@claxedo/sandbox-manager 0.9.0 → 0.10.0

package/dist/drivers/box.mjs

@@ -1,574 +0,0 @@
-// ../claxedo-helpers/dist/string.mjs
-function isString(value) {
-  return typeof value === "string";
-}
-function trimToUndefined(value) {
-  if (!isString(value))
-    return;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-
-// src/runtime-env.ts
-function workspaceRuntimeBootEnv(input) {
-  const env = {
-    ...workspaceRuntimeTargetEnv(input),
-    ...workspaceRuntimeSourceEnv(input),
-    ...input.env
-  };
-  if (input.runner) env.WORKSPACE_RUNTIME_RUNNER = input.runner;
-  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
-  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
-  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
-  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
-  return env;
-}
-function workspaceRuntimeTargetEnv(input) {
-  return {
-    WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
-    ...input.hostId ? { WORKSPACE_RUNTIME_HOST_ID: input.hostId } : {},
-    WORKSPACE_RUNTIME_DIRECTORY: input.directory,
-    WORKSPACE_RUNTIME_PORT: String(input.port),
-    ...input.host ? { WORKSPACE_RUNTIME_HOST: input.host } : {}
-  };
-}
-function workspaceRuntimeSourceEnv(input) {
-  if (!input.source || input.source.kind === "empty") return { WORKSPACE_RUNTIME_SOURCE_KIND: "empty" };
-  return {
-    WORKSPACE_RUNTIME_SOURCE_KIND: "git",
-    WORKSPACE_RUNTIME_GIT_REPO_URL: input.source.repoUrl,
-    ...input.source.branch ? { WORKSPACE_RUNTIME_GIT_BRANCH: input.source.branch } : {}
-  };
-}
-
-// src/command.ts
-function shell(input) {
-  return `'${input.replace(/'/g, `'"'"'`)}'`;
-}
-
-// src/constants.ts
-var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
-
-// src/runtime-version.ts
-var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-function workspaceRuntimeVersion() {
-  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
-}
-
-// src/image-name.ts
-var SNAPSHOT_SCHEMA_VERSION = 8;
-var DEFAULT_SANDBOX_IMAGE_REPOSITORY = "ghcr.io/kyashrathore/claxedo-sandbox";
-function snapshotVersion(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function sandboxImageRepository(env = process.env) {
-  const repository = env.CLAXEDO_SANDBOX_IMAGE_REPOSITORY?.trim();
-  return repository ? repository : DEFAULT_SANDBOX_IMAGE_REPOSITORY;
-}
-function buildIdSuffix(buildId, env) {
-  const id = (buildId ?? env.CLAXEDO_SANDBOX_BUILD_ID)?.trim();
-  return id ? `-${snapshotVersion(id)}` : "";
-}
-function defaultSandboxImage(version = workspaceRuntimeVersion(), buildId, env = process.env) {
-  return `${sandboxImageRepository(env)}:workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
-}
-function defaultSnapshotName(version = workspaceRuntimeVersion(), buildId, env = process.env) {
-  return `claxedo-workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
-}
-
-// ../claxedo-helpers/dist/guards.mjs
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function asRecord(value) {
-  return isRecord(value) ? value : void 0;
-}
-
-// src/json.ts
-function text(input) {
-  return typeof input === "string" && input.length > 0 ? input : void 0;
-}
-function num(input) {
-  return typeof input === "number" ? input : void 0;
-}
-
-// src/image.ts
-var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
-var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
-var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
-
-// src/hosted-network-policy.ts
-var SANDBOX_MODEL_PROVIDER_HOSTS = [
-  "api.anthropic.com",
-  "api.openai.com",
-  "generativelanguage.googleapis.com",
-  "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
-  "models.dev",
-  "opencode.ai"
-];
-var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
-  "registry.npmjs.org",
-  "nodejs.org",
-  "pypi.org",
-  "files.pythonhosted.org",
-  "crates.io",
-  "static.crates.io",
-  "index.crates.io",
-  "proxy.golang.org",
-  "sum.golang.org"
-];
-var SANDBOX_BASELINE_EGRESS_HOSTS = [
-  ...SANDBOX_MODEL_PROVIDER_HOSTS,
-  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
-];
-
-// ../sandbox-contract/dist/index.mjs
-var sandboxDriverCredentialFields = {
-  exe: [{ key: "api_token", label: "API Token", secret: true }],
-  daytona: [{ key: "api_key", label: "API Key", secret: true }],
-  modal: [
-    { key: "token_id", label: "Token ID", secret: true },
-    { key: "token_secret", label: "Token Secret", secret: true }
-  ],
-  vercel: [
-    { key: "access_token", label: "Access Token", secret: true },
-    { key: "team_id", label: "Team ID" },
-    { key: "project_id", label: "Project ID" }
-  ],
-  cloudflare: [
-    { key: "api_token", label: "API Token", secret: true },
-    { key: "worker_url", label: "Worker URL" }
-  ],
-  box: [{ key: "api_key", label: "API Key", secret: true }],
-  docker: [{ key: "image", label: "Image" }]
-};
-var sandboxDriverLabels = {
-  exe: "exe.dev",
-  daytona: "Daytona",
-  modal: "Modal",
-  vercel: "Vercel",
-  cloudflare: "Cloudflare",
-  box: "Box",
-  docker: "Docker"
-};
-
-// src/driver-catalog.ts
-var sandboxDriverCatalog = {
-  exe: {
-    id: "exe",
-    label: sandboxDriverLabels.exe,
-    credentialFields: sandboxDriverCredentialFields.exe,
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: true,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  daytona: {
-    id: "daytona",
-    label: sandboxDriverLabels.daytona,
-    credentialFields: sandboxDriverCredentialFields.daytona,
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // The driver translates names to domainAllowList, or addresses to networkAllowList.
-      egressControl: "hosts-and-cidrs",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  modal: {
-    id: "modal",
-    label: sandboxDriverLabels.modal,
-    credentialFields: sandboxDriverCredentialFields.modal,
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "replacement-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      // The driver does not install Modal's domain allowlist or alpha sidecar.
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  vercel: {
-    id: "vercel",
-    label: sandboxDriverLabels.vercel,
-    credentialFields: sandboxDriverCredentialFields.vercel,
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "replacement-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
-      egressControl: "hosts",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "stopped",
-        retention: "explicit",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  cloudflare: {
-    id: "cloudflare",
-    label: sandboxDriverLabels.cloudflare,
-    credentialFields: sandboxDriverCredentialFields.cloudflare,
-    metadata: {
-      driverRunsIn: ["worker"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "directories",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "copy-on-write"
-      }
-    }
-  },
-  box: {
-    id: "box",
-    label: sandboxDriverLabels.box,
-    credentialFields: sandboxDriverCredentialFields.box,
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: false,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  docker: {
-    id: "docker",
-    label: sandboxDriverLabels.docker,
-    credentialFields: sandboxDriverCredentialFields.docker,
-    metadata: {
-      driverRunsIn: ["local"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "loopback",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "same-resource",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  }
-};
-
-// src/drivers/transient-error.ts
-function textOf(input) {
-  return typeof input === "string" ? input : "";
-}
-function driverErrorSignals(err) {
-  const shaped = isRecord(err) ? err : {};
-  const nested = isRecord(shaped.response) ? shaped.response : {};
-  return {
-    status: num(nested.status) ?? num(shaped.status),
-    text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
-  };
-}
-function isTransientDriverError(err, markers) {
-  const { status, text: text2 } = driverErrorSignals(err);
-  if (status !== void 0 && status >= 500) return true;
-  return markers.some((marker) => text2.includes(marker));
-}
-
-// src/drivers/box.ts
-var DEFAULT_BASE_URL = "https://ascii.dev/api/box/v1";
-var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
-var DEFAULT_WORKSPACE_DIR = "/workspace";
-var DEFAULT_CONTAINER_NAME = "claxedo-runtime";
-var DEFAULT_PROVISION_TIMEOUT_MS = 12e4;
-var DEFAULT_PROVISION_INTERVAL_MS = 2e3;
-var DEFAULT_HEALTH_TIMEOUT_MS = 6e4;
-var DEFAULT_HEALTH_INTERVAL_MS = 1e3;
-var DEFAULT_OPERATION_TIMEOUT_MS = 12e4;
-var READY_STATES = /* @__PURE__ */ new Set(["ready", "idle", "running"]);
-var PENDING_STATES = /* @__PURE__ */ new Set(["init", "provisioning", "provisioned", "cloning"]);
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function clean(input) {
-  const txt = input?.trim();
-  return txt ? txt : void 0;
-}
-var TRANSIENT_MARKERS = ["timeout", "unavailable", "econnreset", "network"];
-function transientDriverError(err) {
-  return isTransientDriverError(err, TRANSIENT_MARKERS);
-}
-var BoxApiError = class extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.name = "BoxApiError";
-    this.status = status;
-  }
-};
-function createBoxSandboxDriver(options) {
-  const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-  const image = options.image ?? SANDBOX_IMAGE;
-  const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
-  const workspaceDir = options.workspaceDir ?? DEFAULT_WORKSPACE_DIR;
-  const containerName = options.containerName ?? DEFAULT_CONTAINER_NAME;
-  const ttlSeconds = options.ttlSeconds === void 0 ? null : options.ttlSeconds;
-  const provisionTimeoutMs = options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS;
-  const provisionIntervalMs = options.provisionIntervalMs ?? DEFAULT_PROVISION_INTERVAL_MS;
-  const healthTimeoutMs = options.healthTimeoutMs ?? DEFAULT_HEALTH_TIMEOUT_MS;
-  const healthIntervalMs = options.healthIntervalMs ?? DEFAULT_HEALTH_INTERVAL_MS;
-  const operationTimeoutMs = options.operationTimeoutMs ?? DEFAULT_OPERATION_TIMEOUT_MS;
-  const fetchImpl = options.fetchImpl ?? fetch;
-  async function api(path, init) {
-    let res;
-    try {
-      res = await fetchImpl(`${baseUrl}${path}`, {
-        method: init?.method ?? "GET",
-        headers: {
-          Authorization: `Bearer ${options.apiKey}`,
-          ...init?.body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...init?.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-        signal: AbortSignal.timeout(operationTimeoutMs)
-      });
-    } catch (err) {
-      throw new BoxApiError(err instanceof Error ? err.message : String(err));
-    }
-    const payload = await res.text();
-    const body = (payload ? asRecord(JSON.parse(payload)) : void 0) ?? {};
-    if (!res.ok || body.ok === false) {
-      const detail = clean(text(body.error)) ?? clean(text(body.message)) ?? res.statusText;
-      throw new BoxApiError(`Box API ${init?.method ?? "GET"} ${path} failed: ${detail}`, res.status);
-    }
-    return body;
-  }
-  function boxOf(body) {
-    const box = asRecord(body.box);
-    const id = text(box?.id);
-    const state = text(box?.state);
-    if (!box || !id || !state) throw new BoxApiError("Box API response omitted its box envelope");
-    return {
-      id,
-      state,
-      ...text(box.name) ? { name: text(box.name) } : {},
-      ...box.url === void 0 ? {} : { url: text(box.url) ?? null },
-      ...box.ip === void 0 ? {} : { ip: text(box.ip) ?? null },
-      ...box.subdomain === void 0 ? {} : { subdomain: text(box.subdomain) ?? null },
-      ...box.createdAt === void 0 ? {} : { createdAt: text(box.createdAt) ?? null }
-    };
-  }
-  function runtimePort(input) {
-    return input.workspaceRuntimePort ?? options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
-  }
-  function workspaceDirectory(input) {
-    return input.workspaceRoot ?? workspaceDir;
-  }
-  function resolveImage(input) {
-    if (input.bootSource?.kind === "image") return input.bootSource.image;
-    return input.snapshot ?? image;
-  }
-  function bootEnv(input, hostId) {
-    return workspaceRuntimeBootEnv({
-      workspaceId: input.workspaceId,
-      hostId,
-      directory: workspaceDirectory(input),
-      port: runtimePort(input),
-      host: "0.0.0.0",
-      source: input.source,
-      env: input.env,
-      runner: options.runner
-    });
-  }
-  async function exec(boxId, command) {
-    const body = await api(`/boxes/${boxId}/commands`, {
-      method: "POST",
-      body: { command }
-    });
-    const result = asRecord(body.result) ?? body;
-    return {
-      stdout: typeof result.stdout === "string" ? result.stdout : "",
-      stderr: typeof result.stderr === "string" ? result.stderr : "",
-      exitCode: typeof result.exitCode === "number" ? result.exitCode : 0
-    };
-  }
-  async function execOrThrow(boxId, command, label) {
-    const result = await exec(boxId, command);
-    if ((result.exitCode ?? 0) !== 0) {
-      throw new BoxApiError(`Box ${boxId} ${label} failed (exit ${result.exitCode}): ${trimToUndefined(result.stderr) ?? trimToUndefined(result.stdout) ?? ""}`);
-    }
-    return result;
-  }
-  async function waitUntilReady(boxId) {
-    const until = Date.now() + provisionTimeoutMs;
-    for (; ; ) {
-      const box = boxOf(await api(`/boxes/${boxId}`));
-      if (READY_STATES.has(box.state)) return true;
-      if (!PENDING_STATES.has(box.state)) {
-        throw new BoxApiError(`Box ${boxId} entered non-ready state: ${box.state}`);
-      }
-      if (Date.now() >= until) return false;
-      await sleep(provisionIntervalMs);
-    }
-  }
-  function dockerRunScript(input, env) {
-    const port = runtimePort(input);
-    const directory = workspaceDirectory(input);
-    const bootScript = [`mkdir -p ${shell(directory)}`, `cd ${shell(directory)}`, `exec ${runtimeCommand}`].join(" && ");
-    const envArgs = Object.entries(env).map(([key, value]) => `--env ${shell(`${key}=${value}`)}`).join(" ");
-    const login = options.registryAuth ? `echo ${shell(options.registryAuth.password)} | docker login ${shell(options.registryAuth.server)} --username ${shell(options.registryAuth.username)} --password-stdin && ` : "";
-    return `${login}docker rm -f ${containerName} >/dev/null 2>&1 || true; docker run -d --name ${containerName} -p ${port}:${port} ${envArgs} --entrypoint sh ${shell(resolveImage(input))} -lc ${shell(bootScript)}`;
-  }
-  async function waitForHealth(boxId, input) {
-    const port = runtimePort(input);
-    const until = Date.now() + healthTimeoutMs;
-    let last = "workspace runtime not ready";
-    while (Date.now() < until) {
-      const probe = await exec(
-        boxId,
-        `curl -sf -o /dev/null -w '%{http_code}' http://127.0.0.1:${port}/global/health || true`
-      );
-      const code = trimToUndefined(probe.stdout);
-      if (code === "200") return;
-      last = `health probe returned ${code ?? "no response"}`;
-      await sleep(healthIntervalMs);
-    }
-    throw new BoxApiError(`Box ${boxId} runtime did not become healthy: ${last}`);
-  }
-  async function boot(boxId, input, hostId) {
-    const env = {
-      ...bootEnv(input, hostId),
-      ...await options.env?.(input, { id: hostId })
-    };
-    const port = runtimePort(input);
-    await execOrThrow(boxId, dockerRunScript(input, env), "docker run");
-    await execOrThrow(boxId, `host ${port}`, "host publish");
-    await waitForHealth(boxId, input);
-    const urlResult = await execOrThrow(boxId, `host url ${port}`, "host url");
-    const url = trimToUndefined(urlResult.stdout?.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop());
-    if (!url) throw new BoxApiError(`Box ${boxId} did not return a public URL for port ${port}`);
-    return {
-      workspaceId: input.workspaceId,
-      sandboxId: boxId,
-      url,
-      hostId,
-      driverResourceId: boxId,
-      driver: { id: "box", resourceId: boxId },
-      labels: input.labels
-    };
-  }
-  function assertNetwork(input) {
-    if (input.net && input.net.mode !== "allow-all") {
-      throw new BoxApiError("Box SandboxDriver cannot enforce host-based network policy");
-    }
-  }
-  async function ensureHost(input) {
-    assertNetwork(input);
-    const hostId = input.hostId ?? `box-${input.workspaceId}`;
-    const created = await api("/boxes", {
-      method: "POST",
-      body: { ttlSeconds }
-    }).catch((err) => {
-      if (transientDriverError(err)) return void 0;
-      throw err;
-    });
-    if (!created) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-    const boxId = boxOf(created).id;
-    const ready = await waitUntilReady(boxId);
-    if (!ready) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-    return boot(boxId, input, hostId);
-  }
-  async function resumeHost(input) {
-    const boxId = input.lease.sandboxId;
-    if (!boxId) return ensureHost(input.ensure);
-    assertNetwork(input.ensure);
-    const hostId = input.ensure.hostId ?? input.lease.hostId ?? `box-${input.ensure.workspaceId}`;
-    try {
-      await api(`/boxes/${boxId}/resume`, { method: "POST" });
-      const ready = await waitUntilReady(boxId);
-      if (!ready) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-      return await boot(boxId, input.ensure, hostId);
-    } catch (err) {
-      if (transientDriverError(err)) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-      return ensureHost(input.ensure);
-    }
-  }
-  async function stop(target) {
-    await api(`/boxes/${target.sandboxId}/stop`, { method: "POST" });
-  }
-  async function destroy(target) {
-    await api(`/boxes/${target.sandboxId}`, { method: "DELETE" });
-  }
-  return {
-    id: "box",
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: sandboxDriverCatalog.box.metadata.persistence
-    },
-    ensureHost,
-    resumeHost,
-    async touch() {
-    },
-    suspend: stop,
-    stop,
-    destroy
-  };
-}
-export {
-  createBoxSandboxDriver
-};