@claxedo/sandbox-manager 0.10.1 → 0.10.3

package/dist/drivers/boat.mjs

@@ -31,6 +31,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -38,6 +39,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -49,6 +51,13 @@ var SandboxRuntimeBootError = class extends Error {
     this.name = "SandboxRuntimeBootError";
   }
 };
+var SandboxImageDownloadError = class extends Error {
+  imageDownloadFailed = true;
+  constructor(reason) {
+    super(reason);
+    this.name = "SandboxImageDownloadError";
+  }
+};
 var SandboxHostGoneError = class extends Error {
   hostGone = true;
   constructor(reason) {
@@ -104,6 +113,10 @@ var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
 function workspaceRuntimeBootSecrets(env) {
   return Object.entries(env).flatMap(([key, value]) => WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS.has(key) ? [] : [value]);
 }
+var REDACTED_VALUE_MIN_LENGTH = 8;
+function redactWorkspaceRuntimeBootSecrets(text, secrets) {
+  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
+}
 function workspaceRuntimeBootEnv(input) {
   assertWorkspaceRuntimeIdentityEnv(input.env);
   const env = {
@@ -149,6 +162,17 @@ function envFile(input) {
   }).join("\n") + "\n";
 }
 
+// src/runtime-version.ts
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
+var SANDBOX_IMAGE_RUNTIME_VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
+function servedRuntimeVersionTest(file) {
+  return `version=$(cat ${file} 2>/dev/null) && [ -n "$version" ] && [ "$(printf '%s\\n%s\\n' ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} "$version" | sort -V | head -n 1)" = ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} ]`;
+}
+
 // src/image-name.ts
 function assertSandboxImageReference(image) {
   if (!image || image !== image.trim() || image.startsWith("-") || /\s/.test(image)) {
@@ -168,6 +192,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -253,8 +298,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -292,6 +337,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -364,10 +436,10 @@ var BoatApiError = class extends Error {
   }
   /** Boat answers 401 or 403 to the API key itself, never to a sandbox it was asked about. */
   providerKeyRefused;
-  /** Create, fork and resume each count as one start (Boat's own refusal, 2026-10-15). */
+  /** Create, fork and resume each count as one start (Boat's own refusal). */
   providerRateLimited;
   startLimit;
-  /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed` (2026-10-17). */
+  /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed`. */
   sandboxState;
 };
 function startCount(value) {
@@ -495,7 +567,7 @@ function createBoatClient(options) {
     },
     /**
      * `ttlSeconds` sets the auto-stop deadline to now plus that many seconds; `null` removes it.
-     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated` (2026-10-13).
+     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated`.
      */
     async update(id, input) {
       const value = sandbox(await api(path(id), ["sandbox.updated", "sandbox.info"], { method: "PATCH", body: input }));
@@ -560,6 +632,97 @@ function isTransientDriverError(err, markers) {
 }
 var TRANSIENT_DRIVER_RETRY_MS = 2e3;
 
+// src/drivers/boat-machine.ts
+var IMAGE_PREPARATION_TIMEOUT_SECONDS = 600;
+var CONTAINER_START_TIMEOUT_SECONDS = 120;
+var DEFAULT_CONTAINER_NAME = "claxedo-runtime";
+var DOCKER_DAEMON_WAIT_SECONDS = 120;
+var RUNTIME_ENV_PATH = ".claxedo-runtime-env";
+var REGISTRY_PASSWORD_PATH = ".claxedo-registry-password";
+var BOOT_LOCK_PATH = "/run/lock/claxedo-boot.lock";
+var BOOT_LOCK_HEADROOM_SECONDS = 60;
+var CONTAINER_ENV_PATH = "/run/claxedo-runtime.env";
+var PERSISTENT_ROOT = "claxedo-persistent";
+var PERSISTENT_HOME_MOUNTS = [["claxedo", "/root/.claxedo"], ["workspace-runtime", "/root/.workspace-runtime"]];
+var IMAGE_TREES = ["root", "usr", "etc", "var", "opt", "home", "srv"];
+var IMAGE_TREE_SEED_EXCLUDES = ["root/.cache", "root/.npm/_cacache"];
+var IMAGE_TREES_COMPLETE_MARKER = ".complete";
+var SEED_CONTAINER_NAME = "claxedo-seed";
+var STUB_IMAGE = "claxedo-runtime-stub";
+var STUB_IMAGE_ARCHIVE = "stub.tar";
+var IMAGE_LABEL = "claxedo.image";
+var IMAGE_ENV_FILE = "image.env";
+var ROOT_LINKS = ["bin", "lib", "lib64", "sbin"];
+var ROOT_DIRECTORIES = ["boot", "dev", "media", "mnt", "proc", "run", "sys", "tmp", ...IMAGE_TREES];
+var BOAT_SAVED_IMAGES = "/var/lib/ascii-docker-images";
+var DOCKER_NAME_IN_USE = "is already in use by container";
+var CONTAINER_CREATE_ATTEMPTS = 5;
+var CONTAINER_SECURITY_OPTIONS = "--security-opt seccomp=unconfined --security-opt apparmor=unconfined";
+var VM_DOCKER_INIT = "/usr/libexec/docker/docker-init";
+var CONTAINER_INIT_PATH = "/claxedo-init";
+function holdingBootLock(commandTimeoutSeconds, script) {
+  const wait = commandTimeoutSeconds - BOOT_LOCK_HEADROOM_SECONDS;
+  return `exec 9>>${BOOT_LOCK_PATH} && { flock -w ${wait} 9 || { echo "another boot of this machine held ${BOOT_LOCK_PATH} for ${wait} s" >&2; exit 1; }; } && ${script}`;
+}
+function containerHostname(workspaceId) {
+  return workspaceId.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 63) || "claxedo";
+}
+function bootedImageFile(staged) {
+  return `${staged.env}.image`;
+}
+function bootedImage(prepareStdout) {
+  return prepareStdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop();
+}
+var stubLabel = `docker image inspect --format '{{index .Config.Labels "${IMAGE_LABEL}"}}' ${STUB_IMAGE} 2>/dev/null`;
+var treesFunctions = [
+  `trees_of() { printf '%s/${PERSISTENT_ROOT}/image-%s' "$(pwd)" "$(printf %s "$1" | sed 's/[^A-Za-z0-9._-]/-/g')"; }`,
+  `seeded() { [ -f "$1/${IMAGE_TREES_COMPLETE_MARKER}" ] && [ -f "$1/${STUB_IMAGE_ARCHIVE}" ] && [ -f "$1/${IMAGE_ENV_FILE}" ]; }`,
+  `served() { ${servedRuntimeVersionTest(`"$1/${SANDBOX_IMAGE_RUNTIME_VERSION_FILE}"`)}; }`
+].join(" && ");
+var IMAGE_DOWNLOAD_INTERRUPTED = "image_download_interrupted";
+var KEPT_IMAGE_SKIPPED = "kept_image_skipped:";
+var PULL_RESUMING = `pull_resuming() { finished=$(mktemp) && while :; do if output=$(docker pull "$1" 2>&1); then rm -f "$finished"; return 0; fi; case "$output" in *"connection reset by peer"*|*"unexpected EOF"*|*"i/o timeout"*|*"TLS handshake timeout"*) ;; *) printf '%s\\n' "$output" >&2; rm -f "$finished"; return 1 ;; esac; before=$(wc -l < "$finished"); { cat "$finished"; printf '%s\\n' "$output" | sed -n -e 's/^\\([0-9a-f]\\{12\\}\\): Download complete$/\\1/p' -e 's/^\\([0-9a-f]\\{12\\}\\): Pull complete$/\\1/p'; } | sort -u > "$finished.next" && mv "$finished.next" "$finished"; [ "$(wc -l < "$finished")" -gt "$before" ] || { printf '%s\\n' "$output" ${IMAGE_DOWNLOAD_INTERRUPTED} >&2; rm -f "$finished"; return 1; }; done; }`;
+function machineBootScripts(boot) {
+  const named = shell(boot.image);
+  const trees = `"$(trees_of ${named})"`;
+  const bootedFile = bootedImageFile(boot.staged);
+  const containerOfBooted = `[ "$(docker container inspect --format '{{index .Config.Labels "${IMAGE_LABEL}"}}' ${boot.containerName} 2>/dev/null)" = "$booted" ]`;
+  const bootScript = [
+    `. ${CONTAINER_ENV_PATH}`,
+    `mkdir -p ${shell(boot.directory)}`,
+    `cd ${shell(boot.directory)}`,
+    `exec ${boot.runtimeCommand}`
+  ].join(" && ");
+  const mounts = [["workspace", boot.directory], ...PERSISTENT_HOME_MOUNTS];
+  const run = `docker run -d --name ${boot.containerName} --hostname ${shell(containerHostname(boot.workspaceId))} -p ${boot.port}:${boot.port} -v ${VM_DOCKER_INIT}:${CONTAINER_INIT_PATH}:ro -v "$(pwd)/${RUNTIME_ENV_PATH}:${CONTAINER_ENV_PATH}:ro" --env-file "$trees/${IMAGE_ENV_FILE}" ` + IMAGE_TREES.map((tree) => `-v "$trees/${tree}":/${tree} `).join("") + mounts.map(([source, target]) => `-v "$(pwd)/${PERSISTENT_ROOT}/${source}":${shell(target)} `).join("") + `${CONTAINER_SECURITY_OPTIONS} --entrypoint ${CONTAINER_INIT_PATH} ${STUB_IMAGE} -- sh -lc ${shell(bootScript)}`;
+  const seedTrees = `sudo rm -rf ${trees} && sudo mkdir -p ${trees} && { docker rm -f ${SEED_CONTAINER_NAME} >/dev/null 2>&1 || true; } && docker create --name ${SEED_CONTAINER_NAME} ${named} true >/dev/null && for tree in ${IMAGE_TREES.join(" ")}; do docker cp ${SEED_CONTAINER_NAME}:/$tree - | sudo tar -xf - -C ${trees} ${IMAGE_TREE_SEED_EXCLUDES.map((exclude) => `--exclude=${exclude}`).join(" ")} && [ -d ${trees}/$tree ] || exit 1; done && docker rm ${SEED_CONTAINER_NAME} >/dev/null && sudo touch ${trees}/${IMAGE_TREES_COMPLETE_MARKER}`;
+  const seedStub = `stub=$(mktemp -d) && docker image inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${named} > "$stub/${IMAGE_ENV_FILE}" && workdir=$(docker image inspect --format '{{or .Config.WorkingDir "/"}}' ${named}) && mkdir "$stub/root" ${ROOT_DIRECTORIES.map((directory) => `"$stub/root/${directory}"`).join(" ")} && ${ROOT_LINKS.map((link) => `ln -s usr/${link} "$stub/root/${link}"`).join(" && ")} && chmod 1777 "$stub/root/tmp" && tar --owner=0 --group=0 --numeric-owner -cf "$stub/skeleton.tar" -C "$stub/root" . && docker import --change "WORKDIR $workdir" --change ${shell(`LABEL ${IMAGE_LABEL}=${boot.image}`)} "$stub/skeleton.tar" ${STUB_IMAGE} >/dev/null && docker save -o "$stub/${STUB_IMAGE_ARCHIVE}" ${STUB_IMAGE} && sudo mv "$stub/${IMAGE_ENV_FILE}" "$stub/${STUB_IMAGE_ARCHIVE}" ${trees}/ && rm -rf "$stub"`;
+  const seedNamed = `{ docker image inspect ${named} >/dev/null 2>&1 || pull_resuming ${named}; } && { [ -f ${trees}/${IMAGE_TREES_COMPLETE_MARKER} ] || { ${seedTrees}; }; } && ${seedStub}`;
+  const keepPrevious = `previous=$(${stubLabel}) && [ -n "$previous" ] && seeded "$(trees_of "$previous")" && served "$(trees_of "$previous")"`;
+  const keptImageSkipped = `echo "${KEPT_IMAGE_SKIPPED} stub=\${previous:-none} seeded=$(seeded "$(trees_of "$previous")" && echo yes || echo no) version=$(cat "$(trees_of "$previous")/${SANDBOX_IMAGE_RUNTIME_VERSION_FILE}" 2>/dev/null || echo none)" >&2`;
+  const removeImage = `if docker image inspect "$booted" >/dev/null 2>&1; then leftovers=$(docker ps -aq --filter ancestor="$booted") && { [ -z "$leftovers" ] || docker rm -f $leftovers >/dev/null; } && id=$(docker image inspect --format '{{.Id}}' "$booted") && docker rmi "$booted" >/dev/null && sudo rm -f ${BOAT_SAVED_IMAGES}/"\${id#sha256:}".tar; fi`;
+  const prepare = [
+    `chmod 600 ${boot.staged.env}`,
+    `find . -maxdepth 1 \\( -name '${RUNTIME_ENV_PATH}.*' -o -name '${REGISTRY_PASSWORD_PATH}.*' \\) -mmin +${boot.staleStagedMinutes} -exec rm -f {} +`,
+    `timeout ${DOCKER_DAEMON_WAIT_SECONDS} sh -c 'until docker info >/dev/null 2>&1; do sleep 1; done'`,
+    `[ -x ${VM_DOCKER_INIT} ]`,
+    ...boot.registry && boot.staged.password ? [`{ chmod 600 ${boot.staged.password}; docker login ${shell(boot.registry.server)} --username ${shell(boot.registry.username)} --password-stdin < ${boot.staged.password}; rc=$?; rm -f ${boot.staged.password}; (exit $rc); }`] : [],
+    treesFunctions,
+    PULL_RESUMING,
+    `booted=${named}`,
+    `if ! seeded ${trees}; then ` + (boot.keepPreviousImage ? `if ${keepPrevious}; then booted=$previous; else ${keptImageSkipped}; ${seedNamed}; fi` : seedNamed) + `; fi`,
+    `{ [ "$(${stubLabel})" = "$booted" ] || docker load -i "$(trees_of "$booted")/${STUB_IMAGE_ARCHIVE}" >/dev/null; }`,
+    `sudo find "$(pwd)/${PERSISTENT_ROOT}" -mindepth 1 -maxdepth 1 -name 'image-*' ! -path "$(trees_of "$booted")" -exec rm -rf {} +`,
+    `printf '%s\\n' "$booted" > ${bootedFile}`,
+    `printf '%s\\n' "$booted"`
+  ];
+  const start = `${treesFunctions} && booted=$(cat ${bootedFile}) && trees=$(trees_of "$booted") && rm -f ${bootedFile} && mv -f ${boot.staged.env} ${RUNTIME_ENV_PATH} && up=; for attempt in $(seq ${CONTAINER_CREATE_ATTEMPTS}); do [ "$attempt" = 1 ] || sleep 1; if ${containerOfBooted}; then failure=$(docker start ${boot.containerName} 2>&1 >/dev/null) && { up=1; break; }; else docker rm -f ${boot.containerName} >/dev/null 2>&1; failure=$(${run} 2>&1 >/dev/null) && { up=1; break; }; fi; case "$failure" in *${shell(DOCKER_NAME_IN_USE)}*) ;; *) break ;; esac; done; [ -n "$up" ] || { echo "$failure" >&2; false; } && ${removeImage}`;
+  return {
+    prepare: holdingBootLock(IMAGE_PREPARATION_TIMEOUT_SECONDS, prepare.join(" && ")),
+    start: holdingBootLock(CONTAINER_START_TIMEOUT_SECONDS, start)
+  };
+}
+
 // src/drivers/boat.ts
 function formatBoatRuntimeTemplate(template) {
   return JSON.stringify({ image: template.image, shareCode: template.shareCode });
@@ -579,7 +742,6 @@ function parseBoatRuntimeTemplate(setting) {
 }
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
 var DEFAULT_WORKSPACE_DIR = "/workspace";
-var DEFAULT_CONTAINER_NAME = "claxedo-runtime";
 var DEFAULT_PROVISION_TIMEOUT_MS = 12e4;
 var DEFAULT_STATE_POLL_MS = { firstMs: 250, maxMs: 2e3 };
 var DEFAULT_HEALTH_TIMEOUT_MS = 10 * 6e4;
@@ -587,39 +749,11 @@ var DEFAULT_HEALTH_INTERVAL_MS = 100;
 var HEALTH_PROBE_WINDOW_SECONDS = 50;
 var HEALTH_PROBE_MARGIN_SECONDS = 10;
 var BOOTING_CONTAINER_STATES = /* @__PURE__ */ new Set(["running", "paused"]);
-var IMAGE_PREPARATION_TIMEOUT_SECONDS = 600;
-var CONTAINER_START_TIMEOUT_SECONDS = 120;
 var HOST_PUBLISH_TIMEOUT_SECONDS = 120;
 var BOOT_TTL_SECONDS = 30 * 60;
-var DOCKER_DAEMON_WAIT_SECONDS = 120;
-var RUNTIME_ENV_PATH = ".claxedo-runtime-env";
-var REGISTRY_PASSWORD_PATH = ".claxedo-registry-password";
-var BOOT_LOCK_PATH = "/run/lock/claxedo-boot.lock";
-var BOOT_LOCK_HEADROOM_SECONDS = 60;
-var CONTAINER_ENV_PATH = "/run/claxedo-runtime.env";
-var PERSISTENT_ROOT = "claxedo-persistent";
-var PERSISTENT_HOME_MOUNTS = [["claxedo", "/root/.claxedo"], ["workspace-runtime", "/root/.workspace-runtime"]];
-var IMAGE_TREES = ["root", "usr", "etc", "var", "opt", "home", "srv"];
-var IMAGE_TREE_SEED_EXCLUDES = ["root/.cache", "root/.npm/_cacache"];
-var IMAGE_TREES_COMPLETE_MARKER = ".complete";
-var SEED_CONTAINER_NAME = "claxedo-seed";
-var STUB_IMAGE = "claxedo-runtime-stub";
-var STUB_IMAGE_ARCHIVE = "stub.tar";
-var IMAGE_LABEL = "claxedo.image";
-var IMAGE_ENV_FILE = "image.env";
-var ROOT_LINKS = ["bin", "lib", "lib64", "sbin"];
-var ROOT_DIRECTORIES = ["boot", "dev", "media", "mnt", "proc", "run", "sys", "tmp", ...IMAGE_TREES];
-var BOAT_SAVED_IMAGES = "/var/lib/ascii-docker-images";
-var BOAT_CONTAINER_RECORD = "/etc/ascii-docker.json";
-var DOCKER_NAME_IN_USE = "is already in use by container";
-var CONTAINER_CREATE_ATTEMPTS = 5;
-var CONTAINER_SECURITY_OPTIONS = "--security-opt seccomp=unconfined --security-opt apparmor=unconfined";
-var VM_DOCKER_INIT = "/usr/libexec/docker/docker-init";
-var CONTAINER_INIT_PATH = "/claxedo-init";
 var CONTAINER_STOP_GRACE_SECONDS = 30;
 var HOST_RELAY_NOT_STOPPED = "The sandbox could not stop the localhost relay of this port. Try again.";
 var STDERR_TAIL_CHARS = 600;
-var REDACTED_VALUE_MIN_LENGTH = 8;
 var READY_STATES = /* @__PURE__ */ new Set(["ready", "idle", "running"]);
 var PENDING_STATES = /* @__PURE__ */ new Set(["init", "provisioning", "provisioned", "cloning"]);
 var TRANSIENT_MARKERS = ["transport_failed", "idempotency_in_progress"];
@@ -627,16 +761,6 @@ var GONE_CODES = /* @__PURE__ */ new Set(["not_found", "snapshot_data_expired"])
 var RESUME_UNDER_WAY = "sandbox_resuming";
 var NOT_RUNNING_CODES = /* @__PURE__ */ new Set(["machine_not_running", "sandbox_not_ready"]);
 var TEMPLATE_UNREADABLE_CODES = /* @__PURE__ */ new Set(["snapshot_not_found", "api_key_action_forbidden", "api_key_sandbox_forbidden"]);
-function boatTemplateResetCommand() {
-  const bootFiles = [
-    `${PERSISTENT_ROOT}/workspace`,
-    ...PERSISTENT_HOME_MOUNTS.map(([source]) => `${PERSISTENT_ROOT}/${source}`),
-    RUNTIME_ENV_PATH,
-    `${RUNTIME_ENV_PATH}.*`,
-    `${REGISTRY_PASSWORD_PATH}.*`
-  ];
-  return `{ docker rm -f ${DEFAULT_CONTAINER_NAME} >/dev/null 2>&1 || true; } && sudo rm -rf ${bootFiles.join(" ")} && [ -z "$(docker ps -aq)" ] && echo '[]' | sudo tee ${BOAT_CONTAINER_RECORD} >/dev/null && sudo find ${BOAT_SAVED_IMAGES} -mindepth 1 -delete && ls -d ${PERSISTENT_ROOT}/image-*/${IMAGE_TREES_COMPLETE_MARKER}`;
-}
 function hostGoneOrThrow(err) {
   if (err instanceof BoatApiError && GONE_CODES.has(err.code)) throw new SandboxHostGoneError(err.message);
   throw err;
@@ -649,24 +773,11 @@ function archivedOrThrow(err) {
   if (err instanceof BoatApiError && err.code === "stop_failed" && err.sandboxState === "archived") return;
   hostGoneOrThrow(err);
 }
-function holdingBootLock(commandTimeoutSeconds, script) {
-  const wait = commandTimeoutSeconds - BOOT_LOCK_HEADROOM_SECONDS;
-  return `exec 9>>${BOOT_LOCK_PATH} && { flock -w ${wait} 9 || { echo "another boot of this machine held ${BOOT_LOCK_PATH} for ${wait} s" >&2; exit 1; }; } && ${script}`;
-}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function scrubbed(text, secrets) {
-  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
-}
 function scrubbedTail(text, secrets) {
-  return scrubbed(text, secrets).trim().slice(-STDERR_TAIL_CHARS);
-}
-function imageTreesDirectory(image) {
-  return `image-${image.replace(/[^A-Za-z0-9._-]/g, "-")}`;
-}
-function containerHostname(workspaceId) {
-  return workspaceId.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 63) || "claxedo";
+  return redactWorkspaceRuntimeBootSecrets(text, secrets).trim().slice(-STDERR_TAIL_CHARS);
 }
 var BoatDriverError = class extends Error {
   constructor(message) {
@@ -748,43 +859,6 @@ function createBoatSandboxDriver(options) {
       wait = Math.min(wait * 2, statePollMs.maxMs);
     }
   }
-  function containerScripts(input, staged) {
-    const port = runtimePort(input);
-    const directory = workspaceDirectory(input);
-    const reference = resolveImage(input);
-    const image = shell(reference);
-    const trees = `"$(pwd)/${PERSISTENT_ROOT}/${imageTreesDirectory(reference)}"`;
-    const labelledWithImage = (object, name) => `[ "$(docker ${object} inspect --format '{{index .Config.Labels "${IMAGE_LABEL}"}}' ${name} 2>/dev/null)" = ${image} ]`;
-    const bootScript = [
-      `. ${CONTAINER_ENV_PATH}`,
-      `mkdir -p ${shell(directory)}`,
-      `cd ${shell(directory)}`,
-      `exec ${runtimeCommand}`
-    ].join(" && ");
-    const mounts = [["workspace", directory], ...PERSISTENT_HOME_MOUNTS];
-    const run = `docker run -d --name ${containerName} --hostname ${shell(containerHostname(input.workspaceId))} -p ${port}:${port} -v ${VM_DOCKER_INIT}:${CONTAINER_INIT_PATH}:ro -v "$(pwd)/${RUNTIME_ENV_PATH}:${CONTAINER_ENV_PATH}:ro" --env-file ${trees}/${IMAGE_ENV_FILE} ` + IMAGE_TREES.map((tree) => `-v ${trees}/${tree}:/${tree} `).join("") + mounts.map(([source, target]) => `-v "$(pwd)/${PERSISTENT_ROOT}/${source}":${shell(target)} `).join("") + `${CONTAINER_SECURITY_OPTIONS} --entrypoint ${CONTAINER_INIT_PATH} ${STUB_IMAGE} -- sh -lc ${shell(bootScript)}`;
-    const seedTrees = `sudo rm -rf ${trees} && sudo mkdir -p ${trees} && { docker rm -f ${SEED_CONTAINER_NAME} >/dev/null 2>&1 || true; } && docker create --name ${SEED_CONTAINER_NAME} ${image} true >/dev/null && for tree in ${IMAGE_TREES.join(" ")}; do docker cp ${SEED_CONTAINER_NAME}:/$tree - | sudo tar -xf - -C ${trees} ${IMAGE_TREE_SEED_EXCLUDES.map((exclude) => `--exclude=${exclude}`).join(" ")} && [ -d ${trees}/$tree ] || exit 1; done && docker rm ${SEED_CONTAINER_NAME} >/dev/null && sudo touch ${trees}/${IMAGE_TREES_COMPLETE_MARKER}`;
-    const seedStub = `stub=$(mktemp -d) && docker image inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${image} > "$stub/${IMAGE_ENV_FILE}" && workdir=$(docker image inspect --format '{{or .Config.WorkingDir "/"}}' ${image}) && mkdir "$stub/root" ${ROOT_DIRECTORIES.map((directory2) => `"$stub/root/${directory2}"`).join(" ")} && ${ROOT_LINKS.map((link) => `ln -s usr/${link} "$stub/root/${link}"`).join(" && ")} && chmod 1777 "$stub/root/tmp" && tar --owner=0 --group=0 --numeric-owner -cf "$stub/skeleton.tar" -C "$stub/root" . && docker import --change "WORKDIR $workdir" --change ${shell(`LABEL ${IMAGE_LABEL}=${reference}`)} "$stub/skeleton.tar" ${STUB_IMAGE} >/dev/null && docker save -o "$stub/${STUB_IMAGE_ARCHIVE}" ${STUB_IMAGE} && sudo mv "$stub/${IMAGE_ENV_FILE}" "$stub/${STUB_IMAGE_ARCHIVE}" ${trees}/ && rm -rf "$stub"`;
-    const removeImage = `if docker image inspect ${image} >/dev/null 2>&1; then leftovers=$(docker ps -aq --filter ancestor=${image}) && { [ -z "$leftovers" ] || docker rm -f $leftovers >/dev/null; } && id=$(docker image inspect --format '{{.Id}}' ${image}) && docker rmi ${image} >/dev/null && sudo rm -f ${BOAT_SAVED_IMAGES}/"\${id#sha256:}".tar; fi`;
-    const seeded = [IMAGE_TREES_COMPLETE_MARKER, STUB_IMAGE_ARCHIVE, IMAGE_ENV_FILE].map((file) => `[ -f ${trees}/${file} ]`).join(" && ");
-    const prepare = [
-      `chmod 600 ${staged.env}`,
-      `find . -maxdepth 1 \\( -name '${RUNTIME_ENV_PATH}.*' -o -name '${REGISTRY_PASSWORD_PATH}.*' \\) -mmin +${BOOT_TTL_SECONDS / 60} -exec rm -f {} +`,
-      `timeout ${DOCKER_DAEMON_WAIT_SECONDS} sh -c 'until docker info >/dev/null 2>&1; do sleep 1; done'`,
-      `[ -x ${VM_DOCKER_INIT} ]`,
-      ...options.registryAuth && staged.password ? [`{ chmod 600 ${staged.password}; docker login ${shell(options.registryAuth.server)} --username ${shell(options.registryAuth.username)} --password-stdin < ${staged.password}; rc=$?; rm -f ${staged.password}; (exit $rc); }`] : [],
-      // Trees an earlier start marked complete hold what a person or a harness
-      // changed since, so a seed missing only its stub or env builds those alone.
-      `if ! { ${seeded}; }; then { docker image inspect ${image} >/dev/null 2>&1 || docker pull ${image} >/dev/null; } && { [ -f ${trees}/${IMAGE_TREES_COMPLETE_MARKER} ] || { ${seedTrees}; }; } && ${seedStub}; fi`,
-      `{ ${labelledWithImage("image", STUB_IMAGE)} || docker load -i ${trees}/${STUB_IMAGE_ARCHIVE} >/dev/null; }`,
-      `sudo find "$(pwd)/${PERSISTENT_ROOT}" -mindepth 1 -maxdepth 1 -name 'image-*' ! -path ${trees} -exec rm -rf {} +`
-    ];
-    const start = `mv -f ${staged.env} ${RUNTIME_ENV_PATH} && up=; for attempt in $(seq ${CONTAINER_CREATE_ATTEMPTS}); do [ "$attempt" = 1 ] || sleep 1; if ${labelledWithImage("container", containerName)}; then failure=$(docker start ${containerName} 2>&1 >/dev/null) && { up=1; break; }; else docker rm -f ${containerName} >/dev/null 2>&1; failure=$(${run} 2>&1 >/dev/null) && { up=1; break; }; fi; case "$failure" in *${shell(DOCKER_NAME_IN_USE)}*) ;; *) break ;; esac; done; [ -n "$up" ] || { echo "$failure" >&2; false; } && ${removeImage}`;
-    return {
-      prepare: holdingBootLock(IMAGE_PREPARATION_TIMEOUT_SECONDS, prepare.join(" && ")),
-      start: holdingBootLock(CONTAINER_START_TIMEOUT_SECONDS, start)
-    };
-  }
   function healthProbe(port, windowSeconds) {
     const booting = [...BOOTING_CONTAINER_STATES].join("|");
     return `end=$(($(date +%s) + ${windowSeconds})); while :; do code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${port}/global/health); [ "$code" = 200 ] && break; state=$(docker inspect --format '{{.State.Status}}' ${shell(containerName)} 2>/dev/null || echo missing); case "$state" in ${booting}) ;; *) break ;; esac; [ "$(date +%s)" -lt "$end" ] || break; sleep ${healthIntervalMs / 1e3}; done; echo "$code"; echo "$state"`;
@@ -813,29 +887,48 @@ function createBoatSandboxDriver(options) {
         command: `docker inspect --format 'status={{.State.Status}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}}' ${shell(containerName)}; docker logs --tail 20 ${shell(containerName)} 2>&1`,
         timeoutSeconds: 10
       });
-      diagnostic = runtimeBootDiagnostic(scrubbed(`${result.stdout}
+      diagnostic = runtimeBootDiagnostic(redactWorkspaceRuntimeBootSecrets(`${result.stdout}
 ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
     } catch {
       diagnostic = "container diagnostics unavailable";
     }
     throw new SandboxRuntimeBootError(`Boat ${sandboxId} runtime did not become healthy: ${last}; ${diagnostic}`);
   }
-  async function startContainer(sandboxId, input, hostId) {
+  async function startContainer(sandboxId, input, hostId, keepPreviousImage) {
     const env = { ...bootEnv(input, hostId), ...await options.env?.(input, { id: hostId }) };
     const boot2 = crypto.randomUUID();
     const staged = {
       env: `${RUNTIME_ENV_PATH}.${boot2}`,
       ...options.registryAuth ? { password: `${REGISTRY_PASSWORD_PATH}.${boot2}` } : {}
     };
-    const scripts = containerScripts(input, staged);
+    const image = resolveImage(input);
+    const scripts = machineBootScripts({
+      image,
+      keepPreviousImage: keepPreviousImage && image === options.image,
+      workspaceId: input.workspaceId,
+      directory: workspaceDirectory(input),
+      port: runtimePort(input),
+      runtimeCommand,
+      containerName,
+      ...options.registryAuth ? { registry: { server: options.registryAuth.server, username: options.registryAuth.username } } : {},
+      staged,
+      staleStagedMinutes: BOOT_TTL_SECONDS / 60
+    });
     await client.writeFile(sandboxId, { path: staged.env, content: envFile(env) });
     if (options.registryAuth && staged.password) {
       await client.writeFile(sandboxId, { path: staged.password, content: options.registryAuth.password });
     }
     const secrets = [...workspaceRuntimeBootSecrets(env), ...options.registryAuth ? [options.registryAuth.password] : []];
     let failure;
+    let booted;
     try {
-      await execOrThrow(sandboxId, scripts.prepare, "runtime image preparation", { timeoutSeconds: IMAGE_PREPARATION_TIMEOUT_SECONDS, secrets });
+      const prepared = await execOrThrow(sandboxId, scripts.prepare, "runtime image preparation", { timeoutSeconds: IMAGE_PREPARATION_TIMEOUT_SECONDS, secrets }).catch((error) => {
+        throw error instanceof BoatDriverError && error.message.includes(IMAGE_DOWNLOAD_INTERRUPTED) ? new SandboxImageDownloadError(error.message) : error;
+      });
+      booted = bootedImage(prepared.stdout);
+      if (!booted) throw new BoatDriverError(`Boat ${sandboxId} runtime image preparation named no image it booted`);
+      const skipped = keepPreviousImage ? prepared.stderr.split("\n").find((line) => line.startsWith(KEPT_IMAGE_SKIPPED)) : void 0;
+      if (skipped) console.warn("A Boat wake took the deployment's image instead of the one the machine last booted", { sandboxId, workspaceId: input.workspaceId, found: skipped.slice(KEPT_IMAGE_SKIPPED.length).trim() });
       try {
         await execOrThrow(sandboxId, scripts.start, "container start", { timeoutSeconds: CONTAINER_START_TIMEOUT_SECONDS, secrets });
       } catch (error) {
@@ -846,19 +939,19 @@ ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
     }
     try {
       if (options.registryAuth || failure !== void 0) {
-        await execOrThrow(sandboxId, `rm -f ${[staged.env, staged.password].filter(Boolean).join(" ")}`, "staged file cleanup", { secrets });
+        await execOrThrow(sandboxId, `rm -f ${[staged.env, staged.password, bootedImageFile(staged)].filter(Boolean).join(" ")}`, "staged file cleanup", { secrets });
       }
     } catch (cleanupFailure) {
       if (failure === void 0) throw cleanupFailure;
       if (failure instanceof Error) failure.message = `${failure.message}; ${cleanupFailure instanceof Error ? cleanupFailure.message : String(cleanupFailure)}`;
     }
-    if (failure !== void 0) throw failure;
-    return secrets;
+    if (failure !== void 0 || !booted) throw failure;
+    return { secrets, booted };
   }
-  async function boot(sandboxId, input, hostId) {
+  async function boot(sandboxId, input, hostId, keepPreviousImage) {
     await input.onMachineReady?.();
     const port = runtimePort(input);
-    const secrets = await startContainer(sandboxId, input, hostId);
+    const { secrets, booted } = await startContainer(sandboxId, input, hostId, keepPreviousImage);
     await input.onImageReady?.();
     await execOrThrow(sandboxId, holdingBootLock(HOST_PUBLISH_TIMEOUT_SECONDS, `host ${port} --public`), "host publish", {
       timeoutSeconds: HOST_PUBLISH_TIMEOUT_SECONDS,
@@ -878,7 +971,7 @@ ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
       hostId,
       driverResourceId: sandboxId,
       driver: { id: "boat", resourceId: sandboxId },
-      labels: { ...input.labels, ...resolveImage(input) === options.image ? { [SANDBOX_IMAGE_LABEL]: options.image } : {} }
+      labels: { ...input.labels, ...resolveImage(input) === options.image ? { [SANDBOX_IMAGE_LABEL]: booted } : {} }
     };
   }
   function assertNetwork(input) {
@@ -927,7 +1020,7 @@ ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
     if (failures.length > 1) throw new AggregateError(failures, `Boat ${created.id} resource handoff and deletion failed`);
     const ready = await waitUntilReady(created.id);
     if (!ready) return { provisioning: true, retryAfterMs: 0 };
-    return boot(created.id, input, hostId);
+    return boot(created.id, input, hostId, false);
   }
   async function resumeHost(input) {
     const sandboxId = input.lease.sandboxId;
@@ -947,7 +1040,7 @@ ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
     }
     const ready = await waitUntilReady(sandboxId);
     if (!ready) return { provisioning: true, retryAfterMs: 0 };
-    return boot(sandboxId, input.ensure, hostId);
+    return boot(sandboxId, input.ensure, hostId, !input.ensure.updateImage);
   }
   async function stop(target) {
     await client.command(target.sandboxId, {
@@ -983,7 +1076,6 @@ ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
   };
 }
 export {
-  boatTemplateResetCommand,
   createBoatSandboxDriver,
   formatBoatRuntimeTemplate,
   parseBoatRuntimeTemplate

package/dist/drivers/cloudflare.d.ts

@@ -5,19 +5,16 @@ export type CloudflareSandboxDriverOptions = {
     workerUrl: string;
     /** Bearer token the Worker validates (its `API_TOKEN` secret). */
     apiToken: string;
-    /** Port the workspace-runtime listens on inside the sandbox (exposed publicly). */
+    /** Port the workspace-runtime listens on inside the container, which the Worker's proxy route forwards to. */
     runtimePort?: number;
-    /** Command that launches the workspace-runtime inside the image. */
     runtimeCommand?: string;
-    /** Workspace directory inside the sandbox. */
     workspaceDir?: string;
     /**
      * Static control-plane config injected into every sandbox so the runtime can
-     * verify relay-proxied requests. Never carries per-workspace secrets — those
-     * (if any) belong to the future egress broker.
-   *   relayJwksUrl     → WORKSPACE_RUNTIME_RELAY_JWKS_URL (relay public key for RAT verify)
-   *   relayVerifyPem   → WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM (fallback to JWKS)
-   *   managementJwksUrl → WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL (config apply)
+     * verify relay-proxied requests; never a per-workspace secret.
+     *   relayJwksUrl      → WORKSPACE_RUNTIME_RELAY_JWKS_URL (relay host token keys)
+     *   relayVerifyPem    → WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM (fallback to JWKS)
+     *   managementJwksUrl → WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL (config apply)
      */
     controlEnv?: WorkspaceRuntimeControlEnv;
     /** Default native harness injected as WORKSPACE_RUNTIME_NATIVE_HARNESS, for example "opencode". */
@@ -26,7 +23,6 @@ export type CloudflareSandboxDriverOptions = {
     env?: (input: SandboxDriverEnsureInput, sandbox: {
         id: string;
     }) => Record<string, string> | Promise<Record<string, string>>;
-    /** Injected for tests. */
     fetch?: typeof fetch;
     /** ensure-runtime/HTTP timeout. */
     timeoutMs?: number;