@better-openclaw/core 1.0.25 → 1.0.30

package/dist/addon-stack.test.cjs

@@ -1,5 +1,5 @@
-require("./skills-BlzpHmpH.cjs");
-const require_test_CTcmp4Su = require("./test.CTcmp4Su-DlzTarwH.cjs");
+require("./skills-uPxJVmKk.cjs");
+const require_test_CTcmp4Su = require("./test.CTcmp4Su-BWSPM8ZQ.cjs");
 const require_schema = require("./schema.cjs");
 const require_addon_stack = require("./addon-stack.cjs");
 let yaml = require("yaml");
@@ -57,7 +57,7 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 		require_test_CTcmp4Su.globalExpect(result.envFile).toContain("N8N_DB_PASSWORD=");
 		const match = result.envFile.match(/N8N_DB_PASSWORD=([a-f0-9]+)/);
 		require_test_CTcmp4Su.globalExpect(match).not.toBeNull();
-		require_test_CTcmp4Su.globalExpect(match[1].length).toBe(48);
+		require_test_CTcmp4Su.globalExpect(match?.[1].length).toBe(48);
 	});
 	require_test_CTcmp4Su.it("gracefully handles unknown service IDs without throwing", () => {
 		const result = require_addon_stack.generateAddonStack({
@@ -90,8 +90,8 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 			services: ["n8n"]
 		}).proxyRoutes.find((r) => r.serviceId === "n8n");
 		require_test_CTcmp4Su.globalExpect(n8nRoute).toBeDefined();
-		require_test_CTcmp4Su.globalExpect(n8nRoute.path).toBe("/n8n");
-		require_test_CTcmp4Su.globalExpect(n8nRoute.port).toBe(5678);
+		require_test_CTcmp4Su.globalExpect(n8nRoute?.path).toBe("/n8n");
+		require_test_CTcmp4Su.globalExpect(n8nRoute?.port).toBe(5678);
 	});
 	require_test_CTcmp4Su.it("generates skill files and openclaw config patch", () => {
 		const result = require_addon_stack.generateAddonStack({
@@ -109,7 +109,7 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 		}).metadata.portAssignments;
 		const n8nAssignment = Object.entries(portAssignments).find(([key]) => key.startsWith("n8n:"));
 		require_test_CTcmp4Su.globalExpect(n8nAssignment).toBeDefined();
-		require_test_CTcmp4Su.globalExpect(n8nAssignment[1]).not.toBe(5678);
+		require_test_CTcmp4Su.globalExpect(n8nAssignment?.[1]).not.toBe(5678);
 	});
 	require_test_CTcmp4Su.it("sanitizes project name from instanceId", () => {
 		require_test_CTcmp4Su.globalExpect(require_addon_stack.generateAddonStack({
@@ -150,8 +150,8 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 			generateSecrets: true
 		}).envFile.match(/MEILI_MASTER_KEY=([^\n]+)/);
 		require_test_CTcmp4Su.globalExpect(match).not.toBeNull();
-		require_test_CTcmp4Su.globalExpect(match[1].length).toBeGreaterThanOrEqual(32);
-		require_test_CTcmp4Su.globalExpect(match[1]).not.toBe("");
+		require_test_CTcmp4Su.globalExpect(match?.[1].length).toBeGreaterThanOrEqual(32);
+		require_test_CTcmp4Su.globalExpect(match?.[1]).not.toBe("");
 	});
 	require_test_CTcmp4Su.it("applies env quirks to envFile output (grafana GF_SECURITY_ADMIN_PASSWORD)", () => {
 		const match = require_addon_stack.generateAddonStack({
@@ -160,7 +160,7 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 			generateSecrets: true
 		}).envFile.match(/GF_SECURITY_ADMIN_PASSWORD=([^\n]+)/);
 		require_test_CTcmp4Su.globalExpect(match).not.toBeNull();
-		require_test_CTcmp4Su.globalExpect(match[1].length).toBeGreaterThanOrEqual(22);
+		require_test_CTcmp4Su.globalExpect(match?.[1].length).toBeGreaterThanOrEqual(22);
 	});
 	require_test_CTcmp4Su.it("syncs DB_POSTGRESDB_PASSWORD with N8N_DB_PASSWORD via must_sync quirk", () => {
 		const result = require_addon_stack.generateAddonStack({
@@ -172,7 +172,7 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 		const dbPostgresPw = result.envFile.match(/DB_POSTGRESDB_PASSWORD=([^\n]+)/);
 		require_test_CTcmp4Su.globalExpect(n8nDbPw).not.toBeNull();
 		require_test_CTcmp4Su.globalExpect(dbPostgresPw).not.toBeNull();
-		require_test_CTcmp4Su.globalExpect(n8nDbPw[1]).toBe(dbPostgresPw[1]);
+		require_test_CTcmp4Su.globalExpect(n8nDbPw?.[1]).toBe(dbPostgresPw?.[1]);
 	});
 	require_test_CTcmp4Su.it("syncs user-provided credential with DB password reference", () => {
 		const customPassword = "my_custom_secure_password";
@@ -193,7 +193,7 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 		}).metadata.portAssignments;
 		const n8nAssignment = Object.entries(portAssignments).find(([key]) => key.startsWith("n8n:"));
 		require_test_CTcmp4Su.globalExpect(n8nAssignment).toBeDefined();
-		require_test_CTcmp4Su.globalExpect(n8nAssignment[1]).toBe(5678);
+		require_test_CTcmp4Su.globalExpect(n8nAssignment?.[1]).toBe(5678);
 	});
 	require_test_CTcmp4Su.it("does not dual-list GPU services in both skipped and resolved", () => {
 		const result = require_addon_stack.generateAddonStack({
@@ -214,6 +214,118 @@ require_test_CTcmp4Su.describe("generateAddonStack", () => {
 		require_test_CTcmp4Su.globalExpect(result.metadata.skippedServices.some((s) => s.serviceId === "ollama" && s.reason === "gpu_required")).toBe(false);
 		require_test_CTcmp4Su.globalExpect(result.metadata.resolvedServices).toContain("ollama");
 	});
+	require_test_CTcmp4Su.it("generates valid compose YAML for opensandbox", () => {
+		const result = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		});
+		require_test_CTcmp4Su.globalExpect(result.metadata.resolvedServices).toContain("opensandbox");
+		const composed = (0, yaml.parse)(result.composeOverride);
+		require_test_CTcmp4Su.globalExpect(composed.services).toHaveProperty("opensandbox");
+		const volumes = composed.services.opensandbox.volumes;
+		require_test_CTcmp4Su.globalExpect(volumes.some((v) => v.includes("/var/run/docker.sock"))).toBe(true);
+		require_test_CTcmp4Su.globalExpect(volumes.some((v) => v.includes("sandbox.toml"))).toBe(true);
+	});
+	require_test_CTcmp4Su.it("generates OPEN_SANDBOX_API_KEY with min 32 bytes via env quirk", () => {
+		const match = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"],
+			generateSecrets: true
+		}).envFile.match(/OPEN_SANDBOX_API_KEY=([^\n]+)/);
+		require_test_CTcmp4Su.globalExpect(match).not.toBeNull();
+		require_test_CTcmp4Su.globalExpect(match?.[1].length).toBeGreaterThanOrEqual(43);
+	});
+	require_test_CTcmp4Su.it("generates code-sandbox skill file and config patch", () => {
+		const result = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		});
+		require_test_CTcmp4Su.globalExpect(result.openclawConfigPatch.skills.entries).toHaveProperty("code-sandbox");
+		require_test_CTcmp4Su.globalExpect(result.openclawConfigPatch.skills.entries["code-sandbox"].enabled).toBe(true);
+		const skillFile = Object.values(result.skillFiles).find((content) => content.includes("code-sandbox"));
+		require_test_CTcmp4Su.globalExpect(skillFile).toBeDefined();
+		require_test_CTcmp4Su.globalExpect(skillFile).toContain("execute_code");
+		require_test_CTcmp4Su.globalExpect(skillFile).toContain("create_desktop");
+		require_test_CTcmp4Su.globalExpect(skillFile).toContain("get_preview_url");
+	});
+	require_test_CTcmp4Su.it("generates proxy route for opensandbox at /sandbox", () => {
+		const route = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).proxyRoutes.find((r) => r.serviceId === "opensandbox");
+		require_test_CTcmp4Su.globalExpect(route).toBeDefined();
+		require_test_CTcmp4Su.globalExpect(route?.path).toBe("/sandbox");
+		require_test_CTcmp4Su.globalExpect(route?.port).toBe(8080);
+	});
+	require_test_CTcmp4Su.it("generates sandbox.toml in additionalFiles", () => {
+		const result = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		});
+		require_test_CTcmp4Su.globalExpect(result.additionalFiles).toHaveProperty("sandbox.toml");
+		const toml = result.additionalFiles["sandbox.toml"];
+		require_test_CTcmp4Su.globalExpect(toml).toContain("[server]");
+		require_test_CTcmp4Su.globalExpect(toml).toContain("api_key = \"${OPEN_SANDBOX_API_KEY}\"");
+		require_test_CTcmp4Su.globalExpect(toml).toContain("[runtime]");
+		require_test_CTcmp4Su.globalExpect(toml).toContain("[docker]");
+		require_test_CTcmp4Su.globalExpect(toml).toContain("[secure_runtime]");
+		require_test_CTcmp4Su.globalExpect(toml).toContain("type = \"gvisor\"");
+	});
+	require_test_CTcmp4Su.it("populates prePullImages with 8 images across 3 priority tiers", () => {
+		const images = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).metadata.prePullImages;
+		require_test_CTcmp4Su.globalExpect(images.length).toBe(8);
+		const p1 = images.filter((i) => i.priority === 1);
+		require_test_CTcmp4Su.globalExpect(p1.length).toBe(4);
+		require_test_CTcmp4Su.globalExpect(p1.map((i) => i.image)).toContain("opensandbox/server:v1.0.6");
+		require_test_CTcmp4Su.globalExpect(p1.map((i) => i.image)).toContain("opensandbox/execd:v1.0.6");
+		require_test_CTcmp4Su.globalExpect(p1.map((i) => i.image)).toContain("opensandbox/desktop:latest");
+		require_test_CTcmp4Su.globalExpect(p1.map((i) => i.image)).toContain("opensandbox/chrome:latest");
+		const p2 = images.filter((i) => i.priority === 2);
+		require_test_CTcmp4Su.globalExpect(p2.length).toBe(2);
+		require_test_CTcmp4Su.globalExpect(p2.map((i) => i.image)).toContain("opensandbox/code-interpreter:python");
+		require_test_CTcmp4Su.globalExpect(p2.map((i) => i.image)).toContain("opensandbox/code-interpreter:node");
+		const p3 = images.filter((i) => i.priority === 3);
+		require_test_CTcmp4Su.globalExpect(p3.length).toBe(2);
+		require_test_CTcmp4Su.globalExpect(p3.map((i) => i.image)).toContain("opensandbox/code-interpreter:latest");
+		require_test_CTcmp4Su.globalExpect(p3.map((i) => i.image)).toContain("opensandbox/vscode:latest");
+	});
+	require_test_CTcmp4Su.it("resolves port conflict between opensandbox and searxng (both 8080)", () => {
+		const result = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox", "searxng"]
+		});
+		require_test_CTcmp4Su.globalExpect(result.metadata.resolvedServices).toContain("opensandbox");
+		require_test_CTcmp4Su.globalExpect(result.metadata.resolvedServices).toContain("searxng");
+		const assignments = result.metadata.portAssignments;
+		const opensandboxPort = assignments["opensandbox:8080"];
+		const searxngPort = assignments["searxng:8080"];
+		require_test_CTcmp4Su.globalExpect(opensandboxPort).toBeDefined();
+		require_test_CTcmp4Su.globalExpect(searxngPort).toBeDefined();
+		require_test_CTcmp4Su.globalExpect(opensandboxPort).not.toBe(searxngPort);
+	});
+	require_test_CTcmp4Su.it("does not include opensandbox in prePullImages when not selected", () => {
+		const result = require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["qdrant"]
+		});
+		require_test_CTcmp4Su.globalExpect(result.metadata.prePullImages.length).toBe(0);
+		require_test_CTcmp4Su.globalExpect(result.additionalFiles).not.toHaveProperty("sandbox.toml");
+	});
+	require_test_CTcmp4Su.it("opensandbox does not require postgresql (no postgres-setup)", () => {
+		require_test_CTcmp4Su.globalExpect((0, yaml.parse)(require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).composeOverride).services).not.toHaveProperty("postgres-setup");
+	});
+	require_test_CTcmp4Su.it("accounts for 768MB memory in estimatedMemoryMB", () => {
+		require_test_CTcmp4Su.globalExpect(require_addon_stack.generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).metadata.estimatedMemoryMB).toBeGreaterThanOrEqual(768);
+	});
 });
 require_test_CTcmp4Su.describe("updateAddonStack", () => {
 	require_test_CTcmp4Su.it("adds a service to an existing stack", () => {

package/dist/addon-stack.test.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"addon-stack.test.cjs","names":["describe","generateAddonStack","expect","updateAddonStack","AddonStackInputSchema"],"sources":["../src/addon-stack.test.ts"],"sourcesContent":["import { parse } from \"yaml\";\nimport { describe, expect, it } from \"vitest\";\nimport { generateAddonStack, updateAddonStack } from \"./addon-stack.js\";\nimport { AddonStackInputSchema } from \"./schema.js\";\n\ndescribe(\"generateAddonStack\", () => {\n\tit(\"generates valid compose YAML with a single service (qdrant)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\t// Resolver may generate warnings about recommended services; that's fine\n\t\texpect(result.metadata.serviceCount).toBeGreaterThan(0);\n\t\texpect(result.metadata.resolvedServices).toContain(\"qdrant\");\n\n\t\t// Parse YAML to verify it's valid\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"qdrant\");\n\n\t\t// Should NOT contain infrastructure services\n\t\texpect(composed.services).not.toHaveProperty(\"openclaw-gateway\");\n\t\texpect(composed.services).not.toHaveProperty(\"openclaw-cli\");\n\t\texpect(composed.services).not.toHaveProperty(\"redis\");\n\t\texpect(composed.services).not.toHaveProperty(\"postgresql\");\n\t\texpect(composed.services).not.toHaveProperty(\"open-webui\");\n\t\texpect(composed.services).not.toHaveProperty(\"caddy\");\n\n\t\t// Should have openclaw-network as external\n\t\texpect(composed.networks).toHaveProperty(\"openclaw-network\");\n\t\texpect(composed.networks[\"openclaw-network\"].external).toBe(true);\n\t});\n\n\tit(\"does not include profiles on any service\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\", \"meilisearch\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\tfor (const [, svc] of Object.entries(composed.services)) {\n\t\t\texpect(svc).not.toHaveProperty(\"profiles\");\n\t\t}\n\t});\n\n\tit(\"does not apply cap_drop or security_opt by default\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\tconst qdrant = composed.services.qdrant;\n\t\texpect(qdrant).not.toHaveProperty(\"cap_drop\");\n\t\texpect(qdrant).not.toHaveProperty(\"security_opt\");\n\t});\n\n\tit(\"includes postgres-setup when a DB-dependent service is requested (n8n)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"n8n\");\n\t\texpect(composed.services).toHaveProperty(\"postgres-setup\");\n\n\t\t// postgres-setup should depend on existing postgresql\n\t\texpect(composed.services[\"postgres-setup\"].depends_on).toHaveProperty(\"postgresql\");\n\n\t\t// n8n should depend on postgres-setup\n\t\texpect(composed.services.n8n.depends_on).toHaveProperty(\"postgres-setup\");\n\t});\n\n\tit(\"generates DB passwords in env file for DB-dependent services\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\texpect(result.envFile).toContain(\"N8N_DB_PASSWORD=\");\n\t\t// Password should be non-empty (48 hex chars = 24 bytes)\n\t\tconst match = result.envFile.match(/N8N_DB_PASSWORD=([a-f0-9]+)/);\n\t\texpect(match).not.toBeNull();\n\t\texpect(match![1].length).toBe(48);\n\t});\n\n\tit(\"gracefully handles unknown service IDs without throwing\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"nonexistent-service\", \"qdrant\"],\n\t\t});\n\n\t\t// Should NOT throw\n\t\texpect(result.metadata.skippedServices).toEqual(\n\t\t\texpect.arrayContaining([\n\t\t\t\texpect.objectContaining({\n\t\t\t\t\tserviceId: \"nonexistent-service\",\n\t\t\t\t\treason: \"unknown_service\",\n\t\t\t\t}),\n\t\t\t]),\n\t\t);\n\n\t\t// Valid service should still be included\n\t\texpect(result.metadata.resolvedServices).toContain(\"qdrant\");\n\t});\n\n\tit(\"excludes infrastructure services from the request\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"redis\", \"postgresql\", \"qdrant\"],\n\t\t});\n\n\t\texpect(result.warnings).toEqual(\n\t\t\texpect.arrayContaining([\n\t\t\t\texpect.stringContaining(\"redis\"),\n\t\t\t\texpect.stringContaining(\"postgresql\"),\n\t\t\t]),\n\t\t);\n\t\texpect(result.metadata.resolvedServices).not.toContain(\"redis\");\n\t\texpect(result.metadata.resolvedServices).not.toContain(\"postgresql\");\n\t\texpect(result.metadata.resolvedServices).toContain(\"qdrant\");\n\t});\n\n\tit(\"generates proxy routes from proxyPath\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t});\n\n\t\tconst n8nRoute = result.proxyRoutes.find((r) => r.serviceId === \"n8n\");\n\t\texpect(n8nRoute).toBeDefined();\n\t\texpect(n8nRoute!.path).toBe(\"/n8n\");\n\t\texpect(n8nRoute!.port).toBe(5678);\n\t});\n\n\tit(\"generates skill files and openclaw config patch\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t});\n\n\t\t// n8n has skill binding: n8n-trigger\n\t\texpect(result.openclawConfigPatch.skills.entries).toHaveProperty(\"n8n-trigger\");\n\t\texpect(result.openclawConfigPatch.skills.entries[\"n8n-trigger\"].enabled).toBe(true);\n\t});\n\n\tit(\"resolves port conflicts with reserved ports\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\treservedPorts: [5678], // n8n's default port\n\t\t});\n\n\t\t// Port should be reassigned\n\t\tconst portAssignments = result.metadata.portAssignments;\n\t\tconst n8nAssignment = Object.entries(portAssignments).find(([key]) =>\n\t\t\tkey.startsWith(\"n8n:\"),\n\t\t);\n\t\texpect(n8nAssignment).toBeDefined();\n\t\texpect(n8nAssignment![1]).not.toBe(5678);\n\t});\n\n\tit(\"sanitizes project name from instanceId\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"My_Instance_123\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\t// Should succeed without error\n\t\texpect(result.metadata.serviceCount).toBeGreaterThan(0);\n\t});\n\n\tit(\"returns env vars grouped by service\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\texpect(result.envVars.length).toBeGreaterThanOrEqual(0);\n\t});\n\n\tit(\"returns empty result for no services\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [],\n\t\t});\n\n\t\texpect(result.composeOverride).toContain(\"services: {}\");\n\t\texpect(result.warnings.length).toBeGreaterThan(0);\n\t});\n\n\tit(\"returns empty result when all services are infrastructure\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"redis\", \"postgresql\", \"caddy\"],\n\t\t});\n\n\t\texpect(result.metadata.serviceCount).toBe(0);\n\t\texpect(result.warnings.length).toBeGreaterThan(0);\n\t});\n\n\tit(\"applies env quirks to envFile output (meilisearch MEILI_MASTER_KEY min_length)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"meilisearch\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// MEILI_MASTER_KEY should be a base64url string of at least 32 chars (24 bytes)\n\t\tconst match = result.envFile.match(/MEILI_MASTER_KEY=([^\\n]+)/);\n\t\texpect(match).not.toBeNull();\n\t\texpect(match![1].length).toBeGreaterThanOrEqual(32);\n\t\t// Should not be empty\n\t\texpect(match![1]).not.toBe(\"\");\n\t});\n\n\tit(\"applies env quirks to envFile output (grafana GF_SECURITY_ADMIN_PASSWORD)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"grafana\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\tconst match = result.envFile.match(/GF_SECURITY_ADMIN_PASSWORD=([^\\n]+)/);\n\t\texpect(match).not.toBeNull();\n\t\t// Should be at least 22 chars (16 bytes base64url)\n\t\texpect(match![1].length).toBeGreaterThanOrEqual(22);\n\t});\n\n\tit(\"syncs DB_POSTGRESDB_PASSWORD with N8N_DB_PASSWORD via must_sync quirk\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\tconst n8nDbPw = result.envFile.match(/N8N_DB_PASSWORD=([^\\n]+)/);\n\t\tconst dbPostgresPw = result.envFile.match(/DB_POSTGRESDB_PASSWORD=([^\\n]+)/);\n\t\texpect(n8nDbPw).not.toBeNull();\n\t\texpect(dbPostgresPw).not.toBeNull();\n\t\t// Both passwords must match due to must_sync quirk\n\t\texpect(n8nDbPw![1]).toBe(dbPostgresPw![1]);\n\t});\n\n\tit(\"syncs user-provided credential with DB password reference\", () => {\n\t\tconst customPassword = \"my_custom_secure_password\";\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\tgenerateSecrets: true,\n\t\t\tcredentials: {\n\t\t\t\tn8n: { DB_POSTGRESDB_PASSWORD: customPassword },\n\t\t\t},\n\t\t});\n\n\t\t// User value should be used for both the service env var and the ref key\n\t\texpect(result.envFile).toContain(`DB_POSTGRESDB_PASSWORD=${customPassword}`);\n\t\texpect(result.envFile).toContain(`N8N_DB_PASSWORD=${customPassword}`);\n\t});\n\n\tit(\"uses existingServices ports for conflict detection\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\t// n8n uses port 5678, qdrant uses 6333 — qdrant as existing should not conflict\n\t\t\texistingServices: [\"qdrant\"],\n\t\t});\n\n\t\t// n8n should still get its default port (no conflict with qdrant)\n\t\tconst portAssignments = result.metadata.portAssignments;\n\t\tconst n8nAssignment = Object.entries(portAssignments).find(([key]) =>\n\t\t\tkey.startsWith(\"n8n:\"),\n\t\t);\n\t\texpect(n8nAssignment).toBeDefined();\n\t\texpect(n8nAssignment![1]).toBe(5678);\n\t});\n\n\tit(\"does not dual-list GPU services in both skipped and resolved\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"ollama\"],\n\t\t\tgpu: false,\n\t\t});\n\n\t\t// ollama requires GPU — without gpu: true, it should be skipped only\n\t\tconst isSkipped = result.metadata.skippedServices.some(\n\t\t\t(s) => s.serviceId === \"ollama\" && s.reason === \"gpu_required\",\n\t\t);\n\t\tconst isResolved = result.metadata.resolvedServices.includes(\"ollama\");\n\n\t\t// Must be in exactly one list, not both\n\t\tif (isSkipped) {\n\t\t\texpect(isResolved).toBe(false);\n\t\t}\n\t});\n\n\tit(\"includes GPU services when gpu: true is set\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"ollama\"],\n\t\t\tgpu: true,\n\t\t});\n\n\t\t// Should NOT be skipped when GPU support is available\n\t\tconst isSkipped = result.metadata.skippedServices.some(\n\t\t\t(s) => s.serviceId === \"ollama\" && s.reason === \"gpu_required\",\n\t\t);\n\t\texpect(isSkipped).toBe(false);\n\t\texpect(result.metadata.resolvedServices).toContain(\"ollama\");\n\t});\n});\n\ndescribe(\"updateAddonStack\", () => {\n\tit(\"adds a service to an existing stack\", () => {\n\t\t// First generate a base stack\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\t// Then add meilisearch\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t});\n\n\t\texpect(result.metadata.added).toContain(\"meilisearch\");\n\t\texpect(result.metadata.unchanged).toContain(\"qdrant\");\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"qdrant\");\n\t\texpect(composed.services).toHaveProperty(\"meilisearch\");\n\t});\n\n\tit(\"removes a service from an existing stack\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\", \"meilisearch\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\tremoveServices: [\"meilisearch\"],\n\t\t});\n\n\t\texpect(result.metadata.removed).toContain(\"meilisearch\");\n\t\texpect(result.metadata.unchanged).toContain(\"qdrant\");\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"qdrant\");\n\t\texpect(composed.services).not.toHaveProperty(\"meilisearch\");\n\t});\n\n\tit(\"preserves existing env values when adding a service\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// Simulate user editing an env value\n\t\tconst customEnv = base.envFile.replace(\n\t\t\t/QDRANT_API_KEY=[a-f0-9]+/,\n\t\t\t\"QDRANT_API_KEY=my_custom_key\",\n\t\t);\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: customEnv,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// If QDRANT_API_KEY was in the original env, it should be preserved\n\t\tif (customEnv.includes(\"QDRANT_API_KEY=my_custom_key\")) {\n\t\t\texpect(result.envFile).toContain(\"QDRANT_API_KEY=my_custom_key\");\n\t\t}\n\t});\n\n\tit(\"returns images to pull for added services\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t});\n\n\t\texpect(result.imagesToPull.length).toBeGreaterThan(0);\n\t\texpect(result.imagesToPull.some((img) => img.includes(\"meilisearch\"))).toBe(true);\n\t});\n\n\tit(\"handles empty update gracefully\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t});\n\n\t\texpect(result.metadata.added).toEqual([]);\n\t\texpect(result.metadata.removed).toEqual([]);\n\t\texpect(result.metadata.unchanged).toContain(\"qdrant\");\n\t});\n\n\tit(\"respects generateSecrets: false during update\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// With generateSecrets: false, services requiring secrets (like meilisearch)\n\t\t// may be skipped as missing_credentials. Provide credentials explicitly.\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t\tgenerateSecrets: false,\n\t\t\tcredentials: {\n\t\t\t\tmeilisearch: { MEILI_MASTER_KEY: \"test-master-key-1234567890\" },\n\t\t\t},\n\t\t});\n\n\t\t// Meilisearch should be added since we provided the required credential\n\t\texpect(result.metadata.added).toContain(\"meilisearch\");\n\t});\n\n\tit(\"forwards portOverrides during update\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"n8n\"],\n\t\t\tportOverrides: { n8n: { \"5678\": 9999 } },\n\t\t});\n\n\t\t// n8n should be present with the port override\n\t\texpect(result.metadata.added).toContain(\"n8n\");\n\t});\n});\n\ndescribe(\"AddonStackInputSchema\", () => {\n\tit(\"accepts valid input\", () => {\n\t\tconst result = AddonStackInputSchema.safeParse({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\", \"n8n\"],\n\t\t});\n\t\texpect(result.success).toBe(true);\n\t});\n\n\tit(\"requires instanceId\", () => {\n\t\tconst result = AddonStackInputSchema.safeParse({\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\t\texpect(result.success).toBe(false);\n\t});\n\n\tit(\"defaults empty arrays and booleans\", () => {\n\t\tconst result = AddonStackInputSchema.parse({\n\t\t\tinstanceId: \"test\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\t\texpect(result.skillPacks).toEqual([]);\n\t\texpect(result.reservedPorts).toEqual([]);\n\t\texpect(result.generateSecrets).toBe(true);\n\t\texpect(result.platform).toBe(\"linux/amd64\");\n\t});\n});\n"],"mappings":";;;;;;AAKAA,sBAAAA,SAAS,4BAA4B;AACpC,uBAAA,GAAG,qEAAqE;EACvE,MAAM,SAASC,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AAGF,wBAAA,aAAO,OAAO,SAAS,aAAa,CAAC,gBAAgB,EAAE;AACvD,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;EAG5D,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,SAAS;AAGlD,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,mBAAmB;AAChE,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,eAAe;AAC5D,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,QAAQ;AACrD,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,aAAa;AAC1D,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,aAAa;AAC1D,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,QAAQ;AAGrD,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,mBAAmB;AAC5D,wBAAA,aAAO,SAAS,SAAS,oBAAoB,SAAS,CAAC,KAAK,KAAK;GAChE;AAEF,uBAAA,GAAG,kDAAkD;EAMpD,MAAM,YAAA,GAAA,KAAA,OALSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,UAAU,cAAc;GACnC,CAAC,CAE4B,gBAAgB;AAC9C,OAAK,MAAM,GAAG,QAAQ,OAAO,QAAQ,SAAS,SAAS,CACtD,uBAAA,aAAO,IAAI,CAAC,IAAI,eAAe,WAAW;GAE1C;AAEF,uBAAA,GAAG,4DAA4D;EAO9D,MAAM,UAAA,GAAA,KAAA,OANSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC,CAE4B,gBAAgB,CACtB,SAAS;AACjC,wBAAA,aAAO,OAAO,CAAC,IAAI,eAAe,WAAW;AAC7C,wBAAA,aAAO,OAAO,CAAC,IAAI,eAAe,eAAe;GAChD;AAEF,uBAAA,GAAG,gFAAgF;EAMlF,MAAM,YAAA,GAAA,KAAA,OALSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,CAAC,CAE4B,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,MAAM;AAC/C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,iBAAiB;AAG1D,wBAAA,aAAO,SAAS,SAAS,kBAAkB,WAAW,CAAC,eAAe,aAAa;AAGnF,wBAAA,aAAO,SAAS,SAAS,IAAI,WAAW,CAAC,eAAe,iBAAiB;GACxE;AAEF,uBAAA,GAAG,sEAAsE;EACxE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,iBAAiB;GACjB,CAAC;AAEF,wBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,mBAAmB;EAEpD,MAAM,QAAQ,OAAO,QAAQ,MAAM,8BAA8B;AACjE,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAC5B,wBAAA,aAAO,MAAO,GAAG,OAAO,CAAC,KAAK,GAAG;GAChC;AAEF,uBAAA,GAAG,iEAAiE;EACnE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,uBAAuB,SAAS;GAC3C,CAAC;AAGF,wBAAA,aAAO,OAAO,SAAS,gBAAgB,CAAC,QACvCC,sBAAAA,aAAO,gBAAgB,CACtBA,sBAAAA,aAAO,iBAAiB;GACvB,WAAW;GACX,QAAQ;GACR,CAAC,CACF,CAAC,CACF;AAGD,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;GAC3D;AAEF,uBAAA,GAAG,2DAA2D;EAC7D,MAAM,SAASD,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU;IAAC;IAAS;IAAc;IAAS;GAC3C,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,CAAC,QACvBC,sBAAAA,aAAO,gBAAgB,CACtBA,sBAAAA,aAAO,iBAAiB,QAAQ,EAChCA,sBAAAA,aAAO,iBAAiB,aAAa,CACrC,CAAC,CACF;AACD,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,IAAI,UAAU,QAAQ;AAC/D,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,IAAI,UAAU,aAAa;AACpE,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;GAC3D;AAEF,uBAAA,GAAG,+CAA+C;EAMjD,MAAM,WALSD,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,CAAC,CAEsB,YAAY,MAAM,MAAM,EAAE,cAAc,MAAM;AACtE,wBAAA,aAAO,SAAS,CAAC,aAAa;AAC9B,wBAAA,aAAO,SAAU,KAAK,CAAC,KAAK,OAAO;AACnC,wBAAA,aAAO,SAAU,KAAK,CAAC,KAAK,KAAK;GAChC;AAEF,uBAAA,GAAG,yDAAyD;EAC3D,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,CAAC;AAGF,wBAAA,aAAO,OAAO,oBAAoB,OAAO,QAAQ,CAAC,eAAe,cAAc;AAC/E,wBAAA,aAAO,OAAO,oBAAoB,OAAO,QAAQ,eAAe,QAAQ,CAAC,KAAK,KAAK;GAClF;AAEF,uBAAA,GAAG,qDAAqD;EAQvD,MAAM,kBAPSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,eAAe,CAAC,KAAK;GACrB,CAAC,CAG6B,SAAS;EACxC,MAAM,gBAAgB,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,SAC5D,IAAI,WAAW,OAAO,CACtB;AACD,wBAAA,aAAO,cAAc,CAAC,aAAa;AACnC,wBAAA,aAAO,cAAe,GAAG,CAAC,IAAI,KAAK,KAAK;GACvC;AAEF,uBAAA,GAAG,gDAAgD;AAOlD,wBAAA,aANeA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC,CAGY,SAAS,aAAa,CAAC,gBAAgB,EAAE;GACtD;AAEF,uBAAA,GAAG,6CAA6C;AAM/C,wBAAA,aALeA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC,CAEY,QAAQ,OAAO,CAAC,uBAAuB,EAAE;GACtD;AAEF,uBAAA,GAAG,8CAA8C;EAChD,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,EAAE;GACZ,CAAC;AAEF,wBAAA,aAAO,OAAO,gBAAgB,CAAC,UAAU,eAAe;AACxD,wBAAA,aAAO,OAAO,SAAS,OAAO,CAAC,gBAAgB,EAAE;GAChD;AAEF,uBAAA,GAAG,mEAAmE;EACrE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU;IAAC;IAAS;IAAc;IAAQ;GAC1C,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,aAAa,CAAC,KAAK,EAAE;AAC5C,wBAAA,aAAO,OAAO,SAAS,OAAO,CAAC,gBAAgB,EAAE;GAChD;AAEF,uBAAA,GAAG,wFAAwF;EAQ1F,MAAM,QAPSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,iBAAiB;GACjB,CAAC,CAGmB,QAAQ,MAAM,4BAA4B;AAC/D,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAC5B,wBAAA,aAAO,MAAO,GAAG,OAAO,CAAC,uBAAuB,GAAG;AAEnD,wBAAA,aAAO,MAAO,GAAG,CAAC,IAAI,KAAK,GAAG;GAC7B;AAEF,uBAAA,GAAG,mFAAmF;EAOrF,MAAM,QANSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,UAAU;GACrB,iBAAiB;GACjB,CAAC,CAEmB,QAAQ,MAAM,sCAAsC;AACzE,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAE5B,wBAAA,aAAO,MAAO,GAAG,OAAO,CAAC,uBAAuB,GAAG;GAClD;AAEF,uBAAA,GAAG,+EAA+E;EACjF,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,iBAAiB;GACjB,CAAC;EAEF,MAAM,UAAU,OAAO,QAAQ,MAAM,2BAA2B;EAChE,MAAM,eAAe,OAAO,QAAQ,MAAM,kCAAkC;AAC5E,wBAAA,aAAO,QAAQ,CAAC,IAAI,UAAU;AAC9B,wBAAA,aAAO,aAAa,CAAC,IAAI,UAAU;AAEnC,wBAAA,aAAO,QAAS,GAAG,CAAC,KAAK,aAAc,GAAG;GACzC;AAEF,uBAAA,GAAG,mEAAmE;EACrE,MAAM,iBAAiB;EACvB,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,iBAAiB;GACjB,aAAa,EACZ,KAAK,EAAE,wBAAwB,gBAAgB,EAC/C;GACD,CAAC;AAGF,wBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,0BAA0B,iBAAiB;AAC5E,wBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,mBAAmB,iBAAiB;GACpE;AAEF,uBAAA,GAAG,4DAA4D;EAS9D,MAAM,kBARSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GAEjB,kBAAkB,CAAC,SAAS;GAC5B,CAAC,CAG6B,SAAS;EACxC,MAAM,gBAAgB,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,SAC5D,IAAI,WAAW,OAAO,CACtB;AACD,wBAAA,aAAO,cAAc,CAAC,aAAa;AACnC,wBAAA,aAAO,cAAe,GAAG,CAAC,KAAK,KAAK;GACnC;AAEF,uBAAA,GAAG,sEAAsE;EACxE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,KAAK;GACL,CAAC;EAGF,MAAM,YAAY,OAAO,SAAS,gBAAgB,MAChD,MAAM,EAAE,cAAc,YAAY,EAAE,WAAW,eAChD;EACD,MAAM,aAAa,OAAO,SAAS,iBAAiB,SAAS,SAAS;AAGtE,MAAI,UACH,uBAAA,aAAO,WAAW,CAAC,KAAK,MAAM;GAE9B;AAEF,uBAAA,GAAG,qDAAqD;EACvD,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,KAAK;GACL,CAAC;AAMF,wBAAA,aAHkB,OAAO,SAAS,gBAAgB,MAChD,MAAM,EAAE,cAAc,YAAY,EAAE,WAAW,eAChD,CACgB,CAAC,KAAK,MAAM;AAC7B,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;GAC3D;EACD;AAEFD,sBAAAA,SAAS,0BAA0B;AAClC,uBAAA,GAAG,6CAA6C;EAE/C,MAAM,OAAOC,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;EAGF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,cAAc;GAC5B,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,MAAM,CAAC,UAAU,cAAc;AACtD,wBAAA,aAAO,OAAO,SAAS,UAAU,CAAC,UAAU,SAAS;EAErD,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,SAAS;AAClD,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,cAAc;GACtD;AAEF,uBAAA,GAAG,kDAAkD;EACpD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,UAAU,cAAc;GACnC,CAAC;EAEF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,gBAAgB,CAAC,cAAc;GAC/B,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,QAAQ,CAAC,UAAU,cAAc;AACxD,wBAAA,aAAO,OAAO,SAAS,UAAU,CAAC,UAAU,SAAS;EAErD,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,SAAS;AAClD,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,cAAc;GAC1D;AAEF,uBAAA,GAAG,6DAA6D;EAC/D,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,iBAAiB;GACjB,CAAC;EAGF,MAAM,YAAY,KAAK,QAAQ,QAC9B,4BACA,+BACA;EAED,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY;GACZ,aAAa,CAAC,cAAc;GAC5B,iBAAiB;GACjB,CAAC;AAGF,MAAI,UAAU,SAAS,+BAA+B,CACrD,uBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,+BAA+B;GAEhE;AAEF,uBAAA,GAAG,mDAAmD;EACrD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;EAEF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,cAAc;GAC5B,CAAC;AAEF,wBAAA,aAAO,OAAO,aAAa,OAAO,CAAC,gBAAgB,EAAE;AACrD,wBAAA,aAAO,OAAO,aAAa,MAAM,QAAQ,IAAI,SAAS,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK;GAChF;AAEF,uBAAA,GAAG,yCAAyC;EAC3C,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;EAEF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,MAAM,CAAC,QAAQ,EAAE,CAAC;AACzC,wBAAA,aAAO,OAAO,SAAS,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC3C,wBAAA,aAAO,OAAO,SAAS,UAAU,CAAC,UAAU,SAAS;GACpD;AAEF,uBAAA,GAAG,uDAAuD;EACzD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,iBAAiB;GACjB,CAAC;AAgBF,wBAAA,aAZeE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,cAAc;GAC5B,iBAAiB;GACjB,aAAa,EACZ,aAAa,EAAE,kBAAkB,8BAA8B,EAC/D;GACD,CAAC,CAGY,SAAS,MAAM,CAAC,UAAU,cAAc;GACrD;AAEF,uBAAA,GAAG,8CAA8C;EAChD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AAWF,wBAAA,aATeE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,MAAM;GACpB,eAAe,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE;GACxC,CAAC,CAGY,SAAS,MAAM,CAAC,UAAU,MAAM;GAC7C;EACD;AAEFH,sBAAAA,SAAS,+BAA+B;AACvC,uBAAA,GAAG,6BAA6B;AAK/B,wBAAA,aAJeI,eAAAA,sBAAsB,UAAU;GAC9C,YAAY;GACZ,UAAU,CAAC,UAAU,MAAM;GAC3B,CAAC,CACY,QAAQ,CAAC,KAAK,KAAK;GAChC;AAEF,uBAAA,GAAG,6BAA6B;AAI/B,wBAAA,aAHeA,eAAAA,sBAAsB,UAAU,EAC9C,UAAU,CAAC,SAAS,EACpB,CAAC,CACY,QAAQ,CAAC,KAAK,MAAM;GACjC;AAEF,uBAAA,GAAG,4CAA4C;EAC9C,MAAM,SAASA,eAAAA,sBAAsB,MAAM;GAC1C,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AACF,wBAAA,aAAO,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AACrC,wBAAA,aAAO,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC;AACxC,wBAAA,aAAO,OAAO,gBAAgB,CAAC,KAAK,KAAK;AACzC,wBAAA,aAAO,OAAO,SAAS,CAAC,KAAK,cAAc;GAC1C;EACD"}
+{"version":3,"file":"addon-stack.test.cjs","names":["describe","generateAddonStack","expect","updateAddonStack","AddonStackInputSchema"],"sources":["../src/addon-stack.test.ts"],"sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { parse } from \"yaml\";\nimport { generateAddonStack, updateAddonStack } from \"./addon-stack.js\";\nimport { AddonStackInputSchema } from \"./schema.js\";\n\ndescribe(\"generateAddonStack\", () => {\n\tit(\"generates valid compose YAML with a single service (qdrant)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\t// Resolver may generate warnings about recommended services; that's fine\n\t\texpect(result.metadata.serviceCount).toBeGreaterThan(0);\n\t\texpect(result.metadata.resolvedServices).toContain(\"qdrant\");\n\n\t\t// Parse YAML to verify it's valid\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"qdrant\");\n\n\t\t// Should NOT contain infrastructure services\n\t\texpect(composed.services).not.toHaveProperty(\"openclaw-gateway\");\n\t\texpect(composed.services).not.toHaveProperty(\"openclaw-cli\");\n\t\texpect(composed.services).not.toHaveProperty(\"redis\");\n\t\texpect(composed.services).not.toHaveProperty(\"postgresql\");\n\t\texpect(composed.services).not.toHaveProperty(\"open-webui\");\n\t\texpect(composed.services).not.toHaveProperty(\"caddy\");\n\n\t\t// Should have openclaw-network as external\n\t\texpect(composed.networks).toHaveProperty(\"openclaw-network\");\n\t\texpect(composed.networks[\"openclaw-network\"].external).toBe(true);\n\t});\n\n\tit(\"does not include profiles on any service\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\", \"meilisearch\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\tfor (const [, svc] of Object.entries(composed.services)) {\n\t\t\texpect(svc).not.toHaveProperty(\"profiles\");\n\t\t}\n\t});\n\n\tit(\"does not apply cap_drop or security_opt by default\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\tconst qdrant = composed.services.qdrant;\n\t\texpect(qdrant).not.toHaveProperty(\"cap_drop\");\n\t\texpect(qdrant).not.toHaveProperty(\"security_opt\");\n\t});\n\n\tit(\"includes postgres-setup when a DB-dependent service is requested (n8n)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"n8n\");\n\t\texpect(composed.services).toHaveProperty(\"postgres-setup\");\n\n\t\t// postgres-setup should depend on existing postgresql\n\t\texpect(composed.services[\"postgres-setup\"].depends_on).toHaveProperty(\"postgresql\");\n\n\t\t// n8n should depend on postgres-setup\n\t\texpect(composed.services.n8n.depends_on).toHaveProperty(\"postgres-setup\");\n\t});\n\n\tit(\"generates DB passwords in env file for DB-dependent services\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\texpect(result.envFile).toContain(\"N8N_DB_PASSWORD=\");\n\t\t// Password should be non-empty (48 hex chars = 24 bytes)\n\t\tconst match = result.envFile.match(/N8N_DB_PASSWORD=([a-f0-9]+)/);\n\t\texpect(match).not.toBeNull();\n\t\texpect(match?.[1].length).toBe(48);\n\t});\n\n\tit(\"gracefully handles unknown service IDs without throwing\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"nonexistent-service\", \"qdrant\"],\n\t\t});\n\n\t\t// Should NOT throw\n\t\texpect(result.metadata.skippedServices).toEqual(\n\t\t\texpect.arrayContaining([\n\t\t\t\texpect.objectContaining({\n\t\t\t\t\tserviceId: \"nonexistent-service\",\n\t\t\t\t\treason: \"unknown_service\",\n\t\t\t\t}),\n\t\t\t]),\n\t\t);\n\n\t\t// Valid service should still be included\n\t\texpect(result.metadata.resolvedServices).toContain(\"qdrant\");\n\t});\n\n\tit(\"excludes infrastructure services from the request\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"redis\", \"postgresql\", \"qdrant\"],\n\t\t});\n\n\t\texpect(result.warnings).toEqual(\n\t\t\texpect.arrayContaining([\n\t\t\t\texpect.stringContaining(\"redis\"),\n\t\t\t\texpect.stringContaining(\"postgresql\"),\n\t\t\t]),\n\t\t);\n\t\texpect(result.metadata.resolvedServices).not.toContain(\"redis\");\n\t\texpect(result.metadata.resolvedServices).not.toContain(\"postgresql\");\n\t\texpect(result.metadata.resolvedServices).toContain(\"qdrant\");\n\t});\n\n\tit(\"generates proxy routes from proxyPath\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t});\n\n\t\tconst n8nRoute = result.proxyRoutes.find((r) => r.serviceId === \"n8n\");\n\t\texpect(n8nRoute).toBeDefined();\n\t\texpect(n8nRoute?.path).toBe(\"/n8n\");\n\t\texpect(n8nRoute?.port).toBe(5678);\n\t});\n\n\tit(\"generates skill files and openclaw config patch\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t});\n\n\t\t// n8n has skill binding: n8n-trigger\n\t\texpect(result.openclawConfigPatch.skills.entries).toHaveProperty(\"n8n-trigger\");\n\t\texpect(result.openclawConfigPatch.skills.entries[\"n8n-trigger\"].enabled).toBe(true);\n\t});\n\n\tit(\"resolves port conflicts with reserved ports\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\treservedPorts: [5678], // n8n's default port\n\t\t});\n\n\t\t// Port should be reassigned\n\t\tconst portAssignments = result.metadata.portAssignments;\n\t\tconst n8nAssignment = Object.entries(portAssignments).find(([key]) => key.startsWith(\"n8n:\"));\n\t\texpect(n8nAssignment).toBeDefined();\n\t\texpect(n8nAssignment?.[1]).not.toBe(5678);\n\t});\n\n\tit(\"sanitizes project name from instanceId\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"My_Instance_123\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\t// Should succeed without error\n\t\texpect(result.metadata.serviceCount).toBeGreaterThan(0);\n\t});\n\n\tit(\"returns env vars grouped by service\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\texpect(result.envVars.length).toBeGreaterThanOrEqual(0);\n\t});\n\n\tit(\"returns empty result for no services\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [],\n\t\t});\n\n\t\texpect(result.composeOverride).toContain(\"services: {}\");\n\t\texpect(result.warnings.length).toBeGreaterThan(0);\n\t});\n\n\tit(\"returns empty result when all services are infrastructure\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"redis\", \"postgresql\", \"caddy\"],\n\t\t});\n\n\t\texpect(result.metadata.serviceCount).toBe(0);\n\t\texpect(result.warnings.length).toBeGreaterThan(0);\n\t});\n\n\tit(\"applies env quirks to envFile output (meilisearch MEILI_MASTER_KEY min_length)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"meilisearch\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// MEILI_MASTER_KEY should be a base64url string of at least 32 chars (24 bytes)\n\t\tconst match = result.envFile.match(/MEILI_MASTER_KEY=([^\\n]+)/);\n\t\texpect(match).not.toBeNull();\n\t\texpect(match?.[1].length).toBeGreaterThanOrEqual(32);\n\t\t// Should not be empty\n\t\texpect(match?.[1]).not.toBe(\"\");\n\t});\n\n\tit(\"applies env quirks to envFile output (grafana GF_SECURITY_ADMIN_PASSWORD)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"grafana\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\tconst match = result.envFile.match(/GF_SECURITY_ADMIN_PASSWORD=([^\\n]+)/);\n\t\texpect(match).not.toBeNull();\n\t\t// Should be at least 22 chars (16 bytes base64url)\n\t\texpect(match?.[1].length).toBeGreaterThanOrEqual(22);\n\t});\n\n\tit(\"syncs DB_POSTGRESDB_PASSWORD with N8N_DB_PASSWORD via must_sync quirk\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\tconst n8nDbPw = result.envFile.match(/N8N_DB_PASSWORD=([^\\n]+)/);\n\t\tconst dbPostgresPw = result.envFile.match(/DB_POSTGRESDB_PASSWORD=([^\\n]+)/);\n\t\texpect(n8nDbPw).not.toBeNull();\n\t\texpect(dbPostgresPw).not.toBeNull();\n\t\t// Both passwords must match due to must_sync quirk\n\t\texpect(n8nDbPw?.[1]).toBe(dbPostgresPw?.[1]);\n\t});\n\n\tit(\"syncs user-provided credential with DB password reference\", () => {\n\t\tconst customPassword = \"my_custom_secure_password\";\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\tgenerateSecrets: true,\n\t\t\tcredentials: {\n\t\t\t\tn8n: { DB_POSTGRESDB_PASSWORD: customPassword },\n\t\t\t},\n\t\t});\n\n\t\t// User value should be used for both the service env var and the ref key\n\t\texpect(result.envFile).toContain(`DB_POSTGRESDB_PASSWORD=${customPassword}`);\n\t\texpect(result.envFile).toContain(`N8N_DB_PASSWORD=${customPassword}`);\n\t});\n\n\tit(\"uses existingServices ports for conflict detection\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"n8n\"],\n\t\t\t// n8n uses port 5678, qdrant uses 6333 — qdrant as existing should not conflict\n\t\t\texistingServices: [\"qdrant\"],\n\t\t});\n\n\t\t// n8n should still get its default port (no conflict with qdrant)\n\t\tconst portAssignments = result.metadata.portAssignments;\n\t\tconst n8nAssignment = Object.entries(portAssignments).find(([key]) => key.startsWith(\"n8n:\"));\n\t\texpect(n8nAssignment).toBeDefined();\n\t\texpect(n8nAssignment?.[1]).toBe(5678);\n\t});\n\n\tit(\"does not dual-list GPU services in both skipped and resolved\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"ollama\"],\n\t\t\tgpu: false,\n\t\t});\n\n\t\t// ollama requires GPU — without gpu: true, it should be skipped only\n\t\tconst isSkipped = result.metadata.skippedServices.some(\n\t\t\t(s) => s.serviceId === \"ollama\" && s.reason === \"gpu_required\",\n\t\t);\n\t\tconst isResolved = result.metadata.resolvedServices.includes(\"ollama\");\n\n\t\t// Must be in exactly one list, not both\n\t\tif (isSkipped) {\n\t\t\texpect(isResolved).toBe(false);\n\t\t}\n\t});\n\n\tit(\"includes GPU services when gpu: true is set\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"ollama\"],\n\t\t\tgpu: true,\n\t\t});\n\n\t\t// Should NOT be skipped when GPU support is available\n\t\tconst isSkipped = result.metadata.skippedServices.some(\n\t\t\t(s) => s.serviceId === \"ollama\" && s.reason === \"gpu_required\",\n\t\t);\n\t\texpect(isSkipped).toBe(false);\n\t\texpect(result.metadata.resolvedServices).toContain(\"ollama\");\n\t});\n\n\t// ── OpenSandbox ────────────────────────────────────────────────────────\n\n\tit(\"generates valid compose YAML for opensandbox\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\texpect(result.metadata.resolvedServices).toContain(\"opensandbox\");\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"opensandbox\");\n\n\t\t// Should have Docker socket mount\n\t\tconst volumes = composed.services.opensandbox.volumes as string[];\n\t\texpect(volumes.some((v: string) => v.includes(\"/var/run/docker.sock\"))).toBe(true);\n\n\t\t// Should have config bind mount\n\t\texpect(volumes.some((v: string) => v.includes(\"sandbox.toml\"))).toBe(true);\n\t});\n\n\tit(\"generates OPEN_SANDBOX_API_KEY with min 32 bytes via env quirk\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\tconst match = result.envFile.match(/OPEN_SANDBOX_API_KEY=([^\\n]+)/);\n\t\texpect(match).not.toBeNull();\n\t\t// 32 bytes base64url ≈ 43 chars\n\t\texpect(match?.[1].length).toBeGreaterThanOrEqual(43);\n\t});\n\n\tit(\"generates code-sandbox skill file and config patch\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\t// Skill config patch\n\t\texpect(result.openclawConfigPatch.skills.entries).toHaveProperty(\"code-sandbox\");\n\t\texpect(result.openclawConfigPatch.skills.entries[\"code-sandbox\"].enabled).toBe(true);\n\n\t\t// Skill file content should exist and contain key actions\n\t\tconst skillFile = Object.values(result.skillFiles).find((content) =>\n\t\t\tcontent.includes(\"code-sandbox\"),\n\t\t);\n\t\texpect(skillFile).toBeDefined();\n\t\texpect(skillFile).toContain(\"execute_code\");\n\t\texpect(skillFile).toContain(\"create_desktop\");\n\t\texpect(skillFile).toContain(\"get_preview_url\");\n\t});\n\n\tit(\"generates proxy route for opensandbox at /sandbox\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\tconst route = result.proxyRoutes.find((r) => r.serviceId === \"opensandbox\");\n\t\texpect(route).toBeDefined();\n\t\texpect(route?.path).toBe(\"/sandbox\");\n\t\texpect(route?.port).toBe(8080);\n\t});\n\n\tit(\"generates sandbox.toml in additionalFiles\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\texpect(result.additionalFiles).toHaveProperty(\"sandbox.toml\");\n\t\tconst toml = result.additionalFiles[\"sandbox.toml\"];\n\t\texpect(toml).toContain(\"[server]\");\n\t\texpect(toml).toContain('api_key = \"${OPEN_SANDBOX_API_KEY}\"');\n\t\texpect(toml).toContain(\"[runtime]\");\n\t\texpect(toml).toContain(\"[docker]\");\n\t\texpect(toml).toContain(\"[secure_runtime]\");\n\t\texpect(toml).toContain('type = \"gvisor\"');\n\t});\n\n\tit(\"populates prePullImages with 8 images across 3 priority tiers\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\tconst images = result.metadata.prePullImages;\n\t\texpect(images.length).toBe(8);\n\n\t\t// Priority 1: core + Homespace\n\t\tconst p1 = images.filter((i) => i.priority === 1);\n\t\texpect(p1.length).toBe(4);\n\t\texpect(p1.map((i) => i.image)).toContain(\"opensandbox/server:v1.0.6\");\n\t\texpect(p1.map((i) => i.image)).toContain(\"opensandbox/execd:v1.0.6\");\n\t\texpect(p1.map((i) => i.image)).toContain(\"opensandbox/desktop:latest\");\n\t\texpect(p1.map((i) => i.image)).toContain(\"opensandbox/chrome:latest\");\n\n\t\t// Priority 2: common languages\n\t\tconst p2 = images.filter((i) => i.priority === 2);\n\t\texpect(p2.length).toBe(2);\n\t\texpect(p2.map((i) => i.image)).toContain(\"opensandbox/code-interpreter:python\");\n\t\texpect(p2.map((i) => i.image)).toContain(\"opensandbox/code-interpreter:node\");\n\n\t\t// Priority 3: optional\n\t\tconst p3 = images.filter((i) => i.priority === 3);\n\t\texpect(p3.length).toBe(2);\n\t\texpect(p3.map((i) => i.image)).toContain(\"opensandbox/code-interpreter:latest\");\n\t\texpect(p3.map((i) => i.image)).toContain(\"opensandbox/vscode:latest\");\n\t});\n\n\tit(\"resolves port conflict between opensandbox and searxng (both 8080)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\", \"searxng\"],\n\t\t});\n\n\t\texpect(result.metadata.resolvedServices).toContain(\"opensandbox\");\n\t\texpect(result.metadata.resolvedServices).toContain(\"searxng\");\n\n\t\t// Both should have port assignments, but they should differ\n\t\tconst assignments = result.metadata.portAssignments;\n\t\tconst opensandboxPort = assignments[\"opensandbox:8080\"];\n\t\tconst searxngPort = assignments[\"searxng:8080\"];\n\t\texpect(opensandboxPort).toBeDefined();\n\t\texpect(searxngPort).toBeDefined();\n\t\texpect(opensandboxPort).not.toBe(searxngPort);\n\t});\n\n\tit(\"does not include opensandbox in prePullImages when not selected\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\texpect(result.metadata.prePullImages.length).toBe(0);\n\t\texpect(result.additionalFiles).not.toHaveProperty(\"sandbox.toml\");\n\t});\n\n\tit(\"opensandbox does not require postgresql (no postgres-setup)\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).not.toHaveProperty(\"postgres-setup\");\n\t});\n\n\tit(\"accounts for 768MB memory in estimatedMemoryMB\", () => {\n\t\tconst result = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"opensandbox\"],\n\t\t});\n\n\t\texpect(result.metadata.estimatedMemoryMB).toBeGreaterThanOrEqual(768);\n\t});\n});\n\ndescribe(\"updateAddonStack\", () => {\n\tit(\"adds a service to an existing stack\", () => {\n\t\t// First generate a base stack\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\t// Then add meilisearch\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t});\n\n\t\texpect(result.metadata.added).toContain(\"meilisearch\");\n\t\texpect(result.metadata.unchanged).toContain(\"qdrant\");\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"qdrant\");\n\t\texpect(composed.services).toHaveProperty(\"meilisearch\");\n\t});\n\n\tit(\"removes a service from an existing stack\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\", \"meilisearch\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\tremoveServices: [\"meilisearch\"],\n\t\t});\n\n\t\texpect(result.metadata.removed).toContain(\"meilisearch\");\n\t\texpect(result.metadata.unchanged).toContain(\"qdrant\");\n\n\t\tconst composed = parse(result.composeOverride);\n\t\texpect(composed.services).toHaveProperty(\"qdrant\");\n\t\texpect(composed.services).not.toHaveProperty(\"meilisearch\");\n\t});\n\n\tit(\"preserves existing env values when adding a service\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// Simulate user editing an env value\n\t\tconst customEnv = base.envFile.replace(\n\t\t\t/QDRANT_API_KEY=[a-f0-9]+/,\n\t\t\t\"QDRANT_API_KEY=my_custom_key\",\n\t\t);\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: customEnv,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// If QDRANT_API_KEY was in the original env, it should be preserved\n\t\tif (customEnv.includes(\"QDRANT_API_KEY=my_custom_key\")) {\n\t\t\texpect(result.envFile).toContain(\"QDRANT_API_KEY=my_custom_key\");\n\t\t}\n\t});\n\n\tit(\"returns images to pull for added services\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t});\n\n\t\texpect(result.imagesToPull.length).toBeGreaterThan(0);\n\t\texpect(result.imagesToPull.some((img) => img.includes(\"meilisearch\"))).toBe(true);\n\t});\n\n\tit(\"handles empty update gracefully\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t});\n\n\t\texpect(result.metadata.added).toEqual([]);\n\t\texpect(result.metadata.removed).toEqual([]);\n\t\texpect(result.metadata.unchanged).toContain(\"qdrant\");\n\t});\n\n\tit(\"respects generateSecrets: false during update\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t\tgenerateSecrets: true,\n\t\t});\n\n\t\t// With generateSecrets: false, services requiring secrets (like meilisearch)\n\t\t// may be skipped as missing_credentials. Provide credentials explicitly.\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"meilisearch\"],\n\t\t\tgenerateSecrets: false,\n\t\t\tcredentials: {\n\t\t\t\tmeilisearch: { MEILI_MASTER_KEY: \"test-master-key-1234567890\" },\n\t\t\t},\n\t\t});\n\n\t\t// Meilisearch should be added since we provided the required credential\n\t\texpect(result.metadata.added).toContain(\"meilisearch\");\n\t});\n\n\tit(\"forwards portOverrides during update\", () => {\n\t\tconst base = generateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\n\t\tconst result = updateAddonStack({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tcurrentCompose: base.composeOverride,\n\t\t\tcurrentEnv: base.envFile,\n\t\t\taddServices: [\"n8n\"],\n\t\t\tportOverrides: { n8n: { \"5678\": 9999 } },\n\t\t});\n\n\t\t// n8n should be present with the port override\n\t\texpect(result.metadata.added).toContain(\"n8n\");\n\t});\n});\n\ndescribe(\"AddonStackInputSchema\", () => {\n\tit(\"accepts valid input\", () => {\n\t\tconst result = AddonStackInputSchema.safeParse({\n\t\t\tinstanceId: \"test-instance\",\n\t\t\tservices: [\"qdrant\", \"n8n\"],\n\t\t});\n\t\texpect(result.success).toBe(true);\n\t});\n\n\tit(\"requires instanceId\", () => {\n\t\tconst result = AddonStackInputSchema.safeParse({\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\t\texpect(result.success).toBe(false);\n\t});\n\n\tit(\"defaults empty arrays and booleans\", () => {\n\t\tconst result = AddonStackInputSchema.parse({\n\t\t\tinstanceId: \"test\",\n\t\t\tservices: [\"qdrant\"],\n\t\t});\n\t\texpect(result.skillPacks).toEqual([]);\n\t\texpect(result.reservedPorts).toEqual([]);\n\t\texpect(result.generateSecrets).toBe(true);\n\t\texpect(result.platform).toBe(\"linux/amd64\");\n\t});\n});\n"],"mappings":";;;;;;AAKAA,sBAAAA,SAAS,4BAA4B;AACpC,uBAAA,GAAG,qEAAqE;EACvE,MAAM,SAASC,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AAGF,wBAAA,aAAO,OAAO,SAAS,aAAa,CAAC,gBAAgB,EAAE;AACvD,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;EAG5D,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,SAAS;AAGlD,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,mBAAmB;AAChE,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,eAAe;AAC5D,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,QAAQ;AACrD,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,aAAa;AAC1D,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,aAAa;AAC1D,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,QAAQ;AAGrD,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,mBAAmB;AAC5D,wBAAA,aAAO,SAAS,SAAS,oBAAoB,SAAS,CAAC,KAAK,KAAK;GAChE;AAEF,uBAAA,GAAG,kDAAkD;EAMpD,MAAM,YAAA,GAAA,KAAA,OALSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,UAAU,cAAc;GACnC,CAAC,CAE4B,gBAAgB;AAC9C,OAAK,MAAM,GAAG,QAAQ,OAAO,QAAQ,SAAS,SAAS,CACtD,uBAAA,aAAO,IAAI,CAAC,IAAI,eAAe,WAAW;GAE1C;AAEF,uBAAA,GAAG,4DAA4D;EAO9D,MAAM,UAAA,GAAA,KAAA,OANSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC,CAE4B,gBAAgB,CACtB,SAAS;AACjC,wBAAA,aAAO,OAAO,CAAC,IAAI,eAAe,WAAW;AAC7C,wBAAA,aAAO,OAAO,CAAC,IAAI,eAAe,eAAe;GAChD;AAEF,uBAAA,GAAG,gFAAgF;EAMlF,MAAM,YAAA,GAAA,KAAA,OALSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,CAAC,CAE4B,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,MAAM;AAC/C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,iBAAiB;AAG1D,wBAAA,aAAO,SAAS,SAAS,kBAAkB,WAAW,CAAC,eAAe,aAAa;AAGnF,wBAAA,aAAO,SAAS,SAAS,IAAI,WAAW,CAAC,eAAe,iBAAiB;GACxE;AAEF,uBAAA,GAAG,sEAAsE;EACxE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,iBAAiB;GACjB,CAAC;AAEF,wBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,mBAAmB;EAEpD,MAAM,QAAQ,OAAO,QAAQ,MAAM,8BAA8B;AACjE,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAC5B,wBAAA,aAAO,QAAQ,GAAG,OAAO,CAAC,KAAK,GAAG;GACjC;AAEF,uBAAA,GAAG,iEAAiE;EACnE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,uBAAuB,SAAS;GAC3C,CAAC;AAGF,wBAAA,aAAO,OAAO,SAAS,gBAAgB,CAAC,QACvCC,sBAAAA,aAAO,gBAAgB,CACtBA,sBAAAA,aAAO,iBAAiB;GACvB,WAAW;GACX,QAAQ;GACR,CAAC,CACF,CAAC,CACF;AAGD,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;GAC3D;AAEF,uBAAA,GAAG,2DAA2D;EAC7D,MAAM,SAASD,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU;IAAC;IAAS;IAAc;IAAS;GAC3C,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,CAAC,QACvBC,sBAAAA,aAAO,gBAAgB,CACtBA,sBAAAA,aAAO,iBAAiB,QAAQ,EAChCA,sBAAAA,aAAO,iBAAiB,aAAa,CACrC,CAAC,CACF;AACD,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,IAAI,UAAU,QAAQ;AAC/D,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,IAAI,UAAU,aAAa;AACpE,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;GAC3D;AAEF,uBAAA,GAAG,+CAA+C;EAMjD,MAAM,WALSD,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,CAAC,CAEsB,YAAY,MAAM,MAAM,EAAE,cAAc,MAAM;AACtE,wBAAA,aAAO,SAAS,CAAC,aAAa;AAC9B,wBAAA,aAAO,UAAU,KAAK,CAAC,KAAK,OAAO;AACnC,wBAAA,aAAO,UAAU,KAAK,CAAC,KAAK,KAAK;GAChC;AAEF,uBAAA,GAAG,yDAAyD;EAC3D,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,CAAC;AAGF,wBAAA,aAAO,OAAO,oBAAoB,OAAO,QAAQ,CAAC,eAAe,cAAc;AAC/E,wBAAA,aAAO,OAAO,oBAAoB,OAAO,QAAQ,eAAe,QAAQ,CAAC,KAAK,KAAK;GAClF;AAEF,uBAAA,GAAG,qDAAqD;EAQvD,MAAM,kBAPSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,eAAe,CAAC,KAAK;GACrB,CAAC,CAG6B,SAAS;EACxC,MAAM,gBAAgB,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,OAAO,CAAC;AAC7F,wBAAA,aAAO,cAAc,CAAC,aAAa;AACnC,wBAAA,aAAO,gBAAgB,GAAG,CAAC,IAAI,KAAK,KAAK;GACxC;AAEF,uBAAA,GAAG,gDAAgD;AAOlD,wBAAA,aANeA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC,CAGY,SAAS,aAAa,CAAC,gBAAgB,EAAE;GACtD;AAEF,uBAAA,GAAG,6CAA6C;AAM/C,wBAAA,aALeA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC,CAEY,QAAQ,OAAO,CAAC,uBAAuB,EAAE;GACtD;AAEF,uBAAA,GAAG,8CAA8C;EAChD,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,EAAE;GACZ,CAAC;AAEF,wBAAA,aAAO,OAAO,gBAAgB,CAAC,UAAU,eAAe;AACxD,wBAAA,aAAO,OAAO,SAAS,OAAO,CAAC,gBAAgB,EAAE;GAChD;AAEF,uBAAA,GAAG,mEAAmE;EACrE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU;IAAC;IAAS;IAAc;IAAQ;GAC1C,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,aAAa,CAAC,KAAK,EAAE;AAC5C,wBAAA,aAAO,OAAO,SAAS,OAAO,CAAC,gBAAgB,EAAE;GAChD;AAEF,uBAAA,GAAG,wFAAwF;EAQ1F,MAAM,QAPSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,iBAAiB;GACjB,CAAC,CAGmB,QAAQ,MAAM,4BAA4B;AAC/D,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAC5B,wBAAA,aAAO,QAAQ,GAAG,OAAO,CAAC,uBAAuB,GAAG;AAEpD,wBAAA,aAAO,QAAQ,GAAG,CAAC,IAAI,KAAK,GAAG;GAC9B;AAEF,uBAAA,GAAG,mFAAmF;EAOrF,MAAM,QANSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,UAAU;GACrB,iBAAiB;GACjB,CAAC,CAEmB,QAAQ,MAAM,sCAAsC;AACzE,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAE5B,wBAAA,aAAO,QAAQ,GAAG,OAAO,CAAC,uBAAuB,GAAG;GACnD;AAEF,uBAAA,GAAG,+EAA+E;EACjF,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,iBAAiB;GACjB,CAAC;EAEF,MAAM,UAAU,OAAO,QAAQ,MAAM,2BAA2B;EAChE,MAAM,eAAe,OAAO,QAAQ,MAAM,kCAAkC;AAC5E,wBAAA,aAAO,QAAQ,CAAC,IAAI,UAAU;AAC9B,wBAAA,aAAO,aAAa,CAAC,IAAI,UAAU;AAEnC,wBAAA,aAAO,UAAU,GAAG,CAAC,KAAK,eAAe,GAAG;GAC3C;AAEF,uBAAA,GAAG,mEAAmE;EACrE,MAAM,iBAAiB;EACvB,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GACjB,iBAAiB;GACjB,aAAa,EACZ,KAAK,EAAE,wBAAwB,gBAAgB,EAC/C;GACD,CAAC;AAGF,wBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,0BAA0B,iBAAiB;AAC5E,wBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,mBAAmB,iBAAiB;GACpE;AAEF,uBAAA,GAAG,4DAA4D;EAS9D,MAAM,kBARSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,MAAM;GAEjB,kBAAkB,CAAC,SAAS;GAC5B,CAAC,CAG6B,SAAS;EACxC,MAAM,gBAAgB,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,OAAO,CAAC;AAC7F,wBAAA,aAAO,cAAc,CAAC,aAAa;AACnC,wBAAA,aAAO,gBAAgB,GAAG,CAAC,KAAK,KAAK;GACpC;AAEF,uBAAA,GAAG,sEAAsE;EACxE,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,KAAK;GACL,CAAC;EAGF,MAAM,YAAY,OAAO,SAAS,gBAAgB,MAChD,MAAM,EAAE,cAAc,YAAY,EAAE,WAAW,eAChD;EACD,MAAM,aAAa,OAAO,SAAS,iBAAiB,SAAS,SAAS;AAGtE,MAAI,UACH,uBAAA,aAAO,WAAW,CAAC,KAAK,MAAM;GAE9B;AAEF,uBAAA,GAAG,qDAAqD;EACvD,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,KAAK;GACL,CAAC;AAMF,wBAAA,aAHkB,OAAO,SAAS,gBAAgB,MAChD,MAAM,EAAE,cAAc,YAAY,EAAE,WAAW,eAChD,CACgB,CAAC,KAAK,MAAM;AAC7B,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,SAAS;GAC3D;AAIF,uBAAA,GAAG,sDAAsD;EACxD,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,cAAc;EACjE,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,cAAc;EAGvD,MAAM,UAAU,SAAS,SAAS,YAAY;AAC9C,wBAAA,aAAO,QAAQ,MAAM,MAAc,EAAE,SAAS,uBAAuB,CAAC,CAAC,CAAC,KAAK,KAAK;AAGlF,wBAAA,aAAO,QAAQ,MAAM,MAAc,EAAE,SAAS,eAAe,CAAC,CAAC,CAAC,KAAK,KAAK;GACzE;AAEF,uBAAA,GAAG,wEAAwE;EAO1E,MAAM,QANSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,iBAAiB;GACjB,CAAC,CAEmB,QAAQ,MAAM,gCAAgC;AACnE,wBAAA,aAAO,MAAM,CAAC,IAAI,UAAU;AAE5B,wBAAA,aAAO,QAAQ,GAAG,OAAO,CAAC,uBAAuB,GAAG;GACnD;AAEF,uBAAA,GAAG,4DAA4D;EAC9D,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC;AAGF,wBAAA,aAAO,OAAO,oBAAoB,OAAO,QAAQ,CAAC,eAAe,eAAe;AAChF,wBAAA,aAAO,OAAO,oBAAoB,OAAO,QAAQ,gBAAgB,QAAQ,CAAC,KAAK,KAAK;EAGpF,MAAM,YAAY,OAAO,OAAO,OAAO,WAAW,CAAC,MAAM,YACxD,QAAQ,SAAS,eAAe,CAChC;AACD,wBAAA,aAAO,UAAU,CAAC,aAAa;AAC/B,wBAAA,aAAO,UAAU,CAAC,UAAU,eAAe;AAC3C,wBAAA,aAAO,UAAU,CAAC,UAAU,iBAAiB;AAC7C,wBAAA,aAAO,UAAU,CAAC,UAAU,kBAAkB;GAC7C;AAEF,uBAAA,GAAG,2DAA2D;EAM7D,MAAM,QALSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC,CAEmB,YAAY,MAAM,MAAM,EAAE,cAAc,cAAc;AAC3E,wBAAA,aAAO,MAAM,CAAC,aAAa;AAC3B,wBAAA,aAAO,OAAO,KAAK,CAAC,KAAK,WAAW;AACpC,wBAAA,aAAO,OAAO,KAAK,CAAC,KAAK,KAAK;GAC7B;AAEF,uBAAA,GAAG,mDAAmD;EACrD,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC;AAEF,wBAAA,aAAO,OAAO,gBAAgB,CAAC,eAAe,eAAe;EAC7D,MAAM,OAAO,OAAO,gBAAgB;AACpC,wBAAA,aAAO,KAAK,CAAC,UAAU,WAAW;AAClC,wBAAA,aAAO,KAAK,CAAC,UAAU,wCAAsC;AAC7D,wBAAA,aAAO,KAAK,CAAC,UAAU,YAAY;AACnC,wBAAA,aAAO,KAAK,CAAC,UAAU,WAAW;AAClC,wBAAA,aAAO,KAAK,CAAC,UAAU,mBAAmB;AAC1C,wBAAA,aAAO,KAAK,CAAC,UAAU,oBAAkB;GACxC;AAEF,uBAAA,GAAG,uEAAuE;EAMzE,MAAM,SALSA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC,CAEoB,SAAS;AAC/B,wBAAA,aAAO,OAAO,OAAO,CAAC,KAAK,EAAE;EAG7B,MAAM,KAAK,OAAO,QAAQ,MAAM,EAAE,aAAa,EAAE;AACjD,wBAAA,aAAO,GAAG,OAAO,CAAC,KAAK,EAAE;AACzB,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,4BAA4B;AACrE,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,2BAA2B;AACpE,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,6BAA6B;AACtE,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,4BAA4B;EAGrE,MAAM,KAAK,OAAO,QAAQ,MAAM,EAAE,aAAa,EAAE;AACjD,wBAAA,aAAO,GAAG,OAAO,CAAC,KAAK,EAAE;AACzB,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,sCAAsC;AAC/E,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,oCAAoC;EAG7E,MAAM,KAAK,OAAO,QAAQ,MAAM,EAAE,aAAa,EAAE;AACjD,wBAAA,aAAO,GAAG,OAAO,CAAC,KAAK,EAAE;AACzB,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,sCAAsC;AAC/E,wBAAA,aAAO,GAAG,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,UAAU,4BAA4B;GACpE;AAEF,uBAAA,GAAG,4EAA4E;EAC9E,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,eAAe,UAAU;GACpC,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,cAAc;AACjE,wBAAA,aAAO,OAAO,SAAS,iBAAiB,CAAC,UAAU,UAAU;EAG7D,MAAM,cAAc,OAAO,SAAS;EACpC,MAAM,kBAAkB,YAAY;EACpC,MAAM,cAAc,YAAY;AAChC,wBAAA,aAAO,gBAAgB,CAAC,aAAa;AACrC,wBAAA,aAAO,YAAY,CAAC,aAAa;AACjC,wBAAA,aAAO,gBAAgB,CAAC,IAAI,KAAK,YAAY;GAC5C;AAEF,uBAAA,GAAG,yEAAyE;EAC3E,MAAM,SAASA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,cAAc,OAAO,CAAC,KAAK,EAAE;AACpD,wBAAA,aAAO,OAAO,gBAAgB,CAAC,IAAI,eAAe,eAAe;GAChE;AAEF,uBAAA,GAAG,qEAAqE;AAOvE,wBAAA,cAAA,GAAA,KAAA,OANeA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC,CAE4B,gBAAgB,CAC9B,SAAS,CAAC,IAAI,eAAe,iBAAiB;GAC7D;AAEF,uBAAA,GAAG,wDAAwD;AAM1D,wBAAA,aALeA,oBAAAA,mBAAmB;GACjC,YAAY;GACZ,UAAU,CAAC,cAAc;GACzB,CAAC,CAEY,SAAS,kBAAkB,CAAC,uBAAuB,IAAI;GACpE;EACD;AAEFD,sBAAAA,SAAS,0BAA0B;AAClC,uBAAA,GAAG,6CAA6C;EAE/C,MAAM,OAAOC,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;EAGF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,cAAc;GAC5B,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,MAAM,CAAC,UAAU,cAAc;AACtD,wBAAA,aAAO,OAAO,SAAS,UAAU,CAAC,UAAU,SAAS;EAErD,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,SAAS;AAClD,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,cAAc;GACtD;AAEF,uBAAA,GAAG,kDAAkD;EACpD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,UAAU,cAAc;GACnC,CAAC;EAEF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,gBAAgB,CAAC,cAAc;GAC/B,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,QAAQ,CAAC,UAAU,cAAc;AACxD,wBAAA,aAAO,OAAO,SAAS,UAAU,CAAC,UAAU,SAAS;EAErD,MAAM,YAAA,GAAA,KAAA,OAAiB,OAAO,gBAAgB;AAC9C,wBAAA,aAAO,SAAS,SAAS,CAAC,eAAe,SAAS;AAClD,wBAAA,aAAO,SAAS,SAAS,CAAC,IAAI,eAAe,cAAc;GAC1D;AAEF,uBAAA,GAAG,6DAA6D;EAC/D,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,iBAAiB;GACjB,CAAC;EAGF,MAAM,YAAY,KAAK,QAAQ,QAC9B,4BACA,+BACA;EAED,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY;GACZ,aAAa,CAAC,cAAc;GAC5B,iBAAiB;GACjB,CAAC;AAGF,MAAI,UAAU,SAAS,+BAA+B,CACrD,uBAAA,aAAO,OAAO,QAAQ,CAAC,UAAU,+BAA+B;GAEhE;AAEF,uBAAA,GAAG,mDAAmD;EACrD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;EAEF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,cAAc;GAC5B,CAAC;AAEF,wBAAA,aAAO,OAAO,aAAa,OAAO,CAAC,gBAAgB,EAAE;AACrD,wBAAA,aAAO,OAAO,aAAa,MAAM,QAAQ,IAAI,SAAS,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK;GAChF;AAEF,uBAAA,GAAG,yCAAyC;EAC3C,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;EAEF,MAAM,SAASE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,CAAC;AAEF,wBAAA,aAAO,OAAO,SAAS,MAAM,CAAC,QAAQ,EAAE,CAAC;AACzC,wBAAA,aAAO,OAAO,SAAS,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC3C,wBAAA,aAAO,OAAO,SAAS,UAAU,CAAC,UAAU,SAAS;GACpD;AAEF,uBAAA,GAAG,uDAAuD;EACzD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,iBAAiB;GACjB,CAAC;AAgBF,wBAAA,aAZeE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,cAAc;GAC5B,iBAAiB;GACjB,aAAa,EACZ,aAAa,EAAE,kBAAkB,8BAA8B,EAC/D;GACD,CAAC,CAGY,SAAS,MAAM,CAAC,UAAU,cAAc;GACrD;AAEF,uBAAA,GAAG,8CAA8C;EAChD,MAAM,OAAOF,oBAAAA,mBAAmB;GAC/B,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AAWF,wBAAA,aATeE,oBAAAA,iBAAiB;GAC/B,YAAY;GACZ,gBAAgB,KAAK;GACrB,YAAY,KAAK;GACjB,aAAa,CAAC,MAAM;GACpB,eAAe,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE;GACxC,CAAC,CAGY,SAAS,MAAM,CAAC,UAAU,MAAM;GAC7C;EACD;AAEFH,sBAAAA,SAAS,+BAA+B;AACvC,uBAAA,GAAG,6BAA6B;AAK/B,wBAAA,aAJeI,eAAAA,sBAAsB,UAAU;GAC9C,YAAY;GACZ,UAAU,CAAC,UAAU,MAAM;GAC3B,CAAC,CACY,QAAQ,CAAC,KAAK,KAAK;GAChC;AAEF,uBAAA,GAAG,6BAA6B;AAI/B,wBAAA,aAHeA,eAAAA,sBAAsB,UAAU,EAC9C,UAAU,CAAC,SAAS,EACpB,CAAC,CACY,QAAQ,CAAC,KAAK,MAAM;GACjC;AAEF,uBAAA,GAAG,4CAA4C;EAC9C,MAAM,SAASA,eAAAA,sBAAsB,MAAM;GAC1C,YAAY;GACZ,UAAU,CAAC,SAAS;GACpB,CAAC;AACF,wBAAA,aAAO,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AACrC,wBAAA,aAAO,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC;AACxC,wBAAA,aAAO,OAAO,gBAAgB,CAAC,KAAK,KAAK;AACzC,wBAAA,aAAO,OAAO,SAAS,CAAC,KAAK,cAAc;GAC1C;EACD"}

package/dist/addon-stack.test.mjs

@@ -1,4 +1,4 @@
-import { n as describe, r as it, t as globalExpect } from "./test.CTcmp4Su-ClCHJ3FA.mjs";
+import { a as describe, o as it, t as globalExpect } from "./test.CTcmp4Su-BRa7-bTj.mjs";
 import { AddonStackInputSchema } from "./schema.mjs";
 import { generateAddonStack, updateAddonStack } from "./addon-stack.mjs";
 import { parse } from "yaml";
@@ -56,7 +56,7 @@ describe("generateAddonStack", () => {
 		globalExpect(result.envFile).toContain("N8N_DB_PASSWORD=");
 		const match = result.envFile.match(/N8N_DB_PASSWORD=([a-f0-9]+)/);
 		globalExpect(match).not.toBeNull();
-		globalExpect(match[1].length).toBe(48);
+		globalExpect(match?.[1].length).toBe(48);
 	});
 	it("gracefully handles unknown service IDs without throwing", () => {
 		const result = generateAddonStack({
@@ -89,8 +89,8 @@ describe("generateAddonStack", () => {
 			services: ["n8n"]
 		}).proxyRoutes.find((r) => r.serviceId === "n8n");
 		globalExpect(n8nRoute).toBeDefined();
-		globalExpect(n8nRoute.path).toBe("/n8n");
-		globalExpect(n8nRoute.port).toBe(5678);
+		globalExpect(n8nRoute?.path).toBe("/n8n");
+		globalExpect(n8nRoute?.port).toBe(5678);
 	});
 	it("generates skill files and openclaw config patch", () => {
 		const result = generateAddonStack({
@@ -108,7 +108,7 @@ describe("generateAddonStack", () => {
 		}).metadata.portAssignments;
 		const n8nAssignment = Object.entries(portAssignments).find(([key]) => key.startsWith("n8n:"));
 		globalExpect(n8nAssignment).toBeDefined();
-		globalExpect(n8nAssignment[1]).not.toBe(5678);
+		globalExpect(n8nAssignment?.[1]).not.toBe(5678);
 	});
 	it("sanitizes project name from instanceId", () => {
 		globalExpect(generateAddonStack({
@@ -149,8 +149,8 @@ describe("generateAddonStack", () => {
 			generateSecrets: true
 		}).envFile.match(/MEILI_MASTER_KEY=([^\n]+)/);
 		globalExpect(match).not.toBeNull();
-		globalExpect(match[1].length).toBeGreaterThanOrEqual(32);
-		globalExpect(match[1]).not.toBe("");
+		globalExpect(match?.[1].length).toBeGreaterThanOrEqual(32);
+		globalExpect(match?.[1]).not.toBe("");
 	});
 	it("applies env quirks to envFile output (grafana GF_SECURITY_ADMIN_PASSWORD)", () => {
 		const match = generateAddonStack({
@@ -159,7 +159,7 @@ describe("generateAddonStack", () => {
 			generateSecrets: true
 		}).envFile.match(/GF_SECURITY_ADMIN_PASSWORD=([^\n]+)/);
 		globalExpect(match).not.toBeNull();
-		globalExpect(match[1].length).toBeGreaterThanOrEqual(22);
+		globalExpect(match?.[1].length).toBeGreaterThanOrEqual(22);
 	});
 	it("syncs DB_POSTGRESDB_PASSWORD with N8N_DB_PASSWORD via must_sync quirk", () => {
 		const result = generateAddonStack({
@@ -171,7 +171,7 @@ describe("generateAddonStack", () => {
 		const dbPostgresPw = result.envFile.match(/DB_POSTGRESDB_PASSWORD=([^\n]+)/);
 		globalExpect(n8nDbPw).not.toBeNull();
 		globalExpect(dbPostgresPw).not.toBeNull();
-		globalExpect(n8nDbPw[1]).toBe(dbPostgresPw[1]);
+		globalExpect(n8nDbPw?.[1]).toBe(dbPostgresPw?.[1]);
 	});
 	it("syncs user-provided credential with DB password reference", () => {
 		const customPassword = "my_custom_secure_password";
@@ -192,7 +192,7 @@ describe("generateAddonStack", () => {
 		}).metadata.portAssignments;
 		const n8nAssignment = Object.entries(portAssignments).find(([key]) => key.startsWith("n8n:"));
 		globalExpect(n8nAssignment).toBeDefined();
-		globalExpect(n8nAssignment[1]).toBe(5678);
+		globalExpect(n8nAssignment?.[1]).toBe(5678);
 	});
 	it("does not dual-list GPU services in both skipped and resolved", () => {
 		const result = generateAddonStack({
@@ -213,6 +213,118 @@ describe("generateAddonStack", () => {
 		globalExpect(result.metadata.skippedServices.some((s) => s.serviceId === "ollama" && s.reason === "gpu_required")).toBe(false);
 		globalExpect(result.metadata.resolvedServices).toContain("ollama");
 	});
+	it("generates valid compose YAML for opensandbox", () => {
+		const result = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		});
+		globalExpect(result.metadata.resolvedServices).toContain("opensandbox");
+		const composed = parse(result.composeOverride);
+		globalExpect(composed.services).toHaveProperty("opensandbox");
+		const volumes = composed.services.opensandbox.volumes;
+		globalExpect(volumes.some((v) => v.includes("/var/run/docker.sock"))).toBe(true);
+		globalExpect(volumes.some((v) => v.includes("sandbox.toml"))).toBe(true);
+	});
+	it("generates OPEN_SANDBOX_API_KEY with min 32 bytes via env quirk", () => {
+		const match = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"],
+			generateSecrets: true
+		}).envFile.match(/OPEN_SANDBOX_API_KEY=([^\n]+)/);
+		globalExpect(match).not.toBeNull();
+		globalExpect(match?.[1].length).toBeGreaterThanOrEqual(43);
+	});
+	it("generates code-sandbox skill file and config patch", () => {
+		const result = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		});
+		globalExpect(result.openclawConfigPatch.skills.entries).toHaveProperty("code-sandbox");
+		globalExpect(result.openclawConfigPatch.skills.entries["code-sandbox"].enabled).toBe(true);
+		const skillFile = Object.values(result.skillFiles).find((content) => content.includes("code-sandbox"));
+		globalExpect(skillFile).toBeDefined();
+		globalExpect(skillFile).toContain("execute_code");
+		globalExpect(skillFile).toContain("create_desktop");
+		globalExpect(skillFile).toContain("get_preview_url");
+	});
+	it("generates proxy route for opensandbox at /sandbox", () => {
+		const route = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).proxyRoutes.find((r) => r.serviceId === "opensandbox");
+		globalExpect(route).toBeDefined();
+		globalExpect(route?.path).toBe("/sandbox");
+		globalExpect(route?.port).toBe(8080);
+	});
+	it("generates sandbox.toml in additionalFiles", () => {
+		const result = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		});
+		globalExpect(result.additionalFiles).toHaveProperty("sandbox.toml");
+		const toml = result.additionalFiles["sandbox.toml"];
+		globalExpect(toml).toContain("[server]");
+		globalExpect(toml).toContain("api_key = \"${OPEN_SANDBOX_API_KEY}\"");
+		globalExpect(toml).toContain("[runtime]");
+		globalExpect(toml).toContain("[docker]");
+		globalExpect(toml).toContain("[secure_runtime]");
+		globalExpect(toml).toContain("type = \"gvisor\"");
+	});
+	it("populates prePullImages with 8 images across 3 priority tiers", () => {
+		const images = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).metadata.prePullImages;
+		globalExpect(images.length).toBe(8);
+		const p1 = images.filter((i) => i.priority === 1);
+		globalExpect(p1.length).toBe(4);
+		globalExpect(p1.map((i) => i.image)).toContain("opensandbox/server:v1.0.6");
+		globalExpect(p1.map((i) => i.image)).toContain("opensandbox/execd:v1.0.6");
+		globalExpect(p1.map((i) => i.image)).toContain("opensandbox/desktop:latest");
+		globalExpect(p1.map((i) => i.image)).toContain("opensandbox/chrome:latest");
+		const p2 = images.filter((i) => i.priority === 2);
+		globalExpect(p2.length).toBe(2);
+		globalExpect(p2.map((i) => i.image)).toContain("opensandbox/code-interpreter:python");
+		globalExpect(p2.map((i) => i.image)).toContain("opensandbox/code-interpreter:node");
+		const p3 = images.filter((i) => i.priority === 3);
+		globalExpect(p3.length).toBe(2);
+		globalExpect(p3.map((i) => i.image)).toContain("opensandbox/code-interpreter:latest");
+		globalExpect(p3.map((i) => i.image)).toContain("opensandbox/vscode:latest");
+	});
+	it("resolves port conflict between opensandbox and searxng (both 8080)", () => {
+		const result = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox", "searxng"]
+		});
+		globalExpect(result.metadata.resolvedServices).toContain("opensandbox");
+		globalExpect(result.metadata.resolvedServices).toContain("searxng");
+		const assignments = result.metadata.portAssignments;
+		const opensandboxPort = assignments["opensandbox:8080"];
+		const searxngPort = assignments["searxng:8080"];
+		globalExpect(opensandboxPort).toBeDefined();
+		globalExpect(searxngPort).toBeDefined();
+		globalExpect(opensandboxPort).not.toBe(searxngPort);
+	});
+	it("does not include opensandbox in prePullImages when not selected", () => {
+		const result = generateAddonStack({
+			instanceId: "test-instance",
+			services: ["qdrant"]
+		});
+		globalExpect(result.metadata.prePullImages.length).toBe(0);
+		globalExpect(result.additionalFiles).not.toHaveProperty("sandbox.toml");
+	});
+	it("opensandbox does not require postgresql (no postgres-setup)", () => {
+		globalExpect(parse(generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).composeOverride).services).not.toHaveProperty("postgres-setup");
+	});
+	it("accounts for 768MB memory in estimatedMemoryMB", () => {
+		globalExpect(generateAddonStack({
+			instanceId: "test-instance",
+			services: ["opensandbox"]
+		}).metadata.estimatedMemoryMB).toBeGreaterThanOrEqual(768);
+	});
 });
 describe("updateAddonStack", () => {
 	it("adds a service to an existing stack", () => {