@claxedo/sandbox-manager 0.9.0 → 0.10.0

package/dist/lease-policy.d.ts

@@ -1,52 +0,0 @@
-import type { SandboxLeaseRow } from "./lease-types";
-import type { SandboxDriverID } from "@claxedo/sandbox-contract";
-export type SandboxDecision = {
-    action: "skip";
-    reason: string;
-} | {
-    action: "wait";
-    until: number;
-    reason: string;
-} | {
-    action: "resume";
-    reason: string;
-} | {
-    action: "restore_snapshot";
-    snapshot_id: string;
-    reason: string;
-} | {
-    action: "start_prepared";
-    image_id: string;
-    reason: string;
-} | {
-    action: "start_fresh";
-    reason: string;
-} | {
-    action: "stop_idle";
-    reason: string;
-} | {
-    action: "mark_failed";
-    reason: string;
-};
-export type SandboxDecisionConfig = {
-    maxRetries: number;
-    idleMs: number;
-    backoffMaxMs: number;
-    healthTimeoutMs: number;
-};
-export type SandboxDriverPlacement = {
-    canPauseAndRestartSameResource: boolean;
-    canCreateFilesystemSnapshot: boolean;
-    canStartFromPreparedImage: boolean;
-    canStopExplicitly: boolean;
-    hasHealthProbe: boolean;
-};
-export declare const DEFAULT_WORKSPACE_HOST_DECISION_CONFIG: SandboxDecisionConfig;
-export declare function sandboxDriverPlacement(driver: SandboxDriverID): SandboxDriverPlacement;
-export declare function decideSandboxStart(lease: SandboxLeaseRow, placement: SandboxDriverPlacement, now: number, config?: SandboxDecisionConfig): SandboxDecision;
-/**
- * Health-failure policy is placement-independent: retry budget and backoff are
- * the same question for every driver, so this deliberately takes no placement.
- */
-export declare function decideSandboxHealthFailure(lease: SandboxLeaseRow, now: number, config?: SandboxDecisionConfig): SandboxDecision;
-export declare function nextSandboxRetryAt(retryCount: number, now: number, config?: SandboxDecisionConfig): number | null;

package/dist/lease-policy.mjs

@@ -1,290 +0,0 @@
-// src/hosted-network-policy.ts
-var SANDBOX_MODEL_PROVIDER_HOSTS = [
-  "api.anthropic.com",
-  "api.openai.com",
-  "generativelanguage.googleapis.com",
-  "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
-  "models.dev",
-  "opencode.ai"
-];
-var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
-  "registry.npmjs.org",
-  "nodejs.org",
-  "pypi.org",
-  "files.pythonhosted.org",
-  "crates.io",
-  "static.crates.io",
-  "index.crates.io",
-  "proxy.golang.org",
-  "sum.golang.org"
-];
-var SANDBOX_BASELINE_EGRESS_HOSTS = [
-  ...SANDBOX_MODEL_PROVIDER_HOSTS,
-  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
-];
-
-// ../sandbox-contract/dist/index.mjs
-var sandboxDriverCredentialFields = {
-  exe: [{ key: "api_token", label: "API Token", secret: true }],
-  daytona: [{ key: "api_key", label: "API Key", secret: true }],
-  modal: [
-    { key: "token_id", label: "Token ID", secret: true },
-    { key: "token_secret", label: "Token Secret", secret: true }
-  ],
-  vercel: [
-    { key: "access_token", label: "Access Token", secret: true },
-    { key: "team_id", label: "Team ID" },
-    { key: "project_id", label: "Project ID" }
-  ],
-  cloudflare: [
-    { key: "api_token", label: "API Token", secret: true },
-    { key: "worker_url", label: "Worker URL" }
-  ],
-  box: [{ key: "api_key", label: "API Key", secret: true }],
-  docker: [{ key: "image", label: "Image" }]
-};
-var sandboxDriverLabels = {
-  exe: "exe.dev",
-  daytona: "Daytona",
-  modal: "Modal",
-  vercel: "Vercel",
-  cloudflare: "Cloudflare",
-  box: "Box",
-  docker: "Docker"
-};
-
-// src/driver-catalog.ts
-var sandboxDriverCatalog = {
-  exe: {
-    id: "exe",
-    label: sandboxDriverLabels.exe,
-    credentialFields: sandboxDriverCredentialFields.exe,
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: true,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  daytona: {
-    id: "daytona",
-    label: sandboxDriverLabels.daytona,
-    credentialFields: sandboxDriverCredentialFields.daytona,
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // The driver translates names to domainAllowList, or addresses to networkAllowList.
-      egressControl: "hosts-and-cidrs",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  modal: {
-    id: "modal",
-    label: sandboxDriverLabels.modal,
-    credentialFields: sandboxDriverCredentialFields.modal,
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "replacement-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      // The driver does not install Modal's domain allowlist or alpha sidecar.
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  vercel: {
-    id: "vercel",
-    label: sandboxDriverLabels.vercel,
-    credentialFields: sandboxDriverCredentialFields.vercel,
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "replacement-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
-      egressControl: "hosts",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "stopped",
-        retention: "explicit",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  cloudflare: {
-    id: "cloudflare",
-    label: sandboxDriverLabels.cloudflare,
-    credentialFields: sandboxDriverCredentialFields.cloudflare,
-    metadata: {
-      driverRunsIn: ["worker"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "directories",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "copy-on-write"
-      }
-    }
-  },
-  box: {
-    id: "box",
-    label: sandboxDriverLabels.box,
-    credentialFields: sandboxDriverCredentialFields.box,
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: false,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  docker: {
-    id: "docker",
-    label: sandboxDriverLabels.docker,
-    credentialFields: sandboxDriverCredentialFields.docker,
-    metadata: {
-      driverRunsIn: ["local"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "loopback",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "same-resource",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  }
-};
-
-// src/lease-policy.ts
-var DEFAULT_WORKSPACE_HOST_DECISION_CONFIG = {
-  maxRetries: 8,
-  idleMs: 10 * 60 * 1e3,
-  backoffMaxMs: 3e4,
-  healthTimeoutMs: 6e4
-};
-function sandboxDriverPlacement(driver) {
-  const metadata = sandboxDriverCatalog[driver].metadata;
-  return {
-    canPauseAndRestartSameResource: metadata.persistence.resume === "same-sandbox",
-    canCreateFilesystemSnapshot: metadata.persistence.capture === "filesystem" || metadata.persistence.capture === "directories",
-    canStartFromPreparedImage: driver === "exe" || driver === "daytona" || driver === "modal" || driver === "box" || driver === "docker",
-    canStopExplicitly: metadata.hostStopBehavior !== "not-supported",
-    hasHealthProbe: true
-  };
-}
-function decideSandboxStart(lease, placement, now, config = DEFAULT_WORKSPACE_HOST_DECISION_CONFIG) {
-  if (lease.status === "ready") {
-    return { action: "skip", reason: "already ready" };
-  }
-  if (lease.status === "failed") {
-    return { action: "mark_failed", reason: `terminal failure: ${lease.last_error ?? "unknown"}` };
-  }
-  if (lease.status === "backoff") {
-    if (lease.retry_count >= config.maxRetries) {
-      return { action: "mark_failed", reason: `exceeded max retries (${config.maxRetries})` };
-    }
-    if (lease.next_retry_at && now < lease.next_retry_at) {
-      return { action: "wait", until: lease.next_retry_at, reason: "backoff timer not elapsed" };
-    }
-  }
-  if (lease.status === "acquiring" || lease.status === "starting") {
-    return { action: "skip", reason: `already ${lease.status}` };
-  }
-  return decideStartMethod(lease, placement);
-}
-function decideSandboxHealthFailure(lease, now, config = DEFAULT_WORKSPACE_HOST_DECISION_CONFIG) {
-  if (lease.status !== "ready" && lease.status !== "unhealthy") {
-    return { action: "skip", reason: `status is ${lease.status}, health check not applicable` };
-  }
-  const retryCount = lease.retry_count + 1;
-  if (retryCount > config.maxRetries) {
-    return { action: "mark_failed", reason: `health failures exceeded max retries (${config.maxRetries})` };
-  }
-  const backoff = Math.min(config.backoffMaxMs, 1e3 * 2 ** Math.max(0, retryCount - 1));
-  return { action: "wait", until: now + backoff, reason: `health failure #${retryCount}, backoff ${backoff}ms` };
-}
-function nextSandboxRetryAt(retryCount, now, config = DEFAULT_WORKSPACE_HOST_DECISION_CONFIG) {
-  if (retryCount >= config.maxRetries) return null;
-  return now + Math.min(config.backoffMaxMs, 1e3 * 2 ** Math.max(0, retryCount));
-}
-function decideStartMethod(lease, placement) {
-  if (lease.sandbox_id && placement.canPauseAndRestartSameResource) {
-    return { action: "resume", reason: `resume sandbox ${lease.sandbox_id}` };
-  }
-  if (lease.accel_snapshot_id && placement.canCreateFilesystemSnapshot) {
-    return {
-      action: "restore_snapshot",
-      snapshot_id: lease.accel_snapshot_id,
-      reason: `restore snapshot ${lease.accel_snapshot_id}`
-    };
-  }
-  if (lease.accel_prepared_image_id && placement.canStartFromPreparedImage) {
-    return {
-      action: "start_prepared",
-      image_id: lease.accel_prepared_image_id,
-      reason: `start from prepared image ${lease.accel_prepared_image_id}`
-    };
-  }
-  return { action: "start_fresh", reason: "no acceleration available, cold start" };
-}
-export {
-  DEFAULT_WORKSPACE_HOST_DECISION_CONFIG,
-  decideSandboxHealthFailure,
-  decideSandboxStart,
-  nextSandboxRetryAt,
-  sandboxDriverPlacement
-};