@claxedo/sandbox-manager 0.7.0 → 0.9.0

package/dist/drivers/vercel.mjs

@@ -1,7 +1,54 @@
-// src/drivers/vercel.ts
-import { Sandbox } from "@vercel/sandbox";
+// src/constants.ts
+var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
+
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/index.ts
+function brokeredSecretPlaceholder(name) {
+  return `claxedo-broker:${name}`;
+}
+function brokeredPlaceholderEnv(secrets) {
+  return Object.fromEntries((secrets ?? []).map((secret) => [secret.name, brokeredSecretPlaceholder(secret.name)]));
+}
 
 // src/runtime-env.ts
+function workspaceRuntimeBootEnv(input) {
+  const env = {
+    ...workspaceRuntimeTargetEnv(input),
+    ...workspaceRuntimeSourceEnv(input),
+    ...input.env
+  };
+  if (input.runner) env.WORKSPACE_RUNTIME_RUNNER = input.runner;
+  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
+  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
+  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
+  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
+  return env;
+}
 function workspaceRuntimeTargetEnv(input) {
   return {
     WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
@@ -31,44 +78,45 @@ function shell(input) {
   return `'${input.replace(/'/g, `'"'"'`)}'`;
 }
 
-// src/constants.ts
-var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
-
 // src/defaults.ts
 var RUNTIME_DIR = "/opt/workspace-runtime";
 
-// src/hosted-network-policy.ts
-var SANDBOX_MODEL_PROVIDER_HOSTS = [
-  "api.anthropic.com",
-  "api.openai.com",
-  "generativelanguage.googleapis.com",
-  "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
-  "models.dev",
-  "opencode.ai"
-];
-var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
-  "registry.npmjs.org",
-  "nodejs.org",
-  "pypi.org",
-  "files.pythonhosted.org",
-  "crates.io",
-  "static.crates.io",
-  "index.crates.io",
-  "proxy.golang.org",
-  "sum.golang.org"
-];
-var SANDBOX_BASELINE_EGRESS_HOSTS = [
-  ...SANDBOX_MODEL_PROVIDER_HOSTS,
-  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
-];
+// ../sandbox-contract/dist/index.mjs
+var sandboxDriverCredentialFields = {
+  exe: [{ key: "api_token", label: "API Token", secret: true }],
+  daytona: [{ key: "api_key", label: "API Key", secret: true }],
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  box: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  exe: "exe.dev",
+  daytona: "Daytona",
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  box: "Box",
+  docker: "Docker"
+};
 
 // src/driver-catalog.ts
 var sandboxDriverCatalog = {
   exe: {
     id: "exe",
-    label: "exe.dev",
-    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    label: sandboxDriverLabels.exe,
+    credentialFields: sandboxDriverCredentialFields.exe,
     metadata: {
       driverRunsIn: ["worker", "node"],
       hostStopBehavior: "not-supported",
@@ -88,17 +136,15 @@ var sandboxDriverCatalog = {
   },
   daytona: {
     id: "daytona",
-    label: "Daytona",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    label: sandboxDriverLabels.daytona,
+    credentialFields: sandboxDriverCredentialFields.daytona,
     metadata: {
       driverRunsIn: ["worker", "node"],
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
       secretBrokering: "native",
-      // Daytona is the only driver that can filter egress by NAME as well as
-      // by address: `domainAllowList` (names) alongside `networkAllowList`
-      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      // The driver translates names to domainAllowList, or addresses to networkAllowList.
       egressControl: "hosts-and-cidrs",
       persistence: {
         resume: "same-sandbox",
@@ -112,20 +158,15 @@ var sandboxDriverCatalog = {
   },
   modal: {
     id: "modal",
-    label: "Modal",
-    credentialFields: [
-      { key: "token_id", label: "Token ID", secret: true },
-      { key: "token_secret", label: "Token Secret", secret: true }
-    ],
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
       secretBrokering: "none",
-      // Modal can cut the network entirely (`blockNetwork`) but cannot express
-      // an allowlist, and its driver throws on a host policy. A blackout is
-      // not containment for a workspace that has to clone and reach a model.
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
       egressControl: "none",
       persistence: {
         resume: "replacement-restore",
@@ -139,20 +180,15 @@ var sandboxDriverCatalog = {
   },
   vercel: {
     id: "vercel",
-    label: "Vercel",
-    credentialFields: [
-      { key: "access_token", label: "Access Token", secret: true },
-      { key: "team_id", label: "Team ID" },
-      { key: "project_id", label: "Project ID" }
-    ],
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
       secretBrokering: "native",
-      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
-      // never CIDRs.
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
       egressControl: "hosts",
       persistence: {
         resume: "replacement-restore",
@@ -166,23 +202,15 @@ var sandboxDriverCatalog = {
   },
   cloudflare: {
     id: "cloudflare",
-    label: "Cloudflare",
-    credentialFields: [
-      { key: "api_token", label: "API Token", secret: true },
-      { key: "worker_url", label: "Worker URL" }
-    ],
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
     metadata: {
       driverRunsIn: ["worker"],
       hostStopBehavior: "not-supported",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "proxy",
-      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
-      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
-      // to route brokered-credential requests through, not a boundary. The
-      // driver therefore drops `net` entirely — which is exactly why this
-      // must be declared, so the manager refuses instead of provisioning a
-      // sandbox the caller believes is contained.
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
       egressControl: "none",
       persistence: {
         resume: "replacement-restore",
@@ -196,8 +224,8 @@ var sandboxDriverCatalog = {
   },
   box: {
     id: "box",
-    label: "Box",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    label: sandboxDriverLabels.box,
+    credentialFields: sandboxDriverCredentialFields.box,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "suspends-host",
@@ -217,8 +245,8 @@ var sandboxDriverCatalog = {
   },
   docker: {
     id: "docker",
-    label: "Docker",
-    credentialFields: [{ key: "image", label: "Image" }],
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
     metadata: {
       driverRunsIn: ["local"],
       hostStopBehavior: "terminates-host",
@@ -238,6 +266,37 @@ var sandboxDriverCatalog = {
   }
 };
 
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
+
+// src/json.ts
+function num(input) {
+  return typeof input === "number" ? input : void 0;
+}
+
+// src/drivers/transient-error.ts
+function textOf(input) {
+  return typeof input === "string" ? input : "";
+}
+function driverErrorSignals(err) {
+  const shaped = isRecord(err) ? err : {};
+  const nested = isRecord(shaped.response) ? shaped.response : {};
+  return {
+    status: num(nested.status) ?? num(shaped.status),
+    text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
+  };
+}
+function isTransientDriverError(err, markers) {
+  const { status, text } = driverErrorSignals(err);
+  if (status !== void 0 && status >= 500) return true;
+  return markers.some((marker) => text.includes(marker));
+}
+
 // src/drivers/vercel.ts
 var DEFAULT_RUNTIME = "node22";
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
@@ -252,15 +311,16 @@ function runtimePackage(version) {
 var SNAPSHOT_CACHE_TTL_MS = 60 * 60 * 1e3;
 var snapshotCache = /* @__PURE__ */ new Map();
 var snapshotCacheState = /* @__PURE__ */ new WeakMap();
+function isVercelSandboxFactory(value) {
+  const row = asRecord(value);
+  return typeof row?.create === "function" && typeof row.get === "function";
+}
 function nameFor(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
+var TRANSIENT_MARKERS = ["timeout", "unavailable", "deadline", "pending"];
 function transientDriverError(err) {
-  const shaped = err;
-  const status = shaped.response?.status ?? shaped.status;
-  if (typeof status === "number" && status >= 500) return true;
-  const text = `${shaped.code ?? ""} ${shaped.name ?? ""} ${shaped.message ?? ""}`.toLowerCase();
-  return text.includes("timeout") || text.includes("unavailable") || text.includes("deadline") || text.includes("pending");
+  return isTransientDriverError(err, TRANSIENT_MARKERS);
 }
 function network(input) {
   if (!input.net || input.net.mode === "allow-all") return void 0;
@@ -277,9 +337,20 @@ function vercelBrokeredNetworkPolicy(secrets, base) {
         `vercel brokered secret "${secret.name}" requires a header \u2014 the firewall injects the value as an HTTP header on egress`
       );
     }
+    if (secret.hosts.length === 0) {
+      throw new Error(`vercel brokered secret "${secret.name}" requires at least one host in its egress allowlist`);
+    }
+    const value = secret.scheme ? `${secret.scheme} ${secret.value}` : secret.value;
+    const methods = [...secret.methods ?? []];
+    const pathPrefixes = [...secret.pathPrefixes ?? []];
     for (const host of secret.hosts) {
-      ;
-      (allow[host] ??= []).push({ transform: [{ headers: { [secret.header]: secret.value } }] });
+      const rules = allow[host] ??= [];
+      for (const prefix of methods.length ? pathPrefixes : []) {
+        rules.push({
+          match: { path: { startsWith: prefix }, method: methods },
+          transform: [{ headers: { [secret.header]: value } }]
+        });
+      }
     }
   }
   const subnets = typeof base === "object" && base?.subnets ? { subnets: base.subnets } : {};
@@ -292,7 +363,18 @@ function baseAllowEntries(base) {
   return Object.entries(base.allow ?? {});
 }
 function createVercelSandboxDriver(options) {
-  const sandboxFactory = options.sandbox ?? Sandbox;
+  let defaultFactory;
+  function resolveFactory() {
+    if (options.sandbox) return options.sandbox;
+    defaultFactory ??= import("@vercel/sandbox").then((sdk) => {
+      const factory = sdk.Sandbox;
+      if (!isVercelSandboxFactory(factory)) {
+        throw new Error("@vercel/sandbox does not expose the factory surface this driver uses");
+      }
+      return factory;
+    });
+    return defaultFactory;
+  }
   const runtime = options.runtime ?? DEFAULT_RUNTIME;
   const runtimePort = options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
   const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
@@ -319,22 +401,17 @@ function createVercelSandboxDriver(options) {
     };
   }
   function bootEnv(input, hostId) {
-    const env = {
-      ...workspaceRuntimeTargetEnv({
-        workspaceId: input.workspaceId,
-        hostId,
-        directory: workspaceDirectory(input),
-        port: runtimePort,
-        host: "0.0.0.0"
-      }),
-      ...workspaceRuntimeSourceEnv({ source: input.source }),
-      ...input.env
-    };
-    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
-    if (options.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = options.controlEnv.relayJwksUrl;
-    if (options.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = options.controlEnv.relayVerifyPem;
-    if (options.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = options.controlEnv.managementJwksUrl;
-    return env;
+    return workspaceRuntimeBootEnv({
+      workspaceId: input.workspaceId,
+      hostId,
+      directory: workspaceDirectory(input),
+      port: runtimePort,
+      host: "0.0.0.0",
+      source: input.source,
+      env: input.env,
+      runner: options.runner,
+      controlEnv: options.controlEnv
+    });
   }
   async function runSetup(sandbox, command) {
     await sandbox.runCommand("bash", ["-c", command], {
@@ -355,7 +432,7 @@ function createVercelSandboxDriver(options) {
     const running = cacheState.builds.get(cacheKey);
     if (running) return running;
     const build = (async () => {
-      const builder = await sandboxFactory.create({
+      const builder = await (await resolveFactory()).create({
         ...credentials(),
         runtime,
         ports: [runtimePort],
@@ -389,14 +466,8 @@ function createVercelSandboxDriver(options) {
         `npm install ${runtimePackage(expectedRuntimeVersion)} --min-release-age=2`,
         `node -e "const fs=require('fs');const actual=JSON.parse(fs.readFileSync('${RUNTIME_DIR}/node_modules/@claxedo/workspace-runtime/package.json','utf8')).version;if(actual!=='${expectedRuntimeVersion}'){throw new Error('workspace-runtime snapshot package version mismatch: expected ${expectedRuntimeVersion}, got '+actual)}"`,
         "test -x node_modules/.bin/workspace-runtime",
-        "test -x node_modules/.bin/claude-agent-acp",
-        "test -x node_modules/.bin/codex-acp",
         `sudo ln -sf ${RUNTIME_DIR}/node_modules/.bin/workspace-runtime /usr/local/bin/workspace-runtime`,
-        `sudo ln -sf ${RUNTIME_DIR}/node_modules/.bin/claude-agent-acp /usr/local/bin/claude-agent-acp`,
-        `sudo ln -sf ${RUNTIME_DIR}/node_modules/.bin/codex-acp /usr/local/bin/codex-acp`,
-        "command -v workspace-runtime",
-        "command -v claude-agent-acp",
-        "command -v codex-acp"
+        "command -v workspace-runtime"
       ].join(" && "));
       const snapshot = await builder.snapshot({
         expiration: 0,
@@ -450,10 +521,13 @@ function createVercelSandboxDriver(options) {
     const hostId = input.hostId ?? nameFor(input.workspaceId);
     const env = {
       ...bootEnv(input, hostId),
-      ...await options.env?.(input, { id: hostId })
+      ...await options.env?.(input, { id: hostId }),
+      // Last, so no caller-supplied variable of the same name can stand in for
+      // a placeholder the firewall transform overwrites.
+      ...brokeredPlaceholderEnv(input.secrets)
     };
     const createPolicy = network(input);
-    const sandbox = await sandboxFactory.create({
+    const sandbox = await (await resolveFactory()).create({
       ...credentials(),
       source: await source(input),
       ports: [runtimePort],
@@ -474,7 +548,7 @@ function createVercelSandboxDriver(options) {
     return readyTarget(input, sandbox, hostId);
   }
   async function sandboxById(target) {
-    return sandboxFactory.get({
+    return (await resolveFactory()).get({
       ...credentials(),
       sandboxId: target.sandboxId
     });

package/dist/hosted-network-policy.d.ts

@@ -39,8 +39,8 @@
 import type { SandboxNetworkPolicy, SandboxSource } from ".";
 /**
  * Model-provider endpoints. Derived from the harness→provider groups in
- * claxedo-server `network/types.ts` (`PROVIDER_TO_GROUP`): claude-acp and
- * claude-sdk → anthropic, codex-acp/codex-app-server/cursor-acp → openai,
+ * claxedo-server `network/types.ts` (`PROVIDER_TO_GROUP`): claude-sdk →
+ * anthropic, codex-app-server/cursor-sdk → openai,
  * google → google_ai; plus the aggregator and catalog endpoints the engine
  * itself fetches at startup.
  */

package/dist/hosted-network-policy.mjs

@@ -25,16 +25,16 @@ var SANDBOX_BASELINE_EGRESS_HOSTS = [
 ];
 function hostOf(value) {
   const raw = value?.trim();
-  if (!raw) return;
+  if (!raw) return void 0;
   try {
     const host = new URL(raw).hostname.trim().toLowerCase();
     return host ? host : void 0;
   } catch {
-    return;
+    return void 0;
   }
 }
 function sandboxSourceHost(source) {
-  if (!source || source.kind !== "git") return;
+  if (!source || source.kind !== "git") return void 0;
   return hostOf(source.repoUrl);
 }
 function hostedSandboxNetworkPolicy(input) {

package/dist/image-name.mjs

@@ -0,0 +1,34 @@
+// src/runtime-version.ts
+var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
+function workspaceRuntimeVersion() {
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
+}
+
+// src/image-name.ts
+var SNAPSHOT_SCHEMA_VERSION = 8;
+var DEFAULT_SANDBOX_IMAGE_REPOSITORY = "ghcr.io/kyashrathore/claxedo-sandbox";
+function snapshotVersion(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function sandboxImageRepository(env = process.env) {
+  const repository = env.CLAXEDO_SANDBOX_IMAGE_REPOSITORY?.trim();
+  return repository ? repository : DEFAULT_SANDBOX_IMAGE_REPOSITORY;
+}
+function buildIdSuffix(buildId, env) {
+  const id = (buildId ?? env.CLAXEDO_SANDBOX_BUILD_ID)?.trim();
+  return id ? `-${snapshotVersion(id)}` : "";
+}
+function defaultSandboxImage(version = workspaceRuntimeVersion(), buildId, env = process.env) {
+  return `${sandboxImageRepository(env)}:workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
+}
+function defaultSnapshotName(version = workspaceRuntimeVersion(), buildId, env = process.env) {
+  return `claxedo-workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
+}
+export {
+  DEFAULT_SANDBOX_IMAGE_REPOSITORY,
+  SNAPSHOT_SCHEMA_VERSION,
+  defaultSandboxImage,
+  defaultSnapshotName,
+  sandboxImageRepository,
+  snapshotVersion
+};

package/dist/image.d.ts

@@ -1,4 +1,4 @@
-import { Daytona, Image } from "@daytona/sdk";
+import type { Daytona, Image } from "@daytona/sdk";
 export { RUNTIME_DIR, WORKSPACE_RUNTIME_PORT, WORKSPACE_DIR } from "./defaults";
 export { SNAPSHOT_SCHEMA_VERSION, snapshotVersion, defaultSandboxImage, defaultSnapshotName, } from "./image-name";
 /**
@@ -19,5 +19,5 @@ export type SandboxImageOptions = {
 export declare const SANDBOX_IMAGE_REPOSITORY: string;
 export declare const SANDBOX_IMAGE: string;
 export declare const SNAPSHOT_NAME: string;
-export declare function buildSandboxImage(): Image;
+export declare function buildSandboxImage(): Promise<Image>;
 export declare function ensureSnapshot(daytona: Daytona, options?: SandboxImageOptions): Promise<string>;

package/dist/image.mjs

@@ -1,6 +1,3 @@
-// src/image.ts
-import { Image, DaytonaNotFoundError } from "@daytona/sdk";
-
 // src/constants.ts
 var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
 
@@ -36,6 +33,19 @@ function defaultSnapshotName(version = workspaceRuntimeVersion(), buildId, env =
   return `claxedo-workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
 }
 
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
+
+// src/json.ts
+function text(input) {
+  return typeof input === "string" && input.length > 0 ? input : void 0;
+}
+
 // src/image.ts
 function defaultImageLogSink(message, context) {
   if (context) console.info(message, context);
@@ -44,16 +54,26 @@ function defaultImageLogSink(message, context) {
 var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
 var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
 var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
-function buildSandboxImage() {
+async function buildSandboxImage() {
+  const { Image } = await import("@daytona/sdk");
   return Image.base(SANDBOX_IMAGE);
 }
 function snapshotUsable(state) {
   return state === "ready" || state === "active";
 }
+function snapshotView(input) {
+  const row = asRecord(input) ?? {};
+  return { id: text(row.id), state: text(row.state), errorReason: text(row.errorReason) };
+}
+async function activateSnapshot(snapshots, id) {
+  const activate = asRecord(snapshots)?.activate;
+  if (typeof activate !== "function") throw new Error("Daytona SDK does not support snapshot activation");
+  await activate.call(snapshots, { id });
+}
 async function createSnapshot(daytona, log) {
   log("Creating sandbox snapshot (this may take a few minutes)...", { name: SNAPSHOT_NAME });
   await daytona.snapshot.create(
-    { name: SNAPSHOT_NAME, image: buildSandboxImage() },
+    { name: SNAPSHOT_NAME, image: await buildSandboxImage() },
     {
       timeout: 120,
       onLogs: (chunk) => log("[snapshot]", { text: chunk })
@@ -64,14 +84,15 @@ async function createSnapshot(daytona, log) {
 async function ensureSnapshot(daytona, options = {}) {
   const log = options.log ?? defaultImageLogSink;
   try {
-    const existing = await daytona.snapshot.get(SNAPSHOT_NAME);
+    const existing = snapshotView(await daytona.snapshot.get(SNAPSHOT_NAME));
     if (existing.state === "inactive") {
       log("Snapshot is inactive, reactivating...", { name: SNAPSHOT_NAME, id: existing.id });
-      await daytona.snapshot.activate({ id: existing.id });
+      if (!existing.id) throw new Error("Daytona snapshot is inactive but reports no id to activate");
+      await activateSnapshot(daytona.snapshot, existing.id);
       for (let i = 0; i < 120; i++) {
-        const snap = await daytona.snapshot.get(SNAPSHOT_NAME);
+        const snap = snapshotView(await daytona.snapshot.get(SNAPSHOT_NAME));
         if (snapshotUsable(snap.state)) return SNAPSHOT_NAME;
-        if (snap.state === "error") throw new Error(`Snapshot activation failed: ${snap.errorReason}`);
+        if (snap.state === "error") throw new Error(`Snapshot activation failed: ${snap.errorReason ?? "unknown"}`);
         await new Promise((resolve) => setTimeout(resolve, 2e3));
       }
       throw new Error("Snapshot activation timed out");
@@ -79,9 +100,9 @@ async function ensureSnapshot(daytona, options = {}) {
     if (existing.state === "building") {
       log("Snapshot is building, waiting (up to 10 min)...", { name: SNAPSHOT_NAME });
       for (let i = 0; i < 300; i++) {
-        const snap = await daytona.snapshot.get(SNAPSHOT_NAME);
+        const snap = snapshotView(await daytona.snapshot.get(SNAPSHOT_NAME));
         if (snapshotUsable(snap.state)) return SNAPSHOT_NAME;
-        if (snap.state === "error") throw new Error(`Snapshot build failed: ${snap.errorReason}`);
+        if (snap.state === "error") throw new Error(`Snapshot build failed: ${snap.errorReason ?? "unknown"}`);
         if (i % 15 === 0) log("Still waiting for snapshot...", { state: snap.state, elapsed: `${i * 2}s` });
         await new Promise((resolve) => setTimeout(resolve, 2e3));
       }
@@ -89,6 +110,7 @@ async function ensureSnapshot(daytona, options = {}) {
     }
     return SNAPSHOT_NAME;
   } catch (err) {
+    const { DaytonaNotFoundError } = await import("@daytona/sdk");
     if (!(err instanceof DaytonaNotFoundError)) throw err;
   }
   return createSnapshot(daytona, log);