sandboxedjs 0.1.35 → 0.1.37

package/dist/agent.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agent/backend.ts","../src/agent/prompts.ts"],"names":[],"mappings":";;;AAmCA,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,IAAA;AAAA,EAAM,KAAA;AAAA,EACvE,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM,OAAA;AAAA,EAAS,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,KAAA;AAAA,EACpE,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,IAAA;AAAA,EAAM;AACpC,CAAC,CAAA;AAED,IAAM,iBAAA,GAA4C;AAAA,EAChD,GAAA,EAAK,WAAA;AAAA,EAAa,GAAA,EAAK,YAAA;AAAA,EAAc,IAAA,EAAM,YAAA;AAAA,EAAc,GAAA,EAAK,WAAA;AAAA,EAC9D,IAAA,EAAM,YAAA;AAAA,EAAc,GAAA,EAAK,eAAA;AAAA,EAAiB,GAAA,EAAK,iBAAA;AAAA,EAC/C,IAAA,EAAM,kBAAA;AAAA,EAAoB,EAAA,EAAI,iBAAA;AAAA,EAAmB,EAAA,EAAI,mBAAA;AAAA,EACrD,IAAA,EAAM,WAAA;AAAA,EAAa,GAAA,EAAK,UAAA;AAAA,EAAY,EAAA,EAAI,eAAA;AAAA,EAAiB,IAAA,EAAM;AACjE,CAAA;AAEA,SAAS,YAAY,QAAA,EAA0B;AAC7C,EAAA,MAAM,OAAO,QAAA,CAAS,KAAA,CAAM,SAAS,WAAA,CAAY,GAAG,IAAI,CAAC,CAAA;AACzD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAChC,EAAA,OAAO,GAAA,GAAM,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAC,CAAA,CAAE,aAAY,GAAI,EAAA;AACvD;AAOA,SAAS,aAAa,OAAA,EAAyB;AAC7C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AAC1C,IAAA,MAAM,EAAA,GAAK,QAAQ,CAAC,CAAA;AACpB,IAAA,IAAI,OAAO,GAAA,EAAK;AACd,MAAA,IAAI,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAA,KAAM,GAAA,EAAK;AAC1B,QAAA,CAAA,IAAK,CAAA;AACL,QAAA,IAAI,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAA,KAAM,GAAA,EAAK;AAC1B,UAAA,CAAA,IAAK,CAAA;AACL,UAAA,GAAA,IAAO,UAAA;AAAA,QACT,CAAA,MAAO;AACL,UAAA,GAAA,IAAO,IAAA;AAAA,QACT;AAAA,MACF,CAAA,MAAO;AACL,QAAA,GAAA,IAAO,OAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,GAAA,EAAK;AACrB,MAAA,GAAA,IAAO,MAAA;AAAA,IACT,CAAA,MAAO;AACL,MAAA,GAAA,IAAO,EAAA,CAAG,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA;AAAA,IAC/C;AAAA,EACF;AACA,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,CAAG,CAAA;AAC9B;AAEA,SAAS,QAAA,CAAS,MAAc,IAAA,EAAsB;AACpD,EAAA,OAAO,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,GAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAChE;AAGA,SAAS,gBAAgB,QAAA,EAAiC;AACxD,EAAA,OAAO,SAAS,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,0BAA0B,QAAQ,CAAA,CAAA;AAC7E;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAEA,SAAS,WAAA,CAAY,MAAkB,QAAA,EAA2B;AAChE,EAAA,IAAI,kBAAkB,GAAA,CAAI,WAAA,CAAY,QAAQ,CAAC,GAAG,OAAO,IAAA;AACzD,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA;AACpC,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,EAAQ,IAAI,IAAA,KAAS,GAAG,OAAO,IAAA;AAClD,EAAA,OAAO,KAAA;AACT;AAqBO,IAAM,qBAAN,MAA6D;AAAA,EAUlE,WAAA,CACW,SAAA,EACT,OAAA,GAAqC,EAAC,EACtC;AAFS,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAGT,IAAA,IAAA,CAAK,EAAA,GAAK,OAAA,CAAQ,EAAA,IAAM,CAAA,YAAA,EAAe,IAAA,CAAK,MAAA,EAAO,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAC9E,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACtC,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,GAAA;AAChD,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACpD,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,GAAA;AAChD,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,mBAAA,IAAuB,GAAA;AAAA,EAC5D;AAAA,EAVW,SAAA;AAAA,EAVF,EAAA;AAAA,EAEQ,GAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,mBAAA;AAAA,EAejB,MAAM,QAAQ,OAAA,EAA2C;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,OAAA,EAAS;AAAA,QAChD,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,SAAS,MAAA,CAAO,MAAA;AACpB,MAAA,IAAI,SAAA,GAAY,KAAA;AAChB,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,IAAA,CAAK,cAAA,EAAgB;AAEvC,QAAA,MAAA,GAAS,CAAA,8BAAA,EAAiC,KAAK,cAAc,CAAA;AAAA,EAAiB,MAAA,CAAO,KAAA,CAAM,CAAC,IAAA,CAAK,cAAc,CAAC,CAAA,CAAA;AAChH,QAAA,SAAA,GAAY,IAAA;AAAA,MACd;AACA,MAAA,IAAI,OAAO,QAAA,EAAU;AACnB,QAAA,MAAA,IAAU;AAAA,yBAAA,EAA8B,KAAK,SAAS,CAAA,GAAA,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,CAAO,UAAU,SAAA,EAAU;AAAA,IACxD,SAAS,KAAA,EAAO;AAGd,MAAA,OAAO,EAAE,QAAQ,YAAA,CAAa,KAAK,GAAG,QAAA,EAAU,CAAA,EAAG,WAAW,KAAA,EAAM;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAM,GAAG,IAAA,EAAiC;AACxC,IAAA,MAAM,OAAA,GAAU,gBAAgB,IAAI,CAAA;AACpC,IAAA,IAAI,OAAA,EAAS,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,UAAU,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,QAAQ,IAAI,CAAA;AACpD,MAAA,MAAM,QAAoB,EAAC;AAC3B,MAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,QAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAChC,QAAA,IAAI;AACF,UAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,KAAK,IAAI,CAAA;AAC/C,UAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,UAAA,KAAA,CAAM,IAAA,CAAK;AAAA,YACT,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA,GAAM,IAAA;AAAA,YAC3B,MAAA,EAAQ,KAAA;AAAA,YACR,IAAA,EAAM,KAAA,GAAQ,KAAA,CAAA,GAAY,KAAA,CAAM,IAAA;AAAA,YAChC,aAAa,IAAI,IAAA,CAAK,KAAA,CAAM,OAAO,EAAE,WAAA;AAAY,WAClD,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAEN,UAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,QAC3B;AAAA,MACF;AACA,MAAA,OAAO,EAAE,KAAA,EAAM;AAAA,IACjB,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,CAAK,QAAA,EAAkB,MAAA,GAAS,GAAG,KAAA,EAAqC;AAC5E,IAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,IAAA,IAAI,OAAA,EAAS,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAS,QAAQ,CAAA;AACrD,MAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,WAAA,CAAY,QAAQ,CAAC,CAAA;AACxD,MAAA,IAAI,WAAA,CAAY,GAAA,EAAK,QAAQ,CAAA,EAAG;AAC9B,QAAA,OAAO,EAAE,OAAA,EAAS,GAAA,EAAK,QAAA,EAAU,YAAY,0BAAA,EAA2B;AAAA,MAC1E;AACA,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AACzC,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE7B,MAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA,KAAM,EAAA,EAAI,KAAA,CAAM,GAAA,EAAI;AAClE,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAA;AAChC,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,CAAI,KAAA,CAAM,QAAQ,KAAA,IAAS,KAAA,IAAS,KAAK,gBAAA,CAAiB,CAAA;AAC3E,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,KAAA,CAAM,OAAO,GAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,QAC1C,UAAU,QAAA,IAAY,YAAA;AAAA,QACtB,YAAY,KAAA,CAAM,MAAA;AAAA,QAClB,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS,GAAA;AAAA,QACT,UAAA,EAAY,GAAA,GAAM,KAAA,CAAM,MAAA,GAAS,GAAA,GAAM,KAAA;AAAA,OACzC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,QAAA,EAA0C;AACtD,IAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,IAAA,IAAI,OAAA,EAAS,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAS,QAAQ,CAAA;AACrD,MAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,WAAA,CAAY,QAAQ,CAAC,CAAA;AACxD,MAAA,IAAI,WAAA,CAAY,GAAA,EAAK,QAAQ,CAAA,EAAG;AAC9B,QAAA,OAAO,EAAE,MAAM,EAAE,OAAA,EAAS,KAAK,QAAA,EAAU,QAAA,IAAY,4BAA2B,EAAE;AAAA,MACpF;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,EAAE,OAAA,EAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,EAAG,QAAA,EAAU,QAAA,IAAY,YAAA;AAAa,OACrF;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,QAAA,EAAkB,OAAA,EAAuC;AACnE,IAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,IAAA,IAAI,OAAA,EAAS,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,SAAS,KAAA,CAAM,CAAA,EAAG,SAAS,WAAA,CAAY,GAAG,CAAC,CAAA,IAAK,GAAA;AAC/D,MAAA,MAAM,IAAA,CAAK,UAAU,EAAA,CAAG,KAAA,CAAM,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AACzD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAA,CAAU,UAAU,OAAO,CAAA;AACnD,MAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAAA,IAC1B,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,CACJ,QAAA,EACA,SAAA,EACA,SAAA,EACA,aAAa,KAAA,EACQ;AACrB,IAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,IAAA,IAAI,OAAA,EAAS,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,IAAA,CAAK,UAAU,EAAA,CAAG,QAAA,CAAS,UAAU,MAAM,CAAA;AAC9D,MAAA,MAAM,WAAA,GAAc,cAAc,EAAA,GAAK,CAAA,GAAI,KAAK,KAAA,CAAM,SAAS,EAAE,MAAA,GAAS,CAAA;AAC1E,MAAA,IAAI,gBAAgB,CAAA,EAAG;AACrB,QAAA,OAAO,EAAE,OAAO,CAAA,oBAAA,EAAuB,QAAQ,KAAK,IAAA,CAAK,SAAA,CAAU,SAAS,CAAC,CAAA,CAAA,EAAG;AAAA,MAClF;AACA,MAAA,IAAI,WAAA,GAAc,CAAA,IAAK,CAAC,UAAA,EAAY;AAClC,QAAA,OAAO;AAAA,UACL,KAAA,EACE,CAAA,eAAA,EAAkB,WAAW,CAAA,UAAA,EAAa,QAAQ,CAAA,yEAAA;AAAA,SAEtD;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,UAAA,GACZ,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,IAAA,CAAK,SAAS,CAAA,GACpC,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,SAAS,CAAA;AACrC,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAA,CAAU,UAAU,OAAO,CAAA;AACnD,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,WAAA,EAAY;AAAA,IACvC,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,QAAA,EAAyC;AACpD,IAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,IAAA,IAAI,OAAA,EAAS,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,EAAA,CAAG,QAAA,EAAU,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,CAAA;AACtE,MAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAAA,IAC1B,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,CAAK,OAAA,EAAiB,IAAA,GAAO,GAAA,EAA0B;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,GAAG,IAAI,OAAA,GAAU,QAAA,CAAS,IAAA,EAAM,OAAO,CAAC,CAAA;AACxF,MAAA,MAAM,QAAoB,EAAC;AAC3B,MAAA,IAAI,SAAA,GAAY,KAAA;AAChB,MAAA,KAAA,MAAW,aAAa,MAAM,IAAA,CAAK,UAAU,EAAA,CAAG,IAAA,CAAK,IAAI,CAAA,EAAG;AAC1D,QAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AAC9B,QAAA,IAAI,KAAA,CAAM,MAAA,IAAU,IAAA,CAAK,cAAA,EAAgB;AACvC,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,SAAA,EAAW,CAAA;AAAA,MAChC;AACA,MAAA,OAAO,EAAE,OAAO,SAAA,EAAU;AAAA,IAC5B,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,CACJ,OAAA,EACA,IAAA,EACA,MACA,QAAA,EACqB;AACrB,IAAA,MAAM,OAAO,IAAA,IAAQ,GAAA;AACrB,IAAA,MAAM,GAAA,GAAM,YAAY,IAAA,CAAK,mBAAA;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,GACX,YAAA,CAAa,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA,GACrD,IAAA;AACJ,MAAA,MAAM,UAAuB,EAAC;AAC9B,MAAA,IAAI,SAAA,GAAY,KAAA;AAChB,MAAA,KAAA,EAAO,KAAA,MAAW,aAAa,MAAM,IAAA,CAAK,UAAU,EAAA,CAAG,IAAA,CAAK,IAAI,CAAA,EAAG;AACjE,QAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,EAAG;AACvC,QAAA,IAAI,GAAA;AACJ,QAAA,IAAI;AACF,UAAA,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAS,SAAS,CAAA;AAAA,QAClD,CAAA,CAAA,MAAQ;AACN,UAAA;AAAA,QACF;AACA,QAAA,IAAI,WAAA,CAAY,GAAA,EAAK,SAAS,CAAA,EAAG;AACjC,QAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA,CAAE,MAAM,IAAI,CAAA;AACtD,QAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,UAAA,IAAI,CAAC,KAAA,CAAM,CAAC,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG;AACjC,UAAA,IAAI,OAAA,CAAQ,UAAU,GAAA,EAAK;AACzB,YAAA,SAAA,GAAY,IAAA;AACZ,YAAA,MAAM,KAAA;AAAA,UACR;AACA,UAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,GAAI,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,CAAC,CAAA,EAAG,CAAA;AAAA,QAC/D;AAAA,MACF;AACA,MAAA,OAAO,EAAE,SAAS,SAAA,EAAU;AAAA,IAC9B,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAK,CAAA,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,KAAA,EAAmE;AACnF,IAAA,MAAM,UAAgC,EAAC;AACvC,IAAA,KAAA,MAAW,CAAC,QAAA,EAAU,OAAO,CAAA,IAAK,KAAA,EAAO;AACvC,MAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,EAAG;AAC7B,QAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,gBAAgB,CAAA;AACtD,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,SAAS,KAAA,CAAM,CAAA,EAAG,SAAS,WAAA,CAAY,GAAG,CAAC,CAAA,IAAK,GAAA;AAC/D,QAAA,MAAM,IAAA,CAAK,UAAU,EAAA,CAAG,KAAA,CAAM,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AACzD,QAAA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAA,CAAU,UAAU,OAAO,CAAA;AACnD,QAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,MAAM,CAAA;AAAA,MAC9C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,qBAAqB,CAAA;AAAA,MAC7D;AAAA,IACF;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,KAAA,EAAkD;AACpE,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,YAAY,KAAA,EAAO;AAC5B,MAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,EAAG;AAC7B,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AACrE,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,KAAK,QAAQ,CAAA;AACnD,QAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,UAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AACrE,UAAA;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,UACX,IAAA,EAAM,QAAA;AAAA,UACN,SAAS,MAAM,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,SAAS,QAAQ,CAAA;AAAA,UAClD,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH,CAAA,CAAA,MAAQ;AACN,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,IAAA,EAAM,KAAA,EAAO,kBAAkB,CAAA;AAAA,MACzE;AAAA,IACF;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACrYO,IAAM,0BAAA,GAA6B,CAAA;;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA,oEAAA;AA4DnC,IAAM,mBAAA,GAAsB,CAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sEAAA;AAkCnC,SAAS,KAAA,CAAM,IAAA,EAAc,WAAA,EAAqB,IAAA,EAA4B;AAC5E,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAAS,CAAA;AAAA,MAAA,EAAc,IAAI;AAAA,aAAA,EAAkB,WAAW;AAAA;;AAAA,EAAY,IAAI;AAAA;AAAA,GAC1E;AACF;AASO,IAAM,cAAA,GAAiC;AAAA,EAC5C,KAAA;AAAA,IACE,cAAA;AAAA,IACA,6GAAA;AAAA,IACA,CAAA;;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA,mEAAA;AAAA,GA8CF;AAAA,EACA,KAAA;AAAA,IACE,cAAA;AAAA,IACA,4HAAA;AAAA,IACA,CAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA,6CAAA;AAAA,GA+BF;AAAA,EACA,KAAA;AAAA,IACE,aAAA;AAAA,IACA,mGAAA;AAAA,IACA,CAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,6BAAA;AAAA,GAaF;AAAA,EACA,KAAA;AAAA,IACE,eAAA;AAAA,IACA,sGAAA;AAAA,IACA,CAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wEAAA;AAAA;AAcJ;AAMO,SAAS,mBAAA,CACd,OAAA,GAAgC,EAAC,EACzB;AACR,EAAA,MAAM,KAAA,GAAQ,CAAC,0BAAA,EAA4B,mBAAmB,CAAA;AAC9D,EAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EAAO;AAC5B,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA;;AAAA,EAAe,cAAA,CAAe,GAAA;AAAA,QAC5B,CAAC,KAAA,KAAU,CAAA,GAAA,EAAM,KAAA,CAAM,IAAI;;AAAA,EAAO,MAAM,WAAW;;AAAA,EAAO,KAAA,CAAM,QAAQ,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA,CAAE,MAAM,CAAA;AAAA,OAClG,CAAE,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,KAChB;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAC1B;AASA,eAAsB,oBAAA,CACpB,SAAA,EACA,SAAA,GAAY,SAAA,EACK;AACjB,EAAA,KAAA,MAAW,SAAS,cAAA,EAAgB;AAClC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AACtC,IAAA,MAAM,UAAU,EAAA,CAAG,KAAA,CAAM,KAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,IAAA,MAAM,UAAU,EAAA,CAAG,SAAA,CAAU,GAAG,GAAG,CAAA,SAAA,CAAA,EAAa,MAAM,OAAO,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,SAAA;AACT","file":"agent.cjs","sourcesContent":["import type { Container } from \"../container/container.js\";\nimport type {\n  DeleteResult,\n  EditResult,\n  ExecuteResponse,\n  FileDownloadResponse,\n  FileInfo,\n  FileUploadResponse,\n  GlobResult,\n  GrepMatch,\n  GrepResult,\n  LsResult,\n  ReadRawResult,\n  ReadResult,\n  SandboxBackendProtocolV2,\n  WriteResult,\n} from \"./protocol.js\";\n\nexport interface SandboxedJsBackendOptions {\n  /** Identity reported to Deep Agents. Defaults to a random per-instance id. */\n  id?: string;\n  /** Working directory every `execute` starts in. Defaults to the container's. */\n  cwd?: string;\n  /** Wall-clock limit for a single `execute`. Default 120_000ms. */\n  timeoutMs?: number;\n  /** Characters of combined output kept per command before truncating. Default 30_000. */\n  maxOutputChars?: number;\n  /** Default line window for `read`. Default 500. */\n  defaultReadLimit?: number;\n  /** Cap on entries returned by `glob`. Default 1_000. */\n  maxGlobResults?: number;\n  /** Cap on matches returned by `grep` when the caller gives no `maxCount`. Default 200. */\n  defaultGrepMaxCount?: number;\n}\n\nconst BINARY_EXTENSIONS = new Set([\n  \"png\", \"jpg\", \"jpeg\", \"gif\", \"webp\", \"ico\", \"bmp\", \"pdf\", \"zip\", \"gz\", \"tar\",\n  \"wasm\", \"so\", \"dylib\", \"dll\", \"exe\", \"woff\", \"woff2\", \"ttf\", \"otf\", \"mp3\",\n  \"mp4\", \"mov\", \"avi\", \"bin\", \"db\", \"sqlite\",\n]);\n\nconst MIME_BY_EXTENSION: Record<string, string> = {\n  png: \"image/png\", jpg: \"image/jpeg\", jpeg: \"image/jpeg\", gif: \"image/gif\",\n  webp: \"image/webp\", svg: \"image/svg+xml\", pdf: \"application/pdf\",\n  json: \"application/json\", js: \"text/javascript\", ts: \"text/x-typescript\",\n  html: \"text/html\", css: \"text/css\", md: \"text/markdown\", wasm: \"application/wasm\",\n};\n\nfunction extensionOf(filePath: string): string {\n  const base = filePath.slice(filePath.lastIndexOf(\"/\") + 1);\n  const dot = base.lastIndexOf(\".\");\n  return dot > 0 ? base.slice(dot + 1).toLowerCase() : \"\";\n}\n\n/**\n * `**` crosses `/`, `*` and `?` do not, and a leading `**\\/` also matches\n * depth zero — the same subset of glob semantics Deep Agents' own backends\n * document for their `glob` tool.\n */\nfunction globToRegExp(pattern: string): RegExp {\n  let out = \"\";\n  for (let i = 0; i < pattern.length; i += 1) {\n    const ch = pattern[i];\n    if (ch === \"*\") {\n      if (pattern[i + 1] === \"*\") {\n        i += 1;\n        if (pattern[i + 1] === \"/\") {\n          i += 1;\n          out += \"(?:.*/)?\";\n        } else {\n          out += \".*\";\n        }\n      } else {\n        out += \"[^/]*\";\n      }\n    } else if (ch === \"?\") {\n      out += \"[^/]\";\n    } else {\n      out += ch.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    }\n  }\n  return new RegExp(`^${out}$`);\n}\n\nfunction joinPath(base: string, name: string): string {\n  return base.endsWith(\"/\") ? `${base}${name}` : `${base}/${name}`;\n}\n\n/** Deep Agents' file tools take absolute paths; a relative one is a caller bug. */\nfunction requireAbsolute(filePath: string): string | null {\n  return filePath.startsWith(\"/\") ? null : `Path must be absolute: ${filePath}`;\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction looksBinary(data: Uint8Array, filePath: string): boolean {\n  if (BINARY_EXTENSIONS.has(extensionOf(filePath))) return true;\n  const window = data.subarray(0, 1024);\n  for (const byte of window) if (byte === 0) return true;\n  return false;\n}\n\n/**\n * A sandboxedjs {@link Container} behind the LangChain Deep Agents backend\n * contract.\n *\n * Deep Agents' `BaseSandbox` derives its filesystem tools from `execute` by\n * shelling out to `find`, `stat`, `awk` and `grep`. This backend answers them\n * from {@link Container.fs} instead: the container's filesystem is an in-process\n * object, so going through the shell would only add parsing and quoting bugs\n * between the agent and data already in memory. `execute` still runs the real\n * POSIX shell, so agent-authored commands behave the way the agent expects.\n *\n * ```ts\n * const box = await createContainer({ cwd: \"/app\", network: { allowOutbound: true } });\n * const agent = createDeepAgent({ model, backend: new SandboxedJsBackend(box) });\n * ```\n *\n * The instance holds the container but does not own it: call\n * {@link Container.dispose} yourself when the run is over.\n */\nexport class SandboxedJsBackend implements SandboxBackendProtocolV2 {\n  readonly id: string;\n\n  private readonly cwd: string | undefined;\n  private readonly timeoutMs: number;\n  private readonly maxOutputChars: number;\n  private readonly defaultReadLimit: number;\n  private readonly maxGlobResults: number;\n  private readonly defaultGrepMaxCount: number;\n\n  constructor(\n    readonly container: Container,\n    options: SandboxedJsBackendOptions = {},\n  ) {\n    this.id = options.id ?? `sandboxedjs-${Math.random().toString(36).slice(2, 10)}`;\n    this.cwd = options.cwd;\n    this.timeoutMs = options.timeoutMs ?? 120_000;\n    this.maxOutputChars = options.maxOutputChars ?? 30_000;\n    this.defaultReadLimit = options.defaultReadLimit ?? 500;\n    this.maxGlobResults = options.maxGlobResults ?? 1_000;\n    this.defaultGrepMaxCount = options.defaultGrepMaxCount ?? 200;\n  }\n\n  async execute(command: string): Promise<ExecuteResponse> {\n    try {\n      const result = await this.container.exec(command, {\n        cwd: this.cwd,\n        timeoutMs: this.timeoutMs,\n      });\n      let output = result.output;\n      let truncated = false;\n      if (output.length > this.maxOutputChars) {\n        /* Keep the tail: a failing command's diagnosis is at the end. */\n        output = `[output truncated to the last ${this.maxOutputChars} characters]\\n${output.slice(-this.maxOutputChars)}`;\n        truncated = true;\n      }\n      if (result.timedOut) {\n        output += `\\n[command timed out after ${this.timeoutMs}ms]`;\n      }\n      return { output, exitCode: result.exitCode, truncated };\n    } catch (error) {\n      /* A container-level failure is still a tool result: the agent has to be\n       * able to read what went wrong and try something else. */\n      return { output: errorMessage(error), exitCode: 1, truncated: false };\n    }\n  }\n\n  async ls(path: string): Promise<LsResult> {\n    const invalid = requireAbsolute(path);\n    if (invalid) return { error: invalid };\n    try {\n      const entries = await this.container.fs.readdir(path);\n      const files: FileInfo[] = [];\n      for (const name of entries) {\n        const full = joinPath(path, name);\n        try {\n          const stats = await this.container.fs.stat(full);\n          const isDir = stats.isDirectory();\n          files.push({\n            path: isDir ? `${full}/` : full,\n            is_dir: isDir,\n            size: isDir ? undefined : stats.size,\n            modified_at: new Date(stats.mtimeMs).toISOString(),\n          });\n        } catch {\n          /* A dangling symlink still belongs in the listing. */\n          files.push({ path: full });\n        }\n      }\n      return { files };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async read(filePath: string, offset = 0, limit?: number): Promise<ReadResult> {\n    const invalid = requireAbsolute(filePath);\n    if (invalid) return { error: invalid };\n    try {\n      const raw = await this.container.fs.readFile(filePath);\n      const mimeType = MIME_BY_EXTENSION[extensionOf(filePath)];\n      if (looksBinary(raw, filePath)) {\n        return { content: raw, mimeType: mimeType ?? \"application/octet-stream\" };\n      }\n      const text = new TextDecoder().decode(raw);\n      const lines = text.split(\"\\n\");\n      /* A trailing newline yields a final empty element that is not a line. */\n      if (lines.length > 1 && lines[lines.length - 1] === \"\") lines.pop();\n      const start = Math.max(0, offset);\n      const end = Math.min(lines.length, start + (limit ?? this.defaultReadLimit));\n      return {\n        content: lines.slice(start, end).join(\"\\n\"),\n        mimeType: mimeType ?? \"text/plain\",\n        totalLines: lines.length,\n        startLine: start,\n        endLine: end,\n        nextOffset: end < lines.length ? end : undefined,\n      };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async readRaw(filePath: string): Promise<ReadRawResult> {\n    const invalid = requireAbsolute(filePath);\n    if (invalid) return { error: invalid };\n    try {\n      const raw = await this.container.fs.readFile(filePath);\n      const mimeType = MIME_BY_EXTENSION[extensionOf(filePath)];\n      if (looksBinary(raw, filePath)) {\n        return { data: { content: raw, mimeType: mimeType ?? \"application/octet-stream\" } };\n      }\n      return {\n        data: { content: new TextDecoder().decode(raw), mimeType: mimeType ?? \"text/plain\" },\n      };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async write(filePath: string, content: string): Promise<WriteResult> {\n    const invalid = requireAbsolute(filePath);\n    if (invalid) return { error: invalid };\n    try {\n      const parent = filePath.slice(0, filePath.lastIndexOf(\"/\")) || \"/\";\n      await this.container.fs.mkdir(parent, { recursive: true });\n      await this.container.fs.writeFile(filePath, content);\n      return { path: filePath };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async edit(\n    filePath: string,\n    oldString: string,\n    newString: string,\n    replaceAll = false,\n  ): Promise<EditResult> {\n    const invalid = requireAbsolute(filePath);\n    if (invalid) return { error: invalid };\n    try {\n      const text = await this.container.fs.readFile(filePath, \"utf8\");\n      const occurrences = oldString === \"\" ? 0 : text.split(oldString).length - 1;\n      if (occurrences === 0) {\n        return { error: `String not found in ${filePath}: ${JSON.stringify(oldString)}` };\n      }\n      if (occurrences > 1 && !replaceAll) {\n        return {\n          error:\n            `String appears ${occurrences} times in ${filePath}. ` +\n            `Provide more surrounding context to make it unique, or pass replaceAll.`,\n        };\n      }\n      const updated = replaceAll\n        ? text.split(oldString).join(newString)\n        : text.replace(oldString, newString);\n      await this.container.fs.writeFile(filePath, updated);\n      return { path: filePath, occurrences };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async delete(filePath: string): Promise<DeleteResult> {\n    const invalid = requireAbsolute(filePath);\n    if (invalid) return { error: invalid };\n    try {\n      await this.container.fs.rm(filePath, { recursive: true, force: false });\n      return { path: filePath };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async glob(pattern: string, path = \"/\"): Promise<GlobResult> {\n    try {\n      const matcher = globToRegExp(pattern.startsWith(\"/\") ? pattern : joinPath(path, pattern));\n      const files: FileInfo[] = [];\n      let truncated = false;\n      for (const candidate of await this.container.fs.walk(path)) {\n        if (!matcher.test(candidate)) continue;\n        if (files.length >= this.maxGlobResults) {\n          truncated = true;\n          break;\n        }\n        files.push({ path: candidate });\n      }\n      return { files, truncated };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async grep(\n    pattern: string,\n    path?: string | null,\n    glob?: string | null,\n    maxCount?: number | null,\n  ): Promise<GrepResult> {\n    const root = path ?? \"/\";\n    const cap = maxCount ?? this.defaultGrepMaxCount;\n    try {\n      const filter = glob\n        ? globToRegExp(glob.includes(\"/\") ? glob : `**/${glob}`)\n        : null;\n      const matches: GrepMatch[] = [];\n      let truncated = false;\n      outer: for (const candidate of await this.container.fs.walk(root)) {\n        if (filter && !filter.test(candidate)) continue;\n        let raw: Uint8Array;\n        try {\n          raw = await this.container.fs.readFile(candidate);\n        } catch {\n          continue; /* Directories and unreadable entries are not grep targets. */\n        }\n        if (looksBinary(raw, candidate)) continue;\n        const lines = new TextDecoder().decode(raw).split(\"\\n\");\n        for (let i = 0; i < lines.length; i += 1) {\n          if (!lines[i].includes(pattern)) continue;\n          if (matches.length >= cap) {\n            truncated = true;\n            break outer;\n          }\n          matches.push({ path: candidate, line: i + 1, text: lines[i] });\n        }\n      }\n      return { matches, truncated };\n    } catch (error) {\n      return { error: errorMessage(error) };\n    }\n  }\n\n  async uploadFiles(files: Array<[string, Uint8Array]>): Promise<FileUploadResponse[]> {\n    const results: FileUploadResponse[] = [];\n    for (const [filePath, content] of files) {\n      if (!filePath.startsWith(\"/\")) {\n        results.push({ path: filePath, error: \"invalid_path\" });\n        continue;\n      }\n      try {\n        const parent = filePath.slice(0, filePath.lastIndexOf(\"/\")) || \"/\";\n        await this.container.fs.mkdir(parent, { recursive: true });\n        await this.container.fs.writeFile(filePath, content);\n        results.push({ path: filePath, error: null });\n      } catch {\n        results.push({ path: filePath, error: \"permission_denied\" });\n      }\n    }\n    return results;\n  }\n\n  async downloadFiles(paths: string[]): Promise<FileDownloadResponse[]> {\n    const results: FileDownloadResponse[] = [];\n    for (const filePath of paths) {\n      if (!filePath.startsWith(\"/\")) {\n        results.push({ path: filePath, content: null, error: \"invalid_path\" });\n        continue;\n      }\n      try {\n        const stats = await this.container.fs.stat(filePath);\n        if (stats.isDirectory()) {\n          results.push({ path: filePath, content: null, error: \"is_directory\" });\n          continue;\n        }\n        results.push({\n          path: filePath,\n          content: await this.container.fs.readFile(filePath),\n          error: null,\n        });\n      } catch {\n        results.push({ path: filePath, content: null, error: \"file_not_found\" });\n      }\n    }\n    return results;\n  }\n}\n","import type { Container } from \"../container/container.js\";\n\n/**\n * What the agent's environment actually is.\n *\n * Every claim here is a behaviour this package implements. Coding agents fail\n * in a sandbox mostly by assuming a host they do not have — reaching for\n * `docker`, `sudo`, `systemctl`, `curl localhost:3000`, or a background process\n * that outlives the turn. Saying plainly what exists is what stops that.\n */\nexport const SANDBOX_ENVIRONMENT_PROMPT = `# Your environment\n\nYou are working inside a sandboxedjs container: a Linux-like environment that\nruns entirely inside a JavaScript process. There is no Docker, no VM, and no\nhost machine you can reach. Everything below is real and available to you.\n\n## What you have\n\n- A POSIX shell (\\`sh\\`/\\`bash\\` syntax): pipes, redirection, \\`&&\\`, \\`||\\`,\n  subshells, globs, heredocs, variables, functions, \\`for\\`/\\`while\\`/\\`case\\`.\n- Around 140 coreutils: \\`ls cat cp mv rm mkdir find grep sed awk head tail\n  sort uniq wc diff patch tar gzip curl chmod ln touch echo printf test\\` and\n  the rest of the usual set.\n- Node.js, with \\`node\\`, \\`npm\\` and \\`npx\\`. \\`npm install\\` resolves against\n  the real npm registry when outbound network is enabled.\n- Python 3 via \\`python3\\` and \\`pip\\`, when the host enabled the Python runtime.\n- A writable virtual filesystem rooted at \\`/\\`, persistent for the life of the\n  container.\n- A virtual network stack. Servers you start inside the container really listen\n  on their ports and can really be requested.\n\n## What you do not have\n\n- No Docker, no VM, no \\`systemctl\\`, no \\`service\\`, no \\`apt\\`/\\`apt-get\\`,\n  no \\`yum\\`, no \\`brew\\`. Never try to install system packages.\n- No \\`sudo\\` and no reason for it: you already run as the container's user and\n  the filesystem is yours.\n- No access to the host machine, its files, its network interfaces, or its\n  environment variables. Nothing outside the container exists for you.\n- No GUI, no browser, no interactive editors. Do not run \\`vim\\`, \\`nano\\`,\n  \\`less\\`, or \\`top\\`; they will hang or fail. Read files by reading them and\n  edit them by editing them.\n- No long-running foreground commands. A command that never exits will hit the\n  execution timeout and the turn is wasted.\n\n## Running servers\n\nStart servers in the background and never block on them:\n\n\\`\\`\\`sh\nnode server.js > /tmp/server.log 2>&1 &\n\\`\\`\\`\n\nThen poll the log for readiness rather than requesting the port immediately.\nDo not run a dev server in the foreground. Do not use \\`curl localhost:PORT\\`\nto prove a server works unless you started it in the background first — the\nhost, not you, is the one that will connect to it.\n\n## How your work is used\n\nThe container is the deliverable. Files you write to the filesystem are what\nthe user receives and what a preview will serve. Write real, complete files to\nreal paths — do not print a project to stdout and call it done.`;\n\n/**\n * Operating rules, in the register a coding harness uses.\n *\n * Deliberately about this environment rather than about coding in general: the\n * host's own system prompt owns the latter, and repeating it only dilutes both.\n */\nexport const SANDBOX_AGENT_RULES = `# Rules\n\n1. Verify before you claim. If you say a server runs or a build passes, you\n   ran it in this container and read the output. Never report success you have\n   not observed.\n2. One command, one purpose. Chain with \\`&&\\` when steps depend on each other\n   so a failure stops the chain instead of hiding under a later success.\n3. Read a file before editing it. Edits are literal string replacements; they\n   fail when you are guessing at the current contents.\n4. Use absolute paths in file tools. Use \\`cd\\` inside a single shell command\n   when a command needs a working directory.\n5. Install dependencies with \\`npm install <pkg>\\`, in the directory that has\n   the \\`package.json\\`. Do not hand-write \\`node_modules\\` or invent versions\n   in \\`package.json\\` — let the installer resolve them.\n6. Background every server and long task, redirect its output to a log file,\n   then poll the log. Never leave a command running in the foreground.\n7. Keep command output small. Pipe noisy commands through \\`tail\\`, \\`head\\`\n   or \\`grep\\`. Output is truncated past the backend's limit and you will lose\n   the part you needed.\n8. When a command fails, read stderr and fix the cause. Do not retry the same\n   command unchanged, and do not work around a failure by faking its result.\n9. Prefer the project's own tooling — \\`npm run build\\`, \\`npm test\\`,\n   \\`npx vite\\` — over reimplementing what it already does.\n10. Do not attempt to escape the container, reach the host, or disable the\n    network policy. Outbound access is the host's decision, not yours.`;\n\n/** A Deep Agents skill: markdown with the frontmatter its loader parses. */\nexport interface SandboxSkill {\n  name: string;\n  description: string;\n  /** Full file content, frontmatter included, ready to write to disk. */\n  content: string;\n}\n\nfunction skill(name: string, description: string, body: string): SandboxSkill {\n  return {\n    name,\n    description,\n    content: `---\\nname: ${name}\\ndescription: ${description}\\n---\\n\\n${body}\\n`,\n  };\n}\n\n/**\n * Skills covering the workflows that break first in a sandbox.\n *\n * Each is a procedure that has to be followed exactly once to work, and that a\n * model otherwise improvises differently every run — which is what makes an\n * agent look unstable when the container underneath is fine.\n */\nexport const SANDBOX_SKILLS: SandboxSkill[] = [\n  skill(\n    \"node-service\",\n    \"Scaffold, install, run and verify a Node.js HTTP service (Express, Fastify, plain http) inside the sandbox.\",\n    `# Building a Node HTTP service\n\nFollow these steps in order. Do not skip verification.\n\n1. Create the project directory and manifest:\n\n   \\`\\`\\`sh\n   mkdir -p /app && cd /app && npm init -y\n   \\`\\`\\`\n\n2. Install dependencies in one command:\n\n   \\`\\`\\`sh\n   cd /app && npm install express\n   \\`\\`\\`\n\n   Read the output. If it ends in an \\`ENOTFOUND\\` or network error, outbound\n   access is disabled for this container — say so and stop, rather than\n   inventing a dependency-free rewrite the user did not ask for.\n\n3. Write the server to a real file. Bind to \\`0.0.0.0\\` and log a line on\n   listen, so readiness is observable:\n\n   \\`\\`\\`js\n   const express = require(\"express\");\n   const app = express();\n   app.get(\"/\", (_req, res) => res.send(\"hello world\"));\n   const port = Number(process.env.PORT) || 3000;\n   app.listen(port, \"0.0.0.0\", () => console.log(\\`listening on \\${port}\\`));\n   \\`\\`\\`\n\n4. Start it in the background and wait for the log line:\n\n   \\`\\`\\`sh\n   cd /app && node server.js > /tmp/server.log 2>&1 &\n   sleep 1 && cat /tmp/server.log\n   \\`\\`\\`\n\n5. Verify it answers:\n\n   \\`\\`\\`sh\n   curl -s -i http://127.0.0.1:3000/ | head -20\n   \\`\\`\\`\n\n   A non-2xx status or an empty response means the server is not working. Read\n   \\`/tmp/server.log\\` and fix the cause before reporting anything.`,\n  ),\n  skill(\n    \"frontend-app\",\n    \"Scaffold and run a Vite-based frontend (React, Vue, Svelte, vanilla) inside the sandbox and confirm the dev server serves.\",\n    `# Building a frontend app\n\n1. Scaffold non-interactively — the interactive prompt will hang:\n\n   \\`\\`\\`sh\n   cd / && npm create vite@latest app -- --template react-ts\n   \\`\\`\\`\n\n2. Install:\n\n   \\`\\`\\`sh\n   cd /app && npm install\n   \\`\\`\\`\n\n3. Edit the real source files under \\`/app/src\\`. Read a file before editing it.\n\n4. Prove it compiles before claiming it works:\n\n   \\`\\`\\`sh\n   cd /app && npm run build 2>&1 | tail -30\n   \\`\\`\\`\n\n5. Only if a live preview is wanted, start the dev server in the background on\n   a fixed host and port and confirm it came up:\n\n   \\`\\`\\`sh\n   cd /app && npx vite --host 0.0.0.0 --port 5173 > /tmp/vite.log 2>&1 &\n   sleep 3 && tail -20 /tmp/vite.log\n   \\`\\`\\`\n\nDo not run \\`npm run dev\\` in the foreground.`,\n  ),\n  skill(\n    \"verify-work\",\n    \"Check that generated code actually builds, runs and passes its tests before reporting completion.\",\n    `# Verifying before reporting\n\nNever report a task complete on the strength of having written files.\n\n- If the project has tests: \\`cd <dir> && npm test 2>&1 | tail -40\\`\n- If it has a build: \\`cd <dir> && npm run build 2>&1 | tail -40\\`\n- If it has neither and it is a script: run it and read the output.\n- If it is a service: start it in the background and request it (see the\n  \\`node-service\\` skill).\n\nThen state what you ran and what it printed. If something fails and you cannot\nfix it, say exactly what fails and what you tried. A wrong claim of success is\nworse than an honest failure.`,\n  ),\n  skill(\n    \"debug-failure\",\n    \"Diagnose a failing command, build, install or server inside the sandbox instead of retrying blindly.\",\n    `# Debugging inside the sandbox\n\n1. Re-read the actual error. The cause is usually the first error line, not\n   the last.\n2. Confirm the state you assumed: \\`ls -la\\` the directory, \\`cat\\` the config,\n   \\`cat package.json\\`. Most failures are a wrong path or a missing install.\n3. Check the log of anything backgrounded: \\`tail -50 /tmp/*.log\\`.\n4. For a module resolution error, verify the package is installed where you\n   think: \\`ls /app/node_modules/<pkg>/package.json\\`.\n5. For a port that will not answer, check the process is alive (\\`ps\\`) and the\n   log shows a listen line. A crashed server leaves no port behind.\n6. Change exactly one thing, then re-run. Do not retry an unchanged command,\n   and do not delete the work to start over unless nothing else is left.`,\n  ),\n];\n\n/**\n * The whole prompt in one string, for hosts that do not use Deep Agents' skills\n * middleware and just want to append it to a system prompt.\n */\nexport function sandboxSystemPrompt(\n  options: { skills?: boolean } = {},\n): string {\n  const parts = [SANDBOX_ENVIRONMENT_PROMPT, SANDBOX_AGENT_RULES];\n  if (options.skills !== false) {\n    parts.push(\n      `# Skills\\n\\n${SANDBOX_SKILLS.map(\n        (entry) => `## ${entry.name}\\n\\n${entry.description}\\n\\n${entry.content.split(\"---\\n\")[2].trim()}`,\n      ).join(\"\\n\\n\")}`,\n    );\n  }\n  return parts.join(\"\\n\\n\");\n}\n\n/**\n * Write the skills into the container as files, one directory each.\n *\n * This is the layout Deep Agents' skills middleware discovers: point its\n * `sources` at the same directory and it loads them itself, so the host does\n * not have to put any of this in its system prompt.\n */\nexport async function installSandboxSkills(\n  container: Container,\n  directory = \"/skills\",\n): Promise<string> {\n  for (const entry of SANDBOX_SKILLS) {\n    const dir = `${directory}/${entry.name}`;\n    await container.fs.mkdir(dir, { recursive: true });\n    await container.fs.writeFile(`${dir}/SKILL.md`, entry.content);\n  }\n  return directory;\n}\n"]}

package/dist/agent.d.cts

@@ -0,0 +1,208 @@
+import { C as Container } from './container-BsPKqY9R.cjs';
+
+/**
+ * Structural copies of the LangChain Deep Agents backend contract.
+ *
+ * Deep Agents is not a dependency of this package — an adapter that imported it
+ * would drag LangChain into every browser bundle that only wanted a container.
+ * The protocol is structural, so declaring the same shapes here is enough:
+ * `createDeepAgent({ backend: new SandboxedJsBackend(box) })` type-checks
+ * against `SandboxBackendProtocolV2` without the two packages ever meeting.
+ *
+ * Mirrors `deepagents@1.13.2` (`SandboxBackendProtocolV2`, `ExecuteResponse`,
+ * and the `*Result` types). Re-verify against the installed version when
+ * bumping Deep Agents.
+ */
+type MaybePromise<T> = T | Promise<T>;
+type FileOperationError = "file_not_found" | "permission_denied" | "is_directory" | "invalid_path";
+interface FileInfo {
+    path: string;
+    is_dir?: boolean;
+    size?: number;
+    modified_at?: string;
+}
+interface ExecuteResponse {
+    /** stdout and stderr interleaved, exactly as the command wrote them. */
+    output: string;
+    exitCode: number | null;
+    truncated: boolean;
+}
+interface FileUploadResponse {
+    path: string;
+    error: FileOperationError | null;
+}
+interface FileDownloadResponse {
+    path: string;
+    content: Uint8Array | null;
+    error: FileOperationError | null;
+}
+interface GrepMatch {
+    path: string;
+    line: number;
+    text: string;
+}
+interface LsResult {
+    error?: string;
+    files?: FileInfo[];
+}
+interface ReadResult {
+    error?: string;
+    content?: string | Uint8Array;
+    mimeType?: string;
+    totalLines?: number;
+    startLine?: number;
+    endLine?: number;
+    nextOffset?: number;
+}
+interface ReadRawResult {
+    error?: string;
+    data?: {
+        content: string | Uint8Array;
+        mimeType?: string;
+    };
+}
+interface WriteResult {
+    error?: string;
+    path?: string;
+}
+interface EditResult {
+    error?: string;
+    path?: string;
+    occurrences?: number;
+}
+interface DeleteResult {
+    error?: string;
+    path?: string;
+}
+interface GrepResult {
+    error?: string;
+    matches?: GrepMatch[];
+    truncated?: boolean;
+}
+interface GlobResult {
+    error?: string;
+    files?: FileInfo[];
+    truncated?: boolean;
+}
+/** The surface Deep Agents' filesystem and execution middleware actually call. */
+interface SandboxBackendProtocolV2 {
+    readonly id: string;
+    execute(command: string): MaybePromise<ExecuteResponse>;
+    ls(path: string): MaybePromise<LsResult>;
+    read(filePath: string, offset?: number, limit?: number): MaybePromise<ReadResult>;
+    readRaw(filePath: string): MaybePromise<ReadRawResult>;
+    write(filePath: string, content: string): MaybePromise<WriteResult>;
+    edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): MaybePromise<EditResult>;
+    grep(pattern: string, path?: string | null, glob?: string | null, maxCount?: number | null): MaybePromise<GrepResult>;
+    glob(pattern: string, path?: string): MaybePromise<GlobResult>;
+    delete?(filePath: string): MaybePromise<DeleteResult>;
+    uploadFiles?(files: Array<[string, Uint8Array]>): MaybePromise<FileUploadResponse[]>;
+    downloadFiles?(paths: string[]): MaybePromise<FileDownloadResponse[]>;
+}
+
+interface SandboxedJsBackendOptions {
+    /** Identity reported to Deep Agents. Defaults to a random per-instance id. */
+    id?: string;
+    /** Working directory every `execute` starts in. Defaults to the container's. */
+    cwd?: string;
+    /** Wall-clock limit for a single `execute`. Default 120_000ms. */
+    timeoutMs?: number;
+    /** Characters of combined output kept per command before truncating. Default 30_000. */
+    maxOutputChars?: number;
+    /** Default line window for `read`. Default 500. */
+    defaultReadLimit?: number;
+    /** Cap on entries returned by `glob`. Default 1_000. */
+    maxGlobResults?: number;
+    /** Cap on matches returned by `grep` when the caller gives no `maxCount`. Default 200. */
+    defaultGrepMaxCount?: number;
+}
+/**
+ * A sandboxedjs {@link Container} behind the LangChain Deep Agents backend
+ * contract.
+ *
+ * Deep Agents' `BaseSandbox` derives its filesystem tools from `execute` by
+ * shelling out to `find`, `stat`, `awk` and `grep`. This backend answers them
+ * from {@link Container.fs} instead: the container's filesystem is an in-process
+ * object, so going through the shell would only add parsing and quoting bugs
+ * between the agent and data already in memory. `execute` still runs the real
+ * POSIX shell, so agent-authored commands behave the way the agent expects.
+ *
+ * ```ts
+ * const box = await createContainer({ cwd: "/app", network: { allowOutbound: true } });
+ * const agent = createDeepAgent({ model, backend: new SandboxedJsBackend(box) });
+ * ```
+ *
+ * The instance holds the container but does not own it: call
+ * {@link Container.dispose} yourself when the run is over.
+ */
+declare class SandboxedJsBackend implements SandboxBackendProtocolV2 {
+    readonly container: Container;
+    readonly id: string;
+    private readonly cwd;
+    private readonly timeoutMs;
+    private readonly maxOutputChars;
+    private readonly defaultReadLimit;
+    private readonly maxGlobResults;
+    private readonly defaultGrepMaxCount;
+    constructor(container: Container, options?: SandboxedJsBackendOptions);
+    execute(command: string): Promise<ExecuteResponse>;
+    ls(path: string): Promise<LsResult>;
+    read(filePath: string, offset?: number, limit?: number): Promise<ReadResult>;
+    readRaw(filePath: string): Promise<ReadRawResult>;
+    write(filePath: string, content: string): Promise<WriteResult>;
+    edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+    delete(filePath: string): Promise<DeleteResult>;
+    glob(pattern: string, path?: string): Promise<GlobResult>;
+    grep(pattern: string, path?: string | null, glob?: string | null, maxCount?: number | null): Promise<GrepResult>;
+    uploadFiles(files: Array<[string, Uint8Array]>): Promise<FileUploadResponse[]>;
+    downloadFiles(paths: string[]): Promise<FileDownloadResponse[]>;
+}
+
+/**
+ * What the agent's environment actually is.
+ *
+ * Every claim here is a behaviour this package implements. Coding agents fail
+ * in a sandbox mostly by assuming a host they do not have — reaching for
+ * `docker`, `sudo`, `systemctl`, `curl localhost:3000`, or a background process
+ * that outlives the turn. Saying plainly what exists is what stops that.
+ */
+declare const SANDBOX_ENVIRONMENT_PROMPT = "# Your environment\n\nYou are working inside a sandboxedjs container: a Linux-like environment that\nruns entirely inside a JavaScript process. There is no Docker, no VM, and no\nhost machine you can reach. Everything below is real and available to you.\n\n## What you have\n\n- A POSIX shell (`sh`/`bash` syntax): pipes, redirection, `&&`, `||`,\n  subshells, globs, heredocs, variables, functions, `for`/`while`/`case`.\n- Around 140 coreutils: `ls cat cp mv rm mkdir find grep sed awk head tail\n  sort uniq wc diff patch tar gzip curl chmod ln touch echo printf test` and\n  the rest of the usual set.\n- Node.js, with `node`, `npm` and `npx`. `npm install` resolves against\n  the real npm registry when outbound network is enabled.\n- Python 3 via `python3` and `pip`, when the host enabled the Python runtime.\n- A writable virtual filesystem rooted at `/`, persistent for the life of the\n  container.\n- A virtual network stack. Servers you start inside the container really listen\n  on their ports and can really be requested.\n\n## What you do not have\n\n- No Docker, no VM, no `systemctl`, no `service`, no `apt`/`apt-get`,\n  no `yum`, no `brew`. Never try to install system packages.\n- No `sudo` and no reason for it: you already run as the container's user and\n  the filesystem is yours.\n- No access to the host machine, its files, its network interfaces, or its\n  environment variables. Nothing outside the container exists for you.\n- No GUI, no browser, no interactive editors. Do not run `vim`, `nano`,\n  `less`, or `top`; they will hang or fail. Read files by reading them and\n  edit them by editing them.\n- No long-running foreground commands. A command that never exits will hit the\n  execution timeout and the turn is wasted.\n\n## Running servers\n\nStart servers in the background and never block on them:\n\n```sh\nnode server.js > /tmp/server.log 2>&1 &\n```\n\nThen poll the log for readiness rather than requesting the port immediately.\nDo not run a dev server in the foreground. Do not use `curl localhost:PORT`\nto prove a server works unless you started it in the background first \u2014 the\nhost, not you, is the one that will connect to it.\n\n## How your work is used\n\nThe container is the deliverable. Files you write to the filesystem are what\nthe user receives and what a preview will serve. Write real, complete files to\nreal paths \u2014 do not print a project to stdout and call it done.";
+/**
+ * Operating rules, in the register a coding harness uses.
+ *
+ * Deliberately about this environment rather than about coding in general: the
+ * host's own system prompt owns the latter, and repeating it only dilutes both.
+ */
+declare const SANDBOX_AGENT_RULES = "# Rules\n\n1. Verify before you claim. If you say a server runs or a build passes, you\n   ran it in this container and read the output. Never report success you have\n   not observed.\n2. One command, one purpose. Chain with `&&` when steps depend on each other\n   so a failure stops the chain instead of hiding under a later success.\n3. Read a file before editing it. Edits are literal string replacements; they\n   fail when you are guessing at the current contents.\n4. Use absolute paths in file tools. Use `cd` inside a single shell command\n   when a command needs a working directory.\n5. Install dependencies with `npm install <pkg>`, in the directory that has\n   the `package.json`. Do not hand-write `node_modules` or invent versions\n   in `package.json` \u2014 let the installer resolve them.\n6. Background every server and long task, redirect its output to a log file,\n   then poll the log. Never leave a command running in the foreground.\n7. Keep command output small. Pipe noisy commands through `tail`, `head`\n   or `grep`. Output is truncated past the backend's limit and you will lose\n   the part you needed.\n8. When a command fails, read stderr and fix the cause. Do not retry the same\n   command unchanged, and do not work around a failure by faking its result.\n9. Prefer the project's own tooling \u2014 `npm run build`, `npm test`,\n   `npx vite` \u2014 over reimplementing what it already does.\n10. Do not attempt to escape the container, reach the host, or disable the\n    network policy. Outbound access is the host's decision, not yours.";
+/** A Deep Agents skill: markdown with the frontmatter its loader parses. */
+interface SandboxSkill {
+    name: string;
+    description: string;
+    /** Full file content, frontmatter included, ready to write to disk. */
+    content: string;
+}
+/**
+ * Skills covering the workflows that break first in a sandbox.
+ *
+ * Each is a procedure that has to be followed exactly once to work, and that a
+ * model otherwise improvises differently every run — which is what makes an
+ * agent look unstable when the container underneath is fine.
+ */
+declare const SANDBOX_SKILLS: SandboxSkill[];
+/**
+ * The whole prompt in one string, for hosts that do not use Deep Agents' skills
+ * middleware and just want to append it to a system prompt.
+ */
+declare function sandboxSystemPrompt(options?: {
+    skills?: boolean;
+}): string;
+/**
+ * Write the skills into the container as files, one directory each.
+ *
+ * This is the layout Deep Agents' skills middleware discovers: point its
+ * `sources` at the same directory and it loads them itself, so the host does
+ * not have to put any of this in its system prompt.
+ */
+declare function installSandboxSkills(container: Container, directory?: string): Promise<string>;
+
+export { type DeleteResult, type EditResult, type ExecuteResponse, type FileDownloadResponse, type FileInfo, type FileOperationError, type FileUploadResponse, type GlobResult, type GrepMatch, type GrepResult, type LsResult, type MaybePromise, type ReadRawResult, type ReadResult, SANDBOX_AGENT_RULES, SANDBOX_ENVIRONMENT_PROMPT, SANDBOX_SKILLS, type SandboxBackendProtocolV2, type SandboxSkill, SandboxedJsBackend, type SandboxedJsBackendOptions, type WriteResult, installSandboxSkills, sandboxSystemPrompt };

package/dist/agent.d.ts

@@ -0,0 +1,208 @@
+import { C as Container } from './container-BsPKqY9R.js';
+
+/**
+ * Structural copies of the LangChain Deep Agents backend contract.
+ *
+ * Deep Agents is not a dependency of this package — an adapter that imported it
+ * would drag LangChain into every browser bundle that only wanted a container.
+ * The protocol is structural, so declaring the same shapes here is enough:
+ * `createDeepAgent({ backend: new SandboxedJsBackend(box) })` type-checks
+ * against `SandboxBackendProtocolV2` without the two packages ever meeting.
+ *
+ * Mirrors `deepagents@1.13.2` (`SandboxBackendProtocolV2`, `ExecuteResponse`,
+ * and the `*Result` types). Re-verify against the installed version when
+ * bumping Deep Agents.
+ */
+type MaybePromise<T> = T | Promise<T>;
+type FileOperationError = "file_not_found" | "permission_denied" | "is_directory" | "invalid_path";
+interface FileInfo {
+    path: string;
+    is_dir?: boolean;
+    size?: number;
+    modified_at?: string;
+}
+interface ExecuteResponse {
+    /** stdout and stderr interleaved, exactly as the command wrote them. */
+    output: string;
+    exitCode: number | null;
+    truncated: boolean;
+}
+interface FileUploadResponse {
+    path: string;
+    error: FileOperationError | null;
+}
+interface FileDownloadResponse {
+    path: string;
+    content: Uint8Array | null;
+    error: FileOperationError | null;
+}
+interface GrepMatch {
+    path: string;
+    line: number;
+    text: string;
+}
+interface LsResult {
+    error?: string;
+    files?: FileInfo[];
+}
+interface ReadResult {
+    error?: string;
+    content?: string | Uint8Array;
+    mimeType?: string;
+    totalLines?: number;
+    startLine?: number;
+    endLine?: number;
+    nextOffset?: number;
+}
+interface ReadRawResult {
+    error?: string;
+    data?: {
+        content: string | Uint8Array;
+        mimeType?: string;
+    };
+}
+interface WriteResult {
+    error?: string;
+    path?: string;
+}
+interface EditResult {
+    error?: string;
+    path?: string;
+    occurrences?: number;
+}
+interface DeleteResult {
+    error?: string;
+    path?: string;
+}
+interface GrepResult {
+    error?: string;
+    matches?: GrepMatch[];
+    truncated?: boolean;
+}
+interface GlobResult {
+    error?: string;
+    files?: FileInfo[];
+    truncated?: boolean;
+}
+/** The surface Deep Agents' filesystem and execution middleware actually call. */
+interface SandboxBackendProtocolV2 {
+    readonly id: string;
+    execute(command: string): MaybePromise<ExecuteResponse>;
+    ls(path: string): MaybePromise<LsResult>;
+    read(filePath: string, offset?: number, limit?: number): MaybePromise<ReadResult>;
+    readRaw(filePath: string): MaybePromise<ReadRawResult>;
+    write(filePath: string, content: string): MaybePromise<WriteResult>;
+    edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): MaybePromise<EditResult>;
+    grep(pattern: string, path?: string | null, glob?: string | null, maxCount?: number | null): MaybePromise<GrepResult>;
+    glob(pattern: string, path?: string): MaybePromise<GlobResult>;
+    delete?(filePath: string): MaybePromise<DeleteResult>;
+    uploadFiles?(files: Array<[string, Uint8Array]>): MaybePromise<FileUploadResponse[]>;
+    downloadFiles?(paths: string[]): MaybePromise<FileDownloadResponse[]>;
+}
+
+interface SandboxedJsBackendOptions {
+    /** Identity reported to Deep Agents. Defaults to a random per-instance id. */
+    id?: string;
+    /** Working directory every `execute` starts in. Defaults to the container's. */
+    cwd?: string;
+    /** Wall-clock limit for a single `execute`. Default 120_000ms. */
+    timeoutMs?: number;
+    /** Characters of combined output kept per command before truncating. Default 30_000. */
+    maxOutputChars?: number;
+    /** Default line window for `read`. Default 500. */
+    defaultReadLimit?: number;
+    /** Cap on entries returned by `glob`. Default 1_000. */
+    maxGlobResults?: number;
+    /** Cap on matches returned by `grep` when the caller gives no `maxCount`. Default 200. */
+    defaultGrepMaxCount?: number;
+}
+/**
+ * A sandboxedjs {@link Container} behind the LangChain Deep Agents backend
+ * contract.
+ *
+ * Deep Agents' `BaseSandbox` derives its filesystem tools from `execute` by
+ * shelling out to `find`, `stat`, `awk` and `grep`. This backend answers them
+ * from {@link Container.fs} instead: the container's filesystem is an in-process
+ * object, so going through the shell would only add parsing and quoting bugs
+ * between the agent and data already in memory. `execute` still runs the real
+ * POSIX shell, so agent-authored commands behave the way the agent expects.
+ *
+ * ```ts
+ * const box = await createContainer({ cwd: "/app", network: { allowOutbound: true } });
+ * const agent = createDeepAgent({ model, backend: new SandboxedJsBackend(box) });
+ * ```
+ *
+ * The instance holds the container but does not own it: call
+ * {@link Container.dispose} yourself when the run is over.
+ */
+declare class SandboxedJsBackend implements SandboxBackendProtocolV2 {
+    readonly container: Container;
+    readonly id: string;
+    private readonly cwd;
+    private readonly timeoutMs;
+    private readonly maxOutputChars;
+    private readonly defaultReadLimit;
+    private readonly maxGlobResults;
+    private readonly defaultGrepMaxCount;
+    constructor(container: Container, options?: SandboxedJsBackendOptions);
+    execute(command: string): Promise<ExecuteResponse>;
+    ls(path: string): Promise<LsResult>;
+    read(filePath: string, offset?: number, limit?: number): Promise<ReadResult>;
+    readRaw(filePath: string): Promise<ReadRawResult>;
+    write(filePath: string, content: string): Promise<WriteResult>;
+    edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+    delete(filePath: string): Promise<DeleteResult>;
+    glob(pattern: string, path?: string): Promise<GlobResult>;
+    grep(pattern: string, path?: string | null, glob?: string | null, maxCount?: number | null): Promise<GrepResult>;
+    uploadFiles(files: Array<[string, Uint8Array]>): Promise<FileUploadResponse[]>;
+    downloadFiles(paths: string[]): Promise<FileDownloadResponse[]>;
+}
+
+/**
+ * What the agent's environment actually is.
+ *
+ * Every claim here is a behaviour this package implements. Coding agents fail
+ * in a sandbox mostly by assuming a host they do not have — reaching for
+ * `docker`, `sudo`, `systemctl`, `curl localhost:3000`, or a background process
+ * that outlives the turn. Saying plainly what exists is what stops that.
+ */
+declare const SANDBOX_ENVIRONMENT_PROMPT = "# Your environment\n\nYou are working inside a sandboxedjs container: a Linux-like environment that\nruns entirely inside a JavaScript process. There is no Docker, no VM, and no\nhost machine you can reach. Everything below is real and available to you.\n\n## What you have\n\n- A POSIX shell (`sh`/`bash` syntax): pipes, redirection, `&&`, `||`,\n  subshells, globs, heredocs, variables, functions, `for`/`while`/`case`.\n- Around 140 coreutils: `ls cat cp mv rm mkdir find grep sed awk head tail\n  sort uniq wc diff patch tar gzip curl chmod ln touch echo printf test` and\n  the rest of the usual set.\n- Node.js, with `node`, `npm` and `npx`. `npm install` resolves against\n  the real npm registry when outbound network is enabled.\n- Python 3 via `python3` and `pip`, when the host enabled the Python runtime.\n- A writable virtual filesystem rooted at `/`, persistent for the life of the\n  container.\n- A virtual network stack. Servers you start inside the container really listen\n  on their ports and can really be requested.\n\n## What you do not have\n\n- No Docker, no VM, no `systemctl`, no `service`, no `apt`/`apt-get`,\n  no `yum`, no `brew`. Never try to install system packages.\n- No `sudo` and no reason for it: you already run as the container's user and\n  the filesystem is yours.\n- No access to the host machine, its files, its network interfaces, or its\n  environment variables. Nothing outside the container exists for you.\n- No GUI, no browser, no interactive editors. Do not run `vim`, `nano`,\n  `less`, or `top`; they will hang or fail. Read files by reading them and\n  edit them by editing them.\n- No long-running foreground commands. A command that never exits will hit the\n  execution timeout and the turn is wasted.\n\n## Running servers\n\nStart servers in the background and never block on them:\n\n```sh\nnode server.js > /tmp/server.log 2>&1 &\n```\n\nThen poll the log for readiness rather than requesting the port immediately.\nDo not run a dev server in the foreground. Do not use `curl localhost:PORT`\nto prove a server works unless you started it in the background first \u2014 the\nhost, not you, is the one that will connect to it.\n\n## How your work is used\n\nThe container is the deliverable. Files you write to the filesystem are what\nthe user receives and what a preview will serve. Write real, complete files to\nreal paths \u2014 do not print a project to stdout and call it done.";
+/**
+ * Operating rules, in the register a coding harness uses.
+ *
+ * Deliberately about this environment rather than about coding in general: the
+ * host's own system prompt owns the latter, and repeating it only dilutes both.
+ */
+declare const SANDBOX_AGENT_RULES = "# Rules\n\n1. Verify before you claim. If you say a server runs or a build passes, you\n   ran it in this container and read the output. Never report success you have\n   not observed.\n2. One command, one purpose. Chain with `&&` when steps depend on each other\n   so a failure stops the chain instead of hiding under a later success.\n3. Read a file before editing it. Edits are literal string replacements; they\n   fail when you are guessing at the current contents.\n4. Use absolute paths in file tools. Use `cd` inside a single shell command\n   when a command needs a working directory.\n5. Install dependencies with `npm install <pkg>`, in the directory that has\n   the `package.json`. Do not hand-write `node_modules` or invent versions\n   in `package.json` \u2014 let the installer resolve them.\n6. Background every server and long task, redirect its output to a log file,\n   then poll the log. Never leave a command running in the foreground.\n7. Keep command output small. Pipe noisy commands through `tail`, `head`\n   or `grep`. Output is truncated past the backend's limit and you will lose\n   the part you needed.\n8. When a command fails, read stderr and fix the cause. Do not retry the same\n   command unchanged, and do not work around a failure by faking its result.\n9. Prefer the project's own tooling \u2014 `npm run build`, `npm test`,\n   `npx vite` \u2014 over reimplementing what it already does.\n10. Do not attempt to escape the container, reach the host, or disable the\n    network policy. Outbound access is the host's decision, not yours.";
+/** A Deep Agents skill: markdown with the frontmatter its loader parses. */
+interface SandboxSkill {
+    name: string;
+    description: string;
+    /** Full file content, frontmatter included, ready to write to disk. */
+    content: string;
+}
+/**
+ * Skills covering the workflows that break first in a sandbox.
+ *
+ * Each is a procedure that has to be followed exactly once to work, and that a
+ * model otherwise improvises differently every run — which is what makes an
+ * agent look unstable when the container underneath is fine.
+ */
+declare const SANDBOX_SKILLS: SandboxSkill[];
+/**
+ * The whole prompt in one string, for hosts that do not use Deep Agents' skills
+ * middleware and just want to append it to a system prompt.
+ */
+declare function sandboxSystemPrompt(options?: {
+    skills?: boolean;
+}): string;
+/**
+ * Write the skills into the container as files, one directory each.
+ *
+ * This is the layout Deep Agents' skills middleware discovers: point its
+ * `sources` at the same directory and it loads them itself, so the host does
+ * not have to put any of this in its system prompt.
+ */
+declare function installSandboxSkills(container: Container, directory?: string): Promise<string>;
+
+export { type DeleteResult, type EditResult, type ExecuteResponse, type FileDownloadResponse, type FileInfo, type FileOperationError, type FileUploadResponse, type GlobResult, type GrepMatch, type GrepResult, type LsResult, type MaybePromise, type ReadRawResult, type ReadResult, SANDBOX_AGENT_RULES, SANDBOX_ENVIRONMENT_PROMPT, SANDBOX_SKILLS, type SandboxBackendProtocolV2, type SandboxSkill, SandboxedJsBackend, type SandboxedJsBackendOptions, type WriteResult, installSandboxSkills, sandboxSystemPrompt };