@agent-compose/sdk 0.8.4 → 0.8.6

package/src/sandbox/registry.ts

@@ -6,7 +6,7 @@
  * at creation time.
  */
 
-import { SandboxNotFoundError, RateLimitError } from "e2b";
+import { SandboxNotFoundError, RateLimitError, NotFoundError } from "e2b";
 import pRetry from "p-retry";
 import type { FailedAttemptError } from "p-retry";
 import type { SandboxProvider } from "../types/sandbox.js";
@@ -45,6 +45,24 @@ function isTransientSandboxError(error: unknown): boolean {
     .test(message);
 }
 
+/** Did a CREATE fail because its create SOURCE (template alias / snapshot id)
+ *  does not resolve on the provider — vs any other create fault? The server's
+ *  recovery-boot fall-through keys on this: a ring snapshot licensed on an
+ *  INDETERMINATE existence probe that turns out to be gone must fall through
+ *  the ring toward the base image, while every other create fault (quota,
+ *  auth, 5xx, network) must propagate — falling through on those would trade
+ *  a still-recoverable machine state for a base boot. E2B maps the create-
+ *  time 404 ("template not found") to its typed `NotFoundError`; the message
+ *  match is the fallback for untyped transports (Vercel). Lives in the SDK
+ *  because the server holds its OWN `e2b` module instance — an `instanceof`
+ *  against the class from the wrong copy is always false. */
+export function isSandboxSourceNotFoundError(error: unknown): boolean {
+  if (error instanceof NotFoundError) return true;
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return /(?:template|snapshot)[^\n]{0,80}not[\s_-]?found|not[\s_-]?found[^\n]{0,80}(?:template|snapshot)/i
+    .test(message);
+}
+
 /** The ONE place the sandbox retry policy lives. Provisioning, reconnecting, and
  *  snapshotting all race with the sandbox being paused/reclaimed; this runs the call
  *  through p-retry's generic backoff, retrying ONLY the transient race (and failing

package/src/sandbox/sizes.ts

@@ -148,15 +148,21 @@ export function sandboxSizeLabel(size: SandboxSize): string {
 /** Stable E2B template ALIAS for the platform base at a given size
  *  (`agent-compose-base-<size>`). Aliases — not snapshot ids — so the refs are
  *  multi-account-clean: the same string resolves in any E2B account that built
- *  the templates. Built by `infra/e2b-template/build.ts`; the E2B provider
- *  boots this when a run on E2B declares no explicit `bootFrom`/template. */
+ *  the templates. Built by `infra/e2b-template/build.ts`. An EXPLICIT
+ *  `bootFrom`/template target only — nothing boots it by default: template-less
+ *  E2B creates resolve `e2bAgentEnvTemplate` (the session-identical image)
+ *  instead, so the run and session lanes can never diverge on baked tooling. */
 export function e2bBaseTemplate(size: SandboxSize): string {
   return `agent-compose-base-${size}`;
 }
 
-/** Stable E2B template ALIAS for the agent runtime (base + claude binary) at a
- *  given size (`agent-env-<size>`). The agent default templates boot from this
- *  via `bootFrom: { snapshotId: e2bAgentEnvTemplate(size) }`. Multi-account-clean
+/** Stable E2B template ALIAS for the agent runtime (base + claude binary +
+ *  dev toolbelt + session desktop) at a given size (`agent-env-<size>`).
+ *  THE default E2B boot image, both lanes: every cloud SESSION boots it
+ *  (server/src/sandbox/persistent.ts), and every template-less E2B workflow
+ *  RUN boots it too (the e2b provider's size-matched default). The agent
+ *  default templates boot from this via
+ *  `bootFrom: { snapshotId: e2bAgentEnvTemplate(size) }`. Multi-account-clean
  *  for the same reason as `e2bBaseTemplate`. */
 export function e2bAgentEnvTemplate(size: SandboxSize): string {
   return `agent-env-${size}`;

package/src/sandbox.ts

@@ -5,8 +5,9 @@
  *   - `sandbox/network-policy.ts` — egress policy shape + per-provider translators
  *   - `sandbox/sizes.ts`          — machine sizes + E2B template aliases
  *   - `sandbox/devbox.ts`         — the ADR-0038 per-member desktop machine alias
+ *   - `sandbox/baked-clis.ts`     — harness CLI versions the session image bakes
  *   - `sandbox/provider-def.ts`   — provider contract, create opts, fleet tag
- *   - `sandbox/exec-stream.ts`    — SSE exec-stream parser (broker clients)
+ *   - `sandbox/exec-stream.ts`    — SSE exec-stream parser
  *   - `sandbox/providers/*`       — vercel / e2b / e2b-desktop / local providers
  *   - `sandbox/registry.ts`       — provider registry + fleet management
  */
@@ -19,7 +20,7 @@ export type {
   SandboxNetworkSubnetPolicy,
   SandboxNetworkPolicy,
 } from "./sandbox/network-policy.js";
-export { DOT_SEGMENT_PATH_RE2, toVercelNetworkPolicy, toE2bNetwork } from "./sandbox/network-policy.js";
+export { DOT_SEGMENT_PATH_RE2, openEgressExcept, toVercelNetworkPolicy, toE2bNetwork } from "./sandbox/network-policy.js";
 
 export type { SandboxSize } from "./sandbox/sizes.js";
 export {
@@ -48,6 +49,11 @@ export {
   e2bDevboxTemplateRef,
 } from "./sandbox/devbox.js";
 
+export {
+  CLAUDE_CODE_VERSION, CODEX_CLI_VERSION, OPENCODE_CLI_VERSION, RTK_VERSION,
+  CLAUDE_CODE_NO_SELF_UPDATE_ENV, CODEX_NO_SELF_UPDATE_CONFIG_LINE, OPENCODE_NO_SELF_UPDATE_CONFIG,
+} from "./sandbox/baked-clis.js";
+
 export { AGENT_COMPOSE_TAG } from "./sandbox/provider-def.js";
 export type { SandboxCreateOpts, OwnedSandbox } from "./sandbox/provider-def.js";
 
@@ -65,6 +71,7 @@ export {
   reconnectSandbox,
   deleteSandboxSnapshot,
   snapshotResolves,
+  isSandboxSourceNotFoundError,
   getSandboxQuotas,
   listOwnedSandboxes,
   killSandboxById,

package/src/step-invocation/invoker.ts

@@ -526,12 +526,8 @@ export async function invokeStep<TOutput = unknown>(
 
   let result: { stdout: string; stderr: string; exitCode: number };
   try {
-    // Run the agent as ROOT (ADR-0019 follow-up). The factory drive (Archil)
-    // presents its S3-synced files root-owned and exposes no uid-mapped mount,
-    // so a non-root agent EACCESes on every shared file — the reason for the
-    // expensive boot-time `chmod -R` walk. As root the agent writes them
-    // directly: the walk disappears entirely. Egress is edge-enforced with NO
-    // root exemption (see sandbox.ts), so root is confined exactly like the
+    // Run the agent as ROOT (ADR-0019 follow-up). Egress is edge-enforced with
+    // NO root exemption (see sandbox.ts), so root is confined exactly like the
     // non-root user. `HOME=/root` so the spawned `claude` finds root's skills.
     //
     // Same pipeline pattern as `launchStep`: tee the runner's stdout to the

package/src/step-invocation/protocol.ts

@@ -38,12 +38,11 @@ export function stepPauseLinePrefix(token: string): string {
   return `${STEP_PAUSE_PREFIX}${token}:`;
 }
 
-/** Sandbox-side path where dispatch writes the compiled runner bundle.
- *  Both modes (full-mode `dispatch.ts` and step-mode `invokeStep`) spawn
- *  the runner from this path; single source of truth. */
+/** Sandbox-side path where the sandbox bootstrap writes the compiled runner
+ *  bundle; `invokeStep` spawns the runner from this path. */
 export const RUNNER_BUNDLE_PATH = "/tmp/runner.bundle.js";
 
-/** Command the invoker (and dispatch) spawns inside the sandbox. */
+/** Command the invoker spawns inside the sandbox. */
 export const RUNNER_COMMAND = `node ${RUNNER_BUNDLE_PATH}`;
 
 /** Names of the env vars the invoker stamps onto the runner subprocess.

package/src/step-invocation/server.ts

@@ -153,8 +153,8 @@ function scrubProtocolEnvs(): void {
  * from process.env so user code (including any workflow module imported
  * inside the handler) cannot read AC_STEP_RESULT_TOKEN — that keeps the
  * result channel uncorruptible by stdout output from anywhere in the
- * workflow's dep tree. RUN_ID remains available to match full-mode
- * runner behaviour.
+ * workflow's dep tree. RUN_ID remains available: SDK code inside the step
+ * (`agent()`, the client's parent-run link) reads it.
  */
 export async function serveStep<TInput, TOutput>(
   handler: StepHandler<TInput, TOutput>,