stitchkit 0.93.0 → 0.94.1

package/dist/agent-runtime-sandbox.js

@@ -1,798 +0,0 @@
-import {
-  createAgentCodingTools
-} from "./index-fq77yfzc.js";
-import"./index-bn2cjajt.js";
-import {
-  codingRefusal,
-  missingSandboxRestrictions,
-  probeAgentProcessSandbox
-} from "./index-qmy6zq75.js";
-import"./index-0a349c33.js";
-import"./index-rxfy4cq7.js";
-import"./index-6k1937bx.js";
-import"./index-vjpvjqpn.js";
-import"./index-h9etkkyk.js";
-import"./index-cby4ar3v.js";
-import"./index-2vtcmrj9.js";
-import"./index-kzfs85xp.js";
-import"./index-77fekveh.js";
-
-// src/agent-runtime/sandbox-bubblewrap.ts
-import { mkdir as mkdir2, mkdtemp, realpath, rm as rm2 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join as join2, posix as posix2 } from "node:path";
-import { z as z3 } from "zod";
-
-// src/agent-runtime/sandbox-broker.ts
-import { chmod, unlink } from "node:fs/promises";
-import { createServer } from "node:http";
-
-// src/agent-runtime/sandbox-contract.ts
-import { z } from "zod";
-var SandboxNetworkPolicySchema = z.union([
-  z.literal("allow-all"),
-  z.literal("deny-all"),
-  z.object({
-    allow: z.array(z.object({
-      origin: z.url().refine((value) => {
-        const u = new URL(value);
-        return ["http:", "https:"].includes(u.protocol) && !u.username && !u.password && u.pathname === "/" && !u.search && !u.hash;
-      }, "Expected an HTTP origin"),
-      headers: z.record(z.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/).refine((name) => ![
-        "host",
-        "connection",
-        "content-length",
-        "transfer-encoding",
-        "proxy-authorization",
-        "proxy-connection",
-        "upgrade",
-        "trailer",
-        "te"
-      ].includes(name.toLowerCase()), "Routing and hop-by-hop headers cannot be brokered"), z.string().refine((value) => !/[\r\n\0]/.test(value), "Invalid header value")).optional()
-    }).strict())
-  }).strict().refine((policy) => new Set(policy.allow.map((entry) => new URL(entry.origin).host)).size === policy.allow.length, "Each gateway host must have exactly one origin")
-]);
-var SandboxStateSchema = z.object({
-  backend: z.string().min(1),
-  sessionId: z.string().min(1),
-  templateKey: z.string().min(1)
-}).strict();
-var SandboxCommandSchema = z.object({
-  executable: z.string().min(1),
-  args: z.array(z.string()).optional(),
-  cwd: z.string().optional(),
-  environment: z.record(z.string(), z.string()).optional(),
-  timeoutMs: z.number().int().positive().max(2147483647).optional(),
-  maxOutputBytes: z.number().int().positive().optional()
-}).strict();
-
-class SandboxError extends Error {
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = "SandboxError";
-  }
-}
-
-// src/agent-runtime/sandbox-broker.ts
-async function createSandboxBroker(socketPath, getPolicy, onError) {
-  const controllers = new Set;
-  const maxBytes = 1048576;
-  async function handle(req, res) {
-    const policy = getPolicy();
-    const rule = typeof policy === "object" ? policy.allow.find((entry) => new URL(entry.origin).host === req.headers.host) : undefined;
-    if (!rule || !req.url?.startsWith("/") || req.url.startsWith("//")) {
-      res.writeHead(403).end("Sandbox network denied");
-      return;
-    }
-    if (controllers.size >= 16) {
-      res.writeHead(503).end("Sandbox broker busy");
-      return;
-    }
-    const controller = new AbortController;
-    controllers.add(controller);
-    const timer = setTimeout(() => {
-      controller.abort();
-      req.destroy();
-    }, 30000);
-    timer.unref();
-    const abort = () => controller.abort();
-    req.on("aborted", abort);
-    res.on("close", abort);
-    try {
-      const chunks = [];
-      let size = 0;
-      for await (const chunk of req) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += bytes.byteLength;
-        if (size > maxBytes)
-          throw new SandboxError("SANDBOX_LIMIT", "Sandbox request limit exceeded");
-        chunks.push(bytes);
-      }
-      const target = new URL(req.url, rule.origin);
-      if (target.origin !== new URL(rule.origin).origin)
-        throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox network denied");
-      const headers = new Headers;
-      for (const name of ["content-type", "accept"]) {
-        const value = req.headers[name];
-        if (typeof value === "string")
-          headers.set(name, value);
-      }
-      for (const [name, value] of Object.entries(rule.headers ?? {}))
-        headers.set(name, value);
-      const response = await fetch(target, {
-        method: req.method,
-        headers,
-        redirect: "manual",
-        signal: controller.signal,
-        ...size > 0 && { body: Buffer.concat(chunks) }
-      });
-      if (response.status >= 300 && response.status < 400) {
-        await response.body?.cancel();
-        throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox redirects are denied");
-      }
-      const reader = response.body?.getReader();
-      const output = [];
-      size = 0;
-      try {
-        while (reader) {
-          const next = await reader.read();
-          if (next.done)
-            break;
-          size += next.value.byteLength;
-          if (size > maxBytes)
-            throw new SandboxError("SANDBOX_LIMIT", "Sandbox response limit exceeded");
-          output.push(next.value);
-        }
-      } finally {
-        await reader?.cancel();
-      }
-      const type = response.headers.get("content-type");
-      res.writeHead(response.status, type ? { "content-type": type } : {});
-      res.end(Buffer.concat(output));
-    } catch (cause) {
-      try {
-        onError(cause);
-      } catch (observerError) {
-        process.emitWarning(new Error("Sandbox diagnostic sink failed", {
-          cause: new AggregateError([cause, observerError])
-        }));
-      }
-      if (!res.destroyed)
-        res.writeHead(502).end("Sandbox upstream request failed");
-    } finally {
-      clearTimeout(timer);
-      controllers.delete(controller);
-      req.off("aborted", abort);
-      res.off("close", abort);
-    }
-  }
-  const server = createServer((req, res) => {
-    handle(req, res);
-  });
-  server.on("connect", (_req, socket) => socket.end(`HTTP/1.1 403 Forbidden\r
-Connection: close\r
-\r
-`));
-  server.requestTimeout = 30000;
-  server.headersTimeout = 5000;
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(socketPath, resolve);
-  });
-  await chmod(socketPath, 384);
-  return {
-    abortRequests() {
-      for (const controller of controllers)
-        controller.abort();
-    },
-    async close() {
-      for (const controller of controllers)
-        controller.abort();
-      await new Promise((resolve, reject) => {
-        server.close((error) => error ? reject(error) : resolve());
-        server.closeAllConnections();
-      });
-      await unlink(socketPath).catch((error) => {
-        if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT"))
-          throw error;
-      });
-    }
-  };
-}
-
-// src/agent-runtime/sandbox-bubblewrap-args.ts
-function bubblewrapArgs(input) {
-  const args = [
-    "--unshare-all",
-    "--die-with-parent",
-    "--new-session",
-    "--cap-drop",
-    "ALL",
-    "--ro-bind",
-    "/usr",
-    "/usr",
-    "--ro-bind",
-    "/lib",
-    "/lib",
-    "--ro-bind",
-    "/lib64",
-    "/lib64",
-    "--symlink",
-    "usr/bin",
-    "/bin",
-    "--symlink",
-    "usr/sbin",
-    "/sbin",
-    "--proc",
-    "/proc",
-    "--dev",
-    "/dev",
-    "--tmpfs",
-    "/tmp",
-    "--dir",
-    "/run",
-    "--bind",
-    input.workspace,
-    "/workspace",
-    "--ro-bind",
-    input.socket,
-    "/run/stitchkit-network.sock",
-    "--clearenv",
-    "--setenv",
-    "PATH",
-    "/usr/bin:/bin",
-    "--setenv",
-    "HOME",
-    "/workspace"
-  ];
-  if (input.network === "allow-all")
-    args.push("--share-net", "--ro-bind", "/etc/resolv.conf", "/etc/resolv.conf");
-  for (const [key, value] of Object.entries(input.command.environment ?? {}))
-    args.push("--setenv", key, value);
-  args.push("--chdir", input.command.cwd ?? "/workspace", "--", input.command.executable, ...input.command.args ?? []);
-  return args;
-}
-
-// src/agent-runtime/sandbox-bubblewrap-storage.ts
-import { createHash, randomUUID } from "node:crypto";
-import { cp, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { z as z2 } from "zod";
-
-// src/agent-runtime/sandbox-session.ts
-import { posix } from "node:path";
-function sandboxPath(path) {
-  const relative = path.startsWith("/workspace/") ? path.slice(11) : path;
-  if (path === "/workspace" || path === ".")
-    return "/workspace";
-  if (!relative || relative.startsWith("/") || relative.includes("\\") || relative.includes("\x00") || relative.split("/").some((part) => part === ".." || part === "" || part === ".")) {
-    throw new SandboxError("SANDBOX_PATH", "Expected a canonical workspace-relative path");
-  }
-  return posix.join("/workspace", relative);
-}
-function createSandboxSession(id, driver, brokerSocket) {
-  const spawn = (command, options) => {
-    const parsed = SandboxCommandSchema.parse(command);
-    return driver.spawn({ ...parsed, cwd: sandboxPath(parsed.cwd ?? ".") }, options);
-  };
-  return {
-    id,
-    ...brokerSocket && { brokerSocket },
-    resolvePath: sandboxPath,
-    readBinaryFile: (path) => driver.read(sandboxPath(path)),
-    readTextFile: async (path) => new TextDecoder("utf-8", { fatal: true }).decode(await driver.read(sandboxPath(path))),
-    writeBinaryFile: (path, bytes) => driver.write(sandboxPath(path), bytes),
-    writeTextFile: (path, text) => driver.write(sandboxPath(path), new TextEncoder().encode(text)),
-    removePath: (path) => {
-      const resolved = sandboxPath(path);
-      if (resolved === "/workspace")
-        throw new SandboxError("SANDBOX_PATH", "Cannot remove the workspace root");
-      return driver.remove(resolved);
-    },
-    spawn,
-    async run(command, options) {
-      const result = await (await spawn(command, options)).result;
-      return {
-        exitCode: result.exitCode,
-        stdout: new TextDecoder().decode(result.stdout),
-        stderr: new TextDecoder().decode(result.stderr)
-      };
-    },
-    setNetworkPolicy: (policy) => driver.setNetworkPolicy(SandboxNetworkPolicySchema.parse(policy))
-  };
-}
-
-// src/agent-runtime/sandbox-bubblewrap-storage.ts
-var Key = z2.string().regex(/^[a-f0-9]{64}$/);
-var digest = (value) => createHash("sha256").update(value).digest("hex");
-function sandboxStorage(root, name) {
-  const base = join(root, digest(name));
-  async function prewarm(input) {
-    const files = Object.entries(input.files ?? {}).map(([path, bytes]) => [path, Uint8Array.from(bytes)]).sort(([a], [b]) => a.localeCompare(b));
-    const key = digest(JSON.stringify([
-      name,
-      input.template,
-      files.map(([path, bytes]) => [
-        sandboxPath(path),
-        createHash("sha256").update(bytes).digest("hex")
-      ])
-    ]));
-    const directory = join(base, "templates", key);
-    await mkdir(join(base, "templates"), { recursive: true, mode: 448 });
-    try {
-      await readFile(join(directory, "ready"));
-      return { reused: true, templateKey: key };
-    } catch (error) {
-      if (!missing(error))
-        throw error;
-    }
-    const temporary = join(base, "templates", randomUUID());
-    await mkdir(join(temporary, "data"), { recursive: true, mode: 448 });
-    try {
-      for (const [path, bytes] of files) {
-        const resolved = sandboxPath(path);
-        if (resolved === "/workspace")
-          throw new SandboxError("SANDBOX_PATH", "Template file cannot be the workspace root");
-        const target = join(temporary, "data", resolved.slice(11));
-        await mkdir(dirname(target), { recursive: true, mode: 448 });
-        await writeFile(target, bytes, { flag: "wx", mode: 384 });
-      }
-      await writeFile(join(temporary, "ready"), JSON.stringify({ backend: name, templateKey: key }));
-      try {
-        await rename(temporary, directory);
-      } catch (error) {
-        if (!(error instanceof Error && ("code" in error) && ["EEXIST", "ENOTEMPTY"].includes(String(error.code))))
-          throw error;
-      }
-      return { reused: false, templateKey: key };
-    } finally {
-      await rm(temporary, { recursive: true, force: true });
-    }
-  }
-  async function acquire(id) {
-    const directory = join(base, "sessions", Key.parse(id));
-    await mkdir(directory, { recursive: true, mode: 448 });
-    try {
-      const lease = await open(join(directory, "lease"), "wx", 384);
-      try {
-        await lease.writeFile(String(process.pid));
-      } catch (error) {
-        await rm(join(directory, "lease"), { force: true });
-        throw error;
-      } finally {
-        await lease.close();
-      }
-    } catch (error) {
-      if (error instanceof Error && "code" in error && error.code === "EEXIST")
-        throw new SandboxError("SANDBOX_BUSY", "Sandbox session already has an owner");
-      throw error;
-    }
-    return { directory, release: () => rm(join(directory, "lease"), { force: true }) };
-  }
-  async function create(template, saved) {
-    Key.parse(template);
-    if (saved && (saved.backend !== name || saved.templateKey !== template))
-      throw new SandboxError("SANDBOX_STATE_MISMATCH", "Reconnect state does not match backend and template");
-    const templateDirectory = join(base, "templates", template);
-    const record = z2.object({ backend: z2.string(), templateKey: z2.string() }).parse(JSON.parse(await readFile(join(templateDirectory, "ready"), "utf8")));
-    if (record.backend !== name || record.templateKey !== template)
-      throw new SandboxError("SANDBOX_STATE_MISMATCH", "Template belongs to another backend");
-    const state = saved ? SandboxStateSchema.parse(saved) : { backend: name, sessionId: digest(randomUUID()), templateKey: template };
-    if (state.backend !== name || state.templateKey !== template)
-      throw new SandboxError("SANDBOX_STATE_MISMATCH", "Reconnect state does not match backend and template");
-    const lease = await acquire(state.sessionId);
-    try {
-      const statePath = join(lease.directory, "state.json");
-      if (saved) {
-        const existing = SandboxStateSchema.parse(JSON.parse(await readFile(statePath, "utf8")));
-        if (JSON.stringify(existing) !== JSON.stringify(state))
-          throw new SandboxError("SANDBOX_STATE_MISMATCH", "Reconnect identity does not match saved session");
-      } else {
-        await cp(join(templateDirectory, "data"), join(lease.directory, "workspace"), {
-          recursive: true
-        });
-        await writeFile(statePath, JSON.stringify(state), { flag: "wx", mode: 384 });
-      }
-      return { ...lease, workspace: join(lease.directory, "workspace"), state };
-    } catch (error) {
-      try {
-        if (!saved)
-          await rm(lease.directory, { recursive: true, force: true });
-      } finally {
-        await lease.release();
-      }
-      throw error;
-    }
-  }
-  return { prewarm, create, acquire };
-}
-function missing(error) {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
-}
-
-// src/agent-runtime/sandbox-coding.ts
-import { relative, sep } from "node:path";
-function sandboxCommandCwd(root, cwd) {
-  const path = relative(root, cwd).split(sep).join("/");
-  return sandboxPath(path || ".");
-}
-function createSandboxCodingTools(handle, config) {
-  const binding = handle.coding;
-  if (!binding)
-    throw new SandboxError("SANDBOX_UNAVAILABLE", "Backend does not expose a host coding workspace");
-  binding.assertActive();
-  const assertToolActive = () => {
-    try {
-      binding.assertActive();
-    } catch (error) {
-      if (error instanceof SandboxError)
-        codingRefusal("SANDBOX_UNAVAILABLE", "Sandbox session cannot execute this operation", {
-          details: { reason: error.code }
-        });
-      throw error;
-    }
-  };
-  const { requiredRestrictions, ...options } = config;
-  return createAgentCodingTools({
-    ...options,
-    root: binding.root,
-    sandbox: {
-      adapter: binding.adapter,
-      required: requiredRestrictions ?? [
-        "write-contained",
-        "process-contained",
-        "secrets-hidden"
-      ]
-    },
-    authorize(input) {
-      assertToolActive();
-      return options.authorize(input);
-    },
-    authorizePath(input) {
-      assertToolActive();
-      return options.authorizePath?.(input) ?? true;
-    }
-  });
-}
-
-// src/agent-runtime/sandbox-coding-adapter.ts
-function createSandboxCodingAdapter(input) {
-  const { workspace, socket, executable, getPolicy, processes, assertActive } = input;
-  let policyRevision = 0;
-  const preparations = new WeakMap;
-  const grade = () => ({
-    grade: "full",
-    restrictions: getPolicy() === "deny-all" ? ["network-denied", "write-contained", "secrets-hidden", "process-contained"] : ["write-contained", "secrets-hidden", "process-contained"]
-  });
-  const adapter = {
-    probe: grade,
-    prepare(command) {
-      assertActive();
-      if (missingSandboxRestrictions(grade(), command.required ?? []).length)
-        throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox policy no longer satisfies required restrictions");
-      const environment = {};
-      preparations.set(environment, policyRevision);
-      return {
-        executable,
-        args: bubblewrapArgs({
-          workspace,
-          socket,
-          network: getPolicy(),
-          command: {
-            executable: command.executable,
-            args: [...command.args],
-            cwd: sandboxCommandCwd(workspace, command.cwd),
-            environment: { ...command.environment }
-          }
-        }),
-        environment
-      };
-    },
-    spawn(command) {
-      assertActive();
-      if (preparations.get(command.environment) !== policyRevision)
-        throw new SandboxError("SANDBOX_BUSY", "Sandbox policy changed after command preparation");
-      preparations.delete(command.environment);
-      return processes.spawn(command);
-    }
-  };
-  return {
-    adapter,
-    async refresh() {
-      policyRevision++;
-      await probeAgentProcessSandbox(adapter, { refresh: true });
-    }
-  };
-}
-
-// src/agent-runtime/sandbox-process.ts
-import { spawn } from "node:child_process";
-function spawnSandboxProcess(executable, args, limits, options = {}, onSpawn) {
-  options.signal?.throwIfAborted();
-  const child = spawn(executable, args, {
-    env: {},
-    detached: true,
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  onSpawn?.(child);
-  const stdout = [];
-  const stderr = [];
-  let bytes = 0;
-  let failure;
-  let finished = false;
-  const kill = () => {
-    if (finished || child.pid === undefined)
-      return;
-    try {
-      process.kill(-child.pid, "SIGKILL");
-    } catch (error) {
-      if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
-        failure ??= error;
-    }
-  };
-  const abort = () => {
-    failure ??= options.signal?.reason ?? new Error("Sandbox command aborted");
-    kill();
-  };
-  const timer = setTimeout(() => {
-    failure ??= new SandboxError("SANDBOX_LIMIT", "Sandbox command deadline exceeded");
-    kill();
-  }, limits.timeoutMs);
-  timer.unref();
-  const result = new Promise((resolve, reject) => {
-    const collect = (target) => (chunk) => {
-      bytes += chunk.byteLength;
-      if (bytes > limits.maxOutputBytes) {
-        failure ??= new SandboxError("SANDBOX_LIMIT", "Sandbox output limit exceeded");
-        kill();
-      } else
-        target.push(chunk);
-    };
-    child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
-    child.on("error", (error) => {
-      failure ??= new SandboxError("SANDBOX_UNAVAILABLE", "Sandbox process could not start", { cause: error });
-    });
-    child.stdin.on("error", (error) => {
-      if (!(("code" in error) && error.code === "EPIPE")) {
-        failure ??= error;
-        kill();
-      }
-    });
-    child.on("close", (code) => {
-      finished = true;
-      clearTimeout(timer);
-      options.signal?.removeEventListener("abort", abort);
-      if (failure !== undefined)
-        reject(failure);
-      else
-        resolve({
-          exitCode: code ?? 137,
-          stdout: Buffer.concat(stdout),
-          stderr: Buffer.concat(stderr)
-        });
-    });
-  });
-  result.catch(() => {
-    return;
-  });
-  options.signal?.addEventListener("abort", abort, { once: true });
-  if (options.signal?.aborted)
-    abort();
-  child.stdin.end(options.stdin);
-  return {
-    result,
-    async stop() {
-      kill();
-      await result.then(() => {
-        return;
-      }, () => {
-        return;
-      });
-    }
-  };
-}
-
-// src/agent-runtime/sandbox-process-owner.ts
-import { spawn as spawn2 } from "node:child_process";
-function sandboxProcessOwner(assertActive, maximum) {
-  const children = new Map;
-  const admit = () => {
-    assertActive();
-    if (children.size >= maximum)
-      throw new SandboxError("SANDBOX_BUSY", "Sandbox command concurrency limit reached");
-  };
-  const track = (child) => {
-    const closed = new Promise((resolve) => {
-      child.once("close", () => {
-        children.delete(child);
-        resolve();
-      });
-    });
-    children.set(child, closed);
-  };
-  return {
-    admit,
-    track,
-    get size() {
-      return children.size;
-    },
-    spawn(input) {
-      admit();
-      const child = spawn2(input.executable, [...input.args], {
-        cwd: input.cwd,
-        env: input.environment,
-        detached: true,
-        stdio: ["pipe", "pipe", "pipe"]
-      });
-      child.stdin.end();
-      track(child);
-      return child;
-    },
-    async stop() {
-      const pending = [...children];
-      for (const [child] of pending) {
-        if (child.pid === undefined)
-          continue;
-        try {
-          process.kill(-child.pid, "SIGKILL");
-        } catch (error) {
-          if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
-            throw error;
-        }
-      }
-      await Promise.all(pending.map(([, closed]) => closed));
-    }
-  };
-}
-
-// src/agent-runtime/sandbox-bubblewrap.ts
-async function createBubblewrapSandboxBackend(config) {
-  if (process.platform !== "linux")
-    throw new SandboxError("SANDBOX_UNAVAILABLE", "Bubblewrap requires Linux");
-  const executable = config.executable ?? "/usr/bin/bwrap";
-  const name = z3.string().min(1).parse(config.name ?? "bubblewrap");
-  await mkdir2(config.stateDirectory, { recursive: true, mode: 448 });
-  const root = await realpath(config.stateDirectory);
-  const storage = sandboxStorage(root, name);
-  const maximum = z3.number().int().positive().max(1024).parse(config.maxConcurrentCommands ?? 8);
-  return {
-    name,
-    prewarm: storage.prewarm,
-    async create(input) {
-      let policy = SandboxNetworkPolicySchema.parse(input.network);
-      const stored = await storage.create(input.template, input.state);
-      async function abandon() {
-        try {
-          if (!input.state)
-            await rm2(stored.directory, { recursive: true, force: true });
-        } finally {
-          await stored.release();
-        }
-      }
-      const temporary = await mkdtemp(join2(tmpdir(), "stitchkit-sandbox-")).catch(async (error) => {
-        await abandon();
-        throw error;
-      });
-      const socket = join2(temporary, "network.sock");
-      let active = true;
-      let deleted = false;
-      let stopPending;
-      const broker = await createSandboxBroker(socket, () => policy, config.onBrokerError).catch(async (error) => {
-        await abandon();
-        await rm2(temporary, { recursive: true, force: true });
-        throw error;
-      });
-      const assertActive = () => {
-        if (!active)
-          throw new SandboxError("SANDBOX_STOPPED", "Sandbox session is stopped");
-      };
-      const processes = sandboxProcessOwner(assertActive, maximum);
-      const coding = createSandboxCodingAdapter({
-        workspace: stored.workspace,
-        socket,
-        executable,
-        getPolicy: () => policy,
-        processes,
-        assertActive
-      });
-      const driver = {
-        async spawn(command, options) {
-          processes.admit();
-          const process2 = spawnSandboxProcess(executable, bubblewrapArgs({ workspace: stored.workspace, socket, command, network: policy }), {
-            timeoutMs: command.timeoutMs ?? 30000,
-            maxOutputBytes: command.maxOutputBytes ?? 1048576
-          }, options, processes.track);
-          return process2;
-        },
-        async read(path) {
-          return (await execute("/usr/bin/cat", ["--", path])).stdout;
-        },
-        async write(path, bytes) {
-          if (bytes.byteLength > 1048576)
-            throw new SandboxError("SANDBOX_LIMIT", "Sandbox file write limit exceeded");
-          await execute("/usr/bin/mkdir", ["-p", "--", posix2.dirname(path)]);
-          await execute("/usr/bin/tee", ["--", path], bytes);
-        },
-        async remove(path) {
-          await execute("/usr/bin/rm", ["-rf", "--", path]);
-        },
-        async setNetworkPolicy(next) {
-          assertActive();
-          if (processes.size)
-            throw new SandboxError("SANDBOX_BUSY", "Stop live commands before changing network policy");
-          broker.abortRequests();
-          policy = SandboxNetworkPolicySchema.parse(next);
-          await coding.refresh();
-        }
-      };
-      async function execute(binary, args, stdin) {
-        const result = await (await driver.spawn({ executable: binary, args }, { stdin })).result;
-        if (result.exitCode !== 0)
-          throw new SandboxError("SANDBOX_UNAVAILABLE", "Sandbox file operation failed");
-        return result;
-      }
-      function stop() {
-        if (stopPending)
-          return stopPending;
-        active = false;
-        stopPending = (async () => {
-          await processes.stop();
-          try {
-            await broker.close();
-          } finally {
-            try {
-              await rm2(temporary, { recursive: true, force: true });
-            } finally {
-              await stored.release();
-            }
-          }
-        })();
-        return stopPending;
-      }
-      try {
-        await execute("/usr/bin/true", []);
-      } catch (error) {
-        await stop();
-        if (!input.state)
-          await rm2(stored.directory, { recursive: true, force: true });
-        throw new SandboxError("SANDBOX_UNAVAILABLE", "Bubblewrap could not establish isolation", { cause: error });
-      }
-      return {
-        coding: { root: stored.workspace, adapter: coding.adapter, assertActive },
-        session: createSandboxSession(stored.state.sessionId, driver, "/run/stitchkit-network.sock"),
-        captureState() {
-          if (deleted)
-            throw new SandboxError("SANDBOX_STOPPED", "Sandbox session is deleted");
-          return { ...stored.state };
-        },
-        stop,
-        shutdown: stop,
-        async delete() {
-          if (deleted)
-            return;
-          await stop();
-          const lease = await storage.acquire(stored.state.sessionId);
-          try {
-            await rm2(lease.directory, { recursive: true, force: true });
-            deleted = true;
-          } catch (error) {
-            await lease.release();
-            throw error;
-          }
-        }
-      };
-    }
-  };
-}
-export {
-  createSandboxSession,
-  createSandboxCodingTools,
-  createBubblewrapSandboxBackend,
-  SandboxStateSchema,
-  SandboxNetworkPolicySchema,
-  SandboxError,
-  SandboxCommandSchema
-};