@claxedo/sandbox-manager 0.5.1

package/dist/drivers/docker.mjs

@@ -0,0 +1,329 @@
+import { createRequire as __createRequire } from 'module';var require = __createRequire(import.meta.url);
+
+// src/drivers/docker.ts
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+
+// src/runtime-env.ts
+function workspaceRuntimeTargetEnv(input) {
+  return {
+    WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
+    ...input.hostId ? { WORKSPACE_RUNTIME_HOST_ID: input.hostId } : {},
+    WORKSPACE_RUNTIME_DIRECTORY: input.directory,
+    WORKSPACE_RUNTIME_PORT: String(input.port),
+    ...input.host ? { WORKSPACE_RUNTIME_HOST: input.host } : {}
+  };
+}
+function workspaceRuntimeSourceEnv(input) {
+  if (!input.source || input.source.kind === "empty") return { WORKSPACE_RUNTIME_SOURCE_KIND: "empty" };
+  return {
+    WORKSPACE_RUNTIME_SOURCE_KIND: "git",
+    WORKSPACE_RUNTIME_GIT_REPO_URL: input.source.repoUrl,
+    ...input.source.branch ? { WORKSPACE_RUNTIME_GIT_BRANCH: input.source.branch } : {}
+  };
+}
+
+// src/command.ts
+function shell(input) {
+  return `'${input.replace(/'/g, `'"'"'`)}'`;
+}
+
+// src/constants.ts
+var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
+
+// src/image.ts
+import { Image, DaytonaNotFoundError } from "@daytona/sdk";
+
+// src/runtime-version.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var versionCache;
+function workspaceRuntimeVersion() {
+  if (versionCache) return versionCache;
+  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
+  if (envVersion) {
+    versionCache = envVersion;
+    return versionCache;
+  }
+  try {
+    versionCache = require2("@claxedo/workspace-runtime/package.json").version;
+    return versionCache;
+  } catch {
+  }
+  versionCache = "0.0.0";
+  return versionCache;
+}
+
+// src/image-name.ts
+var SNAPSHOT_SCHEMA_VERSION = 8;
+var DEFAULT_SANDBOX_IMAGE_REPOSITORY = "ghcr.io/kyashrathore/claxedo-sandbox";
+function snapshotVersion(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function sandboxImageRepository(env = process.env) {
+  const repository = env.CLAXEDO_SANDBOX_IMAGE_REPOSITORY?.trim();
+  return repository ? repository : DEFAULT_SANDBOX_IMAGE_REPOSITORY;
+}
+function buildIdSuffix(buildId, env) {
+  const id = (buildId ?? env.CLAXEDO_SANDBOX_BUILD_ID)?.trim();
+  return id ? `-${snapshotVersion(id)}` : "";
+}
+function defaultSandboxImage(version = workspaceRuntimeVersion(), buildId, env = process.env) {
+  return `${sandboxImageRepository(env)}:workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
+}
+function defaultSnapshotName(version = workspaceRuntimeVersion(), buildId, env = process.env) {
+  return `claxedo-workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
+}
+
+// src/image.ts
+var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
+var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
+var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
+
+// src/drivers/docker.ts
+var execFileAsync = promisify(execFile);
+var DEFAULT_OPERATION_TIMEOUT_MS = 6e4;
+var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
+var DEFAULT_WORKSPACE_DIR = "/workspace";
+var DOCKER_LABEL = "claxedo";
+var AUTH_STAGE_DIR = "/tmp/claxedo-auth";
+function dockerSandboxSyncLocalAuth(env = process.env) {
+  return !disabled(env.CLAXEDO_DOCKER_SANDBOX_SYNC_LOCAL_AUTH);
+}
+function dockerSandboxAuthHome(env = process.env) {
+  return clean(env.CLAXEDO_DOCKER_SANDBOX_AUTH_HOME) ?? clean(env.HOME) ?? os.homedir();
+}
+function dockerSandboxImageFromEnv(env = process.env) {
+  return clean(env.CLAXEDO_DOCKER_SANDBOX_IMAGE) ?? clean(env.CLAXEDO_SANDBOX_IMAGE) ?? SANDBOX_IMAGE;
+}
+function parseDockerPort(input) {
+  const line = input.trim().split(/\r?\n/)[0]?.trim();
+  const match = line?.match(/(?:(?:\[.*\]|[^:]+):)?(\d+)$/);
+  return match?.[1] ? `http://127.0.0.1:${match[1]}` : void 0;
+}
+function dockerLocalAuthCandidates(home) {
+  return [
+    {
+      kind: "file",
+      source: path.join(home, ".codex", "auth.json"),
+      target: "/root/.codex/auth.json"
+    },
+    {
+      kind: "dir",
+      source: path.join(home, ".codex", "accounts"),
+      target: "/root/.codex/accounts"
+    },
+    {
+      kind: "file",
+      source: path.join(home, ".local", "share", "opencode", "auth.json"),
+      target: "/root/.local/share/opencode/auth.json"
+    },
+    {
+      kind: "file",
+      source: path.join(home, ".claude.json"),
+      target: "/root/.claude.json"
+    }
+  ];
+}
+function clean(input) {
+  const txt = input?.trim();
+  return txt ? txt : void 0;
+}
+function disabled(input) {
+  return ["0", "false", "no", "off"].includes(input?.trim().toLowerCase() ?? "");
+}
+function nameFor(workspaceId) {
+  const cleanId = workspaceId.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+  return `claxedo-${cleanId || "workspace"}-${Date.now().toString(36)}`.slice(0, 63);
+}
+async function docker(args, timeoutMs = DEFAULT_OPERATION_TIMEOUT_MS) {
+  return execFileAsync("docker", args, {
+    maxBuffer: 20 * 1024 * 1024,
+    timeout: timeoutMs
+  });
+}
+async function stageLocalAgentAuth(containerId, input) {
+  if (!input.syncLocalAuth) return;
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "claxedo-docker-auth-"));
+  try {
+    const stagedRoot = path.join(tmp, "root");
+    const copied = await Promise.all(dockerLocalAuthCandidates(input.authHome).map(async (item) => {
+      const stat = await fs.stat(item.source).catch(() => void 0);
+      if (!stat) return false;
+      if (item.kind === "file" && !stat.isFile()) return false;
+      if (item.kind === "dir" && !stat.isDirectory()) return false;
+      const target = path.join(stagedRoot, item.target.replace(/^\/root\/?/, ""));
+      await fs.mkdir(path.dirname(target), { recursive: true });
+      if (item.kind === "dir") await fs.cp(item.source, target, { recursive: true });
+      else await fs.copyFile(item.source, target);
+      return true;
+    }));
+    if (!copied.some(Boolean)) return;
+    await input.docker(["cp", stagedRoot, `${containerId}:${AUTH_STAGE_DIR}`], input.timeoutMs);
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+function authHydrationScript() {
+  return [
+    "rm -f /root/.codex/auth.json /root/.local/share/opencode/auth.json /root/.claude.json || true",
+    "rm -rf /root/.codex/accounts || true",
+    "mkdir -p /root/.codex /root/.local/share/opencode /root/.claude",
+    `if [ -f ${AUTH_STAGE_DIR}/.codex/auth.json ]; then cp -a ${AUTH_STAGE_DIR}/.codex/auth.json /root/.codex/auth.json && chmod 600 /root/.codex/auth.json || true; fi`,
+    `if [ -d ${AUTH_STAGE_DIR}/.codex/accounts ]; then mkdir -p /root/.codex/accounts && cp -a ${AUTH_STAGE_DIR}/.codex/accounts/. /root/.codex/accounts/ && chmod -R go-rwx /root/.codex/accounts || true; fi`,
+    `if [ -f ${AUTH_STAGE_DIR}/.local/share/opencode/auth.json ]; then cp -a ${AUTH_STAGE_DIR}/.local/share/opencode/auth.json /root/.local/share/opencode/auth.json && chmod 600 /root/.local/share/opencode/auth.json || true; fi`,
+    `if [ -f ${AUTH_STAGE_DIR}/.claude.json ]; then cp -a ${AUTH_STAGE_DIR}/.claude.json /root/.claude.json && chmod 600 /root/.claude.json || true; fi`
+  ].join(" && ");
+}
+function bootScript(directory, runtimeCommand) {
+  return [
+    authHydrationScript(),
+    `mkdir -p ${shell(directory)}`,
+    `cd ${shell(directory)}`,
+    `exec ${runtimeCommand}`
+  ].join(" && ");
+}
+function envArgs(input) {
+  return Object.entries(input).flatMap(([key, value]) => ["--env", `${key}=${value}`]);
+}
+function labelArgs(input) {
+  return Object.entries(input).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+}
+function transientDriverError(err) {
+  const shaped = err;
+  const text = `${shaped.code ?? ""} ${shaped.message ?? ""}`.toLowerCase();
+  return text.includes("timeout") || text.includes("temporarily unavailable") || text.includes("connection refused");
+}
+function createDockerSandboxDriver(options) {
+  const dockerCommand = options.docker ?? docker;
+  const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
+  const workspaceDir = options.workspaceDir ?? DEFAULT_WORKSPACE_DIR;
+  const timeoutMs = options.operationTimeoutMs ?? DEFAULT_OPERATION_TIMEOUT_MS;
+  const syncLocalAuth = options.syncLocalAuth ?? dockerSandboxSyncLocalAuth();
+  const authHome = options.authHome ?? dockerSandboxAuthHome();
+  function runtimePort(input) {
+    return input.workspaceRuntimePort ?? options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
+  }
+  function workspaceDirectory(input) {
+    return input.workspaceRoot ?? workspaceDir;
+  }
+  function image(input) {
+    if (input.bootSource?.kind === "driver-snapshot") {
+      throw new Error("Docker SandboxDriver does not support driver snapshots; use image boot");
+    }
+    return input.bootSource?.kind === "image" ? input.bootSource.image : input.snapshot ?? options.image;
+  }
+  function bootEnv(input, hostId) {
+    const env = {
+      ...workspaceRuntimeTargetEnv({
+        workspaceId: input.workspaceId,
+        hostId,
+        directory: workspaceDirectory(input),
+        port: runtimePort(input),
+        host: "0.0.0.0"
+      }),
+      ...workspaceRuntimeSourceEnv({ source: input.source }),
+      ...input.env
+    };
+    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
+    return env;
+  }
+  async function readyTarget(input, sandboxId, hostId) {
+    const out = await dockerCommand(["port", sandboxId, `${runtimePort(input)}/tcp`], timeoutMs);
+    const url = parseDockerPort(String(out.stdout ?? ""));
+    if (!url) throw new Error(`Docker container ${sandboxId} does not expose workspace runtime port ${runtimePort(input)}`);
+    return {
+      workspaceId: input.workspaceId,
+      sandboxId,
+      url,
+      hostId,
+      driverResourceId: sandboxId,
+      driver: {
+        id: "docker",
+        resourceId: sandboxId
+      },
+      labels: input.labels
+    };
+  }
+  async function ensureHost(input) {
+    if (input.net && input.net.mode !== "allow-all") {
+      throw new Error("Docker SandboxDriver cannot enforce restricted network policies");
+    }
+    const hostId = input.hostId ?? nameFor(input.workspaceId);
+    const env = {
+      ...bootEnv(input, hostId),
+      ...await options.env?.(input, { id: hostId })
+    };
+    const created = await dockerCommand([
+      "create",
+      "--name",
+      hostId,
+      "--label",
+      `app=${DOCKER_LABEL}`,
+      "--label",
+      `claxedo.workspaceId=${input.workspaceId}`,
+      ...labelArgs(input.labels),
+      "-p",
+      `127.0.0.1::${runtimePort(input)}`,
+      ...envArgs(env),
+      "--entrypoint",
+      "sh",
+      image(input),
+      "-lc",
+      bootScript(workspaceDirectory(input), runtimeCommand)
+    ], 12e4).catch((err) => {
+      if (transientDriverError(err)) return void 0;
+      throw err;
+    });
+    if (!created) return { provisioning: true, retryAfterMs: 2e3 };
+    const sandboxId = String(created.stdout ?? "").trim() || hostId;
+    await stageLocalAgentAuth(sandboxId, { authHome, syncLocalAuth, docker: dockerCommand, timeoutMs });
+    await dockerCommand(["start", sandboxId], timeoutMs);
+    return readyTarget(input, sandboxId, hostId);
+  }
+  async function resumeHost(input) {
+    const sandboxId = input.lease.sandboxId ?? input.lease.sandbox_id;
+    if (!sandboxId) return ensureHost(input.ensure);
+    await dockerCommand(["inspect", "-f", "{{.Id}}", sandboxId], timeoutMs).catch(() => void 0);
+    await dockerCommand(["start", sandboxId], timeoutMs).catch((err) => {
+      if (transientDriverError(err)) return void 0;
+      throw err;
+    });
+    return readyTarget(input.ensure, sandboxId, input.ensure.hostId ?? sandboxId);
+  }
+  async function stop(target) {
+    await dockerCommand(["stop", target.sandboxId], 3e4);
+  }
+  async function destroy(target) {
+    await dockerCommand(["rm", "-f", target.sandboxId], 3e4);
+  }
+  return {
+    id: "docker",
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none"
+    },
+    ensureHost,
+    resumeHost,
+    async touch() {
+    },
+    suspend: stop,
+    stop,
+    destroy
+  };
+}
+export {
+  createDockerSandboxDriver,
+  dockerLocalAuthCandidates,
+  dockerSandboxAuthHome,
+  dockerSandboxImageFromEnv,
+  dockerSandboxSyncLocalAuth,
+  parseDockerPort
+};

package/dist/drivers/fetch-bridge.d.ts

@@ -0,0 +1,10 @@
+import type { SandboxDriver } from "..";
+export type FetchBridgeSandboxDriverOptions = {
+    id: string;
+    baseUrl: string;
+    token?: string;
+    fetch?: typeof fetch;
+    autoStopMs: number;
+    autoDeleteMs: number;
+};
+export declare function createFetchBridgeSandboxDriver(options: FetchBridgeSandboxDriverOptions): SandboxDriver;

package/dist/drivers/fetch-bridge.mjs

@@ -0,0 +1,104 @@
+import { createRequire as __createRequire } from 'module';var require = __createRequire(import.meta.url);
+
+// src/drivers/fetch-bridge.ts
+function cleanUrl(input) {
+  return input.replace(/\/+$/, "");
+}
+function assertLifecycleSettings(options) {
+  if (!Number.isFinite(options.autoStopMs) || options.autoStopMs <= 0) {
+    throw new Error("Fetch bridge sandbox driver requires a finite auto-stop/sleep policy");
+  }
+  if (!Number.isFinite(options.autoDeleteMs) || options.autoDeleteMs <= 0) {
+    throw new Error("Fetch bridge sandbox driver requires a finite auto-delete policy");
+  }
+}
+function headers(token) {
+  return {
+    "content-type": "application/json",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+}
+function target(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("Fetch bridge sandbox driver returned an invalid response");
+  const row = input;
+  if (row.status === "provisioning") {
+    return {
+      provisioning: true,
+      retryAfterMs: typeof row.retryAfterMs === "number" ? row.retryAfterMs : 2e3
+    };
+  }
+  if (typeof row.sandboxId !== "string" || typeof row.url !== "string" || typeof row.hostId !== "string") {
+    throw new Error("Fetch bridge sandbox driver returned an incomplete target");
+  }
+  return {
+    workspaceId: typeof row.workspaceId === "string" ? row.workspaceId : void 0,
+    sandboxId: row.sandboxId,
+    url: row.url,
+    hostId: row.hostId,
+    driverResourceId: typeof row.driverResourceId === "string" ? row.driverResourceId : void 0,
+    labels: row.labels && typeof row.labels === "object" && !Array.isArray(row.labels) ? row.labels : void 0
+  };
+}
+function bridgeTarget(input) {
+  const result = target(input);
+  if ("provisioning" in result) throw new Error("Fetch bridge sandbox driver returned provisioning status in a target list");
+  return result;
+}
+function targetList(input) {
+  const rows = Array.isArray(input) ? input : input && typeof input === "object" && !Array.isArray(input) && Array.isArray(input.targets) ? input.targets : void 0;
+  if (!rows) throw new Error("Fetch bridge sandbox driver returned an invalid target list");
+  return rows.map(bridgeTarget);
+}
+async function post(options, path, body) {
+  const res = await (options.fetch ?? fetch)(`${cleanUrl(options.baseUrl)}${path}`, {
+    method: "POST",
+    headers: headers(options.token),
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`Fetch bridge sandbox driver ${path} failed with ${res.status}`);
+  return res.json();
+}
+function createFetchBridgeSandboxDriver(options) {
+  assertLifecycleSettings(options);
+  async function ensureHost(input) {
+    return target(await post(options, "/runtime/ensure", {
+      workspaceId: input.workspaceId,
+      homeRegion: input.homeRegion,
+      epoch: input.epoch,
+      labels: input.labels,
+      hostControl: {
+        autoStopMs: options.autoStopMs,
+        autoDeleteMs: options.autoDeleteMs
+      }
+    }));
+  }
+  return {
+    id: options.id,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none"
+    },
+    ensureHost,
+    async list() {
+      return targetList(await post(options, "/runtime/list", {}));
+    },
+    async touch(input) {
+      await post(options, "/runtime/touch", input);
+    },
+    async stop(input) {
+      await post(options, "/runtime/stop", input);
+    },
+    async suspend(input) {
+      await post(options, "/runtime/stop", input);
+    },
+    async destroy(input) {
+      await post(options, "/runtime/destroy", input);
+    }
+  };
+}
+export {
+  createFetchBridgeSandboxDriver
+};

package/dist/drivers/modal.d.ts

@@ -0,0 +1,68 @@
+import type { SandboxDriver, SandboxDriverEnsureInput } from "..";
+type ModalAppLike = unknown;
+type ModalImageLike = {
+    imageId?: string;
+};
+type ModalTunnelLike = {
+    url: string;
+};
+export type ModalSandboxLike = {
+    sandboxId: string;
+    tunnels: (timeoutMs?: number) => Promise<Record<number, ModalTunnelLike>>;
+    terminate: () => Promise<void>;
+    setTags: (tags: Record<string, string>) => Promise<void>;
+    snapshotFilesystem: (timeoutMs?: number) => Promise<ModalImageLike>;
+};
+export type ModalClientLike = {
+    apps: {
+        fromName: (name: string, params?: {
+            createIfMissing?: boolean;
+        }) => Promise<ModalAppLike>;
+    };
+    images: {
+        fromRegistry: (tag: string) => ModalImageLike;
+        fromId: (imageId: string) => Promise<ModalImageLike>;
+    };
+    sandboxes: {
+        create: (app: ModalAppLike, image: ModalImageLike, params?: {
+            name?: string;
+            command?: string[];
+            workdir?: string;
+            env?: Record<string, string>;
+            encryptedPorts?: number[];
+            timeoutMs?: number;
+            idleTimeoutMs?: number;
+            tags?: Record<string, string>;
+            blockNetwork?: boolean;
+            outboundCidrAllowlist?: string[];
+            readinessProbe?: unknown;
+        }) => Promise<ModalSandboxLike>;
+        fromId: (sandboxId: string) => Promise<ModalSandboxLike>;
+    };
+};
+export type ModalSandboxDriverOptions = {
+    tokenId: string;
+    tokenSecret: string;
+    appName?: string;
+    baseImage?: string;
+    runtimePort?: number;
+    runtimeCommand?: string;
+    workspaceDir?: string;
+    runner?: string;
+    controlEnv?: {
+        relayJwksUrl?: string;
+        relayVerifyPem?: string;
+        managementJwksUrl?: string;
+    };
+    env?: (input: SandboxDriverEnsureInput, host: {
+        id: string;
+    }) => Record<string, string> | Promise<Record<string, string>>;
+    timeoutMs?: number;
+    idleTimeoutMs?: number;
+    tunnelTimeoutMs?: number;
+    operationTimeoutMs?: number;
+    client?: ModalClientLike;
+    readinessProbe?: (port: number) => unknown;
+};
+export declare function createModalSandboxDriver(options: ModalSandboxDriverOptions): SandboxDriver;
+export {};