piclaw 0.0.19 → 0.0.21

package/.output/server/_chunks/browser.mjs

@@ -1,3 +1,5 @@
+import { t as deviceBus } from "./device-bus.mjs";
+/** In-memory browser tab state, synced with admin UI */
 var state = {
 	tabs: [],
 	activeTabId: null,
@@ -7,11 +9,12 @@ var listeners = /* @__PURE__ */ new Set();
 function getBrowserState() {
 	return state;
 }
-function setBrowserState(incoming) {
+function setBrowserState(incoming, opts) {
 	state.tabs = incoming.tabs;
 	state.activeTabId = incoming.activeTabId;
 	state.rev++;
 	for (const fn of listeners) fn(state);
+	if (!opts?.silent && state.tabs.length > 0) deviceBus.emitDeviceEvent("browser", { state: { ...state } });
 }
 function subscribeBrowser(fn) {
 	listeners.add(fn);

package/.output/server/_chunks/config.mjs

@@ -50,6 +50,10 @@ var CONFIG_DEFS = {
 		env: "BRAVE_API_KEY",
 		default: void 0
 	},
+	sandbox: {
+		env: "SANDBOX",
+		default: void 0
+	},
 	timezone: {
 		env: "TZ",
 		default: Intl.DateTimeFormat().resolvedOptions().timeZone

package/.output/server/_chunks/db.mjs

@@ -20,7 +20,8 @@ async function openDatabase(dbPath) {
 		return openSqlite3Database(dbPath);
 	}
 }
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
+var MINIMUM_VERSION = 4;
 var _db;
 function useDb() {
 	if (!_db) throw new Error("Database not initialized — call initDatabase() first");
@@ -33,7 +34,8 @@ async function createSchema(database) {
       name TEXT,
       last_message_time TEXT,
       channel TEXT,
-      is_group INTEGER DEFAULT 0
+      is_group INTEGER DEFAULT 0,
+      downloads TEXT
     );
     CREATE TABLE IF NOT EXISTS messages (
       id TEXT,
@@ -44,6 +46,7 @@ async function createSchema(database) {
       timestamp TEXT,
       is_from_me INTEGER,
       is_bot_message INTEGER DEFAULT 0,
+      meta TEXT,
       PRIMARY KEY (id, chat_jid),
       FOREIGN KEY (chat_jid) REFERENCES chats(jid)
     );
@@ -115,28 +118,18 @@ async function initDatabase() {
 	const versionFile = path.join(STORE_DIR, "db.version");
 	const dbExists = fs.existsSync(dbPath);
 	const existing = dbExists && fs.existsSync(versionFile) ? Number.parseInt(fs.readFileSync(versionFile, "utf-8").trim(), 10) : 0;
-	if (dbExists && existing !== SCHEMA_VERSION && existing !== SCHEMA_VERSION - 1) throw new Error(`Database schema version mismatch (have v${existing}, need v${SCHEMA_VERSION}). Delete ${STORE_DIR} to recreate.`);
+	if (dbExists && existing < MINIMUM_VERSION) {
+		logger.warn(`Database v${existing} is below minimum v${MINIMUM_VERSION}, recreating`);
+		fs.unlinkSync(dbPath);
+	}
+	const needsCreate = !fs.existsSync(dbPath);
 	const db = await openDatabase(dbPath);
 	await db.exec("PRAGMA journal_mode = WAL");
 	await db.exec("PRAGMA busy_timeout = 5000");
-	if (!dbExists) {
+	if (needsCreate) {
 		await createSchema(db);
 		fs.writeFileSync(versionFile, String(SCHEMA_VERSION));
-	} else if (existing === 2) {
-		await db.exec(`
-      CREATE TABLE IF NOT EXISTS devices (
-        id TEXT PRIMARY KEY,
-        name TEXT NOT NULL,
-        status TEXT NOT NULL,
-        created_at TEXT NOT NULL,
-        approved_at TEXT,
-        last_seen TEXT NOT NULL,
-        ip TEXT
-      );
-    `);
-		fs.writeFileSync(versionFile, String(SCHEMA_VERSION));
-		logger.info("Migrated database v2 → v3 (added devices table)");
-	}
+	} else if (existing < SCHEMA_VERSION) fs.writeFileSync(versionFile, String(SCHEMA_VERSION));
 	_db = db;
 	await _setDbProvider({
 		getConfig,
@@ -147,9 +140,18 @@ async function initDatabase() {
 }
 async function storeMessage(msg) {
 	await useDb().prepare(`
-    INSERT OR REPLACE INTO messages (id, chat_jid, sender, sender_name, content, timestamp, is_from_me, is_bot_message)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(msg.id, msg.chat_jid, msg.sender, msg.sender_name, msg.content, msg.timestamp, msg.is_from_me ? 1 : 0, msg.is_bot_message ? 1 : 0);
+    INSERT OR REPLACE INTO messages (id, chat_jid, sender, sender_name, content, timestamp, is_from_me, is_bot_message, meta)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(msg.id, msg.chat_jid, msg.sender, msg.sender_name, msg.content, msg.timestamp, msg.is_from_me ? 1 : 0, msg.is_bot_message ? 1 : 0, msg.meta ? JSON.stringify(msg.meta) : null);
+}
+/** Parse meta JSON from DB rows */
+function hydrateMeta(rows) {
+	for (const row of rows) if (typeof row.meta === "string") try {
+		row.meta = JSON.parse(row.meta);
+	} catch {
+		row.meta = void 0;
+	}
+	return rows;
 }
 async function getNewMessages(jids, sinceTimestamp, assistantName) {
 	if (jids.length === 0) return {
@@ -163,27 +165,29 @@ async function getNewMessages(jids, sinceTimestamp, assistantName) {
        AND is_bot_message = 0
        AND sender_name != ?
      ORDER BY timestamp ASC`).all(...jids, sinceTimestamp, assistantName);
+	hydrateMeta(rows);
 	return {
 		messages: rows,
 		newTimestamp: rows.length > 0 ? rows[rows.length - 1].timestamp : sinceTimestamp
 	};
 }
 async function getMessagesSince(chatJid, sinceTimestamp, assistantName) {
-	return await useDb().prepare(`SELECT * FROM messages
+	return hydrateMeta(await useDb().prepare(`SELECT * FROM messages
      WHERE chat_jid = ?
        AND timestamp > ?
        AND is_bot_message = 0
        AND sender_name != ?
-     ORDER BY timestamp ASC`).all(chatJid, sinceTimestamp, assistantName);
+     ORDER BY timestamp ASC`).all(chatJid, sinceTimestamp, assistantName));
 }
-async function storeChatMetadata(jid, timestamp, name, channel, isGroup) {
-	await useDb().prepare(`INSERT INTO chats (jid, name, last_message_time, channel, is_group)
-     VALUES (?, ?, ?, ?, ?)
+async function storeChatMetadata(jid, timestamp, name, channel, isGroup, downloads) {
+	await useDb().prepare(`INSERT INTO chats (jid, name, last_message_time, channel, is_group, downloads)
+     VALUES (?, ?, ?, ?, ?, ?)
      ON CONFLICT(jid) DO UPDATE SET
        name = COALESCE(?, name),
        last_message_time = ?,
        channel = COALESCE(?, channel),
-       is_group = COALESCE(?, is_group)`).run(jid, name ?? null, timestamp, channel ?? null, isGroup ? 1 : 0, name ?? null, timestamp, channel ?? null, isGroup != null ? isGroup ? 1 : 0 : null);
+       is_group = COALESCE(?, is_group),
+       downloads = COALESCE(?, downloads)`).run(jid, name ?? null, timestamp, channel ?? null, isGroup ? 1 : 0, downloads ?? null, name ?? null, timestamp, channel ?? null, isGroup != null ? isGroup ? 1 : 0 : null, downloads ?? null);
 }
 async function getAllChats() {
 	return await useDb().prepare("SELECT * FROM chats ORDER BY last_message_time DESC").all();

package/.output/server/_chunks/device-bus.mjs

@@ -0,0 +1,123 @@
+import { a as getDevice } from "./auth.mjs";
+import crypto from "node:crypto";
+/**
+* DeviceBus — in-memory device presence tracking with event broadcasting.
+*
+* Tracks which devices have active SSE connections and broadcasts
+* presence events (connect/disconnect) and custom events to all listeners.
+*/
+var DeviceBus = class {
+	connectionsByDevice = /* @__PURE__ */ new Map();
+	connectionIndex = /* @__PURE__ */ new Map();
+	deviceNames = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	async connect(deviceId, meta) {
+		const conn = {
+			id: crypto.randomUUID(),
+			deviceId,
+			connectedAt: Date.now(),
+			meta
+		};
+		if (!this.deviceNames.has(deviceId)) {
+			const device = await getDevice(deviceId);
+			if (device) this.deviceNames.set(deviceId, device.name);
+		}
+		const isFirstConnection = !this.connectionsByDevice.has(deviceId) || this.connectionsByDevice.get(deviceId).size === 0;
+		let set = this.connectionsByDevice.get(deviceId);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.connectionsByDevice.set(deviceId, set);
+		}
+		set.add(conn);
+		this.connectionIndex.set(conn.id, conn);
+		const name = this.deviceNames.get(deviceId) || "Unknown";
+		if (isFirstConnection) this.emit({
+			type: "device_connected",
+			deviceId,
+			deviceName: name,
+			connections: set.size
+		});
+		this.emit({
+			type: "connection_added",
+			deviceId,
+			connectionId: conn.id,
+			connections: set.size
+		});
+		const unsubscribe = () => this.disconnect(conn.id);
+		return {
+			connectionId: conn.id,
+			unsubscribe
+		};
+	}
+	disconnect(connectionId) {
+		const conn = this.connectionIndex.get(connectionId);
+		if (!conn) return;
+		this.connectionIndex.delete(connectionId);
+		const set = this.connectionsByDevice.get(conn.deviceId);
+		if (set) {
+			set.delete(conn);
+			const remaining = set.size;
+			const name = this.deviceNames.get(conn.deviceId) || "Unknown";
+			this.emit({
+				type: "connection_removed",
+				deviceId: conn.deviceId,
+				connectionId,
+				connections: remaining
+			});
+			if (remaining === 0) {
+				this.connectionsByDevice.delete(conn.deviceId);
+				this.deviceNames.delete(conn.deviceId);
+				this.emit({
+					type: "device_disconnected",
+					deviceId: conn.deviceId,
+					deviceName: name
+				});
+			}
+		}
+	}
+	/** Emit a device event to all connected listeners */
+	emitDeviceEvent(topic, data) {
+		this.emit({
+			type: "device_event",
+			topic,
+			data
+		});
+	}
+	/** Emit a device event to a specific device's connections */
+	emitDeviceEventTo(deviceId, topic, data) {
+		this.emit({
+			type: "device_event",
+			deviceId,
+			topic,
+			data
+		});
+	}
+	/** Send a notification to all connected devices */
+	notify(notification) {
+		this.emitDeviceEvent("notification", notification);
+	}
+	/** Send a notification to a specific device */
+	notifyDevice(deviceId, notification) {
+		this.emitDeviceEventTo(deviceId, "notification", notification);
+	}
+	/** Get snapshot of all connected devices */
+	getConnectedDevices() {
+		const result = [];
+		for (const [deviceId, set] of this.connectionsByDevice) if (set.size > 0) result.push({
+			deviceId,
+			name: this.deviceNames.get(deviceId) || "Unknown",
+			connections: set.size
+		});
+		return result;
+	}
+	/** Subscribe to all presence events */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	emit(event) {
+		for (const listener of this.listeners) listener(event);
+	}
+};
+const deviceBus = new DeviceBus();
+export { deviceBus as t };

package/.output/server/_chunks/dummy.mjs

@@ -1,4 +1,4 @@
-import { a as __require } from "../_runtime.mjs";
+import { i as __require } from "../_runtime.mjs";
 import path from "node:path";
 import { execFile } from "node:child_process";
 /**

package/.output/server/_chunks/logger.mjs

@@ -64,6 +64,7 @@ function log(level, tag, dataOrMsg, msg) {
 	if (currentLevel > LOG_LEVELS[level]) return;
 	const [d, m] = typeof dataOrMsg === "string" ? [void 0, dataOrMsg] : [dataOrMsg, msg];
 	levelMap[level].fn(fmt(level, tag, m, d));
+	if (LOG_LEVELS[level] >= LOG_LEVELS.warn) notifyLog(level, tag, m);
 	try {
 		const entry = JSON.stringify({
 			level: LOG_LEVELS[level],
@@ -102,4 +103,26 @@ function getSystemLogs(opts) {
 	const limit = opts?.limit ?? 100;
 	return entries.slice(offset, offset + limit);
 }
+var levelToNotificationType = {
+	warn: "warning",
+	error: "alert",
+	fatal: "alert"
+};
+var _deviceBus;
+function notifyLog(level, tag, message) {
+	if (!_deviceBus) {
+		import("../_libs/_88.mjs").then((m) => {
+			_deviceBus = m.deviceBus;
+			_deviceBus.notify({
+				title: `[${tag}] ${message}`.slice(0, 120),
+				type: levelToNotificationType[level] ?? "warning"
+			});
+		});
+		return;
+	}
+	_deviceBus.notify({
+		title: `[${tag}] ${message}`.slice(0, 120),
+		type: levelToNotificationType[level] ?? "warning"
+	});
+}
 export { getSystemLogs as n, createLogger as t };

package/.output/server/_chunks/login.mjs

@@ -1,5 +1,5 @@
 import { t as createLogger } from "./logger.mjs";
-import { i as modelRegistry, t as authStorage } from "./session.mjs";
+import { c as authStorage, u as modelRegistry } from "./server.mjs";
 import { randomUUID } from "node:crypto";
 var logger = createLogger("pi:login");
 var LoginSession = class LoginSession {

package/.output/server/_chunks/notes.mjs

@@ -24,10 +24,8 @@ function writeNote(ref, content) {
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	fs.writeFileSync(filePath, content);
 }
-/** Delete a note. Returns true if it existed. Virtual session notes cannot be deleted. */
+/** Delete a note. Returns true if it existed. */
 function deleteNote(ref) {
-	const { category } = parseRef(ref);
-	if (category === VIRTUAL_CATEGORY) return false;
 	const filePath = resolveNotePath(ref);
 	if (!fs.existsSync(filePath)) return false;
 	fs.unlinkSync(filePath);

package/.output/server/_chunks/renderer-template.mjs

@@ -1,5 +1,5 @@
 import { r as HTTPResponse } from "../_libs/h3+rou3+srvx.mjs";
-const rendererTemplate = () => new HTTPResponse("<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta\n      name=\"viewport\"\n      content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover, interactive-widget=resizes-content\"\n    />\n    <title>PiClaw</title>\n    <meta name=\"theme-color\" content=\"#0a0e14\" />\n    <meta name=\"apple-mobile-web-app-capable\" content=\"yes\" />\n    <meta name=\"apple-mobile-web-app-status-bar-style\" content=\"black-translucent\" />\n    <meta name=\"mobile-web-app-capable\" content=\"yes\" />\n    <link rel=\"icon\" type=\"image/svg+xml\" href=\"/icon.svg\" />\n    <link rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/icon-192.png\" />\n    <link rel=\"apple-touch-icon\" href=\"/icon-192.png\" />\n    <link rel=\"manifest\" href=\"/manifest.json\" />\n  </head>\n  <body style=\"background-color: #0a0e14\">\n    <div id=\"app\"></div>\n    <script type=\"module\" src=\"/src/app/index.ts\"><\/script>\n  </body>\n</html>\n", { headers: { "content-type": "text/html; charset=utf-8" } });
+const rendererTemplate = () => new HTTPResponse("<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta\n      name=\"viewport\"\n      content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover, interactive-widget=resizes-content\"\n    />\n    <title>PiClaw</title>\n    <meta name=\"theme-color\" content=\"#0a0e14\" />\n    <meta name=\"apple-mobile-web-app-capable\" content=\"yes\" />\n    <meta name=\"apple-mobile-web-app-status-bar-style\" content=\"black-translucent\" />\n    <meta name=\"mobile-web-app-capable\" content=\"yes\" />\n    <link rel=\"icon\" type=\"image/svg+xml\" href=\"/icon.svg\" />\n    <link rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/icon-192.png\" />\n    <link rel=\"apple-touch-icon\" href=\"/icon-192.png\" />\n    <link rel=\"manifest\" href=\"/manifest.json\" />\n  </head>\n  <body style=\"background-color: #0a0e14\">\n    <div id=\"app\"></div>\n    <script>\n      // Electrobun app-window: persist appToken as cookie for auth bypass\n      var t = new URLSearchParams(location.search).get(\"appToken\");\n      if (t) {\n        var prev = document.cookie.match(/piclaw_app_token=([^;]*)/)?.[1];\n        document.cookie = \"piclaw_app_token=\" + t + \";path=/;SameSite=Lax\";\n        if (prev && prev !== t) location.reload();\n      }\n    <\/script>\n    <script type=\"module\" src=\"/src/app/index.ts\"><\/script>\n  </body>\n</html>\n", { headers: { "content-type": "text/html; charset=utf-8" } });
 function renderIndexHTML(event) {
 	return rendererTemplate(event.req);
 }

package/.output/server/_chunks/sandbox.mjs

@@ -0,0 +1,217 @@
+import { t as DATA_ROOT } from "./config.mjs";
+import { t as createLogger } from "./logger.mjs";
+import { n as Ie, r as ft, t as At } from "../_libs/just-bash+[...].mjs";
+import { t as deviceBus } from "./device-bus.mjs";
+import fs from "fs";
+import path from "path";
+/**
+* Centralized sandbox manager — tracks in-memory filesystem sandboxes.
+*
+* A `Sandbox` owns a single `InMemoryFs` or `OverlayFs` + `Bash` instance.
+* Both PI SDK coding tools (`src/lib/pi/tools/sandbox.ts`) and virtual PTY
+* terminals (`src/lib/pty/virtual.ts`) can share the same sandbox when they
+* belong to the same group, so files created by the agent are visible in the
+* terminal and vice-versa.
+*
+* When `realCwd` is provided, uses `OverlayFs` (copy-on-write over the real
+* group directory) so the agent can read real files while writes stay in memory.
+*
+* State is persisted to `<DATA_ROOT>/sandboxes/<id>/state.json` on destroy
+* and hydrated automatically when a sandbox with the same id is created.
+*/
+var logger = createLogger("sandbox");
+var SANDBOXES_DIR = path.resolve(DATA_ROOT, "sandboxes");
+function defaultCwd(id) {
+	return `/home/${id}`;
+}
+function defaultEnv(id) {
+	return {
+		HOME: `/home/${id}`,
+		PATH: "/usr/bin:/bin"
+	};
+}
+var SandboxManager = class {
+	sandboxes = /* @__PURE__ */ new Map();
+	/** Get or create a sandbox for the given id (typically group folder). */
+	get(id, opts) {
+		let sb = this.sandboxes.get(id);
+		if (!sb) {
+			sb = this._create(id, opts);
+			this.sandboxes.set(id, sb);
+			logger.info({
+				id,
+				cwd: sb.cwd
+			}, "Sandbox created");
+			deviceBus.emitDeviceEvent("sandbox", {
+				action: "created",
+				id
+			});
+		}
+		return sb;
+	}
+	/** Check if a sandbox exists. */
+	has(id) {
+		return this.sandboxes.has(id);
+	}
+	/** Destroy a sandbox, persisting its state to disk. */
+	destroy(id) {
+		const sb = this.sandboxes.get(id);
+		if (!sb) return false;
+		this._persist(sb).catch((err) => {
+			logger.warn({
+				id,
+				err: err.message
+			}, "Failed to persist sandbox state");
+		});
+		this.sandboxes.delete(id);
+		logger.info({ id }, "Sandbox destroyed (state persisted)");
+		deviceBus.emitDeviceEvent("sandbox", {
+			action: "destroyed",
+			id
+		});
+		return true;
+	}
+	/** List all active sandbox ids. */
+	list() {
+		return [...this.sandboxes.keys()];
+	}
+	/** Get info for all active sandboxes. */
+	getAll() {
+		return [...this.sandboxes.values()].map((sb) => ({
+			id: sb.id,
+			cwd: sb.env.PWD || sb.cwd,
+			fileCount: sb.fs.getAllPaths().length,
+			overlay: sb.fs instanceof ft
+		}));
+	}
+	/** Destroy all sandboxes (persists each). */
+	shutdown() {
+		for (const id of this.sandboxes.keys()) this.destroy(id);
+	}
+	_create(id, opts) {
+		const persisted = this._hydrate(id);
+		const cwd = persisted?.cwd ?? opts?.cwd ?? defaultCwd(id);
+		const initialFiles = persisted?.files ?? opts?.files;
+		const useOverlay = !!opts?.realCwd;
+		let memFs;
+		if (useOverlay) {
+			memFs = new ft({
+				root: opts.realCwd,
+				mountPoint: cwd
+			});
+			if (initialFiles) for (const [p, content] of Object.entries(initialFiles)) memFs.writeFileSync(p, content);
+		} else memFs = new Ie(initialFiles);
+		const env = persisted?.env ?? {
+			...defaultEnv(id),
+			PWD: cwd
+		};
+		if (persisted) logger.info({ id }, "Sandbox hydrated from persisted state");
+		if (useOverlay) logger.info({
+			id,
+			root: opts.realCwd,
+			mountPoint: cwd
+		}, "Sandbox using OverlayFs");
+		const bash = new At({
+			cwd: env.PWD || cwd,
+			fs: memFs
+		});
+		const realCwd = opts?.realCwd;
+		const sandbox = {
+			id,
+			fs: memFs,
+			cwd,
+			env,
+			realCwd,
+			async exec(command, execOpts) {
+				const result = await bash.exec(command, {
+					cwd: execOpts?.cwd || env.PWD || sandbox.cwd,
+					env
+				});
+				if (result.env.PWD) sandbox.cwd = result.env.PWD;
+				for (const [k, v] of Object.entries(result.env)) env[k] = v;
+				return {
+					stdout: result.stdout || "",
+					stderr: result.stderr || "",
+					exitCode: result.exitCode ?? 0
+				};
+			},
+			async writeBack() {
+				if (!realCwd || !(memFs instanceof ft)) return {
+					written: 0,
+					deleted: 0
+				};
+				const canonicalRoot = fs.realpathSync(realCwd);
+				const mountPoint = memFs.getMountPoint();
+				const overlayPaths = new Set(memFs.getAllPaths());
+				const safeRealPath = (virtualPath) => {
+					const rel = virtualPath.slice(mountPoint.length);
+					if (!rel && virtualPath !== mountPoint) return null;
+					const real = path.resolve(canonicalRoot, "." + (rel || "/"));
+					if (!real.startsWith(canonicalRoot + path.sep) && real !== canonicalRoot) return null;
+					return real;
+				};
+				let written = 0;
+				let deleted = 0;
+				for (const vPath of overlayPaths) {
+					if (!vPath.startsWith(mountPoint)) continue;
+					const realP = safeRealPath(vPath);
+					if (!realP) continue;
+					const stat = await memFs.lstat(vPath);
+					if (stat.isFile) {
+						const content = await memFs.readFile(vPath);
+						fs.mkdirSync(path.dirname(realP), { recursive: true });
+						fs.writeFileSync(realP, content);
+						written++;
+					} else if (stat.isDirectory) fs.mkdirSync(realP, { recursive: true });
+				}
+				logger.info({
+					id,
+					written
+				}, "Sandbox writeBack complete");
+				return {
+					written,
+					deleted
+				};
+			}
+		};
+		return sandbox;
+	}
+	/** Serialize sandbox state to disk. */
+	async _persist(sb) {
+		try {
+			const files = {};
+			const allPaths = sb.fs.getAllPaths();
+			for (const p of allPaths) if ((await sb.fs.lstat(p)).isFile) files[p] = await sb.fs.readFile(p);
+			const state = {
+				cwd: sb.env.PWD || sb.cwd,
+				env: sb.env,
+				files
+			};
+			const dir = path.join(SANDBOXES_DIR, sb.id);
+			fs.mkdirSync(dir, { recursive: true });
+			fs.writeFileSync(path.join(dir, "state.json"), JSON.stringify(state));
+		} catch (err) {
+			logger.warn({
+				id: sb.id,
+				err: err.message
+			}, "Failed to persist sandbox state");
+		}
+	}
+	/** Try to load persisted state from disk. */
+	_hydrate(id) {
+		try {
+			const stateFile = path.join(SANDBOXES_DIR, id, "state.json");
+			if (!fs.existsSync(stateFile)) return void 0;
+			const raw = fs.readFileSync(stateFile, "utf-8");
+			return JSON.parse(raw);
+		} catch (err) {
+			logger.warn({
+				id,
+				err: err.message
+			}, "Failed to hydrate sandbox state");
+			return;
+		}
+	}
+};
+const sandboxManager = new SandboxManager();
+export { sandboxManager as t };