@ash-ai/sandbox 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Ash Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/bridge-client.d.ts

@@ -0,0 +1,26 @@
+import { type BridgeCommand, type BridgeEvent } from '@ash-ai/shared';
+/**
+ * Client-side of the bridge Unix socket protocol.
+ * Connects to a bridge process inside a sandbox and sends commands / receives events.
+ */
+export declare class BridgeClient {
+    private socketPath;
+    private socket;
+    private buffer;
+    private listeners;
+    constructor(socketPath: string);
+    /**
+     * Connect to the bridge socket and wait for the 'ready' event.
+     */
+    connect(): Promise<void>;
+    /**
+     * Send a command and return an async iterable of events until 'done' or 'error'.
+     */
+    sendCommand(cmd: BridgeCommand): AsyncGenerator<BridgeEvent>;
+    disconnect(): void;
+    get connected(): boolean;
+    private setupDataHandler;
+    private addListener;
+    private removeListener;
+}
+//# sourceMappingURL=bridge-client.d.ts.map

package/dist/bridge-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-client.d.ts","sourceRoot":"","sources":["../src/bridge-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,WAAW,EAA2B,MAAM,gBAAgB,CAAC;AAE/G;;;GAGG;AACH,qBAAa,YAAY;IAKX,OAAO,CAAC,UAAU;IAJ9B,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,SAAS,CAA2C;gBAExC,UAAU,EAAE,MAAM;IAEtC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC9B;;OAEG;IACI,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC;IAqCnE,UAAU,IAAI,IAAI;IAMlB,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,OAAO,CAAC,gBAAgB;IAqBxB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,cAAc;CAGvB"}

package/dist/bridge-client.js

@@ -0,0 +1,123 @@
+import net from 'node:net';
+import { encode, decode, BRIDGE_READY_TIMEOUT_MS } from '@ash-ai/shared';
+/**
+ * Client-side of the bridge Unix socket protocol.
+ * Connects to a bridge process inside a sandbox and sends commands / receives events.
+ */
+export class BridgeClient {
+    socketPath;
+    socket = null;
+    buffer = '';
+    listeners = [];
+    constructor(socketPath) {
+        this.socketPath = socketPath;
+    }
+    /**
+     * Connect to the bridge socket and wait for the 'ready' event.
+     */
+    async connect() {
+        return new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                reject(new Error(`Bridge did not become ready within ${BRIDGE_READY_TIMEOUT_MS}ms`));
+            }, BRIDGE_READY_TIMEOUT_MS);
+            const tryConnect = () => {
+                const sock = net.createConnection(this.socketPath);
+                sock.on('connect', () => {
+                    this.socket = sock;
+                    this.setupDataHandler(sock);
+                });
+                sock.on('error', (err) => {
+                    if (err.code === 'ENOENT' || err.code === 'ECONNREFUSED' || err.code === 'EINVAL') {
+                        // Socket not ready yet — retry
+                        sock.destroy();
+                        setTimeout(tryConnect, 100);
+                    }
+                    else {
+                        clearTimeout(timeout);
+                        reject(err);
+                    }
+                });
+            };
+            // Wait for 'ready' event
+            const onReady = (event) => {
+                if (event.ev === 'ready') {
+                    clearTimeout(timeout);
+                    this.removeListener(onReady);
+                    resolve();
+                }
+            };
+            this.addListener(onReady);
+            tryConnect();
+        });
+    }
+    /**
+     * Send a command and return an async iterable of events until 'done' or 'error'.
+     */
+    async *sendCommand(cmd) {
+        if (!this.socket)
+            throw new Error('Not connected');
+        this.socket.write(encode(cmd));
+        // Yield events until done
+        const queue = [];
+        let resolve = null;
+        let done = false;
+        const listener = (event) => {
+            queue.push(event);
+            resolve?.();
+        };
+        this.addListener(listener);
+        try {
+            while (!done) {
+                if (queue.length === 0) {
+                    await new Promise((r) => { resolve = r; });
+                    resolve = null;
+                }
+                while (queue.length > 0) {
+                    const event = queue.shift();
+                    yield event;
+                    if (event.ev === 'done' || event.ev === 'error') {
+                        done = true;
+                        break;
+                    }
+                }
+            }
+        }
+        finally {
+            this.removeListener(listener);
+        }
+    }
+    disconnect() {
+        this.socket?.destroy();
+        this.socket = null;
+        this.listeners = [];
+    }
+    get connected() {
+        return this.socket !== null && !this.socket.destroyed;
+    }
+    setupDataHandler(sock) {
+        sock.on('data', (chunk) => {
+            this.buffer += chunk.toString();
+            let newline;
+            while ((newline = this.buffer.indexOf('\n')) !== -1) {
+                const line = this.buffer.slice(0, newline);
+                this.buffer = this.buffer.slice(newline + 1);
+                if (line.trim()) {
+                    const event = decode(line);
+                    for (const listener of this.listeners) {
+                        listener(event);
+                    }
+                }
+            }
+        });
+        sock.on('close', () => {
+            this.socket = null;
+        });
+    }
+    addListener(fn) {
+        this.listeners.push(fn);
+    }
+    removeListener(fn) {
+        this.listeners = this.listeners.filter((l) => l !== fn);
+    }
+}
+//# sourceMappingURL=bridge-client.js.map

package/dist/bridge-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-client.js","sourceRoot":"","sources":["../src/bridge-client.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAwC,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE/G;;;GAGG;AACH,MAAM,OAAO,YAAY;IAKH;IAJZ,MAAM,GAAsB,IAAI,CAAC;IACjC,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,GAAwC,EAAE,CAAC;IAE5D,YAAoB,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAE1C;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,uBAAuB,IAAI,CAAC,CAAC,CAAC;YACvF,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAE5B,MAAM,UAAU,GAAG,GAAG,EAAE;gBACtB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAEnD,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;oBACnB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;oBAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAClF,+BAA+B;wBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACf,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;oBAC9B,CAAC;yBAAM,CAAC;wBACN,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,yBAAyB;YACzB,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE;gBACrC,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;oBACzB,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;oBAC7B,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAE1B,UAAU,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,CAAC,WAAW,CAAC,GAAkB;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAEnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAE/B,0BAA0B;QAC1B,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,IAAI,OAAO,GAAwB,IAAI,CAAC;QACxC,IAAI,IAAI,GAAG,KAAK,CAAC;QAEjB,MAAM,QAAQ,GAAG,CAAC,KAAkB,EAAE,EAAE;YACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,EAAE,EAAE,CAAC;QACd,CAAC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;oBAC7B,MAAM,KAAK,CAAC;oBACZ,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;wBAChD,IAAI,GAAG,IAAI,CAAC;wBACZ,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,UAAU;QACR,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IACxD,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAe,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAgB,CAAC;oBAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACtC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,EAAgC;QAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAEO,cAAc,CAAC,EAAgC;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { SandboxManager } from './manager.js';
+export type { ManagedSandbox, CreateSandboxOpts } from './manager.js';
+export { SandboxPool } from './pool.js';
+export type { PoolEntry, SandboxPoolOpts, LiveSandboxState, SandboxDb } from './pool.js';
+export { BridgeClient } from './bridge-client.js';
+export { spawnWithLimits, isOomExit, getDirSizeKb, startDiskMonitor, createCgroup, addToCgroup, removeCgroup, DEFAULT_SANDBOX_LIMITS, } from './resource-limits.js';
+export type { SpawnResult, SandboxSpawnOpts } from './resource-limits.js';
+export { persistSessionState, restoreSessionState, hasPersistedState, deleteSessionState, getStateMetadata, syncStateToCloud, restoreStateFromCloud, deleteCloudState, } from './state-persistence.js';
+export type { SnapshotStore } from './snapshot-store.js';
+export { createSnapshotStore, getSnapshotStore, resetSnapshotStore } from './snapshot-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { SandboxManager } from './manager.js';
+export { SandboxPool } from './pool.js';
+export { BridgeClient } from './bridge-client.js';
+export { spawnWithLimits, isOomExit, getDirSizeKb, startDiskMonitor, createCgroup, addToCgroup, removeCgroup, DEFAULT_SANDBOX_LIMITS, } from './resource-limits.js';
+export { persistSessionState, restoreSessionState, hasPersistedState, deleteSessionState, getStateMetadata, syncStateToCloud, restoreStateFromCloud, deleteCloudState, } from './state-persistence.js';
+export { createSnapshotStore, getSnapshotStore, resetSnapshotStore } from './snapshot-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/manager.d.ts

@@ -0,0 +1,39 @@
+import { type ChildProcess } from 'node:child_process';
+import type { SandboxLimits } from '@ash-ai/shared';
+import { BridgeClient } from './bridge-client.js';
+export interface ManagedSandbox {
+    id: string;
+    process: ChildProcess;
+    client: BridgeClient;
+    socketPath: string;
+    workspaceDir: string;
+    createdAt: string;
+    limits: SandboxLimits;
+}
+export interface CreateSandboxOpts {
+    agentDir: string;
+    sessionId: string;
+    /** Use a specific sandbox ID instead of generating a random one. */
+    id?: string;
+    /** Skip copying agent files into workspace (for resume when workspace already exists). */
+    skipAgentCopy?: boolean;
+    limits?: Partial<SandboxLimits>;
+    onOomKill?: (sandboxId: string) => void;
+}
+export declare class SandboxManager {
+    private sandboxes;
+    private sandboxesDir;
+    private bridgeEntry;
+    private defaultLimits;
+    constructor(opts: {
+        sandboxesDir: string;
+        bridgeEntry: string;
+        defaultLimits?: Partial<SandboxLimits>;
+    });
+    create(opts: CreateSandboxOpts): Promise<ManagedSandbox>;
+    get(id: string): ManagedSandbox | undefined;
+    destroy(id: string): Promise<void>;
+    destroyAll(): Promise<void>;
+    get activeCount(): number;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAA0B,MAAM,oBAAoB,CAAC;AAM/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,0FAA0F;IAC1F,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AASD,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;KAAE;IAOjG,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IA8H9D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIrC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}

package/dist/manager.js

@@ -0,0 +1,161 @@
+import { execSync, execFileSync } from 'node:child_process';
+import { mkdirSync, cpSync, unlinkSync, existsSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { SANDBOX_ENV_ALLOWLIST, DEFAULT_SANDBOX_LIMITS, INSTALL_SCRIPT_TIMEOUT_MS } from '@ash-ai/shared';
+import { BridgeClient } from './bridge-client.js';
+import { spawnWithLimits, isOomExit, startDiskMonitor } from './resource-limits.js';
+export class SandboxManager {
+    sandboxes = new Map();
+    sandboxesDir;
+    bridgeEntry;
+    defaultLimits;
+    constructor(opts) {
+        this.sandboxesDir = opts.sandboxesDir;
+        this.bridgeEntry = opts.bridgeEntry;
+        this.defaultLimits = { ...DEFAULT_SANDBOX_LIMITS, ...opts.defaultLimits };
+        mkdirSync(this.sandboxesDir, { recursive: true });
+    }
+    async create(opts) {
+        const id = opts.id ?? randomUUID();
+        const shortId = id.slice(0, 8);
+        const sandboxDir = join(this.sandboxesDir, id);
+        const workspaceDir = join(sandboxDir, 'workspace');
+        // macOS limits Unix socket paths to 104 bytes — use /tmp with short ID
+        const socketPath = join(tmpdir(), `ash-${shortId}.sock`);
+        const limits = { ...this.defaultLimits, ...opts.limits };
+        if (!opts.skipAgentCopy) {
+            // Copy entire agent directory into workspace — no special cases.
+            // CLAUDE.md, .claude/, .mcp.json, and any other files the SDK needs
+            // all live in the agent dir and get copied as-is.
+            cpSync(opts.agentDir, workspaceDir, { recursive: true });
+        }
+        else {
+            // Resume path: workspace already exists, just ensure the dir is there
+            mkdirSync(workspaceDir, { recursive: true });
+        }
+        // SECURITY: Allowlist env — nothing else leaks to sandbox
+        const env = {};
+        for (const key of SANDBOX_ENV_ALLOWLIST) {
+            if (process.env[key]) {
+                env[key] = process.env[key];
+            }
+        }
+        env.ASH_BRIDGE_SOCKET = socketPath;
+        env.ASH_AGENT_DIR = opts.agentDir;
+        env.ASH_WORKSPACE_DIR = workspaceDir;
+        env.ASH_SANDBOX_ID = id;
+        env.ASH_SESSION_ID = opts.sessionId;
+        // When ASH_SANDBOX_UID is set (Docker), run bridge as non-root user.
+        // Claude Code refuses --dangerously-skip-permissions as root.
+        const sandboxUid = process.env.ASH_SANDBOX_UID ? parseInt(process.env.ASH_SANDBOX_UID, 10) : undefined;
+        const sandboxGid = process.env.ASH_SANDBOX_GID ? parseInt(process.env.ASH_SANDBOX_GID, 10) : undefined;
+        if (sandboxUid !== undefined) {
+            env.HOME = `/home/ash-sandbox`;
+            // Recursively chown so the non-root sandbox user can write to all files
+            execSync(`chown -R ${sandboxUid}:${sandboxGid ?? sandboxUid} '${sandboxDir}'`);
+        }
+        else {
+            env.HOME = workspaceDir;
+        }
+        // Run install.sh if present (only on fresh creation, not resume)
+        if (!opts.skipAgentCopy) {
+            const installScript = join(workspaceDir, 'install.sh');
+            if (existsSync(installScript)) {
+                console.log(`[sandbox:${shortId}] Running install.sh...`);
+                chmodSync(installScript, 0o755);
+                try {
+                    const installOutput = execFileSync(installScript, [], {
+                        cwd: workspaceDir,
+                        env,
+                        timeout: INSTALL_SCRIPT_TIMEOUT_MS,
+                        stdio: ['ignore', 'pipe', 'pipe'],
+                        ...(sandboxUid !== undefined && { uid: sandboxUid, gid: sandboxGid }),
+                    });
+                    if (installOutput.length > 0) {
+                        console.log(`[sandbox:${shortId}:install] ${installOutput.toString().trimEnd()}`);
+                    }
+                    console.log(`[sandbox:${shortId}] install.sh completed`);
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    throw new Error(`install.sh failed for sandbox ${shortId}: ${msg}`);
+                }
+            }
+        }
+        const spawnOpts = {
+            env, cwd: workspaceDir, stdio: ['ignore', 'pipe', 'pipe'],
+            ...(sandboxUid !== undefined && { uid: sandboxUid, gid: sandboxGid }),
+        };
+        const { child, cleanup: resourceCleanup } = spawnWithLimits('node', [this.bridgeEntry], spawnOpts, limits, { sandboxId: id, workspaceDir, agentDir: opts.agentDir });
+        child.stdout?.on('data', (chunk) => {
+            console.log(`[sandbox:${shortId}:out] ${chunk.toString().trimEnd()}`);
+        });
+        child.stderr?.on('data', (chunk) => {
+            console.error(`[sandbox:${shortId}:err] ${chunk.toString().trimEnd()}`);
+        });
+        // OOM detection
+        child.on('exit', (code, signal) => {
+            console.error(`[sandbox:${shortId}] exited code=${code} signal=${signal}`);
+            if (isOomExit(code, signal)) {
+                console.error(`[sandbox:${shortId}] OOM killed (memory limit: ${limits.memoryMb}MB)`);
+                opts.onOomKill?.(id);
+            }
+        });
+        const client = new BridgeClient(socketPath);
+        await client.connect();
+        const sandbox = {
+            id,
+            process: child,
+            client,
+            socketPath,
+            workspaceDir,
+            createdAt: new Date().toISOString(),
+            limits,
+        };
+        // Disk monitoring — kill sandbox if workspace exceeds disk limit
+        const diskMonitor = startDiskMonitor(workspaceDir, limits.diskMb, () => {
+            console.error(`[sandbox:${shortId}] exceeded disk limit (${limits.diskMb}MB), killing`);
+            this.destroy(id);
+        });
+        this.sandboxes.set(id, { sandbox, resourceCleanup, diskMonitor });
+        return sandbox;
+    }
+    get(id) {
+        return this.sandboxes.get(id)?.sandbox;
+    }
+    async destroy(id) {
+        const internal = this.sandboxes.get(id);
+        if (!internal)
+            return;
+        const { sandbox, resourceCleanup, diskMonitor } = internal;
+        clearInterval(diskMonitor);
+        sandbox.client.disconnect();
+        if (sandbox.process.exitCode === null) {
+            sandbox.process.kill('SIGTERM');
+            // Wait for exit with timeout
+            await Promise.race([
+                new Promise((resolve) => sandbox.process.on('exit', resolve)),
+                new Promise((resolve) => setTimeout(resolve, 5000)),
+            ]);
+            if (sandbox.process.exitCode === null) {
+                sandbox.process.kill('SIGKILL');
+            }
+        }
+        try {
+            unlinkSync(sandbox.socketPath);
+        }
+        catch { /* already gone */ }
+        resourceCleanup();
+        this.sandboxes.delete(id);
+    }
+    async destroyAll() {
+        const ids = [...this.sandboxes.keys()];
+        await Promise.all(ids.map((id) => this.destroy(id)));
+    }
+    get activeCount() {
+        return this.sandboxes.size;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE1G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA8BpF,MAAM,OAAO,cAAc;IACjB,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,aAAa,CAAgB;IAErC,YAAY,IAA2F;QACrG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1E,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,OAAO,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAkB,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAExE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,iEAAiE;YACjE,oEAAoE;YACpE,kDAAkD;YAClD,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,0DAA0D;QAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,GAAG,CAAC,iBAAiB,GAAG,UAAU,CAAC;QACnC,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,GAAG,CAAC,iBAAiB,GAAG,YAAY,CAAC;QACrC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC;QACxB,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;QAEpC,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvG,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;YAC/B,wEAAwE;YACxE,QAAQ,CAAC,YAAY,UAAU,IAAI,UAAU,IAAI,UAAU,KAAK,UAAU,GAAG,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;QAC1B,CAAC;QAED,iEAAiE;QACjE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,yBAAyB,CAAC,CAAC;gBAC1D,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,EAAE;wBACpD,GAAG,EAAE,YAAY;wBACjB,GAAG;wBACH,OAAO,EAAE,yBAAyB;wBAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;wBACjC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;qBACtE,CAAC,CAAC;oBACH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC7B,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,aAAa,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACpF,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,wBAAwB,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAA4B;YACzC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACzD,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACtE,CAAC;QAEF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,eAAe,CACzD,MAAM,EACN,CAAC,IAAI,CAAC,WAAW,CAAC,EAClB,SAAsD,EACtD,MAAM,EACN,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CACzD,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,OAAO,CAAC,KAAK,CAAC,YAAY,OAAO,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,gBAAgB;QAChB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,OAAO,CAAC,KAAK,CAAC,YAAY,OAAO,iBAAiB,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CAAC,YAAY,OAAO,+BAA+B,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;gBACtF,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAmB;YAC9B,EAAE;YACF,OAAO,EAAE,KAAK;YACd,MAAM;YACN,UAAU;YACV,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;SACP,CAAC;QAEF,iEAAiE;QACjE,MAAM,WAAW,GAAG,gBAAgB,CAClC,YAAY,EACZ,MAAM,CAAC,MAAM,EACb,GAAG,EAAE;YACH,OAAO,CAAC,KAAK,CAAC,YAAY,OAAO,0BAA0B,MAAM,CAAC,MAAM,cAAc,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;QAE3D,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAE5B,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,6BAA6B;YAC7B,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACpE,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/dist/pool.d.ts

@@ -0,0 +1,69 @@
+import type { PoolStats, SandboxState, SandboxRecord } from '@ash-ai/shared';
+import type { ManagedSandbox, CreateSandboxOpts, SandboxManager } from './manager.js';
+export type LiveSandboxState = 'warming' | 'warm' | 'waiting' | 'running';
+/**
+ * Subset of the Db interface that SandboxPool needs.
+ * The full Db (with agent/session methods) lives in the server package.
+ * This narrower type avoids a circular dependency.
+ */
+export interface SandboxDb {
+    insertSandbox(id: string, agentName: string, workspaceDir: string, sessionId?: string): Promise<void>;
+    updateSandboxState(id: string, state: SandboxState): Promise<void>;
+    updateSandboxSession(id: string, sessionId: string | null): Promise<void>;
+    touchSandbox(id: string): Promise<void>;
+    getSandbox(id: string): Promise<SandboxRecord | null>;
+    countSandboxes(): Promise<number>;
+    getBestEvictionCandidate(): Promise<SandboxRecord | null>;
+    getIdleSandboxes(olderThan: string): Promise<SandboxRecord[]>;
+    deleteSandbox(id: string): Promise<void>;
+    markAllSandboxesCold(): Promise<number>;
+}
+export interface PoolEntry {
+    sandbox: ManagedSandbox;
+    state: LiveSandboxState;
+    sessionId: string | null;
+    agentName: string;
+}
+export interface SandboxPoolOpts {
+    manager: SandboxManager;
+    db: SandboxDb;
+    dataDir: string;
+    maxCapacity?: number;
+    idleTimeoutMs?: number;
+    onBeforeEvict?: (entry: PoolEntry) => Promise<void>;
+}
+export declare class SandboxPool {
+    private live;
+    private sessionIndex;
+    private manager;
+    private db;
+    private dataDir;
+    private maxCapacity;
+    private idleTimeoutMs;
+    private onBeforeEvict?;
+    private sweepTimer;
+    private resumeWarmHits;
+    private resumeColdHits;
+    constructor(opts: SandboxPoolOpts);
+    init(): Promise<void>;
+    create(opts: CreateSandboxOpts & {
+        agentName: string;
+    }): Promise<ManagedSandbox>;
+    get(sandboxId: string): ManagedSandbox | undefined;
+    getEntry(sandboxId: string): PoolEntry | undefined;
+    getSandboxForSession(sessionId: string): ManagedSandbox | undefined;
+    destroy(sandboxId: string): Promise<void>;
+    destroyAll(): Promise<void>;
+    markRunning(sandboxId: string): void;
+    markWaiting(sandboxId: string): void;
+    private evictOne;
+    sweepIdle(): Promise<number>;
+    startIdleSweep(): void;
+    stopIdleSweep(): void;
+    recordWarmHit(): void;
+    recordColdHit(): void;
+    get stats(): PoolStats;
+    statsAsync(): Promise<PoolStats>;
+    get activeCount(): number;
+}
+//# sourceMappingURL=pool.d.ts.map

package/dist/pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGtF,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACtD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,wBAAwB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,CAAC;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,YAAY,CAA6B;IAEjD,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,EAAE,CAAY;IACtB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAsC;IAC5D,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;gBAEf,IAAI,EAAE,eAAe;IAW3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAgCtF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAoBlD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIlD,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAM7D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IASjC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAWpC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;YAatB,QAAQ;IA4ChB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BlC,cAAc,IAAI,IAAI;IAWtB,aAAa,IAAI,IAAI;IASrB,aAAa,IAAI,IAAI;IACrB,aAAa,IAAI,IAAI;IAIrB,IAAI,KAAK,IAAI,SAAS,CAyBrB;IAEK,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC;IAWtC,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}