@claxedo/sandbox-manager 0.7.0 → 0.10.0

package/dist/drivers/local-brokering.mjs

@@ -0,0 +1,1029 @@
+// src/drivers/local-brokering.ts
+import { execFileSync, spawn } from "node:child_process";
+import { closeSync, mkdtempSync, openSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import fs from "node:fs/promises";
+import { createServer } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import net from "node:net";
+import path from "node:path";
+
+// ../agent-runtime-contract/dist/index.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
+var CLAXEDO_TOOL_NAMES = [
+  "task_list",
+  "task_get",
+  "task_create",
+  "task_edit",
+  "task_start",
+  "session_create",
+  "sessions_list",
+  "session_get",
+  "session_transcript",
+  "session_send",
+  "session_cancel_turn",
+  "session_handoff",
+  "session_rename",
+  "session_delete",
+  "session_changes",
+  "documents_list",
+  "documents_open",
+  "subagent_capabilities",
+  "create_subagent",
+  "subagent_status",
+  "subagent_list",
+  "subagent_cancel",
+  "sessions_board",
+  "permission_reply",
+  "question_reply",
+  "question_reject",
+  "wait_for_attention",
+  "workspaces_list",
+  "workspace_status",
+  "workspace_checkpoint",
+  "workspace_restore",
+  "workspace_lifecycle",
+  "app_plugin_create",
+  "app_plugin_check",
+  "app_plugin_add",
+  "app_plugin_guide",
+  "ui_show",
+  "ui_guide"
+];
+var CLAXEDO_TOOL_NAME_SET = new Set(CLAXEDO_TOOL_NAMES);
+var CREDENTIAL_BROKER_ERRORS = {
+  binding_route_required: {
+    fault: "harness",
+    message: "The credential broker serves binding paths only"
+  },
+  runtime_token_required: {
+    fault: "harness",
+    message: "The request carried no runtime token, or two that disagree"
+  },
+  runtime_token_invalid: {
+    fault: "credential",
+    message: "The runtime token could not be verified"
+  },
+  binding_not_permitted: {
+    fault: "harness",
+    message: "This runtime token does not name that binding"
+  },
+  binding_unavailable: {
+    fault: "credential",
+    message: "The binding names no account this runtime can spend"
+  },
+  credential_unavailable: {
+    fault: "credential",
+    message: "The account behind this binding has no readable value"
+  },
+  binding_destination_invalid: {
+    fault: "harness",
+    message: "The binding's destination is not a usable vendor origin"
+  },
+  binding_injection_invalid: {
+    fault: "harness",
+    message: "The binding names a header the broker cannot set"
+  },
+  request_outside_policy: {
+    fault: "harness",
+    message: "The request is outside the routes this binding allows"
+  },
+  upstream_unavailable: {
+    fault: "model",
+    message: "The vendor could not be reached"
+  },
+  upstream_redirect_refused: {
+    fault: "model",
+    message: "The vendor answered with a redirect, which the broker does not follow"
+  },
+  broker_authority_unavailable: {
+    fault: "harness",
+    message: "The credential authority could not be reached"
+  },
+  loopback_required: {
+    fault: "harness",
+    message: "The credential broker answers loopback callers only"
+  },
+  runtime_token_rate_limited: {
+    fault: "harness",
+    message: "Too many requests without a verifiable runtime token from this client"
+  }
+};
+var codeInProse = new RegExp(`\\b(${Object.keys(CREDENTIAL_BROKER_ERRORS).join("|")})\\b`);
+var AGENT_PRESENTATION_EVENT_TYPE_REGISTRY = {
+  "message.updated": true,
+  "message.removed": true,
+  "message.part.updated": true,
+  "message.part.removed": true,
+  "message.part.delta": true,
+  "message.part.retracted": true,
+  "message.completed": true,
+  "permission.asked": true,
+  "permission.replied": true,
+  "permission.expired": true,
+  "question.asked": true,
+  "question.replied": true,
+  "question.rejected": true,
+  "question.expired": true,
+  "todo.updated": true,
+  "session.status": true,
+  "session.idle": true,
+  "session.error": true,
+  "session.updated": true,
+  "session.diff": true,
+  "session.compacted": true,
+  "session.agent": true,
+  "session.config": true,
+  "session.commands": true,
+  "session.usage": true,
+  "subagent.updated": true,
+  "goal.updated": true,
+  "goal.cleared": true,
+  "runtime.diagnostic": true,
+  "server.connected": true,
+  "server.heartbeat": true,
+  "session.deleted": true,
+  "harness.health": true,
+  "session.background-work": true
+};
+function isAgentPresentationEventType(value) {
+  return Object.hasOwn(AGENT_PRESENTATION_EVENT_TYPE_REGISTRY, value);
+}
+var AGENT_PRESENTATION_EVENT_TYPES = Object.keys(AGENT_PRESENTATION_EVENT_TYPE_REGISTRY).filter(isAgentPresentationEventType);
+var mode = (id, name, description, level) => ({
+  id,
+  name,
+  description,
+  ...level ? { level } : {}
+});
+var CLAUDE_PERMISSION_MODES = {
+  modes: [
+    mode("default", "Default", "Standard behavior, prompts for dangerous operations", "ask"),
+    mode("acceptEdits", "Accept edits", "Auto-accept file edit operations"),
+    mode("auto", "Auto", "Use a model classifier to approve/deny permission prompts", "auto"),
+    mode("plan", "Plan", "Planning mode, no actual tool execution"),
+    mode("dontAsk", "Don't ask", "Don't prompt for permissions, deny if not pre-approved"),
+    mode("bypassPermissions", "Bypass permissions", "Bypass all permission checks", "full")
+  ],
+  appliesFrom: "immediate",
+  defaultModeId: "auto"
+};
+var CURSOR_PERMISSION_MODES = {
+  modes: [
+    mode("review", "Review each call", "Run tool calls inside Cursor's sandbox and review them", "ask"),
+    mode("auto-review", "Auto-review", "Let Cursor's classifier approve tool calls inside the sandbox", "auto"),
+    mode("unsandboxed", "Unsandboxed", "Run tool calls directly, with no sandbox", "full")
+  ],
+  appliesFrom: "next-turn"
+};
+var CODEX_PERMISSION_MODES = {
+  modes: [
+    mode("read-only", "Read only", "Never asks; the sandbox permits reads only, so writes fail", "ask"),
+    mode("workspace-write", "Workspace write", "Runs commands inside the workspace without asking; escalates outside it", "auto"),
+    mode("untrusted", "Untrusted", "Only trusted commands run without asking; anything else escalates"),
+    mode("full-access", "Full access", "Never asks; full filesystem and network access", "full")
+  ],
+  appliesFrom: "next-turn",
+  defaultModeId: "workspace-write"
+};
+var PI_PERMISSION_MODES = {
+  modes: [
+    mode("ask", "Ask", "Ask before each write, edit, command and MCP tool call", "ask"),
+    mode("full", "Full access", "Run every tool call without asking", "full")
+  ],
+  appliesFrom: "next-turn",
+  defaultModeId: "full"
+};
+var AGENT_HARNESS_DEFINITIONS = [
+  {
+    key: "claude",
+    id: "claude",
+    access: "native",
+    label: "Claude",
+    authEnv: "ANTHROPIC_API_KEY",
+    authSlot: "anthropic",
+    cloudHost: "workspace-runtime"
+  },
+  {
+    key: "codex",
+    id: "codex",
+    access: "native",
+    label: "Codex",
+    authEnv: "OPENAI_API_KEY",
+    authSlot: "openai",
+    cloudHost: "workspace-runtime"
+  },
+  {
+    key: "cursor",
+    id: "cursor",
+    access: "native",
+    label: "Cursor",
+    authEnv: "CURSOR_API_KEY",
+    authSlot: "cursor",
+    cloudHost: "workspace-runtime"
+  },
+  {
+    key: "pi",
+    id: "pi",
+    access: "native",
+    label: "Pi",
+    authEnv: null,
+    authSlot: null,
+    cloudHost: "session-host"
+  },
+  {
+    key: "opencode",
+    id: "opencode",
+    access: "native",
+    label: "OpenCode",
+    authEnv: null,
+    authSlot: null,
+    cloudHost: "workspace-runtime"
+  }
+];
+var AGENT_HARNESS_KEYS = AGENT_HARNESS_DEFINITIONS.map((item) => item.key);
+var HARNESS_IDS = ["claude", "codex", "cursor"];
+var HARNESS_TABLE = {
+  claude: {
+    label: "Claude Code",
+    vendor: "Anthropic",
+    providerIds: ["claude-sdk", "claude-acp", "anthropic"],
+    connectProvider: "claude-sdk",
+    vendorProvider: "anthropic",
+    machineLoginServes: ["claude-sdk", "claude-acp"],
+    permissionModes: CLAUDE_PERMISSION_MODES,
+    defaultModelId: "default"
+  },
+  codex: {
+    label: "Codex",
+    vendor: "OpenAI",
+    providerIds: ["codex-app-server", "openai"],
+    connectProvider: "codex-app-server",
+    vendorProvider: "openai",
+    machineLoginServes: ["codex-app-server", "openai"],
+    permissionModes: CODEX_PERMISSION_MODES
+  },
+  cursor: {
+    label: "Cursor",
+    vendor: "Cursor",
+    providerIds: ["cursor-sdk", "cursor-acp", "cursor"],
+    connectProvider: "cursor-sdk",
+    vendorProvider: "cursor",
+    machineLoginServes: ["cursor-acp"],
+    permissionModes: CURSOR_PERMISSION_MODES,
+    defaultModelId: "auto"
+  }
+};
+function harnessBindingIds(harness) {
+  const record2 = HARNESS_TABLE[harness];
+  return record2.providerIds.filter((id) => id !== record2.vendorProvider);
+}
+function vendorCredentialProviderIds(vendorProvider) {
+  const bindings = HARNESS_IDS.filter((harness) => HARNESS_TABLE[harness].vendorProvider === vendorProvider).flatMap((harness) => harnessBindingIds(harness));
+  return [.../* @__PURE__ */ new Set([vendorProvider, ...bindings])];
+}
+var credentialProviders = {
+  "openai-codex": ["codex-app-server"],
+  anthropic: vendorCredentialProviderIds("anthropic"),
+  openai: ["openai"],
+  openrouter: ["openrouter"],
+  google: ["google"],
+  groq: ["groq"],
+  xai: ["xai"]
+};
+var DEFAULT_RECOVERY_BUDGETS = {
+  ackMs: 2e3,
+  providerQueryMs: 5e3,
+  gracefulCancelMs: 1e4,
+  termGraceMs: 3e3,
+  killVerifyMs: 2e3,
+  reconcileMs: 3e4,
+  drainMs: 3e4
+};
+var RECOVERY_OPERATION_RETENTION_MS = DEFAULT_RECOVERY_BUDGETS.reconcileMs * 10;
+var MCP_APP_MAX_BYTES = 2 * 1024 * 1024;
+function fieldsNamed(value, keys) {
+  return Object.fromEntries(keys.flatMap((key) => Object.hasOwn(value, key) ? [[key, value[key]]] : []));
+}
+var metadataNamed = (...keys) => (metadata) => fieldsNamed(metadata, keys);
+var DIFF_COUNTS = ["file", "filePath", "relativePath", "type", "movePath", "additions", "deletions"];
+function diffCounts(value) {
+  const record2 = asRecord(value);
+  return record2 && fieldsNamed(record2, DIFF_COUNTS);
+}
+var HEADERS = {
+  read: { input: ["filePath", "offset", "limit"], metadata: metadataNamed("loaded") },
+  list: { input: ["path"] },
+  glob: { input: ["path", "pattern"] },
+  grep: { input: ["path", "pattern", "include"] },
+  webfetch: { input: ["url"] },
+  websearch: { input: ["query"], metadata: metadataNamed("provider") },
+  bash: { input: ["command", "description"], metadata: metadataNamed("command", "exitCode") },
+  edit: {
+    input: ["filePath", "path"],
+    metadata: (metadata) => {
+      const filediff = diffCounts(metadata.filediff);
+      return filediff ? { filediff } : {};
+    }
+  },
+  write: { input: ["filePath", "path"] },
+  apply_patch: {
+    input: [],
+    metadata: (metadata) => Array.isArray(metadata.files) ? { files: metadata.files.flatMap((file) => diffCounts(file) ?? []) } : {}
+  },
+  todowrite: { input: [] },
+  skill: { input: ["name", "skill"] },
+  enterplanmode: { input: [] }
+};
+var TURN_PAGE_BYTE_CAP = 256 * 1024;
+var encoder = new TextEncoder();
+var AGENT_RUNTIME_EVENT_TYPE_REGISTRY = {
+  "text-delta": true,
+  "thinking-delta": true,
+  "tool-start": true,
+  "tool-input": true,
+  "tool-status": true,
+  "tool-content": true,
+  "tool-output": true,
+  "tool-error": true,
+  "file-diff": true,
+  "step-start": true,
+  "input-incorporated": true,
+  "permission-request": true,
+  question: true,
+  "question-answered": true,
+  "proposed-plan-delta": true,
+  "proposed-plan-complete": true,
+  "todo-update": true,
+  "session-status": true,
+  "session-compaction": true,
+  "harness-notice": true,
+  "agent-message": true,
+  "session-retry": true,
+  "response-start": true,
+  "response-retracted": true,
+  "conversation-reset": true,
+  "auth-status": true,
+  "rate-limit": true,
+  "mcp-server-status": true,
+  "goal-updated": true,
+  "goal-cleared": true,
+  "subagent-updated": true,
+  finish: true,
+  cancelled: true,
+  error: true,
+  "image-delta": true,
+  "audio-delta": true,
+  "resource-link-delta": true,
+  "thinking-audio-delta": true,
+  "thinking-resource-link-delta": true,
+  "resource-delta": true,
+  "tool-location": true,
+  "tool-terminal": true,
+  "available-commands-update": true,
+  "session-agent": true,
+  "config-update": true,
+  "session-info": true,
+  "session-title": true,
+  "background-work": true,
+  usage: true,
+  diagnostic: true
+};
+function isAgentRuntimeEventType(value) {
+  return Object.hasOwn(AGENT_RUNTIME_EVENT_TYPE_REGISTRY, value);
+}
+var AGENT_RUNTIME_EVENT_TYPES = Object.keys(AGENT_RUNTIME_EVENT_TYPE_REGISTRY).filter(isAgentRuntimeEventType);
+var D1_BOOKMARK_COOKIE_PREFIX = "__Host-claxedo.d1-";
+var CONTROL_COOKIE = `${D1_BOOKMARK_COOKIE_PREFIX}control=`;
+var EVENT_STREAM_HEARTBEAT_MS = 1e4;
+var EVENT_STREAM_STALL_TIMEOUT_MS = 4 * EVENT_STREAM_HEARTBEAT_MS;
+
+// ../egress-broker/dist/token.js
+var MAX_TOKEN_LIFETIME_MS = 60 * 60 * 1e3;
+
+// ../egress-broker/dist/native-substitution.js
+function registeredValue(secret) {
+  return secret.scheme ? `${secret.scheme} ${secret.value}` : secret.value;
+}
+function substituteNativeSecrets(target, method, incoming, secrets) {
+  const headers = new Headers(incoming);
+  const presented = [...headers].filter(([, value]) => value.includes("claxedo-broker:"));
+  for (const [, value] of presented) {
+    if (!secrets.some((secret) => value.includes(`claxedo-broker:${secret.name}`))) {
+      throw new Error("brokered_secret_withdrawn");
+    }
+  }
+  for (const secret of secrets) {
+    const slot = secret.header;
+    if (!slot)
+      continue;
+    const placeholder = `claxedo-broker:${secret.name}`;
+    const sent = headers.get(slot);
+    if (sent !== placeholder && sent !== `${secret.scheme ?? "Bearer"} ${placeholder}`)
+      continue;
+    if (!secret.hosts.includes(target.host) || secret.methods && !secret.methods.includes(method) || secret.pathPrefixes && !secret.pathPrefixes.some((prefix) => target.pathname === prefix || target.pathname.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))) {
+      throw new Error("brokered_secret_destination_refused");
+    }
+    headers.set(slot, registeredValue(secret));
+  }
+  if ([...headers].some(([, value]) => value.includes("claxedo-broker:"))) {
+    throw new Error("brokered_secret_slot_refused");
+  }
+  return headers;
+}
+
+// ../egress-broker/dist/mount.js
+var PREFIX = "/bindings/";
+var BROKER_ROUTE_PATTERN = `${PREFIX}*`;
+
+// src/driver-billing.ts
+var HOUR_SECONDS = 3600;
+var boatBilling = {
+  source: { url: "https://docs.boat.dev/pricing", readOn: "2026-10-12" },
+  meter: "Boat bills machine time per second while a sandbox runs, at an hourly rate per size; a stopped sandbox costs nothing.",
+  rates: {
+    small: { size: "small", vcpu: 2, memoryGb: 4, usdPerHour: 0.018 },
+    default: { size: "default", vcpu: 4, memoryGb: 8, usdPerHour: 0.036 },
+    large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
+  }
+};
+var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
+var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
+var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
+var CLOUDFLARE_STANDARD_1 = { size: "standard-1", vcpu: 0.5, memoryGb: 4, diskGb: 8 };
+var cloudflareBilling = {
+  source: { url: "https://developers.cloudflare.com/containers/pricing/", readOn: "2026-10-12" },
+  meter: "Cloudflare bills a container for every 10 ms it runs: memory at $0.0000025 per GiB-second and disk at $0.00000007 per GB-second for the whole run, plus CPU at $0.00002 per vCPU-second of active use.",
+  rates: {
+    default: {
+      size: CLOUDFLARE_STANDARD_1.size,
+      vcpu: CLOUDFLARE_STANDARD_1.vcpu,
+      memoryGb: CLOUDFLARE_STANDARD_1.memoryGb,
+      usdPerHour: (CLOUDFLARE_STANDARD_1.memoryGb * CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY + CLOUDFLARE_STANDARD_1.diskGb * CLOUDFLARE_USD_PER_GB_SECOND_DISK) * HOUR_SECONDS
+    }
+  },
+  excludes: `active CPU, billed at $${CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE} per vCPU-second and not measured by Claxedo, and the monthly allowance a Workers Paid plan includes`
+};
+
+// ../sandbox-contract/dist/index.mjs
+var sandboxDriverCredentialFields = {
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  boat: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  boat: "Boat",
+  docker: "Docker"
+};
+
+// src/driver-catalog.ts
+var localBrokeringTestDriverCatalogEntry = {
+  id: "local-brokering-test",
+  label: "Local brokering test driver",
+  credentialFields: [],
+  runtimeNetwork: { controlPlane: "direct", relay: "local" },
+  runtimeEnv: "ensure",
+  preparedImage: false,
+  metadata: {
+    driverRunsIn: ["local"],
+    hostStopBehavior: "terminates-host",
+    hostResumeBehavior: "same-host",
+    targetAccess: "loopback",
+    secretBrokering: "native",
+    egressControl: "hosts",
+    persistence: {
+      resume: "same-sandbox",
+      capture: "none",
+      clone: false,
+      captureSource: "not-applicable",
+      retention: "provider-managed",
+      restoreMount: "same-resource"
+    }
+  }
+};
+var sandboxDriverCatalog = {
+  modal: {
+    id: "modal",
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: false,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: false,
+    billing: cloudflareBilling,
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      hostWatchesIdle: true,
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
+      egressControl: "none",
+      // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  boat: {
+    id: "boat",
+    label: sandboxDriverLabels.boat,
+    credentialFields: sandboxDriverCredentialFields.boat,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: boatBilling,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
+  docker: {
+    id: "docker",
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
+    runtimeNetwork: { controlPlane: "docker-host", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
+// src/runtime-env.ts
+var WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS = [
+  "WORKSPACE_RUNTIME_WORKSPACE_ID",
+  "WORKSPACE_RUNTIME_HOST_ID",
+  "WORKSPACE_RUNTIME_RELAY_WORKSPACE_IDS"
+];
+function workspaceRuntimeIdentityEnvConflicts(env) {
+  if (!env) return [];
+  return WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS.filter((key) => env[key] !== void 0);
+}
+function assertWorkspaceRuntimeIdentityEnv(env) {
+  const conflicts = workspaceRuntimeIdentityEnvConflicts(env);
+  if (conflicts.length === 0) return;
+  throw new Error(
+    `sandbox env cannot set runtime identity ${conflicts.join(", ")}: the driver's placement owns the identity its target reports and the lease records`
+  );
+}
+var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
+  ...WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS,
+  "WORKSPACE_RUNTIME_DIRECTORY",
+  "WORKSPACE_RUNTIME_PORT",
+  "WORKSPACE_RUNTIME_HOST",
+  "WORKSPACE_RUNTIME_SOURCE_KIND",
+  "WORKSPACE_RUNTIME_GIT_REPO_URL",
+  "WORKSPACE_RUNTIME_GIT_BRANCH",
+  "WORKSPACE_RUNTIME_NATIVE_HARNESS",
+  "WORKSPACE_RUNTIME_RELAY_JWKS_URL",
+  "WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL",
+  "WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL"
+]);
+function workspaceRuntimeBootEnv(input) {
+  assertWorkspaceRuntimeIdentityEnv(input.env);
+  const env = {
+    ...workspaceRuntimeTargetEnv(input),
+    ...workspaceRuntimeSourceEnv(input),
+    ...input.env
+  };
+  if (input.nativeHarness) env.WORKSPACE_RUNTIME_NATIVE_HARNESS = input.nativeHarness;
+  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
+  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
+  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
+  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
+  return env;
+}
+function workspaceRuntimeTargetEnv(input) {
+  return {
+    WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
+    ...input.hostId ? { WORKSPACE_RUNTIME_HOST_ID: input.hostId } : {},
+    WORKSPACE_RUNTIME_DIRECTORY: input.directory,
+    WORKSPACE_RUNTIME_PORT: String(input.port),
+    ...input.host ? { WORKSPACE_RUNTIME_HOST: input.host } : {}
+  };
+}
+function workspaceRuntimeSourceEnv(input) {
+  if (!input.source || input.source.kind === "empty") return { WORKSPACE_RUNTIME_SOURCE_KIND: "empty" };
+  return {
+    WORKSPACE_RUNTIME_SOURCE_KIND: "git",
+    WORKSPACE_RUNTIME_GIT_REPO_URL: input.source.repoUrl,
+    ...input.source.branch ? { WORKSPACE_RUNTIME_GIT_BRANCH: input.source.branch } : {}
+  };
+}
+
+// ../claxedo-helpers/dist/deadline.mjs
+async function withDeadlineSignal(timeoutMs, work, parent) {
+  const deadline = new AbortController();
+  const timer = setTimeout(() => deadline.abort(new DOMException("The operation timed out.", "TimeoutError")), timeoutMs);
+  try {
+    return await work(parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/drivers/local-brokering.ts
+function createTestAuthority(root) {
+  const privateDirectory = realpathSync(mkdtempSync(path.join(root, "local-broker-ca-")));
+  const certificate = path.join(root, `${path.basename(privateDirectory)}.pem`);
+  const key = path.join(privateDirectory, "ca.key");
+  execFileSync("openssl", ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-keyout", key, "-out", certificate, "-days", "1", "-subj", "/CN=Claxedo local broker test CA", "-addext", "basicConstraints=critical,CA:TRUE"], { stdio: "ignore" });
+  return { certificate, privateDirectory, key, leaves: /* @__PURE__ */ new Map() };
+}
+function certificateForHost(authority, hostname) {
+  const existing = authority.leaves.get(hostname);
+  if (existing) return existing;
+  const directory = mkdtempSync(path.join(authority.privateDirectory, "leaf-"));
+  const keyFile = path.join(directory, "leaf.key");
+  const requestFile = path.join(directory, "leaf.csr");
+  const certificateFile = path.join(directory, "leaf.pem");
+  const extensionFile = path.join(directory, "leaf.ext");
+  writeFileSync(extensionFile, `subjectAltName=DNS:${hostname}
+`);
+  execFileSync("openssl", ["req", "-new", "-newkey", "rsa:2048", "-nodes", "-keyout", keyFile, "-out", requestFile, "-subj", `/CN=${hostname}`], { stdio: "ignore" });
+  execFileSync("openssl", ["x509", "-req", "-in", requestFile, "-CA", authority.certificate, "-CAkey", authority.key, "-CAcreateserial", "-out", certificateFile, "-days", "1", "-extfile", extensionFile], { stdio: "ignore" });
+  const leaf = { key: readFileSync(keyFile), cert: readFileSync(certificateFile) };
+  authority.leaves.set(hostname, leaf);
+  return leaf;
+}
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      const address = server.address();
+      if (!address || typeof address === "string") return reject(new Error("local broker has no TCP port"));
+      resolve(address.port);
+    });
+  });
+}
+async function reserveLocalRuntimePort() {
+  const server = net.createServer();
+  const port = await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") reject(new Error("local runtime has no TCP port"));
+      else resolve(address.port);
+    });
+  });
+  await new Promise((resolve) => server.close(() => resolve()));
+  return port;
+}
+async function waitForLocalRuntimeHealth(url, child, logFile) {
+  const lastLines = async () => (await fs.readFile(logFile, "utf8")).trimEnd().split("\n").slice(-40).join("\n");
+  const until = Date.now() + 2e4;
+  while (Date.now() < until) {
+    if (child.exitCode !== null || child.signalCode !== null) {
+      const lines2 = await lastLines();
+      throw new Error(`local sandbox runtime exited: ${child.exitCode ?? child.signalCode}${lines2 ? `
+${lines2}` : ""}`);
+    }
+    try {
+      if ((await withDeadlineSignal(1e3, (signal) => fetch(`${url}/global/health`, { signal }))).ok) return;
+    } catch {
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  const lines = await lastLines();
+  throw new Error(`local sandbox runtime did not become healthy${lines ? `
+${lines}` : ""}`);
+}
+async function closeHost(host) {
+  const child = host.child;
+  if (child && child.exitCode === null) {
+    child.kill("SIGTERM");
+    await new Promise((resolve) => child.once("exit", () => resolve()));
+  }
+  for (const tunnel of host.tunnels) tunnel.destroy();
+  host.proxy.closeAllConnections();
+  await new Promise((resolve) => host.proxy.close(() => resolve()));
+  await fs.rm(host.directory, { recursive: true, force: true });
+}
+function createLocalBrokeringSandboxDriver(options) {
+  if (process.platform !== "darwin") throw new Error("local brokering test driver requires macOS sandbox-exec network policy");
+  const authority = createTestAuthority(options.root);
+  const hosts = /* @__PURE__ */ new Map();
+  const allowedOrigins = new Set(options.allowedOrigins.map((origin) => new URL(origin).origin));
+  const upstreams = new Map(Object.entries(options.upstreams ?? {}).map(([origin, upstream]) => {
+    const parsed = new URL(origin);
+    const destination = new URL(upstream);
+    if (parsed.protocol !== "https:" || parsed.origin !== origin || parsed.port || destination.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(destination.hostname)) {
+      throw new Error("local broker upstreams require exact HTTPS origins and loopback HTTP destinations");
+    }
+    return [parsed.origin, destination.origin];
+  }));
+  const directOrigins = options.directOrigins.map((origin) => new URL(origin));
+  const directDestinations = directOrigins.map((url) => {
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.hostname.endsWith(".localhost");
+    if (!(loopback && ["http:", "https:"].includes(url.protocol))) {
+      throw new Error("local brokering direct origins must use loopback HTTP");
+    }
+    return `localhost:${url.port || (url.protocol === "https:" ? "443" : "80")}`;
+  });
+  async function ensureHost(input) {
+    const existing = hosts.get(input.workspaceId);
+    if (existing) {
+      const held = new Set(existing.secrets.map((secret) => secret.name));
+      if ((input.secrets ?? []).some((secret) => !held.has(secret.name))) {
+        await stop(existing.target);
+        return ensureHost(input);
+      }
+      existing.secrets = [...input.secrets ?? []];
+      return existing.target;
+    }
+    const directory = await fs.mkdtemp(path.join(options.root, "local-brokered-"));
+    const workspace = path.resolve(input.workspaceRoot ?? path.join(directory, "workspace"));
+    const relative = path.relative(options.root, workspace);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+      await fs.rm(directory, { recursive: true, force: true });
+      throw new Error("local sandbox workspace must stay under its private test root");
+    }
+    const home = path.join(directory, "home");
+    await Promise.all([fs.mkdir(workspace, { recursive: true }), fs.mkdir(home)]);
+    const trustedCertificates = path.join(directory, "trusted-cas.pem");
+    await fs.writeFile(trustedCertificates, Buffer.concat([
+      readFileSync(authority.certificate),
+      ...options.inheritedEnv?.NODE_EXTRA_CA_CERTS ? [readFileSync(options.inheritedEnv.NODE_EXTRA_CA_CERTS)] : []
+    ]), { mode: 384 });
+    const runtimePort = await reserveLocalRuntimePort();
+    const hostId = input.hostId ?? `local-${input.workspaceId}`;
+    const target = {
+      workspaceId: input.workspaceId,
+      sandboxId: `${input.workspaceId}-${input.epoch}`,
+      url: `http://127.0.0.1:${runtimePort}`,
+      hostId,
+      driverResourceId: `${input.workspaceId}-${input.epoch}`,
+      labels: input.labels,
+      driver: { id: "local-brokering-test", resourceId: `${input.workspaceId}-${input.epoch}` }
+    };
+    async function forward(request, response, targetUrl, destination) {
+      try {
+        const method = request.method ?? "GET";
+        const incoming = new Headers();
+        for (const [name, values] of Object.entries(request.headers)) {
+          if (Array.isArray(values)) for (const value of values) incoming.append(name, value);
+          else if (values !== void 0) incoming.append(name, values);
+        }
+        const headers = substituteNativeSecrets(targetUrl, method, incoming, host.secrets);
+        for (const name of ["host", "connection", "proxy-connection", "content-length", "transfer-encoding"]) headers.delete(name);
+        const chunks = [];
+        if (method !== "GET" && method !== "HEAD") for await (const chunk of request) chunks.push(Buffer.from(chunk));
+        const upstream = await fetch(destination, {
+          method,
+          headers,
+          body: chunks.length ? new Uint8Array(Buffer.concat(chunks)) : void 0,
+          redirect: "manual"
+        });
+        response.writeHead(upstream.status, Object.fromEntries(upstream.headers));
+        response.end(Buffer.from(await upstream.arrayBuffer()));
+      } catch {
+        response.writeHead(403).end("local sandbox egress refused");
+      }
+    }
+    const proxy = createServer((request, response) => {
+      try {
+        const targetUrl = new URL(request.url ?? "");
+        if (!allowedOrigins.has(targetUrl.origin)) throw new Error("destination_refused");
+        void forward(request, response, targetUrl, targetUrl);
+      } catch {
+        response.writeHead(403).end("local sandbox egress refused");
+      }
+    });
+    proxy.on("connect", (request, socket, head) => {
+      const match = /^([a-z0-9.-]+):443$/i.exec(request.url ?? "");
+      const hostname = match?.[1]?.toLowerCase();
+      const origin = hostname ? `https://${hostname}` : void 0;
+      const destination = origin && upstreams.get(origin);
+      if (!hostname || !destination || !host.secrets.some((secret) => secret.hosts.includes(hostname))) {
+        socket.end("HTTP/1.1 403 Forbidden\r\ncontent-length: 0\r\n\r\n");
+        return;
+      }
+      const leaf = certificateForHost(authority, hostname);
+      const secure = createHttpsServer(leaf, (innerRequest, innerResponse) => {
+        const hostHeader = innerRequest.headers.host?.toLowerCase();
+        if (hostHeader !== hostname && hostHeader !== `${hostname}:443`) {
+          innerResponse.writeHead(403).end("local sandbox egress refused");
+          return;
+        }
+        const url = new URL(innerRequest.url ?? "", origin);
+        if (url.origin !== origin) {
+          innerResponse.writeHead(403).end("local sandbox egress refused");
+          return;
+        }
+        void forward(innerRequest, innerResponse, url, new URL(`${url.pathname}${url.search}`, destination));
+      });
+      secure.listen(0, "127.0.0.1", () => {
+        const address = secure.address();
+        if (!address || typeof address === "string") {
+          socket.destroy(new Error("local TLS listener has no port"));
+          return;
+        }
+        const bridge = net.connect(address.port, "127.0.0.1", () => {
+          socket.write("HTTP/1.1 200 Connection Established\r\n\r\n", () => {
+            if (head.length) bridge.write(head);
+            socket.pipe(bridge).pipe(socket);
+            socket.resume();
+          });
+        });
+        bridge.on("error", () => socket.destroy());
+        socket.on("error", () => bridge.destroy());
+        socket.on("close", () => {
+          bridge.destroy();
+          secure.close();
+          host.tunnels.delete(socket);
+        });
+        host.tunnels.add(socket);
+      });
+    });
+    proxy.on("upgrade", (_request, socket) => socket.end("HTTP/1.1 403 Forbidden\r\ncontent-length: 0\r\n\r\n"));
+    const host = { directory, target, secrets: [...input.secrets ?? []], proxy, child: void 0, tunnels: /* @__PURE__ */ new Set() };
+    try {
+      const proxyPort = await listen(proxy);
+      const proxyUrl = `http://127.0.0.1:${proxyPort}`;
+      const unproxied = [...directOrigins.map((url) => url.host), `127.0.0.1:${runtimePort}`, `localhost:${runtimePort}`].join(",");
+      const env = {
+        ...options.inheritedEnv,
+        ...workspaceRuntimeBootEnv({
+          workspaceId: input.workspaceId,
+          hostId,
+          directory: workspace,
+          port: runtimePort,
+          source: input.source,
+          env: input.env
+        }),
+        ...Object.fromEntries(host.secrets.map((secret) => [secret.name, `claxedo-broker:${secret.name}`])),
+        HOME: home,
+        TMPDIR: directory,
+        HTTP_PROXY: proxyUrl,
+        HTTPS_PROXY: proxyUrl,
+        ALL_PROXY: proxyUrl,
+        http_proxy: proxyUrl,
+        https_proxy: proxyUrl,
+        all_proxy: proxyUrl,
+        NO_PROXY: unproxied,
+        no_proxy: unproxied,
+        NODE_USE_ENV_PROXY: "1",
+        NODE_EXTRA_CA_CERTS: trustedCertificates
+      };
+      for (const secret of host.secrets) {
+        if (Object.values(env).some((value) => value.includes(secret.value))) throw new Error("brokered secret entered sandbox environment");
+      }
+      const networkPolicy = `(version 1) (allow default) (deny network-outbound) (deny file-read* (subpath ${JSON.stringify(authority.privateDirectory)})) (allow process-exec (literal "/bin/ps") (with no-sandbox)) ${[`localhost:${proxyPort}`, `localhost:${runtimePort}`, ...directDestinations].map((destination) => `(allow network-outbound (remote tcp ${JSON.stringify(destination)}))`).join(" ")}`;
+      const logFile = path.join(directory, "runtime.log");
+      const log = openSync(logFile, "w", 384);
+      let child;
+      try {
+        child = spawn("/usr/bin/sandbox-exec", ["-p", networkPolicy, options.executable, ...options.args], {
+          cwd: workspace,
+          env,
+          stdio: ["ignore", log, log]
+        });
+      } finally {
+        closeSync(log);
+      }
+      host.child = child;
+      if (!child.pid) throw new Error("local sandbox runtime did not start");
+      hosts.set(input.workspaceId, host);
+      await waitForLocalRuntimeHealth(target.url, child, logFile);
+      const targets = path.join(options.root, "local-broker-targets");
+      await fs.mkdir(targets, { recursive: true });
+      await fs.writeFile(path.join(targets, `${input.workspaceId}.json`), JSON.stringify({ url: target.url, directory: workspace, home, pid: child.pid, secretNames: host.secrets.map((secret) => secret.name) }));
+      return target;
+    } catch (error) {
+      if (host.child) await closeHost(host);
+      else {
+        proxy.closeAllConnections();
+        await new Promise((resolve) => proxy.close(() => resolve()));
+        await fs.rm(directory, { recursive: true, force: true });
+      }
+      hosts.delete(input.workspaceId);
+      throw error;
+    }
+  }
+  async function stop(target) {
+    const host = hosts.get(target.workspaceId ?? "");
+    if (!host) return;
+    hosts.delete(target.workspaceId ?? "");
+    await closeHost(host);
+    await fs.rm(path.join(options.root, "local-broker-targets", `${target.workspaceId}.json`), { force: true });
+  }
+  return {
+    id: "local-brokering-test",
+    metadata: localBrokeringTestDriverCatalogEntry.metadata,
+    catalogEntry: localBrokeringTestDriverCatalogEntry,
+    ensureHost,
+    resumeHost: ({ ensure }) => ensureHost(ensure),
+    inspect: async (target) => hosts.get(target.workspaceId ?? "")?.target ? "serving" : "gone",
+    touch: async () => {
+    },
+    stop,
+    suspend: stop,
+    destroy: stop
+  };
+}
+export {
+  createLocalBrokeringSandboxDriver
+};