@decocms/sandbox-controller 0.7.2 → 0.8.1

package/dist/index.d.ts

@@ -3730,6 +3730,7 @@ interface FreestyleSandboxProviderOptions {
     client?: Freestyle;
 }
 declare class FreestyleSandboxProvider implements SandboxProvider {
+    private readonly apiKey;
     private readonly freestyle;
     private readonly lookupClient;
     private readonly image;
@@ -3740,6 +3741,8 @@ declare class FreestyleSandboxProvider implements SandboxProvider {
     private readonly timeDaemonRequest;
     private readonly inflight;
     private readonly snapshotInflight;
+    /** Snapshots are immutable once built, so one positive lookup is enough. */
+    private readonly knownSnapshots;
     private readonly lookups;
     private readonly releaseTimers;
     constructor(opts: FreestyleSandboxProviderOptions);
@@ -3749,15 +3752,34 @@ declare class FreestyleSandboxProvider implements SandboxProvider {
     private find;
     private remember;
     /**
-     * A snapshot of a VM with both images already pulled, so a sandbox boots in
-     * seconds instead of pulling ~2GB. One per image pair; built on first use.
+     * A snapshot of a VM with both containers RUNNING and the daemon healthy but
+     * unclaimed, so a fork resumes a live daemon (Freestyle snapshots memory) and
+     * is configured with one request instead of booted. One per image pair.
      */
+    /**
+     * Build this image's base snapshot now, so the first sandbox after an image
+     * bump boots from it instead of waiting on the pull. Never throws.
+     */
+    warm(): Promise<void>;
     private baseSnapshot;
+    /**
+     * The bearer the snapshot's daemon boots with. Every fork shares it until its
+     * first config rotates it, so it is derived (any replica can compute it) and
+     * never stored.
+     */
+    private sentinelToken;
+    private startContainers;
     private snapshotExists;
     private run;
     ensure(id: SandboxId, opts?: EnsureOptions): Promise<Sandbox>;
     private resume;
     private create;
+    /**
+     * The fork's first config: swap the snapshot's sentinel bearer for this
+     * sandbox's own, retried until the new domain routes. A 401 means an earlier
+     * attempt already rotated (its response was lost), so finish with the new one.
+     */
+    private claimDaemon;
     /** A plan that caps autoDelete lower answers 400; omitting it gets the cap. */
     private createVm;
     private configPayload;

package/dist/index.js

@@ -4475,7 +4475,7 @@ function tenantPoolReader(store, cluster, { refreshMs = DEFAULT_TENANT_POOL_REFR
 }
 
 // ../sandbox/server/provider/freestyle.ts
-import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash3, createHmac, randomBytes as randomBytes2 } from "crypto";
 
 // ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/errors.js
 var FreestyleApiError = class _FreestyleApiError extends Error {
@@ -6759,7 +6759,7 @@ var Freestyle = class {
 // ../sandbox/package.json
 var package_default = {
   name: "@decocms/sandbox",
-  version: "1.80.4",
+  version: "1.85.1",
   private: true,
   type: "module",
   description: "Sandbox runtime for isolated Studio tool execution",
@@ -6853,6 +6853,7 @@ var ORG_KEY = "studio-org-id";
 var USER_KEY = "studio-user-id";
 var DAEMON_BOOT_TIMEOUT_MS = 12e4;
 var HEALTH_POLL_MS = 500;
+var CLAIM_RETRY_MS = 100;
 var HEALTH_PROBE_TIMEOUT_MS2 = 5e3;
 var IMAGE_PULL_TIMEOUT_MS = 3e5;
 var LOOKUP_TTL_MS = 5 * 6e4;
@@ -6861,6 +6862,7 @@ var LOOKUP_MAX = 5e3;
 var WATCH_TIMEOUT_MS = 5 * 6e4;
 var LOOKUP_TIMEOUT_MS = 3e3;
 var FreestyleSandboxProvider = class {
+  apiKey;
   freestyle;
   lookupClient;
   image;
@@ -6871,9 +6873,12 @@ var FreestyleSandboxProvider = class {
   timeDaemonRequest;
   inflight = new Inflight();
   snapshotInflight = new Inflight();
+  /** Snapshots are immutable once built, so one positive lookup is enough. */
+  knownSnapshots = /* @__PURE__ */ new Set();
   lookups = /* @__PURE__ */ new Map();
   releaseTimers = /* @__PURE__ */ new Map();
   constructor(opts) {
+    this.apiKey = opts.apiKey;
     this.freestyle = opts.client ?? new Freestyle({ apiKey: opts.apiKey });
     this.lookupClient = opts.client ?? new Freestyle({
       apiKey: opts.apiKey,
@@ -6934,15 +6939,30 @@ var FreestyleSandboxProvider = class {
   }
   // ---- Base snapshot --------------------------------------------------------
   /**
-   * A snapshot of a VM with both images already pulled, so a sandbox boots in
-   * seconds instead of pulling ~2GB. One per image pair; built on first use.
+   * A snapshot of a VM with both containers RUNNING and the daemon healthy but
+   * unclaimed, so a fork resumes a live daemon (Freestyle snapshots memory) and
+   * is configured with one request instead of booted. One per image pair.
    */
+  /**
+   * Build this image's base snapshot now, so the first sandbox after an image
+   * bump boots from it instead of waiting on the pull. Never throws.
+   */
+  async warm() {
+    await this.baseSnapshot().catch(
+      (err) => console.warn(`[${LOG_LABEL2}] base snapshot warm failed: ${errMsg2(err)}`)
+    );
+  }
   baseSnapshot() {
     const { image, sidecarImage } = this;
     const slug = `studio-sandbox-${createHash3("sha256").update(`${image}
-${sidecarImage}`).digest("hex").slice(0, 16)}`;
+${sidecarImage}
+running`).digest("hex").slice(0, 16)}`;
+    if (this.knownSnapshots.has(slug)) return Promise.resolve(slug);
     return this.snapshotInflight.run(slug, async () => {
-      if (await this.snapshotExists(slug)) return slug;
+      if (await this.snapshotExists(slug)) {
+        this.knownSnapshots.add(slug);
+        return slug;
+      }
       console.log(`[${LOG_LABEL2}] building base snapshot ${slug} for ${image}`);
       const { vm } = await this.freestyle.vms.create({
         ttlSeconds: 1800,
@@ -6958,7 +6978,14 @@ ${sidecarImage}`).digest("hex").slice(0, 16)}`;
           `docker pull -q ${shellQuote(image)} && docker pull -q ${shellQuote(sidecarImage)}`,
           { timeoutMs: IMAGE_PULL_TIMEOUT_MS }
         );
+        await this.startContainers(vm, this.sentinelToken(slug));
+        await this.run(
+          vm,
+          `for i in $(seq 1 240); do curl -sf -o /dev/null http://127.0.0.1:${DAEMON_PORT}/health && exit 0; sleep 0.5; done; exit 1`,
+          { timeoutMs: DAEMON_BOOT_TIMEOUT_MS + 1e4 }
+        );
         await vm.snapshot({ slug });
+        this.knownSnapshots.add(slug);
       } catch (err) {
         if (!await this.snapshotExists(slug)) throw err;
       } finally {
@@ -6968,6 +6995,34 @@ ${sidecarImage}`).digest("hex").slice(0, 16)}`;
       return slug;
     });
   }
+  /**
+   * The bearer the snapshot's daemon boots with. Every fork shares it until its
+   * first config rotates it, so it is derived (any replica can compute it) and
+   * never stored.
+   */
+  sentinelToken(slug) {
+    return createHmac("sha256", this.apiKey).update(`daemon-sentinel:${slug}`).digest("hex").slice(0, 48);
+  }
+  async startContainers(vm, token) {
+    const env = {
+      DAEMON_TOKEN: token,
+      APP_ROOT: WORKDIR,
+      PROXY_PORT: String(DAEMON_PORT),
+      ORGFS_SIDECAR_CONFIG_PATH: `${CTL_DIR}/config.json`,
+      ORGFS_SIDECAR_STATUS_PATH: `${CTL_DIR}/status.json`
+    };
+    const envFlags = Object.keys(env).map((k) => `-e ${shellQuote(k)}`).join(" ");
+    await this.run(
+      vm,
+      `sudo sh -c ${shellQuote(HOST_SETUP)} && docker run -d --name ${SIDECAR} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${WORKDIR} -e ORGFS_FEED_IDLE_MS=60000 -v ${HOST_ORG_DIR}:${WORKDIR}/org:rshared -v ${HOST_CTL_DIR}:${CTL_DIR} ${shellQuote(this.sidecarImage)}`,
+      { timeoutMs: IMAGE_PULL_TIMEOUT_MS }
+    );
+    await this.run(
+      vm,
+      `docker run -d --name ${CONTAINER} --restart=always -p ${DAEMON_PORT}:${DAEMON_PORT} -v ${HOST_ORG_DIR}:${WORKDIR}/org:rslave -v ${HOST_CTL_DIR}:${CTL_DIR} ${envFlags} ${shellQuote(this.image)}`,
+      { env, timeoutMs: IMAGE_PULL_TIMEOUT_MS }
+    );
+  }
   async snapshotExists(slug) {
     try {
       await this.freestyle.vms.snapshots.get(slug);
@@ -7032,7 +7087,19 @@ ${sidecarImage}`).digest("hex").slice(0, 16)}`;
     }
   }
   async create(handle, opts) {
+    if (opts.env && Object.keys(opts.env).length > 0) {
+      throw new Error(
+        `${LOG_LABEL2}: per-sandbox container env is not supported`
+      );
+    }
+    const ms = {};
+    let last = Date.now();
+    const step = (name) => {
+      ms[name] = Date.now() - last;
+      last = Date.now();
+    };
     const snapshotId = await this.baseSnapshot();
+    step("snapshot");
     const token = randomBytes2(24).toString("hex");
     const { vm } = await this.createVm({
       snapshotId,
@@ -7056,35 +7123,23 @@ ${sidecarImage}`).digest("hex").slice(0, 16)}`;
         ]
       }
     });
+    step("vm-fork");
     const daemon = { url: this.daemonUrl(handle), token };
     try {
-      const env = {
-        ...opts.env,
-        DAEMON_TOKEN: token,
-        DAEMON_BOOT_ID: crypto.randomUUID(),
-        APP_ROOT: WORKDIR,
-        PROXY_PORT: String(DAEMON_PORT),
-        ORGFS_SIDECAR_CONFIG_PATH: `${CTL_DIR}/config.json`,
-        ORGFS_SIDECAR_STATUS_PATH: `${CTL_DIR}/status.json`
-      };
-      const envFlags = Object.keys(env).map((k) => `-e ${shellQuote(k)}`).join(" ");
-      await this.run(
-        vm,
-        `sudo sh -c ${shellQuote(HOST_SETUP)} && docker run -d --name ${SIDECAR} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${WORKDIR} -e ORGFS_FEED_IDLE_MS=60000 -v ${HOST_ORG_DIR}:${WORKDIR}/org:rshared -v ${HOST_CTL_DIR}:${CTL_DIR} ${shellQuote(this.sidecarImage)}`,
-        { timeoutMs: IMAGE_PULL_TIMEOUT_MS }
-      );
-      await this.run(
-        vm,
-        `docker run -d --name ${CONTAINER} --restart=always -p ${DAEMON_PORT}:${DAEMON_PORT} -v ${HOST_ORG_DIR}:${WORKDIR}/org:rslave -v ${HOST_CTL_DIR}:${CTL_DIR} ${envFlags} ${shellQuote(this.image)}`,
-        { env, timeoutMs: IMAGE_PULL_TIMEOUT_MS }
+      await this.claimDaemon(
+        daemon.url,
+        this.sentinelToken(snapshotId),
+        token,
+        this.configPayload(opts) ?? {}
       );
-      await this.waitForDaemon(daemon.url);
-      await postConfig(daemon.url, token, this.configPayload(opts) ?? {});
+      step("claim");
       if (opts.orgFsConfigJson) {
         await postOrgFsConfig(daemon.url, token, opts.orgFsConfigJson).catch(
           (err) => console.warn(`[${LOG_LABEL2}] org-fs relay failed`, err)
         );
       }
+      step("orgfs-config");
+      console.log(`[${LOG_LABEL2}] create ${handle} ms=${JSON.stringify(ms)}`);
     } catch (err) {
       await vm.delete().catch(() => {
       });
@@ -7093,6 +7148,30 @@ ${sidecarImage}`).digest("hex").slice(0, 16)}`;
     }
     this.remember(handle, { vm, daemon });
   }
+  /**
+   * The fork's first config: swap the snapshot's sentinel bearer for this
+   * sandbox's own, retried until the new domain routes. A 401 means an earlier
+   * attempt already rotated (its response was lost), so finish with the new one.
+   */
+  async claimDaemon(url, sentinel, token, payload) {
+    const deadline = Date.now() + DAEMON_BOOT_TIMEOUT_MS;
+    for (; ; ) {
+      try {
+        await postConfig(url, sentinel, payload, { rotateToken: token });
+        return;
+      } catch (err) {
+        if (err instanceof ConfigRequestError && err.status === 401) {
+          await postConfig(url, token, payload);
+          return;
+        }
+        if (err instanceof ConfigRequestError && (err.status === 400 || err.status === 409)) {
+          throw err;
+        }
+        if (Date.now() > deadline) throw err;
+        await delay(CLAIM_RETRY_MS);
+      }
+    }
+  }
   /** A plan that caps autoDelete lower answers 400; omitting it gets the cap. */
   async createVm(opts) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/sandbox-controller",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Runs Studio agent sandboxes on Kubernetes, and serves them to a remote Studio.",
   "repository": {
     "type": "git",