@claxedo/sandbox-manager 0.7.0 → 0.9.0

package/dist/drivers/daytona.mjs

@@ -1,6 +1,3 @@
-// src/drivers/daytona.ts
-import { Daytona } from "@daytona/sdk";
-
 // src/daytona-allow-list.ts
 function formatDaytonaAllowList(cidrs) {
   return cidrs.slice(0, 10).join(",");
@@ -10,6 +7,19 @@ function formatDaytonaDomainAllowList(hosts) {
 }
 
 // src/runtime-env.ts
+function workspaceRuntimeBootEnv(input) {
+  const env = {
+    ...workspaceRuntimeTargetEnv(input),
+    ...workspaceRuntimeSourceEnv(input),
+    ...input.env
+  };
+  if (input.runner) env.WORKSPACE_RUNTIME_RUNNER = input.runner;
+  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
+  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
+  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
+  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
+  return env;
+}
 function workspaceRuntimeTargetEnv(input) {
   return {
     WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
@@ -62,12 +72,42 @@ var SANDBOX_BASELINE_EGRESS_HOSTS = [
   ...SANDBOX_PACKAGE_REGISTRY_HOSTS
 ];
 
+// ../sandbox-contract/dist/index.mjs
+var sandboxDriverCredentialFields = {
+  exe: [{ key: "api_token", label: "API Token", secret: true }],
+  daytona: [{ key: "api_key", label: "API Key", secret: true }],
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  box: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  exe: "exe.dev",
+  daytona: "Daytona",
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  box: "Box",
+  docker: "Docker"
+};
+
 // src/driver-catalog.ts
 var sandboxDriverCatalog = {
   exe: {
     id: "exe",
-    label: "exe.dev",
-    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    label: sandboxDriverLabels.exe,
+    credentialFields: sandboxDriverCredentialFields.exe,
     metadata: {
       driverRunsIn: ["worker", "node"],
       hostStopBehavior: "not-supported",
@@ -87,17 +127,15 @@ var sandboxDriverCatalog = {
   },
   daytona: {
     id: "daytona",
-    label: "Daytona",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    label: sandboxDriverLabels.daytona,
+    credentialFields: sandboxDriverCredentialFields.daytona,
     metadata: {
       driverRunsIn: ["worker", "node"],
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
       secretBrokering: "native",
-      // Daytona is the only driver that can filter egress by NAME as well as
-      // by address: `domainAllowList` (names) alongside `networkAllowList`
-      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      // The driver translates names to domainAllowList, or addresses to networkAllowList.
       egressControl: "hosts-and-cidrs",
       persistence: {
         resume: "same-sandbox",
@@ -111,20 +149,15 @@ var sandboxDriverCatalog = {
   },
   modal: {
     id: "modal",
-    label: "Modal",
-    credentialFields: [
-      { key: "token_id", label: "Token ID", secret: true },
-      { key: "token_secret", label: "Token Secret", secret: true }
-    ],
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
       secretBrokering: "none",
-      // Modal can cut the network entirely (`blockNetwork`) but cannot express
-      // an allowlist, and its driver throws on a host policy. A blackout is
-      // not containment for a workspace that has to clone and reach a model.
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
       egressControl: "none",
       persistence: {
         resume: "replacement-restore",
@@ -138,20 +171,15 @@ var sandboxDriverCatalog = {
   },
   vercel: {
     id: "vercel",
-    label: "Vercel",
-    credentialFields: [
-      { key: "access_token", label: "Access Token", secret: true },
-      { key: "team_id", label: "Team ID" },
-      { key: "project_id", label: "Project ID" }
-    ],
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
       secretBrokering: "native",
-      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
-      // never CIDRs.
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
       egressControl: "hosts",
       persistence: {
         resume: "replacement-restore",
@@ -165,23 +193,15 @@ var sandboxDriverCatalog = {
   },
   cloudflare: {
     id: "cloudflare",
-    label: "Cloudflare",
-    credentialFields: [
-      { key: "api_token", label: "API Token", secret: true },
-      { key: "worker_url", label: "Worker URL" }
-    ],
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
     metadata: {
       driverRunsIn: ["worker"],
       hostStopBehavior: "not-supported",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "proxy",
-      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
-      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
-      // to route brokered-credential requests through, not a boundary. The
-      // driver therefore drops `net` entirely — which is exactly why this
-      // must be declared, so the manager refuses instead of provisioning a
-      // sandbox the caller believes is contained.
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
       egressControl: "none",
       persistence: {
         resume: "replacement-restore",
@@ -195,8 +215,8 @@ var sandboxDriverCatalog = {
   },
   box: {
     id: "box",
-    label: "Box",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    label: sandboxDriverLabels.box,
+    credentialFields: sandboxDriverCredentialFields.box,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "suspends-host",
@@ -216,8 +236,8 @@ var sandboxDriverCatalog = {
   },
   docker: {
     id: "docker",
-    label: "Docker",
-    credentialFields: [{ key: "image", label: "Image" }],
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
     metadata: {
       driverRunsIn: ["local"],
       hostStopBehavior: "terminates-host",
@@ -237,28 +257,87 @@ var sandboxDriverCatalog = {
   }
 };
 
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/json.ts
+function num(input) {
+  return typeof input === "number" ? input : void 0;
+}
+
+// src/drivers/transient-error.ts
+function textOf(input) {
+  return typeof input === "string" ? input : "";
+}
+function driverErrorSignals(err) {
+  const shaped = isRecord(err) ? err : {};
+  const nested = isRecord(shaped.response) ? shaped.response : {};
+  return {
+    status: num(nested.status) ?? num(shaped.status),
+    text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
+  };
+}
+function isTransientDriverError(err, markers) {
+  const { status, text } = driverErrorSignals(err);
+  if (status !== void 0 && status >= 500) return true;
+  return markers.some((marker) => text.includes(marker));
+}
+
 // src/drivers/daytona.ts
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
 var DEFAULT_WORKSPACE_DIR = "/workspace";
 var DEFAULT_PREVIEW_EXPIRY_S = 3600;
 var DEFAULT_OPERATION_TIMEOUT_S = 60;
 var LIST_PAGE_SIZE = 100;
+var SECRET_LIST_PAGE_SIZE = 200;
+var SENTINEL_SECRET_ENV = "CLAXEDO_BROKERED_SECRET_SLOT";
+var REVOKED_SECRET_VALUE = "claxedo-revoked";
 var MAX_LIST_PAGES = 100;
 function labelName(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
+function encodeSecretSegment(value) {
+  return encodeURIComponent(value).replace(/[-_.!~*'()]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%/g, "_");
+}
+function workspaceSecretPrefix(workspaceId) {
+  return `claxedo-${encodeSecretSegment(workspaceId)}-`;
+}
 function daytonaSecretName(workspaceId, secretName) {
-  const safe = (value) => value.replace(/[^a-zA-Z0-9_-]+/g, "-");
-  return `claxedo-${safe(workspaceId)}-${safe(secretName)}`;
+  return `${workspaceSecretPrefix(workspaceId)}${encodeSecretSegment(secretName)}`;
+}
+function daytonaSecretEnvName(workspaceId, secretName) {
+  try {
+    return decodeURIComponent(secretName.slice(workspaceSecretPrefix(workspaceId).length).replace(/_/g, "%"));
+  } catch {
+    return void 0;
+  }
 }
+async function listWorkspaceSecrets(secrets, workspaceId) {
+  const prefix = workspaceSecretPrefix(workspaceId);
+  const held = /* @__PURE__ */ new Map();
+  let cursor;
+  for (let page = 0; page < MAX_LIST_PAGES; page++) {
+    const result = await secrets.list({ name: prefix, limit: SECRET_LIST_PAGE_SIZE, ...cursor ? { cursor } : {} });
+    for (const secret of result.items ?? []) {
+      if (secret.name.startsWith(prefix)) held.set(secret.name, secret);
+    }
+    cursor = result.nextCursor ?? void 0;
+    if (!cursor) break;
+  }
+  return held;
+}
+async function withdrawSecret(secrets, secret, options) {
+  await secrets.update(secret.id, { value: REVOKED_SECRET_VALUE, hosts: [] });
+  if (options.delete) await secrets.delete(secret.id);
+}
+var TRANSIENT_MARKERS = ["timeout", "pending", "starting"];
 function transientDriverError(err) {
-  const shaped = err;
-  const status = shaped.response?.status ?? shaped.status;
-  if (typeof status === "number" && status >= 500) return true;
-  const text = `${shaped.name ?? ""} ${shaped.message ?? ""}`.toLowerCase();
-  return text.includes("timeout") || text.includes("pending") || text.includes("starting");
+  return isTransientDriverError(err, TRANSIENT_MARKERS);
 }
-function createDefaultClient(options) {
+async function createDefaultClient(options) {
+  const { Daytona } = await import("@daytona/sdk");
   const sdk = new Daytona({
     apiKey: options.apiKey,
     ...options.apiUrl ? { apiUrl: options.apiUrl } : {},
@@ -285,37 +364,36 @@ function createDefaultClient(options) {
       return sdk.create(params, operation);
     },
     get: (sandboxIdOrName) => sdk.get(sandboxIdOrName),
-    async upsertSecret({ name, value, hosts }) {
-      await sdk.secret.create({ name, value, hosts });
-    }
+    secret: sdk.secret
   };
 }
 function createDaytonaSandboxDriver(options) {
-  const client = options.client ?? createDefaultClient(options);
+  let defaultClient;
+  function resolveClient() {
+    if (options.client) return options.client;
+    defaultClient ??= createDefaultClient(options);
+    return defaultClient;
+  }
   const runtimePort = options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
   const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
   const workspaceDir = options.workspaceDir ?? DEFAULT_WORKSPACE_DIR;
   const previewExpiry = options.previewExpirySeconds ?? DEFAULT_PREVIEW_EXPIRY_S;
   const operationTimeout = options.operationTimeoutSeconds ?? DEFAULT_OPERATION_TIMEOUT_S;
+  const warn = options.warn ?? ((message) => console.warn(message));
   function workspaceDirectory(input) {
     return input.workspaceRoot ?? workspaceDir;
   }
   function staticBootEnv(input, hostId, directory) {
-    const env = {
-      ...workspaceRuntimeTargetEnv({
-        workspaceId: input.workspaceId,
-        hostId,
-        directory,
-        port: runtimePort
-      }),
-      ...workspaceRuntimeSourceEnv({ source: input.source }),
-      ...input.env
-    };
-    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
-    if (options.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = options.controlEnv.relayJwksUrl;
-    if (options.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = options.controlEnv.relayVerifyPem;
-    if (options.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = options.controlEnv.managementJwksUrl;
-    return env;
+    return workspaceRuntimeBootEnv({
+      workspaceId: input.workspaceId,
+      hostId,
+      directory,
+      port: runtimePort,
+      source: input.source,
+      env: input.env,
+      runner: options.runner,
+      controlEnv: options.controlEnv
+    });
   }
   async function bootEnv(input, sandbox, hostId) {
     return {
@@ -324,13 +402,14 @@ function createDaytonaSandboxDriver(options) {
     };
   }
   async function findExisting(workspaceId) {
+    const client = await resolveClient();
     const labels = { "claxedo.workspaceId": workspaceId };
     if (client.findByLabels) return client.findByLabels(labels).catch(() => void 0);
     const result = await client.list?.(labels, 1, 1).catch(() => void 0);
     return result?.items?.[0];
   }
   async function sandboxById(sandboxId) {
-    return client.get(sandboxId);
+    return (await resolveClient()).get(sandboxId);
   }
   async function previewUrl(sandbox) {
     const signed = await sandbox.getSignedPreviewUrl(runtimePort, previewExpiry).catch(() => void 0);
@@ -366,21 +445,67 @@ function createDaytonaSandboxDriver(options) {
     };
     return target;
   }
-  async function brokeredSecretReferences(input) {
-    if (!input.secrets?.length) return {};
-    if (!client.upsertSecret) {
+  async function brokeredSecretService() {
+    const secrets = (await resolveClient()).secret;
+    if (!secrets) {
       throw new Error("daytona sandbox client does not support secret brokering");
     }
+    return secrets;
+  }
+  async function reconcileBrokeredSecrets(input, options2) {
+    const secrets = await brokeredSecretService();
+    const existing = await listWorkspaceSecrets(secrets, input.workspaceId);
     const references = {};
-    for (const secret of input.secrets) {
+    const desired = /* @__PURE__ */ new Set();
+    const sentinel = daytonaSecretName(input.workspaceId, SENTINEL_SECRET_ENV);
+    desired.add(sentinel);
+    references[SENTINEL_SECRET_ENV] = sentinel;
+    if (!existing.has(sentinel)) await secrets.create({ name: sentinel, value: "", hosts: [] });
+    for (const secret of input.secrets ?? []) {
       if (secret.hosts.length === 0) {
         throw new Error(`daytona brokered secret "${secret.name}" requires at least one host in its egress allowlist`);
       }
-      const secretName = daytonaSecretName(input.workspaceId, secret.name);
-      await client.upsertSecret({ name: secretName, value: secret.value, hosts: secret.hosts });
-      references[secret.name] = secretName;
+      const name = daytonaSecretName(input.workspaceId, secret.name);
+      desired.add(name);
+      references[secret.name] = name;
+      const current = existing.get(name);
+      if (current) await secrets.update(current.id, { value: secret.value, hosts: secret.hosts });
+      else await secrets.create({ name, value: secret.value, hosts: secret.hosts });
+    }
+    if (options2.withdraw) {
+      for (const [name, secret] of existing) {
+        if (desired.has(name)) continue;
+        await withdrawSecret(secrets, secret, { delete: false });
+        if (!options2.mountWithdrawn) continue;
+        const envName = daytonaSecretEnvName(input.workspaceId, name);
+        if (!envName) {
+          warn(
+            `[sandbox-manager] daytona org secret ${name} matches workspace ${input.workspaceId}'s prefix but was not minted by this driver; it was emptied and left unmounted`
+          );
+          continue;
+        }
+        desired.add(name);
+        references[envName] = name;
+      }
+    }
+    const mountedNamesChanged = existing.size !== desired.size || [...desired].some((name) => !existing.has(name));
+    return { references, mountedNamesChanged };
+  }
+  function mayBeRunning(sandbox) {
+    return !sandbox.state || sandbox.state === "started";
+  }
+  async function restartForMountedSecrets(sandbox, workspaceId) {
+    warn(
+      `[sandbox-manager] restarting daytona sandbox ${sandbox.id} (workspace ${workspaceId}): the set of brokered secret names changed and mounted env vars only reach processes spawned after the change`
+    );
+    await sandbox.stop(operationTimeout);
+    await sandbox.start(operationTimeout);
+  }
+  async function applyBrokeredSecrets(sandbox, plan, workspaceId) {
+    await sandbox.updateSecrets(plan.references);
+    if (plan.mountedNamesChanged && mayBeRunning(sandbox)) {
+      await restartForMountedSecrets(sandbox, workspaceId);
     }
-    return references;
   }
   async function applyNetworkPolicy(sandbox, input) {
     const net = network(input);
@@ -402,13 +527,16 @@ function createDaytonaSandboxDriver(options) {
     const hostId = labelName(input.workspaceId);
     const bootSource = input.bootSource?.kind === "image" ? { image: input.bootSource.image } : { snapshot: input.bootSource?.kind === "driver-snapshot" ? input.bootSource.snapshotId : input.snapshot ?? options.baseSnapshot };
     const net = network(input);
-    const secrets = await brokeredSecretReferences(input);
     const existing = await findExisting(input.workspaceId);
-    const sandbox = existing ?? await client.create({
+    const plan = existing && input.secrets === void 0 ? void 0 : await reconcileBrokeredSecrets(input, {
+      withdraw: input.secrets !== void 0,
+      mountWithdrawn: Boolean(existing)
+    });
+    const sandbox = existing ?? await (await resolveClient()).create({
       name: labelName(input.workspaceId),
       ...bootSource,
       envVars: staticBootEnv(input, hostId, workspaceDirectory(input)),
-      ...Object.keys(secrets).length ? { secrets } : {},
+      ...plan ? { secrets: plan.references } : {},
       labels: { ...input.labels, "claxedo.workspaceId": input.workspaceId },
       public: false,
       ...net,
@@ -419,6 +547,7 @@ function createDaytonaSandboxDriver(options) {
       throw err;
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: 2e3 };
+    if (existing && plan) await applyBrokeredSecrets(existing, plan, input.workspaceId);
     if (!await ensureStarted(sandbox)) return { provisioning: true, retryAfterMs: 2e3 };
     if (existing && await applyNetworkPolicy(existing, input) === "retry") {
       return { provisioning: true, retryAfterMs: 2e3 };
@@ -463,6 +592,7 @@ function createDaytonaSandboxDriver(options) {
     // round-trip and GC only needs identity, so a sweep over N orphans would
     // cost N extra API calls to fill a field it then discards.
     async list() {
+      const client = await resolveClient();
       if (!client.list) {
         throw new Error("daytona sandbox client does not support listing");
       }
@@ -496,6 +626,10 @@ function createDaytonaSandboxDriver(options) {
     },
     async resumeHost(input) {
       const sandbox = await sandboxById(input.lease.sandboxId);
+      if (input.ensure.secrets !== void 0) {
+        const plan = await reconcileBrokeredSecrets(input.ensure, { withdraw: true, mountWithdrawn: true });
+        await applyBrokeredSecrets(sandbox, plan, input.ensure.workspaceId);
+      }
       if (!await ensureStarted(sandbox)) return { provisioning: true, retryAfterMs: 2e3 };
       if (await applyNetworkPolicy(sandbox, input.ensure) === "retry") {
         return { provisioning: true, retryAfterMs: 2e3 };
@@ -513,9 +647,17 @@ function createDaytonaSandboxDriver(options) {
     },
     async destroy(target) {
       await sandboxById(target.sandboxId).then((sandbox) => sandbox.delete(operationTimeout)).catch((err) => {
-        const status = err.response?.status ?? err.status;
-        if (status !== 404) throw err;
+        if (driverErrorSignals(err).status !== 404) throw err;
       });
+      if (!target.workspaceId) {
+        throw new Error(
+          `daytona deleted sandbox ${target.sandboxId} but cannot withdraw its brokered secrets: the destroy target names no workspace`
+        );
+      }
+      const secrets = await brokeredSecretService();
+      for (const secret of (await listWorkspaceSecrets(secrets, target.workspaceId)).values()) {
+        await withdrawSecret(secrets, secret, { delete: true });
+      }
     },
     async snapshot(target) {
       const sandbox = await sandboxById(target.sandboxId);