@claxedo/sandbox-manager 0.10.1 → 0.10.3

package/dist/start-admission.d.ts

@@ -0,0 +1,32 @@
+import type { SandboxDriver, SandboxEnsureResult, SandboxManagerInput } from "./contract";
+import type { EgressWarnings } from "./egress-warnings";
+export type SandboxStartRefusal = Extract<SandboxEnsureResult, {
+    status: "unavailable";
+}>;
+/**
+ * The composition's standing answers to a start's input, decided BEFORE a
+ * lease is touched: none of them is a provisioning failure, so none may burn a
+ * lease epoch or enter retry backoff, and each repeats until the composition
+ * or the input changes.
+ *
+ * Egress: a caller that hands over a restricted policy is stating that this
+ * sandbox must not reach the open internet. That is honoured where the driver
+ * can honour it. Where it cannot, the start is refused, unless the start
+ * allows uncontained egress: then the sandbox runs with the policy withheld
+ * (`ensureHostInput` never hands it down) and the gap is reported here, once
+ * per driver per isolate. `sandbox_egress_policy_unenforceable` is refused too,
+ * and deliberately so: that driver DOES enforce egress, it just cannot express
+ * this policy's encoding, and degrading an enforcing driver to "unrestricted"
+ * would weaken the path that does enforce.
+ *
+ * Identity: caller env restating the identity the driver's target reports,
+ * which `recordTarget` persists, would boot the runtime bound to a hostId the
+ * lease never authorized; the driver rejects it again at compose time for
+ * callers that reach it directly.
+ */
+export declare function refusedStart(input: {
+    driver: SandboxDriver;
+    workspaceId: string;
+    start: SandboxManagerInput;
+    egressWarnings: EgressWarnings;
+}): SandboxStartRefusal | undefined;

package/dist/start-telemetry.d.ts

@@ -16,14 +16,16 @@ export declare function createSandboxStartRecorder(options: {
      * lease as it ends, so a poller reading the lease mid-boot sees how far the
      * start has come. `opened` writes the epoch's `lease_decision` before the
      * driver runs, so a stop that lands mid-boot finds the boot it ends on the
-     * row. A serving lease is not starting. An epoch acquired with a start it
-     * continues has that start and no phase yet; one acquired without begins
-     * its own here.
+     * row. A serving lease is not starting, unless the step is a person's
+     * update, which is a start of its own on the same epoch. An epoch acquired
+     * with a start it continues has that start and no phase yet; one acquired
+     * without begins its own here.
      */
     observe(lease: SandboxLease, input: {
         bootMode: SandboxBootMode;
         enteredAt: number;
         labels: Record<string, string>;
+        update?: true;
     }): {
         opened: () => Promise<void>;
         end: (phase: SandboxStartPhase) => Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "type": "module",
-  "description": "Sandbox lifecycle manager with epoch-based leases and pluggable drivers for Modal, Vercel Sandbox, Cloudflare, Boat, and Docker",
+  "description": "Sandbox lifecycle manager with epoch-based leases and pluggable drivers for Modal, Vercel Sandbox, Cloudflare, Boat, Agent37, and Docker",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -15,6 +15,7 @@
     "cloudflare",
     "docker",
     "boat",
+    "agent37",
     "agents"
   ],
   "main": "./dist/index.mjs",
@@ -62,6 +63,13 @@
       "import": "./dist/driver-catalog.mjs",
       "default": "./dist/driver-catalog.mjs"
     },
+    "./drivers/agent37": {
+      "development": "./src/drivers/agent37.ts",
+      "bun": "./src/drivers/agent37.ts",
+      "types": "./dist/drivers/agent37.d.ts",
+      "import": "./dist/drivers/agent37.mjs",
+      "default": "./dist/drivers/agent37.mjs"
+    },
     "./drivers/boat": {
       "development": "./src/drivers/boat.ts",
       "bun": "./src/drivers/boat.ts",
@@ -163,7 +171,7 @@
     "access": "public"
   },
   "name": "@claxedo/sandbox-manager",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "scripts": {
     "build": "bun scripts/build.ts",
     "prepublishOnly": "npm run build",
@@ -172,8 +180,8 @@
     "test": "mkdir -p .artifacts/unit && node ../../script/test-deadline.mjs bun test src --reporter=junit --reporter-outfile=.artifacts/unit/junit.xml"
   },
   "dependencies": {
-    "@claxedo/helpers": "0.2.1",
-    "@claxedo/sandbox-contract": "0.10.1",
+    "@claxedo/helpers": "0.2.3",
+    "@claxedo/sandbox-contract": "0.10.3",
     "@vercel/sandbox": "3.3.0",
     "modal": "0.10.1"
   },