veryfront 0.1.14 → 0.1.16

package/esm/cli/commands/serve/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/serve/command.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,YAAY,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAsFD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvE"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/serve/command.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,YAAY,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAgGD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvE"}

package/esm/cli/commands/serve/command.js

@@ -21,7 +21,15 @@ async function runProxy(options) {
     const { setEnv } = await import("../../../src/platform/index.js");
     setEnv("PORT", String(options.port));
     setEnv("HOST", options.bindAddress);
+    registerTerminationSignals((signal) => {
+        cliLogger.info(`Received ${signal}, shutting down proxy server...`);
+        exitProcess(0);
+    });
+    // DenoHttpServer.serve() blocks until the server stops,
+    // so this import keeps the process alive.
     await import("../../../src/proxy/main.js");
+    // Keep the process alive (Deno.serve returns immediately in compiled binaries)
+    await new Promise(() => { });
 }
 async function runProductionServer(options) {
     showLogo();

package/esm/deno.d.ts

@@ -27,6 +27,7 @@ declare namespace _default {
         "./provider": string;
         "./fs": string;
         "./integrations": string;
+        "./sandbox": string;
         "./cli": string;
     };
     let imports: {
@@ -45,6 +46,7 @@ declare namespace _default {
         "veryfront/react/fonts": string;
         "veryfront/react/components/ai": string;
         "veryfront/components/ai": string;
+        "veryfront/sandbox": string;
         "veryfront/agent/react": string;
         "veryfront/agent/testing": string;
         "veryfront/agent/middleware": string;
@@ -127,6 +129,7 @@ declare namespace _default {
         "#veryfront/testing/bdd.ts": string;
         "#veryfront/testing/deno-compat": string;
         "#veryfront/testing/utils": string;
+        "#veryfront/sandbox": string;
         "#veryfront/tool": string;
         "#veryfront/tool/schema": string;
         "#veryfront/transforms": string;

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.14",
+    "version": "0.1.16",
     "nodeModulesDir": "auto",
     "exclude": [
         "npm/",
@@ -37,6 +37,7 @@ export default {
         "./provider": "./src/provider/index.ts",
         "./fs": "./src/fs/index.ts",
         "./integrations": "./src/integrations/index.ts",
+        "./sandbox": "./src/sandbox/index.ts",
         "./cli": "./cli/main.ts"
     },
     "imports": {
@@ -55,6 +56,7 @@ export default {
         "veryfront/react/fonts": "./src/react/fonts/index.ts",
         "veryfront/react/components/ai": "./src/react/components/ai/index.ts",
         "veryfront/components/ai": "./src/react/components/ai/index.ts",
+        "veryfront/sandbox": "./src/sandbox/index.ts",
         "veryfront/agent/react": "./src/agent/react/index.ts",
         "veryfront/agent/testing": "./src/agent/testing/index.ts",
         "veryfront/agent/middleware": "./src/agent/middleware/index.ts",
@@ -137,6 +139,7 @@ export default {
         "#veryfront/testing/bdd.ts": "./src/testing/bdd.ts",
         "#veryfront/testing/deno-compat": "./src/testing/deno-compat.ts",
         "#veryfront/testing/utils": "./src/testing/utils.ts",
+        "#veryfront/sandbox": "./src/sandbox/index.ts",
         "#veryfront/tool": "./src/tool/index.ts",
         "#veryfront/tool/schema": "./src/tool/schema/index.ts",
         "#veryfront/transforms": "./src/transforms/index.ts",

package/esm/src/platform/adapters/runtime/deno/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/runtime/deno/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAGxD,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAElB,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAiHvB,cAAM,qBAAsB,YAAW,iBAAiB;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKhD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;IAY/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAYrC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW;CAsErE;AAED,cAAM,sBAAuB,YAAW,kBAAkB;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAOrC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAInC;AAED,cAAM,iBAAkB,YAAW,aAAa;IAC9C,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,gBAAgB;CAO7D;AAED,cAAM,gBAAiB,YAAW,YAAY;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAejE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAanC;AAwBD,qBAAa,WAAY,YAAW,cAAc;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,EAAE,wBAA+B;IAC1C,QAAQ,CAAC,GAAG,yBAAgC;IAC5C,QAAQ,CAAC,MAAM,oBAA2B;IAC1C,QAAQ,CAAC,KAAK,mBAA0B;IAExC,QAAQ,CAAC,YAAY;;;;;;;;;;MAUnB;IAEF,OAAO,CAAC,YAAY,CAA2B;IAE/C,KAAK,CACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,EACnF,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,MAAM,CAAC;IAmDZ,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/runtime/deno/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAGxD,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAElB,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAiHvB,cAAM,qBAAsB,YAAW,iBAAiB;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKhD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;IAY/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAYrC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW;CAsErE;AAED,cAAM,sBAAuB,YAAW,kBAAkB;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAOrC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAInC;AAED,cAAM,iBAAkB,YAAW,aAAa;IAC9C,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,gBAAgB;CAO7D;AAED,cAAM,gBAAiB,YAAW,YAAY;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAejE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAanC;AAwBD,qBAAa,WAAY,YAAW,cAAc;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,EAAE,wBAA+B;IAC1C,QAAQ,CAAC,GAAG,yBAAgC;IAC5C,QAAQ,CAAC,MAAM,oBAA2B;IAC1C,QAAQ,CAAC,KAAK,mBAA0B;IAExC,QAAQ,CAAC,YAAY;;;;;;;;;;MAUnB;IAEF,OAAO,CAAC,YAAY,CAA2B;IAE/C,KAAK,CACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,EACnF,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,MAAM,CAAC;IAqEZ,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/esm/src/platform/adapters/runtime/deno/adapter.js

@@ -312,17 +312,34 @@ export class DenoAdapter {
         // dnt rewrites both `Deno.*` and `globalThis.*` to use @deno/shim-deno which lacks .serve.
         // `self` is not shimmed by dnt and equals `globalThis` in Deno.
         const nativeDeno = self["Deno"];
+        // Access native Response via `self` to bypass dnt shim transform.
+        // In npm packages, dnt replaces Response with undici's polyfill,
+        // but Deno.serve requires native Response instances.
+        const NativeResponse = self
+            .Response;
         const server = nativeDeno.serve({
             port,
             hostname,
             signal,
             handler: async (request) => {
                 try {
-                    return await wrappedHandler(request);
+                    const response = await wrappedHandler(request);
+                    // If already native (compiled binary), return as-is
+                    if (response instanceof NativeResponse)
+                        return response;
+                    // Re-wrap polyfilled Response as native Response.
+                    // dnt replaces Response with undici's polyfill which fails
+                    // Deno.serve's native instanceof check.
+                    const r = response;
+                    return new NativeResponse(r.body, {
+                        status: r.status,
+                        statusText: r.statusText,
+                        headers: r.headers,
+                    });
                 }
                 catch (error) {
                     serverLogger.error("Request handler error:", error);
-                    return new dntShim.Response("Internal Server Error", { status: 500 });
+                    return new NativeResponse("Internal Server Error", { status: 500 });
                 }
             },
             onListen: (params) => {

package/esm/src/platform/compat/http/deno-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deno-server.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/deno-server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGpE,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,eAAe,CAAC,CAAkB;IAEpC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAIvB"}
+{"version":3,"file":"deno-server.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/deno-server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGpE,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,eAAe,CAAC,CAAkB;IAEpC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAIvB"}

package/esm/src/platform/compat/http/deno-server.js

@@ -8,7 +8,31 @@ export class DenoHttpServer {
         onListen?.({ hostname, port });
         // Access native Deno.serve via `self` to bypass dnt shim transform.
         const nativeDeno = self["Deno"];
-        await nativeDeno.serve({ port, hostname, signal: serveSignal }, handler);
+        // Access native Response via `self` to bypass dnt shim transform.
+        // In npm packages, dnt replaces Response with undici's polyfill,
+        // but Deno.serve requires native Response instances.
+        const NativeResponse = self
+            .Response;
+        const wrappedHandler = async (req) => {
+            const response = await handler(req);
+            // If already native (compiled binary or WebSocket upgrade), return as-is
+            if (response instanceof NativeResponse)
+                return response;
+            // Re-wrap polyfilled Response as native Response.
+            // At runtime, `response` may be an undici Response (from dnt shim) that
+            // fails Deno's native instanceof check. Cast to access its properties.
+            const r = response;
+            return new NativeResponse(r.body, {
+                status: r.status,
+                statusText: r.statusText,
+                headers: r.headers,
+            });
+        };
+        const httpServer = nativeDeno.serve({ port, hostname, signal: serveSignal }, wrappedHandler);
+        // Block until the server stops (e.g. via signal abort).
+        // Deno.serve() returns synchronously; without awaiting .finished
+        // the event loop drains and the process exits in compiled binaries.
+        await httpServer.finished;
     }
     close() {
         this.abortController?.abort();

package/esm/src/sandbox/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Sandbox module for ephemeral compute environments.
+ *
+ * Provides the `Sandbox` class for creating and interacting with
+ * isolated execution environments, and re-exports `createBashTool`
+ * for AI agent integration.
+ *
+ * @example
+ * ```ts
+ * import { Sandbox } from "veryfront/sandbox";
+ *
+ * const sandbox = await Sandbox.create({ authToken: userJwt });
+ * const result = await sandbox.executeCommand("echo hello");
+ * console.log(result.stdout); // "hello\n"
+ * await sandbox.close();
+ * ```
+ *
+ * @example With bash-tool for AI agents:
+ * ```ts
+ * import { Sandbox, createBashTool } from "veryfront/sandbox";
+ *
+ * const sandbox = await Sandbox.create({ authToken });
+ * const { tools } = await createBashTool({ sandbox });
+ * // Pass tools to agent...
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+export { type ExecResult, type ExecStreamEvent, Sandbox, type SandboxOptions } from "./sandbox.js";
+//# sourceMappingURL=index.d.ts.map

package/esm/src/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/esm/src/sandbox/index.js

@@ -0,0 +1,30 @@
+/**
+ * Sandbox module for ephemeral compute environments.
+ *
+ * Provides the `Sandbox` class for creating and interacting with
+ * isolated execution environments, and re-exports `createBashTool`
+ * for AI agent integration.
+ *
+ * @example
+ * ```ts
+ * import { Sandbox } from "veryfront/sandbox";
+ *
+ * const sandbox = await Sandbox.create({ authToken: userJwt });
+ * const result = await sandbox.executeCommand("echo hello");
+ * console.log(result.stdout); // "hello\n"
+ * await sandbox.close();
+ * ```
+ *
+ * @example With bash-tool for AI agents:
+ * ```ts
+ * import { Sandbox, createBashTool } from "veryfront/sandbox";
+ *
+ * const sandbox = await Sandbox.create({ authToken });
+ * const { tools } = await createBashTool({ sandbox });
+ * // Pass tools to agent...
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+export { Sandbox } from "./sandbox.js";

package/esm/src/sandbox/sandbox.d.ts

@@ -0,0 +1,48 @@
+export interface SandboxOptions {
+    /** Base URL of the Veryfront API. Defaults to VERYFRONT_API_URL env. */
+    apiUrl?: string;
+    /** User's JWT for authentication. */
+    authToken: string;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export interface ExecStreamEvent {
+    type: "stdout" | "stderr" | "exit" | "error";
+    data?: string;
+    exitCode?: number;
+}
+export declare class Sandbox {
+    private endpoint;
+    private sessionId;
+    private authToken;
+    private apiUrl;
+    private constructor();
+    /** Create a new sandbox session. Claims a warm pod or creates a new one. */
+    static create(options: SandboxOptions): Promise<Sandbox>;
+    /** Reconnect to an existing sandbox session. */
+    static get(id: string, options: SandboxOptions): Promise<Sandbox>;
+    private static waitForReady;
+    /** Execute a bash command in the sandbox and return buffered result. */
+    executeCommand(command: string): Promise<ExecResult>;
+    /** Execute a bash command with streaming output (NDJSON). */
+    executeStream(command: string): AsyncGenerator<ExecStreamEvent>;
+    /** Read a file from the sandbox workspace. */
+    readFile(path: string): Promise<string>;
+    /** Write files to the sandbox workspace. */
+    writeFiles(files: Array<{
+        path: string;
+        content: string;
+    }>): Promise<void>;
+    /** Send a heartbeat to prevent idle timeout. */
+    heartbeat(): Promise<void>;
+    /** Close the sandbox session and mark for deletion. */
+    close(): Promise<void>;
+    /** Get the session ID. */
+    get id(): string;
+    /** Get the sandbox endpoint URL. */
+    get url(): string;
+}
+//# sourceMappingURL=sandbox.d.ts.map

package/esm/src/sandbox/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/src/sandbox/sandbox.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAJhB,OAAO;IAOP,4EAA4E;WAC/D,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B9D,gDAAgD;WACnC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;mBAmBlD,YAAY;IA0BjC,wEAAwE;IAClE,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsB1D,6DAA6D;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAAC,eAAe,CAAC;IAsCtE,8CAA8C;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAe7C,4CAA4C;IACtC,UAAU,CACd,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC;IAehB,gDAAgD;IAC1C,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC,uDAAuD;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,oCAAoC;IACpC,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF"}

package/esm/src/sandbox/sandbox.js

@@ -0,0 +1,178 @@
+/**
+ * Sandbox client SDK for ephemeral compute environments.
+ *
+ * Implements the bash-tool Sandbox interface for seamless integration
+ * with AI agent tool loops.
+ *
+ * @module
+ */
+import * as dntShim from "../../_dnt.shims.js";
+export class Sandbox {
+    endpoint;
+    sessionId;
+    authToken;
+    apiUrl;
+    constructor(endpoint, sessionId, authToken, apiUrl) {
+        this.endpoint = endpoint;
+        this.sessionId = sessionId;
+        this.authToken = authToken;
+        this.apiUrl = apiUrl;
+    }
+    /** Create a new sandbox session. Claims a warm pod or creates a new one. */
+    static async create(options) {
+        const apiUrl = options.apiUrl ||
+            (typeof dntShim.Deno !== "undefined"
+                ? dntShim.Deno.env.get("VERYFRONT_API_URL")
+                : process.env.VERYFRONT_API_URL) ||
+            "https://api.veryfront.com";
+        const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${options.authToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!res.ok) {
+            throw new Error(`Failed to create sandbox: ${res.status} ${await res.text()}`);
+        }
+        const { id, endpoint, status } = await res.json();
+        // If not yet running, poll until ready
+        if (status !== "running") {
+            await Sandbox.waitForReady(apiUrl, id, options.authToken);
+        }
+        return new Sandbox(endpoint, id, options.authToken, apiUrl);
+    }
+    /** Reconnect to an existing sandbox session. */
+    static async get(id, options) {
+        const apiUrl = options.apiUrl ||
+            (typeof dntShim.Deno !== "undefined"
+                ? dntShim.Deno.env.get("VERYFRONT_API_URL")
+                : process.env.VERYFRONT_API_URL) ||
+            "https://api.veryfront.com";
+        const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
+            headers: { Authorization: `Bearer ${options.authToken}` },
+        });
+        if (!res.ok) {
+            throw new Error(`Failed to get sandbox: ${res.status} ${await res.text()}`);
+        }
+        const { endpoint } = await res.json();
+        return new Sandbox(endpoint, id, options.authToken, apiUrl);
+    }
+    static async waitForReady(apiUrl, id, authToken, maxWaitMs = 60_000, pollIntervalMs = 2_000) {
+        const start = Date.now();
+        while (Date.now() - start < maxWaitMs) {
+            await new Promise((r) => dntShim.setTimeout(r, pollIntervalMs));
+            const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
+                headers: { Authorization: `Bearer ${authToken}` },
+            });
+            if (res.ok) {
+                const data = await res.json();
+                if (data.status === "running")
+                    return;
+                if (data.status === "error" || data.status === "deleting") {
+                    throw new Error(`Sandbox failed to start: status=${data.status}`);
+                }
+            }
+        }
+        throw new Error("Sandbox did not become ready within timeout");
+    }
+    /** Execute a bash command in the sandbox and return buffered result. */
+    async executeCommand(command) {
+        let stdout = "";
+        let stderr = "";
+        let exitCode = 1;
+        for await (const event of this.executeStream(command)) {
+            switch (event.type) {
+                case "stdout":
+                    stdout += event.data ?? "";
+                    break;
+                case "stderr":
+                    stderr += event.data ?? "";
+                    break;
+                case "exit":
+                    exitCode = event.exitCode ?? 1;
+                    break;
+            }
+        }
+        return { stdout, stderr, exitCode };
+    }
+    /** Execute a bash command with streaming output (NDJSON). */
+    async *executeStream(command) {
+        const res = await dntShim.fetch(`${this.endpoint}/exec`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${this.authToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ command }),
+        });
+        if (!res.ok) {
+            throw new Error(`Exec failed: ${res.status} ${await res.text()}`);
+        }
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop();
+            for (const line of lines) {
+                if (line.trim()) {
+                    yield JSON.parse(line);
+                }
+            }
+        }
+        if (buffer.trim()) {
+            yield JSON.parse(buffer);
+        }
+    }
+    /** Read a file from the sandbox workspace. */
+    async readFile(path) {
+        const res = await dntShim.fetch(`${this.endpoint}/file?path=${encodeURIComponent(path)}`, {
+            headers: { Authorization: `Bearer ${this.authToken}` },
+        });
+        if (!res.ok) {
+            throw new Error(`Read file failed: ${res.status} ${await res.text()}`);
+        }
+        return res.text();
+    }
+    /** Write files to the sandbox workspace. */
+    async writeFiles(files) {
+        const res = await dntShim.fetch(`${this.endpoint}/files`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${this.authToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ files }),
+        });
+        if (!res.ok) {
+            throw new Error(`Write files failed: ${res.status} ${await res.text()}`);
+        }
+    }
+    /** Send a heartbeat to prevent idle timeout. */
+    async heartbeat() {
+        await dntShim.fetch(`${this.apiUrl}/sandbox-sessions/${this.sessionId}/heartbeat`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${this.authToken}` },
+        });
+    }
+    /** Close the sandbox session and mark for deletion. */
+    async close() {
+        await dntShim.fetch(`${this.apiUrl}/sandbox-sessions/${this.sessionId}`, {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${this.authToken}` },
+        });
+    }
+    /** Get the session ID. */
+    get id() {
+        return this.sessionId;
+    }
+    /** Get the sandbox endpoint URL. */
+    get url() {
+        return this.endpoint;
+    }
+}

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/import-finder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-finder.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/import-finder.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAY1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU1D"}
+{"version":3,"file":"import-finder.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/import-finder.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAY1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB1D"}

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/import-finder.js

@@ -22,9 +22,15 @@ export function findVfModuleImports(code) {
  */
 export function findRelativeImports(code) {
     const imports = [];
-    const pattern = /from\s*["'](\.\.?\/[^"']+)["']/g;
+    // Match: from "./foo" or from "../bar"
+    const fromPattern = /from\s*["'](\.\.?\/[^"']+)["']/g;
+    // Match side-effect imports: import "./foo" or import "../bar" (no `from`)
+    const sideEffectPattern = /import\s*["'](\.\.?\/[^"']+)["']/g;
     let match;
-    while ((match = pattern.exec(code)) !== null) {
+    while ((match = fromPattern.exec(code)) !== null) {
+        imports.push(match[1]);
+    }
+    while ((match = sideEffectPattern.exec(code)) !== null) {
         imports.push(match[1]);
     }
     return [...new Set(imports)];

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/index.d.ts

@@ -24,6 +24,7 @@ export declare const _testExports: {
     resolveVeryfrontSourcePath: typeof resolveVeryfrontSourcePath;
     resolveAndTransformVeryfrontImport: typeof resolveAndTransformVeryfrontImport;
     FRAMEWORK_ROOT: string;
+    EMBEDDED_SRC_DIR: string;
     EXTENSIONS: string[];
 };
 export declare const ssrVfModulesPlugin: TransformPlugin;

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,kCAAkC,EAEnC,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kCAAkC,EAClC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAexB,eAAO,MAAM,YAAY;;;;;;;;;CASxB,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,eA+EhC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,kCAAkC,EAEnC,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kCAAkC,EAClC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAexB,eAAO,MAAM,YAAY;;;;;;;;;;CAUxB,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,eA+EhC,CAAC"}

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/index.js

@@ -43,6 +43,7 @@ export const _testExports = {
     resolveVeryfrontSourcePath,
     resolveAndTransformVeryfrontImport,
     FRAMEWORK_ROOT,
+    EMBEDDED_SRC_DIR,
     EXTENSIONS,
 };
 export const ssrVfModulesPlugin = {

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAYrE,OAAO,EAML,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,UAAQ,EAC5B,KAAK,SAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAoOjB;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAEjB"}
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAYrE,OAAO,EAOL,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,UAAQ,EAC5B,KAAK,SAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAoPjB;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAEjB"}

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.js

@@ -15,7 +15,7 @@ import { VERSION } from "../../../../utils/version.js";
 import { buildReactUrl, getReactImportMap } from "../../../import-rewriter/url-builder.js";
 import { findRelativeImports } from "./import-finder.js";
 import { resolveRelativeFrameworkImport, resolveVeryfrontSourcePath } from "./path-resolver.js";
-import { FRAMEWORK_ROOT, frameworkFileCache, frameworkWriteFlight, LOG_PREFIX, MAX_RELATIVE_IMPORT_DEPTH, transformingFiles, veryfrontTransformCache, } from "./constants.js";
+import { EMBEDDED_SRC_DIR, FRAMEWORK_ROOT, frameworkFileCache, frameworkWriteFlight, LOG_PREFIX, MAX_RELATIVE_IMPORT_DEPTH, transformingFiles, veryfrontTransformCache, } from "./constants.js";
 /**
  * Check if a transformed code string is a cycle placeholder.
  * Cycle placeholders are returned when transformFrameworkCode detects a cycle
@@ -159,6 +159,10 @@ export async function transformFrameworkCode(content, sourcePath, ctx, throwOnMi
         // Safety: MAX_RELATIVE_IMPORT_DEPTH limits recursion, transformingFiles detects
         // cycles, and frameworkFileCache deduplicates already-transformed files.
         const relativeReplacements = new Map();
+        // Prefixes for framework source directories - files outside these are
+        // already-compiled JS (e.g. dnt shims) that should not be recursively transformed.
+        const frameworkSrcDir = join(FRAMEWORK_ROOT, "src") + "/";
+        const embeddedSrcDirPrefix = EMBEDDED_SRC_DIR + "/";
         {
             const relativeImports = findRelativeImports(transformed);
             for (const specifier of relativeImports) {
@@ -174,6 +178,16 @@ export async function transformFrameworkCode(content, sourcePath, ctx, throwOnMi
                     logger.warn(`${LOG_PREFIX} Could not resolve relative import "${specifier}" in ${sourcePath}`);
                     continue;
                 }
+                // Files outside framework source directories (e.g. _dnt.shims.js,
+                // _dnt.polyfills.js) are already-compiled JS with bare npm imports
+                // that Deno resolves natively. Skip recursive transformation and
+                // just point to the file directly.
+                const isFrameworkSource = resolvedPath.startsWith(frameworkSrcDir) ||
+                    resolvedPath.startsWith(embeddedSrcDirPrefix);
+                if (!isFrameworkSource) {
+                    relativeReplacements.set(specifier, `file://${resolvedPath}`);
+                    continue;
+                }
                 // Check if this dependency was already transformed (by absolute path)
                 const existingFileUrl = frameworkFileCache.get(resolvedPath);
                 if (existingFileUrl) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -94,6 +94,9 @@
     "./integrations": {
       "import": "./esm/src/integrations/index.js"
     },
+    "./sandbox": {
+      "import": "./esm/src/sandbox/index.js"
+    },
     "./cli": {
       "import": "./esm/cli/main.js"
     },

package/src/cli/commands/serve/command.ts

@@ -37,7 +37,17 @@ async function runProxy(options: ServeOptions): Promise<void> {
   setEnv("PORT", String(options.port));
   setEnv("HOST", options.bindAddress);
 
+  registerTerminationSignals((signal) => {
+    cliLogger.info(`Received ${signal}, shutting down proxy server...`);
+    exitProcess(0);
+  });
+
+  // DenoHttpServer.serve() blocks until the server stops,
+  // so this import keeps the process alive.
   await import("../../../src/proxy/main.js");
+
+  // Keep the process alive (Deno.serve returns immediately in compiled binaries)
+  await new Promise(() => {});
 }
 
 async function runProductionServer(options: ServeOptions): Promise<void> {

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "nodeModulesDir": "auto",
   "exclude": [
     "npm/",
@@ -37,6 +37,7 @@ export default {
     "./provider": "./src/provider/index.ts",
     "./fs": "./src/fs/index.ts",
     "./integrations": "./src/integrations/index.ts",
+    "./sandbox": "./src/sandbox/index.ts",
     "./cli": "./cli/main.ts"
   },
   "imports": {
@@ -55,6 +56,7 @@ export default {
     "veryfront/react/fonts": "./src/react/fonts/index.ts",
     "veryfront/react/components/ai": "./src/react/components/ai/index.ts",
     "veryfront/components/ai": "./src/react/components/ai/index.ts",
+    "veryfront/sandbox": "./src/sandbox/index.ts",
     "veryfront/agent/react": "./src/agent/react/index.ts",
     "veryfront/agent/testing": "./src/agent/testing/index.ts",
     "veryfront/agent/middleware": "./src/agent/middleware/index.ts",
@@ -137,6 +139,7 @@ export default {
     "#veryfront/testing/bdd.ts": "./src/testing/bdd.ts",
     "#veryfront/testing/deno-compat": "./src/testing/deno-compat.ts",
     "#veryfront/testing/utils": "./src/testing/utils.ts",
+    "#veryfront/sandbox": "./src/sandbox/index.ts",
     "#veryfront/tool": "./src/tool/index.ts",
     "#veryfront/tool/schema": "./src/tool/schema/index.ts",
     "#veryfront/transforms": "./src/transforms/index.ts",

package/src/src/platform/adapters/runtime/deno/adapter.ts

@@ -397,16 +397,34 @@ export class DenoAdapter implements RuntimeAdapter {
     // dnt rewrites both `Deno.*` and `globalThis.*` to use @deno/shim-deno which lacks .serve.
     // `self` is not shimmed by dnt and equals `globalThis` in Deno.
     const nativeDeno = (self as unknown as Record<string, typeof dntShim.Deno>)["Deno"]!;
+
+    // Access native Response via `self` to bypass dnt shim transform.
+    // In npm packages, dnt replaces Response with undici's polyfill,
+    // but Deno.serve requires native Response instances.
+    const NativeResponse = (self as unknown as { Response: typeof dntShim.Response })
+      .Response;
+
     const server = nativeDeno.serve({
       port,
       hostname,
       signal,
       handler: async (request) => {
         try {
-          return await wrappedHandler(request);
+          const response: dntShim.Response = await wrappedHandler(request);
+          // If already native (compiled binary), return as-is
+          if (response instanceof NativeResponse) return response;
+          // Re-wrap polyfilled Response as native Response.
+          // dnt replaces Response with undici's polyfill which fails
+          // Deno.serve's native instanceof check.
+          const r = response as unknown as dntShim.Response;
+          return new NativeResponse(r.body, {
+            status: r.status,
+            statusText: r.statusText,
+            headers: r.headers,
+          });
         } catch (error) {
           serverLogger.error("Request handler error:", error);
-          return new dntShim.Response("Internal Server Error", { status: 500 });
+          return new NativeResponse("Internal Server Error", { status: 500 });
         }
       },
       onListen: (params) => {

package/src/src/platform/compat/http/deno-server.ts

@@ -15,7 +15,37 @@ export class DenoHttpServer implements HttpServer {
 
     // Access native Deno.serve via `self` to bypass dnt shim transform.
     const nativeDeno = (self as unknown as Record<string, typeof dntShim.Deno>)["Deno"]!;
-    await nativeDeno.serve({ port, hostname, signal: serveSignal }, handler);
+
+    // Access native Response via `self` to bypass dnt shim transform.
+    // In npm packages, dnt replaces Response with undici's polyfill,
+    // but Deno.serve requires native Response instances.
+    const NativeResponse = (self as unknown as { Response: typeof dntShim.Response })
+      .Response;
+
+    const wrappedHandler: Handler = async (req) => {
+      const response: dntShim.Response = await handler(req);
+      // If already native (compiled binary or WebSocket upgrade), return as-is
+      if (response instanceof NativeResponse) return response;
+      // Re-wrap polyfilled Response as native Response.
+      // At runtime, `response` may be an undici Response (from dnt shim) that
+      // fails Deno's native instanceof check. Cast to access its properties.
+      const r = response as unknown as dntShim.Response;
+      return new NativeResponse(r.body, {
+        status: r.status,
+        statusText: r.statusText,
+        headers: r.headers,
+      });
+    };
+
+    const httpServer = nativeDeno.serve(
+      { port, hostname, signal: serveSignal },
+      wrappedHandler,
+    );
+
+    // Block until the server stops (e.g. via signal abort).
+    // Deno.serve() returns synchronously; without awaiting .finished
+    // the event loop drains and the process exits in compiled binaries.
+    await httpServer.finished;
   }
 
   close(): Promise<void> {

package/src/src/sandbox/index.ts

@@ -0,0 +1,32 @@
+/**
+ * Sandbox module for ephemeral compute environments.
+ *
+ * Provides the `Sandbox` class for creating and interacting with
+ * isolated execution environments, and re-exports `createBashTool`
+ * for AI agent integration.
+ *
+ * @example
+ * ```ts
+ * import { Sandbox } from "veryfront/sandbox";
+ *
+ * const sandbox = await Sandbox.create({ authToken: userJwt });
+ * const result = await sandbox.executeCommand("echo hello");
+ * console.log(result.stdout); // "hello\n"
+ * await sandbox.close();
+ * ```
+ *
+ * @example With bash-tool for AI agents:
+ * ```ts
+ * import { Sandbox, createBashTool } from "veryfront/sandbox";
+ *
+ * const sandbox = await Sandbox.create({ authToken });
+ * const { tools } = await createBashTool({ sandbox });
+ * // Pass tools to agent...
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+
+
+export { type ExecResult, type ExecStreamEvent, Sandbox, type SandboxOptions } from "./sandbox.js";

package/src/src/sandbox/sandbox.ts

@@ -0,0 +1,236 @@
+/**
+ * Sandbox client SDK for ephemeral compute environments.
+ *
+ * Implements the bash-tool Sandbox interface for seamless integration
+ * with AI agent tool loops.
+ *
+ * @module
+ */
+import * as dntShim from "../../_dnt.shims.js";
+
+
+export interface SandboxOptions {
+  /** Base URL of the Veryfront API. Defaults to VERYFRONT_API_URL env. */
+  apiUrl?: string;
+  /** User's JWT for authentication. */
+  authToken: string;
+}
+
+export interface ExecResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+}
+
+export interface ExecStreamEvent {
+  type: "stdout" | "stderr" | "exit" | "error";
+  data?: string;
+  exitCode?: number;
+}
+
+export class Sandbox {
+  private constructor(
+    private endpoint: string,
+    private sessionId: string,
+    private authToken: string,
+    private apiUrl: string,
+  ) {}
+
+  /** Create a new sandbox session. Claims a warm pod or creates a new one. */
+  static async create(options: SandboxOptions): Promise<Sandbox> {
+    const apiUrl = options.apiUrl ||
+      (typeof dntShim.Deno !== "undefined"
+        ? dntShim.Deno.env.get("VERYFRONT_API_URL")
+        : process.env.VERYFRONT_API_URL) ||
+      "https://api.veryfront.com";
+
+    const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${options.authToken}`,
+        "Content-Type": "application/json",
+      },
+    });
+
+    if (!res.ok) {
+      throw new Error(`Failed to create sandbox: ${res.status} ${await res.text()}`);
+    }
+
+    const { id, endpoint, status } = await res.json();
+
+    // If not yet running, poll until ready
+    if (status !== "running") {
+      await Sandbox.waitForReady(apiUrl, id, options.authToken);
+    }
+
+    return new Sandbox(endpoint, id, options.authToken, apiUrl);
+  }
+
+  /** Reconnect to an existing sandbox session. */
+  static async get(id: string, options: SandboxOptions): Promise<Sandbox> {
+    const apiUrl = options.apiUrl ||
+      (typeof dntShim.Deno !== "undefined"
+        ? dntShim.Deno.env.get("VERYFRONT_API_URL")
+        : process.env.VERYFRONT_API_URL) ||
+      "https://api.veryfront.com";
+
+    const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
+      headers: { Authorization: `Bearer ${options.authToken}` },
+    });
+
+    if (!res.ok) {
+      throw new Error(`Failed to get sandbox: ${res.status} ${await res.text()}`);
+    }
+
+    const { endpoint } = await res.json();
+    return new Sandbox(endpoint, id, options.authToken, apiUrl);
+  }
+
+  private static async waitForReady(
+    apiUrl: string,
+    id: string,
+    authToken: string,
+    maxWaitMs = 60_000,
+    pollIntervalMs = 2_000,
+  ): Promise<void> {
+    const start = Date.now();
+    while (Date.now() - start < maxWaitMs) {
+      await new Promise((r) => dntShim.setTimeout(r, pollIntervalMs));
+
+      const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
+        headers: { Authorization: `Bearer ${authToken}` },
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        if (data.status === "running") return;
+        if (data.status === "error" || data.status === "deleting") {
+          throw new Error(`Sandbox failed to start: status=${data.status}`);
+        }
+      }
+    }
+    throw new Error("Sandbox did not become ready within timeout");
+  }
+
+  /** Execute a bash command in the sandbox and return buffered result. */
+  async executeCommand(command: string): Promise<ExecResult> {
+    let stdout = "";
+    let stderr = "";
+    let exitCode = 1;
+
+    for await (const event of this.executeStream(command)) {
+      switch (event.type) {
+        case "stdout":
+          stdout += event.data ?? "";
+          break;
+        case "stderr":
+          stderr += event.data ?? "";
+          break;
+        case "exit":
+          exitCode = event.exitCode ?? 1;
+          break;
+      }
+    }
+
+    return { stdout, stderr, exitCode };
+  }
+
+  /** Execute a bash command with streaming output (NDJSON). */
+  async *executeStream(command: string): AsyncGenerator<ExecStreamEvent> {
+    const res = await dntShim.fetch(`${this.endpoint}/exec`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.authToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ command }),
+    });
+
+    if (!res.ok) {
+      throw new Error(`Exec failed: ${res.status} ${await res.text()}`);
+    }
+
+    const reader = res.body!.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop()!;
+
+      for (const line of lines) {
+        if (line.trim()) {
+          yield JSON.parse(line) as ExecStreamEvent;
+        }
+      }
+    }
+
+    if (buffer.trim()) {
+      yield JSON.parse(buffer) as ExecStreamEvent;
+    }
+  }
+
+  /** Read a file from the sandbox workspace. */
+  async readFile(path: string): Promise<string> {
+    const res = await dntShim.fetch(
+      `${this.endpoint}/file?path=${encodeURIComponent(path)}`,
+      {
+        headers: { Authorization: `Bearer ${this.authToken}` },
+      },
+    );
+
+    if (!res.ok) {
+      throw new Error(`Read file failed: ${res.status} ${await res.text()}`);
+    }
+
+    return res.text();
+  }
+
+  /** Write files to the sandbox workspace. */
+  async writeFiles(
+    files: Array<{ path: string; content: string }>,
+  ): Promise<void> {
+    const res = await dntShim.fetch(`${this.endpoint}/files`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.authToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ files }),
+    });
+
+    if (!res.ok) {
+      throw new Error(`Write files failed: ${res.status} ${await res.text()}`);
+    }
+  }
+
+  /** Send a heartbeat to prevent idle timeout. */
+  async heartbeat(): Promise<void> {
+    await dntShim.fetch(`${this.apiUrl}/sandbox-sessions/${this.sessionId}/heartbeat`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${this.authToken}` },
+    });
+  }
+
+  /** Close the sandbox session and mark for deletion. */
+  async close(): Promise<void> {
+    await dntShim.fetch(`${this.apiUrl}/sandbox-sessions/${this.sessionId}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${this.authToken}` },
+    });
+  }
+
+  /** Get the session ID. */
+  get id(): string {
+    return this.sessionId;
+  }
+
+  /** Get the sandbox endpoint URL. */
+  get url(): string {
+    return this.endpoint;
+  }
+}

package/src/src/transforms/pipeline/stages/ssr-vf-modules/import-finder.ts

@@ -26,10 +26,17 @@ export function findVfModuleImports(code: string): string[] {
  */
 export function findRelativeImports(code: string): string[] {
   const imports: string[] = [];
-  const pattern = /from\s*["'](\.\.?\/[^"']+)["']/g;
+
+  // Match: from "./foo" or from "../bar"
+  const fromPattern = /from\s*["'](\.\.?\/[^"']+)["']/g;
+  // Match side-effect imports: import "./foo" or import "../bar" (no `from`)
+  const sideEffectPattern = /import\s*["'](\.\.?\/[^"']+)["']/g;
 
   let match: RegExpExecArray | null;
-  while ((match = pattern.exec(code)) !== null) {
+  while ((match = fromPattern.exec(code)) !== null) {
+    imports.push(match[1]!);
+  }
+  while ((match = sideEffectPattern.exec(code)) !== null) {
     imports.push(match[1]!);
   }
 

package/src/src/transforms/pipeline/stages/ssr-vf-modules/index.ts

@@ -85,6 +85,7 @@ export const _testExports = {
   resolveVeryfrontSourcePath,
   resolveAndTransformVeryfrontImport,
   FRAMEWORK_ROOT,
+  EMBEDDED_SRC_DIR,
   EXTENSIONS,
 };
 

package/src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts

@@ -18,6 +18,7 @@ import { buildReactUrl, getReactImportMap } from "../../../import-rewriter/url-b
 import { findRelativeImports } from "./import-finder.js";
 import { resolveRelativeFrameworkImport, resolveVeryfrontSourcePath } from "./path-resolver.js";
 import {
+  EMBEDDED_SRC_DIR,
   FRAMEWORK_ROOT,
   frameworkFileCache,
   frameworkWriteFlight,
@@ -193,6 +194,11 @@ export async function transformFrameworkCode(
     // cycles, and frameworkFileCache deduplicates already-transformed files.
     const relativeReplacements = new Map<string, string>();
 
+    // Prefixes for framework source directories - files outside these are
+    // already-compiled JS (e.g. dnt shims) that should not be recursively transformed.
+    const frameworkSrcDir = join(FRAMEWORK_ROOT, "src") + "/";
+    const embeddedSrcDirPrefix = EMBEDDED_SRC_DIR + "/";
+
     {
       const relativeImports = findRelativeImports(transformed);
 
@@ -215,6 +221,17 @@ export async function transformFrameworkCode(
           continue;
         }
 
+        // Files outside framework source directories (e.g. _dnt.shims.js,
+        // _dnt.polyfills.js) are already-compiled JS with bare npm imports
+        // that Deno resolves natively. Skip recursive transformation and
+        // just point to the file directly.
+        const isFrameworkSource = resolvedPath.startsWith(frameworkSrcDir) ||
+          resolvedPath.startsWith(embeddedSrcDirPrefix);
+        if (!isFrameworkSource) {
+          relativeReplacements.set(specifier, `file://${resolvedPath}`);
+          continue;
+        }
+
         // Check if this dependency was already transformed (by absolute path)
         const existingFileUrl = frameworkFileCache.get(resolvedPath);
         if (existingFileUrl) {