stitchkit 0.87.1 → 0.89.0

package/dist/agent-runtime-sandbox.js

@@ -0,0 +1,797 @@
+import {
+  codingRefusal,
+  createAgentCodingTools
+} from "./index-cp20z0n6.js";
+import"./index-bn2cjajt.js";
+import {
+  missingSandboxRestrictions,
+  probeAgentProcessSandbox
+} from "./index-gskm1k5a.js";
+import"./index-2bxcmqkb.js";
+import"./index-6k1937bx.js";
+import"./index-0w9abg87.js";
+import"./index-kzfs85xp.js";
+import"./index-kc6h6hg0.js";
+import"./index-r159gjwy.js";
+import"./index-cby4ar3v.js";
+import"./index-77fekveh.js";
+
+// src/agent-runtime/sandbox-bubblewrap.ts
+import { mkdir as mkdir2, mkdtemp, realpath, rm as rm2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join2, posix as posix2 } from "node:path";
+import { z as z3 } from "zod";
+
+// src/agent-runtime/sandbox-broker.ts
+import { chmod, unlink } from "node:fs/promises";
+import { createServer } from "node:http";
+
+// src/agent-runtime/sandbox-contract.ts
+import { z } from "zod";
+var SandboxNetworkPolicySchema = z.union([
+  z.literal("allow-all"),
+  z.literal("deny-all"),
+  z.object({
+    allow: z.array(z.object({
+      origin: z.url().refine((value) => {
+        const u = new URL(value);
+        return ["http:", "https:"].includes(u.protocol) && !u.username && !u.password && u.pathname === "/" && !u.search && !u.hash;
+      }, "Expected an HTTP origin"),
+      headers: z.record(z.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/).refine((name) => ![
+        "host",
+        "connection",
+        "content-length",
+        "transfer-encoding",
+        "proxy-authorization",
+        "proxy-connection",
+        "upgrade",
+        "trailer",
+        "te"
+      ].includes(name.toLowerCase()), "Routing and hop-by-hop headers cannot be brokered"), z.string().refine((value) => !/[\r\n\0]/.test(value), "Invalid header value")).optional()
+    }).strict())
+  }).strict().refine((policy) => new Set(policy.allow.map((entry) => new URL(entry.origin).host)).size === policy.allow.length, "Each gateway host must have exactly one origin")
+]);
+var SandboxStateSchema = z.object({
+  backend: z.string().min(1),
+  sessionId: z.string().min(1),
+  templateKey: z.string().min(1)
+}).strict();
+var SandboxCommandSchema = z.object({
+  executable: z.string().min(1),
+  args: z.array(z.string()).optional(),
+  cwd: z.string().optional(),
+  environment: z.record(z.string(), z.string()).optional(),
+  timeoutMs: z.number().int().positive().max(2147483647).optional(),
+  maxOutputBytes: z.number().int().positive().optional()
+}).strict();
+
+class SandboxError extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "SandboxError";
+  }
+}
+
+// src/agent-runtime/sandbox-broker.ts
+async function createSandboxBroker(socketPath, getPolicy, onError) {
+  const controllers = new Set;
+  const maxBytes = 1048576;
+  async function handle(req, res) {
+    const policy = getPolicy();
+    const rule = typeof policy === "object" ? policy.allow.find((entry) => new URL(entry.origin).host === req.headers.host) : undefined;
+    if (!rule || !req.url?.startsWith("/") || req.url.startsWith("//")) {
+      res.writeHead(403).end("Sandbox network denied");
+      return;
+    }
+    if (controllers.size >= 16) {
+      res.writeHead(503).end("Sandbox broker busy");
+      return;
+    }
+    const controller = new AbortController;
+    controllers.add(controller);
+    const timer = setTimeout(() => {
+      controller.abort();
+      req.destroy();
+    }, 30000);
+    timer.unref();
+    const abort = () => controller.abort();
+    req.on("aborted", abort);
+    res.on("close", abort);
+    try {
+      const chunks = [];
+      let size = 0;
+      for await (const chunk of req) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += bytes.byteLength;
+        if (size > maxBytes)
+          throw new SandboxError("SANDBOX_LIMIT", "Sandbox request limit exceeded");
+        chunks.push(bytes);
+      }
+      const target = new URL(req.url, rule.origin);
+      if (target.origin !== new URL(rule.origin).origin)
+        throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox network denied");
+      const headers = new Headers;
+      for (const name of ["content-type", "accept"]) {
+        const value = req.headers[name];
+        if (typeof value === "string")
+          headers.set(name, value);
+      }
+      for (const [name, value] of Object.entries(rule.headers ?? {}))
+        headers.set(name, value);
+      const response = await fetch(target, {
+        method: req.method,
+        headers,
+        redirect: "manual",
+        signal: controller.signal,
+        ...size > 0 && { body: Buffer.concat(chunks) }
+      });
+      if (response.status >= 300 && response.status < 400) {
+        await response.body?.cancel();
+        throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox redirects are denied");
+      }
+      const reader = response.body?.getReader();
+      const output = [];
+      size = 0;
+      try {
+        while (reader) {
+          const next = await reader.read();
+          if (next.done)
+            break;
+          size += next.value.byteLength;
+          if (size > maxBytes)
+            throw new SandboxError("SANDBOX_LIMIT", "Sandbox response limit exceeded");
+          output.push(next.value);
+        }
+      } finally {
+        await reader?.cancel();
+      }
+      const type = response.headers.get("content-type");
+      res.writeHead(response.status, type ? { "content-type": type } : {});
+      res.end(Buffer.concat(output));
+    } catch (cause) {
+      try {
+        onError(cause);
+      } catch (observerError) {
+        process.emitWarning(new Error("Sandbox diagnostic sink failed", {
+          cause: new AggregateError([cause, observerError])
+        }));
+      }
+      if (!res.destroyed)
+        res.writeHead(502).end("Sandbox upstream request failed");
+    } finally {
+      clearTimeout(timer);
+      controllers.delete(controller);
+      req.off("aborted", abort);
+      res.off("close", abort);
+    }
+  }
+  const server = createServer((req, res) => {
+    handle(req, res);
+  });
+  server.on("connect", (_req, socket) => socket.end(`HTTP/1.1 403 Forbidden\r
+Connection: close\r
+\r
+`));
+  server.requestTimeout = 30000;
+  server.headersTimeout = 5000;
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, resolve);
+  });
+  await chmod(socketPath, 384);
+  return {
+    abortRequests() {
+      for (const controller of controllers)
+        controller.abort();
+    },
+    async close() {
+      for (const controller of controllers)
+        controller.abort();
+      await new Promise((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+        server.closeAllConnections();
+      });
+      await unlink(socketPath).catch((error) => {
+        if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT"))
+          throw error;
+      });
+    }
+  };
+}
+
+// src/agent-runtime/sandbox-bubblewrap-args.ts
+function bubblewrapArgs(input) {
+  const args = [
+    "--unshare-all",
+    "--die-with-parent",
+    "--new-session",
+    "--cap-drop",
+    "ALL",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--symlink",
+    "usr/sbin",
+    "/sbin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--dir",
+    "/run",
+    "--bind",
+    input.workspace,
+    "/workspace",
+    "--ro-bind",
+    input.socket,
+    "/run/stitchkit-network.sock",
+    "--clearenv",
+    "--setenv",
+    "PATH",
+    "/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/workspace"
+  ];
+  if (input.network === "allow-all")
+    args.push("--share-net", "--ro-bind", "/etc/resolv.conf", "/etc/resolv.conf");
+  for (const [key, value] of Object.entries(input.command.environment ?? {}))
+    args.push("--setenv", key, value);
+  args.push("--chdir", input.command.cwd ?? "/workspace", "--", input.command.executable, ...input.command.args ?? []);
+  return args;
+}
+
+// src/agent-runtime/sandbox-bubblewrap-storage.ts
+import { createHash, randomUUID } from "node:crypto";
+import { cp, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { z as z2 } from "zod";
+
+// src/agent-runtime/sandbox-session.ts
+import { posix } from "node:path";
+function sandboxPath(path) {
+  const relative = path.startsWith("/workspace/") ? path.slice(11) : path;
+  if (path === "/workspace" || path === ".")
+    return "/workspace";
+  if (!relative || relative.startsWith("/") || relative.includes("\\") || relative.includes("\x00") || relative.split("/").some((part) => part === ".." || part === "" || part === ".")) {
+    throw new SandboxError("SANDBOX_PATH", "Expected a canonical workspace-relative path");
+  }
+  return posix.join("/workspace", relative);
+}
+function createSandboxSession(id, driver, brokerSocket) {
+  const spawn = (command, options) => {
+    const parsed = SandboxCommandSchema.parse(command);
+    return driver.spawn({ ...parsed, cwd: sandboxPath(parsed.cwd ?? ".") }, options);
+  };
+  return {
+    id,
+    ...brokerSocket && { brokerSocket },
+    resolvePath: sandboxPath,
+    readBinaryFile: (path) => driver.read(sandboxPath(path)),
+    readTextFile: async (path) => new TextDecoder("utf-8", { fatal: true }).decode(await driver.read(sandboxPath(path))),
+    writeBinaryFile: (path, bytes) => driver.write(sandboxPath(path), bytes),
+    writeTextFile: (path, text) => driver.write(sandboxPath(path), new TextEncoder().encode(text)),
+    removePath: (path) => {
+      const resolved = sandboxPath(path);
+      if (resolved === "/workspace")
+        throw new SandboxError("SANDBOX_PATH", "Cannot remove the workspace root");
+      return driver.remove(resolved);
+    },
+    spawn,
+    async run(command, options) {
+      const result = await (await spawn(command, options)).result;
+      return {
+        exitCode: result.exitCode,
+        stdout: new TextDecoder().decode(result.stdout),
+        stderr: new TextDecoder().decode(result.stderr)
+      };
+    },
+    setNetworkPolicy: (policy) => driver.setNetworkPolicy(SandboxNetworkPolicySchema.parse(policy))
+  };
+}
+
+// src/agent-runtime/sandbox-bubblewrap-storage.ts
+var Key = z2.string().regex(/^[a-f0-9]{64}$/);
+var digest = (value) => createHash("sha256").update(value).digest("hex");
+function sandboxStorage(root, name) {
+  const base = join(root, digest(name));
+  async function prewarm(input) {
+    const files = Object.entries(input.files ?? {}).map(([path, bytes]) => [path, Uint8Array.from(bytes)]).sort(([a], [b]) => a.localeCompare(b));
+    const key = digest(JSON.stringify([
+      name,
+      input.template,
+      files.map(([path, bytes]) => [
+        sandboxPath(path),
+        createHash("sha256").update(bytes).digest("hex")
+      ])
+    ]));
+    const directory = join(base, "templates", key);
+    await mkdir(join(base, "templates"), { recursive: true, mode: 448 });
+    try {
+      await readFile(join(directory, "ready"));
+      return { reused: true, templateKey: key };
+    } catch (error) {
+      if (!missing(error))
+        throw error;
+    }
+    const temporary = join(base, "templates", randomUUID());
+    await mkdir(join(temporary, "data"), { recursive: true, mode: 448 });
+    try {
+      for (const [path, bytes] of files) {
+        const resolved = sandboxPath(path);
+        if (resolved === "/workspace")
+          throw new SandboxError("SANDBOX_PATH", "Template file cannot be the workspace root");
+        const target = join(temporary, "data", resolved.slice(11));
+        await mkdir(dirname(target), { recursive: true, mode: 448 });
+        await writeFile(target, bytes, { flag: "wx", mode: 384 });
+      }
+      await writeFile(join(temporary, "ready"), JSON.stringify({ backend: name, templateKey: key }));
+      try {
+        await rename(temporary, directory);
+      } catch (error) {
+        if (!(error instanceof Error && ("code" in error) && ["EEXIST", "ENOTEMPTY"].includes(String(error.code))))
+          throw error;
+      }
+      return { reused: false, templateKey: key };
+    } finally {
+      await rm(temporary, { recursive: true, force: true });
+    }
+  }
+  async function acquire(id) {
+    const directory = join(base, "sessions", Key.parse(id));
+    await mkdir(directory, { recursive: true, mode: 448 });
+    try {
+      const lease = await open(join(directory, "lease"), "wx", 384);
+      try {
+        await lease.writeFile(String(process.pid));
+      } catch (error) {
+        await rm(join(directory, "lease"), { force: true });
+        throw error;
+      } finally {
+        await lease.close();
+      }
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "EEXIST")
+        throw new SandboxError("SANDBOX_BUSY", "Sandbox session already has an owner");
+      throw error;
+    }
+    return { directory, release: () => rm(join(directory, "lease"), { force: true }) };
+  }
+  async function create(template, saved) {
+    Key.parse(template);
+    if (saved && (saved.backend !== name || saved.templateKey !== template))
+      throw new SandboxError("SANDBOX_STATE_MISMATCH", "Reconnect state does not match backend and template");
+    const templateDirectory = join(base, "templates", template);
+    const record = z2.object({ backend: z2.string(), templateKey: z2.string() }).parse(JSON.parse(await readFile(join(templateDirectory, "ready"), "utf8")));
+    if (record.backend !== name || record.templateKey !== template)
+      throw new SandboxError("SANDBOX_STATE_MISMATCH", "Template belongs to another backend");
+    const state = saved ? SandboxStateSchema.parse(saved) : { backend: name, sessionId: digest(randomUUID()), templateKey: template };
+    if (state.backend !== name || state.templateKey !== template)
+      throw new SandboxError("SANDBOX_STATE_MISMATCH", "Reconnect state does not match backend and template");
+    const lease = await acquire(state.sessionId);
+    try {
+      const statePath = join(lease.directory, "state.json");
+      if (saved) {
+        const existing = SandboxStateSchema.parse(JSON.parse(await readFile(statePath, "utf8")));
+        if (JSON.stringify(existing) !== JSON.stringify(state))
+          throw new SandboxError("SANDBOX_STATE_MISMATCH", "Reconnect identity does not match saved session");
+      } else {
+        await cp(join(templateDirectory, "data"), join(lease.directory, "workspace"), {
+          recursive: true
+        });
+        await writeFile(statePath, JSON.stringify(state), { flag: "wx", mode: 384 });
+      }
+      return { ...lease, workspace: join(lease.directory, "workspace"), state };
+    } catch (error) {
+      try {
+        if (!saved)
+          await rm(lease.directory, { recursive: true, force: true });
+      } finally {
+        await lease.release();
+      }
+      throw error;
+    }
+  }
+  return { prewarm, create, acquire };
+}
+function missing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
+// src/agent-runtime/sandbox-coding.ts
+import { relative, sep } from "node:path";
+function sandboxCommandCwd(root, cwd) {
+  const path = relative(root, cwd).split(sep).join("/");
+  return sandboxPath(path || ".");
+}
+function createSandboxCodingTools(handle, config) {
+  const binding = handle.coding;
+  if (!binding)
+    throw new SandboxError("SANDBOX_UNAVAILABLE", "Backend does not expose a host coding workspace");
+  binding.assertActive();
+  const assertToolActive = () => {
+    try {
+      binding.assertActive();
+    } catch (error) {
+      if (error instanceof SandboxError)
+        codingRefusal("SANDBOX_UNAVAILABLE", "Sandbox session cannot execute this operation", {
+          details: { reason: error.code }
+        });
+      throw error;
+    }
+  };
+  const { requiredRestrictions, ...options } = config;
+  return createAgentCodingTools({
+    ...options,
+    root: binding.root,
+    sandbox: {
+      adapter: binding.adapter,
+      required: requiredRestrictions ?? [
+        "write-contained",
+        "process-contained",
+        "secrets-hidden"
+      ]
+    },
+    authorize(input) {
+      assertToolActive();
+      return options.authorize(input);
+    },
+    authorizePath(input) {
+      assertToolActive();
+      return options.authorizePath?.(input) ?? true;
+    }
+  });
+}
+
+// src/agent-runtime/sandbox-coding-adapter.ts
+function createSandboxCodingAdapter(input) {
+  const { workspace, socket, executable, getPolicy, processes, assertActive } = input;
+  let policyRevision = 0;
+  const preparations = new WeakMap;
+  const grade = () => ({
+    grade: "full",
+    restrictions: getPolicy() === "deny-all" ? ["network-denied", "write-contained", "secrets-hidden", "process-contained"] : ["write-contained", "secrets-hidden", "process-contained"]
+  });
+  const adapter = {
+    probe: grade,
+    prepare(command) {
+      assertActive();
+      if (missingSandboxRestrictions(grade(), command.required ?? []).length)
+        throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox policy no longer satisfies required restrictions");
+      const environment = {};
+      preparations.set(environment, policyRevision);
+      return {
+        executable,
+        args: bubblewrapArgs({
+          workspace,
+          socket,
+          network: getPolicy(),
+          command: {
+            executable: command.executable,
+            args: [...command.args],
+            cwd: sandboxCommandCwd(workspace, command.cwd),
+            environment: { ...command.environment }
+          }
+        }),
+        environment
+      };
+    },
+    spawn(command) {
+      assertActive();
+      if (preparations.get(command.environment) !== policyRevision)
+        throw new SandboxError("SANDBOX_BUSY", "Sandbox policy changed after command preparation");
+      preparations.delete(command.environment);
+      return processes.spawn(command);
+    }
+  };
+  return {
+    adapter,
+    async refresh() {
+      policyRevision++;
+      await probeAgentProcessSandbox(adapter, { refresh: true });
+    }
+  };
+}
+
+// src/agent-runtime/sandbox-process.ts
+import { spawn } from "node:child_process";
+function spawnSandboxProcess(executable, args, limits, options = {}, onSpawn) {
+  options.signal?.throwIfAborted();
+  const child = spawn(executable, args, {
+    env: {},
+    detached: true,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  onSpawn?.(child);
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  let failure;
+  let finished = false;
+  const kill = () => {
+    if (finished || child.pid === undefined)
+      return;
+    try {
+      process.kill(-child.pid, "SIGKILL");
+    } catch (error) {
+      if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
+        failure ??= error;
+    }
+  };
+  const abort = () => {
+    failure ??= options.signal?.reason ?? new Error("Sandbox command aborted");
+    kill();
+  };
+  const timer = setTimeout(() => {
+    failure ??= new SandboxError("SANDBOX_LIMIT", "Sandbox command deadline exceeded");
+    kill();
+  }, limits.timeoutMs);
+  timer.unref();
+  const result = new Promise((resolve, reject) => {
+    const collect = (target) => (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > limits.maxOutputBytes) {
+        failure ??= new SandboxError("SANDBOX_LIMIT", "Sandbox output limit exceeded");
+        kill();
+      } else
+        target.push(chunk);
+    };
+    child.stdout.on("data", collect(stdout));
+    child.stderr.on("data", collect(stderr));
+    child.on("error", (error) => {
+      failure ??= new SandboxError("SANDBOX_UNAVAILABLE", "Sandbox process could not start", { cause: error });
+    });
+    child.stdin.on("error", (error) => {
+      if (!(("code" in error) && error.code === "EPIPE")) {
+        failure ??= error;
+        kill();
+      }
+    });
+    child.on("close", (code) => {
+      finished = true;
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+      if (failure !== undefined)
+        reject(failure);
+      else
+        resolve({
+          exitCode: code ?? 137,
+          stdout: Buffer.concat(stdout),
+          stderr: Buffer.concat(stderr)
+        });
+    });
+  });
+  result.catch(() => {
+    return;
+  });
+  options.signal?.addEventListener("abort", abort, { once: true });
+  if (options.signal?.aborted)
+    abort();
+  child.stdin.end(options.stdin);
+  return {
+    result,
+    async stop() {
+      kill();
+      await result.then(() => {
+        return;
+      }, () => {
+        return;
+      });
+    }
+  };
+}
+
+// src/agent-runtime/sandbox-process-owner.ts
+import { spawn as spawn2 } from "node:child_process";
+function sandboxProcessOwner(assertActive, maximum) {
+  const children = new Map;
+  const admit = () => {
+    assertActive();
+    if (children.size >= maximum)
+      throw new SandboxError("SANDBOX_BUSY", "Sandbox command concurrency limit reached");
+  };
+  const track = (child) => {
+    const closed = new Promise((resolve) => {
+      child.once("close", () => {
+        children.delete(child);
+        resolve();
+      });
+    });
+    children.set(child, closed);
+  };
+  return {
+    admit,
+    track,
+    get size() {
+      return children.size;
+    },
+    spawn(input) {
+      admit();
+      const child = spawn2(input.executable, [...input.args], {
+        cwd: input.cwd,
+        env: input.environment,
+        detached: true,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      child.stdin.end();
+      track(child);
+      return child;
+    },
+    async stop() {
+      const pending = [...children];
+      for (const [child] of pending) {
+        if (child.pid === undefined)
+          continue;
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch (error) {
+          if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
+            throw error;
+        }
+      }
+      await Promise.all(pending.map(([, closed]) => closed));
+    }
+  };
+}
+
+// src/agent-runtime/sandbox-bubblewrap.ts
+async function createBubblewrapSandboxBackend(config) {
+  if (process.platform !== "linux")
+    throw new SandboxError("SANDBOX_UNAVAILABLE", "Bubblewrap requires Linux");
+  const executable = config.executable ?? "/usr/bin/bwrap";
+  const name = z3.string().min(1).parse(config.name ?? "bubblewrap");
+  await mkdir2(config.stateDirectory, { recursive: true, mode: 448 });
+  const root = await realpath(config.stateDirectory);
+  const storage = sandboxStorage(root, name);
+  const maximum = z3.number().int().positive().max(1024).parse(config.maxConcurrentCommands ?? 8);
+  return {
+    name,
+    prewarm: storage.prewarm,
+    async create(input) {
+      let policy = SandboxNetworkPolicySchema.parse(input.network);
+      const stored = await storage.create(input.template, input.state);
+      async function abandon() {
+        try {
+          if (!input.state)
+            await rm2(stored.directory, { recursive: true, force: true });
+        } finally {
+          await stored.release();
+        }
+      }
+      const temporary = await mkdtemp(join2(tmpdir(), "stitchkit-sandbox-")).catch(async (error) => {
+        await abandon();
+        throw error;
+      });
+      const socket = join2(temporary, "network.sock");
+      let active = true;
+      let deleted = false;
+      let stopPending;
+      const broker = await createSandboxBroker(socket, () => policy, config.onBrokerError).catch(async (error) => {
+        await abandon();
+        await rm2(temporary, { recursive: true, force: true });
+        throw error;
+      });
+      const assertActive = () => {
+        if (!active)
+          throw new SandboxError("SANDBOX_STOPPED", "Sandbox session is stopped");
+      };
+      const processes = sandboxProcessOwner(assertActive, maximum);
+      const coding = createSandboxCodingAdapter({
+        workspace: stored.workspace,
+        socket,
+        executable,
+        getPolicy: () => policy,
+        processes,
+        assertActive
+      });
+      const driver = {
+        async spawn(command, options) {
+          processes.admit();
+          const process2 = spawnSandboxProcess(executable, bubblewrapArgs({ workspace: stored.workspace, socket, command, network: policy }), {
+            timeoutMs: command.timeoutMs ?? 30000,
+            maxOutputBytes: command.maxOutputBytes ?? 1048576
+          }, options, processes.track);
+          return process2;
+        },
+        async read(path) {
+          return (await execute("/usr/bin/cat", ["--", path])).stdout;
+        },
+        async write(path, bytes) {
+          if (bytes.byteLength > 1048576)
+            throw new SandboxError("SANDBOX_LIMIT", "Sandbox file write limit exceeded");
+          await execute("/usr/bin/mkdir", ["-p", "--", posix2.dirname(path)]);
+          await execute("/usr/bin/tee", ["--", path], bytes);
+        },
+        async remove(path) {
+          await execute("/usr/bin/rm", ["-rf", "--", path]);
+        },
+        async setNetworkPolicy(next) {
+          assertActive();
+          if (processes.size)
+            throw new SandboxError("SANDBOX_BUSY", "Stop live commands before changing network policy");
+          broker.abortRequests();
+          policy = SandboxNetworkPolicySchema.parse(next);
+          await coding.refresh();
+        }
+      };
+      async function execute(binary, args, stdin) {
+        const result = await (await driver.spawn({ executable: binary, args }, { stdin })).result;
+        if (result.exitCode !== 0)
+          throw new SandboxError("SANDBOX_UNAVAILABLE", "Sandbox file operation failed");
+        return result;
+      }
+      function stop() {
+        if (stopPending)
+          return stopPending;
+        active = false;
+        stopPending = (async () => {
+          await processes.stop();
+          try {
+            await broker.close();
+          } finally {
+            try {
+              await rm2(temporary, { recursive: true, force: true });
+            } finally {
+              await stored.release();
+            }
+          }
+        })();
+        return stopPending;
+      }
+      try {
+        await execute("/usr/bin/true", []);
+      } catch (error) {
+        await stop();
+        if (!input.state)
+          await rm2(stored.directory, { recursive: true, force: true });
+        throw new SandboxError("SANDBOX_UNAVAILABLE", "Bubblewrap could not establish isolation", { cause: error });
+      }
+      return {
+        coding: { root: stored.workspace, adapter: coding.adapter, assertActive },
+        session: createSandboxSession(stored.state.sessionId, driver, "/run/stitchkit-network.sock"),
+        captureState() {
+          if (deleted)
+            throw new SandboxError("SANDBOX_STOPPED", "Sandbox session is deleted");
+          return { ...stored.state };
+        },
+        stop,
+        shutdown: stop,
+        async delete() {
+          if (deleted)
+            return;
+          await stop();
+          const lease = await storage.acquire(stored.state.sessionId);
+          try {
+            await rm2(lease.directory, { recursive: true, force: true });
+            deleted = true;
+          } catch (error) {
+            await lease.release();
+            throw error;
+          }
+        }
+      };
+    }
+  };
+}
+export {
+  createSandboxSession,
+  createSandboxCodingTools,
+  createBubblewrapSandboxBackend,
+  SandboxStateSchema,
+  SandboxNetworkPolicySchema,
+  SandboxError,
+  SandboxCommandSchema
+};