@codeworksh/harness 0.0.1-dev.20260825093030 → 0.0.1-dev.20260907170816

package/sandbox-QCmZ3UhD.mjs

@@ -0,0 +1,713 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { Context, DateTime, Effect, Option, Path, Schema, SchemaGetter } from "effect";
+import { uuidv7 } from "uuidv7";
+import { Message } from "@codeworksh/aikit";
+import TypeBoxSchema from "typebox/schema";
+//#region src/schema.ts
+const aikitValidators = /* @__PURE__ */ new WeakMap();
+const aikitValidatorFor = (schema) => {
+	const cached = aikitValidators.get(schema);
+	if (cached !== void 0) return cached;
+	const compiled = TypeBoxSchema.Compile(schema);
+	aikitValidators.set(schema, compiled);
+	return compiled;
+};
+const aikitErrorPath = (error) => {
+	if (error.instancePath) return error.instancePath.substring(1);
+	const required = error.params?.requiredProperties;
+	return Array.isArray(required) ? required.join(", ") : "root";
+};
+const validateAikitSchema = (schema, value, label) => {
+	const validator = aikitValidatorFor(schema);
+	if (validator.Check(value)) return value;
+	const [, issues] = validator.Errors(value);
+	const details = issues.map((issue) => ` - ${aikitErrorPath(issue)}: ${issue.message}`).join("\n") || "unknown error";
+	throw new Error(`validation failed for ${label}\n${details}`);
+};
+/** Validate an aikit message without coercing or rewriting durable data. */
+const validateAikitMessage = (value, label) => validateAikitSchema(Message.MessageSchema, value, label);
+const validateAikitUserMessage = (value, label) => validateAikitSchema(Message.UserMessageSchema, value, label);
+const validateAikitAssistantMessage = (value, label) => validateAikitSchema(Message.AssistantMessageSchema, value, label);
+const validateAikitToolCallTerminalPart = (value, label) => validateAikitSchema(Message.ToolCallTerminalPartSchema, value, label);
+const isAikitAssistantMessage = (value) => aikitValidatorFor(Message.AssistantMessageSchema).Check(value);
+const isAikitToolCallTerminalPart = (value) => aikitValidatorFor(Message.ToolCallTerminalPartSchema).Check(value);
+Schema.Int.check(Schema.isGreaterThan(0));
+/**
+* Integer greater than or equal to zero.
+*/
+const NonNegativeInt = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/**
+* Cost greater than or equal with finite value
+*/
+const NonNegativeCost = Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0));
+Schema.String.pipe(Schema.brand("RelativePath"));
+/**
+* Absolute file path (e.g., `/home/user/projects/myapp/src/main.ts`).
+*/
+const AbsolutePath$1 = Schema.String.pipe(Schema.brand("AbsolutePath"));
+/**
+* Optional public JSON field that can hold explicit `undefined` on the type
+* side but encodes it as an omitted key, matching legacy `JSON.stringify`.
+*/
+const optional = (schema) => Schema.optionalKey(schema).pipe(Schema.decodeTo(Schema.optional(schema), {
+	decode: SchemaGetter.passthrough({ strict: false }),
+	encode: SchemaGetter.transformOptional(Option.filter((value) => value !== void 0))
+}));
+/**
+* Attach static methods to a schema object. Designed to be used with `.pipe()`:
+*
+* @example
+*   export const Foo = fooSchema.pipe(
+*     withStatics((schema) => ({
+*       zero: schema.make(0),
+*       from: Schema.decodeUnknownOption(schema),
+*     }))
+*   )
+*/
+const withStatics = (methods) => (schema) => Object.assign(schema, methods(schema));
+const DateTimeUtcFromMillis = Schema.Finite.pipe(Schema.decodeTo(Schema.DateTimeUtc, {
+	decode: SchemaGetter.transform((value) => DateTime.makeUnsafe(value)),
+	encode: SchemaGetter.transform((value) => DateTime.toEpochMillis(value))
+}));
+//#endregion
+//#region src/util/posix.ts
+/** Shared POSIX path implementation for sandbox and remote-runtime paths. */
+const posix = Effect.runSync(Path.Path.pipe(Effect.provide(Path.layer)));
+//#endregion
+//#region src/sandbox/instance.ts
+var instance_exports = /* @__PURE__ */ __exportAll({
+	ID: () => ID,
+	Kind: () => Kind,
+	Ownership: () => Ownership,
+	PersistedError: () => PersistedError,
+	SandboxInstance: () => instance_exports,
+	Status: () => Status,
+	Usage: () => Usage,
+	fromColumn: () => fromColumn,
+	fromField: () => fromField,
+	isMountable: () => isMountable,
+	mountable: () => mountable,
+	toColumn: () => toColumn,
+	toField: () => toField
+});
+/**
+* A Sandbox instance is a **durable filesystem namespace** plus whatever compute
+* acts on it — a device in Unix terms, which exists whether or not anything has
+* it mounted. `Sandbox.Controller` is the only thing that creates,
+* stops, or destroys one; this module is just its identity and state model.
+*
+* The application ID is deliberately separate from the driver's own resource
+* locator: callers never parse a Vercel name or a Daytona ID, driver formats may
+* change, and a destroyed resource must stay identifiable in Project/Session
+* history. A missing resource is never recreated under an existing ID — a new
+* resource is a new namespace and therefore a new ID.
+*/
+const ID = Schema.String.pipe(Schema.brand("SandboxInstance.ID"), withStatics((schema) => ({
+	/**
+	* The host. Reserved, and never written to a column — see {@link toColumn}.
+	* It exists at runtime so nothing has to branch on "is this the host": it is
+	* what identity reads, what logs show, and what the transport cache keys on.
+	*/
+	local: schema.make("local"),
+	/** A fresh identity for a namespace nothing has named yet. */
+	create: () => schema.make(`sbx_${uuidv7()}`)
+})));
+/**
+* The storage boundary for namespace references, in one place.
+*
+* The host filesystem exists whether or not a row describes it, so it gets no
+* row and `NULL` is the only spelling of it — the Unix analogue is exact, since
+* `/` has no entry in the mount table you consult to find other mounts. That
+* makes a session or directory writable before any namespace is registered (the
+* foreign key is skipped on NULL), makes `SET sandbox_instance_id = NULL` a
+* meaningful "revert to the host", and leaves the host impossible to tombstone,
+* collect, or destroy, because there is nothing to point at.
+*
+* Two SQLite consequences ride on this and break correctness silently if missed:
+* unique indexes treat NULLs as distinct, so every uniqueness constraint
+* spanning a namespace column coalesces to `'local'`; and `= NULL` never
+* matches, so namespace-scoped reads use `IS`.
+*/
+const toColumn = (id) => id === ID.local ? null : id;
+const fromColumn = (value) => value === null ? ID.local : ID.make(value);
+/**
+* The same mapping for row models, whose optional columns are `Option` rather
+* than `null`. Kept beside {@link toColumn} so the boundary stays one place:
+* `toColumn`/`fromColumn` for SQL parameters, these for `Model.FieldOption`.
+*/
+const toField = (id) => id === ID.local ? Option.none() : Option.some(id);
+const fromField = (value) => Option.getOrElse(value, () => ID.local);
+/**
+* Filesystem-class taxonomy, mirroring Unix: disk, tmpfs/procfs, NFS/CIFS.
+* Stored on the row rather than derived from the registered driver, so reading
+* an instance never depends on the registry — which matters most when a driver
+* is *not* configured and you need to list or clean up its rows.
+*/
+const Kind = Schema.Literals([
+	"local",
+	"virtual",
+	"remote"
+]);
+const Ownership = Schema.Literals(["managed", "external"]);
+/**
+* Lifecycle state, in ZFS pool vocabulary. This is the **last observed** value,
+* not live driver truth: Daytona auto-stops and auto-archives, Vercel sandboxes
+* expire on their own timeout, so drift is normal. `stateObservedAt` carries the
+* freshness and `Controller.refresh` updates it without waking anything.
+*
+* `removed` and `unavail` are deliberately distinct. `removed` means we deleted
+* it; `unavail` means the driver claims it is gone. A "not found" is frequently a
+* misclassification — wrong region, wrong API url, a revoked key answering 404,
+* eventual consistency right after create — so it must never be recorded as if we
+* had destroyed the resource ourselves.
+*/
+const Status = Schema.Literals([
+	"provisioning",
+	"online",
+	"offline",
+	"suspending",
+	"removing",
+	"removed",
+	"unavail",
+	"faulted"
+]);
+/**
+* The statuses a `mount` may proceed from. This is the predicate every
+* conditional write depends on, so it is enumerated once here rather than
+* restated as prose at each call site.
+*
+* `offline` qualifies because mounting wakes.
+* `faulted` qualifies because a fault is a *usability* condition, not an identity one — see {@link Status}.
+*
+* There is no `resuming`: it would exist to be observed by nothing, since
+* mounting wakes, `offline` is already mountable, and waking is not destructive
+* so it needs no claim. `suspending` and `removing` stay because they *are*
+* compare-and-set claims, blocking a concurrent mount mid-destruction.
+*/
+const mountable = /* @__PURE__ */ new Set([
+	"online",
+	"offline",
+	"faulted"
+]);
+const isMountable = (status) => mountable.has(status);
+/**
+* Reference state, derived — never stored. `busy` carries its `umount` meaning:
+* something holds this and destruction must not proceed unforced.
+*
+* `pinned` is the kernel sense of the word: never reclaimable. It short-circuits
+* counting entirely for instances that cannot be stopped or destroyed (the local
+* host), which is what keeps them out of any future collector by construction
+* rather than by an ownership check happening to catch them.
+*/
+const Usage = Schema.Literals([
+	"idle",
+	"busy",
+	"pinned"
+]);
+/** Sanitized driver failure. The only error shape allowed to be persisted or logged. */
+const PersistedError = Schema.Struct({
+	name: Schema.String,
+	message: Schema.String,
+	code: Schema.optional(Schema.String)
+});
+//#endregion
+//#region src/sandbox/fs/filesystem.ts
+var filesystem_exports = /* @__PURE__ */ __exportAll({
+	FileSystemError: () => FileSystemError,
+	OperationUnsupportedError: () => OperationUnsupportedError,
+	SandboxFileSystem: () => filesystem_exports,
+	Service: () => Service$1,
+	fromProvider: () => fromProvider,
+	isNotFoundError: () => isNotFoundError,
+	validateRmOptions: () => validateRmOptions,
+	withCwd: () => withCwd$1
+});
+/**
+* The runtime filesystem contract, independent of any backend.
+*
+* Two surfaces, deliberately:
+* - {@link Provider} is what a backend implements — plain promises that reject,
+*   matching every SDK we wrap.
+* - {@link Interface} is what the harness consumes — Effect with a typed error
+*   channel and tracing spans. {@link fromProvider} bridges the two exactly
+*   once, so no consumer ever writes `Effect.tryPromise` against a filesystem.
+*
+* Implementations:
+* - Local:
+* implement it over a VFS (`./local`);
+* local filesystem use OS primitives; hence have broader filesytem capabilities.
+*
+* - Remote:
+* implement it over a provider (`./remote`).
+* remote filesytems depends on the interface provided by the remote provider; hence can have limited filesytem capabilities.
+*
+* `isFile`/`isDirectory` are required booleans; size, mtime, and isSymbolicLink are omitted when the
+* backend cannot report them — never fabricated.
+*
+* **Paths are POSIX, and the harness is Unix-only (for now!).** Every path uses `/`
+* separators on both the host and inside a sandbox — Windows is not supported,
+* so no translation layer exists. Consumers must use the shared Effect POSIX
+* path implementation, never the platform default, or a host running the harness would
+* impose its own flavour on a remote sandbox's paths. Relative paths resolve
+* against the backend's configured `cwd`.
+*/
+var OperationUnsupportedError = class extends Schema.TaggedError()("OperationUnsupportedError", {
+	operation: Schema.String,
+	message: Schema.String
+}) {};
+/** A backend operation failed. `cause` carries the provider's own rejection. */
+var FileSystemError = class extends Schema.TaggedError()("SandboxFileSystemError", {
+	method: Schema.String,
+	path: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/** Whether a provider failure means the path itself is definitively absent. */
+const isNotFoundError = (cause) => {
+	const code = cause?.code;
+	return code === "ENOENT" || code === "ENOTDIR";
+};
+/** The runtime filesystem service — the live {@link Interface} for the active sandbox. */
+var Service$1 = class extends Context.Service()("@codeworksh/harness/sandbox/fs/filesystem/Service") {};
+/**
+* Reject `rm` options a provider does not implement, before any mutation. Only
+* `recursive` and `force` are part of the contract; anything else is refused
+* loudly rather than silently ignored.
+*/
+const validateRmOptions = (options, operation = "rm") => Effect.suspend(() => {
+	for (const option of Object.keys(options ?? {})) {
+		if (option === "recursive" || option === "force") continue;
+		return Effect.fail(new OperationUnsupportedError({
+			operation,
+			message: `Unsupported rm option: ${option}`
+		}));
+	}
+	return Effect.void;
+});
+/**
+* Lift a {@link Provider} into the runtime {@link Interface}: one place that
+* converts rejections into {@link FileSystemError}, validates `rm` options,
+* creates missing parents on write, and names a tracing span per operation.
+*/
+const fromProvider = (provider) => {
+	const attempt = (method, path, run) => Effect.tryPromise({
+		try: run,
+		catch: (cause) => new FileSystemError({
+			method,
+			path,
+			cause
+		})
+	});
+	const writeCreatingParents = (path, content) => {
+		const write = attempt("writeFile", path, () => provider.writeFile(path, content));
+		const parent = posix.dirname(path);
+		return write.pipe(Effect.catch(() => attempt("mkdir", parent, () => provider.mkdir(parent, { recursive: true })).pipe(Effect.ignore, Effect.andThen(write))));
+	};
+	return {
+		readFile: Effect.fn("SandboxFileSystem.readFile")((path) => attempt("readFile", path, () => provider.readFile(path))),
+		readFileBuffer: Effect.fn("SandboxFileSystem.readFileBuffer")((path) => attempt("readFileBuffer", path, () => provider.readFileBuffer(path))),
+		writeFile: Effect.fn("SandboxFileSystem.writeFile")(writeCreatingParents),
+		stat: Effect.fn("SandboxFileSystem.stat")((path) => attempt("stat", path, () => provider.stat(path))),
+		...provider.lstat === void 0 ? {} : { lstat: Effect.fn("SandboxFileSystem.lstat")((path) => attempt("lstat", path, () => provider.lstat(path))) },
+		readdir: Effect.fn("SandboxFileSystem.readdir")((path) => attempt("readdir", path, () => provider.readdir(path))),
+		exists: Effect.fn("SandboxFileSystem.exists")((path) => attempt("exists", path, () => provider.exists(path))),
+		mkdir: Effect.fn("SandboxFileSystem.mkdir")((path, options) => attempt("mkdir", path, () => provider.mkdir(path, options))),
+		rm: Effect.fn("SandboxFileSystem.rm")((path, options) => validateRmOptions(options).pipe(Effect.andThen(attempt("rm", path, () => provider.rm(path, options)))))
+	};
+};
+/**
+* Bind a cwd-neutral filesystem to one mount's working directory.
+*
+* The counterpart of `Shell.withCwd`, and the reason relative paths mean the
+* same thing to both: a shared transport stays rooted at the namespace root, so
+* resolution happens here, per mount, rather than inside a VFS whose `chdir` is
+* global state two mounts would fight over.
+*/
+const withCwd$1 = (fs, cwd) => {
+	const at = (path) => posix.resolve(cwd, path);
+	return {
+		readFile: (path) => fs.readFile(at(path)),
+		readFileBuffer: (path) => fs.readFileBuffer(at(path)),
+		writeFile: (path, content) => fs.writeFile(at(path), content),
+		stat: (path) => fs.stat(at(path)),
+		readdir: (path) => fs.readdir(at(path)),
+		exists: (path) => fs.exists(at(path)),
+		mkdir: (path, options) => fs.mkdir(at(path), options),
+		rm: (path, options) => fs.rm(at(path), options),
+		...fs.lstat === void 0 ? {} : { lstat: (path) => fs.lstat(at(path)) }
+	};
+};
+//#endregion
+//#region src/sandbox/shell/shell.ts
+/**
+* The pluggable execution contract. Local sandboxes usually get a Shell through
+* just-bash over the local `Local.Vfs`; remote sandboxes provide their own
+* native Shell. Either way the rest of the harness depends only on this service
+* tag.
+*/
+var ShellError = class extends Schema.TaggedError()("ShellError", {
+	command: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/**
+* Mount-local shell factories are attached out-of-band so the public Shell
+* contract stays about command execution only.
+*
+* Most transports are safely shared and need only the cwd wrapper below.
+* Stateful in-process interpreters use this hook to construct one interpreter
+* per mount while retaining the underlying filesystem transport. This tag must
+* remain on the outermost wrapper consumed by {@link withCwd}; wrapper helpers
+* such as {@link fromExec} must propagate it when they return a new object.
+*/
+const mountFactories = /* @__PURE__ */ new WeakMap();
+const perMount = (transport, make) => {
+	mountFactories.set(transport, make);
+	return transport;
+};
+/**
+* POSIX single-quote escaping: wrap in `'…'` and rewrite each embedded quote as
+* `'\''`. Everything inside single quotes is literal to the shell, so this is
+* safe for arbitrary bytes.
+*/
+const quote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+/** Render an argument vector as one shell-safe command string. */
+const quoteArgv = (argv) => argv.map(quote).join(" ");
+/**
+* Resolve a per-command cwd against the sandbox cwd. Passing a relative cwd
+* straight to a host or remote process API would otherwise resolve it against
+* that API's own default, which need not be the filesystem's configured cwd.
+*/
+const resolveCwd = (base, cwd) => {
+	if (cwd === void 0 || posix.isAbsolute(cwd) || base === void 0) return cwd ?? base;
+	return posix.resolve(base, cwd);
+};
+/**
+* Complete a string-only backend: `execArgv` quotes the vector and runs it
+* through `exec`. Backends that spawn a real argument vector (Vercel) implement
+* `execArgv` themselves instead, so the args never meet a shell parser at all.
+*
+* `cwd` rides the options rather than a `cd <dir> && …` prefix. Every backend
+* we wrap takes a working directory natively, and the prefix form cannot tell a
+* failed `cd` from a failed command — both arrive as one exit code.
+*/
+const fromExec = (backend) => {
+	const wrapped = {
+		...backend,
+		execArgv: (argv, options) => backend.exec(quoteArgv(argv), options)
+	};
+	const mountFactory = mountFactories.get(backend);
+	return mountFactory === void 0 ? wrapped : perMount(wrapped, (cwd) => fromExec(mountFactory(cwd)));
+};
+/**
+* Bind a cwd-neutral backend to one mount's working directory.
+*
+* The transport is shared between mounts and must stay rooted at the namespace
+* root, so the directory cannot live inside it: two mounts at different
+* directories would otherwise see each other's. This wrapper is per mount, and
+* an operation-level `cwd` still wins — resolved against the mount's, so a
+* relative one means what it reads like.
+*/
+const withCwd = (backend, cwd) => {
+	const mounted = mountFactories.get(backend)?.(cwd) ?? backend;
+	const at = (options) => {
+		const resolvedCwd = resolveCwd(cwd, options?.cwd);
+		return {
+			...options,
+			...resolvedCwd === void 0 ? {} : { cwd: resolvedCwd }
+		};
+	};
+	const stream = mounted.stream;
+	return {
+		exec: (command, options) => mounted.exec(command, at(options)),
+		execArgv: (argv, options) => mounted.execArgv(argv, at(options)),
+		...stream === void 0 ? {} : { stream: (command, options) => stream(command, at(options)) }
+	};
+};
+/** Execution service — the live {@link ISandboxExe} for the active sandbox. */
+var Shell$1 = class extends Context.Service()("@codeworksh/harness/sandbox/shell/shell") {};
+//#endregion
+//#region src/sandbox/io.ts
+/**
+* `SandboxIO` is a **mount**: a filesystem, a shell, and the identity and
+* working directory they act on.
+*
+* It is the whole vocabulary a consumer needs. Project, Git, Copy, Location, and
+* every tool ask for `SandboxIO.FileSystem`, `SandboxIO.Shell`, and
+* `SandboxIO.Current` — never for a driver, an address, or a provider SDK — so
+* a host directory, an in-memory VFS, and a remote microVM are interchangeable
+* behind one contract.
+*
+* The mount neither creates nor destroys infrastructure. `SandboxInstance` is
+* the durable namespace it acts on — a device, which exists whether or not
+* anything has it mounted — and `Sandbox.Controller` is the only path that
+* creates, stops, or destroys one.
+*/
+/**
+* The filesystem tag. Re-exported here so consumers import one namespace —
+* Project, Git, Copy, and the runner ask for `SandboxIO.FileSystem`, never for
+* the module that happens to define it. Code *inside* `sandbox/` keeps importing
+* the tag directly, since `io.ts` is built on top of it.
+*/
+const FileSystem$1 = Service$1;
+/** The shell tag. Re-exported here so consumers import one namespace. */
+const Shell = Shell$1;
+/** Identity and working directory of the current mount. */
+var Current = class extends Context.Service()("@codeworksh/harness/sandbox/io/Current") {};
+/**
+* Resolve a mount's cwd without consulting ambient process state.
+*
+* The default is supplied by the namespace adapter:
+* provider metadata remotely, `/` for a virtual filesystem, and `process.cwd()` for the host adapter.
+* An explicit absolute cwd replaces it; a relative cwd is resolved inside it. The
+* result is therefore always the one concrete absolute path `Current` requires.
+*
+* A non-absolute default throws rather than failing typed. It is the one
+* defect-level guard in this module, and deliberately so:
+* Adapters reading a value from a provider call this inside their own error channel,
+* where the throw becomes their typed failure (see `EnvDaytona.mountCwd`).
+*/
+const resolveMountCwd = (defaultCwd, cwd) => {
+	if (!posix.isAbsolute(defaultCwd)) throw new TypeError(`Sandbox default cwd must be absolute: ${defaultCwd}`);
+	if (cwd === void 0) return posix.resolve(defaultCwd);
+	return posix.isAbsolute(cwd) ? posix.resolve(cwd) : posix.resolve(defaultCwd, cwd);
+};
+/** Open driver identity. Adding a driver never extends a union in core. */
+const Name = Schema.String.check(Schema.isNonEmpty()).pipe(Schema.brand("SandboxDriver.Name"));
+/** A path whose coordinate system is the mounted namespace. */
+const AbsolutePath = Schema.String.check(Schema.isStartsWith("/")).pipe(Schema.brand("SandboxDriver.AbsolutePath"));
+const RuntimeConfigBase = Schema.Struct({ defaultCwd: AbsolutePath });
+const erase = (value) => ({
+	name: value.name,
+	kind: value.kind,
+	capabilities: value.capabilities,
+	createConfigCodec: value.createConfigCodec,
+	runtimeConfigCodec: value.runtimeConfigCodec,
+	create: (input) => value.create({
+		instanceId: input.instanceId,
+		config: input.config
+	}),
+	...value.runtimeConfigFor === void 0 ? {} : { runtimeConfigFor: (input) => value.runtimeConfigFor({
+		providerResourceId: input.providerResourceId,
+		...input.overrides === void 0 ? {} : { overrides: input.overrides }
+	}) },
+	attach: (input) => value.attach(input),
+	...value.inspect === void 0 ? {} : { inspect: (input) => value.inspect(input) },
+	...value.wake === void 0 ? {} : { wake: (input) => value.wake(input) },
+	...value.stop === void 0 ? {} : { stop: (input) => value.stop(input) },
+	...value.destroy === void 0 ? {} : { destroy: (input) => value.destroy(input) }
+});
+/** Define the default export of a loadable sandbox package. */
+const defineModule = (value) => ({
+	...value,
+	name: Name.make(value.name)
+});
+/** Construct a driver and its registry contribution. */
+const driver = (value) => Object.assign(value, {
+	registered: erase(value),
+	apiVersion: 1,
+	source: "builtin"
+});
+/** Attach trusted origin metadata without changing the driver implementation. */
+const withSource = (registration, source) => ({
+	...registration,
+	source
+});
+//#endregion
+//#region src/sandbox/errors.ts
+/**
+* Lifecycle errors are confined to the control plane. Once a mount succeeds,
+* consumers continue to see only FileSystemError and ShellError.
+*/
+var SandboxNotFoundError = class extends Schema.TaggedError()("SandboxNotFoundError", { id: ID }) {};
+var SandboxDriverNotRegisteredError = class extends Schema.TaggedError()("SandboxDriverNotRegisteredError", {
+	driver: Schema.String,
+	registered: Schema.optional(Schema.Array(Schema.String))
+}) {};
+var SandboxDriverRegistrationError = class extends Schema.TaggedError()("SandboxDriverRegistrationError", {
+	driver: Schema.String,
+	reason: Schema.String
+}) {};
+const SandboxDriverLoadPhase = Schema.Literals([
+	"resolve",
+	"import",
+	"module",
+	"api-version",
+	"options",
+	"factory",
+	"registration"
+]);
+var SandboxDriverLoadError = class extends Schema.TaggedError()("SandboxDriverLoadError", {
+	specifier: Schema.String,
+	phase: SandboxDriverLoadPhase,
+	driver: Schema.optional(Schema.String),
+	reason: Schema.String
+}) {};
+var SandboxBusyError = class extends Schema.TaggedError()("SandboxBusyError", {
+	id: ID,
+	refCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+var SandboxMustBeStoppedError = class extends Schema.TaggedError()("SandboxMustBeStoppedError", {
+	id: ID,
+	status: Status
+}) {};
+var SandboxRemovedError = class extends Schema.TaggedError()("SandboxRemovedError", {
+	id: ID,
+	removedAt: Schema.optional(Schema.DateTimeUtc)
+}) {};
+var SandboxUnavailError = class extends Schema.TaggedError()("SandboxUnavailError", {
+	id: ID,
+	reason: Schema.String
+}) {};
+var SandboxUnsupportedError = class extends Schema.TaggedError()("SandboxUnsupportedError", {
+	id: Schema.optional(ID),
+	driver: Schema.String,
+	operation: Schema.String
+}) {};
+var SandboxTransitionConflictError = class extends Schema.TaggedError()("SandboxTransitionConflictError", {
+	id: ID,
+	expected: Schema.Array(Status),
+	actual: Status
+}) {};
+/**
+* A lifecycle failure safe to serialize, persist, or log.
+*
+* The raw SDK defect is deliberately absent from the schema. It is retained on
+* a non-enumerable symbol by {@link providerError}, so Effect's default
+* formatting and JSON serialization cannot expose credentials nested in it.
+*/
+var SandboxProviderError = class extends Schema.TaggedError()("SandboxProviderError", {
+	driver: Schema.String,
+	operation: Schema.String,
+	sanitized: PersistedError
+}) {};
+const rawCause = Symbol("@codework/sandbox/provider/error/raw/cause");
+const missingResource = Symbol("@codework/sandbox/provider/error/missing/resource");
+const providerErrorCause = (error) => error[rawCause];
+const providerErrorIsNotFound = (error) => error[missingResource] === true;
+const REDACTED = "<redacted>";
+/**
+* Conservative text redaction shared by every driver sanitizer.
+*
+* Disclaimer: This can really leak. Its never safe
+*
+* Configured secrets are removed exactly. Common authorization/header and URL
+* query shapes are masked as a second line of defence for values the caller did
+* not explicitly seed.
+*
+* Note: add support for diff regex as needed.
+*/
+const makeRedactor = (secrets = []) => {
+	const configured = [...secrets].filter((secret) => secret.length > 0).sort((a, b) => b.length - a.length);
+	return (value) => {
+		let redacted = value;
+		for (const secret of configured) redacted = redacted.replaceAll(secret, REDACTED);
+		return redacted.replace(/\b(authorization\s*:\s*(?:bearer|basic)\s+)[^\s,;]+/gi, `$1${REDACTED}`).replace(/\b((?:api[-_]?key|token|secret|password)\s*[=:]\s*)[^\s,;&]+/gi, `$1${REDACTED}`).replace(/([?&](?:access_token|api_key|token|secret|password)=)[^&#\s]+/gi, `$1${REDACTED}`).replace(/\b(?:gh[opsu]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g, REDACTED);
+	};
+};
+const errorCode = (cause) => {
+	if (typeof cause !== "object" || cause === null || !("code" in cause)) return void 0;
+	const code = cause.code;
+	return typeof code === "string" || typeof code === "number" ? String(code) : void 0;
+};
+const errorName = (cause) => {
+	if (typeof cause !== "object" || cause === null || !("name" in cause) || typeof cause.name !== "string") return "Error";
+	return cause.name;
+};
+const errorMessage = (cause) => {
+	if (typeof cause === "object" && cause !== null && "message" in cause && typeof cause.message === "string") return cause.message;
+	return String(cause);
+};
+const sanitizeError = (cause, redact = makeRedactor()) => {
+	const code = errorCode(cause);
+	return {
+		name: redact(errorName(cause)),
+		message: redact(errorMessage(cause)),
+		...code === void 0 ? {} : { code: redact(code) }
+	};
+};
+const providerError = (input) => {
+	const redact = input.redact ?? makeRedactor();
+	const error = new SandboxProviderError({
+		driver: input.driver,
+		operation: input.operation,
+		sanitized: (input.sanitize ?? sanitizeError)(input.cause, redact)
+	});
+	Object.defineProperty(error, rawCause, {
+		configurable: false,
+		enumerable: false,
+		value: input.cause,
+		writable: false
+	});
+	Object.defineProperty(error, missingResource, {
+		configurable: false,
+		enumerable: false,
+		value: input.notFound === true,
+		writable: false
+	});
+	return error;
+};
+//#endregion
+//#region src/sandbox/public/driver.ts
+var driver_exports = /* @__PURE__ */ __exportAll({
+	AbsolutePath: () => AbsolutePath,
+	Name: () => Name,
+	RuntimeConfigBase: () => RuntimeConfigBase,
+	SandboxDriver: () => driver_exports,
+	apiVersion: () => 1,
+	driver: () => driver,
+	module: () => defineModule
+});
+//#endregion
+//#region src/sandbox/public/io.ts
+var io_exports = /* @__PURE__ */ __exportAll({
+	Current: () => Current,
+	FileSystem: () => FileSystem$1,
+	SandboxIO: () => io_exports,
+	Shell: () => Shell
+});
+//#endregion
+//#region src/sandbox/error.ts
+var error_exports = /* @__PURE__ */ __exportAll({
+	SandboxProviderError: () => SandboxProviderError,
+	makeRedactor: () => makeRedactor,
+	providerError: () => providerError,
+	providerErrorCause: () => providerErrorCause,
+	providerErrorIsNotFound: () => providerErrorIsNotFound,
+	sanitizeError: () => sanitizeError
+});
+//#endregion
+//#region src/sandbox/resource.ts
+var resource_exports = /* @__PURE__ */ __exportAll({
+	SandboxResource: () => resource_exports,
+	Service: () => Service
+});
+/**
+* The driver's own locator for the attached resource — a Vercel sandbox name, a
+* Daytona sandbox id.
+*
+* Deliberately *not* on `SandboxIO.Current`: consumers never parse one,
+* and keeps it separate from the application id precisely so a driver's format can
+* change without touching identity.
+*
+* It exists for the control plane, which records it as `provider_resource_id`,
+* and for tests that reattach to the same resource.
+*
+* One tag for every driver rather than one per driver. A mount has exactly one
+* driver, so there is nothing to disambiguate, and the control plane has to read
+* the locator without knowing which driver produced it — keeps the
+* driver name open, so anything keyed on a closed `"vercel" | "daytona"` set is
+* a bug waiting for the third driver.
+*/
+var Service = class extends Context.Service()("@codeworksh/harness/sandbox/resource/Service") {};
+//#endregion
+//#region src/sandbox/public/shell.ts
+var shell_exports = /* @__PURE__ */ __exportAll({
+	Shell: () => Shell$1,
+	ShellError: () => ShellError,
+	fromExec: () => fromExec,
+	quote: () => quote,
+	quoteArgv: () => quoteArgv
+});
+//#endregion
+export { isMountable as $, FileSystem$1 as A, withCwd as B, Name as C, erase as D, driver as E, fromExec as F, withCwd$1 as G, filesystem_exports as H, perMount as I, Ownership as J, ID as K, quote as L, resolveMountCwd as M, Shell$1 as N, withSource as O, ShellError as P, instance_exports as Q, quoteArgv as R, AbsolutePath as S, defineModule as T, fromProvider as U, Service$1 as V, isNotFoundError as W, Status as X, PersistedError as Y, fromField as Z, SandboxUnsupportedError as _, io_exports as a, NonNegativeCost as at, providerErrorIsNotFound as b, SandboxDriverLoadError as c, isAikitToolCallTerminalPart as ct, SandboxMustBeStoppedError as d, validateAikitMessage as dt, toColumn as et, SandboxNotFoundError as f, validateAikitToolCallTerminalPart as ft, SandboxUnavailError as g, SandboxTransitionConflictError as h, error_exports as i, DateTimeUtcFromMillis as it, Shell as j, Current as k, SandboxDriverNotRegisteredError as l, optional as lt, SandboxRemovedError as m, withStatics as mt, Service as n, posix as nt, driver_exports as o, NonNegativeInt as ot, SandboxProviderError as p, validateAikitUserMessage as pt, Kind as q, resource_exports as r, AbsolutePath$1 as rt, SandboxBusyError as s, isAikitAssistantMessage as st, shell_exports as t, toField as tt, SandboxDriverRegistrationError as u, validateAikitAssistantMessage as ut, makeRedactor as v, RuntimeConfigBase as w, sanitizeError as x, providerError as y, resolveCwd as z };
+
+//# sourceMappingURL=sandbox-QCmZ3UhD.mjs.map