@claxedo/sandbox-manager 0.6.0 → 0.9.0

package/dist/drivers/modal.mjs

@@ -1,7 +1,17 @@
-// src/drivers/modal.ts
-import { ModalClient, Probe } from "modal";
-
 // src/runtime-env.ts
+function workspaceRuntimeBootEnv(input) {
+  const env = {
+    ...workspaceRuntimeTargetEnv(input),
+    ...workspaceRuntimeSourceEnv(input),
+    ...input.env
+  };
+  if (input.runner) env.WORKSPACE_RUNTIME_RUNNER = input.runner;
+  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
+  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
+  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
+  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
+  return env;
+}
 function workspaceRuntimeTargetEnv(input) {
   return {
     WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
@@ -28,21 +38,10 @@ function shell(input) {
 // src/constants.ts
 var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
 
-// src/image.ts
-import { Image, DaytonaNotFoundError } from "@daytona/sdk";
-
 // src/runtime-version.ts
 var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-var versionCache;
 function workspaceRuntimeVersion() {
-  if (versionCache) return versionCache;
-  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
-  if (envVersion) {
-    versionCache = envVersion;
-    return versionCache;
-  }
-  versionCache = DEFAULT_WORKSPACE_RUNTIME_VERSION;
-  return versionCache;
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
 
 // src/image-name.ts
@@ -66,11 +65,253 @@ function defaultSnapshotName(version = workspaceRuntimeVersion(), buildId, env =
   return `claxedo-workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
 }
 
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
+
+// src/json.ts
+function num(input) {
+  return typeof input === "number" ? input : void 0;
+}
+
 // src/image.ts
 var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
 var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
 var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
 
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// ../sandbox-contract/dist/index.mjs
+var sandboxDriverCredentialFields = {
+  exe: [{ key: "api_token", label: "API Token", secret: true }],
+  daytona: [{ key: "api_key", label: "API Key", secret: true }],
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  box: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  exe: "exe.dev",
+  daytona: "Daytona",
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  box: "Box",
+  docker: "Docker"
+};
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: sandboxDriverLabels.exe,
+    credentialFields: sandboxDriverCredentialFields.exe,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: sandboxDriverLabels.daytona,
+    credentialFields: sandboxDriverCredentialFields.daytona,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates names to domainAllowList, or addresses to networkAllowList.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: sandboxDriverLabels.box,
+    credentialFields: sandboxDriverCredentialFields.box,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
+// src/drivers/transient-error.ts
+function textOf(input) {
+  return typeof input === "string" ? input : "";
+}
+function driverErrorSignals(err) {
+  const shaped = isRecord(err) ? err : {};
+  const nested = isRecord(shaped.response) ? shaped.response : {};
+  return {
+    status: num(nested.status) ?? num(shaped.status),
+    text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
+  };
+}
+function isTransientDriverError(err, markers) {
+  const { status, text: text2 } = driverErrorSignals(err);
+  if (status !== void 0 && status >= 500) return true;
+  return markers.some((marker) => text2.includes(marker));
+}
+
 // src/drivers/modal.ts
 var DEFAULT_APP_NAME = "claxedo";
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
@@ -78,21 +319,28 @@ var DEFAULT_WORKSPACE_DIR = "/workspace";
 var DEFAULT_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_TUNNEL_TIMEOUT_MS = 3e4;
 var DEFAULT_OPERATION_TIMEOUT_MS = 6e4;
+function isModalClient(value) {
+  const row = asRecord(value);
+  return typeof asRecord(row?.apps)?.fromName === "function" && typeof asRecord(row?.images)?.fromRegistry === "function" && typeof asRecord(row?.sandboxes)?.create === "function";
+}
 function nameFor(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
+var TRANSIENT_MARKERS = ["timeout", "unavailable", "deadline"];
 function transientDriverError(err) {
-  const shaped = err;
-  const status = shaped.response?.status ?? shaped.status;
-  if (typeof status === "number" && status >= 500) return true;
-  const text = `${shaped.code ?? ""} ${shaped.name ?? ""} ${shaped.message ?? ""}`.toLowerCase();
-  return text.includes("timeout") || text.includes("unavailable") || text.includes("deadline");
+  return isTransientDriverError(err, TRANSIENT_MARKERS);
 }
 function createModalSandboxDriver(options) {
-  const client = options.client ?? new ModalClient({
-    tokenId: options.tokenId,
-    tokenSecret: options.tokenSecret
-  });
+  let defaultClient;
+  function resolveClient() {
+    if (options.client) return options.client;
+    defaultClient ??= import("modal").then((sdk) => {
+      const client = new sdk.ModalClient({ tokenId: options.tokenId, tokenSecret: options.tokenSecret });
+      if (!isModalClient(client)) throw new Error("modal SDK does not expose the client surface this driver uses");
+      return client;
+    });
+    return defaultClient;
+  }
   const appName = options.appName ?? DEFAULT_APP_NAME;
   const runtimePort = options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
   const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
@@ -100,29 +348,28 @@ function createModalSandboxDriver(options) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const tunnelTimeoutMs = options.tunnelTimeoutMs ?? DEFAULT_TUNNEL_TIMEOUT_MS;
   const operationTimeoutMs = options.operationTimeoutMs ?? DEFAULT_OPERATION_TIMEOUT_MS;
-  const readinessProbe = options.readinessProbe ?? ((port) => Probe.withTcp(port, { intervalMs: 1e3 }));
+  async function readinessProbeFor(port) {
+    if (options.readinessProbe) return options.readinessProbe(port);
+    const { Probe } = await import("modal");
+    return Probe.withTcp(port, { intervalMs: 1e3 });
+  }
   function workspaceDirectory(input) {
     return input.workspaceRoot ?? workspaceDir;
   }
   function bootEnv(input, hostId) {
-    const env = {
-      ...workspaceRuntimeTargetEnv({
-        workspaceId: input.workspaceId,
-        hostId,
-        directory: workspaceDirectory(input),
-        port: runtimePort,
-        host: "0.0.0.0"
-      }),
-      ...workspaceRuntimeSourceEnv({ source: input.source }),
-      ...input.env
-    };
-    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
-    if (options.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = options.controlEnv.relayJwksUrl;
-    if (options.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = options.controlEnv.relayVerifyPem;
-    if (options.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = options.controlEnv.managementJwksUrl;
-    return env;
+    return workspaceRuntimeBootEnv({
+      workspaceId: input.workspaceId,
+      hostId,
+      directory: workspaceDirectory(input),
+      port: runtimePort,
+      host: "0.0.0.0",
+      source: input.source,
+      env: input.env,
+      runner: options.runner,
+      controlEnv: options.controlEnv
+    });
   }
-  async function image(input) {
+  async function image(client, input) {
     if (input.bootSource?.kind === "driver-snapshot") return client.images.fromId(input.bootSource.snapshotId);
     if (input.bootSource?.kind === "image") return client.images.fromId(input.bootSource.image);
     if (input.snapshot) return client.images.fromId(input.snapshot);
@@ -160,9 +407,10 @@ function createModalSandboxDriver(options) {
       ...bootEnv(input, hostId),
       ...await options.env?.(input, { id: hostId })
     };
+    const client = await resolveClient();
     const sandbox = await client.sandboxes.create(
       await client.apps.fromName(appName, { createIfMissing: true }),
-      await image(input),
+      await image(client, input),
       {
         name: nameFor(input.workspaceId),
         command: ["bash", "-lc", `mkdir -p ${shell(directory)}; cd ${shell(directory)}; exec ${runtimeCommand}`],
@@ -172,7 +420,7 @@ function createModalSandboxDriver(options) {
         timeoutMs,
         ...options.idleTimeoutMs !== void 0 ? { idleTimeoutMs: options.idleTimeoutMs } : {},
         tags: { ...input.labels, "claxedo.workspaceId": input.workspaceId },
-        readinessProbe: readinessProbe(runtimePort),
+        readinessProbe: await readinessProbeFor(runtimePort),
         ...network(input)
       }
     ).catch((err) => {
@@ -183,7 +431,7 @@ function createModalSandboxDriver(options) {
     return readyTarget(input, sandbox, hostId);
   }
   async function sandboxById(target) {
-    return client.sandboxes.fromId(target.sandboxId);
+    return (await resolveClient()).sandboxes.fromId(target.sandboxId);
   }
   return {
     id: "modal",
@@ -192,7 +440,9 @@ function createModalSandboxDriver(options) {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
-      secretBrokering: "none"
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: sandboxDriverCatalog.modal.metadata.persistence
     },
     ensureHost,
     resumeHost: (input) => ensureHost(input.ensure),

package/dist/drivers/transient-error.d.ts

@@ -0,0 +1,11 @@
+/** The status and lower-cased text a driver error carries, if it carries any. */
+export declare function driverErrorSignals(err: unknown): {
+    status: number | undefined;
+    text: string;
+};
+/**
+ * A 5xx is transient for every driver; anything else is a per-driver judgment
+ * made from the error text, so each driver passes the markers it has actually
+ * seen its own SDK produce.
+ */
+export declare function isTransientDriverError(err: unknown, markers: readonly string[]): boolean;

package/dist/drivers/vercel.d.ts

@@ -1,5 +1,6 @@
-import { type NetworkPolicy } from "@vercel/sandbox";
-import type { SandboxBrokeredSecret, SandboxDriver, SandboxDriverEnsureInput } from "..";
+import type { NetworkPolicy } from "@vercel/sandbox";
+import { type SandboxBrokeredSecret, type SandboxDriver, type SandboxDriverEnsureInput } from "..";
+import { type WorkspaceRuntimeControlEnv } from "../runtime-env";
 type VercelSnapshotLike = {
     snapshotId: string;
 };
@@ -80,11 +81,7 @@ export type VercelSandboxDriverOptions = {
     runtimeCommand?: string;
     workspaceDir?: string;
     runner?: string;
-    controlEnv?: {
-        relayJwksUrl?: string;
-        relayVerifyPem?: string;
-        managementJwksUrl?: string;
-    };
+    controlEnv?: WorkspaceRuntimeControlEnv;
     env?: (input: SandboxDriverEnsureInput, host: {
         id: string;
     }) => Record<string, string> | Promise<Record<string, string>>;
@@ -101,10 +98,29 @@ export type VercelSandboxDriverOptions = {
  * a header on outbound requests to the allowlisted hosts, so the raw value
  * never enters the sandbox (see @claxedo/sandbox-manager SandboxBrokeredSecret
  * and https://vercel.com/docs/sandbox/concepts/firewall — credentials
- * brokering). The resulting policy is deny-all-except-brokered-hosts, which is
- * the secure default: a sandbox holding a brokered credential should only be
- * able to reach the host that credential is for.
+ * brokering).
+ *
+ * The result is the union of `base` — the create-time allow-list — and the
+ * brokered hosts, never a replacement. Replacing it is wrong in both
+ * directions: it breaks egress the caller was granted, since
+ * `updateNetworkPolicy` overwrites the whole policy, so a sandbox created with
+ * git and the npm registry allowed loses both the instant a brokered secret is
+ * attached, and the agent's next `npm install` fails mid-run. It can also
+ * silently widen egress, since a brokered host that was not in the create-time
+ * list becomes reachable, installing a policy nobody approved as a side effect
+ * of attaching a credential. A union changes exactly one thing — it adds the
+ * brokered hosts, the smallest edit that makes the credential usable.
+ *
+ * `base` is the create-time `NetworkPolicy` exactly as passed to `create`, and
+ * it is required even though `undefined` is a legal value: `undefined` means
+ * "no policy was requested", so the merge keeps egress unrestricted, expressed
+ * as the `"*"` wildcard the record form needs for the header transforms to ride
+ * alongside it. An optional parameter defaulting to
+ * deny-all-except-brokered-hosts would let an existing caller keep compiling
+ * while its egress silently widens. Spelling the base out forces that decision
+ * to be made once, visibly. A `"deny-all"` base contributes nothing, leaving
+ * deny-all-except-brokered-hosts.
  */
-export declare function vercelBrokeredNetworkPolicy(secrets: SandboxBrokeredSecret[]): NetworkPolicy;
+export declare function vercelBrokeredNetworkPolicy(secrets: SandboxBrokeredSecret[], base: NetworkPolicy | undefined): NetworkPolicy;
 export declare function createVercelSandboxDriver(options: VercelSandboxDriverOptions): SandboxDriver;
 export {};