Defines the `Sandbox` protocol (ABC) with methods `execute()`, `Mount`, `to_guest_path()`, `to_host_path()`, and `write_file()`. This is a clean, self-contained abstraction that isolates code execution from the host, with multiple implementations (`NullSandbox`, `QuicksandSandbox`). The protocol includes path translation sorted by mount depth, making it easy to swap sandbox implementations or add new ones without changing agent logic.

Provides atomic JSON read/write functions with size caps (50MB), safe fallback logic, and a `json_encoder_default` that handles enums, `set`, `datetime`, and `Path` objects. The `write_size_capped` function ensures state files never exceed a configurable maximum. This is a reusable, standalone utility for persisting agent state without introducing database schema dependencies.

Implements `classify_bash_command()`, `classify_file_tool()`, and `classify_sensitive_read()` using a `CommandVerdict` enum (ALLOW, REQUIRE_APPROVAL, DENY) and a `Category` enum (DESTRUCTIVE, DANGEROUS, UNBOUNDED, etc.). This is a standalone, testable module that applies flag-aware classification (e.g., `base64 -o` is destructive, `tail -f` is unbounded) without any system-side effects. The pattern can be reused in any application that needs to sandbox or gate command execution.

The `WebSocketManager` handles the full lifecycle of agent runs over WebSocket: connect/disconnect with grace period (for reconnection), stream execution with pause/resume via asyncio.Queue, stop with task cancellation, input/approval/continuation responses, and cleanup. It uses a `_pool_full` semaphore to limit concurrent runs and provides idempotency guards. This pattern is a robust, self-contained WebSocket session manager that could be extracted for any real-time agent application.

A React context provider and hook that manages WebSocket connection lifecycle with auto-reconnect (exponential backoff), heartbeat, status tracking, and message dispatch to Zustand stores. It exposes `sendMessage` for typed commands (start, stop, pause, input, approval, continuation). The pattern separates connection state from rendering logic and is reusable in any React application needing persistent WebSocket communication.

Provides `validate_host_path()` which enforces containment within allowed directories (home, mounts), checks symlink escapes via `os.path.realpath`, and applies a configurable denylist (`.ssh`, `.aws`, `/etc`, etc.). Also includes `normalize_host_path()` for WSL path resolution and `validate_session_id()`/`validate_dir_name()` for injection prevention. This is a standalone, testable path sanitization module that can be reused in any application dealing with user-supplied file paths.