@evolvingmachines/daytona 0.0.51 → 0.0.52-project-sable.20260729.8632c49

package/dist/index.cjs

@@ -1,2 +1,2 @@
-'use strict';var sdk=require('@daytonaio/sdk');var h={"evolve-all":"evolvingmachines/evolve-all"},S=new Set([".xlsx",".xls",".docx",".doc",".pptx",".ppt",".pdf",".zip",".tar",".gz",".7z",".rar",".png",".jpg",".jpeg",".gif",".webp",".ico",".bmp",".mp3",".wav",".ogg",".flac",".aac",".mp4",".avi",".mov",".mkv",".webm",".woff",".woff2",".ttf",".otf",".eot",".exe",".dll",".so",".dylib",".sqlite",".db",".pickle",".pkl",".parquet"]);function w(r){let e=r.substring(r.lastIndexOf(".")).toLowerCase();return S.has(e)}function v(r){let e=r.lastIndexOf("/");return e>0?r.substring(0,e):"/"}function P(r){let e=r.lastIndexOf("/");return e>=0?r.substring(e+1):r}function g(r,e,t){let s=r;return e&&(s=`cd '${e.replace(/'/g,"'\\''")}' && ${s}`),t&&Object.keys(t).length>0&&(s=`${Object.entries(t).filter(([,a])=>a!=null).map(([a,o])=>`export ${a}='${o.replace(/'/g,"'\\''")}'`).join("; ")}; ${s}`),s}var C=g,f=class{constructor(e){this.sandbox=e;}async run(e,t){let s=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,n=`run-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(n);try{let a=await this.sandbox.process.executeSessionCommand(n,{command:g(e,t?.cwd,t?.envs),runAsync:!1},s),o=a.cmdId;o&&(t?.onStdout||t?.onStderr)&&await this.sandbox.process.getSessionCommandLogs(n,o,t.onStdout||(()=>{}),t.onStderr||(()=>{}));let d=a.stdout??a.output??"",i=a.stderr??"";if(!d&&o&&!t?.onStdout)try{let m=await this.sandbox.process.getSessionCommandLogs(n,o);d=m.stdout??m.output??"",i=m.stderr??i;}catch{}return {exitCode:a.exitCode??0,stdout:d,stderr:i}}finally{try{await this.sandbox.process.deleteSession(n);}catch{}}}async spawn(e,t){let s=`evolve-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(s);let n=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,a=Date.now(),o=t?.timeoutMs,i=(await this.sandbox.process.executeSessionCommand(s,{command:g(e,t?.cwd,t?.envs),runAsync:true},n)).cmdId;i&&(t?.onStdout||t?.onStderr)&&this.sandbox.process.getSessionCommandLogs(s,i,t.onStdout||(()=>{}),t.onStderr||(()=>{})).catch(()=>{});let m=this.sandbox;return {processId:s,wait:async()=>{if(!i)return {exitCode:0,stdout:"",stderr:""};for(;;){if(o&&Date.now()-a>=o){try{await m.process.deleteSession(s);}catch{}return {exitCode:-1,stdout:"",stderr:"operation timed out"}}try{let c=await m.process.getSessionCommand(s,i);if(c.exitCode!==void 0)try{let l=await m.process.getSessionCommandLogs(s,i);return {exitCode:c.exitCode,stdout:l.stdout??l.output??"",stderr:l.stderr??""}}catch{return {exitCode:c.exitCode,stdout:"",stderr:""}}}catch(c){if((c instanceof Error?c.message.toLowerCase():String(c).toLowerCase()).includes("not found"))return {exitCode:-1,stdout:"",stderr:"session terminated"};throw c}await new Promise(c=>setTimeout(c,500));}},kill:async()=>{try{return await m.process.deleteSession(s),!0}catch{return  false}}}}async list(){try{return (await this.sandbox.process.listSessions()).map(t=>({processId:t.sessionId||"",cmd:"",args:[],envs:{}}))}catch{return []}}async kill(e){try{return await this.sandbox.process.deleteSession(e),!0}catch{return  false}}},p=class{constructor(e){this.sandbox=e;}async read(e){let t=await this.sandbox.fs.downloadFile(e);return w(e)?new Uint8Array(t):t.toString("utf-8")}async write(e,t){let s;if(typeof t=="string")s=Buffer.from(t,"utf-8");else if(Buffer.isBuffer(t))s=t;else if(t instanceof ArrayBuffer)s=Buffer.from(t);else if(t instanceof Uint8Array)s=Buffer.from(t);else throw new Error(`Unsupported content type: ${typeof t}`);await this.sandbox.fs.uploadFile(s,e);}async writeBatch(e){let t=e.map(s=>{let n;if(typeof s.data=="string")n=Buffer.from(s.data,"utf-8");else if(Buffer.isBuffer(s.data))n=s.data;else if(s.data instanceof ArrayBuffer)n=Buffer.from(s.data);else if(s.data instanceof Uint8Array)n=Buffer.from(s.data);else throw new Error(`Unsupported content type: ${typeof s.data}`);return {source:n,destination:s.path}});await this.sandbox.fs.uploadFiles(t);}async makeDir(e){await this.sandbox.fs.createFolder(e,"755");}async exists(e){try{let t=v(e),s=P(e);return (await this.sandbox.fs.listFiles(t)).some(a=>a.name===s)}catch{return  false}}async list(e){return (await this.sandbox.fs.listFiles(e)).map(s=>({name:s.name,path:e.endsWith("/")?`${e}${s.name}`:`${e}/${s.name}`,type:s.isDir?"dir":"file"}))}async remove(e){await this.sandbox.fs.deleteFile(e,true);}async rename(e,t){await this.sandbox.fs.moveFiles(e,t);}},u=class{constructor(e){this.sandbox=e;this.commands=new f(e),this.files=new p(e);}commands;files;get sandboxId(){return this.sandbox.id}async getHost(e){return (await this.sandbox.getPreviewLink(e)).url}async isRunning(){return this.sandbox.state==="started"}async getInfo(){return {sandboxId:this.sandbox.id,image:this.sandbox.snapshot||"unknown",name:this.sandbox.name,metadata:this.sandbox.labels||{},startedAt:new Date().toISOString()}}async kill(){await this.sandbox.delete();}async pause(){await this.sandbox.stop();}},x=class{providerType="daytona";name="Daytona";client;defaultTimeoutMs;snapshotName;constructor(e){this.client=new sdk.Daytona({apiKey:e.apiKey,apiUrl:e.apiUrl,target:e.target}),this.defaultTimeoutMs=e.defaultTimeoutMs??36e5,this.snapshotName=e.snapshotName??"evolve-all";}async create(e){let t=e.timeoutMs??this.defaultTimeoutMs,s=Math.max(1,Math.ceil(t/6e4)),n=e.image||this.snapshotName,a;try{let o=await this.client.snapshot.get(n);if(o&&o.state==="active")console.log(`[daytona] Using cached snapshot: ${n}`),a=await this.client.create({snapshot:n,envVars:e.envs,labels:e.metadata,autoStopInterval:s},{timeout:600});else throw new Error("Snapshot not active")}catch{let o=h[n]??n;console.log(`[daytona] Snapshot "${n}" not found, building from image: ${o}`),console.log("[daytona] First run will take a few minutes (this only happens once)...");try{await this.client.snapshot.create({name:n,image:sdk.Image.base(o),resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{onLogs:d=>console.log(`[daytona] ${d}`)}),console.log(`[daytona] Snapshot "${n}" ready.`),a=await this.client.create({snapshot:n,envVars:e.envs,labels:e.metadata,autoStopInterval:s},{timeout:600});}catch(d){console.warn(`[daytona] Snapshot creation failed, falling back to direct image: ${d instanceof Error?d.message:d}`),a=await this.client.create({image:o,envVars:e.envs,labels:e.metadata,autoStopInterval:s,resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{timeout:600,onSnapshotCreateLogs:i=>console.log(`[daytona] ${i}`)});}}return e.workingDirectory&&await a.fs.createFolder(e.workingDirectory,"755"),new u(a)}async connect(e,t){let s=await this.client.get(e);return s.state!=="started"&&await s.start(),new u(s)}async list(e){let t=e?.limit??100;return (await this.client.list(e?.metadata,1,t)).items.map(n=>({sandboxId:n.id,image:n.snapshot||"unknown",name:n.name,metadata:n.labels||{},startedAt:new Date().toISOString()}))}};function A(r={}){let e=r.apiKey??process.env.DAYTONA_API_KEY;if(!e)throw new Error("Daytona API key required. Set DAYTONA_API_KEY environment variable or pass apiKey in config. Get your key at https://app.daytona.io/dashboard/keys");return new x({...r,apiKey:e})}
-exports.DaytonaProvider=x;exports._testWrapCommand=C;exports.createDaytonaProvider=A;
+'use strict';var sdk=require('@daytonaio/sdk'),promises=require('dns/promises');var z={"evolve-all":"evolvingmachines/evolve-all"},q=10,L=10,T=100,y=100,W=new Set([".xlsx",".xls",".docx",".doc",".pptx",".ppt",".pdf",".zip",".tar",".gz",".7z",".rar",".png",".jpg",".jpeg",".gif",".webp",".ico",".bmp",".mp3",".wav",".ogg",".flac",".aac",".mp4",".avi",".mov",".mkv",".webm",".woff",".woff2",".ttf",".otf",".eot",".exe",".dll",".so",".dylib",".sqlite",".db",".pickle",".pkl",".parquet"]);function X(s){let e=s.substring(s.lastIndexOf(".")).toLowerCase();return W.has(e)}function G(s){let e=s.lastIndexOf("/");return e>0?s.substring(0,e):"/"}function J(s){let e=s.lastIndexOf("/");return e>=0?s.substring(e+1):s}var f=class extends Error{reason;destination;constructor(e,t,n){super(t),this.name="DaytonaNetworkPolicyError",this.reason=e,this.destination=n;}},w=class extends Error{image;constructor(e,t){let n=t instanceof Error?t.message:String(t??"unknown error");super(`Failed to pull image "${e}" on Daytona: ${n}. Private registry images (e.g. AWS ECR) require registry credentials pre-registered in the Daytona dashboard (Registries page) before sandbox creation \u2014 Daytona has no per-call image pull secret. Register the registry at https://app.daytona.io, then retry. Also ensure the image is linux/amd64 and pinned to a tag or digest (floating tags like "latest" are rejected by Daytona's snapshot builder).`),this.name="DaytonaImagePullError",this.image=e;}},h=class extends Error{snapshot;constructor(e){super(`Daytona snapshot "${e}" already exists and pins its cpu/memory/disk sizing \u2014 create-from-snapshot cannot resize it, so the requested \`resources\` cannot be enforced. Pre-build a snapshot with the desired sizing under its own name (sizing-addressed), or omit \`resources\` to accept the snapshot's pinned sizing.`),this.name="DaytonaResourcesError",this.snapshot=e;}},S=class extends Error{constructor(){super("Daytona has no separate idle timeout: auto-stop IS its only clock and it already measures inactivity, so `timeoutMs` is what sets it (autoStopInterval). Set the inactivity bound with `timeoutMs`; a hard bound on the process itself is enforced in-box instead (see withInBoxTimeout)."),this.name="DaytonaIdleTimeoutError";}};function v(s,e){if(!e||e<=0)return s;let t=Buffer.from(s).toString("base64"),n=`/tmp/.evolve-cmd-${Date.now()}-${Math.random().toString(36).slice(2,8)}.sh`;return `sh -c '${`echo ${t} | base64 -d > ${n} && [ -s ${n} ] || { rm -f ${n}; exit 126; }; if command -v timeout >/dev/null 2>&1; then timeout -k 10 ${e} bash ${n}; else bash ${n}; fi; rc=$?; rm -f ${n}; exit $rc`}'`}function P(s,e,t,n){let r=s;return e&&(r=`cd '${e.replace(/'/g,"'\\''")}' && ${r}`),t&&Object.keys(t).length>0&&(r=`${Object.entries(t).filter(([,o])=>o!=null).map(([o,a])=>`export ${o}='${String(a).replace(/'/g,"'\\''")}'`).join("; ")}; ${r}`),n==="root"&&(r=`echo ${Buffer.from(r).toString("base64")} | base64 -d | sudo -n bash`),r}var V=s=>promises.resolve4(s);function E(s){let e=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?:\/(\d{1,3}))?$/.exec(s);return !(!e||[e[1],e[2],e[3],e[4]].some(t=>Number(t)>255)||e[5]!==void 0&&Number(e[5])>32)}function Z(s){return /^\d{1,3}(\.\d{1,3}){3}(\/\d+)?$/.test(s)&&!E(s)}function Q(s){return s.startsWith("[")?true:(s.match(/:/g)?.length??0)>=2}function ee(s){return /^[^:]+:\d+$/.test(s)}async function B(s,e=V){if(!s||s.outbound==="open"){if(s?.allowedDestinations?.length)throw new Error("network.allowedDestinations is only valid when outbound is blocked");return s?{networkBlockAll:false}:{}}let t=s.allowedDestinations??[];if(t.length===0)return {networkBlockAll:true};let n=[],r=[];for(let o of t)if(E(o))n.push(o.includes("/")?o:`${o}/32`);else {if(Z(o))throw new f("invalid-ipv4",`"${o}" is not a valid IPv4 address or CIDR (octets must be 0-255, prefix 0-32). Fix the address or list a hostname instead.`,o);if(Q(o))throw new f("ipv6-unsupported",`Daytona's network allowlist supports IPv4 CIDRs only; cannot allow IPv6 destination "${o}".`,o);if(ee(o))throw new f("port-unsupported",`Daytona's network allowlist filters hosts and IPs only and cannot match a port; drop the ":<port>" from "${o}" and list just the host or IP.`,o);if(o.includes("*"))throw new f("wildcard-hostname",`Daytona cannot enforce wildcard hostname "${o}": its allowlist is kernel-level IPv4 CIDR filtering with no DNS/domain layer. List concrete hostnames or IPv4 CIDRs instead.`,o);r.push(o);}for(let o of r){let a=[];try{a=await e(o);}catch(i){throw new f("unresolvable-hostname",`Cannot pin hostname "${o}" to stable IPv4 addresses at create time (${i instanceof Error?i.message:String(i)}). Daytona enforces IPv4 CIDRs only; use an IPv4 CIDR for this destination instead.`,o)}if(a.length===0)throw new f("unresolvable-hostname",`Hostname "${o}" resolved to no IPv4 addresses. Daytona enforces IPv4 CIDRs only; use an IPv4 CIDR for this destination instead.`,o);console.warn(`[daytona] Network allowlist: pinning "${o}" to [${a.join(", ")}] (DNS resolved at create time). Daytona enforces IPv4 CIDRs only \u2014 if this host rotates DNS (CDNs and cloud APIs often do), traffic to its new IPs will be BLOCKED for the sandbox's lifetime.`);for(let i of a)n.push(`${i}/32`);}let l=[...new Set(n)];if(l.length>L)throw new f("allowlist-too-large",`Daytona allows at most ${L} entries in its network allowlist; this policy resolved to ${l.length} CIDRs (${l.join(", ")}). Aggregate destinations into broader CIDRs or reduce the list.`);return {networkBlockAll:false,networkAllowList:l.join(",")}}function O(s){let e=s.indexOf("/");if(e<0)return;let t=s.substring(0,e);return t.includes(".")||t.includes(":")||t==="localhost"?t:void 0}function k(s){return {sandboxId:s.id,image:s.snapshot??"",name:s.name,metadata:s.labels??{},startedAt:s.createdAt??""}}function _(s){if(s==="started")return "running";if(s==="stopped"||s==="archived")return "paused"}var I=class extends sdk.Daytona{constructor(t,n){super(t);this.managedToolboxUrl=n;}async getProxyToolboxUrl(){return this.managedToolboxUrl}};function te(s,e){let t=new Uint8Array(new ArrayBuffer(s.length+e.length));return t.set(s,0),t.set(e,s.length),t}function U(s,e,t){e:for(let n=t;n+e.length<=s.length;n++){for(let r=0;r<e.length;r++)if(s[n+r]!==e[r])continue e;return n}return  -1}function N(s,e){let t=new TextDecoder("utf-8"),n=new TextDecoder("utf-8"),r=new Uint8Array(0),l="stdout",o=a=>{a.length!==0&&(l==="stdout"?s(t.decode(a,{stream:true})):e(n.decode(a,{stream:true})));};return {push(a){for(r=te(r,a);;){let i=U(r,sdk.STDOUT_PREFIX_BYTES,0),d=U(r,sdk.STDERR_PREFIX_BYTES,0),c=-1,u="stdout",m=0;if(i!==-1&&(d===-1||i<d)?(c=i,u="stdout",m=sdk.STDOUT_PREFIX_BYTES.length):d!==-1&&(c=d,u="stderr",m=sdk.STDERR_PREFIX_BYTES.length),c===-1){let g=Math.max(0,r.length-(sdk.MAX_PREFIX_LEN-1));o(r.subarray(0,g)),r=r.slice(g);return}o(r.subarray(0,c)),l=u,r=r.slice(c+m);}},flush(){o(r),r=new Uint8Array(0);let a=t.decode();a&&s(a);let i=n.decode();i&&e(i);}}}async function F(s,e,t,n,r,l){let o=`${s.toolboxUrl.replace(/\/+$/,"")}/${encodeURIComponent(e)}/process/session/${encodeURIComponent(t)}/command/${encodeURIComponent(n)}/logs?follow=true`,a=await fetch(o,{headers:{Authorization:`Bearer ${s.apiKey}`,accept:"application/octet-stream"}});if(!a.ok)throw new Error(`Daytona managed log follow failed: ${a.status} ${await a.text()}`);if(!a.body)return;let i=N(r,l),d=a.body.getReader();try{for(;;){let{done:c,value:u}=await d.read();if(c)break;u&&i.push(u);}}finally{i.flush(),await d.cancel().catch(()=>{});}}function x(s){let e=s.stdout||"",t=s.stderr||"",n=s.output||"";return !e&&!t&&n?{stdout:n,stderr:""}:{stdout:e,stderr:t}}var D=class{constructor(e,t,n){this.sandbox=e;this.user=t;this.managedStream=n;}followLogs(e,t,n,r){return this.managedStream?F(this.managedStream,this.sandbox.id,e,t,n,r):this.sandbox.process.getSessionCommandLogs(e,t,n,r)}async run(e,t){let n=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,r=`run-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(r);try{let l=await this.sandbox.process.executeSessionCommand(r,{command:v(P(e,t?.cwd,t?.envs,this.user),n),runAsync:!1},n),o=l.cmdId;o&&(t?.onStdout||t?.onStderr)&&await this.followLogs(r,o,t.onStdout||(()=>{}),t.onStderr||(()=>{}));let{stdout:a,stderr:i}=x(l);if(!a&&!i&&o&&!t?.onStdout)try{let d=await this.sandbox.process.getSessionCommandLogs(r,o),c=x(d);a=c.stdout,i=c.stderr||i;}catch{}return {exitCode:l.exitCode??0,stdout:a,stderr:i}}finally{try{await this.sandbox.process.deleteSession(r);}catch{}}}async spawn(e,t){let n=`evolve-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(n);let r=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,l=Date.now(),o=t?.timeoutMs,i=(await this.sandbox.process.executeSessionCommand(n,{command:v(P(e,t?.cwd,t?.envs,this.user),r),runAsync:true},r)).cmdId;i&&(t?.onStdout||t?.onStderr)&&this.followLogs(n,i,t.onStdout||(()=>{}),t.onStderr||(()=>{})).catch(()=>{});let d=this.sandbox;return {processId:n,wait:async()=>{if(!i)return {exitCode:0,stdout:"",stderr:""};for(;;){if(o&&Date.now()-l>=o){try{await d.process.deleteSession(n);}catch{}return {exitCode:124,stdout:"",stderr:"operation timed out"}}try{let c=await d.process.getSessionCommand(n,i);if(c.exitCode!==void 0)try{let u=await d.process.getSessionCommandLogs(n,i);return {exitCode:c.exitCode,...x(u)}}catch{return {exitCode:c.exitCode,stdout:"",stderr:""}}}catch(c){let u=c instanceof Error?c.message.toLowerCase():String(c).toLowerCase();if(u.includes("not found")){let m=u.includes("sandbox");try{await d.refreshData(),m=!1;}catch(g){(g instanceof Error?g.message.toLowerCase():String(g).toLowerCase()).includes("not found")&&(m=true);}return {exitCode:-1,stdout:"",stderr:m?"sandbox deleted during run":"session terminated"}}throw c}await new Promise(c=>setTimeout(c,500));}},kill:async()=>{try{return await d.process.deleteSession(n),!0}catch{return  false}}}}async list(){try{return (await this.sandbox.process.listSessions()).map(t=>({processId:t.sessionId||"",cmd:"",args:[],envs:{}}))}catch{return []}}async kill(e){try{return await this.sandbox.process.deleteSession(e),!0}catch{return  false}}},A=class{constructor(e){this.sandbox=e;}async read(e){let t=await this.sandbox.fs.downloadFile(e);return X(e)?new Uint8Array(t):t.toString("utf-8")}async write(e,t){let n;if(typeof t=="string")n=Buffer.from(t,"utf-8");else if(Buffer.isBuffer(t))n=t;else if(t instanceof ArrayBuffer)n=Buffer.from(t);else if(t instanceof Uint8Array)n=Buffer.from(t);else throw new Error(`Unsupported content type: ${typeof t}`);await this.sandbox.fs.uploadFile(n,e);}async writeBatch(e){let t=e.map(n=>{let r;if(typeof n.data=="string")r=Buffer.from(n.data,"utf-8");else if(Buffer.isBuffer(n.data))r=n.data;else if(n.data instanceof ArrayBuffer)r=Buffer.from(n.data);else if(n.data instanceof Uint8Array)r=Buffer.from(n.data);else throw new Error(`Unsupported content type: ${typeof n.data}`);return {source:r,destination:n.path}});await this.sandbox.fs.uploadFiles(t);}async writeFromPath(e,t){await this.sandbox.fs.uploadFile(t,e);}async makeDir(e){await this.sandbox.fs.createFolder(e,"755");}async exists(e){try{let t=G(e),n=J(e);return (await this.sandbox.fs.listFiles(t)).some(l=>l.name===n)}catch{return  false}}async list(e){return (await this.sandbox.fs.listFiles(e)).map(n=>({name:n.name,path:e.endsWith("/")?`${e}${n.name}`:`${e}/${n.name}`,type:n.isDir?"dir":"file"}))}async remove(e){await this.sandbox.fs.deleteFile(e,true);}async rename(e,t){await this.sandbox.fs.moveFiles(e,t);}},b=class{constructor(e,t,n){this.sandbox=e;this.commands=new D(e,t,n),this.files=new A(e);}commands;files;get sandboxId(){return this.sandbox.id}async getHost(e){return (await this.sandbox.getPreviewLink(e)).url}async isRunning(){try{await this.sandbox.refreshData();}catch{return  false}return this.sandbox.state==="started"}async getInfo(){return await this.sandbox.refreshData(),k(this.sandbox)}async kill(){await this.sandbox.delete();}async pause(){await this.sandbox.stop();}},C=class{providerType="daytona";name="Daytona";client;defaultTimeoutMs;snapshotName;sandboxUsers=new Map;managedStream;constructor(e){let t={apiKey:e.apiKey,apiUrl:e.apiUrl,target:e.target};this.client=e.managedToolboxUrl?new I(t,e.managedToolboxUrl):new sdk.Daytona(t),e.managedToolboxUrl&&(this.managedStream={toolboxUrl:e.managedToolboxUrl,apiKey:e.apiKey}),this.defaultTimeoutMs=e.defaultTimeoutMs??36e5,this.snapshotName=e.snapshotName??"evolve-all";}async create(e){if(e.idleTimeoutMs!==void 0)throw new S;let t=await B(e.network),n=e.user,r=n&&n!=="root"?n:void 0,l=e.timeoutMs??this.defaultTimeoutMs,o=Math.max(1,Math.ceil(l/6e4)),a=e.image||this.snapshotName,i={envVars:e.envs,labels:e.metadata,autoStopInterval:o,autoDeleteInterval:q,...r?{user:r}:{},...t},d,c=e.resources!==void 0&&(e.resources.cpu!==void 0||e.resources.memory!==void 0||e.resources.disk!==void 0);if(this.managedStream){if(c)throw new h(a);let u=await this.client.create({snapshot:a,...i},{timeout:600});return e.workingDirectory&&await u.fs.createFolder(e.workingDirectory,"755"),n&&this.sandboxUsers.set(u.id,n),new b(u,n,this.managedStream)}try{let u=await this.client.snapshot.get(a);if(u&&u.state==="active"){if(c)throw new h(a);console.log(`[daytona] Using cached snapshot: ${a}`),d=await this.client.create({snapshot:a,...i},{timeout:600});}else throw new Error("Snapshot not active")}catch(u){if(u instanceof h)throw u;let m=z[a]??a;console.log(`[daytona] Snapshot "${a}" not found, building from image: ${m}`),console.log("[daytona] First run will take a few minutes (this only happens once)...");try{await this.client.snapshot.create({name:a,image:sdk.Image.base(m),resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{onLogs:g=>console.log(`[daytona] ${g}`)}),console.log(`[daytona] Snapshot "${a}" ready.`),d=await this.client.create({snapshot:a,...i},{timeout:600});}catch(g){console.warn(`[daytona] Snapshot creation failed, falling back to direct image: ${g instanceof Error?g.message:g}`);try{d=await this.client.create({image:m,...i,resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{timeout:600,onSnapshotCreateLogs:p=>console.log(`[daytona] ${p}`)});}catch(p){throw O(m)?new w(m,p):p}}}return e.workingDirectory&&await d.fs.createFolder(e.workingDirectory,"755"),n&&this.sandboxUsers.set(d.id,n),new b(d,n,this.managedStream)}async connect(e,t){let n=await this.client.get(e);return n.state!=="started"&&await n.start(),new b(n,this.sandboxUsers.get(e),this.managedStream)}async list(e){let t=await this.paginate(e);if(t.error&&!t.stoppedAtLimit)throw new Error(t.error);return t.sandboxes}async listAll(e){let{stoppedAtLimit:t,...n}=await this.paginate(e);return n}async paginate(e){return K(t=>this.listPage(e,t),e)}async listPage(e,t){let n=e?.state?ne(e.state):void 0;if(n&&n.length>0){let r=this.client.sandboxApi;if(typeof r?.listSandboxesPaginated=="function")try{let l=await r.listSandboxesPaginated(void 0,t,T,void 0,void 0,e?.metadata?JSON.stringify(e.metadata):void 0,void 0,n);return {items:l.data.items,totalPages:l.data.totalPages}}catch{}}return this.client.list(e?.metadata,t,T)}};function ne(s){let e=[];for(let t of s)t==="running"&&e.push("started"),t==="paused"&&e.push("stopped","archived");return e}async function K(s,e){let t=e?.limit,n=[],r=0,l=new Set;for(let o=1;o<=y;o+=1){let a;try{a=await s(o);}catch(d){return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:false,error:`sandbox list failed: ${d instanceof Error?d.message:String(d)}`}}r+=1;for(let d of a.items){if(e?.state){let c=_(d.state);if(c===void 0||!e.state.includes(c))continue}if(!l.has(d.id)){if(t!==void 0&&n.length>=t)return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:true,error:`stopped at the requested limit of ${t} with more sandboxes available`};l.add(d.id),n.push(k(d));}}let i=a.items.length===0||typeof a.totalPages=="number"&&o>=a.totalPages;if(t!==void 0&&n.length>=t&&!i)return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:true,error:`stopped at the requested limit of ${t} with more sandboxes available`};if(i)break;if(o===y)return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:false,error:`sandbox list exceeded ${y} pages`}}return {sandboxes:n,complete:true,pagesFetched:r,stoppedAtLimit:false}}var oe=K;function ae(s={}){let e=s.apiKey??process.env.DAYTONA_API_KEY;if(!e)throw new Error("Daytona API key required. Set DAYTONA_API_KEY environment variable or pass apiKey in config. Get your key at https://app.daytona.io/dashboard/keys");return new C({...s,apiKey:e})}var ie=P,de=v,le=B,ce=O,ue=k,me=_,ge=N,fe=F,pe=x;
+exports.DAYTONA_AUTO_DELETE_GRACE_MINUTES=q;exports.DAYTONA_LIST_PAGE_SIZE=T;exports.DAYTONA_MAX_LIST_PAGES=y;exports.DAYTONA_MAX_NETWORK_ALLOWLIST=L;exports.DaytonaCommands=D;exports.DaytonaFiles=A;exports.DaytonaIdleTimeoutError=S;exports.DaytonaImagePullError=w;exports.DaytonaNetworkPolicyError=f;exports.DaytonaProvider=C;exports.DaytonaResourcesError=h;exports._testCollectSandboxPages=oe;exports._testCreateLogDemuxer=ge;exports._testDaytonaStateToEvolveState=me;exports._testFollowManagedSessionLogs=fe;exports._testImageRegistryHost=ce;exports._testMapNetworkPolicy=le;exports._testReadCommandStreams=pe;exports._testToSandboxInfo=ue;exports._testWithInBoxTimeout=de;exports._testWrapCommand=ie;exports.createDaytonaProvider=ae;

package/dist/index.d.cts

@@ -1,3 +1,5 @@
+import { Sandbox } from '@daytonaio/sdk';
+
 /**
  * Daytona Sandbox Provider
  *
@@ -7,17 +9,215 @@
  * - Mirror E2B provider interface for SDK compatibility
  * - Uses public Docker images via IMAGE_MAP
  * - Parallel structure to E2B provider
+ *
+ * Daytona-specific notes:
+ * - Network policy maps to Daytona's networkBlockAll / networkAllowList,
+ *   enforced by kernel iptables on the runner. The allowlist is IPv4 CIDR
+ *   ONLY (max 10 entries, DAYTONA_MAX_NETWORK_ALLOWLIST). Hostname
+ *   destinations are pinned to their IPv4 addresses by a DNS lookup at
+ *   create time — see the DNS-ROTATION CAVEAT on SandboxCreateOptions.network.
+ *   Destinations Daytona can never enforce (wildcards, IPv6, unresolvable
+ *   hostnames, >10 CIDRs) throw DaytonaNetworkPolicyError instead of
+ *   silently weakening the policy.
+ * - The `user` option is a CREATE-TIME OS user (Daytona's osUser field);
+ *   there is no per-exec user switch — the Daytona daemon runs commands as
+ *   the container's user (governed by the image's USER directive; default
+ *   images use "daytona" with passwordless sudo). `user: "root"` keeps the
+ *   image's default user and elevates every command through a `sudo -n`
+ *   wrapper instead (mirrors the Modal provider's su wrapper). File
+ *   operations always go through the Daytona daemon and are NOT elevated.
+ * - Private registry images (AWS ECR, GHCR, GCP Artifact Registry, ...)
+ *   require registry credentials pre-registered in the Daytona dashboard
+ *   (Registries page) — Daytona has no per-call image pull secret. Pull
+ *   failures for such images throw DaytonaImagePullError.
+ * - getInfo()/list() report the API's real createdAt timestamp (never a
+ *   fabricated client-side date); Daytona exposes no end timestamp, so
+ *   endAt is always undefined.
+ */
+
+/**
+ * Daytona's hard cap on network allowlist size (validated server-side too).
+ * Policies that resolve to more CIDRs throw DaytonaNetworkPolicyError.
+ */
+/**
+ * Minutes a STOPPED sandbox is kept before Daytona deletes it. Long enough that
+ * a stop nobody ordered leaves something to look at and something to collect
+ * from; short enough that it is never a way to hold billable state.
+ */
+declare const DAYTONA_AUTO_DELETE_GRACE_MINUTES = 10;
+declare const DAYTONA_MAX_NETWORK_ALLOWLIST = 10;
+/**
+ * Sandboxes requested per list page. Held at the value every provider in this
+ * lineup accepts, so one number is valid everywhere a fleet is enumerated.
  */
+declare const DAYTONA_LIST_PAGE_SIZE = 100;
 /**
- * Wrap command with cwd and envs shell prefixes.
+ * Page ceiling for one enumeration — 10,000 sandboxes at the page size above.
+ * A walk that reaches it stops and reports itself INCOMPLETE, because the one
+ * thing a fleet enumeration may never do is return a short list that reads like
+ * a whole one.
+ */
+declare const DAYTONA_MAX_LIST_PAGES = 100;
+/** Why a network policy cannot be enforced by Daytona. */
+type DaytonaNetworkPolicyReason = "wildcard-hostname" | "ipv6-unsupported" | "port-unsupported" | "invalid-ipv4" | "unresolvable-hostname" | "allowlist-too-large";
+/**
+ * Typed error for network policies Daytona cannot enforce.
+ *
+ * Daytona's allowlist is kernel-level IPv4 CIDR filtering only (max 10
+ * entries) — no DNS/domain layer. Anything that cannot be pinned to stable
+ * IPv4 CIDRs at create time is rejected loudly instead of silently
+ * weakening the sandbox's egress policy.
+ */
+declare class DaytonaNetworkPolicyError extends Error {
+    readonly reason: DaytonaNetworkPolicyReason;
+    /** The offending destination (absent for list-level violations). */
+    readonly destination?: string;
+    constructor(reason: DaytonaNetworkPolicyReason, message: string, destination?: string);
+}
+/**
+ * Typed error for image pull failures on private registries.
+ *
+ * Daytona has no per-call image pull secret: credentials for private
+ * registries (AWS ECR, GHCR, GCP Artifact Registry, private Docker Hub)
+ * must be pre-registered in the Daytona dashboard BEFORE creating the
+ * sandbox (dashboard → Registries → Add Registry).
+ */
+declare class DaytonaImagePullError extends Error {
+    /** The image reference that failed to pull. */
+    readonly image: string;
+    constructor(image: string, cause?: unknown);
+}
+/**
+ * Typed error for create-time sizing requests an EXISTING snapshot cannot
+ * honor. Daytona pins cpu/memory/disk on the SNAPSHOT at build time;
+ * create-from-snapshot has no resources parameter, so a `resources` request
+ * against a cached snapshot would be silently ignored. Per the provider law
+ * (reject what you cannot enforce) it is refused loudly instead: pre-build a
+ * snapshot with the desired sizing under its own name, or drop `resources`.
+ */
+declare class DaytonaResourcesError extends Error {
+    /** The existing snapshot whose pinned sizing cannot be overridden. */
+    readonly snapshot: string;
+    constructor(snapshot: string);
+}
+/**
+ * Typed error for an idle timeout Daytona cannot take as a SEPARATE bound.
+ * Daytona has no absolute lifetime at all: auto-stop is an inactivity clock and
+ * it is the only one there is, so `timeoutMs` is already mapped onto it. A
+ * second option pointing at the same knob could only contradict the first.
+ */
+declare class DaytonaIdleTimeoutError extends Error {
+    constructor();
+}
+/**
+ * Wrap command with cwd and envs shell prefixes, and (for user "root") a
+ * `sudo -n` elevation wrapper.
  *
  * Daytona's executeSessionCommand doesn't support cwd or envs natively,
  * so we inline them as shell commands. Values are single-quoted to handle
  * spaces and special characters safely.
+ *
+ * Daytona has no per-exec user switch: commands run as the container's OS
+ * user (image USER directive; default "daytona" with passwordless sudo).
+ * When the sandbox user is "root", the fully wrapped command is base64
+ * encoded and piped through `sudo -n bash` — base64 avoids escaping issues
+ * and `-n` fails fast (typed non-zero exit) instead of hanging on a
+ * password prompt if the image lacks passwordless sudo.
  */
-declare function wrapCommand(command: string, cwd?: string, envs?: Record<string, string>): string;
-/** @internal Test-only export for unit testing wrapCommand logic. */
-declare const _testWrapCommand: typeof wrapCommand;
+/**
+ * Enforce the timeout INSIDE the box, on BOTH execution paths. Daytona has no
+ * fixed sandbox lifetime, and its auto-stop timer measures INACTIVITY over SDK
+ * interactions ("no new events ... state changes or interactions with the
+ * Sandbox through the sdk"), so it bounds nothing that matters here: while a
+ * client is polling, that polling is itself an interaction and resets the clock,
+ * and once the client is gone the box still runs for the whole remaining
+ * interval before it merely STOPS. e2b and Modal both take an absolute,
+ * server-side lifetime; Daytona takes none.
+ *
+ * The session API's timeout argument does not close the hole on either path.
+ * spawn launches with runAsync:true, where that argument bounds the *call*, not
+ * the process, and the only deadline is a client-side poll in wait(). run blocks
+ * with runAsync:false, where the argument is documented as how long to WAIT for
+ * the command — and it is this process that waits, so a wait that ends because
+ * this process died is not a kill.
+ *
+ * coreutils `timeout` closes it for both: the kernel kills the command whether
+ * or not anything is still watching, and exits 124 — the same code wait()'s own
+ * deadline and the e2b adapter return, so a timeout means one thing across every
+ * provider and both paths. The script is passed base64 -> file so no quoting of
+ * the caller's command is ever attempted, and a box without coreutils degrades
+ * to the un-timed run rather than failing outright (the client-side deadlines
+ * still cover the case where a client is alive to enforce them).
+ *
+ * IT FAILS CLOSED ON A BAD DECODE, and that is not a nicety. `>` creates the
+ * file before the pipeline runs, so on an image with no `base64` the decode
+ * fails and leaves a ZERO-BYTE script — and `bash <empty>` exits 0 having
+ * printed nothing. This wrapper would then have turned a command that used to
+ * fail loudly into one that reports success with empty output, on exactly the
+ * images where it breaks: the eval artifact listing is itself a
+ * `find ... | base64 -w0`, so a box missing base64 failed that listing outright
+ * before this wrapper existed, and would afterwards have returned an empty
+ * listing instead — no files, no patch, and a clean exit all the way up. So the
+ * decode is chained with `&&` and the script is size-checked before bash is
+ * handed it; either way out is exit 126, which is nonzero and therefore visible
+ * to every caller that checks.
+ */
+declare function withInBoxTimeout(wrapped: string, timeoutSec?: number): string;
+declare function wrapCommand(command: string, cwd?: string, envs?: Record<string, string>, user?: string): string;
+/** Daytona create() params derived from Evolve's provider-neutral network policy. */
+interface DaytonaNetworkCreateParams {
+    networkBlockAll?: boolean;
+    networkAllowList?: string;
+}
+/** Resolves a hostname to its IPv4 addresses (injectable for tests). */
+type HostnameResolver = (hostname: string) => Promise<string[]>;
+/**
+ * Map Evolve's provider-neutral network policy onto Daytona create() params.
+ *
+ * - outbound "open" (or no policy)     → no restrictions
+ * - outbound "blocked", no allowlist   → networkBlockAll: true (kernel DROP of all egress)
+ * - outbound "blocked" with allowlist  → networkAllowList (comma-separated IPv4
+ *   CIDRs; bare IPv4 gets /32). Daytona enforces the allowlist with kernel
+ *   iptables and supports IPv4 CIDRs ONLY, max 10 entries.
+ *
+ * DNS-ROTATION CAVEAT (load-bearing): hostname destinations are resolved to
+ * their IPv4 A records ONCE, at create time, and pinned as /32 CIDRs. If the
+ * host rotates DNS afterwards (CDNs and cloud APIs often do), traffic to the
+ * new IPs is BLOCKED for the sandbox's lifetime. Prefer stable IPs/CIDRs for
+ * anything long-running.
+ *
+ * Anything that cannot be pinned to stable IPv4 CIDRs throws
+ * DaytonaNetworkPolicyError (wildcard hostnames, IPv6, unresolvable
+ * hostnames, >10 resolved CIDRs) — never silently weakened.
+ */
+declare function mapNetworkPolicy(network?: SandboxCreateOptions["network"], resolveHostname?: HostnameResolver): Promise<DaytonaNetworkCreateParams>;
+/**
+ * Registry host of an image reference, or undefined for Docker Hub images.
+ * A reference carries a registry host only when its first path segment
+ * contains "." or ":" or is "localhost" (Docker's own heuristic).
+ */
+declare function imageRegistryHost(image: string): string | undefined;
+/** Fields we read off a Daytona SDK sandbox to build a SandboxInfo. */
+interface DaytonaSandboxLike {
+    id: string;
+    name?: string;
+    snapshot?: string;
+    labels?: Record<string, string>;
+    createdAt?: string;
+}
+/**
+ * Build a SandboxInfo from a Daytona sandbox entity. Timestamps come from
+ * the API's createdAt (never fabricated client-side; empty string when the
+ * API omits it). Daytona exposes no end timestamp, so endAt is always
+ * undefined.
+ */
+declare function toSandboxInfo(sandbox: DaytonaSandboxLike): SandboxInfo;
+/**
+ * Map a Daytona sandbox state onto Evolve's list() filter states.
+ * "started" → running; "stopped"/"archived" → paused (our pause() stops the
+ * sandbox); transitional and terminal states match no filter.
+ */
+declare function daytonaStateToEvolveState(state?: string): "running" | "paused" | undefined;
 /** Result of a completed sandbox command */
 interface SandboxCommandResult {
     exitCode: number;
@@ -46,6 +246,7 @@ interface SandboxInfo {
     name?: string;
     metadata: Record<string, string>;
     startedAt: string;
+    /** End time (undefined for running sandboxes; Daytona never exposes one) */
     endAt?: string;
 }
 /** File or directory entry info */
@@ -81,16 +282,72 @@ interface SandboxCreateOptions {
     envs?: Record<string, string>;
     metadata?: Record<string, string>;
     timeoutMs?: number;
+    /**
+     * REJECTED with DaytonaIdleTimeoutError — not for want of an idle clock, but
+     * because auto-stop is the ONLY clock Daytona has and `timeoutMs` is already
+     * mapped onto it (autoStopInterval). Two options, one knob.
+     */
+    idleTimeoutMs?: number;
     workingDirectory?: string;
-    /** Resource allocation for the sandbox */
+    /**
+     * Resource allocation (cpu cores, memory GiB, disk GiB), applied when a
+     * SNAPSHOT IS BUILT for the image (Daytona pins sizing on the snapshot).
+     * When the named snapshot ALREADY exists it cannot be resized at create —
+     * declaring resources then throws DaytonaResourcesError rather than
+     * silently ignoring them (pre-build a sizing-addressed snapshot instead).
+     */
     resources?: SandboxResources;
+    /**
+     * Provider-neutral outbound network policy, enforced by kernel iptables on
+     * the Daytona runner. "blocked" with no allowedDestinations drops all
+     * egress. With allowedDestinations, Daytona supports IPv4 CIDRs ONLY (max
+     * 10): IPs/CIDRs pass through; hostnames are DNS-resolved ONCE at create
+     * time and pinned as /32 CIDRs — if the host rotates DNS later (CDNs and
+     * cloud APIs often do), its new IPs are BLOCKED for the sandbox's
+     * lifetime. Wildcards, IPv6, and unresolvable hostnames throw
+     * DaytonaNetworkPolicyError rather than silently weakening the policy.
+     * Note: on Daytona orgs below Tier 3, org network policy overrides
+     * per-sandbox settings server-side.
+     */
+    network?: {
+        outbound: "open" | "blocked";
+        allowedDestinations?: string[];
+    };
+    /**
+     * OS user for the sandbox, applied at CREATE time (Daytona's osUser field)
+     * — Daytona has no per-exec user switch, so the user commands actually run
+     * as is governed by the sandbox image (USER directive; default Daytona
+     * images use "daytona" with passwordless sudo). A non-root value must
+     * exist in the image. Pass "root" to keep the image's default user and
+     * elevate every command through a `sudo -n` wrapper instead (requires
+     * passwordless sudo in the image; default images have it). File operations
+     * go through the Daytona daemon and are NOT elevated.
+     */
+    user?: string;
+    /** Home directory used by the SDK for agent config paths; not consumed by the provider. */
+    homeDir?: string;
 }
 /** Options for listing sandboxes */
 interface SandboxListOptions {
+    /** "running" matches Daytona "started"; "paused" matches "stopped"/"archived". */
     state?: ("running" | "paused")[];
     metadata?: Record<string, string>;
     limit?: number;
 }
+/**
+ * A COMPLETE (or admittedly incomplete) enumeration of the organization's fleet.
+ *
+ * `complete` is the load-bearing field. Callers that need a whole fleet —
+ * orphan sweeps, lifecycle reconciliation — read a sandbox's ABSENCE from the
+ * list as evidence it is gone, so a truncated page and a small fleet must never
+ * be the same answer. `complete: false` means leave every row alone.
+ */
+interface SandboxListPage {
+    sandboxes: SandboxInfo[];
+    complete: boolean;
+    pagesFetched: number;
+    error?: string;
+}
 /** Command execution capabilities */
 interface SandboxCommands {
     run(command: string, options?: SandboxRunOptions): Promise<SandboxCommandResult>;
@@ -106,6 +363,8 @@ interface SandboxFiles {
         path: string;
         data: string | Buffer | ArrayBuffer | Uint8Array;
     }>): Promise<void>;
+    /** Upload a local file by path, without buffering it whole */
+    writeFromPath(sandboxPath: string, localPath: string): Promise<void>;
     makeDir(path: string): Promise<void>;
     exists(path: string): Promise<boolean>;
     list(path: string): Promise<FileInfo[]>;
@@ -129,7 +388,10 @@ interface SandboxProvider {
     readonly name?: string;
     create(options: SandboxCreateOptions): Promise<SandboxInstance>;
     connect(sandboxId: string, timeoutMs?: number): Promise<SandboxInstance>;
+    /** List sandboxes, paginating to exhaustion. `limit` bounds items returned. */
     list(options?: SandboxListOptions): Promise<SandboxInfo[]>;
+    /** The same enumeration for fleet bookkeeping: never throws, reports completeness. */
+    listAll(options?: SandboxListOptions): Promise<SandboxListPage>;
 }
 interface DaytonaConfig {
     /** Daytona API key. Default: reads from DAYTONA_API_KEY env var */
@@ -142,6 +404,20 @@ interface DaytonaConfig {
     defaultTimeoutMs?: number;
     /** Daytona snapshot name (default: 'evolve-all'). Create custom snapshots via `cd assets && ./build.sh daytona` */
     snapshotName?: string;
+    /**
+     * Evolve-managed toolbox base URL. Setting it puts the provider in MANAGED
+     * mode, where `apiKey` is an Evolve API key rather than a Daytona one and
+     * both planes ride the Dashboard.
+     *
+     * One field rather than a separate `managed: true` because the two effects
+     * have one cause: if the toolbox belongs to the platform, so do the
+     * snapshots behind it, so managed creates name an existing platform snapshot
+     * and never build one. Resolved by the Evolve SDK; direct/BYO callers leave
+     * it unset.
+     *
+     * @internal
+     */
+    managedToolboxUrl?: string;
 }
 interface ResolvedDaytonaConfig {
     apiKey: string;
@@ -149,6 +425,110 @@ interface ResolvedDaytonaConfig {
     target?: string;
     defaultTimeoutMs?: number;
     snapshotName?: string;
+    managedToolboxUrl?: string;
+}
+/** What a managed sandbox's streaming log follow needs to reach the Dashboard. */
+interface ManagedStreamContext {
+    toolboxUrl: string;
+    apiKey: string;
+}
+/**
+ * Split Daytona's multiplexed command log into stdout and stderr as the bytes
+ * arrive.
+ *
+ * The wire format is one byte stream with 3-byte markers announcing which
+ * stream the following bytes belong to (STDOUT_PREFIX_BYTES /
+ * STDERR_PREFIX_BYTES, both exported by the Daytona SDK — this reads their
+ * framing, it does not invent one). Two things make a streaming demux
+ * different from the SDK's whole-buffer one: a marker can be split across two
+ * chunks, so the last MAX_PREFIX_LEN-1 bytes are always held back rather than
+ * emitted; and a multi-byte UTF-8 character can be split too, so each stream
+ * keeps its own decoder in streaming mode.
+ */
+declare function createLogDemuxer(onStdout: (chunk: string) => void, onStderr: (chunk: string) => void): {
+    push(chunk: Uint8Array): void;
+    flush(): void;
+};
+/**
+ * Follow a session command's logs over plain HTTP.
+ *
+ * The Daytona SDK follows logs over a WEBSOCKET (Process.js:289 rewrites the
+ * toolbox base to ws:// and opens a socket). A managed sandbox's toolbox base
+ * is a Next.js route handler, and a Next route handler never sees a websocket
+ * upgrade — the codebase's one websocket proxy lives in a separate custom
+ * server for exactly that reason. So managed mode cannot use that transport.
+ *
+ * It does not have to. MEASURED 2026-07-26 against a live sandbox: the same
+ * endpoint with `?follow=true` over ordinary HTTP answers 200 with
+ * `transfer-encoding: chunked` and `content-type: application/octet-stream`,
+ * and chunks arrive as the command produces them — 95 ms, 1045 ms, 2127 ms,
+ * 2984 ms, 3976 ms for a command printing one line per second. That is real
+ * streaming through a plain response body, which is what the Dashboard route
+ * pipes through unbuffered.
+ */
+declare function followManagedSessionLogs(context: ManagedStreamContext, sandboxId: string, sessionId: string, commandId: string, onStdout: (chunk: string) => void, onStderr: (chunk: string) => void): Promise<void>;
+/**
+ * Read a command's streams out of whatever shape Daytona returned.
+ *
+ * Session logs are USUALLY framed with per-stream markers, and the Daytona
+ * SDK's demux returns "" for a stream whose marker never appears. An empty
+ * string is not "this command printed nothing" — it means "this daemon build
+ * did not frame the output" — and `??` does not fall through an empty string,
+ * so reading `stdout ?? output` silently reports every such command as silent.
+ *
+ * Measured 2026-07-26 on a live sandbox booted from ubuntu:22.04: a command
+ * printing one line to each stream came back as
+ * {output: "hello-managed\noops\n", stdout: null, exitCode: 0} with no marker
+ * bytes anywhere in the log body, and the provider reported exit 0 with empty
+ * stdout. Unframed output goes to stdout, because that is what the combined
+ * `output` field is; a framed response is untouched.
+ */
+declare function readCommandStreams(source: {
+    stdout?: string | null;
+    stderr?: string | null;
+    output?: string | null;
+}): {
+    stdout: string;
+    stderr: string;
+};
+declare class DaytonaCommands implements SandboxCommands {
+    private sandbox;
+    private user?;
+    private managedStream?;
+    constructor(sandbox: Sandbox, user?: string | undefined, managedStream?: ManagedStreamContext | undefined);
+    /**
+     * Stream a command's output to callbacks. Direct mode uses the Daytona
+     * SDK's own follow, which is a websocket; managed mode uses the HTTP
+     * chunked follow, because a Dashboard route handler cannot terminate a
+     * websocket upgrade (see followManagedSessionLogs).
+     */
+    private followLogs;
+    run(command: string, options?: SandboxRunOptions): Promise<SandboxCommandResult>;
+    spawn(command: string, options?: SandboxSpawnOptions): Promise<SandboxCommandHandle>;
+    list(): Promise<ProcessInfo[]>;
+    kill(processId: string): Promise<boolean>;
+}
+declare class DaytonaFiles implements SandboxFiles {
+    private sandbox;
+    constructor(sandbox: Sandbox);
+    read(path: string): Promise<string | Uint8Array>;
+    write(path: string, content: string | Buffer | ArrayBuffer | Uint8Array): Promise<void>;
+    writeBatch(files: Array<{
+        path: string;
+        data: string | Buffer | ArrayBuffer | Uint8Array;
+    }>): Promise<void>;
+    /**
+     * Upload a local file by PATH. Daytona's own uploadFile has a local-path
+     * overload (FileSystem.d.ts: `uploadFile(localPath: string, remotePath:
+     * string, timeout?)`), so the bytes never pass through this process's heap —
+     * which is what makes a large artifact safe to upload under concurrency.
+     */
+    writeFromPath(sandboxPath: string, localPath: string): Promise<void>;
+    makeDir(path: string): Promise<void>;
+    exists(path: string): Promise<boolean>;
+    list(path: string): Promise<FileInfo[]>;
+    remove(path: string): Promise<void>;
+    rename(oldPath: string, newPath: string): Promise<void>;
 }
 declare class DaytonaProvider implements SandboxProvider {
     readonly providerType: "daytona";
@@ -156,11 +536,85 @@ declare class DaytonaProvider implements SandboxProvider {
     private readonly client;
     private readonly defaultTimeoutMs;
     private readonly snapshotName;
+    /**
+     * Sandbox user configured at create time, reapplied on connect() so the
+     * root sudo wrapper keeps applying. In-memory only: a connect() from a
+     * fresh process falls back to the sandbox's create-time OS user without
+     * the wrapper — callers reconnecting across processes must recreate the
+     * provider and sandbox with the same user, or root-only operations fail
+     * loudly.
+     */
+    private readonly sandboxUsers;
+    /** Set only in Evolve-managed mode; see the EVOLVE-MANAGED MODE section. */
+    private readonly managedStream?;
     constructor(config: ResolvedDaytonaConfig);
     create(options: SandboxCreateOptions): Promise<SandboxInstance>;
     connect(sandboxId: string, _timeoutMs?: number): Promise<SandboxInstance>;
+    /**
+     * List sandboxes, walking every page.
+     *
+     * This used to request page 1 and stop, discarding `totalPages` — an
+     * organization with more than one page of sandboxes was silently truncated,
+     * and nothing in the return value said so. For any caller that reads absence
+     * from the list as "this sandbox is gone", that is a correctness bug.
+     *
+     * ORDER OF OPERATIONS, because it is observable: `limit` bounds the sandboxes
+     * RETURNED, and Daytona has no server-side state filter, so the state filter
+     * runs client-side on each page BEFORE the limit is counted. Asking for 10
+     * running sandboxes therefore keeps paging until ten running ones have been
+     * found, rather than filtering ten arbitrary rows down to whatever survives.
+     */
     list(options?: SandboxListOptions): Promise<SandboxInfo[]>;
+    /**
+     * The fleet-bookkeeping enumeration: same walk, never throws.
+     *
+     * The distinction from `list()` is what a failure MEANS to the caller. An
+     * orphan sweep treats a missing sandbox as a terminated one, so it must be
+     * able to tell "the organization has no sandboxes" from "the enumeration
+     * stopped early".
+     */
+    listAll(options?: SandboxListOptions): Promise<SandboxListPage>;
+    private paginate;
+    /**
+     * One page, asking the API to do the state filtering when it can.
+     *
+     * Daytona's REST endpoint takes a `states` array
+     * (api-client sandbox-api.d.ts listSandboxesPaginated), but the SDK wrapper
+     * this provider is built on does not expose it — `Daytona.list(labels, page,
+     * limit)` is the whole public surface, and `sandboxApi` is declared private.
+     * Without the server-side filter, `state: ['running']` on an organization
+     * full of archived boxes pages through all of them client-side looking for a
+     * handful of live ones.
+     *
+     * So the server filter is applied OPPORTUNISTICALLY, through the private
+     * field when it is shaped the way we expect, and the client-side filter in
+     * the walk stays the authority regardless. That ordering is the whole point:
+     * if a future SDK refactor renames or removes the field, this degrades to the
+     * request count it has today, and can never degrade to admitting states the
+     * caller excluded.
+     */
+    private listPage;
+}
+/** One page as Daytona's `list(labels?, page?, limit?)` returns it. */
+interface DaytonaSandboxPage {
+    items: Sandbox[];
+    totalPages?: number;
 }
+/**
+ * Walk every page into one answer, with an honest completeness verdict.
+ *
+ * Separate from the provider because everything worth getting wrong lives here
+ * and none of it needs a network: the ways a walk can fail to terminate, the
+ * difference between "the caller asked for ten" and "the provider ran out", and
+ * the rule that a failure mid-walk yields the sandboxes seen so far marked
+ * INCOMPLETE rather than either an exception or a short complete list.
+ *
+ * Exported for its test (`_testCollectSandboxPages`).
+ */
+declare function collectSandboxPages(fetchPage: (page: number) => Promise<DaytonaSandboxPage>, options?: SandboxListOptions): Promise<SandboxListPage & {
+    stoppedAtLimit: boolean;
+}>;
+declare const _testCollectSandboxPages: typeof collectSandboxPages;
 /**
  * Create Daytona sandbox provider.
  *
@@ -168,5 +622,15 @@ declare class DaytonaProvider implements SandboxProvider {
  * @throws Error if apiKey cannot be resolved
  */
 declare function createDaytonaProvider(config?: DaytonaConfig): SandboxProvider;
+/** @internal Test-only export for unit testing wrapCommand logic. */
+declare const _testWrapCommand: typeof wrapCommand;
+declare const _testWithInBoxTimeout: typeof withInBoxTimeout;
+declare const _testMapNetworkPolicy: typeof mapNetworkPolicy;
+declare const _testImageRegistryHost: typeof imageRegistryHost;
+declare const _testToSandboxInfo: typeof toSandboxInfo;
+declare const _testDaytonaStateToEvolveState: typeof daytonaStateToEvolveState;
+declare const _testCreateLogDemuxer: typeof createLogDemuxer;
+declare const _testFollowManagedSessionLogs: typeof followManagedSessionLogs;
+declare const _testReadCommandStreams: typeof readCommandStreams;
 
-export { type DaytonaConfig, DaytonaProvider, type FileInfo, type ProcessInfo, type SandboxCommandHandle, type SandboxCommandResult, type SandboxCommands, type SandboxCreateOptions, type SandboxFiles, type SandboxInfo, type SandboxInstance, type SandboxListOptions, type SandboxProvider, type SandboxResources, type SandboxRunOptions, type SandboxSpawnOptions, _testWrapCommand, createDaytonaProvider };
+export { DAYTONA_AUTO_DELETE_GRACE_MINUTES, DAYTONA_LIST_PAGE_SIZE, DAYTONA_MAX_LIST_PAGES, DAYTONA_MAX_NETWORK_ALLOWLIST, DaytonaCommands, type DaytonaConfig, DaytonaFiles, DaytonaIdleTimeoutError, DaytonaImagePullError, DaytonaNetworkPolicyError, type DaytonaNetworkPolicyReason, DaytonaProvider, DaytonaResourcesError, type DaytonaSandboxPage, type FileInfo, type ProcessInfo, type SandboxCommandHandle, type SandboxCommandResult, type SandboxCommands, type SandboxCreateOptions, type SandboxFiles, type SandboxInfo, type SandboxInstance, type SandboxListOptions, type SandboxListPage, type SandboxProvider, type SandboxResources, type SandboxRunOptions, type SandboxSpawnOptions, _testCollectSandboxPages, _testCreateLogDemuxer, _testDaytonaStateToEvolveState, _testFollowManagedSessionLogs, _testImageRegistryHost, _testMapNetworkPolicy, _testReadCommandStreams, _testToSandboxInfo, _testWithInBoxTimeout, _testWrapCommand, createDaytonaProvider };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { Sandbox } from '@daytonaio/sdk';
+
 /**
  * Daytona Sandbox Provider
  *
@@ -7,17 +9,215 @@
  * - Mirror E2B provider interface for SDK compatibility
  * - Uses public Docker images via IMAGE_MAP
  * - Parallel structure to E2B provider
+ *
+ * Daytona-specific notes:
+ * - Network policy maps to Daytona's networkBlockAll / networkAllowList,
+ *   enforced by kernel iptables on the runner. The allowlist is IPv4 CIDR
+ *   ONLY (max 10 entries, DAYTONA_MAX_NETWORK_ALLOWLIST). Hostname
+ *   destinations are pinned to their IPv4 addresses by a DNS lookup at
+ *   create time — see the DNS-ROTATION CAVEAT on SandboxCreateOptions.network.
+ *   Destinations Daytona can never enforce (wildcards, IPv6, unresolvable
+ *   hostnames, >10 CIDRs) throw DaytonaNetworkPolicyError instead of
+ *   silently weakening the policy.
+ * - The `user` option is a CREATE-TIME OS user (Daytona's osUser field);
+ *   there is no per-exec user switch — the Daytona daemon runs commands as
+ *   the container's user (governed by the image's USER directive; default
+ *   images use "daytona" with passwordless sudo). `user: "root"` keeps the
+ *   image's default user and elevates every command through a `sudo -n`
+ *   wrapper instead (mirrors the Modal provider's su wrapper). File
+ *   operations always go through the Daytona daemon and are NOT elevated.
+ * - Private registry images (AWS ECR, GHCR, GCP Artifact Registry, ...)
+ *   require registry credentials pre-registered in the Daytona dashboard
+ *   (Registries page) — Daytona has no per-call image pull secret. Pull
+ *   failures for such images throw DaytonaImagePullError.
+ * - getInfo()/list() report the API's real createdAt timestamp (never a
+ *   fabricated client-side date); Daytona exposes no end timestamp, so
+ *   endAt is always undefined.
+ */
+
+/**
+ * Daytona's hard cap on network allowlist size (validated server-side too).
+ * Policies that resolve to more CIDRs throw DaytonaNetworkPolicyError.
+ */
+/**
+ * Minutes a STOPPED sandbox is kept before Daytona deletes it. Long enough that
+ * a stop nobody ordered leaves something to look at and something to collect
+ * from; short enough that it is never a way to hold billable state.
+ */
+declare const DAYTONA_AUTO_DELETE_GRACE_MINUTES = 10;
+declare const DAYTONA_MAX_NETWORK_ALLOWLIST = 10;
+/**
+ * Sandboxes requested per list page. Held at the value every provider in this
+ * lineup accepts, so one number is valid everywhere a fleet is enumerated.
  */
+declare const DAYTONA_LIST_PAGE_SIZE = 100;
 /**
- * Wrap command with cwd and envs shell prefixes.
+ * Page ceiling for one enumeration — 10,000 sandboxes at the page size above.
+ * A walk that reaches it stops and reports itself INCOMPLETE, because the one
+ * thing a fleet enumeration may never do is return a short list that reads like
+ * a whole one.
+ */
+declare const DAYTONA_MAX_LIST_PAGES = 100;
+/** Why a network policy cannot be enforced by Daytona. */
+type DaytonaNetworkPolicyReason = "wildcard-hostname" | "ipv6-unsupported" | "port-unsupported" | "invalid-ipv4" | "unresolvable-hostname" | "allowlist-too-large";
+/**
+ * Typed error for network policies Daytona cannot enforce.
+ *
+ * Daytona's allowlist is kernel-level IPv4 CIDR filtering only (max 10
+ * entries) — no DNS/domain layer. Anything that cannot be pinned to stable
+ * IPv4 CIDRs at create time is rejected loudly instead of silently
+ * weakening the sandbox's egress policy.
+ */
+declare class DaytonaNetworkPolicyError extends Error {
+    readonly reason: DaytonaNetworkPolicyReason;
+    /** The offending destination (absent for list-level violations). */
+    readonly destination?: string;
+    constructor(reason: DaytonaNetworkPolicyReason, message: string, destination?: string);
+}
+/**
+ * Typed error for image pull failures on private registries.
+ *
+ * Daytona has no per-call image pull secret: credentials for private
+ * registries (AWS ECR, GHCR, GCP Artifact Registry, private Docker Hub)
+ * must be pre-registered in the Daytona dashboard BEFORE creating the
+ * sandbox (dashboard → Registries → Add Registry).
+ */
+declare class DaytonaImagePullError extends Error {
+    /** The image reference that failed to pull. */
+    readonly image: string;
+    constructor(image: string, cause?: unknown);
+}
+/**
+ * Typed error for create-time sizing requests an EXISTING snapshot cannot
+ * honor. Daytona pins cpu/memory/disk on the SNAPSHOT at build time;
+ * create-from-snapshot has no resources parameter, so a `resources` request
+ * against a cached snapshot would be silently ignored. Per the provider law
+ * (reject what you cannot enforce) it is refused loudly instead: pre-build a
+ * snapshot with the desired sizing under its own name, or drop `resources`.
+ */
+declare class DaytonaResourcesError extends Error {
+    /** The existing snapshot whose pinned sizing cannot be overridden. */
+    readonly snapshot: string;
+    constructor(snapshot: string);
+}
+/**
+ * Typed error for an idle timeout Daytona cannot take as a SEPARATE bound.
+ * Daytona has no absolute lifetime at all: auto-stop is an inactivity clock and
+ * it is the only one there is, so `timeoutMs` is already mapped onto it. A
+ * second option pointing at the same knob could only contradict the first.
+ */
+declare class DaytonaIdleTimeoutError extends Error {
+    constructor();
+}
+/**
+ * Wrap command with cwd and envs shell prefixes, and (for user "root") a
+ * `sudo -n` elevation wrapper.
  *
  * Daytona's executeSessionCommand doesn't support cwd or envs natively,
  * so we inline them as shell commands. Values are single-quoted to handle
  * spaces and special characters safely.
+ *
+ * Daytona has no per-exec user switch: commands run as the container's OS
+ * user (image USER directive; default "daytona" with passwordless sudo).
+ * When the sandbox user is "root", the fully wrapped command is base64
+ * encoded and piped through `sudo -n bash` — base64 avoids escaping issues
+ * and `-n` fails fast (typed non-zero exit) instead of hanging on a
+ * password prompt if the image lacks passwordless sudo.
  */
-declare function wrapCommand(command: string, cwd?: string, envs?: Record<string, string>): string;
-/** @internal Test-only export for unit testing wrapCommand logic. */
-declare const _testWrapCommand: typeof wrapCommand;
+/**
+ * Enforce the timeout INSIDE the box, on BOTH execution paths. Daytona has no
+ * fixed sandbox lifetime, and its auto-stop timer measures INACTIVITY over SDK
+ * interactions ("no new events ... state changes or interactions with the
+ * Sandbox through the sdk"), so it bounds nothing that matters here: while a
+ * client is polling, that polling is itself an interaction and resets the clock,
+ * and once the client is gone the box still runs for the whole remaining
+ * interval before it merely STOPS. e2b and Modal both take an absolute,
+ * server-side lifetime; Daytona takes none.
+ *
+ * The session API's timeout argument does not close the hole on either path.
+ * spawn launches with runAsync:true, where that argument bounds the *call*, not
+ * the process, and the only deadline is a client-side poll in wait(). run blocks
+ * with runAsync:false, where the argument is documented as how long to WAIT for
+ * the command — and it is this process that waits, so a wait that ends because
+ * this process died is not a kill.
+ *
+ * coreutils `timeout` closes it for both: the kernel kills the command whether
+ * or not anything is still watching, and exits 124 — the same code wait()'s own
+ * deadline and the e2b adapter return, so a timeout means one thing across every
+ * provider and both paths. The script is passed base64 -> file so no quoting of
+ * the caller's command is ever attempted, and a box without coreutils degrades
+ * to the un-timed run rather than failing outright (the client-side deadlines
+ * still cover the case where a client is alive to enforce them).
+ *
+ * IT FAILS CLOSED ON A BAD DECODE, and that is not a nicety. `>` creates the
+ * file before the pipeline runs, so on an image with no `base64` the decode
+ * fails and leaves a ZERO-BYTE script — and `bash <empty>` exits 0 having
+ * printed nothing. This wrapper would then have turned a command that used to
+ * fail loudly into one that reports success with empty output, on exactly the
+ * images where it breaks: the eval artifact listing is itself a
+ * `find ... | base64 -w0`, so a box missing base64 failed that listing outright
+ * before this wrapper existed, and would afterwards have returned an empty
+ * listing instead — no files, no patch, and a clean exit all the way up. So the
+ * decode is chained with `&&` and the script is size-checked before bash is
+ * handed it; either way out is exit 126, which is nonzero and therefore visible
+ * to every caller that checks.
+ */
+declare function withInBoxTimeout(wrapped: string, timeoutSec?: number): string;
+declare function wrapCommand(command: string, cwd?: string, envs?: Record<string, string>, user?: string): string;
+/** Daytona create() params derived from Evolve's provider-neutral network policy. */
+interface DaytonaNetworkCreateParams {
+    networkBlockAll?: boolean;
+    networkAllowList?: string;
+}
+/** Resolves a hostname to its IPv4 addresses (injectable for tests). */
+type HostnameResolver = (hostname: string) => Promise<string[]>;
+/**
+ * Map Evolve's provider-neutral network policy onto Daytona create() params.
+ *
+ * - outbound "open" (or no policy)     → no restrictions
+ * - outbound "blocked", no allowlist   → networkBlockAll: true (kernel DROP of all egress)
+ * - outbound "blocked" with allowlist  → networkAllowList (comma-separated IPv4
+ *   CIDRs; bare IPv4 gets /32). Daytona enforces the allowlist with kernel
+ *   iptables and supports IPv4 CIDRs ONLY, max 10 entries.
+ *
+ * DNS-ROTATION CAVEAT (load-bearing): hostname destinations are resolved to
+ * their IPv4 A records ONCE, at create time, and pinned as /32 CIDRs. If the
+ * host rotates DNS afterwards (CDNs and cloud APIs often do), traffic to the
+ * new IPs is BLOCKED for the sandbox's lifetime. Prefer stable IPs/CIDRs for
+ * anything long-running.
+ *
+ * Anything that cannot be pinned to stable IPv4 CIDRs throws
+ * DaytonaNetworkPolicyError (wildcard hostnames, IPv6, unresolvable
+ * hostnames, >10 resolved CIDRs) — never silently weakened.
+ */
+declare function mapNetworkPolicy(network?: SandboxCreateOptions["network"], resolveHostname?: HostnameResolver): Promise<DaytonaNetworkCreateParams>;
+/**
+ * Registry host of an image reference, or undefined for Docker Hub images.
+ * A reference carries a registry host only when its first path segment
+ * contains "." or ":" or is "localhost" (Docker's own heuristic).
+ */
+declare function imageRegistryHost(image: string): string | undefined;
+/** Fields we read off a Daytona SDK sandbox to build a SandboxInfo. */
+interface DaytonaSandboxLike {
+    id: string;
+    name?: string;
+    snapshot?: string;
+    labels?: Record<string, string>;
+    createdAt?: string;
+}
+/**
+ * Build a SandboxInfo from a Daytona sandbox entity. Timestamps come from
+ * the API's createdAt (never fabricated client-side; empty string when the
+ * API omits it). Daytona exposes no end timestamp, so endAt is always
+ * undefined.
+ */
+declare function toSandboxInfo(sandbox: DaytonaSandboxLike): SandboxInfo;
+/**
+ * Map a Daytona sandbox state onto Evolve's list() filter states.
+ * "started" → running; "stopped"/"archived" → paused (our pause() stops the
+ * sandbox); transitional and terminal states match no filter.
+ */
+declare function daytonaStateToEvolveState(state?: string): "running" | "paused" | undefined;
 /** Result of a completed sandbox command */
 interface SandboxCommandResult {
     exitCode: number;
@@ -46,6 +246,7 @@ interface SandboxInfo {
     name?: string;
     metadata: Record<string, string>;
     startedAt: string;
+    /** End time (undefined for running sandboxes; Daytona never exposes one) */
     endAt?: string;
 }
 /** File or directory entry info */
@@ -81,16 +282,72 @@ interface SandboxCreateOptions {
     envs?: Record<string, string>;
     metadata?: Record<string, string>;
     timeoutMs?: number;
+    /**
+     * REJECTED with DaytonaIdleTimeoutError — not for want of an idle clock, but
+     * because auto-stop is the ONLY clock Daytona has and `timeoutMs` is already
+     * mapped onto it (autoStopInterval). Two options, one knob.
+     */
+    idleTimeoutMs?: number;
     workingDirectory?: string;
-    /** Resource allocation for the sandbox */
+    /**
+     * Resource allocation (cpu cores, memory GiB, disk GiB), applied when a
+     * SNAPSHOT IS BUILT for the image (Daytona pins sizing on the snapshot).
+     * When the named snapshot ALREADY exists it cannot be resized at create —
+     * declaring resources then throws DaytonaResourcesError rather than
+     * silently ignoring them (pre-build a sizing-addressed snapshot instead).
+     */
     resources?: SandboxResources;
+    /**
+     * Provider-neutral outbound network policy, enforced by kernel iptables on
+     * the Daytona runner. "blocked" with no allowedDestinations drops all
+     * egress. With allowedDestinations, Daytona supports IPv4 CIDRs ONLY (max
+     * 10): IPs/CIDRs pass through; hostnames are DNS-resolved ONCE at create
+     * time and pinned as /32 CIDRs — if the host rotates DNS later (CDNs and
+     * cloud APIs often do), its new IPs are BLOCKED for the sandbox's
+     * lifetime. Wildcards, IPv6, and unresolvable hostnames throw
+     * DaytonaNetworkPolicyError rather than silently weakening the policy.
+     * Note: on Daytona orgs below Tier 3, org network policy overrides
+     * per-sandbox settings server-side.
+     */
+    network?: {
+        outbound: "open" | "blocked";
+        allowedDestinations?: string[];
+    };
+    /**
+     * OS user for the sandbox, applied at CREATE time (Daytona's osUser field)
+     * — Daytona has no per-exec user switch, so the user commands actually run
+     * as is governed by the sandbox image (USER directive; default Daytona
+     * images use "daytona" with passwordless sudo). A non-root value must
+     * exist in the image. Pass "root" to keep the image's default user and
+     * elevate every command through a `sudo -n` wrapper instead (requires
+     * passwordless sudo in the image; default images have it). File operations
+     * go through the Daytona daemon and are NOT elevated.
+     */
+    user?: string;
+    /** Home directory used by the SDK for agent config paths; not consumed by the provider. */
+    homeDir?: string;
 }
 /** Options for listing sandboxes */
 interface SandboxListOptions {
+    /** "running" matches Daytona "started"; "paused" matches "stopped"/"archived". */
     state?: ("running" | "paused")[];
     metadata?: Record<string, string>;
     limit?: number;
 }
+/**
+ * A COMPLETE (or admittedly incomplete) enumeration of the organization's fleet.
+ *
+ * `complete` is the load-bearing field. Callers that need a whole fleet —
+ * orphan sweeps, lifecycle reconciliation — read a sandbox's ABSENCE from the
+ * list as evidence it is gone, so a truncated page and a small fleet must never
+ * be the same answer. `complete: false` means leave every row alone.
+ */
+interface SandboxListPage {
+    sandboxes: SandboxInfo[];
+    complete: boolean;
+    pagesFetched: number;
+    error?: string;
+}
 /** Command execution capabilities */
 interface SandboxCommands {
     run(command: string, options?: SandboxRunOptions): Promise<SandboxCommandResult>;
@@ -106,6 +363,8 @@ interface SandboxFiles {
         path: string;
         data: string | Buffer | ArrayBuffer | Uint8Array;
     }>): Promise<void>;
+    /** Upload a local file by path, without buffering it whole */
+    writeFromPath(sandboxPath: string, localPath: string): Promise<void>;
     makeDir(path: string): Promise<void>;
     exists(path: string): Promise<boolean>;
     list(path: string): Promise<FileInfo[]>;
@@ -129,7 +388,10 @@ interface SandboxProvider {
     readonly name?: string;
     create(options: SandboxCreateOptions): Promise<SandboxInstance>;
     connect(sandboxId: string, timeoutMs?: number): Promise<SandboxInstance>;
+    /** List sandboxes, paginating to exhaustion. `limit` bounds items returned. */
     list(options?: SandboxListOptions): Promise<SandboxInfo[]>;
+    /** The same enumeration for fleet bookkeeping: never throws, reports completeness. */
+    listAll(options?: SandboxListOptions): Promise<SandboxListPage>;
 }
 interface DaytonaConfig {
     /** Daytona API key. Default: reads from DAYTONA_API_KEY env var */
@@ -142,6 +404,20 @@ interface DaytonaConfig {
     defaultTimeoutMs?: number;
     /** Daytona snapshot name (default: 'evolve-all'). Create custom snapshots via `cd assets && ./build.sh daytona` */
     snapshotName?: string;
+    /**
+     * Evolve-managed toolbox base URL. Setting it puts the provider in MANAGED
+     * mode, where `apiKey` is an Evolve API key rather than a Daytona one and
+     * both planes ride the Dashboard.
+     *
+     * One field rather than a separate `managed: true` because the two effects
+     * have one cause: if the toolbox belongs to the platform, so do the
+     * snapshots behind it, so managed creates name an existing platform snapshot
+     * and never build one. Resolved by the Evolve SDK; direct/BYO callers leave
+     * it unset.
+     *
+     * @internal
+     */
+    managedToolboxUrl?: string;
 }
 interface ResolvedDaytonaConfig {
     apiKey: string;
@@ -149,6 +425,110 @@ interface ResolvedDaytonaConfig {
     target?: string;
     defaultTimeoutMs?: number;
     snapshotName?: string;
+    managedToolboxUrl?: string;
+}
+/** What a managed sandbox's streaming log follow needs to reach the Dashboard. */
+interface ManagedStreamContext {
+    toolboxUrl: string;
+    apiKey: string;
+}
+/**
+ * Split Daytona's multiplexed command log into stdout and stderr as the bytes
+ * arrive.
+ *
+ * The wire format is one byte stream with 3-byte markers announcing which
+ * stream the following bytes belong to (STDOUT_PREFIX_BYTES /
+ * STDERR_PREFIX_BYTES, both exported by the Daytona SDK — this reads their
+ * framing, it does not invent one). Two things make a streaming demux
+ * different from the SDK's whole-buffer one: a marker can be split across two
+ * chunks, so the last MAX_PREFIX_LEN-1 bytes are always held back rather than
+ * emitted; and a multi-byte UTF-8 character can be split too, so each stream
+ * keeps its own decoder in streaming mode.
+ */
+declare function createLogDemuxer(onStdout: (chunk: string) => void, onStderr: (chunk: string) => void): {
+    push(chunk: Uint8Array): void;
+    flush(): void;
+};
+/**
+ * Follow a session command's logs over plain HTTP.
+ *
+ * The Daytona SDK follows logs over a WEBSOCKET (Process.js:289 rewrites the
+ * toolbox base to ws:// and opens a socket). A managed sandbox's toolbox base
+ * is a Next.js route handler, and a Next route handler never sees a websocket
+ * upgrade — the codebase's one websocket proxy lives in a separate custom
+ * server for exactly that reason. So managed mode cannot use that transport.
+ *
+ * It does not have to. MEASURED 2026-07-26 against a live sandbox: the same
+ * endpoint with `?follow=true` over ordinary HTTP answers 200 with
+ * `transfer-encoding: chunked` and `content-type: application/octet-stream`,
+ * and chunks arrive as the command produces them — 95 ms, 1045 ms, 2127 ms,
+ * 2984 ms, 3976 ms for a command printing one line per second. That is real
+ * streaming through a plain response body, which is what the Dashboard route
+ * pipes through unbuffered.
+ */
+declare function followManagedSessionLogs(context: ManagedStreamContext, sandboxId: string, sessionId: string, commandId: string, onStdout: (chunk: string) => void, onStderr: (chunk: string) => void): Promise<void>;
+/**
+ * Read a command's streams out of whatever shape Daytona returned.
+ *
+ * Session logs are USUALLY framed with per-stream markers, and the Daytona
+ * SDK's demux returns "" for a stream whose marker never appears. An empty
+ * string is not "this command printed nothing" — it means "this daemon build
+ * did not frame the output" — and `??` does not fall through an empty string,
+ * so reading `stdout ?? output` silently reports every such command as silent.
+ *
+ * Measured 2026-07-26 on a live sandbox booted from ubuntu:22.04: a command
+ * printing one line to each stream came back as
+ * {output: "hello-managed\noops\n", stdout: null, exitCode: 0} with no marker
+ * bytes anywhere in the log body, and the provider reported exit 0 with empty
+ * stdout. Unframed output goes to stdout, because that is what the combined
+ * `output` field is; a framed response is untouched.
+ */
+declare function readCommandStreams(source: {
+    stdout?: string | null;
+    stderr?: string | null;
+    output?: string | null;
+}): {
+    stdout: string;
+    stderr: string;
+};
+declare class DaytonaCommands implements SandboxCommands {
+    private sandbox;
+    private user?;
+    private managedStream?;
+    constructor(sandbox: Sandbox, user?: string | undefined, managedStream?: ManagedStreamContext | undefined);
+    /**
+     * Stream a command's output to callbacks. Direct mode uses the Daytona
+     * SDK's own follow, which is a websocket; managed mode uses the HTTP
+     * chunked follow, because a Dashboard route handler cannot terminate a
+     * websocket upgrade (see followManagedSessionLogs).
+     */
+    private followLogs;
+    run(command: string, options?: SandboxRunOptions): Promise<SandboxCommandResult>;
+    spawn(command: string, options?: SandboxSpawnOptions): Promise<SandboxCommandHandle>;
+    list(): Promise<ProcessInfo[]>;
+    kill(processId: string): Promise<boolean>;
+}
+declare class DaytonaFiles implements SandboxFiles {
+    private sandbox;
+    constructor(sandbox: Sandbox);
+    read(path: string): Promise<string | Uint8Array>;
+    write(path: string, content: string | Buffer | ArrayBuffer | Uint8Array): Promise<void>;
+    writeBatch(files: Array<{
+        path: string;
+        data: string | Buffer | ArrayBuffer | Uint8Array;
+    }>): Promise<void>;
+    /**
+     * Upload a local file by PATH. Daytona's own uploadFile has a local-path
+     * overload (FileSystem.d.ts: `uploadFile(localPath: string, remotePath:
+     * string, timeout?)`), so the bytes never pass through this process's heap —
+     * which is what makes a large artifact safe to upload under concurrency.
+     */
+    writeFromPath(sandboxPath: string, localPath: string): Promise<void>;
+    makeDir(path: string): Promise<void>;
+    exists(path: string): Promise<boolean>;
+    list(path: string): Promise<FileInfo[]>;
+    remove(path: string): Promise<void>;
+    rename(oldPath: string, newPath: string): Promise<void>;
 }
 declare class DaytonaProvider implements SandboxProvider {
     readonly providerType: "daytona";
@@ -156,11 +536,85 @@ declare class DaytonaProvider implements SandboxProvider {
     private readonly client;
     private readonly defaultTimeoutMs;
     private readonly snapshotName;
+    /**
+     * Sandbox user configured at create time, reapplied on connect() so the
+     * root sudo wrapper keeps applying. In-memory only: a connect() from a
+     * fresh process falls back to the sandbox's create-time OS user without
+     * the wrapper — callers reconnecting across processes must recreate the
+     * provider and sandbox with the same user, or root-only operations fail
+     * loudly.
+     */
+    private readonly sandboxUsers;
+    /** Set only in Evolve-managed mode; see the EVOLVE-MANAGED MODE section. */
+    private readonly managedStream?;
     constructor(config: ResolvedDaytonaConfig);
     create(options: SandboxCreateOptions): Promise<SandboxInstance>;
     connect(sandboxId: string, _timeoutMs?: number): Promise<SandboxInstance>;
+    /**
+     * List sandboxes, walking every page.
+     *
+     * This used to request page 1 and stop, discarding `totalPages` — an
+     * organization with more than one page of sandboxes was silently truncated,
+     * and nothing in the return value said so. For any caller that reads absence
+     * from the list as "this sandbox is gone", that is a correctness bug.
+     *
+     * ORDER OF OPERATIONS, because it is observable: `limit` bounds the sandboxes
+     * RETURNED, and Daytona has no server-side state filter, so the state filter
+     * runs client-side on each page BEFORE the limit is counted. Asking for 10
+     * running sandboxes therefore keeps paging until ten running ones have been
+     * found, rather than filtering ten arbitrary rows down to whatever survives.
+     */
     list(options?: SandboxListOptions): Promise<SandboxInfo[]>;
+    /**
+     * The fleet-bookkeeping enumeration: same walk, never throws.
+     *
+     * The distinction from `list()` is what a failure MEANS to the caller. An
+     * orphan sweep treats a missing sandbox as a terminated one, so it must be
+     * able to tell "the organization has no sandboxes" from "the enumeration
+     * stopped early".
+     */
+    listAll(options?: SandboxListOptions): Promise<SandboxListPage>;
+    private paginate;
+    /**
+     * One page, asking the API to do the state filtering when it can.
+     *
+     * Daytona's REST endpoint takes a `states` array
+     * (api-client sandbox-api.d.ts listSandboxesPaginated), but the SDK wrapper
+     * this provider is built on does not expose it — `Daytona.list(labels, page,
+     * limit)` is the whole public surface, and `sandboxApi` is declared private.
+     * Without the server-side filter, `state: ['running']` on an organization
+     * full of archived boxes pages through all of them client-side looking for a
+     * handful of live ones.
+     *
+     * So the server filter is applied OPPORTUNISTICALLY, through the private
+     * field when it is shaped the way we expect, and the client-side filter in
+     * the walk stays the authority regardless. That ordering is the whole point:
+     * if a future SDK refactor renames or removes the field, this degrades to the
+     * request count it has today, and can never degrade to admitting states the
+     * caller excluded.
+     */
+    private listPage;
+}
+/** One page as Daytona's `list(labels?, page?, limit?)` returns it. */
+interface DaytonaSandboxPage {
+    items: Sandbox[];
+    totalPages?: number;
 }
+/**
+ * Walk every page into one answer, with an honest completeness verdict.
+ *
+ * Separate from the provider because everything worth getting wrong lives here
+ * and none of it needs a network: the ways a walk can fail to terminate, the
+ * difference between "the caller asked for ten" and "the provider ran out", and
+ * the rule that a failure mid-walk yields the sandboxes seen so far marked
+ * INCOMPLETE rather than either an exception or a short complete list.
+ *
+ * Exported for its test (`_testCollectSandboxPages`).
+ */
+declare function collectSandboxPages(fetchPage: (page: number) => Promise<DaytonaSandboxPage>, options?: SandboxListOptions): Promise<SandboxListPage & {
+    stoppedAtLimit: boolean;
+}>;
+declare const _testCollectSandboxPages: typeof collectSandboxPages;
 /**
  * Create Daytona sandbox provider.
  *
@@ -168,5 +622,15 @@ declare class DaytonaProvider implements SandboxProvider {
  * @throws Error if apiKey cannot be resolved
  */
 declare function createDaytonaProvider(config?: DaytonaConfig): SandboxProvider;
+/** @internal Test-only export for unit testing wrapCommand logic. */
+declare const _testWrapCommand: typeof wrapCommand;
+declare const _testWithInBoxTimeout: typeof withInBoxTimeout;
+declare const _testMapNetworkPolicy: typeof mapNetworkPolicy;
+declare const _testImageRegistryHost: typeof imageRegistryHost;
+declare const _testToSandboxInfo: typeof toSandboxInfo;
+declare const _testDaytonaStateToEvolveState: typeof daytonaStateToEvolveState;
+declare const _testCreateLogDemuxer: typeof createLogDemuxer;
+declare const _testFollowManagedSessionLogs: typeof followManagedSessionLogs;
+declare const _testReadCommandStreams: typeof readCommandStreams;
 
-export { type DaytonaConfig, DaytonaProvider, type FileInfo, type ProcessInfo, type SandboxCommandHandle, type SandboxCommandResult, type SandboxCommands, type SandboxCreateOptions, type SandboxFiles, type SandboxInfo, type SandboxInstance, type SandboxListOptions, type SandboxProvider, type SandboxResources, type SandboxRunOptions, type SandboxSpawnOptions, _testWrapCommand, createDaytonaProvider };
+export { DAYTONA_AUTO_DELETE_GRACE_MINUTES, DAYTONA_LIST_PAGE_SIZE, DAYTONA_MAX_LIST_PAGES, DAYTONA_MAX_NETWORK_ALLOWLIST, DaytonaCommands, type DaytonaConfig, DaytonaFiles, DaytonaIdleTimeoutError, DaytonaImagePullError, DaytonaNetworkPolicyError, type DaytonaNetworkPolicyReason, DaytonaProvider, DaytonaResourcesError, type DaytonaSandboxPage, type FileInfo, type ProcessInfo, type SandboxCommandHandle, type SandboxCommandResult, type SandboxCommands, type SandboxCreateOptions, type SandboxFiles, type SandboxInfo, type SandboxInstance, type SandboxListOptions, type SandboxListPage, type SandboxProvider, type SandboxResources, type SandboxRunOptions, type SandboxSpawnOptions, _testCollectSandboxPages, _testCreateLogDemuxer, _testDaytonaStateToEvolveState, _testFollowManagedSessionLogs, _testImageRegistryHost, _testMapNetworkPolicy, _testReadCommandStreams, _testToSandboxInfo, _testWithInBoxTimeout, _testWrapCommand, createDaytonaProvider };

package/dist/index.js

@@ -1,2 +1,2 @@
-import {Daytona,Image}from'@daytonaio/sdk';var h={"evolve-all":"evolvingmachines/evolve-all"},S=new Set([".xlsx",".xls",".docx",".doc",".pptx",".ppt",".pdf",".zip",".tar",".gz",".7z",".rar",".png",".jpg",".jpeg",".gif",".webp",".ico",".bmp",".mp3",".wav",".ogg",".flac",".aac",".mp4",".avi",".mov",".mkv",".webm",".woff",".woff2",".ttf",".otf",".eot",".exe",".dll",".so",".dylib",".sqlite",".db",".pickle",".pkl",".parquet"]);function w(r){let e=r.substring(r.lastIndexOf(".")).toLowerCase();return S.has(e)}function v(r){let e=r.lastIndexOf("/");return e>0?r.substring(0,e):"/"}function P(r){let e=r.lastIndexOf("/");return e>=0?r.substring(e+1):r}function g(r,e,t){let s=r;return e&&(s=`cd '${e.replace(/'/g,"'\\''")}' && ${s}`),t&&Object.keys(t).length>0&&(s=`${Object.entries(t).filter(([,a])=>a!=null).map(([a,o])=>`export ${a}='${o.replace(/'/g,"'\\''")}'`).join("; ")}; ${s}`),s}var C=g,f=class{constructor(e){this.sandbox=e;}async run(e,t){let s=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,n=`run-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(n);try{let a=await this.sandbox.process.executeSessionCommand(n,{command:g(e,t?.cwd,t?.envs),runAsync:!1},s),o=a.cmdId;o&&(t?.onStdout||t?.onStderr)&&await this.sandbox.process.getSessionCommandLogs(n,o,t.onStdout||(()=>{}),t.onStderr||(()=>{}));let d=a.stdout??a.output??"",i=a.stderr??"";if(!d&&o&&!t?.onStdout)try{let m=await this.sandbox.process.getSessionCommandLogs(n,o);d=m.stdout??m.output??"",i=m.stderr??i;}catch{}return {exitCode:a.exitCode??0,stdout:d,stderr:i}}finally{try{await this.sandbox.process.deleteSession(n);}catch{}}}async spawn(e,t){let s=`evolve-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(s);let n=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,a=Date.now(),o=t?.timeoutMs,i=(await this.sandbox.process.executeSessionCommand(s,{command:g(e,t?.cwd,t?.envs),runAsync:true},n)).cmdId;i&&(t?.onStdout||t?.onStderr)&&this.sandbox.process.getSessionCommandLogs(s,i,t.onStdout||(()=>{}),t.onStderr||(()=>{})).catch(()=>{});let m=this.sandbox;return {processId:s,wait:async()=>{if(!i)return {exitCode:0,stdout:"",stderr:""};for(;;){if(o&&Date.now()-a>=o){try{await m.process.deleteSession(s);}catch{}return {exitCode:-1,stdout:"",stderr:"operation timed out"}}try{let c=await m.process.getSessionCommand(s,i);if(c.exitCode!==void 0)try{let l=await m.process.getSessionCommandLogs(s,i);return {exitCode:c.exitCode,stdout:l.stdout??l.output??"",stderr:l.stderr??""}}catch{return {exitCode:c.exitCode,stdout:"",stderr:""}}}catch(c){if((c instanceof Error?c.message.toLowerCase():String(c).toLowerCase()).includes("not found"))return {exitCode:-1,stdout:"",stderr:"session terminated"};throw c}await new Promise(c=>setTimeout(c,500));}},kill:async()=>{try{return await m.process.deleteSession(s),!0}catch{return  false}}}}async list(){try{return (await this.sandbox.process.listSessions()).map(t=>({processId:t.sessionId||"",cmd:"",args:[],envs:{}}))}catch{return []}}async kill(e){try{return await this.sandbox.process.deleteSession(e),!0}catch{return  false}}},p=class{constructor(e){this.sandbox=e;}async read(e){let t=await this.sandbox.fs.downloadFile(e);return w(e)?new Uint8Array(t):t.toString("utf-8")}async write(e,t){let s;if(typeof t=="string")s=Buffer.from(t,"utf-8");else if(Buffer.isBuffer(t))s=t;else if(t instanceof ArrayBuffer)s=Buffer.from(t);else if(t instanceof Uint8Array)s=Buffer.from(t);else throw new Error(`Unsupported content type: ${typeof t}`);await this.sandbox.fs.uploadFile(s,e);}async writeBatch(e){let t=e.map(s=>{let n;if(typeof s.data=="string")n=Buffer.from(s.data,"utf-8");else if(Buffer.isBuffer(s.data))n=s.data;else if(s.data instanceof ArrayBuffer)n=Buffer.from(s.data);else if(s.data instanceof Uint8Array)n=Buffer.from(s.data);else throw new Error(`Unsupported content type: ${typeof s.data}`);return {source:n,destination:s.path}});await this.sandbox.fs.uploadFiles(t);}async makeDir(e){await this.sandbox.fs.createFolder(e,"755");}async exists(e){try{let t=v(e),s=P(e);return (await this.sandbox.fs.listFiles(t)).some(a=>a.name===s)}catch{return  false}}async list(e){return (await this.sandbox.fs.listFiles(e)).map(s=>({name:s.name,path:e.endsWith("/")?`${e}${s.name}`:`${e}/${s.name}`,type:s.isDir?"dir":"file"}))}async remove(e){await this.sandbox.fs.deleteFile(e,true);}async rename(e,t){await this.sandbox.fs.moveFiles(e,t);}},u=class{constructor(e){this.sandbox=e;this.commands=new f(e),this.files=new p(e);}commands;files;get sandboxId(){return this.sandbox.id}async getHost(e){return (await this.sandbox.getPreviewLink(e)).url}async isRunning(){return this.sandbox.state==="started"}async getInfo(){return {sandboxId:this.sandbox.id,image:this.sandbox.snapshot||"unknown",name:this.sandbox.name,metadata:this.sandbox.labels||{},startedAt:new Date().toISOString()}}async kill(){await this.sandbox.delete();}async pause(){await this.sandbox.stop();}},x=class{providerType="daytona";name="Daytona";client;defaultTimeoutMs;snapshotName;constructor(e){this.client=new Daytona({apiKey:e.apiKey,apiUrl:e.apiUrl,target:e.target}),this.defaultTimeoutMs=e.defaultTimeoutMs??36e5,this.snapshotName=e.snapshotName??"evolve-all";}async create(e){let t=e.timeoutMs??this.defaultTimeoutMs,s=Math.max(1,Math.ceil(t/6e4)),n=e.image||this.snapshotName,a;try{let o=await this.client.snapshot.get(n);if(o&&o.state==="active")console.log(`[daytona] Using cached snapshot: ${n}`),a=await this.client.create({snapshot:n,envVars:e.envs,labels:e.metadata,autoStopInterval:s},{timeout:600});else throw new Error("Snapshot not active")}catch{let o=h[n]??n;console.log(`[daytona] Snapshot "${n}" not found, building from image: ${o}`),console.log("[daytona] First run will take a few minutes (this only happens once)...");try{await this.client.snapshot.create({name:n,image:Image.base(o),resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{onLogs:d=>console.log(`[daytona] ${d}`)}),console.log(`[daytona] Snapshot "${n}" ready.`),a=await this.client.create({snapshot:n,envVars:e.envs,labels:e.metadata,autoStopInterval:s},{timeout:600});}catch(d){console.warn(`[daytona] Snapshot creation failed, falling back to direct image: ${d instanceof Error?d.message:d}`),a=await this.client.create({image:o,envVars:e.envs,labels:e.metadata,autoStopInterval:s,resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{timeout:600,onSnapshotCreateLogs:i=>console.log(`[daytona] ${i}`)});}}return e.workingDirectory&&await a.fs.createFolder(e.workingDirectory,"755"),new u(a)}async connect(e,t){let s=await this.client.get(e);return s.state!=="started"&&await s.start(),new u(s)}async list(e){let t=e?.limit??100;return (await this.client.list(e?.metadata,1,t)).items.map(n=>({sandboxId:n.id,image:n.snapshot||"unknown",name:n.name,metadata:n.labels||{},startedAt:new Date().toISOString()}))}};function A(r={}){let e=r.apiKey??process.env.DAYTONA_API_KEY;if(!e)throw new Error("Daytona API key required. Set DAYTONA_API_KEY environment variable or pass apiKey in config. Get your key at https://app.daytona.io/dashboard/keys");return new x({...r,apiKey:e})}
-export{x as DaytonaProvider,C as _testWrapCommand,A as createDaytonaProvider};
+import {STDOUT_PREFIX_BYTES,STDERR_PREFIX_BYTES,MAX_PREFIX_LEN,Daytona,Image}from'@daytonaio/sdk';import {resolve4}from'dns/promises';var z={"evolve-all":"evolvingmachines/evolve-all"},q=10,L=10,T=100,y=100,W=new Set([".xlsx",".xls",".docx",".doc",".pptx",".ppt",".pdf",".zip",".tar",".gz",".7z",".rar",".png",".jpg",".jpeg",".gif",".webp",".ico",".bmp",".mp3",".wav",".ogg",".flac",".aac",".mp4",".avi",".mov",".mkv",".webm",".woff",".woff2",".ttf",".otf",".eot",".exe",".dll",".so",".dylib",".sqlite",".db",".pickle",".pkl",".parquet"]);function X(s){let e=s.substring(s.lastIndexOf(".")).toLowerCase();return W.has(e)}function G(s){let e=s.lastIndexOf("/");return e>0?s.substring(0,e):"/"}function J(s){let e=s.lastIndexOf("/");return e>=0?s.substring(e+1):s}var f=class extends Error{reason;destination;constructor(e,t,n){super(t),this.name="DaytonaNetworkPolicyError",this.reason=e,this.destination=n;}},w=class extends Error{image;constructor(e,t){let n=t instanceof Error?t.message:String(t??"unknown error");super(`Failed to pull image "${e}" on Daytona: ${n}. Private registry images (e.g. AWS ECR) require registry credentials pre-registered in the Daytona dashboard (Registries page) before sandbox creation \u2014 Daytona has no per-call image pull secret. Register the registry at https://app.daytona.io, then retry. Also ensure the image is linux/amd64 and pinned to a tag or digest (floating tags like "latest" are rejected by Daytona's snapshot builder).`),this.name="DaytonaImagePullError",this.image=e;}},h=class extends Error{snapshot;constructor(e){super(`Daytona snapshot "${e}" already exists and pins its cpu/memory/disk sizing \u2014 create-from-snapshot cannot resize it, so the requested \`resources\` cannot be enforced. Pre-build a snapshot with the desired sizing under its own name (sizing-addressed), or omit \`resources\` to accept the snapshot's pinned sizing.`),this.name="DaytonaResourcesError",this.snapshot=e;}},S=class extends Error{constructor(){super("Daytona has no separate idle timeout: auto-stop IS its only clock and it already measures inactivity, so `timeoutMs` is what sets it (autoStopInterval). Set the inactivity bound with `timeoutMs`; a hard bound on the process itself is enforced in-box instead (see withInBoxTimeout)."),this.name="DaytonaIdleTimeoutError";}};function v(s,e){if(!e||e<=0)return s;let t=Buffer.from(s).toString("base64"),n=`/tmp/.evolve-cmd-${Date.now()}-${Math.random().toString(36).slice(2,8)}.sh`;return `sh -c '${`echo ${t} | base64 -d > ${n} && [ -s ${n} ] || { rm -f ${n}; exit 126; }; if command -v timeout >/dev/null 2>&1; then timeout -k 10 ${e} bash ${n}; else bash ${n}; fi; rc=$?; rm -f ${n}; exit $rc`}'`}function P(s,e,t,n){let r=s;return e&&(r=`cd '${e.replace(/'/g,"'\\''")}' && ${r}`),t&&Object.keys(t).length>0&&(r=`${Object.entries(t).filter(([,o])=>o!=null).map(([o,a])=>`export ${o}='${String(a).replace(/'/g,"'\\''")}'`).join("; ")}; ${r}`),n==="root"&&(r=`echo ${Buffer.from(r).toString("base64")} | base64 -d | sudo -n bash`),r}var V=s=>resolve4(s);function E(s){let e=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?:\/(\d{1,3}))?$/.exec(s);return !(!e||[e[1],e[2],e[3],e[4]].some(t=>Number(t)>255)||e[5]!==void 0&&Number(e[5])>32)}function Z(s){return /^\d{1,3}(\.\d{1,3}){3}(\/\d+)?$/.test(s)&&!E(s)}function Q(s){return s.startsWith("[")?true:(s.match(/:/g)?.length??0)>=2}function ee(s){return /^[^:]+:\d+$/.test(s)}async function B(s,e=V){if(!s||s.outbound==="open"){if(s?.allowedDestinations?.length)throw new Error("network.allowedDestinations is only valid when outbound is blocked");return s?{networkBlockAll:false}:{}}let t=s.allowedDestinations??[];if(t.length===0)return {networkBlockAll:true};let n=[],r=[];for(let o of t)if(E(o))n.push(o.includes("/")?o:`${o}/32`);else {if(Z(o))throw new f("invalid-ipv4",`"${o}" is not a valid IPv4 address or CIDR (octets must be 0-255, prefix 0-32). Fix the address or list a hostname instead.`,o);if(Q(o))throw new f("ipv6-unsupported",`Daytona's network allowlist supports IPv4 CIDRs only; cannot allow IPv6 destination "${o}".`,o);if(ee(o))throw new f("port-unsupported",`Daytona's network allowlist filters hosts and IPs only and cannot match a port; drop the ":<port>" from "${o}" and list just the host or IP.`,o);if(o.includes("*"))throw new f("wildcard-hostname",`Daytona cannot enforce wildcard hostname "${o}": its allowlist is kernel-level IPv4 CIDR filtering with no DNS/domain layer. List concrete hostnames or IPv4 CIDRs instead.`,o);r.push(o);}for(let o of r){let a=[];try{a=await e(o);}catch(i){throw new f("unresolvable-hostname",`Cannot pin hostname "${o}" to stable IPv4 addresses at create time (${i instanceof Error?i.message:String(i)}). Daytona enforces IPv4 CIDRs only; use an IPv4 CIDR for this destination instead.`,o)}if(a.length===0)throw new f("unresolvable-hostname",`Hostname "${o}" resolved to no IPv4 addresses. Daytona enforces IPv4 CIDRs only; use an IPv4 CIDR for this destination instead.`,o);console.warn(`[daytona] Network allowlist: pinning "${o}" to [${a.join(", ")}] (DNS resolved at create time). Daytona enforces IPv4 CIDRs only \u2014 if this host rotates DNS (CDNs and cloud APIs often do), traffic to its new IPs will be BLOCKED for the sandbox's lifetime.`);for(let i of a)n.push(`${i}/32`);}let l=[...new Set(n)];if(l.length>L)throw new f("allowlist-too-large",`Daytona allows at most ${L} entries in its network allowlist; this policy resolved to ${l.length} CIDRs (${l.join(", ")}). Aggregate destinations into broader CIDRs or reduce the list.`);return {networkBlockAll:false,networkAllowList:l.join(",")}}function O(s){let e=s.indexOf("/");if(e<0)return;let t=s.substring(0,e);return t.includes(".")||t.includes(":")||t==="localhost"?t:void 0}function k(s){return {sandboxId:s.id,image:s.snapshot??"",name:s.name,metadata:s.labels??{},startedAt:s.createdAt??""}}function _(s){if(s==="started")return "running";if(s==="stopped"||s==="archived")return "paused"}var I=class extends Daytona{constructor(t,n){super(t);this.managedToolboxUrl=n;}async getProxyToolboxUrl(){return this.managedToolboxUrl}};function te(s,e){let t=new Uint8Array(new ArrayBuffer(s.length+e.length));return t.set(s,0),t.set(e,s.length),t}function U(s,e,t){e:for(let n=t;n+e.length<=s.length;n++){for(let r=0;r<e.length;r++)if(s[n+r]!==e[r])continue e;return n}return  -1}function N(s,e){let t=new TextDecoder("utf-8"),n=new TextDecoder("utf-8"),r=new Uint8Array(0),l="stdout",o=a=>{a.length!==0&&(l==="stdout"?s(t.decode(a,{stream:true})):e(n.decode(a,{stream:true})));};return {push(a){for(r=te(r,a);;){let i=U(r,STDOUT_PREFIX_BYTES,0),d=U(r,STDERR_PREFIX_BYTES,0),c=-1,u="stdout",m=0;if(i!==-1&&(d===-1||i<d)?(c=i,u="stdout",m=STDOUT_PREFIX_BYTES.length):d!==-1&&(c=d,u="stderr",m=STDERR_PREFIX_BYTES.length),c===-1){let g=Math.max(0,r.length-(MAX_PREFIX_LEN-1));o(r.subarray(0,g)),r=r.slice(g);return}o(r.subarray(0,c)),l=u,r=r.slice(c+m);}},flush(){o(r),r=new Uint8Array(0);let a=t.decode();a&&s(a);let i=n.decode();i&&e(i);}}}async function F(s,e,t,n,r,l){let o=`${s.toolboxUrl.replace(/\/+$/,"")}/${encodeURIComponent(e)}/process/session/${encodeURIComponent(t)}/command/${encodeURIComponent(n)}/logs?follow=true`,a=await fetch(o,{headers:{Authorization:`Bearer ${s.apiKey}`,accept:"application/octet-stream"}});if(!a.ok)throw new Error(`Daytona managed log follow failed: ${a.status} ${await a.text()}`);if(!a.body)return;let i=N(r,l),d=a.body.getReader();try{for(;;){let{done:c,value:u}=await d.read();if(c)break;u&&i.push(u);}}finally{i.flush(),await d.cancel().catch(()=>{});}}function x(s){let e=s.stdout||"",t=s.stderr||"",n=s.output||"";return !e&&!t&&n?{stdout:n,stderr:""}:{stdout:e,stderr:t}}var D=class{constructor(e,t,n){this.sandbox=e;this.user=t;this.managedStream=n;}followLogs(e,t,n,r){return this.managedStream?F(this.managedStream,this.sandbox.id,e,t,n,r):this.sandbox.process.getSessionCommandLogs(e,t,n,r)}async run(e,t){let n=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,r=`run-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(r);try{let l=await this.sandbox.process.executeSessionCommand(r,{command:v(P(e,t?.cwd,t?.envs,this.user),n),runAsync:!1},n),o=l.cmdId;o&&(t?.onStdout||t?.onStderr)&&await this.followLogs(r,o,t.onStdout||(()=>{}),t.onStderr||(()=>{}));let{stdout:a,stderr:i}=x(l);if(!a&&!i&&o&&!t?.onStdout)try{let d=await this.sandbox.process.getSessionCommandLogs(r,o),c=x(d);a=c.stdout,i=c.stderr||i;}catch{}return {exitCode:l.exitCode??0,stdout:a,stderr:i}}finally{try{await this.sandbox.process.deleteSession(r);}catch{}}}async spawn(e,t){let n=`evolve-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;await this.sandbox.process.createSession(n);let r=t?.timeoutMs?Math.floor(t.timeoutMs/1e3):void 0,l=Date.now(),o=t?.timeoutMs,i=(await this.sandbox.process.executeSessionCommand(n,{command:v(P(e,t?.cwd,t?.envs,this.user),r),runAsync:true},r)).cmdId;i&&(t?.onStdout||t?.onStderr)&&this.followLogs(n,i,t.onStdout||(()=>{}),t.onStderr||(()=>{})).catch(()=>{});let d=this.sandbox;return {processId:n,wait:async()=>{if(!i)return {exitCode:0,stdout:"",stderr:""};for(;;){if(o&&Date.now()-l>=o){try{await d.process.deleteSession(n);}catch{}return {exitCode:124,stdout:"",stderr:"operation timed out"}}try{let c=await d.process.getSessionCommand(n,i);if(c.exitCode!==void 0)try{let u=await d.process.getSessionCommandLogs(n,i);return {exitCode:c.exitCode,...x(u)}}catch{return {exitCode:c.exitCode,stdout:"",stderr:""}}}catch(c){let u=c instanceof Error?c.message.toLowerCase():String(c).toLowerCase();if(u.includes("not found")){let m=u.includes("sandbox");try{await d.refreshData(),m=!1;}catch(g){(g instanceof Error?g.message.toLowerCase():String(g).toLowerCase()).includes("not found")&&(m=true);}return {exitCode:-1,stdout:"",stderr:m?"sandbox deleted during run":"session terminated"}}throw c}await new Promise(c=>setTimeout(c,500));}},kill:async()=>{try{return await d.process.deleteSession(n),!0}catch{return  false}}}}async list(){try{return (await this.sandbox.process.listSessions()).map(t=>({processId:t.sessionId||"",cmd:"",args:[],envs:{}}))}catch{return []}}async kill(e){try{return await this.sandbox.process.deleteSession(e),!0}catch{return  false}}},A=class{constructor(e){this.sandbox=e;}async read(e){let t=await this.sandbox.fs.downloadFile(e);return X(e)?new Uint8Array(t):t.toString("utf-8")}async write(e,t){let n;if(typeof t=="string")n=Buffer.from(t,"utf-8");else if(Buffer.isBuffer(t))n=t;else if(t instanceof ArrayBuffer)n=Buffer.from(t);else if(t instanceof Uint8Array)n=Buffer.from(t);else throw new Error(`Unsupported content type: ${typeof t}`);await this.sandbox.fs.uploadFile(n,e);}async writeBatch(e){let t=e.map(n=>{let r;if(typeof n.data=="string")r=Buffer.from(n.data,"utf-8");else if(Buffer.isBuffer(n.data))r=n.data;else if(n.data instanceof ArrayBuffer)r=Buffer.from(n.data);else if(n.data instanceof Uint8Array)r=Buffer.from(n.data);else throw new Error(`Unsupported content type: ${typeof n.data}`);return {source:r,destination:n.path}});await this.sandbox.fs.uploadFiles(t);}async writeFromPath(e,t){await this.sandbox.fs.uploadFile(t,e);}async makeDir(e){await this.sandbox.fs.createFolder(e,"755");}async exists(e){try{let t=G(e),n=J(e);return (await this.sandbox.fs.listFiles(t)).some(l=>l.name===n)}catch{return  false}}async list(e){return (await this.sandbox.fs.listFiles(e)).map(n=>({name:n.name,path:e.endsWith("/")?`${e}${n.name}`:`${e}/${n.name}`,type:n.isDir?"dir":"file"}))}async remove(e){await this.sandbox.fs.deleteFile(e,true);}async rename(e,t){await this.sandbox.fs.moveFiles(e,t);}},b=class{constructor(e,t,n){this.sandbox=e;this.commands=new D(e,t,n),this.files=new A(e);}commands;files;get sandboxId(){return this.sandbox.id}async getHost(e){return (await this.sandbox.getPreviewLink(e)).url}async isRunning(){try{await this.sandbox.refreshData();}catch{return  false}return this.sandbox.state==="started"}async getInfo(){return await this.sandbox.refreshData(),k(this.sandbox)}async kill(){await this.sandbox.delete();}async pause(){await this.sandbox.stop();}},C=class{providerType="daytona";name="Daytona";client;defaultTimeoutMs;snapshotName;sandboxUsers=new Map;managedStream;constructor(e){let t={apiKey:e.apiKey,apiUrl:e.apiUrl,target:e.target};this.client=e.managedToolboxUrl?new I(t,e.managedToolboxUrl):new Daytona(t),e.managedToolboxUrl&&(this.managedStream={toolboxUrl:e.managedToolboxUrl,apiKey:e.apiKey}),this.defaultTimeoutMs=e.defaultTimeoutMs??36e5,this.snapshotName=e.snapshotName??"evolve-all";}async create(e){if(e.idleTimeoutMs!==void 0)throw new S;let t=await B(e.network),n=e.user,r=n&&n!=="root"?n:void 0,l=e.timeoutMs??this.defaultTimeoutMs,o=Math.max(1,Math.ceil(l/6e4)),a=e.image||this.snapshotName,i={envVars:e.envs,labels:e.metadata,autoStopInterval:o,autoDeleteInterval:q,...r?{user:r}:{},...t},d,c=e.resources!==void 0&&(e.resources.cpu!==void 0||e.resources.memory!==void 0||e.resources.disk!==void 0);if(this.managedStream){if(c)throw new h(a);let u=await this.client.create({snapshot:a,...i},{timeout:600});return e.workingDirectory&&await u.fs.createFolder(e.workingDirectory,"755"),n&&this.sandboxUsers.set(u.id,n),new b(u,n,this.managedStream)}try{let u=await this.client.snapshot.get(a);if(u&&u.state==="active"){if(c)throw new h(a);console.log(`[daytona] Using cached snapshot: ${a}`),d=await this.client.create({snapshot:a,...i},{timeout:600});}else throw new Error("Snapshot not active")}catch(u){if(u instanceof h)throw u;let m=z[a]??a;console.log(`[daytona] Snapshot "${a}" not found, building from image: ${m}`),console.log("[daytona] First run will take a few minutes (this only happens once)...");try{await this.client.snapshot.create({name:a,image:Image.base(m),resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{onLogs:g=>console.log(`[daytona] ${g}`)}),console.log(`[daytona] Snapshot "${a}" ready.`),d=await this.client.create({snapshot:a,...i},{timeout:600});}catch(g){console.warn(`[daytona] Snapshot creation failed, falling back to direct image: ${g instanceof Error?g.message:g}`);try{d=await this.client.create({image:m,...i,resources:{cpu:e.resources?.cpu??4,memory:e.resources?.memory??4,disk:e.resources?.disk??10}},{timeout:600,onSnapshotCreateLogs:p=>console.log(`[daytona] ${p}`)});}catch(p){throw O(m)?new w(m,p):p}}}return e.workingDirectory&&await d.fs.createFolder(e.workingDirectory,"755"),n&&this.sandboxUsers.set(d.id,n),new b(d,n,this.managedStream)}async connect(e,t){let n=await this.client.get(e);return n.state!=="started"&&await n.start(),new b(n,this.sandboxUsers.get(e),this.managedStream)}async list(e){let t=await this.paginate(e);if(t.error&&!t.stoppedAtLimit)throw new Error(t.error);return t.sandboxes}async listAll(e){let{stoppedAtLimit:t,...n}=await this.paginate(e);return n}async paginate(e){return K(t=>this.listPage(e,t),e)}async listPage(e,t){let n=e?.state?ne(e.state):void 0;if(n&&n.length>0){let r=this.client.sandboxApi;if(typeof r?.listSandboxesPaginated=="function")try{let l=await r.listSandboxesPaginated(void 0,t,T,void 0,void 0,e?.metadata?JSON.stringify(e.metadata):void 0,void 0,n);return {items:l.data.items,totalPages:l.data.totalPages}}catch{}}return this.client.list(e?.metadata,t,T)}};function ne(s){let e=[];for(let t of s)t==="running"&&e.push("started"),t==="paused"&&e.push("stopped","archived");return e}async function K(s,e){let t=e?.limit,n=[],r=0,l=new Set;for(let o=1;o<=y;o+=1){let a;try{a=await s(o);}catch(d){return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:false,error:`sandbox list failed: ${d instanceof Error?d.message:String(d)}`}}r+=1;for(let d of a.items){if(e?.state){let c=_(d.state);if(c===void 0||!e.state.includes(c))continue}if(!l.has(d.id)){if(t!==void 0&&n.length>=t)return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:true,error:`stopped at the requested limit of ${t} with more sandboxes available`};l.add(d.id),n.push(k(d));}}let i=a.items.length===0||typeof a.totalPages=="number"&&o>=a.totalPages;if(t!==void 0&&n.length>=t&&!i)return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:true,error:`stopped at the requested limit of ${t} with more sandboxes available`};if(i)break;if(o===y)return {sandboxes:n,complete:false,pagesFetched:r,stoppedAtLimit:false,error:`sandbox list exceeded ${y} pages`}}return {sandboxes:n,complete:true,pagesFetched:r,stoppedAtLimit:false}}var oe=K;function ae(s={}){let e=s.apiKey??process.env.DAYTONA_API_KEY;if(!e)throw new Error("Daytona API key required. Set DAYTONA_API_KEY environment variable or pass apiKey in config. Get your key at https://app.daytona.io/dashboard/keys");return new C({...s,apiKey:e})}var ie=P,de=v,le=B,ce=O,ue=k,me=_,ge=N,fe=F,pe=x;
+export{q as DAYTONA_AUTO_DELETE_GRACE_MINUTES,T as DAYTONA_LIST_PAGE_SIZE,y as DAYTONA_MAX_LIST_PAGES,L as DAYTONA_MAX_NETWORK_ALLOWLIST,D as DaytonaCommands,A as DaytonaFiles,S as DaytonaIdleTimeoutError,w as DaytonaImagePullError,f as DaytonaNetworkPolicyError,C as DaytonaProvider,h as DaytonaResourcesError,oe as _testCollectSandboxPages,ge as _testCreateLogDemuxer,me as _testDaytonaStateToEvolveState,fe as _testFollowManagedSessionLogs,ce as _testImageRegistryHost,le as _testMapNetworkPolicy,pe as _testReadCommandStreams,ue as _testToSandboxInfo,de as _testWithInBoxTimeout,ie as _testWrapCommand,ae as createDaytonaProvider};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvingmachines/daytona",
-  "version": "0.0.51",
+  "version": "0.0.52-project-sable.20260729.8632c49",
   "keywords": [
     "ai",
     "agents",
@@ -33,7 +33,7 @@
     "build": "tsup --minify",
     "dev": "tsup --watch",
     "type-check": "tsc --noEmit",
-    "test:unit": "tsx tests/unit/daytona-commands.test.ts"
+    "test:unit": "tsx tests/unit/daytona-commands.test.ts && tsx tests/unit/daytona-provider.test.ts && tsx tests/unit/daytona-managed.test.ts && tsx tests/unit/daytona-list-pagination.test.ts"
   },
   "dependencies": {
     "@daytonaio/sdk": "^0.134.0"