@fitlab-ai/agent-infra 0.5.10 → 0.6.1

package/dist/lib/sandbox/engine.js

@@ -0,0 +1,155 @@
+import { platform } from 'node:os';
+import { detectHostResources } from "./constants.js";
+import { ADAPTERS, enginesForPlatform, getAdapter } from "./engines/index.js";
+import { run, runOk, runSafe, runVerbose } from "./shell.js";
+export const ENGINES = Object.freeze({
+    COLIMA: 'colima',
+    ORBSTACK: 'orbstack',
+    DOCKER_DESKTOP: 'docker-desktop',
+    NATIVE: 'native',
+    WSL2: 'wsl2'
+});
+const PLATFORM_DEFAULTS = Object.freeze({
+    linux: ENGINES.NATIVE,
+    darwin: ENGINES.COLIMA,
+    win32: ENGINES.WSL2
+});
+function runFns({ runFn = run, runOkFn = runOk, runSafeFn = runSafe, runVerboseFn = runVerbose } = {}) {
+    return {
+        run: runFn,
+        runOk: runOkFn,
+        runSafe: runSafeFn,
+        runVerbose: runVerboseFn
+    };
+}
+function applyDockerContext(adapter) {
+    if (adapter.dockerContext) {
+        process.env.DOCKER_CONTEXT = adapter.dockerContext;
+    }
+}
+export function validateSandboxEngine(engine, { platformFn = platform } = {}) {
+    if (engine === null || engine === undefined) {
+        return null;
+    }
+    const os = platformFn();
+    if (!(engine in ADAPTERS)) {
+        const known = Object.keys(ADAPTERS).join(', ');
+        throw new Error(`sandbox: invalid "sandbox.engine" value "${engine}" (unknown sandbox engine). `
+            + `Valid engines: ${known}.`);
+    }
+    const adapter = ADAPTERS[engine];
+    if (!adapter.supportedPlatforms.includes(os)) {
+        const supported = enginesForPlatform(os);
+        const supportedList = supported.length > 0 ? supported.join(', ') : 'none';
+        throw new Error(`sandbox: "sandbox.engine" value "${engine}" is not supported on ${os}. `
+            + `Supported engines on ${os}: ${supportedList}.`);
+    }
+    return engine;
+}
+export function detectEngine(config = {}, { platformFn = platform } = {}) {
+    const configured = validateSandboxEngine(config.engine, { platformFn });
+    if (configured) {
+        return configured;
+    }
+    const os = platformFn();
+    const fallback = PLATFORM_DEFAULTS[os];
+    if (fallback) {
+        return fallback;
+    }
+    throw new Error(`sandbox: platform "${os}" is not supported. `
+        + 'Supported platforms: linux (native), darwin (colima/orbstack/docker-desktop), win32 (wsl2). '
+        + 'Please open an issue at https://github.com/fitlab-ai/agent-infra/issues/new '
+        + 'with your platform details if you need this added.');
+}
+export function hasUserVmConfig(vm = {}) {
+    return vm.cpu != null || vm.memory != null || vm.disk != null;
+}
+export function resolveEffectiveVm(adapter, userVm = {}, { detectHostResourcesFn = detectHostResources } = {}) {
+    let host = null;
+    const getHost = () => {
+        host ??= detectHostResourcesFn();
+        return host;
+    };
+    const defaults = adapter.defaultResources?.(getHost) ?? {};
+    return {
+        cpu: userVm.cpu ?? defaults.cpu ?? null,
+        memory: userVm.memory ?? defaults.memory ?? null,
+        disk: userVm.disk ?? defaults.disk ?? null
+    };
+}
+function effectiveConfigFor(adapter, config) {
+    const userVm = config.vm ?? {};
+    return {
+        ...config,
+        userVm,
+        hasUserVmConfig,
+        vm: resolveEffectiveVm(adapter, userVm)
+    };
+}
+export async function ensureDocker(config, onMessage, dependencies = {}) {
+    const engine = detectEngine(config, dependencies);
+    const adapter = getAdapter(engine);
+    const effectiveConfig = effectiveConfigFor(adapter, config);
+    applyDockerContext(adapter);
+    const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, runFns(dependencies));
+    adapter.syncResources(effectiveConfig, onMessage, runFns(dependencies), { vmJustStarted });
+}
+export function isVmManaged(config = {}, dependencies = {}) {
+    try {
+        const engine = detectEngine(config, dependencies);
+        return isManagedEngine(engine);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : '';
+        if (message.startsWith('sandbox: platform "')
+            || / is not supported on [^.]+\. Supported engines on [^:]+: none\./.test(message)) {
+            return false;
+        }
+        throw error;
+    }
+}
+export function isManagedEngine(engine) {
+    try {
+        return getAdapter(engine).managed;
+    }
+    catch {
+        return false;
+    }
+}
+export function engineDisplayName(engine) {
+    try {
+        return getAdapter(engine).displayName;
+    }
+    catch {
+        return engine;
+    }
+}
+export function startManagedVm(config, { platformFn = platform, runOkFn = runOk, runSafeFn = runSafe, runVerboseFn = runVerbose, onMessage } = {}) {
+    const engine = detectEngine(config, { platformFn });
+    const adapter = getAdapter(engine);
+    if (!adapter.managed) {
+        throw new Error(`VM management is unavailable for engine '${adapter.displayName}'.`);
+    }
+    const effectiveConfig = effectiveConfigFor(adapter, config);
+    applyDockerContext(adapter);
+    if (!adapter.startVm) {
+        throw new Error(`VM management is unavailable for engine '${adapter.displayName}'.`);
+    }
+    const result = adapter.startVm(effectiveConfig, onMessage, runFns({ runOkFn, runSafeFn, runVerboseFn }));
+    adapter.syncResources(effectiveConfig, onMessage, runFns({ runOkFn, runSafeFn, runVerboseFn }), { vmJustStarted: result === 'started' });
+    return result;
+}
+export function stopManagedVm(config, { platformFn = platform, runFn = run } = {}) {
+    const engine = detectEngine(config, { platformFn });
+    const adapter = getAdapter(engine);
+    if (!adapter.managed) {
+        throw new Error(`VM management is unavailable for engine '${adapter.displayName}'.`);
+    }
+    if (!adapter.stopVm) {
+        throw new Error(`VM management is unavailable for engine '${adapter.displayName}'.`);
+    }
+    // Stop commands do not read Docker context or VM resource values; keep the
+    // previous environment unchanged and pass the original config intentionally.
+    return adapter.stopVm(config, null, runFns({ runFn }));
+}
+//# sourceMappingURL=engine.js.map

package/dist/lib/sandbox/engines/colima.js

@@ -0,0 +1,64 @@
+function colimaArgs(config, runSafeFn) {
+    const arch = runSafeFn('uname', ['-m']);
+    const vm = config.vm ?? {};
+    const args = ['start', '--cpu', String(vm.cpu), '--memory', String(vm.memory), '--disk', String(vm.disk)];
+    if (arch === 'arm64') {
+        args.push('--arch', 'aarch64', '--vm-type=vz', '--mount-type=virtiofs');
+    }
+    else {
+        args.push('--arch', 'x86_64');
+    }
+    return args;
+}
+export const colimaAdapter = {
+    id: 'colima',
+    displayName: 'Colima',
+    supportedPlatforms: ['darwin'],
+    dockerContext: 'colima',
+    managed: true,
+    canApplyResources: 'on-start',
+    defaultResources(getHost) {
+        const host = getHost();
+        return {
+            cpu: host.cpu,
+            memory: host.memory,
+            disk: 60
+        };
+    },
+    async ensure(config, onMessage, { runOk, runSafe, runVerbose }) {
+        let started = false;
+        if (!runOk('which', ['colima'])) {
+            onMessage?.('Installing colima + docker via Homebrew...');
+            runVerbose('brew', ['install', 'colima', 'docker']);
+        }
+        if (!runOk('colima', ['status'])) {
+            onMessage?.('Starting Colima VM...');
+            runVerbose('colima', colimaArgs(config, runSafe));
+            started = true;
+        }
+        if (!runOk('docker', ['info'])) {
+            throw new Error('Docker daemon is not available after starting Colima');
+        }
+        return started;
+    },
+    startVm(config, _onMessage, { runOk, runSafe, runVerbose }) {
+        if (runOk('colima', ['status'])) {
+            return 'already-running';
+        }
+        runVerbose('colima', colimaArgs(config, runSafe));
+        return 'started';
+    },
+    stopVm(_config, _onMessage, { run }) {
+        run('colima', ['stop']);
+        return 'stopped';
+    },
+    syncResources(config, onMessage, _runFns, { vmJustStarted } = {}) {
+        if (vmJustStarted || !config.hasUserVmConfig?.(config.userVm)) {
+            return;
+        }
+        onMessage?.('Warning: Colima VM is already running; restart with '
+            + '`ai sandbox vm stop && ai sandbox vm start` to apply new sandbox.vm.* values.');
+    }
+};
+export default colimaAdapter;
+//# sourceMappingURL=colima.js.map

package/dist/lib/sandbox/engines/docker-desktop.js

@@ -0,0 +1,27 @@
+export const dockerDesktopAdapter = {
+    id: 'docker-desktop',
+    displayName: 'Docker Desktop',
+    supportedPlatforms: ['darwin', 'linux', 'win32'],
+    dockerContext: 'desktop-linux',
+    managed: false,
+    canApplyResources: 'never',
+    defaultResources() {
+        return null;
+    },
+    async ensure(_config, _onMessage, { runOk }) {
+        if (!runOk('docker', ['info'])) {
+            throw new Error('Docker Desktop is not running. Please start Docker Desktop manually.');
+        }
+        return false;
+    },
+    syncResources(config, onMessage) {
+        if (!config.hasUserVmConfig?.(config.userVm)) {
+            return;
+        }
+        onMessage?.('Warning: Docker Desktop manages CPU/memory/disk via Settings -> Resources. '
+            + 'sandbox.vm.* values and --cpu/--memory flags are not applied for this engine. '
+            + 'Please configure resources in Docker Desktop GUI to match.');
+    }
+};
+export default dockerDesktopAdapter;
+//# sourceMappingURL=docker-desktop.js.map

package/dist/lib/sandbox/engines/index.js

@@ -0,0 +1,25 @@
+import { colimaAdapter } from "./colima.js";
+import { dockerDesktopAdapter } from "./docker-desktop.js";
+import { nativeAdapter } from "./native.js";
+import { orbstackAdapter } from "./orbstack.js";
+import { wsl2Adapter } from "./wsl2.js";
+export const ADAPTERS = Object.freeze({
+    colima: colimaAdapter,
+    orbstack: orbstackAdapter,
+    'docker-desktop': dockerDesktopAdapter,
+    native: nativeAdapter,
+    wsl2: wsl2Adapter
+});
+export function getAdapter(engineId) {
+    const adapter = ADAPTERS[engineId];
+    if (!adapter) {
+        throw new Error(`No adapter registered for engine '${engineId}'`);
+    }
+    return adapter;
+}
+export function enginesForPlatform(platformName) {
+    return Object.values(ADAPTERS)
+        .filter((adapter) => adapter.supportedPlatforms.includes(platformName))
+        .map((adapter) => adapter.id);
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/sandbox/engines/native.js

@@ -0,0 +1,96 @@
+export function isRootlessDocker({ env = process.env, runSafe } = {}) {
+    const dockerHost = env.DOCKER_HOST ?? '';
+    if (dockerHost.startsWith('unix:///run/user/')) {
+        return true;
+    }
+    if (!runSafe) {
+        return false;
+    }
+    try {
+        const securityOptions = runSafe('docker', ['info', '--format', '{{.SecurityOptions}}']);
+        return securityOptions.includes('rootless');
+    }
+    catch {
+        return false;
+    }
+}
+export function resolveBuildUid({ engine, runFn, runSafeFn, env = process.env }) {
+    const runSafe = runSafeFn
+        ? (cmd, args) => runSafeFn(engine, cmd, args)
+        : undefined;
+    if (engine === 'native' && isRootlessDocker({ env, runSafe })) {
+        return { uid: '0', gid: '0' };
+    }
+    return {
+        uid: runFn(engine, 'id', ['-u']),
+        gid: runFn(engine, 'id', ['-g'])
+    };
+}
+export const nativeAdapter = {
+    id: 'native',
+    displayName: 'native Docker',
+    supportedPlatforms: ['linux', 'win32'],
+    dockerContext: null,
+    managed: false,
+    canApplyResources: 'never',
+    defaultResources() {
+        return null;
+    },
+    async ensure(_config, _onMessage, { runOk, runSafe }) {
+        if (!runOk('which', ['docker'])) {
+            throw new Error([
+                'Docker is not installed.',
+                'Install Docker Engine for your distribution: https://docs.docker.com/engine/install/',
+                'Then start the daemon with: sudo systemctl enable --now docker',
+                'If you want to run Docker without sudo, add your user to the docker group: sudo usermod -aG docker $USER'
+            ].join('\n'));
+        }
+        if (runOk('docker', ['info'])) {
+            return false;
+        }
+        const serverVersion = runSafe('docker', ['version', '--format', '{{.Server.Version}}']);
+        const rootless = isRootlessDocker({ runSafe });
+        if (!serverVersion) {
+            if (rootless) {
+                throw new Error([
+                    'Docker rootless daemon is not running or is unreachable.',
+                    'Start it with: systemctl --user start docker',
+                    'Enable it on login with: systemctl --user enable docker',
+                    'Verify DOCKER_HOST points at $XDG_RUNTIME_DIR/docker.sock.',
+                    'Then retry: ai sandbox create <branch>'
+                ].join('\n'));
+            }
+            throw new Error([
+                'Docker daemon is not running or is unreachable.',
+                'Start it with: sudo systemctl start docker',
+                'Enable it on boot with: sudo systemctl enable docker',
+                'If you use rootless or remote Docker, verify DOCKER_HOST points at a reachable socket.',
+                'For rootless Docker, export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock and run: systemctl --user start docker',
+                'Then retry: ai sandbox create <branch>'
+            ].join('\n'));
+        }
+        if (rootless) {
+            throw new Error([
+                'docker info failed even though the rootless daemon responded to version.',
+                'This usually means DOCKER_HOST or XDG_RUNTIME_DIR is misconfigured.',
+                'Verify DOCKER_HOST matches $XDG_RUNTIME_DIR/docker.sock.',
+                'Check the daemon with: systemctl --user status docker',
+                'Then retry: ai sandbox create <branch>'
+            ].join('\n'));
+        }
+        throw new Error([
+            'Docker is installed, but the current user may lack permission to use the daemon.',
+            'Add your user to the docker group: sudo usermod -aG docker $USER',
+            'Open a new login shell or run: newgrp docker'
+        ].join('\n'));
+    },
+    syncResources(config, onMessage) {
+        if (!config.hasUserVmConfig?.(config.userVm)) {
+            return;
+        }
+        onMessage?.('Warning: Linux native Docker has no managed VM; sandbox.vm.* is not applicable. '
+            + 'Use docker run --cpus / --memory per container or host cgroups.');
+    }
+};
+export default nativeAdapter;
+//# sourceMappingURL=native.js.map

package/dist/lib/sandbox/engines/orbstack.js

@@ -0,0 +1,63 @@
+export const orbstackAdapter = {
+    id: 'orbstack',
+    displayName: 'OrbStack',
+    supportedPlatforms: ['darwin'],
+    dockerContext: 'orbstack',
+    managed: true,
+    canApplyResources: 'hot',
+    defaultResources() {
+        return null;
+    },
+    async ensure(_config, onMessage, { runOk, runVerbose }) {
+        let started = false;
+        if (!runOk('which', ['orb'])) {
+            onMessage?.('Installing OrbStack via Homebrew...');
+            runVerbose('brew', ['install', '--cask', 'orbstack']);
+        }
+        if (!runOk('docker', ['info'])) {
+            onMessage?.('Starting OrbStack...');
+            runVerbose('orb', ['start']);
+            started = true;
+        }
+        if (!runOk('docker', ['info'])) {
+            throw new Error('Docker daemon is not available after starting OrbStack');
+        }
+        return started;
+    },
+    startVm(_config, _onMessage, { runOk, runVerbose }) {
+        if (runOk('orb', ['status'])) {
+            return 'already-running';
+        }
+        runVerbose('orb', ['start']);
+        return 'started';
+    },
+    stopVm(_config, _onMessage, { run }) {
+        run('orb', ['stop']);
+        return 'stopped';
+    },
+    syncResources(config, onMessage, { runVerbose }) {
+        const vm = config?.vm ?? {};
+        if (vm.cpu != null) {
+            try {
+                runVerbose('orb', ['config', 'set', 'cpu', String(vm.cpu)]);
+            }
+            catch {
+                onMessage?.(`Warning: failed to apply OrbStack cpu=${vm.cpu}; resource limit may not take effect.`);
+            }
+        }
+        if (vm.memory != null) {
+            try {
+                runVerbose('orb', ['config', 'set', 'memory_mib', String(vm.memory * 1024)]);
+            }
+            catch {
+                onMessage?.(`Warning: failed to apply OrbStack memory=${vm.memory}GiB; resource limit may not take effect.`);
+            }
+        }
+        if (vm.disk != null) {
+            onMessage?.(`Warning: OrbStack does not expose a fixed disk size; sandbox.vm.disk=${vm.disk} is ignored. `
+                + 'Manage storage via OrbStack settings GUI.');
+        }
+    }
+};
+export default orbstackAdapter;
+//# sourceMappingURL=orbstack.js.map

package/dist/lib/sandbox/engines/selinux.js

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+const SELINUX_ENFORCE_PATH = '/sys/fs/selinux/enforce';
+const detectionCache = new WeakMap();
+const VALID_DISABLE_VALUES = new Set([undefined, '', '0', '1']);
+function isDisabled(env) {
+    return env?.AGENT_INFRA_SELINUX_DISABLE === '1';
+}
+function readEnforceFlag(fsImpl) {
+    try {
+        return fsImpl.readFileSync(SELINUX_ENFORCE_PATH, 'utf8').trim();
+    }
+    catch {
+        return null;
+    }
+}
+function isSelinuxEnforcing(fsImpl, platform) {
+    let cache = detectionCache.get(fsImpl);
+    if (!cache) {
+        cache = new Map();
+        detectionCache.set(fsImpl, cache);
+    }
+    if (cache.has(platform)) {
+        return cache.get(platform);
+    }
+    const enforcing = readEnforceFlag(fsImpl) === '1';
+    cache.set(platform, enforcing);
+    return enforcing;
+}
+export function selinuxLabelForMount(engine, options = {}) {
+    const { fs: fsImpl = fs, platform = process.platform, env = process.env } = options;
+    if (engine !== 'native' || platform !== 'linux') {
+        return null;
+    }
+    if (isDisabled(env)) {
+        return null;
+    }
+    if (!isSelinuxEnforcing(fsImpl, platform)) {
+        return null;
+    }
+    return 'z';
+}
+export function validateSelinuxDisableEnv(env = process.env) {
+    const value = env?.AGENT_INFRA_SELINUX_DISABLE;
+    if (!VALID_DISABLE_VALUES.has(value)) {
+        throw new Error('Invalid AGENT_INFRA_SELINUX_DISABLE value. Expected 1 to disable, or unset/0 for default.');
+    }
+}
+//# sourceMappingURL=selinux.js.map

package/dist/lib/sandbox/engines/wsl2-paths.js

@@ -0,0 +1,47 @@
+import path from 'node:path';
+import { selinuxLabelForMount } from "./selinux.js";
+const WINDOWS_DRIVE_PATH_PATTERN = /^([A-Za-z]):[\\/](.*)$/;
+const UNC_PATH_PATTERN = /^(?:\\\\|\/\/)[^\\/]+[\\/][^\\/]+/;
+export function hostJoin(basePath, ...segments) {
+    return basePath.startsWith('/') ? path.posix.join(basePath, ...segments) : path.join(basePath, ...segments);
+}
+export function isWindowsDrivePath(value) {
+    return typeof value === 'string' && WINDOWS_DRIVE_PATH_PATTERN.test(value);
+}
+export function isUncPath(value) {
+    return typeof value === 'string' && UNC_PATH_PATTERN.test(value);
+}
+export function windowsPathToWslPath(value) {
+    if (value.length === 0) {
+        return value;
+    }
+    if (isUncPath(value)) {
+        throw new Error(`UNC paths are not supported for WSL2 sandbox mounts: ${value}`);
+    }
+    const match = value.match(WINDOWS_DRIVE_PATH_PATTERN);
+    if (!match) {
+        return value.replace(/\\/g, '/');
+    }
+    const [, drive = '', rest = ''] = match;
+    const normalizedRest = rest.replace(/\\/g, '/').replace(/^\/+/, '');
+    return `/mnt/${drive.toLowerCase()}/${normalizedRest}`;
+}
+export function toEnginePath(engine, value) {
+    if (engine !== 'wsl2') {
+        return value;
+    }
+    return windowsPathToWslPath(value);
+}
+export function volumeArg(engine, hostPath, containerPath, suffix = '', options = {}) {
+    const { selinux = 'shared', ...selinuxOptions } = options;
+    const flags = suffix.replace(/^:/, '').split(',').filter(Boolean);
+    if (selinux !== 'none') {
+        const label = selinuxLabelForMount(engine, selinuxOptions);
+        if (label && !flags.includes(label)) {
+            flags.push(label);
+        }
+    }
+    const composedSuffix = flags.length > 0 ? `:${flags.join(',')}` : '';
+    return `${toEnginePath(engine, hostPath)}:${containerPath}${composedSuffix}`;
+}
+//# sourceMappingURL=wsl2-paths.js.map

package/dist/lib/sandbox/engines/wsl2.js

@@ -0,0 +1,57 @@
+function ensureWslAvailable(runOk) {
+    if (runOk('wsl.exe', ['--status']) || runOk('wsl.exe', ['--', 'true'])) {
+        return;
+    }
+    throw new Error([
+        'WSL2 is required for Windows sandbox support.',
+        'Install WSL2, configure a default Linux distribution, and re-run "ai sandbox create".'
+    ].join('\n'));
+}
+function ensureDockerAvailable(runOk) {
+    if (runOk('wsl.exe', ['--', 'docker', 'info'])) {
+        return;
+    }
+    throw new Error([
+        'Docker is not available inside WSL2.',
+        'Start Docker Desktop and enable WSL integration for your default distribution.'
+    ].join('\n'));
+}
+function wsl2BackendCheck(runOk, onMessage) {
+    ensureWslAvailable(runOk);
+    onMessage?.('Checking Docker Desktop from WSL2...');
+    ensureDockerAvailable(runOk);
+}
+export const wsl2Adapter = {
+    id: 'wsl2',
+    displayName: 'WSL2',
+    supportedPlatforms: ['win32'],
+    dockerContext: null,
+    managed: true,
+    canApplyResources: 'never',
+    defaultResources() {
+        return null;
+    },
+    async ensure(config, onMessage, { runOk }) {
+        wsl2BackendCheck(runOk, onMessage);
+        void config;
+        return false;
+    },
+    startVm(config, onMessage, { runOk }) {
+        wsl2BackendCheck(runOk, onMessage);
+        void config;
+        return 'already-running';
+    },
+    stopVm() {
+        throw new Error('Windows uses Docker Desktop with WSL2. Stop it from Docker Desktop or run "wsl --shutdown" manually.');
+    },
+    syncResources(config, onMessage) {
+        if (!config.hasUserVmConfig?.(config.userVm)) {
+            return;
+        }
+        onMessage?.('Warning: Docker Desktop manages CPU/memory/disk via Settings -> Resources. '
+            + 'sandbox.vm.* values and --cpu/--memory flags are not applied for this engine. '
+            + 'Please configure resources in Docker Desktop GUI to match.');
+    }
+};
+export default wsl2Adapter;
+//# sourceMappingURL=wsl2.js.map

package/dist/lib/sandbox/index.js

@@ -0,0 +1,70 @@
+const USAGE = `Usage: ai sandbox <command> [options]
+
+Commands:
+  create <branch> [base]       Create a sandbox (VM + image + worktree + container)
+  exec <branch> [cmd...]       Enter sandbox or run a command
+  refresh                      Sync host Claude Code credentials to all sandbox copies
+  ls                           List sandboxes for the current project
+  rm <branch> [--all]          Remove a sandbox or all sandboxes
+  vm status|start|stop         Manage the sandbox VM (macOS) or check the backend (Windows)
+  rebuild [--quiet]            Rebuild the sandbox image
+
+Run 'ai sandbox <command> --help' for details.`;
+export async function runSandbox(args) {
+    const [subcommand, ...rest] = args;
+    if (!subcommand) {
+        process.stdout.write(`${USAGE}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (subcommand === '--help' || subcommand === '-h' || subcommand === 'help') {
+        process.stdout.write(`${USAGE}\n`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': {
+            const { create } = await import("./commands/create.js");
+            await create(rest);
+            break;
+        }
+        case 'exec': {
+            const { enter } = await import("./commands/enter.js");
+            const exitCode = enter(rest);
+            if (typeof exitCode === 'number' && exitCode !== 0) {
+                process.exitCode = exitCode;
+            }
+            break;
+        }
+        case 'refresh': {
+            const { refresh } = await import("./commands/refresh.js");
+            const exitCode = await refresh(rest);
+            if (typeof exitCode === 'number' && exitCode !== 0) {
+                process.exitCode = exitCode;
+            }
+            break;
+        }
+        case 'ls': {
+            const { ls } = await import("./commands/ls.js");
+            ls(rest);
+            break;
+        }
+        case 'rm': {
+            const { rm } = await import("./commands/rm.js");
+            await rm(rest);
+            break;
+        }
+        case 'vm': {
+            const { vm } = await import("./commands/vm.js");
+            await vm(rest);
+            break;
+        }
+        case 'rebuild': {
+            const { rebuild } = await import("./commands/rebuild.js");
+            await rebuild(rest);
+            break;
+        }
+        default:
+            throw new Error(`Unknown sandbox command: ${subcommand}`);
+    }
+}
+//# sourceMappingURL=index.js.map