@enclave-run/sdk 0.2.0 → 0.4.0

package/dist/index.d.mts

@@ -2834,8 +2834,6 @@ interface components {
             network?: components["schemas"]["SandboxNetworkConfig"];
             /** @description Optional region code for sandbox placement. When omitted, Enclave automatically selects a placement region. */
             region?: string;
-            /** @description Secure all system communication with sandbox */
-            secure?: boolean;
             /** @description Identifier of the required template */
             templateID: string;
             /**
@@ -4350,6 +4348,15 @@ type StartRequest = Message<"process.StartRequest"> & {
      * @generated from field: optional bool stdin = 4;
      */
     stdin?: boolean;
+    /**
+     * A retried Start with the same key attaches to the process the first
+     * Start launched (replaying its retained output) instead of running the
+     * command again. Keys are kept while the process runs and for a short
+     * retention window after it exits.
+     *
+     * @generated from field: optional string idempotency_key = 5;
+     */
+    idempotencyKey?: string;
 };
 /**
  * Describes the message process.StartRequest.
@@ -4418,6 +4425,15 @@ type ProcessEvent = Message<"process.ProcessEvent"> & {
         case: undefined;
         value?: undefined;
     };
+    /**
+     * Per-process position of a data or end event, starting at 1. Start and
+     * keepalive events carry 0. A client that reconnects with
+     * ConnectRequest.after_sequence receives every retained event after it;
+     * a jump in the sequence means older output was evicted.
+     *
+     * @generated from field: uint64 sequence = 5;
+     */
+    sequence: bigint;
 };
 /**
  * @generated from message process.ProcessEvent.StartEvent
@@ -4686,6 +4702,15 @@ type ConnectRequest = Message<"process.ConnectRequest"> & {
      * @generated from field: process.ProcessSelector process = 1;
      */
     process?: ProcessSelector;
+    /**
+     * Replay retained events with a greater sequence before streaming live
+     * ones. Unset streams live events only. An exited process stays
+     * connectable for a short retention window and always ends with its
+     * end event (exit code).
+     *
+     * @generated from field: optional uint64 after_sequence = 2;
+     */
+    afterSequence?: bigint;
 };
 /**
  * Describes the message process.ConnectRequest.
@@ -7283,12 +7308,6 @@ interface SandboxOpts extends ConnectionOpts {
      * @default 300_000 // 5 minutes
      */
     timeoutMs?: number;
-    /**
-     * Secure all traffic coming to the sandbox controller with auth token
-     *
-     * @default true
-     */
-    secure?: boolean;
     /**
      * Allow sandbox to access the internet. If set to `False`, it works the same as setting network `denyOut` to `[0.0.0.0/0]`.
      *
@@ -7905,6 +7924,12 @@ declare class Commands {
      * @internal
      */
     get supportsStdinClose(): boolean;
+    /**
+     * sbxd 1.1.0+ numbers process output and accepts idempotent starts, so a
+     * dropped command stream can be resumed without losing or repeating
+     * output, and a retried start never runs the command twice.
+     */
+    private get supportsProcessResume();
     /**
      * List all running commands and PTY sessions.
      *

package/dist/index.d.ts

@@ -2834,8 +2834,6 @@ interface components {
             network?: components["schemas"]["SandboxNetworkConfig"];
             /** @description Optional region code for sandbox placement. When omitted, Enclave automatically selects a placement region. */
             region?: string;
-            /** @description Secure all system communication with sandbox */
-            secure?: boolean;
             /** @description Identifier of the required template */
             templateID: string;
             /**
@@ -4350,6 +4348,15 @@ type StartRequest = Message<"process.StartRequest"> & {
      * @generated from field: optional bool stdin = 4;
      */
     stdin?: boolean;
+    /**
+     * A retried Start with the same key attaches to the process the first
+     * Start launched (replaying its retained output) instead of running the
+     * command again. Keys are kept while the process runs and for a short
+     * retention window after it exits.
+     *
+     * @generated from field: optional string idempotency_key = 5;
+     */
+    idempotencyKey?: string;
 };
 /**
  * Describes the message process.StartRequest.
@@ -4418,6 +4425,15 @@ type ProcessEvent = Message<"process.ProcessEvent"> & {
         case: undefined;
         value?: undefined;
     };
+    /**
+     * Per-process position of a data or end event, starting at 1. Start and
+     * keepalive events carry 0. A client that reconnects with
+     * ConnectRequest.after_sequence receives every retained event after it;
+     * a jump in the sequence means older output was evicted.
+     *
+     * @generated from field: uint64 sequence = 5;
+     */
+    sequence: bigint;
 };
 /**
  * @generated from message process.ProcessEvent.StartEvent
@@ -4686,6 +4702,15 @@ type ConnectRequest = Message<"process.ConnectRequest"> & {
      * @generated from field: process.ProcessSelector process = 1;
      */
     process?: ProcessSelector;
+    /**
+     * Replay retained events with a greater sequence before streaming live
+     * ones. Unset streams live events only. An exited process stays
+     * connectable for a short retention window and always ends with its
+     * end event (exit code).
+     *
+     * @generated from field: optional uint64 after_sequence = 2;
+     */
+    afterSequence?: bigint;
 };
 /**
  * Describes the message process.ConnectRequest.
@@ -7283,12 +7308,6 @@ interface SandboxOpts extends ConnectionOpts {
      * @default 300_000 // 5 minutes
      */
     timeoutMs?: number;
-    /**
-     * Secure all traffic coming to the sandbox controller with auth token
-     *
-     * @default true
-     */
-    secure?: boolean;
     /**
      * Allow sandbox to access the internet. If set to `False`, it works the same as setting network `denyOut` to `[0.0.0.0/0]`.
      *
@@ -7905,6 +7924,12 @@ declare class Commands {
      * @internal
      */
     get supportsStdinClose(): boolean;
+    /**
+     * sbxd 1.1.0+ numbers process output and accepts idempotent starts, so a
+     * dropped command stream can be resumed without losing or repeating
+     * output, and a retried start never runs the command twice.
+     */
+    private get supportsProcessResume();
     /**
      * List all running commands and PTY sessions.
      *

package/dist/index.js

@@ -128,7 +128,7 @@ var import_openapi_fetch = __toESM(require("openapi-fetch"));
 var import_platform2 = __toESM(require("platform"));
 
 // package.json
-var version = "0.2.0";
+var version = "0.4.0";
 
 // src/utils.ts
 var import_platform = __toESM(require("platform"));
@@ -1000,6 +1000,7 @@ var ENVD_DEBUG_FALLBACK = "99.99.99";
 var ENVD_COMMANDS_STDIN = "0.3.0";
 var ENVD_DEFAULT_USER = "0.4.0";
 var ENVD_ENVD_CLOSE = "0.5.2";
+var ENVD_PROCESS_RESUME = "1.1.0";
 
 // src/envd/rpc.ts
 function handleRpcError(err) {
@@ -2673,23 +2674,121 @@ var Git = class {
 var import_connect_web = require("@connectrpc/connect-web");
 
 // src/sandbox/commands/index.ts
-var import_connect5 = require("@connectrpc/connect");
+var import_connect6 = require("@connectrpc/connect");
 var import_compare_versions3 = require("compare-versions");
 
 // src/envd/process/process_pb.ts
 var import_codegenv22 = require("@bufbuild/protobuf/codegenv2");
-var file_process_process = /* @__PURE__ */ (0, import_codegenv22.fileDesc)("ChVwcm9jZXNzL3Byb2Nlc3MucHJvdG8SB3Byb2Nlc3MiSgoDUFRZEh8KBHNpemUYASABKAsyES5wcm9jZXNzLlBUWS5TaXplGiIKBFNpemUSDAoEY29scxgBIAEoDRIMCgRyb3dzGAIgASgNIqEBCg1Qcm9jZXNzQ29uZmlnEgsKA2NtZBgBIAEoCRIMCgRhcmdzGAIgAygJEi4KBGVudnMYAyADKAsyIC5wcm9jZXNzLlByb2Nlc3NDb25maWcuRW52c0VudHJ5EhAKA2N3ZBgEIAEoCUgAiAEBGisKCUVudnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBQgYKBF9jd2QiDQoLTGlzdFJlcXVlc3QiXAoLUHJvY2Vzc0luZm8SJgoGY29uZmlnGAEgASgLMhYucHJvY2Vzcy5Qcm9jZXNzQ29uZmlnEgsKA3BpZBgCIAEoDRIQCgN0YWcYAyABKAlIAIgBAUIGCgRfdGFnIjcKDExpc3RSZXNwb25zZRInCglwcm9jZXNzZXMYASADKAsyFC5wcm9jZXNzLlByb2Nlc3NJbmZvIpcBCgxTdGFydFJlcXVlc3QSJwoHcHJvY2VzcxgBIAEoCzIWLnByb2Nlc3MuUHJvY2Vzc0NvbmZpZxIeCgNwdHkYAiABKAsyDC5wcm9jZXNzLlBUWUgAiAEBEhAKA3RhZxgDIAEoCUgBiAEBEhIKBXN0ZGluGAQgASgISAKIAQFCBgoEX3B0eUIGCgRfdGFnQggKBl9zdGRpbiJiCg1VcGRhdGVSZXF1ZXN0EikKB3Byb2Nlc3MYASABKAsyGC5wcm9jZXNzLlByb2Nlc3NTZWxlY3RvchIeCgNwdHkYAiABKAsyDC5wcm9jZXNzLlBUWUgAiAEBQgYKBF9wdHkiEAoOVXBkYXRlUmVzcG9uc2UirwMKDFByb2Nlc3NFdmVudBIxCgVzdGFydBgBIAEoCzIgLnByb2Nlc3MuUHJvY2Vzc0V2ZW50LlN0YXJ0RXZlbnRIABIvCgRkYXRhGAIgASgLMh8ucHJvY2Vzcy5Qcm9jZXNzRXZlbnQuRGF0YUV2ZW50SAASLQoDZW5kGAMgASgLMh4ucHJvY2Vzcy5Qcm9jZXNzRXZlbnQuRW5kRXZlbnRIABI0CglrZWVwYWxpdmUYBCABKAsyHy5wcm9jZXNzLlByb2Nlc3NFdmVudC5LZWVwQWxpdmVIABoZCgpTdGFydEV2ZW50EgsKA3BpZBgBIAEoDRpICglEYXRhRXZlbnQSEAoGc3Rkb3V0GAEgASgMSAASEAoGc3RkZXJyGAIgASgMSAASDQoDcHR5GAMgASgMSABCCAoGb3V0cHV0GlsKCEVuZEV2ZW50EhEKCWV4aXRfY29kZRgBIAEoERIOCgZleGl0ZWQYAiABKAgSDgoGc3RhdHVzGAMgASgJEhIKBWVycm9yGAQgASgJSACIAQFCCAoGX2Vycm9yGgsKCUtlZXBBbGl2ZUIHCgVldmVudCI1Cg1TdGFydFJlc3BvbnNlEiQKBWV2ZW50GAEgASgLMhUucHJvY2Vzcy5Qcm9jZXNzRXZlbnQiNwoPQ29ubmVjdFJlc3BvbnNlEiQKBWV2ZW50GAEgASgLMhUucHJvY2Vzcy5Qcm9jZXNzRXZlbnQiYwoQU2VuZElucHV0UmVxdWVzdBIpCgdwcm9jZXNzGAEgASgLMhgucHJvY2Vzcy5Qcm9jZXNzU2VsZWN0b3ISJAoFaW5wdXQYAiABKAsyFS5wcm9jZXNzLlByb2Nlc3NJbnB1dCITChFTZW5kSW5wdXRSZXNwb25zZSI3CgxQcm9jZXNzSW5wdXQSDwoFc3RkaW4YASABKAxIABINCgNwdHkYAiABKAxIAEIHCgVpbnB1dCLCAgoSU3RyZWFtSW5wdXRSZXF1ZXN0EjcKBXN0YXJ0GAEgASgLMiYucHJvY2Vzcy5TdHJlYW1JbnB1dFJlcXVlc3QuU3RhcnRFdmVudEgAEjUKBGRhdGEYAiABKAsyJS5wcm9jZXNzLlN0cmVhbUlucHV0UmVxdWVzdC5EYXRhRXZlbnRIABI6CglrZWVwYWxpdmUYAyABKAsyJS5wcm9jZXNzLlN0cmVhbUlucHV0UmVxdWVzdC5LZWVwQWxpdmVIABo3CgpTdGFydEV2ZW50EikKB3Byb2Nlc3MYASABKAsyGC5wcm9jZXNzLlByb2Nlc3NTZWxlY3RvchoxCglEYXRhRXZlbnQSJAoFaW5wdXQYAiABKAsyFS5wcm9jZXNzLlByb2Nlc3NJbnB1dBoLCglLZWVwQWxpdmVCBwoFZXZlbnQiFQoTU3RyZWFtSW5wdXRSZXNwb25zZSJfChFTZW5kU2lnbmFsUmVxdWVzdBIpCgdwcm9jZXNzGAEgASgLMhgucHJvY2Vzcy5Qcm9jZXNzU2VsZWN0b3ISHwoGc2lnbmFsGAIgASgOMg8ucHJvY2Vzcy5TaWduYWwiFAoSU2VuZFNpZ25hbFJlc3BvbnNlIj4KEUNsb3NlU3RkaW5SZXF1ZXN0EikKB3Byb2Nlc3MYASABKAsyGC5wcm9jZXNzLlByb2Nlc3NTZWxlY3RvciIUChJDbG9zZVN0ZGluUmVzcG9uc2UiOwoOQ29ubmVjdFJlcXVlc3QSKQoHcHJvY2VzcxgBIAEoCzIYLnByb2Nlc3MuUHJvY2Vzc1NlbGVjdG9yIjsKD1Byb2Nlc3NTZWxlY3RvchINCgNwaWQYASABKA1IABINCgN0YWcYAiABKAlIAEIKCghzZWxlY3RvcipICgZTaWduYWwSFgoSU0lHTkFMX1VOU1BFQ0lGSUVEEAASEgoOU0lHTkFMX1NJR1RFUk0QDxISCg5TSUdOQUxfU0lHS0lMTBAJMpEECgdQcm9jZXNzEjMKBExpc3QSFC5wcm9jZXNzLkxpc3RSZXF1ZXN0GhUucHJvY2Vzcy5MaXN0UmVzcG9uc2USPgoHQ29ubmVjdBIXLnByb2Nlc3MuQ29ubmVjdFJlcXVlc3QaGC5wcm9jZXNzLkNvbm5lY3RSZXNwb25zZTABEjgKBVN0YXJ0EhUucHJvY2Vzcy5TdGFydFJlcXVlc3QaFi5wcm9jZXNzLlN0YXJ0UmVzcG9uc2UwARI5CgZVcGRhdGUSFi5wcm9jZXNzLlVwZGF0ZVJlcXVlc3QaFy5wcm9jZXNzLlVwZGF0ZVJlc3BvbnNlEkoKC1N0cmVhbUlucHV0EhsucHJvY2Vzcy5TdHJlYW1JbnB1dFJlcXVlc3QaHC5wcm9jZXNzLlN0cmVhbUlucHV0UmVzcG9uc2UoARJCCglTZW5kSW5wdXQSGS5wcm9jZXNzLlNlbmRJbnB1dFJlcXVlc3QaGi5wcm9jZXNzLlNlbmRJbnB1dFJlc3BvbnNlEkUKClNlbmRTaWduYWwSGi5wcm9jZXNzLlNlbmRTaWduYWxSZXF1ZXN0GhsucHJvY2Vzcy5TZW5kU2lnbmFsUmVzcG9uc2USRQoKQ2xvc2VTdGRpbhIaLnByb2Nlc3MuQ2xvc2VTdGRpblJlcXVlc3QaGy5wcm9jZXNzLkNsb3NlU3RkaW5SZXNwb25zZUJXCgtjb20ucHJvY2Vzc0IMUHJvY2Vzc1Byb3RvUAGiAgNQWFiqAgdQcm9jZXNzygIHUHJvY2Vzc+ICE1Byb2Nlc3NcR1BCTWV0YWRhdGHqAgdQcm9jZXNzYgZwcm90bzM");
+var file_process_process = /* @__PURE__ */ (0, import_codegenv22.fileDesc)("ChVwcm9jZXNzL3Byb2Nlc3MucHJvdG8SB3Byb2Nlc3MiSgoDUFRZEh8KBHNpemUYASABKAsyES5wcm9jZXNzLlBUWS5TaXplGiIKBFNpemUSDAoEY29scxgBIAEoDRIMCgRyb3dzGAIgASgNIqEBCg1Qcm9jZXNzQ29uZmlnEgsKA2NtZBgBIAEoCRIMCgRhcmdzGAIgAygJEi4KBGVudnMYAyADKAsyIC5wcm9jZXNzLlByb2Nlc3NDb25maWcuRW52c0VudHJ5EhAKA2N3ZBgEIAEoCUgAiAEBGisKCUVudnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBQgYKBF9jd2QiDQoLTGlzdFJlcXVlc3QiXAoLUHJvY2Vzc0luZm8SJgoGY29uZmlnGAEgASgLMhYucHJvY2Vzcy5Qcm9jZXNzQ29uZmlnEgsKA3BpZBgCIAEoDRIQCgN0YWcYAyABKAlIAIgBAUIGCgRfdGFnIjcKDExpc3RSZXNwb25zZRInCglwcm9jZXNzZXMYASADKAsyFC5wcm9jZXNzLlByb2Nlc3NJbmZvIskBCgxTdGFydFJlcXVlc3QSJwoHcHJvY2VzcxgBIAEoCzIWLnByb2Nlc3MuUHJvY2Vzc0NvbmZpZxIeCgNwdHkYAiABKAsyDC5wcm9jZXNzLlBUWUgAiAEBEhAKA3RhZxgDIAEoCUgBiAEBEhIKBXN0ZGluGAQgASgISAKIAQESHAoPaWRlbXBvdGVuY3lfa2V5GAUgASgJSAOIAQFCBgoEX3B0eUIGCgRfdGFnQggKBl9zdGRpbkISChBfaWRlbXBvdGVuY3lfa2V5ImIKDVVwZGF0ZVJlcXVlc3QSKQoHcHJvY2VzcxgBIAEoCzIYLnByb2Nlc3MuUHJvY2Vzc1NlbGVjdG9yEh4KA3B0eRgCIAEoCzIMLnByb2Nlc3MuUFRZSACIAQFCBgoEX3B0eSIQCg5VcGRhdGVSZXNwb25zZSLBAwoMUHJvY2Vzc0V2ZW50EjEKBXN0YXJ0GAEgASgLMiAucHJvY2Vzcy5Qcm9jZXNzRXZlbnQuU3RhcnRFdmVudEgAEi8KBGRhdGEYAiABKAsyHy5wcm9jZXNzLlByb2Nlc3NFdmVudC5EYXRhRXZlbnRIABItCgNlbmQYAyABKAsyHi5wcm9jZXNzLlByb2Nlc3NFdmVudC5FbmRFdmVudEgAEjQKCWtlZXBhbGl2ZRgEIAEoCzIfLnByb2Nlc3MuUHJvY2Vzc0V2ZW50LktlZXBBbGl2ZUgAEhAKCHNlcXVlbmNlGAUgASgEGhkKClN0YXJ0RXZlbnQSCwoDcGlkGAEgASgNGkgKCURhdGFFdmVudBIQCgZzdGRvdXQYASABKAxIABIQCgZzdGRlcnIYAiABKAxIABINCgNwdHkYAyABKAxIAEIICgZvdXRwdXQaWwoIRW5kRXZlbnQSEQoJZXhpdF9jb2RlGAEgASgREg4KBmV4aXRlZBgCIAEoCBIOCgZzdGF0dXMYAyABKAkSEgoFZXJyb3IYBCABKAlIAIgBAUIICgZfZXJyb3IaCwoJS2VlcEFsaXZlQgcKBWV2ZW50IjUKDVN0YXJ0UmVzcG9uc2USJAoFZXZlbnQYASABKAsyFS5wcm9jZXNzLlByb2Nlc3NFdmVudCI3Cg9Db25uZWN0UmVzcG9uc2USJAoFZXZlbnQYASABKAsyFS5wcm9jZXNzLlByb2Nlc3NFdmVudCJjChBTZW5kSW5wdXRSZXF1ZXN0EikKB3Byb2Nlc3MYASABKAsyGC5wcm9jZXNzLlByb2Nlc3NTZWxlY3RvchIkCgVpbnB1dBgCIAEoCzIVLnByb2Nlc3MuUHJvY2Vzc0lucHV0IhMKEVNlbmRJbnB1dFJlc3BvbnNlIjcKDFByb2Nlc3NJbnB1dBIPCgVzdGRpbhgBIAEoDEgAEg0KA3B0eRgCIAEoDEgAQgcKBWlucHV0IsICChJTdHJlYW1JbnB1dFJlcXVlc3QSNwoFc3RhcnQYASABKAsyJi5wcm9jZXNzLlN0cmVhbUlucHV0UmVxdWVzdC5TdGFydEV2ZW50SAASNQoEZGF0YRgCIAEoCzIlLnByb2Nlc3MuU3RyZWFtSW5wdXRSZXF1ZXN0LkRhdGFFdmVudEgAEjoKCWtlZXBhbGl2ZRgDIAEoCzIlLnByb2Nlc3MuU3RyZWFtSW5wdXRSZXF1ZXN0LktlZXBBbGl2ZUgAGjcKClN0YXJ0RXZlbnQSKQoHcHJvY2VzcxgBIAEoCzIYLnByb2Nlc3MuUHJvY2Vzc1NlbGVjdG9yGjEKCURhdGFFdmVudBIkCgVpbnB1dBgCIAEoCzIVLnByb2Nlc3MuUHJvY2Vzc0lucHV0GgsKCUtlZXBBbGl2ZUIHCgVldmVudCIVChNTdHJlYW1JbnB1dFJlc3BvbnNlIl8KEVNlbmRTaWduYWxSZXF1ZXN0EikKB3Byb2Nlc3MYASABKAsyGC5wcm9jZXNzLlByb2Nlc3NTZWxlY3RvchIfCgZzaWduYWwYAiABKA4yDy5wcm9jZXNzLlNpZ25hbCIUChJTZW5kU2lnbmFsUmVzcG9uc2UiPgoRQ2xvc2VTdGRpblJlcXVlc3QSKQoHcHJvY2VzcxgBIAEoCzIYLnByb2Nlc3MuUHJvY2Vzc1NlbGVjdG9yIhQKEkNsb3NlU3RkaW5SZXNwb25zZSJrCg5Db25uZWN0UmVxdWVzdBIpCgdwcm9jZXNzGAEgASgLMhgucHJvY2Vzcy5Qcm9jZXNzU2VsZWN0b3ISGwoOYWZ0ZXJfc2VxdWVuY2UYAiABKARIAIgBAUIRCg9fYWZ0ZXJfc2VxdWVuY2UiOwoPUHJvY2Vzc1NlbGVjdG9yEg0KA3BpZBgBIAEoDUgAEg0KA3RhZxgCIAEoCUgAQgoKCHNlbGVjdG9yKkgKBlNpZ25hbBIWChJTSUdOQUxfVU5TUEVDSUZJRUQQABISCg5TSUdOQUxfU0lHVEVSTRAPEhIKDlNJR05BTF9TSUdLSUxMEAkykQQKB1Byb2Nlc3MSMwoETGlzdBIULnByb2Nlc3MuTGlzdFJlcXVlc3QaFS5wcm9jZXNzLkxpc3RSZXNwb25zZRI+CgdDb25uZWN0EhcucHJvY2Vzcy5Db25uZWN0UmVxdWVzdBoYLnByb2Nlc3MuQ29ubmVjdFJlc3BvbnNlMAESOAoFU3RhcnQSFS5wcm9jZXNzLlN0YXJ0UmVxdWVzdBoWLnByb2Nlc3MuU3RhcnRSZXNwb25zZTABEjkKBlVwZGF0ZRIWLnByb2Nlc3MuVXBkYXRlUmVxdWVzdBoXLnByb2Nlc3MuVXBkYXRlUmVzcG9uc2USSgoLU3RyZWFtSW5wdXQSGy5wcm9jZXNzLlN0cmVhbUlucHV0UmVxdWVzdBocLnByb2Nlc3MuU3RyZWFtSW5wdXRSZXNwb25zZSgBEkIKCVNlbmRJbnB1dBIZLnByb2Nlc3MuU2VuZElucHV0UmVxdWVzdBoaLnByb2Nlc3MuU2VuZElucHV0UmVzcG9uc2USRQoKU2VuZFNpZ25hbBIaLnByb2Nlc3MuU2VuZFNpZ25hbFJlcXVlc3QaGy5wcm9jZXNzLlNlbmRTaWduYWxSZXNwb25zZRJFCgpDbG9zZVN0ZGluEhoucHJvY2Vzcy5DbG9zZVN0ZGluUmVxdWVzdBobLnByb2Nlc3MuQ2xvc2VTdGRpblJlc3BvbnNlQlcKC2NvbS5wcm9jZXNzQgxQcm9jZXNzUHJvdG9QAaICA1BYWKoCB1Byb2Nlc3PKAgdQcm9jZXNz4gITUHJvY2Vzc1xHUEJNZXRhZGF0YeoCB1Byb2Nlc3NiBnByb3RvMw");
 var Process = /* @__PURE__ */ (0, import_codegenv22.serviceDesc)(file_process_process, 0);
 
-// src/sandbox/commands/pty.ts
+// src/sandbox/commands/resumable.ts
 var import_connect4 = require("@connectrpc/connect");
+var DEFAULT_ATTEMPTS = 3;
+var defaultBackoff = (attempt) => 250 * 2 ** (attempt - 1);
+var ZERO = BigInt(0);
+var ONE = BigInt(1);
+function isResumableError(err) {
+  const code = import_connect4.ConnectError.from(err).code;
+  return code === import_connect4.Code.Unavailable || code === import_connect4.Code.Unknown || code === import_connect4.Code.Aborted || // sbxd drops a subscriber that stopped reading and asks it to reconnect.
+  code === import_connect4.Code.ResourceExhausted;
+}
+function resumableProcessEvents(initial, reopen, opts) {
+  return __asyncGenerator(this, null, function* () {
+    var _a3, _b, _c, _d, _e, _f, _g;
+    const maxAttempts = (_a3 = opts.maxAttempts) != null ? _a3 : DEFAULT_ATTEMPTS;
+    const backoffMs = (_b = opts.backoffMs) != null ? _b : defaultBackoff;
+    let stream2 = initial;
+    let pid;
+    let last = ZERO;
+    let attempts = 0;
+    let resumed = false;
+    for (; ; ) {
+      try {
+        try {
+          for (var iter = __forAwait(stream2), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+            const response = temp.value;
+            const event = response.event;
+            const kind = event == null ? void 0 : event.event.case;
+            if (kind === "start") {
+              if (resumed && pid !== void 0) {
+                continue;
+              }
+              pid = event == null ? void 0 : event.event.value.pid;
+            }
+            const sequence = (_c = event == null ? void 0 : event.sequence) != null ? _c : ZERO;
+            if (sequence > ZERO) {
+              if (sequence <= last) {
+                continue;
+              }
+              if (resumed && sequence > last + ONE) {
+                (_e = (_d = opts.logger) == null ? void 0 : _d.warn) == null ? void 0 : _e.call(
+                  _d,
+                  `Process ${pid} output between events ${last} and ${sequence} was evicted before the reconnect`
+                );
+              }
+              last = sequence;
+            }
+            attempts = 0;
+            yield response;
+            if (kind === "end") {
+              return;
+            }
+          }
+        } catch (temp) {
+          error = [temp];
+        } finally {
+          try {
+            more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+          } finally {
+            if (error)
+              throw error[0];
+          }
+        }
+        return;
+      } catch (err) {
+        if (opts.signal.aborted || !isResumableError(err) || attempts >= maxAttempts) {
+          throw err;
+        }
+        attempts += 1;
+        (_g = (_f = opts.logger) == null ? void 0 : _f.debug) == null ? void 0 : _g.call(
+          _f,
+          `Process stream dropped (${import_connect4.ConnectError.from(err).code}); reconnecting, attempt ${attempts}`
+        );
+        yield new __await(sleep(backoffMs(attempts), opts.signal));
+        stream2 = reopen(pid, last);
+        resumed = true;
+      }
+    }
+  });
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new import_connect4.ConnectError("operation was aborted", import_connect4.Code.Canceled));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new import_connect4.ConnectError("operation was aborted", import_connect4.Code.Canceled));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/sandbox/commands/pty.ts
+var import_connect5 = require("@connectrpc/connect");
 var Pty = class {
   // 60 seconds
   constructor(transport, connectionConfig, metadata) {
     this.transport = transport;
     this.connectionConfig = connectionConfig;
     this.defaultPtyConnectionTimeout = 6e4;
-    this.rpc = (0, import_connect4.createClient)(Process, this.transport);
+    this.rpc = (0, import_connect5.createClient)(Process, this.transport);
     this.envdVersion = metadata.version;
   }
   /**
@@ -2886,8 +2985,8 @@ var Pty = class {
       );
       return true;
     } catch (err) {
-      if (err instanceof import_connect4.ConnectError) {
-        if (err.code === import_connect4.Code.NotFound) {
+      if (err instanceof import_connect5.ConnectError) {
+        if (err.code === import_connect5.Code.NotFound) {
           return false;
         }
       }
@@ -2897,11 +2996,24 @@ var Pty = class {
 };
 
 // src/sandbox/commands/index.ts
+function remainingMs(deadline) {
+  if (deadline === void 0) {
+    return void 0;
+  }
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) {
+    throw new import_connect6.ConnectError(
+      "process stream deadline exceeded",
+      import_connect6.Code.DeadlineExceeded
+    );
+  }
+  return remaining;
+}
 var Commands = class {
   constructor(transport, connectionConfig, metadata) {
     this.connectionConfig = connectionConfig;
     this.defaultProcessConnectionTimeout = 6e4;
-    this.rpc = (0, import_connect5.createClient)(Process, transport);
+    this.rpc = (0, import_connect6.createClient)(Process, transport);
     this.envdVersion = metadata.version;
   }
   /**
@@ -2911,6 +3023,14 @@ var Commands = class {
   get supportsStdinClose() {
     return (0, import_compare_versions3.compareVersions)(this.envdVersion, ENVD_ENVD_CLOSE) >= 0;
   }
+  /**
+   * sbxd 1.1.0+ numbers process output and accepts idempotent starts, so a
+   * dropped command stream can be resumed without losing or repeating
+   * output, and a retried start never runs the command twice.
+   */
+  get supportsProcessResume() {
+    return (0, import_compare_versions3.compareVersions)(this.envdVersion, ENVD_PROCESS_RESUME) >= 0;
+  }
   /**
    * List all running commands and PTY sessions.
    *
@@ -3025,8 +3145,8 @@ var Commands = class {
       );
       return true;
     } catch (err) {
-      if (err instanceof import_connect5.ConnectError) {
-        if (err.code === import_connect5.Code.NotFound) {
+      if (err instanceof import_connect6.ConnectError) {
+        if (err.code === import_connect6.Code.NotFound) {
           return false;
         }
       }
@@ -3049,23 +3169,31 @@ var Commands = class {
     const reqTimeout = requestTimeoutMs ? setTimeout(() => {
       controller.abort();
     }, requestTimeoutMs) : void 0;
-    const events = this.rpc.connect(
+    const timeoutMs = (_b = opts == null ? void 0 : opts.timeoutMs) != null ? _b : this.defaultProcessConnectionTimeout;
+    const deadline = timeoutMs ? Date.now() + timeoutMs : void 0;
+    const connectTo = (afterSequence, remaining = timeoutMs) => this.rpc.connect(
       {
         process: {
           selector: {
             case: "pid",
             value: pid
           }
-        }
+        },
+        afterSequence
       },
       {
         signal: controller.signal,
         headers: {
           [KEEPALIVE_PING_HEADER]: KEEPALIVE_PING_INTERVAL_SEC.toString()
         },
-        timeoutMs: (_b = opts == null ? void 0 : opts.timeoutMs) != null ? _b : this.defaultProcessConnectionTimeout
+        timeoutMs: remaining
       }
     );
+    const events = this.supportsProcessResume ? resumableProcessEvents(
+      connectTo(),
+      (_, afterSequence) => connectTo(afterSequence, remainingMs(deadline)),
+      { signal: controller.signal, logger: this.connectionConfig.logger }
+    ) : connectTo();
     try {
       const pid2 = await handleProcessStartEvent(events);
       clearTimeout(reqTimeout);
@@ -3098,24 +3226,39 @@ var Commands = class {
         `Sandbox envd version ${this.envdVersion} can't specify stdin, it's always turned on. Please rebuild your template if you need this feature.`
       );
     }
-    const events = this.rpc.start(
-      {
-        process: {
-          cmd: "/bin/bash",
-          cwd: opts == null ? void 0 : opts.cwd,
-          envs: opts == null ? void 0 : opts.envs,
-          args: ["-l", "-c", cmd]
-        },
-        stdin: (opts == null ? void 0 : opts.stdin) || false
+    const resume = this.supportsProcessResume;
+    const request = {
+      process: {
+        cmd: "/bin/bash",
+        cwd: opts == null ? void 0 : opts.cwd,
+        envs: opts == null ? void 0 : opts.envs,
+        args: ["-l", "-c", cmd]
       },
-      {
-        headers: __spreadProps(__spreadValues({}, authenticationHeader(this.envdVersion, opts == null ? void 0 : opts.user)), {
-          [KEEPALIVE_PING_HEADER]: KEEPALIVE_PING_INTERVAL_SEC.toString()
-        }),
-        signal: controller.signal,
-        timeoutMs: (_b = opts == null ? void 0 : opts.timeoutMs) != null ? _b : this.defaultProcessConnectionTimeout
-      }
-    );
+      stdin: (opts == null ? void 0 : opts.stdin) || false,
+      // A retried start with the same key attaches to the first one.
+      idempotencyKey: resume ? crypto.randomUUID() : void 0
+    };
+    const timeoutMs = (_b = opts == null ? void 0 : opts.timeoutMs) != null ? _b : this.defaultProcessConnectionTimeout;
+    const deadline = timeoutMs ? Date.now() + timeoutMs : void 0;
+    const callOptions = (remaining) => ({
+      headers: __spreadProps(__spreadValues({}, authenticationHeader(this.envdVersion, opts == null ? void 0 : opts.user)), {
+        [KEEPALIVE_PING_HEADER]: KEEPALIVE_PING_INTERVAL_SEC.toString()
+      }),
+      signal: controller.signal,
+      timeoutMs: remaining
+    });
+    const started = this.rpc.start(request, callOptions(timeoutMs));
+    const events = resume ? resumableProcessEvents(
+      started,
+      (pid, afterSequence) => pid === void 0 ? this.rpc.start(request, callOptions(remainingMs(deadline))) : this.rpc.connect(
+        {
+          process: { selector: { case: "pid", value: pid } },
+          afterSequence
+        },
+        callOptions(remainingMs(deadline))
+      ),
+      { signal: controller.signal, logger: this.connectionConfig.logger }
+    ) : started;
     try {
       const pid = await handleProcessStartEvent(events);
       clearTimeout(reqTimeout);
@@ -3429,7 +3572,7 @@ var SandboxApi = class {
     return true;
   }
   static async createSandbox(template, timeoutMs, opts) {
-    var _a3, _b, _c;
+    var _a3, _b;
     const config = ConnectionConfig.forSandbox(opts);
     const client = new ApiClient(config);
     const idempotencyKey = (_a3 = opts == null ? void 0 : opts.idempotencyKey) != null ? _a3 : crypto.randomUUID();
@@ -3448,8 +3591,7 @@ var SandboxApi = class {
       mcp: opts == null ? void 0 : opts.mcp,
       envVars: opts == null ? void 0 : opts.envs,
       timeout: timeoutToSeconds(timeoutMs),
-      secure: (_b = opts == null ? void 0 : opts.secure) != null ? _b : true,
-      allow_internet_access: (_c = opts == null ? void 0 : opts.allowInternetAccess) != null ? _c : true,
+      allow_internet_access: (_b = opts == null ? void 0 : opts.allowInternetAccess) != null ? _b : true,
       network: opts == null ? void 0 : opts.network,
       autoPause: pauseOnTimeout
     }, pauseOnTimeout ? { autoResume: { policy: lifecycle.autoResume ? "any" : "off" } } : {}), config.region ? { region: config.region } : {});