@agentworkforce/deploy 0.0.0

package/dist/modes/sandbox-client.test.js

@@ -0,0 +1,177 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { createProxySandboxClient, SANDBOX_BUNDLE_DIR } from './sandbox-client.js';
+function fakeFetch(handlers) {
+    const calls = [];
+    let i = 0;
+    const impl = (async (input, init) => {
+        const url = typeof input === 'string' ? input : input.toString();
+        const headers = {};
+        if (init?.headers) {
+            const entries = init.headers instanceof Headers
+                ? Array.from(init.headers.entries())
+                : Array.isArray(init.headers)
+                    ? init.headers
+                    : Object.entries(init.headers);
+            for (const [k, v] of entries)
+                headers[k.toLowerCase()] = String(v);
+        }
+        const body = init?.body ? JSON.parse(init.body.toString()) : undefined;
+        const call = {
+            url,
+            method: init?.method ?? 'GET',
+            headers,
+            ...(body !== undefined ? { body } : {})
+        };
+        calls.push(call);
+        const handler = handlers[i];
+        if (!handler)
+            throw new Error(`fakeFetch: no handler at call index ${i}`);
+        i += 1;
+        return handler(call);
+    });
+    return { fetch: impl, calls };
+}
+async function fixtureBundle(dir) {
+    const runnerPath = path.join(dir, 'runner.mjs');
+    const bundlePath = path.join(dir, 'agent.bundle.mjs');
+    const personaCopyPath = path.join(dir, 'persona.json');
+    const packageJsonPath = path.join(dir, 'package.json');
+    await Promise.all([
+        writeFile(runnerPath, 'runner', 'utf8'),
+        writeFile(bundlePath, 'bundle', 'utf8'),
+        writeFile(personaCopyPath, '{"id":"demo"}', 'utf8'),
+        writeFile(packageJsonPath, '{}', 'utf8')
+    ]);
+    return { runnerPath, bundlePath, personaCopyPath, packageJsonPath, sizeBytes: 13 };
+}
+test('proxy client mints, uploads, execs, and destroys against cloud sandboxes endpoint', async () => {
+    const dir = await mkdtemp(path.join(os.tmpdir(), 'wf-sandbox-'));
+    try {
+        const bundle = await fixtureBundle(dir);
+        const { fetch: impl, calls } = fakeFetch([
+            // POST /sandboxes
+            () => new Response(JSON.stringify({
+                sandboxId: 'sbx_test',
+                authMode: 'proxy',
+                execUrl: 'https://cloud.example.com/api/v1/workspaces/ws/sandboxes/sbx_test/exec',
+                filesUrl: 'https://cloud.example.com/api/v1/workspaces/ws/sandboxes/sbx_test/files'
+            }), { status: 201 }),
+            // PUT /files
+            () => new Response(null, { status: 204 }),
+            // POST /exec (npm install)
+            () => new Response(JSON.stringify({ exitCode: 0, output: 'added 1 package' }), { status: 200 }),
+            // POST /exec (node runner.mjs)
+            () => new Response(JSON.stringify({ exitCode: 0, output: 'runner ok' }), { status: 200 }),
+            // DELETE /sandboxes/:id
+            () => new Response(null, { status: 204 })
+        ]);
+        const client = createProxySandboxClient({
+            cloudUrl: 'https://cloud.example.com',
+            workspaceId: 'ws',
+            workspaceToken: 'tok-secret',
+            personaId: 'demo',
+            fetchImpl: impl
+        });
+        const handle = await client.mint({
+            label: 'wf-demo',
+            env: { WORKFORCE_WORKSPACE_ID: 'ws' }
+        });
+        assert.equal(handle.mode, 'proxy');
+        assert.equal(handle.sandboxId, 'sbx_test');
+        assert.equal(handle.id, 'proxy:sbx_test');
+        await client.uploadBundle(handle, bundle);
+        const runResult = await client.exec(handle, 'node runner.mjs', {
+            cwd: SANDBOX_BUNDLE_DIR,
+            timeoutSeconds: 60
+        });
+        assert.equal(runResult.exitCode, 0);
+        assert.equal(runResult.output, 'runner ok');
+        await client.destroy(handle);
+        // Mint request shape.
+        assert.equal(calls[0].url, 'https://cloud.example.com/api/v1/workspaces/ws/sandboxes');
+        assert.equal(calls[0].method, 'POST');
+        assert.equal(calls[0].headers.authorization, 'Bearer tok-secret');
+        assert.equal(calls[0].body.purpose, 'workforce-deploy');
+        assert.equal(calls[0].body.personaId, 'demo');
+        // Upload PUT carries base64 file entries.
+        assert.equal(calls[1].method, 'PUT');
+        assert.match(calls[1].url, /\/sandboxes\/sbx_test\/files$/);
+        const uploadBody = calls[1].body;
+        assert.equal(uploadBody.entries.length, 4);
+        const runnerEntry = uploadBody.entries.find((e) => e.destination.endsWith('/runner.mjs'));
+        assert.ok(runnerEntry);
+        assert.equal(Buffer.from(runnerEntry.source, 'base64').toString('utf8'), 'runner');
+        // Install exec.
+        assert.equal(calls[2].method, 'POST');
+        assert.match(calls[2].url, /\/sandboxes\/sbx_test\/exec$/);
+        assert.match(calls[2].body.command, /^npm install/);
+        // Runner exec.
+        assert.equal(calls[3].body.command, 'node runner.mjs');
+        // Delete by sandbox id.
+        assert.equal(calls[4].method, 'DELETE');
+        assert.match(calls[4].url, /\/sandboxes\/sbx_test$/);
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+});
+test('proxy client surfaces non-2xx mint responses with the cloud status + excerpt', async () => {
+    const { fetch: impl } = fakeFetch([
+        () => new Response('quota exceeded', { status: 429, statusText: 'Too Many Requests' })
+    ]);
+    const client = createProxySandboxClient({
+        cloudUrl: 'https://cloud.example.com',
+        workspaceId: 'ws',
+        workspaceToken: 'tok',
+        personaId: 'demo',
+        fetchImpl: impl
+    });
+    await assert.rejects(() => client.mint({ label: 'wf-demo' }), /sandbox\(proxy\)\.mint: 429 Too Many Requests/);
+});
+test('proxy client tolerates 404 on destroy (already deleted)', async () => {
+    const { fetch: impl } = fakeFetch([
+        () => new Response('not found', { status: 404, statusText: 'Not Found' })
+    ]);
+    const client = createProxySandboxClient({
+        cloudUrl: 'https://cloud.example.com',
+        workspaceId: 'ws',
+        workspaceToken: 'tok',
+        personaId: 'demo',
+        fetchImpl: impl
+    });
+    // Construct a minimal proxy handle by hand (we don't want to mint first).
+    await client.destroy({ id: 'proxy:x', sandboxId: 'x', mode: 'proxy' });
+});
+test('proxy client throws when npm install in the sandbox fails', async () => {
+    const dir = await mkdtemp(path.join(os.tmpdir(), 'wf-sandbox-'));
+    try {
+        const bundle = await fixtureBundle(dir);
+        const { fetch: impl } = fakeFetch([
+            () => new Response(JSON.stringify({
+                sandboxId: 'sbx',
+                authMode: 'proxy',
+                execUrl: 'https://cloud.example.com/api/v1/workspaces/ws/sandboxes/sbx/exec',
+                filesUrl: 'https://cloud.example.com/api/v1/workspaces/ws/sandboxes/sbx/files'
+            }), { status: 201 }),
+            () => new Response(null, { status: 204 }),
+            () => new Response(JSON.stringify({ exitCode: 1, output: 'EACCES' }), { status: 200 })
+        ]);
+        const client = createProxySandboxClient({
+            cloudUrl: 'https://cloud.example.com',
+            workspaceId: 'ws',
+            workspaceToken: 'tok',
+            personaId: 'demo',
+            fetchImpl: impl
+        });
+        const handle = await client.mint({ label: 'wf' });
+        await assert.rejects(() => client.uploadBundle(handle, bundle), /npm install failed \(exit 1\)/);
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=sandbox-client.test.js.map

package/dist/modes/sandbox-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-client.test.js","sourceRoot":"","sources":["../../src/modes/sandbox-client.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAUnF,SAAS,SAAS,CAChB,QAAqE;IAErE,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QACnE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjE,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,YAAY,OAAO;gBAC7B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO;oBACd,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,IAAI,GAAiB;YACzB,GAAG;YACH,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC,IAAI,CAAC,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAiB,CAAC;IACnB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;QACvC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;QACvC,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC;QACnD,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,IAAI,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;YACvC,kBAAkB;YAClB,GAAG,EAAE,CACH,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wEAAwE;gBACjF,QAAQ,EAAE,yEAAyE;aACpF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;YACH,aAAa;YACb,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzC,2BAA2B;YAC3B,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC/F,+BAA+B;YAC/B,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzF,wBAAwB;YACxB,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,YAAY;YAC5B,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAE1C,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE;YAC7D,GAAG,EAAE,kBAAkB;YACvB,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE5C,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7B,sBAAsB;QACtB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,0DAA0D,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAA4B,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAA8B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEzE,0CAA0C;QAC1C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAmE,CAAC;QAChG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEpF,gBAAgB;QAChB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE7E,eAAe;QACf,MAAM,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAA4B,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAEhF,wBAAwB;QACxB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;IAC9F,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;QAChC,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,QAAQ,EAAE,2BAA2B;QACrC,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,KAAK;QACrB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EACvC,+CAA+C,CAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;QAChC,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,QAAQ,EAAE,2BAA2B;QACrC,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,KAAK;QACrB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,0EAA0E;IAC1E,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;YAChC,GAAG,EAAE,CACH,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,mEAAmE;gBAC5E,QAAQ,EAAE,oEAAoE;aAC/E,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;YACH,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzC,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACnG,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/modes/sandbox.d.ts

@@ -0,0 +1,50 @@
+import type { ModeLaunchInput, ModeLauncher } from '../types.js';
+import { type SandboxClient } from './sandbox-client.js';
+/**
+ * Daytona-backed sandbox launcher with two auth paths:
+ *
+ *   - **BYO** — `DAYTONA_API_KEY` (or `DAYTONA_JWT_TOKEN` +
+ *     `DAYTONA_ORGANIZATION_ID`) is present in env. The launcher talks
+ *     directly to Daytona via `@daytonaio/sdk`. Zero workforce-cloud
+ *     round-trips; useful in CI or for power users with their own
+ *     Daytona accounts.
+ *   - **Workforce-managed** — `DAYTONA_API_KEY` is absent but
+ *     `WORKFORCE_WORKSPACE_TOKEN` is set (either via `workforce login`
+ *     or exported manually). The launcher POSTs the cloud sandboxes
+ *     endpoint to mint a proxy handle and routes all exec/upload
+ *     traffic through cloud's per-sandbox `/exec` and `/files` URLs.
+ *     Cloud holds the org Daytona credentials so users never see them.
+ *
+ * Mode picking is purely env-based today. Pass `--byo-sandbox` on the
+ * deploy CLI to force BYO when both are configured (handled in
+ * `resolveLauncher`, not here).
+ *
+ * Streaming: cloud's `/exec` endpoint and Daytona's `executeCommand` are
+ * both final-result-only. The runner exits when its envelope stream
+ * ends, and the resulting output is forwarded to DeployIO at that
+ * point. Live tail support is gated on a future iteration.
+ */
+export declare const sandboxLauncher: ModeLauncher;
+/**
+ * Pick the sandbox client implementation based on env. Public so the
+ * deploy orchestrator (and tests) can plug in an explicit choice.
+ */
+export declare function resolveSandboxClient(input: Pick<ModeLaunchInput, 'workspace' | 'persona' | 'env'> & Partial<Pick<ModeLaunchInput, 'io'>>, overrides?: {
+    /** Force BYO even when both BYO and workforce-managed are configured. */
+    forceByo?: boolean;
+    /** Inject a custom client (tests). */
+    client?: SandboxClient;
+}): SandboxClient;
+export { SANDBOX_BUNDLE_DIR, createByoSandboxClient, createProxySandboxClient, type SandboxClient, type SandboxHandle } from './sandbox-client.js';
+/**
+ * Legacy alias for the env-resolved Daytona credentials surface. Kept so
+ * existing imports of `resolveSandboxAuth` continue to compile; new code
+ * should use `resolveSandboxClient` instead.
+ */
+export interface SandboxAuth {
+    apiKey?: string;
+    jwtToken?: string;
+    organizationId?: string;
+}
+export declare function resolveSandboxAuth(): SandboxAuth | undefined;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/modes/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/modes/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAEf,YAAY,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAI7B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,EAAE,YA2D7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,EACpG,SAAS,GAAE;IACT,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sCAAsC;IACtC,MAAM,CAAC,EAAE,aAAa,CAAC;CACnB,GACL,aAAa,CAkCf;AAGD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,IAAI,WAAW,GAAG,SAAS,CAU5D"}

package/dist/modes/sandbox.js

@@ -0,0 +1,131 @@
+import { SANDBOX_BUNDLE_DIR, createByoSandboxClient, createProxySandboxClient } from './sandbox-client.js';
+const DEFAULT_CLOUD_URL = 'https://cloud.agentworkforce.com';
+/**
+ * Daytona-backed sandbox launcher with two auth paths:
+ *
+ *   - **BYO** — `DAYTONA_API_KEY` (or `DAYTONA_JWT_TOKEN` +
+ *     `DAYTONA_ORGANIZATION_ID`) is present in env. The launcher talks
+ *     directly to Daytona via `@daytonaio/sdk`. Zero workforce-cloud
+ *     round-trips; useful in CI or for power users with their own
+ *     Daytona accounts.
+ *   - **Workforce-managed** — `DAYTONA_API_KEY` is absent but
+ *     `WORKFORCE_WORKSPACE_TOKEN` is set (either via `workforce login`
+ *     or exported manually). The launcher POSTs the cloud sandboxes
+ *     endpoint to mint a proxy handle and routes all exec/upload
+ *     traffic through cloud's per-sandbox `/exec` and `/files` URLs.
+ *     Cloud holds the org Daytona credentials so users never see them.
+ *
+ * Mode picking is purely env-based today. Pass `--byo-sandbox` on the
+ * deploy CLI to force BYO when both are configured (handled in
+ * `resolveLauncher`, not here).
+ *
+ * Streaming: cloud's `/exec` endpoint and Daytona's `executeCommand` are
+ * both final-result-only. The runner exits when its envelope stream
+ * ends, and the resulting output is forwarded to DeployIO at that
+ * point. Live tail support is gated on a future iteration.
+ */
+export const sandboxLauncher = {
+    async launch(input) {
+        const client = resolveSandboxClient(input, input.byoSandbox ? { forceByo: true } : {});
+        const handle = await client.mint({
+            label: `wf-${input.persona.id}`,
+            env: {
+                ...(input.env ?? {}),
+                WORKFORCE_WORKSPACE_ID: input.workspace,
+                WORKFORCE_PERSONA_ID: input.persona.id
+            }
+        });
+        try {
+            await client.uploadBundle(handle, input.bundle);
+        }
+        catch (err) {
+            // If upload fails the sandbox is unrecoverable for this deploy.
+            // Tear it down so we don't leak Daytona resources or charge for
+            // an idle workforce-managed sandbox.
+            await client.destroy(handle).catch(() => undefined);
+            throw err;
+        }
+        let stopping = false;
+        const stop = async () => {
+            if (stopping)
+                return;
+            stopping = true;
+            try {
+                await client.destroy(handle);
+            }
+            catch (err) {
+                input.io.warn(`sandbox: cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        };
+        const done = (async () => {
+            try {
+                const result = await client.exec(handle, 'node runner.mjs', {
+                    cwd: SANDBOX_BUNDLE_DIR
+                });
+                const output = result.output.trim();
+                if (output.length > 0)
+                    input.io.info(`[sandbox] ${output}`);
+                return { code: result.exitCode };
+            }
+            catch (err) {
+                if (!stopping) {
+                    input.io.error(`sandbox: runner exec failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                return { code: 1 };
+            }
+        })();
+        return {
+            id: handle.id,
+            stop,
+            done
+        };
+    }
+};
+/**
+ * Pick the sandbox client implementation based on env. Public so the
+ * deploy orchestrator (and tests) can plug in an explicit choice.
+ */
+export function resolveSandboxClient(input, overrides = {}) {
+    if (overrides.client)
+        return overrides.client;
+    const apiKey = process.env.DAYTONA_API_KEY?.trim();
+    const jwtToken = process.env.DAYTONA_JWT_TOKEN?.trim();
+    const organizationId = process.env.DAYTONA_ORGANIZATION_ID?.trim();
+    const byoAvailable = Boolean(apiKey || jwtToken);
+    if (overrides.forceByo || byoAvailable) {
+        if (!byoAvailable) {
+            throw new Error('sandbox launcher: --byo-sandbox requested but no Daytona credentials are in env. Set DAYTONA_API_KEY (or DAYTONA_JWT_TOKEN + DAYTONA_ORGANIZATION_ID).');
+        }
+        return createByoSandboxClient({
+            ...(apiKey ? { apiKey } : {}),
+            ...(jwtToken ? { jwtToken } : {}),
+            ...(organizationId ? { organizationId } : {})
+        });
+    }
+    const workspaceToken = process.env.WORKFORCE_WORKSPACE_TOKEN?.trim();
+    if (!workspaceToken) {
+        throw new Error('sandbox launcher: no Daytona credentials and no workforce workspace token. Either export DAYTONA_API_KEY, or run `workforce login` (sets WORKFORCE_WORKSPACE_TOKEN) so we can mint a workforce-managed sandbox.');
+    }
+    const cloudUrl = (process.env.WORKFORCE_CLOUD_URL?.trim() || DEFAULT_CLOUD_URL).replace(/\/$/, '');
+    return createProxySandboxClient({
+        cloudUrl,
+        workspaceId: input.workspace,
+        workspaceToken,
+        personaId: input.persona.id
+    });
+}
+// Re-exported for tests + power users wanting to compose the client manually.
+export { SANDBOX_BUNDLE_DIR, createByoSandboxClient, createProxySandboxClient } from './sandbox-client.js';
+export function resolveSandboxAuth() {
+    const apiKey = process.env.DAYTONA_API_KEY?.trim();
+    const jwtToken = process.env.DAYTONA_JWT_TOKEN?.trim();
+    const organizationId = process.env.DAYTONA_ORGANIZATION_ID?.trim();
+    if (!apiKey && !jwtToken)
+        return undefined;
+    return {
+        ...(apiKey ? { apiKey } : {}),
+        ...(jwtToken ? { jwtToken } : {}),
+        ...(organizationId ? { organizationId } : {})
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/modes/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/modes/sandbox.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EAGzB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE;YAC/B,GAAG,EAAE;gBACH,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;gBACpB,sBAAsB,EAAE,KAAK,CAAC,SAAS;gBACvC,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gEAAgE;YAChE,gEAAgE;YAChE,qCAAqC;YACrC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,EAAE,CAAC,IAAI,CACX,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE;oBAC1D,GAAG,EAAE,kBAAkB;iBACxB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;gBAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,KAAK,CAAC,EAAE,CAAC,KAAK,CACZ,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI;YACJ,IAAI;SACL,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAoG,EACpG,YAKI,EAAE;IAEN,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,wJAAwJ,CACzJ,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,iNAAiN,CAClN,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnG,OAAO,wBAAwB,CAAC;QAC9B,QAAQ;QACR,WAAW,EAAE,KAAK,CAAC,SAAS;QAC5B,cAAc;QACd,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EAGzB,MAAM,qBAAqB,CAAC;AAa7B,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/modes/sandbox.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox.test.d.ts.map

package/dist/modes/sandbox.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.test.d.ts","sourceRoot":"","sources":["../../src/modes/sandbox.test.ts"],"names":[],"mappings":""}

package/dist/modes/sandbox.test.js

@@ -0,0 +1,95 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { resolveSandboxClient } from './sandbox.js';
+function input() {
+    return {
+        workspace: 'ws-demo',
+        persona: {
+            id: 'demo',
+            intent: 'documentation',
+            tags: ['documentation'],
+            description: '',
+            skills: [],
+            harness: 'claude',
+            model: 'm',
+            systemPrompt: 's',
+            harnessSettings: { reasoning: 'medium', timeoutSeconds: 300 },
+            cloud: true,
+            onEvent: './agent.ts'
+        }
+    };
+}
+function withEnv(overrides, fn) {
+    const previous = {};
+    for (const key of Object.keys(overrides)) {
+        previous[key] = process.env[key];
+        if (overrides[key] === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = overrides[key];
+    }
+    try {
+        return fn();
+    }
+    finally {
+        for (const [key, value] of Object.entries(previous)) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+}
+test('resolveSandboxClient prefers BYO when DAYTONA_API_KEY is set', () => {
+    withEnv({
+        DAYTONA_API_KEY: 'sk_byo',
+        WORKFORCE_WORKSPACE_TOKEN: 'tok'
+    }, () => {
+        const client = resolveSandboxClient(input());
+        // BYO client carries the Daytona SDK; we infer mode by inspecting
+        // a mint-like call would tag the resulting handle. Easier to just
+        // verify by structural shape — but the simplest check is that the
+        // proxy path was *not* picked (which would have called fetch).
+        assert.ok(typeof client.mint === 'function');
+        assert.ok(typeof client.exec === 'function');
+    });
+});
+test('resolveSandboxClient falls back to the cloud proxy when only WORKFORCE_WORKSPACE_TOKEN is set', () => {
+    withEnv({
+        DAYTONA_API_KEY: undefined,
+        DAYTONA_JWT_TOKEN: undefined,
+        WORKFORCE_WORKSPACE_TOKEN: 'tok-cloud',
+        WORKFORCE_CLOUD_URL: 'https://cloud.example.com'
+    }, () => {
+        const client = resolveSandboxClient(input());
+        assert.ok(typeof client.mint === 'function');
+    });
+});
+test('resolveSandboxClient throws when neither path is configured', () => {
+    withEnv({
+        DAYTONA_API_KEY: undefined,
+        DAYTONA_JWT_TOKEN: undefined,
+        WORKFORCE_WORKSPACE_TOKEN: undefined
+    }, () => {
+        assert.throws(() => resolveSandboxClient(input()), /no Daytona credentials and no workforce workspace token/);
+    });
+});
+test('resolveSandboxClient honors --byo-sandbox even when both paths are configured', () => {
+    withEnv({
+        DAYTONA_API_KEY: 'sk_byo',
+        WORKFORCE_WORKSPACE_TOKEN: 'tok'
+    }, () => {
+        const client = resolveSandboxClient(input(), { forceByo: true });
+        assert.ok(typeof client.mint === 'function');
+    });
+});
+test('resolveSandboxClient with forceByo and no BYO env throws a clear error', () => {
+    withEnv({
+        DAYTONA_API_KEY: undefined,
+        DAYTONA_JWT_TOKEN: undefined,
+        WORKFORCE_WORKSPACE_TOKEN: 'tok'
+    }, () => {
+        assert.throws(() => resolveSandboxClient(input(), { forceByo: true }), /--byo-sandbox requested but no Daytona credentials/);
+    });
+});
+//# sourceMappingURL=sandbox.test.js.map

package/dist/modes/sandbox.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.test.js","sourceRoot":"","sources":["../../src/modes/sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,SAAS,KAAK;IACZ,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE;YACP,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,GAAG;YACV,YAAY,EAAE,GAAG;YACjB,eAAe,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE;YAC7D,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,YAAY;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAI,SAA6C,EAAE,EAAW;IAC5E,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YACrD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,OAAO,CACL;QACE,eAAe,EAAE,QAAQ;QACzB,yBAAyB,EAAE,KAAK;KACjC,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC/C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,GAAG,EAAE;IACzG,OAAO,CACL;QACE,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,SAAS;QAC5B,yBAAyB,EAAE,WAAW;QACtC,mBAAmB,EAAE,2BAA2B;KACjD,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC/C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,OAAO,CACL;QACE,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,SAAS;QAC5B,yBAAyB,EAAE,SAAS;KACrC,EACD,GAAG,EAAE;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,EAAE,yDAAyD,CAAC,CAAC;IAChH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+EAA+E,EAAE,GAAG,EAAE;IACzF,OAAO,CACL;QACE,eAAe,EAAE,QAAQ;QACzB,yBAAyB,EAAE,KAAK;KACjC,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC/C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,OAAO,CACL;QACE,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,SAAS;QAC5B,yBAAyB,EAAE,KAAK;KACjC,EACD,GAAG,EAAE;QACH,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EACvD,oDAAoD,CACrD,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/preflight.d.ts

@@ -0,0 +1,14 @@
+import type { DeployPreflight } from './types.js';
+/**
+ * Load + parse + validate a persona for the deploy surface. Returns the
+ * frozen-shape preflight on success, throws with a field-pointed error
+ * on validation failure.
+ *
+ * Deploy preflight is stricter than the persona-kit parser: the parser
+ * accepts any persona, valid or not for deploy; this function enforces
+ * the deploy-specific cross-field rules (cloud:true, onEvent present when
+ * triggers exist, onEvent file actually on disk, etc.) so the orchestrator
+ * never gets a half-valid spec.
+ */
+export declare function preflightPersona(personaPath: string): Promise<DeployPreflight>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAqFpF"}

package/dist/preflight.js

@@ -0,0 +1,78 @@
+import { readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { lintTriggers, parsePersonaSpec } from '@agentworkforce/persona-kit';
+/**
+ * Load + parse + validate a persona for the deploy surface. Returns the
+ * frozen-shape preflight on success, throws with a field-pointed error
+ * on validation failure.
+ *
+ * Deploy preflight is stricter than the persona-kit parser: the parser
+ * accepts any persona, valid or not for deploy; this function enforces
+ * the deploy-specific cross-field rules (cloud:true, onEvent present when
+ * triggers exist, onEvent file actually on disk, etc.) so the orchestrator
+ * never gets a half-valid spec.
+ */
+export async function preflightPersona(personaPath) {
+    const absPath = path.resolve(personaPath);
+    const personaDir = path.dirname(absPath);
+    const raw = await readFile(absPath, 'utf8').catch((err) => {
+        if (err.code === 'ENOENT') {
+            throw new Error(`persona JSON not found at ${absPath}`);
+        }
+        throw err;
+    });
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`persona JSON at ${absPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof json !== 'object' || json === null) {
+        throw new Error(`persona JSON at ${absPath} must be a top-level object`);
+    }
+    // The persona-kit parser is intent-aware; we pass the intent it declares
+    // back to itself so the check is self-consistent (parsePersonaSpec
+    // enforces that `intent` matches `expectedIntent` to catch type-collated
+    // mistakes in built-in catalogs). For loose deploy use, mirror the
+    // declared intent.
+    const declaredIntent = json.intent;
+    if (typeof declaredIntent !== 'string' || !declaredIntent) {
+        throw new Error(`persona JSON at ${absPath} is missing top-level "intent"`);
+    }
+    const persona = parsePersonaSpec(json, declaredIntent);
+    if (persona.cloud !== true) {
+        throw new Error(`persona "${persona.id}" is not opted into deploy (set "cloud": true to enable workforce deploy)`);
+    }
+    const hasIntegrationTriggers = !!persona.integrations &&
+        Object.values(persona.integrations).some((cfg) => (cfg.triggers?.length ?? 0) > 0);
+    const hasSchedules = (persona.schedules?.length ?? 0) > 0;
+    if (!hasIntegrationTriggers && !hasSchedules) {
+        throw new Error(`persona "${persona.id}" declares cloud:true but has no triggers (add at least one schedule or integration trigger)`);
+    }
+    if (!persona.onEvent) {
+        throw new Error(`persona "${persona.id}" declares cloud:true but is missing "onEvent" (path to the handler file)`);
+    }
+    const onEventPath = path.resolve(personaDir, persona.onEvent);
+    const onEventStat = await stat(onEventPath).catch((err) => {
+        if (err.code === 'ENOENT') {
+            throw new Error(`persona "${persona.id}" onEvent file not found at ${onEventPath} (relative to ${personaDir})`);
+        }
+        throw err;
+    });
+    if (!onEventStat.isFile()) {
+        throw new Error(`onEvent path ${onEventPath} is not a regular file`);
+    }
+    const triggerLint = lintTriggers(persona);
+    const warnings = triggerLint.map((issue) => `${issue.path}: ${issue.message}`);
+    return {
+        persona,
+        personaPath: absPath,
+        personaDir,
+        onEventPath,
+        schedules: (persona.schedules ?? []).map((s) => s.name),
+        integrations: persona.integrations ? Object.keys(persona.integrations) : [],
+        warnings
+    };
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAGjB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE;QAC/E,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,6BAA6B,CAAC,CAAC;IAC3E,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,mBAAmB;IACnB,MAAM,cAAc,GAAI,IAA6B,CAAC,MAAM,CAAC;IAC7D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,gCAAgC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,OAAO,GAAgB,gBAAgB,CAAC,IAAI,EAAE,cAA+B,CAAC,CAAC;IAErF,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,EAAE,2EAA2E,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,sBAAsB,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,sBAAsB,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,EAAE,8FAA8F,CACrH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,EAAE,2EAA2E,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE;QAC/E,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,EAAE,+BAA+B,WAAW,iBAAiB,UAAU,GAAG,CAC/F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,wBAAwB,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAC7C,CAAC;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,UAAU;QACV,WAAW;QACX,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC"}