@geminixiang/mama 0.1.10 → 0.2.0-beta.1

package/dist/provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAqB1C,kFAAkF;AAElF;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;aAST,kBAAa,GAAG,mBAAmB,AAAtB,CAAuB;aACpC,qBAAgB,GAAG,oBAAoB,AAAvB,CAAwB;aACxC,uBAAkB,GAAG,eAAe,AAAlB,CAAmB;IAE7D,YACmB,KAAa,EACb,YAAoB,EACpB,YAAY,GAAkB,aAAa;QAF3C,UAAK,GAAL,KAAK,CAAQ;QACb,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAA+B;QAftD,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;QAClD;;;;;WAKG;QACK,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IASnD,CAAC;IAEJ,gFAAgF;IAChF,MAAM,CAAC,eAAe,CAAC,KAAa;QAClC,MAAM,SAAS,GAAG,KAAK;aACpB,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,QAAgB,EAAE,cAAsB;QACrD,OAAO,GAAG,sBAAsB,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,CAAC;IACzH,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,CAAC,OAAe;QAClC,OAAO,gBAAgB,OAAO,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAO,GAAqB,EAAE;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAAyB;QACrE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAClF,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,uCAAuC,CAAC,CAAC;gBAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,YAAY,CAAC,CAAC;YACtD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,kBAAkB,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,4BAA4B,aAAa,EAAE,EAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,8BAA8B,aAAa,EAAE,EAC7C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACnD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,KAAK,MAAM,aAAa,IAAI,UAAU,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,UAAU,CAAC,qDAAqD,EAAE,aAAa,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,CACT,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,OAAO,aAAa,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,OAAe,EAAE,MAAuB,EAAE,aAAqB;QAC9E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACjG,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,KAAqB;QACtC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,aAAqB,EACrB,MAAwB;QAExB,GAAG,CAAC,OAAO,CAAC,sBAAsB,aAAa,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,aAAa;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,OAAO,EAAE;YACzD,IAAI;YACJ,GAAG,IAAI,CAAC,YAAY,aAAa;YACjC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,KAAK;YACV,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,aAAqB,EACrB,MAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAEO,aAAa,CAAC,MAAwB;QAC5C,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,aAAa,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;aACzF,KAAK,EAAE;aACP,IAAI,EAAE,CAAC;IACZ,CAAC;IAEO,SAAS,CAAC,QAAkB,EAAE,MAAgB;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,4BAA4B;YAC5B,aAAa;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;QAE5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,aAAa,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,SAAS,sBAAsB,CAAC,aAAa,EAAE;gBAC/C,UAAU;gBACV,SAAS,sBAAsB,CAAC,gBAAgB,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,2CAA2C,EAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,0BAA0B;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,QAAQ,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,0CAA0C,EAC1C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAErB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,qEAAqE,sBAAsB,CAAC,kBAAkB,KAAK;gBACnH,aAAa;aACd,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,+BAA+B,aAAa,mBAAmB,EAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,wBAAwB,CAAC,aAAqB;QACpD,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC","sourcesContent":["import { execFile } from \"child_process\";\nimport { promisify } from \"util\";\nimport * as log from \"./log.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n}\n\n// ── DockerContainerManager ─────────────────────────────────────────────────────\n\n/**\n * Manages the lifecycle of per-user Docker containers.\n *\n * Tracks each container's status in memory (running / stopped / missing).\n * State is always verified against Docker on provision(), so in-memory state\n * stays accurate without polling.\n */\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  /**\n   * In-flight provision() calls per vaultId. A concurrent second call for the\n   * same user piggybacks on the first docker start/run instead of racing —\n   * without this, two parallel messages from one user could produce duplicate\n   * containers or conflict on docker run.\n   */\n  private inflight = new Map<string, Promise<string>>();\n  private static readonly MANAGED_LABEL = \"mama.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mama.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mama.vault-id\";\n\n  constructor(\n    private readonly image: string,\n    private readonly workspaceDir: string,\n    private readonly execFileImpl: ExecFileAsync = execFileAsync,\n  ) {}\n\n  /** Sanitize an identifier segment for use in vault keys and container names. */\n  static sanitizeSegment(value: string): string {\n    const sanitized = value\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\");\n    return sanitized || \"unknown\";\n  }\n\n  /**\n   * Deterministic vault key for a platform user.\n   * e.g. (\"slack\", \"U04ABC\") → \"slack-u04abc\"\n   */\n  static vaultId(platform: string, platformUserId: string): string {\n    return `${DockerContainerManager.sanitizeSegment(platform)}-${DockerContainerManager.sanitizeSegment(platformUserId)}`;\n  }\n\n  /** Deterministic container name for a vault-backed user sandbox. */\n  static containerName(vaultId: string): string {\n    return `mama-sandbox-${vaultId}`;\n  }\n\n  /**\n   * Ensure a container exists and is running for the given vaultId.\n   * Always inspects the actual Docker state, then acts accordingly:\n   * - running  → no-op\n   * - stopped  → docker start\n   * - missing  → docker run\n   *\n   * Returns the container name.\n   */\n  async provision(vaultId: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(vaultId);\n    if (existing) return existing;\n\n    const pending = this.provisionInner(vaultId, options).finally(() => {\n      this.inflight.delete(vaultId);\n    });\n    this.inflight.set(vaultId, pending);\n    return pending;\n  }\n\n  private async provisionInner(vaultId: string, options: ProvisionOptions): Promise<string> {\n    const containerName = options.containerName ?? DockerContainerManager.containerName(vaultId);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      if (status !== \"missing\" && (await this.hasBindMountDrift(containerName, mounts))) {\n        log.logInfo(`Container ${containerName} mounts changed; recreating container`);\n        await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n        await this.runContainer(vaultId, containerName, mounts);\n        log.logInfo(`Container ${containerName} recreated`);\n      } else if (status === \"running\") {\n        log.logInfo(`Container ${containerName} already running`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else {\n        await this.runContainer(vaultId, containerName, mounts);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      // Drop cached state so the next provision() re-inspects Docker cleanly\n      // and stopIdle doesn't keep trying to stop a container that never\n      // became running. We deliberately don't bump lastUsed here.\n      this.state.delete(vaultId);\n      throw err;\n    }\n\n    this.setState(vaultId, \"running\", containerName);\n    return containerName;\n  }\n\n  /**\n   * Stop a running container (docker stop). Container is preserved and can be\n   * restarted via provision(). Intended for idle lifecycle management.\n   */\n  async stop(vaultId: string): Promise<void> {\n    const containerName = this.getContainerName(vaultId);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(vaultId, \"stopped\", containerName);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to stop container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  /** Stop and remove a container permanently (e.g. on vault revocation). */\n  async remove(vaultId: string): Promise<void> {\n    const containerName = this.getContainerName(vaultId);\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      this.state.delete(vaultId);\n      log.logInfo(`Container ${containerName} removed`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to remove container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  /**\n   * Stop all containers that have been idle for longer than maxIdleMs.\n   * Idle time is measured from the last provision() call.\n   */\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [vaultId, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(vaultId);\n      }\n    }\n    await Promise.all(toStop.map((vaultId) => this.stop(vaultId)));\n  }\n\n  /**\n   * Rebuild in-memory state from existing Docker containers managed by mama image mode.\n   * Supports both new labeled containers and legacy name-prefixed containers.\n   */\n  async reconcile(): Promise<void> {\n    const discovered = new Set<string>();\n    const labeledNames = await this.listContainerNamesByLabel();\n    for (const name of labeledNames) discovered.add(name);\n    const legacyNames = await this.listContainerNamesByPrefix();\n    for (const name of legacyNames) discovered.add(name);\n\n    this.state.clear();\n\n    for (const containerName of discovered) {\n      const details = await this.inspectContainerDetails(containerName);\n      if (!details) continue;\n\n      const vaultId = details.vaultId || this.vaultIdFromContainerName(containerName);\n      if (!vaultId) {\n        log.logWarning(`Skipping unmanaged-style container without vault id`, containerName);\n        continue;\n      }\n\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(vaultId, { status, lastUsed, containerName });\n    }\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(vaultId: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(vaultId, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(vaultId: string): string {\n    return this.state.get(vaultId)?.containerName ?? DockerContainerManager.containerName(vaultId);\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}`;\n  }\n\n  private async runContainer(\n    vaultId: string,\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<void> {\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${vaultId}`,\n      \"-v\",\n      `${this.workspaceDir}:/workspace`,\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private async hasBindMountDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    const expected = this.expectedBinds(mounts);\n    const actual = await this.inspectBindMounts(containerName);\n    return !this.sameBinds(expected, actual);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return [`${this.workspaceDir}:/workspace`, ...mounts.map((mount) => this.toBindSpec(mount))]\n      .slice()\n      .sort();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].sort();\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list labeled managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private async listContainerNamesByPrefix(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `name=${DockerContainerManager.containerName(\"\")}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list legacy managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<{ running: boolean; startedAtMs?: number; vaultId?: string } | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{index .Config.Labels \"${DockerContainerManager.VAULT_ID_LABEL_KEY}\"}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, vaultIdRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      const vaultId = this.normalizeDockerValue(vaultIdRaw);\n      return { running, startedAtMs, vaultId };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        err instanceof Error ? err.message : String(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private vaultIdFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const vaultId = containerName.slice(prefix.length);\n    return vaultId.length > 0 ? vaultId : undefined;\n  }\n}\n\n/** @deprecated Use DockerContainerManager */\nexport const DockerProvisioner = DockerContainerManager;\n"]}

package/dist/sandbox/container.d.ts

@@ -0,0 +1,15 @@
+import type { ContainerSandboxConfig, ExecOptions, ExecResult, Executor, SandboxAdapter } from "./types.js";
+export declare function parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined;
+export declare function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void>;
+export declare function buildContainerExecCommand(container: string, command: string, envFilePath?: string): string;
+export declare class ContainerExecutor implements Executor {
+    private container;
+    private env?;
+    private ensureReady?;
+    constructor(container: string, env?: Record<string, string> | undefined, ensureReady?: (() => Promise<void>) | undefined);
+    exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    getWorkspacePath(_hostPath: string): string;
+    getSandboxConfig(): ContainerSandboxConfig;
+}
+export declare const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig>;
+//# sourceMappingURL=container.d.ts.map

package/dist/sandbox/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,cAAc,EACf,MAAM,YAAY,CAAC;AAQpB,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAY1F;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B5F;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAGR;AAED,qBAAa,iBAAkB,YAAW,QAAQ;IAE9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IAHtB,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAetE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAM1E,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple, shellEscape } from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mama-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nexport async function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nexport function buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;\n}\n\nexport class ContainerExecutor implements Executor {\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const hostExecutor = new HostExecutor();\n    const temp = this.env ? createSecureEnvFile(this.env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(this.container, command, temp?.envFilePath);\n      return await hostExecutor.exec(dockerCmd, options);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mama-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n\nfunction sanitizeEnvValue(value: string): string {\n  return value.replace(/\\r?\\n/g, \"\");\n}\n"]}

package/dist/sandbox/container.js

@@ -0,0 +1,122 @@
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { SandboxError } from "./errors.js";
+import { execSimple, shellEscape } from "./utils.js";
+import { HostExecutor } from "./host.js";
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+export function parseContainerSandboxArg(value) {
+    if (!value.startsWith("container:")) {
+        return undefined;
+    }
+    const container = value.slice("container:".length);
+    if (!container) {
+        throw new SandboxError("Error: container sandbox requires container name (e.g., container:mama-sandbox)");
+    }
+    return { type: "container", container };
+}
+export async function validateContainerSandbox(config) {
+    try {
+        await execSimple("docker", ["--version"]);
+    }
+    catch {
+        throw new SandboxError("Error: Docker is not installed or not in PATH");
+    }
+    try {
+        const result = await execSimple("docker", [
+            "inspect",
+            "-f",
+            "{{.State.Running}}",
+            config.container,
+        ]);
+        if (result.trim() !== "true") {
+            throw new SandboxError(`Error: Container '${config.container}' is not running.`, [
+                `Start it with: docker start ${config.container}`,
+            ]);
+        }
+    }
+    catch (error) {
+        if (error instanceof SandboxError) {
+            throw error;
+        }
+        throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [
+            `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,
+        ]);
+    }
+    console.log(`  Container '${config.container}' is running.`);
+}
+export function buildContainerExecCommand(container, command, envFilePath) {
+    const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : "";
+    return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;
+}
+export class ContainerExecutor {
+    constructor(container, env, ensureReady) {
+        this.container = container;
+        this.env = env;
+        this.ensureReady = ensureReady;
+    }
+    async exec(command, options) {
+        if (this.ensureReady) {
+            await this.ensureReady();
+        }
+        else {
+            await ensureContainerRunning(this.container);
+        }
+        const hostExecutor = new HostExecutor();
+        const temp = this.env ? createSecureEnvFile(this.env) : undefined;
+        try {
+            const dockerCmd = buildContainerExecCommand(this.container, command, temp?.envFilePath);
+            return await hostExecutor.exec(dockerCmd, options);
+        }
+        finally {
+            temp?.cleanup();
+        }
+    }
+    getWorkspacePath(_hostPath) {
+        return "/workspace";
+    }
+    getSandboxConfig() {
+        return { type: "container", container: this.container };
+    }
+}
+export const containerSandboxAdapter = {
+    type: "container",
+    parse: parseContainerSandboxArg,
+    validate: validateContainerSandbox,
+    createExecutor: (config, env, ensureReady) => new ContainerExecutor(config.container, env, ensureReady),
+};
+async function ensureContainerRunning(container) {
+    try {
+        const running = await execSimple("docker", ["inspect", "-f", "{{.State.Running}}", container]);
+        if (running.trim() === "true") {
+            return;
+        }
+        await execSimple("docker", ["start", container]);
+    }
+    catch (error) {
+        const details = error instanceof Error ? error.message : String(error);
+        throw new Error(`Container "${container}" is not available. ` +
+            `Expected a pre-existing container or image provisioning to keep it running.\n${details}`.trim());
+    }
+}
+function createSecureEnvFile(env) {
+    const tempDir = mkdtempSync(join(tmpdir(), "mama-docker-env-"));
+    chmodSync(tempDir, PRIVATE_DIR_MODE);
+    const envFilePath = join(tempDir, "env.list");
+    const content = Object.entries(env)
+        .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)
+        .join("\n") + "\n";
+    writeFileSync(envFilePath, content, { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
+    chmodSync(envFilePath, PRIVATE_FILE_MODE);
+    return {
+        envFilePath,
+        cleanup: () => {
+            rmSync(tempDir, { recursive: true, force: true });
+        },
+    };
+}
+function sanitizeEnvValue(value) {
+    return value.replace(/\r?\n/g, "");
+}
+//# sourceMappingURL=container.js.map

package/dist/sandbox/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IAC3E,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,OAAe,EACf,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,eAAe,OAAO,iBAAiB,SAAS,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,OAAO,iBAAiB;IAC5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;yBAFjC,SAAS;mBACT,GAAG;2BACH,WAAW;IAClB,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACxF,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple, shellEscape } from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mama-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nexport async function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nexport function buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;\n}\n\nexport class ContainerExecutor implements Executor {\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const hostExecutor = new HostExecutor();\n    const temp = this.env ? createSecureEnvFile(this.env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(this.container, command, temp?.envFilePath);\n      return await hostExecutor.exec(dockerCmd, options);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mama-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n\nfunction sanitizeEnvValue(value: string): string {\n  return value.replace(/\\r?\\n/g, \"\");\n}\n"]}

package/dist/sandbox/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class SandboxError extends Error {
+    readonly details: string[];
+    constructor(message: string, details?: string[]);
+    formatForCli(): string[];
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/sandbox/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sandbox/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3B,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,EAI9C;IAED,YAAY,IAAI,MAAM,EAAE,CAEvB;CACF","sourcesContent":["export class SandboxError extends Error {\n  readonly details: string[];\n\n  constructor(message: string, details?: string[]) {\n    super(message);\n    this.name = \"SandboxError\";\n    this.details = details ?? [];\n  }\n\n  formatForCli(): string[] {\n    return [this.message, ...this.details];\n  }\n}\n"]}

package/dist/sandbox/errors.js

@@ -0,0 +1,11 @@
+export class SandboxError extends Error {
+    constructor(message, details) {
+        super(message);
+        this.name = "SandboxError";
+        this.details = details ?? [];
+    }
+    formatForCli() {
+        return [this.message, ...this.details];
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/sandbox/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sandbox/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAGrC,YAAY,OAAe,EAAE,OAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;CACF","sourcesContent":["export class SandboxError extends Error {\n  readonly details: string[];\n\n  constructor(message: string, details?: string[]) {\n    super(message);\n    this.name = \"SandboxError\";\n    this.details = details ?? [];\n  }\n\n  formatForCli(): string[] {\n    return [this.message, ...this.details];\n  }\n}\n"]}

package/dist/sandbox/firecracker.d.ts

@@ -0,0 +1,16 @@
+import type { ExecOptions, ExecResult, Executor, FirecrackerSandboxConfig, SandboxAdapter } from "./types.js";
+export declare function parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined;
+export declare function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void>;
+export declare class FirecrackerExecutor implements Executor {
+    private vmId;
+    private hostPath;
+    private sshUser;
+    private sshPort;
+    private env?;
+    constructor(vmId: string, hostPath: string, sshUser?: string, sshPort?: number, env?: Record<string, string> | undefined);
+    exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    getWorkspacePath(_hostPath: string): string;
+    getSandboxConfig(): FirecrackerSandboxConfig;
+}
+export declare const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig>;
+//# sourceMappingURL=firecracker.d.ts.map

package/dist/sandbox/firecracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../src/sandbox/firecracker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,wBAAwB,EACxB,cAAc,EACf,MAAM,YAAY,CAAC;AAKpB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CA8B9F;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6ChG;AAED,qBAAa,mBAAoB,YAAW,QAAQ;IAEhD,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,GAAG,CAAC;IALd,YACU,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAe,EACxB,OAAO,GAAE,MAAW,EACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAClC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqGtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,gBAAgB,IAAI,wBAAwB,CAQ3C;CACF;AAgBD,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,wBAAwB,CAM9E,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  FirecrackerSandboxConfig,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { execSimple, killProcessTree, shellEscape } from \"./utils.js\";\n\nexport function parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined {\n  if (!value.startsWith(\"firecracker:\")) {\n    return undefined;\n  }\n\n  const arg = value.slice(\"firecracker:\".length);\n  // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n  // Example: firecracker:vm1:/home/user/workspace\n  //          firecracker:vm1:/home/user/workspace:root\n  //          firecracker:vm1:/home/user/workspace:root:22\n  const parts = arg.split(\":\");\n  if (parts.length < 2) {\n    throw new SandboxError(\n      \"Error: firecracker sandbox requires vm-id and host-path\\n\" +\n        \"Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\\n\" +\n        \"Example: firecracker:vm1:/home/user/workspace\",\n    );\n  }\n  const vmId = parts[0];\n  const hostPath = parts[1];\n  const sshUser = parts[2] || \"root\";\n  const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;\n\n  if (!vmId || !hostPath) {\n    throw new SandboxError(\"Error: firecracker sandbox requires vm-id and host-path\");\n  }\n  if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {\n    throw new SandboxError(\"Error: invalid SSH port\");\n  }\n  return { type: \"firecracker\", vmId, hostPath, sshUser, sshPort };\n}\n\nexport async function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void> {\n  // Check if fc-agent or firecracker CLI is available\n  try {\n    await execSimple(\"fc-agent\", [\"--version\"]);\n  } catch {\n    // Try alternative: firecracker\n    try {\n      await execSimple(\"firecracker\", [\"--version\"]);\n    } catch {\n      throw new SandboxError(\n        \"Error: Firecracker tools (fc-agent or firecracker) not found in PATH\",\n        [\"Install firecracker: https://github.com/firecracker-microvm/firecracker\"],\n      );\n    }\n  }\n\n  // Check if VM is running using fc-agent\n  try {\n    const result = await execSimple(\"fc-agent\", [\"status\", config.vmId]);\n    if (!result.includes(\"running\") && !result.includes(\"Running\")) {\n      throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [\n        `Start it with: fc-agent start ${config.vmId}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    // Try alternative: firecracker-ctl or direct check\n    try {\n      await execSimple(\"firecracker-ctl\", [\"status\", config.vmId]);\n    } catch {\n      console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);\n      console.error(\"Make sure the VM is started before running mama.\");\n    }\n  }\n\n  // Verify host path exists\n  try {\n    await execSimple(\"ls\", [\"-d\", config.hostPath]);\n  } catch {\n    throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);\n  }\n\n  console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);\n}\n\nexport class FirecrackerExecutor implements Executor {\n  constructor(\n    private vmId: string,\n    private hostPath: string,\n    private sshUser: string = \"root\",\n    private sshPort: number = 22,\n    private env?: Record<string, string>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (!this.env || Object.keys(this.env).length === 0) {\n      const sshCmd =\n        this.sshPort === 22\n          ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`\n          : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;\n      const hostExecutor = new HostExecutor();\n      return hostExecutor.exec(sshCmd, options);\n    }\n\n    return new Promise((resolve, reject) => {\n      const sshArgs = [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"ConnectTimeout=10\"];\n      if (this.sshPort !== 22) {\n        sshArgs.push(\"-p\", String(this.sshPort));\n      }\n      sshArgs.push(`${this.sshUser}@${this.vmId}`, \"sh\", \"-se\");\n\n      const child = spawn(\"ssh\", sshArgs, {\n        detached: true,\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n      let settled = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              if (child.pid) killProcessTree(child.pid);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.on(\"error\", (error) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n        reject(error);\n      });\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stdin?.on(\"error\", (error) => {\n        stderr += `${error.message}\\n`;\n      });\n      child.stdin?.end(buildRemoteScript(command, this.env));\n\n      child.on(\"close\", (code) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getSandboxConfig(): FirecrackerSandboxConfig {\n    return {\n      type: \"firecracker\",\n      vmId: this.vmId,\n      hostPath: this.hostPath,\n      sshUser: this.sshUser,\n      sshPort: this.sshPort,\n    };\n  }\n}\n\nfunction buildRemoteScript(command: string, env?: Record<string, string>): string {\n  const exports = env\n    ? Object.entries(env)\n        .map(([key, value]) => {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n            throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);\n          }\n          return `export ${key}=${shellEscape(value)}`;\n        })\n        .join(\"\\n\") + \"\\n\"\n    : \"\";\n  return `${exports}${command}\\n`;\n}\n\nexport const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig> = {\n  type: \"firecracker\",\n  parse: parseFirecrackerSandboxArg,\n  validate: validateFirecrackerSandbox,\n  createExecutor: (config, env) =>\n    new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),\n};\n"]}

package/dist/sandbox/firecracker.js

@@ -0,0 +1,206 @@
+import { spawn } from "child_process";
+import { SandboxError } from "./errors.js";
+import { HostExecutor } from "./host.js";
+import { execSimple, killProcessTree, shellEscape } from "./utils.js";
+export function parseFirecrackerSandboxArg(value) {
+    if (!value.startsWith("firecracker:")) {
+        return undefined;
+    }
+    const arg = value.slice("firecracker:".length);
+    // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]
+    // Example: firecracker:vm1:/home/user/workspace
+    //          firecracker:vm1:/home/user/workspace:root
+    //          firecracker:vm1:/home/user/workspace:root:22
+    const parts = arg.split(":");
+    if (parts.length < 2) {
+        throw new SandboxError("Error: firecracker sandbox requires vm-id and host-path\n" +
+            "Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n" +
+            "Example: firecracker:vm1:/home/user/workspace");
+    }
+    const vmId = parts[0];
+    const hostPath = parts[1];
+    const sshUser = parts[2] || "root";
+    const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;
+    if (!vmId || !hostPath) {
+        throw new SandboxError("Error: firecracker sandbox requires vm-id and host-path");
+    }
+    if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {
+        throw new SandboxError("Error: invalid SSH port");
+    }
+    return { type: "firecracker", vmId, hostPath, sshUser, sshPort };
+}
+export async function validateFirecrackerSandbox(config) {
+    // Check if fc-agent or firecracker CLI is available
+    try {
+        await execSimple("fc-agent", ["--version"]);
+    }
+    catch {
+        // Try alternative: firecracker
+        try {
+            await execSimple("firecracker", ["--version"]);
+        }
+        catch {
+            throw new SandboxError("Error: Firecracker tools (fc-agent or firecracker) not found in PATH", ["Install firecracker: https://github.com/firecracker-microvm/firecracker"]);
+        }
+    }
+    // Check if VM is running using fc-agent
+    try {
+        const result = await execSimple("fc-agent", ["status", config.vmId]);
+        if (!result.includes("running") && !result.includes("Running")) {
+            throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [
+                `Start it with: fc-agent start ${config.vmId}`,
+            ]);
+        }
+    }
+    catch (error) {
+        if (error instanceof SandboxError) {
+            throw error;
+        }
+        // Try alternative: firecracker-ctl or direct check
+        try {
+            await execSimple("firecracker-ctl", ["status", config.vmId]);
+        }
+        catch {
+            console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);
+            console.error("Make sure the VM is started before running mama.");
+        }
+    }
+    // Verify host path exists
+    try {
+        await execSimple("ls", ["-d", config.hostPath]);
+    }
+    catch {
+        throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);
+    }
+    console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);
+}
+export class FirecrackerExecutor {
+    constructor(vmId, hostPath, sshUser = "root", sshPort = 22, env) {
+        this.vmId = vmId;
+        this.hostPath = hostPath;
+        this.sshUser = sshUser;
+        this.sshPort = sshPort;
+        this.env = env;
+    }
+    async exec(command, options) {
+        if (!this.env || Object.keys(this.env).length === 0) {
+            const sshCmd = this.sshPort === 22
+                ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`
+                : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;
+            const hostExecutor = new HostExecutor();
+            return hostExecutor.exec(sshCmd, options);
+        }
+        return new Promise((resolve, reject) => {
+            const sshArgs = ["-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=10"];
+            if (this.sshPort !== 22) {
+                sshArgs.push("-p", String(this.sshPort));
+            }
+            sshArgs.push(`${this.sshUser}@${this.vmId}`, "sh", "-se");
+            const child = spawn("ssh", sshArgs, {
+                detached: true,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            let stdout = "";
+            let stderr = "";
+            let timedOut = false;
+            let settled = false;
+            const timeoutHandle = options?.timeout && options.timeout > 0
+                ? setTimeout(() => {
+                    timedOut = true;
+                    if (child.pid)
+                        killProcessTree(child.pid);
+                }, options.timeout * 1000)
+                : undefined;
+            const onAbort = () => {
+                if (child.pid)
+                    killProcessTree(child.pid);
+            };
+            if (options?.signal) {
+                if (options.signal.aborted) {
+                    onAbort();
+                }
+                else {
+                    options.signal.addEventListener("abort", onAbort, { once: true });
+                }
+            }
+            child.on("error", (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timeoutHandle)
+                    clearTimeout(timeoutHandle);
+                if (options?.signal) {
+                    options.signal.removeEventListener("abort", onAbort);
+                }
+                reject(error);
+            });
+            child.stdout?.on("data", (data) => {
+                stdout += data.toString();
+                if (stdout.length > 10 * 1024 * 1024) {
+                    stdout = stdout.slice(0, 10 * 1024 * 1024);
+                }
+            });
+            child.stderr?.on("data", (data) => {
+                stderr += data.toString();
+                if (stderr.length > 10 * 1024 * 1024) {
+                    stderr = stderr.slice(0, 10 * 1024 * 1024);
+                }
+            });
+            child.stdin?.on("error", (error) => {
+                stderr += `${error.message}\n`;
+            });
+            child.stdin?.end(buildRemoteScript(command, this.env));
+            child.on("close", (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timeoutHandle)
+                    clearTimeout(timeoutHandle);
+                if (options?.signal) {
+                    options.signal.removeEventListener("abort", onAbort);
+                }
+                if (options?.signal?.aborted) {
+                    reject(new Error(`${stdout}\n${stderr}\nCommand aborted`.trim()));
+                    return;
+                }
+                if (timedOut) {
+                    reject(new Error(`${stdout}\n${stderr}\nCommand timed out after ${options?.timeout} seconds`.trim()));
+                    return;
+                }
+                resolve({ stdout, stderr, code: code ?? 0 });
+            });
+        });
+    }
+    getWorkspacePath(_hostPath) {
+        return "/workspace";
+    }
+    getSandboxConfig() {
+        return {
+            type: "firecracker",
+            vmId: this.vmId,
+            hostPath: this.hostPath,
+            sshUser: this.sshUser,
+            sshPort: this.sshPort,
+        };
+    }
+}
+function buildRemoteScript(command, env) {
+    const exports = env
+        ? Object.entries(env)
+            .map(([key, value]) => {
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+                throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);
+            }
+            return `export ${key}=${shellEscape(value)}`;
+        })
+            .join("\n") + "\n"
+        : "";
+    return `${exports}${command}\n`;
+}
+export const firecrackerSandboxAdapter = {
+    type: "firecracker",
+    parse: parseFirecrackerSandboxArg,
+    validate: validateFirecrackerSandbox,
+    createExecutor: (config, env) => new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),
+};
+//# sourceMappingURL=firecracker.js.map

package/dist/sandbox/firecracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/C,oEAAoE;IACpE,gDAAgD;IAChD,qDAAqD;IACrD,wDAAwD;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CACpB,2DAA2D;YACzD,oEAAoE;YACpE,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,yDAAyD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAgC;IAC/E,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,sEAAsE,EACtE,CAAC,yEAAyE,CAAC,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,YAAY,CAAC,0BAA0B,MAAM,CAAC,IAAI,mBAAmB,EAAE;gBAC/E,iCAAiC,MAAM,CAAC,IAAI,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;YAC9E,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,QAAQ,mBAAmB,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,OAAO,mBAAmB;IAC9B,YACU,IAAY,EACZ,QAAgB,EAChB,OAAO,GAAW,MAAM,EACxB,OAAO,GAAW,EAAE,EACpB,GAA4B;oBAJ5B,IAAI;wBACJ,QAAQ;uBACR,OAAO;uBACP,OAAO;mBACP,GAAG;IACV,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,EAAE;gBACjB,CAAC,CAAC,wDAAwD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE;gBACnH,CAAC,CAAC,2DAA2D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3I,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAE1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;gBAClC,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAEvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,GAA4B;IACtE,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;aAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,YAAY,CAAC,sDAAsD,GAAG,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,UAAU,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACtB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,OAAO,GAAG,OAAO,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAA6C;IACjF,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,0BAA0B;IACjC,QAAQ,EAAE,0BAA0B;IACpC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAC9B,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;CAC7F,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  FirecrackerSandboxConfig,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { execSimple, killProcessTree, shellEscape } from \"./utils.js\";\n\nexport function parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined {\n  if (!value.startsWith(\"firecracker:\")) {\n    return undefined;\n  }\n\n  const arg = value.slice(\"firecracker:\".length);\n  // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n  // Example: firecracker:vm1:/home/user/workspace\n  //          firecracker:vm1:/home/user/workspace:root\n  //          firecracker:vm1:/home/user/workspace:root:22\n  const parts = arg.split(\":\");\n  if (parts.length < 2) {\n    throw new SandboxError(\n      \"Error: firecracker sandbox requires vm-id and host-path\\n\" +\n        \"Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\\n\" +\n        \"Example: firecracker:vm1:/home/user/workspace\",\n    );\n  }\n  const vmId = parts[0];\n  const hostPath = parts[1];\n  const sshUser = parts[2] || \"root\";\n  const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;\n\n  if (!vmId || !hostPath) {\n    throw new SandboxError(\"Error: firecracker sandbox requires vm-id and host-path\");\n  }\n  if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {\n    throw new SandboxError(\"Error: invalid SSH port\");\n  }\n  return { type: \"firecracker\", vmId, hostPath, sshUser, sshPort };\n}\n\nexport async function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void> {\n  // Check if fc-agent or firecracker CLI is available\n  try {\n    await execSimple(\"fc-agent\", [\"--version\"]);\n  } catch {\n    // Try alternative: firecracker\n    try {\n      await execSimple(\"firecracker\", [\"--version\"]);\n    } catch {\n      throw new SandboxError(\n        \"Error: Firecracker tools (fc-agent or firecracker) not found in PATH\",\n        [\"Install firecracker: https://github.com/firecracker-microvm/firecracker\"],\n      );\n    }\n  }\n\n  // Check if VM is running using fc-agent\n  try {\n    const result = await execSimple(\"fc-agent\", [\"status\", config.vmId]);\n    if (!result.includes(\"running\") && !result.includes(\"Running\")) {\n      throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [\n        `Start it with: fc-agent start ${config.vmId}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    // Try alternative: firecracker-ctl or direct check\n    try {\n      await execSimple(\"firecracker-ctl\", [\"status\", config.vmId]);\n    } catch {\n      console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);\n      console.error(\"Make sure the VM is started before running mama.\");\n    }\n  }\n\n  // Verify host path exists\n  try {\n    await execSimple(\"ls\", [\"-d\", config.hostPath]);\n  } catch {\n    throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);\n  }\n\n  console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);\n}\n\nexport class FirecrackerExecutor implements Executor {\n  constructor(\n    private vmId: string,\n    private hostPath: string,\n    private sshUser: string = \"root\",\n    private sshPort: number = 22,\n    private env?: Record<string, string>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (!this.env || Object.keys(this.env).length === 0) {\n      const sshCmd =\n        this.sshPort === 22\n          ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`\n          : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;\n      const hostExecutor = new HostExecutor();\n      return hostExecutor.exec(sshCmd, options);\n    }\n\n    return new Promise((resolve, reject) => {\n      const sshArgs = [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"ConnectTimeout=10\"];\n      if (this.sshPort !== 22) {\n        sshArgs.push(\"-p\", String(this.sshPort));\n      }\n      sshArgs.push(`${this.sshUser}@${this.vmId}`, \"sh\", \"-se\");\n\n      const child = spawn(\"ssh\", sshArgs, {\n        detached: true,\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n      let settled = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              if (child.pid) killProcessTree(child.pid);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.on(\"error\", (error) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n        reject(error);\n      });\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stdin?.on(\"error\", (error) => {\n        stderr += `${error.message}\\n`;\n      });\n      child.stdin?.end(buildRemoteScript(command, this.env));\n\n      child.on(\"close\", (code) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getSandboxConfig(): FirecrackerSandboxConfig {\n    return {\n      type: \"firecracker\",\n      vmId: this.vmId,\n      hostPath: this.hostPath,\n      sshUser: this.sshUser,\n      sshPort: this.sshPort,\n    };\n  }\n}\n\nfunction buildRemoteScript(command: string, env?: Record<string, string>): string {\n  const exports = env\n    ? Object.entries(env)\n        .map(([key, value]) => {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n            throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);\n          }\n          return `export ${key}=${shellEscape(value)}`;\n        })\n        .join(\"\\n\") + \"\\n\"\n    : \"\";\n  return `${exports}${command}\\n`;\n}\n\nexport const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig> = {\n  type: \"firecracker\",\n  parse: parseFirecrackerSandboxArg,\n  validate: validateFirecrackerSandbox,\n  createExecutor: (config, env) =>\n    new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),\n};\n"]}

package/dist/sandbox/host.d.ts

@@ -0,0 +1,12 @@
+import type { ExecOptions, ExecResult, Executor, HostSandboxConfig, SandboxAdapter } from "./types.js";
+export declare function parseHostSandboxArg(value: string): HostSandboxConfig | undefined;
+export declare function validateHostSandbox(_config: HostSandboxConfig): Promise<void>;
+export declare class HostExecutor implements Executor {
+    private env?;
+    constructor(env?: Record<string, string> | undefined);
+    exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    getWorkspacePath(hostPath: string): string;
+    getSandboxConfig(): HostSandboxConfig;
+}
+export declare const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig>;
+//# sourceMappingURL=host.d.ts.map

package/dist/sandbox/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAC;AAGpB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAKhF;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;AAED,qBAAa,YAAa,YAAW,QAAQ;IAC/B,OAAO,CAAC,GAAG,CAAC;IAAxB,YAAoB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAAI;IAE9C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAwEtE;IAED,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED,gBAAgB,IAAI,iBAAiB,CAEpC;CACF;AAED,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,iBAAiB,CAKhE,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { killProcessTree } from \"./utils.js\";\n\nexport function parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport async function validateHostSandbox(_config: HostSandboxConfig): Promise<void> {\n  return;\n}\n\nexport class HostExecutor implements Executor {\n  constructor(private env?: Record<string, string>) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const shell = process.platform === \"win32\" ? \"cmd\" : \"sh\";\n      const shellArgs = process.platform === \"win32\" ? [\"/c\"] : [\"-c\"];\n\n      const child = spawn(shell, [...shellArgs, command], {\n        detached: true,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        ...(this.env && { env: { ...process.env, ...this.env } }),\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  parse: parseHostSandboxArg,\n  validate: validateHostSandbox,\n  createExecutor: (_config, env) => new HostExecutor(env),\n};\n"]}