@geminixiang/mikan 0.3.0 → 0.3.2

package/dist/portal-shell.js

@@ -1,10 +1,5 @@
+import { escapeHtml } from "./html.js";
 import { PRODUCT_NAME } from "./ui-copy.js";
-function escAttr(value) {
-    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-}
-function escHtml(value) {
-    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-}
 const NAV_ICONS = {
     admin: {
         label: "Admin",
@@ -34,20 +29,20 @@ function renderNav(activeView, navLinks) {
         const isActive = view === activeView;
         const href = navLinks[view];
         const baseClass = `view-nav-btn${isActive ? " active" : ""}${!href && !isActive ? " disabled" : ""}`;
-        const attrs = `data-view="${view}" aria-label="${escAttr(meta.label)}" data-tooltip="${escAttr(meta.label)}"`;
+        const attrs = `data-view="${view}" aria-label="${escapeHtml(meta.label)}" data-tooltip="${escapeHtml(meta.label)}"`;
         if (href && !isActive) {
-            return `<a class="${baseClass}" href="${escAttr(href)}" ${attrs}>${meta.svg}</a>`;
+            return `<a class="${baseClass}" href="${escapeHtml(href)}" ${attrs}>${meta.svg}</a>`;
         }
         if (isActive) {
             return `<span class="${baseClass}" aria-current="page" ${attrs}>${meta.svg}</span>`;
         }
-        return `<span class="${baseClass}" aria-disabled="true" ${attrs} data-tooltip="${escAttr(meta.label)} (no token)">${meta.svg}</span>`;
+        return `<span class="${baseClass}" aria-disabled="true" ${attrs} data-tooltip="${escapeHtml(meta.label)} (no token)">${meta.svg}</span>`;
     });
     return `<nav class="floating-view-nav" aria-label="Primary views">${buttons.join("")}</nav>`;
 }
 function renderTopbar(options) {
     const identity = options.identity
-        ? `<span class="topbar-user">${escHtml(options.identity.primary)}${options.identity.secondary ? ` · ${escHtml(options.identity.secondary)}` : ""}</span>`
+        ? `<span class="topbar-user">${escapeHtml(options.identity.primary)}${options.identity.secondary ? ` · ${escapeHtml(options.identity.secondary)}` : ""}</span>`
         : "";
     let switcher = "";
     if (options.conversationSwitcher) {
@@ -57,20 +52,20 @@ function renderTopbar(options) {
                 .map((c) => {
                 const label = `${c.label}${c.running ? " (running)" : ""}`;
                 const selected = c.id === currentId ? " selected" : "";
-                return `<option value="${escAttr(c.id)}"${selected}>${escHtml(label)}</option>`;
+                return `<option value="${escapeHtml(c.id)}"${selected}>${escapeHtml(label)}</option>`;
             })
                 .join("");
             switcher = `<select id="conv-switcher" class="conv-inline-select" aria-label="Switch conversation">${opts}</select>`;
         }
         else {
-            switcher = `<select id="conv-switcher" class="conv-inline-select" aria-label="Switch conversation"><option>${escHtml(currentId)}</option></select>`;
+            switcher = `<select id="conv-switcher" class="conv-inline-select" aria-label="Switch conversation"><option>${escapeHtml(currentId)}</option></select>`;
         }
     }
     return `<header class="topbar">
     <div class="topbar-brand">
       <span class="topbar-wordmark">${PRODUCT_NAME}</span>
       <span class="topbar-sep">·</span>
-      <span class="topbar-title">${escHtml(options.pageTitle)}</span>
+      <span class="topbar-title">${escapeHtml(options.pageTitle)}</span>
     </div>
     <div class="topbar-meta">
       ${identity}
@@ -80,7 +75,7 @@ function renderTopbar(options) {
 }
 export function renderPortalShell(options) {
     const bodyAttrs = Object.entries(options.bodyAttributes ?? {})
-        .map(([key, value]) => `${escAttr(key)}="${escAttr(value)}"`)
+        .map(([key, value]) => `${escapeHtml(key)}="${escapeHtml(value)}"`)
         .join(" ");
     const titleText = `${options.pageTitle} — ${PRODUCT_NAME}`;
     const nav = renderNav(options.activeView, options.navLinks ?? {});
@@ -93,7 +88,7 @@ export function renderPortalShell(options) {
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>${escHtml(titleText)}</title>
+  <title>${escapeHtml(titleText)}</title>
   <style>${portalShellStyles}</style>
   ${extraStyles}
   ${extraHead}
@@ -109,7 +104,7 @@ export function renderPortalShell(options) {
 </html>`;
 }
 // ── Shared stylesheet ──────────────────────────────────────────────────────────
-export const portalShellStyles = `
+const portalShellStyles = `
   @import url('https://fonts.googleapis.com/css2?family=Lora:wght@400;600&family=DM+Sans:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap');
 
   :root {

package/dist/portal-shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"portal-shell.js","sourceRoot":"","sources":["../src/portal-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAsC5C,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,OAAO,CAClB,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,OAAO,CAClB,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAuD;IACpE,KAAK,EAAE;QACL,KAAK,EAAE,OAAO;QACd,GAAG,EAAE;;;WAGE;KACR;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE;;WAEE;KACR;IACD,KAAK,EAAE;QACL,KAAK,EAAE,OAAO;QACd,GAAG,EAAE;;;WAGE;KACR;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,UAAsB,EAAE,QAA6C;IACtF,MAAM,KAAK,GAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,eAAe,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACrG,MAAM,KAAK,GAAG,cAAc,IAAI,iBAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAC9G,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,aAAa,SAAS,WAAW,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,gBAAgB,SAAS,yBAAyB,KAAK,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC;QACtF,CAAC;QACD,OAAO,gBAAgB,SAAS,0BAA0B,KAAK,kBAAkB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,SAAS,CAAC;IACxI,CAAC,CAAC,CAAC;IACH,OAAO,6DAA6D,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;AAC/F,CAAC;AAED,SAAS,YAAY,CAAC,OAA2B;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ;QAC/B,CAAC,CAAC,6BAA6B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS;QACzJ,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzE,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,WAAW;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,kBAAkB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YAClF,CAAC,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,QAAQ,GAAG,0FAA0F,IAAI,WAAW,CAAC;QACvH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,kGAAkG,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC;QACtJ,CAAC;IACH,CAAC;IAED,OAAO;;sCAE6B,YAAY;;mCAEf,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;;;QAGrD,QAAQ;QACR,QAAQ;;YAEJ,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;SAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,SAAS,MAAM,YAAY,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAE1C,OAAO;;;;;WAKE,OAAO,CAAC,SAAS,CAAC;WAClB,iBAAiB;IACxB,WAAW;IACX,SAAS;;OAEN,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;IACnC,GAAG;;MAED,MAAM;MACN,OAAO,CAAC,IAAI;;IAEd,YAAY;;QAER,CAAC;AACT,CAAC;AAED,kFAAkF;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkQhC,CAAC","sourcesContent":["import { PRODUCT_NAME } from \"./ui-copy.js\";\n\n// ── Shared portal shell ────────────────────────────────────────────────────────\n//\n// Three portals (admin / session / vault aka login) share the same chrome:\n// - Fixed left rail with three round icon buttons (admin, session, vault)\n// - Compact topbar (product wordmark + identity + optional conversation switcher)\n// - Main content area\n//\n// Each portal renders its own page-head + body inside <main class=\"shell\">.\n// Sidebar buttons whose target token isn't available are rendered as anchors\n// only when href is provided; otherwise they are buttons in a disabled state.\n\nexport type PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  /** Additional CSS appended after the shared stylesheet. */\n  extraStyles?: string;\n  /** Inline script run after body. */\n  inlineScript?: string;\n  /** Extra <head> markup (e.g., third-party fonts already loaded by shared CSS, so usually empty). */\n  extraHead?: string;\n  /** Body-level data-* attributes (e.g., data-session-running). */\n  bodyAttributes?: Record<string, string>;\n}\n\nfunction escAttr(value: string): string {\n  return value.replace(\n    /[&<>\"']/g,\n    (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n}\n\nfunction escHtml(value: string): string {\n  return value.replace(\n    /[&<>\"']/g,\n    (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n}\n\nconst NAV_ICONS: Record<PortalView, { label: string; svg: string }> = {\n  admin: {\n    label: \"Admin\",\n    svg: `<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <circle cx=\"12\" cy=\"12\" r=\"3\"/>\n      <path d=\"M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09a1.65 1.65 0 0 0-1-1.51 1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09a1.65 1.65 0 0 0 1.51-1 1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33h.01a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82v.01a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z\"/>\n    </svg>`,\n  },\n  session: {\n    label: \"Session\",\n    svg: `<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <path d=\"M21 11.5a8.38 8.38 0 0 1-.9 3.8 8.5 8.5 0 0 1-7.6 4.7 8.38 8.38 0 0 1-3.8-.9L3 21l1.9-5.7a8.38 8.38 0 0 1-.9-3.8 8.5 8.5 0 0 1 4.7-7.6 8.38 8.38 0 0 1 3.8-.9h.5a8.48 8.48 0 0 1 8 8v.5z\"/>\n    </svg>`,\n  },\n  vault: {\n    label: \"Vault\",\n    svg: `<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <rect x=\"3\" y=\"11\" width=\"18\" height=\"11\" rx=\"2\" ry=\"2\"/>\n      <path d=\"M7 11V7a5 5 0 0 1 10 0v4\"/>\n    </svg>`,\n  },\n};\n\nfunction renderNav(activeView: PortalView, navLinks: Partial<Record<PortalView, string>>): string {\n  const views: PortalView[] = [\"admin\", \"session\", \"vault\"];\n  const buttons = views.map((view) => {\n    const meta = NAV_ICONS[view];\n    const isActive = view === activeView;\n    const href = navLinks[view];\n    const baseClass = `view-nav-btn${isActive ? \" active\" : \"\"}${!href && !isActive ? \" disabled\" : \"\"}`;\n    const attrs = `data-view=\"${view}\" aria-label=\"${escAttr(meta.label)}\" data-tooltip=\"${escAttr(meta.label)}\"`;\n    if (href && !isActive) {\n      return `<a class=\"${baseClass}\" href=\"${escAttr(href)}\" ${attrs}>${meta.svg}</a>`;\n    }\n    if (isActive) {\n      return `<span class=\"${baseClass}\" aria-current=\"page\" ${attrs}>${meta.svg}</span>`;\n    }\n    return `<span class=\"${baseClass}\" aria-disabled=\"true\" ${attrs} data-tooltip=\"${escAttr(meta.label)} (no token)\">${meta.svg}</span>`;\n  });\n  return `<nav class=\"floating-view-nav\" aria-label=\"Primary views\">${buttons.join(\"\")}</nav>`;\n}\n\nfunction renderTopbar(options: PortalShellOptions): string {\n  const identity = options.identity\n    ? `<span class=\"topbar-user\">${escHtml(options.identity.primary)}${options.identity.secondary ? ` · ${escHtml(options.identity.secondary)}` : \"\"}</span>`\n    : \"\";\n\n  let switcher = \"\";\n  if (options.conversationSwitcher) {\n    const { currentId, options: convOptions } = options.conversationSwitcher;\n    if (convOptions && convOptions.length > 0) {\n      const opts = convOptions\n        .map((c) => {\n          const label = `${c.label}${c.running ? \" (running)\" : \"\"}`;\n          const selected = c.id === currentId ? \" selected\" : \"\";\n          return `<option value=\"${escAttr(c.id)}\"${selected}>${escHtml(label)}</option>`;\n        })\n        .join(\"\");\n      switcher = `<select id=\"conv-switcher\" class=\"conv-inline-select\" aria-label=\"Switch conversation\">${opts}</select>`;\n    } else {\n      switcher = `<select id=\"conv-switcher\" class=\"conv-inline-select\" aria-label=\"Switch conversation\"><option>${escHtml(currentId)}</option></select>`;\n    }\n  }\n\n  return `<header class=\"topbar\">\n    <div class=\"topbar-brand\">\n      <span class=\"topbar-wordmark\">${PRODUCT_NAME}</span>\n      <span class=\"topbar-sep\">·</span>\n      <span class=\"topbar-title\">${escHtml(options.pageTitle)}</span>\n    </div>\n    <div class=\"topbar-meta\">\n      ${identity}\n      ${switcher}\n    </div>\n  </header>`;\n}\n\nexport function renderPortalShell(options: PortalShellOptions): string {\n  const bodyAttrs = Object.entries(options.bodyAttributes ?? {})\n    .map(([key, value]) => `${escAttr(key)}=\"${escAttr(value)}\"`)\n    .join(\" \");\n  const titleText = `${options.pageTitle} — ${PRODUCT_NAME}`;\n  const nav = renderNav(options.activeView, options.navLinks ?? {});\n  const topbar = renderTopbar(options);\n  const extraStyles = options.extraStyles ? `<style>${options.extraStyles}</style>` : \"\";\n  const inlineScript = options.inlineScript ? `<script>${options.inlineScript}</script>` : \"\";\n  const extraHead = options.extraHead ?? \"\";\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>${escHtml(titleText)}</title>\n  <style>${portalShellStyles}</style>\n  ${extraStyles}\n  ${extraHead}\n</head>\n<body${bodyAttrs ? ` ${bodyAttrs}` : \"\"}>\n  ${nav}\n  <main class=\"shell\">\n    ${topbar}\n    ${options.body}\n  </main>\n  ${inlineScript}\n</body>\n</html>`;\n}\n\n// ── Shared stylesheet ──────────────────────────────────────────────────────────\n\nexport const portalShellStyles = `\n  @import url('https://fonts.googleapis.com/css2?family=Lora:wght@400;600&family=DM+Sans:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap');\n\n  :root {\n    --bg: #f0ece3;\n    --surface: #ffffff;\n    --border: rgba(0, 0, 0, 0.08);\n    --text: #18181b;\n    --muted: #71717a;\n    --subtle: #a1a1aa;\n    --accent: #d97706;\n\n    --ok-bg: #f0fdf4;\n    --ok-text: #15803d;\n    --ok-border: rgba(21, 128, 61, 0.16);\n    --warn-bg: #fffbeb;\n    --warn-text: #92400e;\n    --err-bg: #fef2f2;\n    --err-text: #b91c1c;\n    --err-border: rgba(185, 28, 28, 0.14);\n  }\n\n  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n\n  body {\n    min-height: 100vh;\n    padding: 28px 24px 60px;\n    display: flex;\n    flex-direction: column;\n    align-items: center;\n    background-color: var(--bg);\n    background-image: radial-gradient(ellipse 80% 40% at 50% -10%, rgba(255,255,255,0.65) 0%, transparent 70%);\n    color: var(--text);\n    font-family: 'DM Sans', 'Segoe UI', system-ui, sans-serif;\n    font-size: 15px;\n    line-height: 1.5;\n    -webkit-font-smoothing: antialiased;\n  }\n\n  .shell {\n    width: 100%;\n    max-width: 960px;\n    margin-left: 72px;\n    display: flex;\n    flex-direction: column;\n    gap: 18px;\n  }\n\n  /* ── Topbar ─────────────────────────────────────────────────────────── */\n\n  .topbar {\n    display: flex; align-items: center; justify-content: space-between;\n    gap: 16px; padding: 10px 18px;\n    border: 1px solid var(--border); border-radius: 14px;\n    background: rgba(255,255,255,0.7); backdrop-filter: blur(8px);\n  }\n  .topbar-brand { display: flex; align-items: baseline; gap: 8px; min-width: 0; }\n  .topbar-wordmark {\n    font-family: 'Lora', Georgia, serif; font-size: 1.05rem; font-weight: 600;\n    color: var(--text); letter-spacing: -0.01em;\n  }\n  .topbar-sep { color: var(--subtle); font-size: 0.9rem; }\n  .topbar-title { font-size: 0.86rem; color: var(--muted); font-weight: 500; }\n  .topbar-meta {\n    display: flex; align-items: center; gap: 12px; min-width: 0; flex-wrap: wrap;\n    justify-content: flex-end;\n  }\n  .topbar-user {\n    font-size: 0.8rem; color: var(--muted);\n    padding: 4px 10px; border-radius: 999px; background: rgba(0,0,0,0.04);\n    white-space: nowrap;\n  }\n  .conv-inline-select {\n    max-width: min(360px, 100%);\n    padding: 6px 10px; border: 1px solid var(--border); border-radius: 10px;\n    background: #fff; font-family: 'JetBrains Mono', ui-monospace, monospace; font-size: 0.76rem;\n    color: var(--text); cursor: pointer;\n    transition: border-color 120ms;\n  }\n  .conv-inline-select:hover { border-color: rgba(0,0,0,0.18); }\n  .conv-inline-select:focus-visible { outline: 2px solid var(--text); outline-offset: 1px; }\n\n  /* ── Floating icon nav ──────────────────────────────────────────────── */\n\n  .floating-view-nav {\n    position: fixed;\n    left: 20px;\n    top: 50%;\n    transform: translateY(-50%);\n    z-index: 20;\n    display: flex;\n    flex-direction: column;\n    gap: 4px;\n    padding: 6px;\n    border: 1px solid var(--border);\n    border-radius: 999px;\n    background: rgba(255,255,255,0.88);\n    box-shadow: 0 10px 32px rgba(0,0,0,0.10), 0 2px 6px rgba(0,0,0,0.04);\n    backdrop-filter: blur(14px);\n  }\n  .view-nav-btn {\n    position: relative;\n    display: flex; align-items: center; justify-content: center;\n    width: 40px; height: 40px;\n    border: none; border-radius: 999px; background: transparent;\n    color: var(--muted); cursor: pointer;\n    text-decoration: none;\n    transition: background 160ms, color 160ms, transform 160ms;\n  }\n  .view-nav-btn:hover { background: rgba(0,0,0,0.05); color: var(--text); }\n  .view-nav-btn:active { transform: scale(0.94); }\n  .view-nav-btn.active {\n    background: var(--text); color: #fff;\n    box-shadow: 0 2px 8px rgba(0,0,0,0.18);\n    cursor: default;\n  }\n  .view-nav-btn.disabled {\n    opacity: 0.4; cursor: not-allowed;\n  }\n  .view-nav-btn.disabled:hover { background: transparent; color: var(--muted); }\n  .view-nav-btn svg { display: block; }\n\n  /* Tooltip */\n  .view-nav-btn::after {\n    content: attr(data-tooltip);\n    position: absolute;\n    left: calc(100% + 12px);\n    top: 50%;\n    transform: translateY(-50%) translateX(-4px);\n    padding: 5px 10px;\n    border-radius: 8px;\n    background: var(--text);\n    color: #fff;\n    font: 500 0.76rem/1 'DM Sans', sans-serif;\n    white-space: nowrap;\n    opacity: 0;\n    pointer-events: none;\n    transition: opacity 140ms, transform 140ms;\n    box-shadow: 0 4px 12px rgba(0,0,0,0.16);\n  }\n  .view-nav-btn::before {\n    content: '';\n    position: absolute;\n    left: calc(100% + 6px);\n    top: 50%;\n    transform: translateY(-50%);\n    border: 5px solid transparent;\n    border-right-color: var(--text);\n    opacity: 0;\n    pointer-events: none;\n    transition: opacity 140ms;\n  }\n  .view-nav-btn:hover::after,\n  .view-nav-btn:focus-visible::after {\n    opacity: 1;\n    transform: translateY(-50%) translateX(0);\n  }\n  .view-nav-btn:hover::before,\n  .view-nav-btn:focus-visible::before {\n    opacity: 1;\n  }\n\n  /* ── Generic page-head ───────────────────────────────────────────────── */\n\n  .page-head {\n    display: flex; justify-content: space-between; align-items: flex-start; gap: 14px;\n    padding: 2px 4px;\n  }\n  .page-title {\n    font-family: 'Lora', Georgia, serif;\n    font-size: clamp(1.35rem, 2.4vw, 1.6rem);\n    font-weight: 600; line-height: 1.2; letter-spacing: -0.01em;\n  }\n  .page-desc { color: var(--muted); font-size: 0.9rem; margin-top: 4px; }\n  .eyebrow {\n    color: var(--subtle); font-size: 0.72rem; font-weight: 600;\n    letter-spacing: 0.12em; text-transform: uppercase; margin-bottom: 6px;\n  }\n\n  /* ── Cards ──────────────────────────────────────────────────────────── */\n\n  .card {\n    padding: 24px 28px;\n    border: 1px solid var(--border);\n    border-radius: 20px;\n    background: var(--surface);\n    box-shadow: 0 1px 2px rgba(0,0,0,0.04), 0 4px 16px rgba(0,0,0,0.06);\n  }\n  .card-title {\n    font-family: 'Lora', Georgia, serif;\n    font-size: clamp(1.1rem, 2vw, 1.3rem);\n    font-weight: 600; line-height: 1.25; letter-spacing: -0.01em;\n    margin-bottom: 10px;\n  }\n  .card-subtitle { font-size: 1rem; font-weight: 650; margin-bottom: 10px; line-height: 1.3; }\n\n  code {\n    font-family: 'JetBrains Mono', ui-monospace, monospace;\n    font-size: 0.82em; padding: 0.14em 0.36em;\n    border-radius: 6px; background: rgba(0,0,0,0.05); color: var(--text);\n  }\n\n  button:focus-visible { outline: 2px solid var(--text); outline-offset: 2px; }\n\n  .primary-action-btn {\n    padding: 9px 16px;\n    border: none; border-radius: 10px;\n    background: var(--text); color: #fff;\n    font: 500 0.86rem/1.2 'DM Sans', sans-serif;\n    cursor: pointer;\n    transition: opacity 120ms;\n  }\n  .primary-action-btn:hover:not(:disabled) { opacity: 0.85; }\n  .primary-action-btn:disabled { opacity: 0.5; cursor: wait; }\n\n  .loading-msg { color: var(--muted); font-size: 0.9rem; padding: 8px 0; }\n  .err-msg {\n    padding: 12px 16px; border-radius: 10px;\n    background: var(--err-bg); color: var(--err-text);\n    border: 1px solid var(--err-border); font-size: 0.88rem;\n  }\n  .empty-state {\n    padding: 18px 8px; text-align: center; color: var(--muted);\n    font-size: 0.88rem;\n  }\n  .inline-result {\n    padding: 8px 12px; border-radius: 8px; font-size: 0.82rem; margin-top: 4px;\n  }\n  .inline-result.ok { background: var(--ok-bg); color: var(--ok-text); border: 1px solid var(--ok-border); }\n  .inline-result.err { background: var(--err-bg); color: var(--err-text); border: 1px solid var(--err-border); }\n\n  @media (max-width: 900px) {\n    .shell { margin-left: 0; }\n    .floating-view-nav {\n      left: 50%; right: auto; top: auto; bottom: 18px;\n      transform: translateX(-50%); flex-direction: row;\n    }\n    .view-nav-btn::after {\n      left: 50%; top: auto; bottom: calc(100% + 10px);\n      transform: translateX(-50%) translateY(4px);\n    }\n    .view-nav-btn::before {\n      left: 50%; top: auto; bottom: calc(100% + 4px);\n      transform: translateX(-50%);\n      border-right-color: transparent;\n      border-top-color: var(--text);\n    }\n    .view-nav-btn:hover::after,\n    .view-nav-btn:focus-visible::after { transform: translateX(-50%) translateY(0); }\n  }\n\n  @media (max-width: 640px) {\n    body { padding: 16px 12px 96px; }\n    .topbar { padding: 10px 14px; border-radius: 12px; }\n    .topbar-meta { gap: 8px; }\n    .page-head { padding-inline: 2px; }\n    .card { padding: 18px; border-radius: 16px; }\n  }\n`;\n"]}
+{"version":3,"file":"portal-shell.js","sourceRoot":"","sources":["../src/portal-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAsC5C,MAAM,SAAS,GAAuD;IACpE,KAAK,EAAE;QACL,KAAK,EAAE,OAAO;QACd,GAAG,EAAE;;;WAGE;KACR;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE;;WAEE;KACR;IACD,KAAK,EAAE;QACL,KAAK,EAAE,OAAO;QACd,GAAG,EAAE;;;WAGE;KACR;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,UAAsB,EAAE,QAA6C;IACtF,MAAM,KAAK,GAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,eAAe,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACrG,MAAM,KAAK,GAAG,cAAc,IAAI,iBAAiB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACpH,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,aAAa,SAAS,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC;QACvF,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,gBAAgB,SAAS,yBAAyB,KAAK,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC;QACtF,CAAC;QACD,OAAO,gBAAgB,SAAS,0BAA0B,KAAK,kBAAkB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3I,CAAC,CAAC,CAAC;IACH,OAAO,6DAA6D,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;AAC/F,CAAC;AAED,SAAS,YAAY,CAAC,OAA2B;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ;QAC/B,CAAC,CAAC,6BAA6B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS;QAC/J,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzE,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,WAAW;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,kBAAkB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;YACxF,CAAC,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,QAAQ,GAAG,0FAA0F,IAAI,WAAW,CAAC;QACvH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,kGAAkG,UAAU,CAAC,SAAS,CAAC,oBAAoB,CAAC;QACzJ,CAAC;IACH,CAAC;IAED,OAAO;;sCAE6B,YAAY;;mCAEf,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;;;QAGxD,QAAQ;QACR,QAAQ;;YAEJ,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,SAAS,MAAM,YAAY,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAE1C,OAAO;;;;;WAKE,UAAU,CAAC,SAAS,CAAC;WACrB,iBAAiB;IACxB,WAAW;IACX,SAAS;;OAEN,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;IACnC,GAAG;;MAED,MAAM;MACN,OAAO,CAAC,IAAI;;IAEd,YAAY;;QAER,CAAC;AACT,CAAC;AAED,kFAAkF;AAElF,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkQzB,CAAC","sourcesContent":["import { escapeHtml } from \"./html.js\";\nimport { PRODUCT_NAME } from \"./ui-copy.js\";\n\n// ── Shared portal shell ────────────────────────────────────────────────────────\n//\n// Three portals (admin / session / vault aka login) share the same chrome:\n// - Fixed left rail with three round icon buttons (admin, session, vault)\n// - Compact topbar (product wordmark + identity + optional conversation switcher)\n// - Main content area\n//\n// Each portal renders its own page-head + body inside <main class=\"shell\">.\n// Sidebar buttons whose target token isn't available are rendered as anchors\n// only when href is provided; otherwise they are buttons in a disabled state.\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  /** Additional CSS appended after the shared stylesheet. */\n  extraStyles?: string;\n  /** Inline script run after body. */\n  inlineScript?: string;\n  /** Extra <head> markup (e.g., third-party fonts already loaded by shared CSS, so usually empty). */\n  extraHead?: string;\n  /** Body-level data-* attributes (e.g., data-session-running). */\n  bodyAttributes?: Record<string, string>;\n}\n\nconst NAV_ICONS: Record<PortalView, { label: string; svg: string }> = {\n  admin: {\n    label: \"Admin\",\n    svg: `<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <circle cx=\"12\" cy=\"12\" r=\"3\"/>\n      <path d=\"M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09a1.65 1.65 0 0 0-1-1.51 1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09a1.65 1.65 0 0 0 1.51-1 1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33h.01a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82v.01a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z\"/>\n    </svg>`,\n  },\n  session: {\n    label: \"Session\",\n    svg: `<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <path d=\"M21 11.5a8.38 8.38 0 0 1-.9 3.8 8.5 8.5 0 0 1-7.6 4.7 8.38 8.38 0 0 1-3.8-.9L3 21l1.9-5.7a8.38 8.38 0 0 1-.9-3.8 8.5 8.5 0 0 1 4.7-7.6 8.38 8.38 0 0 1 3.8-.9h.5a8.48 8.48 0 0 1 8 8v.5z\"/>\n    </svg>`,\n  },\n  vault: {\n    label: \"Vault\",\n    svg: `<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <rect x=\"3\" y=\"11\" width=\"18\" height=\"11\" rx=\"2\" ry=\"2\"/>\n      <path d=\"M7 11V7a5 5 0 0 1 10 0v4\"/>\n    </svg>`,\n  },\n};\n\nfunction renderNav(activeView: PortalView, navLinks: Partial<Record<PortalView, string>>): string {\n  const views: PortalView[] = [\"admin\", \"session\", \"vault\"];\n  const buttons = views.map((view) => {\n    const meta = NAV_ICONS[view];\n    const isActive = view === activeView;\n    const href = navLinks[view];\n    const baseClass = `view-nav-btn${isActive ? \" active\" : \"\"}${!href && !isActive ? \" disabled\" : \"\"}`;\n    const attrs = `data-view=\"${view}\" aria-label=\"${escapeHtml(meta.label)}\" data-tooltip=\"${escapeHtml(meta.label)}\"`;\n    if (href && !isActive) {\n      return `<a class=\"${baseClass}\" href=\"${escapeHtml(href)}\" ${attrs}>${meta.svg}</a>`;\n    }\n    if (isActive) {\n      return `<span class=\"${baseClass}\" aria-current=\"page\" ${attrs}>${meta.svg}</span>`;\n    }\n    return `<span class=\"${baseClass}\" aria-disabled=\"true\" ${attrs} data-tooltip=\"${escapeHtml(meta.label)} (no token)\">${meta.svg}</span>`;\n  });\n  return `<nav class=\"floating-view-nav\" aria-label=\"Primary views\">${buttons.join(\"\")}</nav>`;\n}\n\nfunction renderTopbar(options: PortalShellOptions): string {\n  const identity = options.identity\n    ? `<span class=\"topbar-user\">${escapeHtml(options.identity.primary)}${options.identity.secondary ? ` · ${escapeHtml(options.identity.secondary)}` : \"\"}</span>`\n    : \"\";\n\n  let switcher = \"\";\n  if (options.conversationSwitcher) {\n    const { currentId, options: convOptions } = options.conversationSwitcher;\n    if (convOptions && convOptions.length > 0) {\n      const opts = convOptions\n        .map((c) => {\n          const label = `${c.label}${c.running ? \" (running)\" : \"\"}`;\n          const selected = c.id === currentId ? \" selected\" : \"\";\n          return `<option value=\"${escapeHtml(c.id)}\"${selected}>${escapeHtml(label)}</option>`;\n        })\n        .join(\"\");\n      switcher = `<select id=\"conv-switcher\" class=\"conv-inline-select\" aria-label=\"Switch conversation\">${opts}</select>`;\n    } else {\n      switcher = `<select id=\"conv-switcher\" class=\"conv-inline-select\" aria-label=\"Switch conversation\"><option>${escapeHtml(currentId)}</option></select>`;\n    }\n  }\n\n  return `<header class=\"topbar\">\n    <div class=\"topbar-brand\">\n      <span class=\"topbar-wordmark\">${PRODUCT_NAME}</span>\n      <span class=\"topbar-sep\">·</span>\n      <span class=\"topbar-title\">${escapeHtml(options.pageTitle)}</span>\n    </div>\n    <div class=\"topbar-meta\">\n      ${identity}\n      ${switcher}\n    </div>\n  </header>`;\n}\n\nexport function renderPortalShell(options: PortalShellOptions): string {\n  const bodyAttrs = Object.entries(options.bodyAttributes ?? {})\n    .map(([key, value]) => `${escapeHtml(key)}=\"${escapeHtml(value)}\"`)\n    .join(\" \");\n  const titleText = `${options.pageTitle} — ${PRODUCT_NAME}`;\n  const nav = renderNav(options.activeView, options.navLinks ?? {});\n  const topbar = renderTopbar(options);\n  const extraStyles = options.extraStyles ? `<style>${options.extraStyles}</style>` : \"\";\n  const inlineScript = options.inlineScript ? `<script>${options.inlineScript}</script>` : \"\";\n  const extraHead = options.extraHead ?? \"\";\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>${escapeHtml(titleText)}</title>\n  <style>${portalShellStyles}</style>\n  ${extraStyles}\n  ${extraHead}\n</head>\n<body${bodyAttrs ? ` ${bodyAttrs}` : \"\"}>\n  ${nav}\n  <main class=\"shell\">\n    ${topbar}\n    ${options.body}\n  </main>\n  ${inlineScript}\n</body>\n</html>`;\n}\n\n// ── Shared stylesheet ──────────────────────────────────────────────────────────\n\nconst portalShellStyles = `\n  @import url('https://fonts.googleapis.com/css2?family=Lora:wght@400;600&family=DM+Sans:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap');\n\n  :root {\n    --bg: #f0ece3;\n    --surface: #ffffff;\n    --border: rgba(0, 0, 0, 0.08);\n    --text: #18181b;\n    --muted: #71717a;\n    --subtle: #a1a1aa;\n    --accent: #d97706;\n\n    --ok-bg: #f0fdf4;\n    --ok-text: #15803d;\n    --ok-border: rgba(21, 128, 61, 0.16);\n    --warn-bg: #fffbeb;\n    --warn-text: #92400e;\n    --err-bg: #fef2f2;\n    --err-text: #b91c1c;\n    --err-border: rgba(185, 28, 28, 0.14);\n  }\n\n  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n\n  body {\n    min-height: 100vh;\n    padding: 28px 24px 60px;\n    display: flex;\n    flex-direction: column;\n    align-items: center;\n    background-color: var(--bg);\n    background-image: radial-gradient(ellipse 80% 40% at 50% -10%, rgba(255,255,255,0.65) 0%, transparent 70%);\n    color: var(--text);\n    font-family: 'DM Sans', 'Segoe UI', system-ui, sans-serif;\n    font-size: 15px;\n    line-height: 1.5;\n    -webkit-font-smoothing: antialiased;\n  }\n\n  .shell {\n    width: 100%;\n    max-width: 960px;\n    margin-left: 72px;\n    display: flex;\n    flex-direction: column;\n    gap: 18px;\n  }\n\n  /* ── Topbar ─────────────────────────────────────────────────────────── */\n\n  .topbar {\n    display: flex; align-items: center; justify-content: space-between;\n    gap: 16px; padding: 10px 18px;\n    border: 1px solid var(--border); border-radius: 14px;\n    background: rgba(255,255,255,0.7); backdrop-filter: blur(8px);\n  }\n  .topbar-brand { display: flex; align-items: baseline; gap: 8px; min-width: 0; }\n  .topbar-wordmark {\n    font-family: 'Lora', Georgia, serif; font-size: 1.05rem; font-weight: 600;\n    color: var(--text); letter-spacing: -0.01em;\n  }\n  .topbar-sep { color: var(--subtle); font-size: 0.9rem; }\n  .topbar-title { font-size: 0.86rem; color: var(--muted); font-weight: 500; }\n  .topbar-meta {\n    display: flex; align-items: center; gap: 12px; min-width: 0; flex-wrap: wrap;\n    justify-content: flex-end;\n  }\n  .topbar-user {\n    font-size: 0.8rem; color: var(--muted);\n    padding: 4px 10px; border-radius: 999px; background: rgba(0,0,0,0.04);\n    white-space: nowrap;\n  }\n  .conv-inline-select {\n    max-width: min(360px, 100%);\n    padding: 6px 10px; border: 1px solid var(--border); border-radius: 10px;\n    background: #fff; font-family: 'JetBrains Mono', ui-monospace, monospace; font-size: 0.76rem;\n    color: var(--text); cursor: pointer;\n    transition: border-color 120ms;\n  }\n  .conv-inline-select:hover { border-color: rgba(0,0,0,0.18); }\n  .conv-inline-select:focus-visible { outline: 2px solid var(--text); outline-offset: 1px; }\n\n  /* ── Floating icon nav ──────────────────────────────────────────────── */\n\n  .floating-view-nav {\n    position: fixed;\n    left: 20px;\n    top: 50%;\n    transform: translateY(-50%);\n    z-index: 20;\n    display: flex;\n    flex-direction: column;\n    gap: 4px;\n    padding: 6px;\n    border: 1px solid var(--border);\n    border-radius: 999px;\n    background: rgba(255,255,255,0.88);\n    box-shadow: 0 10px 32px rgba(0,0,0,0.10), 0 2px 6px rgba(0,0,0,0.04);\n    backdrop-filter: blur(14px);\n  }\n  .view-nav-btn {\n    position: relative;\n    display: flex; align-items: center; justify-content: center;\n    width: 40px; height: 40px;\n    border: none; border-radius: 999px; background: transparent;\n    color: var(--muted); cursor: pointer;\n    text-decoration: none;\n    transition: background 160ms, color 160ms, transform 160ms;\n  }\n  .view-nav-btn:hover { background: rgba(0,0,0,0.05); color: var(--text); }\n  .view-nav-btn:active { transform: scale(0.94); }\n  .view-nav-btn.active {\n    background: var(--text); color: #fff;\n    box-shadow: 0 2px 8px rgba(0,0,0,0.18);\n    cursor: default;\n  }\n  .view-nav-btn.disabled {\n    opacity: 0.4; cursor: not-allowed;\n  }\n  .view-nav-btn.disabled:hover { background: transparent; color: var(--muted); }\n  .view-nav-btn svg { display: block; }\n\n  /* Tooltip */\n  .view-nav-btn::after {\n    content: attr(data-tooltip);\n    position: absolute;\n    left: calc(100% + 12px);\n    top: 50%;\n    transform: translateY(-50%) translateX(-4px);\n    padding: 5px 10px;\n    border-radius: 8px;\n    background: var(--text);\n    color: #fff;\n    font: 500 0.76rem/1 'DM Sans', sans-serif;\n    white-space: nowrap;\n    opacity: 0;\n    pointer-events: none;\n    transition: opacity 140ms, transform 140ms;\n    box-shadow: 0 4px 12px rgba(0,0,0,0.16);\n  }\n  .view-nav-btn::before {\n    content: '';\n    position: absolute;\n    left: calc(100% + 6px);\n    top: 50%;\n    transform: translateY(-50%);\n    border: 5px solid transparent;\n    border-right-color: var(--text);\n    opacity: 0;\n    pointer-events: none;\n    transition: opacity 140ms;\n  }\n  .view-nav-btn:hover::after,\n  .view-nav-btn:focus-visible::after {\n    opacity: 1;\n    transform: translateY(-50%) translateX(0);\n  }\n  .view-nav-btn:hover::before,\n  .view-nav-btn:focus-visible::before {\n    opacity: 1;\n  }\n\n  /* ── Generic page-head ───────────────────────────────────────────────── */\n\n  .page-head {\n    display: flex; justify-content: space-between; align-items: flex-start; gap: 14px;\n    padding: 2px 4px;\n  }\n  .page-title {\n    font-family: 'Lora', Georgia, serif;\n    font-size: clamp(1.35rem, 2.4vw, 1.6rem);\n    font-weight: 600; line-height: 1.2; letter-spacing: -0.01em;\n  }\n  .page-desc { color: var(--muted); font-size: 0.9rem; margin-top: 4px; }\n  .eyebrow {\n    color: var(--subtle); font-size: 0.72rem; font-weight: 600;\n    letter-spacing: 0.12em; text-transform: uppercase; margin-bottom: 6px;\n  }\n\n  /* ── Cards ──────────────────────────────────────────────────────────── */\n\n  .card {\n    padding: 24px 28px;\n    border: 1px solid var(--border);\n    border-radius: 20px;\n    background: var(--surface);\n    box-shadow: 0 1px 2px rgba(0,0,0,0.04), 0 4px 16px rgba(0,0,0,0.06);\n  }\n  .card-title {\n    font-family: 'Lora', Georgia, serif;\n    font-size: clamp(1.1rem, 2vw, 1.3rem);\n    font-weight: 600; line-height: 1.25; letter-spacing: -0.01em;\n    margin-bottom: 10px;\n  }\n  .card-subtitle { font-size: 1rem; font-weight: 650; margin-bottom: 10px; line-height: 1.3; }\n\n  code {\n    font-family: 'JetBrains Mono', ui-monospace, monospace;\n    font-size: 0.82em; padding: 0.14em 0.36em;\n    border-radius: 6px; background: rgba(0,0,0,0.05); color: var(--text);\n  }\n\n  button:focus-visible { outline: 2px solid var(--text); outline-offset: 2px; }\n\n  .primary-action-btn {\n    padding: 9px 16px;\n    border: none; border-radius: 10px;\n    background: var(--text); color: #fff;\n    font: 500 0.86rem/1.2 'DM Sans', sans-serif;\n    cursor: pointer;\n    transition: opacity 120ms;\n  }\n  .primary-action-btn:hover:not(:disabled) { opacity: 0.85; }\n  .primary-action-btn:disabled { opacity: 0.5; cursor: wait; }\n\n  .loading-msg { color: var(--muted); font-size: 0.9rem; padding: 8px 0; }\n  .err-msg {\n    padding: 12px 16px; border-radius: 10px;\n    background: var(--err-bg); color: var(--err-text);\n    border: 1px solid var(--err-border); font-size: 0.88rem;\n  }\n  .empty-state {\n    padding: 18px 8px; text-align: center; color: var(--muted);\n    font-size: 0.88rem;\n  }\n  .inline-result {\n    padding: 8px 12px; border-radius: 8px; font-size: 0.82rem; margin-top: 4px;\n  }\n  .inline-result.ok { background: var(--ok-bg); color: var(--ok-text); border: 1px solid var(--ok-border); }\n  .inline-result.err { background: var(--err-bg); color: var(--err-text); border: 1px solid var(--err-border); }\n\n  @media (max-width: 900px) {\n    .shell { margin-left: 0; }\n    .floating-view-nav {\n      left: 50%; right: auto; top: auto; bottom: 18px;\n      transform: translateX(-50%); flex-direction: row;\n    }\n    .view-nav-btn::after {\n      left: 50%; top: auto; bottom: calc(100% + 10px);\n      transform: translateX(-50%) translateY(4px);\n    }\n    .view-nav-btn::before {\n      left: 50%; top: auto; bottom: calc(100% + 4px);\n      transform: translateX(-50%);\n      border-right-color: transparent;\n      border-top-color: var(--text);\n    }\n    .view-nav-btn:hover::after,\n    .view-nav-btn:focus-visible::after { transform: translateX(-50%) translateY(0); }\n  }\n\n  @media (max-width: 640px) {\n    body { padding: 16px 12px 96px; }\n    .topbar { padding: 10px 14px; border-radius: 12px; }\n    .topbar-meta { gap: 8px; }\n    .page-head { padding-inline: 2px; }\n    .card { padding: 18px; border-radius: 16px; }\n  }\n`;\n"]}

package/dist/sandbox/cloudflare.d.ts

@@ -1,6 +1,4 @@
 import type { CloudflareSandboxConfig, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter } from "./types.js";
-export declare function parseCloudflareSandboxArg(value: string): CloudflareSandboxConfig | undefined;
-export declare function validateCloudflareSandbox(_config: CloudflareSandboxConfig): Promise<void>;
 export declare class CloudflareSandboxExecutor implements Executor {
     private readonly sandboxId;
     private readonly env?;

package/dist/sandbox/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/sandbox/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AAqBpB,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAa5F;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/F;AAED,qBAAa,yBAA0B,YAAW,QAAQ;IAItD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IAJvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YACmB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC7C,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAGnC;IAEK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiEtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAK5D;IAED,gBAAgB,IAAI,uBAAuB,CAE1C;CACF;AAED,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,uBAAuB,CAM5E,CAAC","sourcesContent":["import type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { readEnv } from \"../env.js\";\nimport { SandboxError } from \"./errors.js\";\n\nconst DEFAULT_CLOUDFLARE_CWD = \"/workspace\";\n\ninterface CloudflareExecPayload {\n  sandboxId: string;\n  command: string;\n  timeoutSeconds?: number;\n  cwd?: string;\n  env?: Record<string, string>;\n}\n\ninterface CloudflareExecResponse {\n  stdout?: string;\n  stderr?: string;\n  code?: number;\n  error?: string;\n}\n\nexport function parseCloudflareSandboxArg(value: string): CloudflareSandboxConfig | undefined {\n  if (!value.startsWith(\"cloudflare:\")) {\n    return undefined;\n  }\n\n  const sandboxId = value.slice(\"cloudflare:\".length).trim();\n  if (!sandboxId) {\n    throw new SandboxError(\n      \"Error: cloudflare sandbox requires sandbox id (e.g., cloudflare:slack-u123)\",\n    );\n  }\n\n  return { type: \"cloudflare\", sandboxId };\n}\n\nexport async function validateCloudflareSandbox(_config: CloudflareSandboxConfig): Promise<void> {\n  const url = resolveCloudflareSandboxUrl();\n  try {\n    const response = await fetch(new URL(\"/health\", url), {\n      headers: buildCloudflareHeaders(),\n    });\n    if (!response.ok) {\n      throw new SandboxError(\n        `Error: Cloudflare sandbox bridge health check failed with HTTP ${response.status}`,\n      );\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: Cloudflare sandbox bridge is not reachable: ${detail}`);\n  }\n\n  console.log(\n    `  Cloudflare sandbox bridge enabled. Base URL: ${url.toString().replace(/\\/$/, \"\")}`,\n  );\n}\n\nexport class CloudflareSandboxExecutor implements Executor {\n  private readonly cwd: string;\n\n  constructor(\n    private readonly sandboxId: string,\n    private readonly env?: Record<string, string>,\n    _ensureReady?: () => Promise<void>,\n  ) {\n    this.cwd = readEnv(\"CLOUDFLARE_SANDBOX_CWD\") || DEFAULT_CLOUDFLARE_CWD;\n  }\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    const controller = new AbortController();\n    const timeoutHandle =\n      options?.timeout && options.timeout > 0\n        ? setTimeout(() => controller.abort(), options.timeout * 1000)\n        : undefined;\n\n    const onAbort = () => controller.abort();\n    if (options?.signal) {\n      if (options.signal.aborted) {\n        controller.abort();\n      } else {\n        options.signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n    }\n\n    try {\n      const payload: CloudflareExecPayload = {\n        sandboxId: this.sandboxId,\n        command,\n        cwd: this.cwd,\n      };\n      if (options?.timeout) payload.timeoutSeconds = options.timeout;\n      if (this.env && Object.keys(this.env).length > 0) payload.env = this.env;\n\n      const response = await fetch(new URL(\"/exec\", resolveCloudflareSandboxUrl()), {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          ...buildCloudflareHeaders(),\n        },\n        body: JSON.stringify(payload),\n        signal: controller.signal,\n      });\n\n      const raw = (await response.text()).trim();\n      const parsed = raw ? (JSON.parse(raw) as CloudflareExecResponse) : {};\n\n      if (!response.ok) {\n        throw new Error(\n          parsed.error ||\n            parsed.stderr ||\n            `Cloudflare sandbox bridge returned HTTP ${response.status}`,\n        );\n      }\n\n      return {\n        stdout: parsed.stdout || \"\",\n        stderr: parsed.stderr || \"\",\n        code: parsed.code ?? 0,\n      };\n    } catch (error) {\n      if (controller.signal.aborted) {\n        if (options?.signal?.aborted) {\n          throw new Error(\"Command aborted\", { cause: error });\n        }\n        throw new Error(`Command timed out after ${options?.timeout} seconds`, { cause: error });\n      }\n      throw error;\n    } finally {\n      if (timeoutHandle) clearTimeout(timeoutHandle);\n      if (options?.signal) {\n        options.signal.removeEventListener(\"abort\", onAbort);\n      }\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return this.cwd;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: this.cwd,\n    };\n  }\n\n  getSandboxConfig(): CloudflareSandboxConfig {\n    return { type: \"cloudflare\", sandboxId: this.sandboxId };\n  }\n}\n\nexport const cloudflareSandboxAdapter: SandboxAdapter<CloudflareSandboxConfig> = {\n  type: \"cloudflare\",\n  parse: parseCloudflareSandboxArg,\n  validate: validateCloudflareSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new CloudflareSandboxExecutor(config.sandboxId, env, ensureReady),\n};\n\nfunction resolveCloudflareSandboxUrl(): URL {\n  const raw = readEnv(\"CLOUDFLARE_SANDBOX_URL\");\n  if (!raw) {\n    throw new SandboxError(\n      \"Error: CLOUDFLARE_SANDBOX_URL or MIKAN_CLOUDFLARE_SANDBOX_URL is required for cloudflare sandbox mode\",\n    );\n  }\n\n  try {\n    return new URL(raw);\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: invalid CLOUDFLARE_SANDBOX_URL: ${detail}`);\n  }\n}\n\nfunction buildCloudflareHeaders(): Record<string, string> {\n  const token = readEnv(\"CLOUDFLARE_SANDBOX_TOKEN\");\n  return token ? { authorization: `Bearer ${token}` } : {};\n}\n"]}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/sandbox/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AA4DpB,qBAAa,yBAA0B,YAAW,QAAQ;IAItD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IAJvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YACmB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC7C,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAGnC;IAEK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiEtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAK5D;IAED,gBAAgB,IAAI,uBAAuB,CAE1C;CACF;AAED,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,uBAAuB,CAM5E,CAAC","sourcesContent":["import type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { readEnv } from \"../env.js\";\nimport { SandboxError } from \"./errors.js\";\n\nconst DEFAULT_CLOUDFLARE_CWD = \"/workspace\";\n\ninterface CloudflareExecPayload {\n  sandboxId: string;\n  command: string;\n  timeoutSeconds?: number;\n  cwd?: string;\n  env?: Record<string, string>;\n}\n\ninterface CloudflareExecResponse {\n  stdout?: string;\n  stderr?: string;\n  code?: number;\n  error?: string;\n}\n\nfunction parseCloudflareSandboxArg(value: string): CloudflareSandboxConfig | undefined {\n  if (!value.startsWith(\"cloudflare:\")) {\n    return undefined;\n  }\n\n  const sandboxId = value.slice(\"cloudflare:\".length).trim();\n  if (!sandboxId) {\n    throw new SandboxError(\n      \"Error: cloudflare sandbox requires sandbox id (e.g., cloudflare:slack-u123)\",\n    );\n  }\n\n  return { type: \"cloudflare\", sandboxId };\n}\n\nasync function validateCloudflareSandbox(_config: CloudflareSandboxConfig): Promise<void> {\n  const url = resolveCloudflareSandboxUrl();\n  try {\n    const response = await fetch(new URL(\"/health\", url), {\n      headers: buildCloudflareHeaders(),\n    });\n    if (!response.ok) {\n      throw new SandboxError(\n        `Error: Cloudflare sandbox bridge health check failed with HTTP ${response.status}`,\n      );\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: Cloudflare sandbox bridge is not reachable: ${detail}`);\n  }\n\n  console.log(\n    `  Cloudflare sandbox bridge enabled. Base URL: ${url.toString().replace(/\\/$/, \"\")}`,\n  );\n}\n\nexport class CloudflareSandboxExecutor implements Executor {\n  private readonly cwd: string;\n\n  constructor(\n    private readonly sandboxId: string,\n    private readonly env?: Record<string, string>,\n    _ensureReady?: () => Promise<void>,\n  ) {\n    this.cwd = readEnv(\"CLOUDFLARE_SANDBOX_CWD\") || DEFAULT_CLOUDFLARE_CWD;\n  }\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    const controller = new AbortController();\n    const timeoutHandle =\n      options?.timeout && options.timeout > 0\n        ? setTimeout(() => controller.abort(), options.timeout * 1000)\n        : undefined;\n\n    const onAbort = () => controller.abort();\n    if (options?.signal) {\n      if (options.signal.aborted) {\n        controller.abort();\n      } else {\n        options.signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n    }\n\n    try {\n      const payload: CloudflareExecPayload = {\n        sandboxId: this.sandboxId,\n        command,\n        cwd: this.cwd,\n      };\n      if (options?.timeout) payload.timeoutSeconds = options.timeout;\n      if (this.env && Object.keys(this.env).length > 0) payload.env = this.env;\n\n      const response = await fetch(new URL(\"/exec\", resolveCloudflareSandboxUrl()), {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          ...buildCloudflareHeaders(),\n        },\n        body: JSON.stringify(payload),\n        signal: controller.signal,\n      });\n\n      const raw = (await response.text()).trim();\n      const parsed = raw ? (JSON.parse(raw) as CloudflareExecResponse) : {};\n\n      if (!response.ok) {\n        throw new Error(\n          parsed.error ||\n            parsed.stderr ||\n            `Cloudflare sandbox bridge returned HTTP ${response.status}`,\n        );\n      }\n\n      return {\n        stdout: parsed.stdout || \"\",\n        stderr: parsed.stderr || \"\",\n        code: parsed.code ?? 0,\n      };\n    } catch (error) {\n      if (controller.signal.aborted) {\n        if (options?.signal?.aborted) {\n          throw new Error(\"Command aborted\", { cause: error });\n        }\n        throw new Error(`Command timed out after ${options?.timeout} seconds`, { cause: error });\n      }\n      throw error;\n    } finally {\n      if (timeoutHandle) clearTimeout(timeoutHandle);\n      if (options?.signal) {\n        options.signal.removeEventListener(\"abort\", onAbort);\n      }\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return this.cwd;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: this.cwd,\n    };\n  }\n\n  getSandboxConfig(): CloudflareSandboxConfig {\n    return { type: \"cloudflare\", sandboxId: this.sandboxId };\n  }\n}\n\nexport const cloudflareSandboxAdapter: SandboxAdapter<CloudflareSandboxConfig> = {\n  type: \"cloudflare\",\n  parse: parseCloudflareSandboxArg,\n  validate: validateCloudflareSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new CloudflareSandboxExecutor(config.sandboxId, env, ensureReady),\n};\n\nfunction resolveCloudflareSandboxUrl(): URL {\n  const raw = readEnv(\"CLOUDFLARE_SANDBOX_URL\");\n  if (!raw) {\n    throw new SandboxError(\n      \"Error: CLOUDFLARE_SANDBOX_URL or MIKAN_CLOUDFLARE_SANDBOX_URL is required for cloudflare sandbox mode\",\n    );\n  }\n\n  try {\n    return new URL(raw);\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: invalid CLOUDFLARE_SANDBOX_URL: ${detail}`);\n  }\n}\n\nfunction buildCloudflareHeaders(): Record<string, string> {\n  const token = readEnv(\"CLOUDFLARE_SANDBOX_TOKEN\");\n  return token ? { authorization: `Bearer ${token}` } : {};\n}\n"]}

package/dist/sandbox/cloudflare.js

@@ -1,7 +1,7 @@
 import { readEnv } from "../env.js";
 import { SandboxError } from "./errors.js";
 const DEFAULT_CLOUDFLARE_CWD = "/workspace";
-export function parseCloudflareSandboxArg(value) {
+function parseCloudflareSandboxArg(value) {
     if (!value.startsWith("cloudflare:")) {
         return undefined;
     }
@@ -11,7 +11,7 @@ export function parseCloudflareSandboxArg(value) {
     }
     return { type: "cloudflare", sandboxId };
 }
-export async function validateCloudflareSandbox(_config) {
+async function validateCloudflareSandbox(_config) {
     const url = resolveCloudflareSandboxUrl();
     try {
         const response = await fetch(new URL("/health", url), {

package/dist/sandbox/cloudflare.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/sandbox/cloudflare.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAiB5C,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgC;IAC9E,MAAM,GAAG,GAAG,2BAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;YACpD,OAAO,EAAE,sBAAsB,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,kEAAkE,QAAQ,CAAC,MAAM,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kDAAkD,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAAyB;IAGpC,YACmB,SAAiB,EACjB,GAA4B,EAC7C,YAAkC;yBAFjB,SAAS;mBACT,GAAG;QAGpB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,wBAAwB,CAAC,IAAI,sBAAsB,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;YACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAA0B;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC;YACF,IAAI,OAAO,EAAE,OAAO;gBAAE,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE;gBAC5E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,sBAAsB,EAAE;iBAC5B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;YAEtE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,KAAK;oBACV,MAAM,CAAC,MAAM;oBACb,2CAA2C,QAAQ,CAAC,MAAM,EAAE,CAC/D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,OAAO,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,aAAa;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO;YACL,iBAAiB;YACjB,oBAAoB,EAAE,IAAI,CAAC,GAAG;SAC/B,CAAC;IACJ,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA4C;IAC/E,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,yBAAyB;IAChC,QAAQ,EAAE,yBAAyB;IACnC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CACpE,CAAC;AAEF,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,YAAY,CACpB,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC","sourcesContent":["import type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { readEnv } from \"../env.js\";\nimport { SandboxError } from \"./errors.js\";\n\nconst DEFAULT_CLOUDFLARE_CWD = \"/workspace\";\n\ninterface CloudflareExecPayload {\n  sandboxId: string;\n  command: string;\n  timeoutSeconds?: number;\n  cwd?: string;\n  env?: Record<string, string>;\n}\n\ninterface CloudflareExecResponse {\n  stdout?: string;\n  stderr?: string;\n  code?: number;\n  error?: string;\n}\n\nexport function parseCloudflareSandboxArg(value: string): CloudflareSandboxConfig | undefined {\n  if (!value.startsWith(\"cloudflare:\")) {\n    return undefined;\n  }\n\n  const sandboxId = value.slice(\"cloudflare:\".length).trim();\n  if (!sandboxId) {\n    throw new SandboxError(\n      \"Error: cloudflare sandbox requires sandbox id (e.g., cloudflare:slack-u123)\",\n    );\n  }\n\n  return { type: \"cloudflare\", sandboxId };\n}\n\nexport async function validateCloudflareSandbox(_config: CloudflareSandboxConfig): Promise<void> {\n  const url = resolveCloudflareSandboxUrl();\n  try {\n    const response = await fetch(new URL(\"/health\", url), {\n      headers: buildCloudflareHeaders(),\n    });\n    if (!response.ok) {\n      throw new SandboxError(\n        `Error: Cloudflare sandbox bridge health check failed with HTTP ${response.status}`,\n      );\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: Cloudflare sandbox bridge is not reachable: ${detail}`);\n  }\n\n  console.log(\n    `  Cloudflare sandbox bridge enabled. Base URL: ${url.toString().replace(/\\/$/, \"\")}`,\n  );\n}\n\nexport class CloudflareSandboxExecutor implements Executor {\n  private readonly cwd: string;\n\n  constructor(\n    private readonly sandboxId: string,\n    private readonly env?: Record<string, string>,\n    _ensureReady?: () => Promise<void>,\n  ) {\n    this.cwd = readEnv(\"CLOUDFLARE_SANDBOX_CWD\") || DEFAULT_CLOUDFLARE_CWD;\n  }\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    const controller = new AbortController();\n    const timeoutHandle =\n      options?.timeout && options.timeout > 0\n        ? setTimeout(() => controller.abort(), options.timeout * 1000)\n        : undefined;\n\n    const onAbort = () => controller.abort();\n    if (options?.signal) {\n      if (options.signal.aborted) {\n        controller.abort();\n      } else {\n        options.signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n    }\n\n    try {\n      const payload: CloudflareExecPayload = {\n        sandboxId: this.sandboxId,\n        command,\n        cwd: this.cwd,\n      };\n      if (options?.timeout) payload.timeoutSeconds = options.timeout;\n      if (this.env && Object.keys(this.env).length > 0) payload.env = this.env;\n\n      const response = await fetch(new URL(\"/exec\", resolveCloudflareSandboxUrl()), {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          ...buildCloudflareHeaders(),\n        },\n        body: JSON.stringify(payload),\n        signal: controller.signal,\n      });\n\n      const raw = (await response.text()).trim();\n      const parsed = raw ? (JSON.parse(raw) as CloudflareExecResponse) : {};\n\n      if (!response.ok) {\n        throw new Error(\n          parsed.error ||\n            parsed.stderr ||\n            `Cloudflare sandbox bridge returned HTTP ${response.status}`,\n        );\n      }\n\n      return {\n        stdout: parsed.stdout || \"\",\n        stderr: parsed.stderr || \"\",\n        code: parsed.code ?? 0,\n      };\n    } catch (error) {\n      if (controller.signal.aborted) {\n        if (options?.signal?.aborted) {\n          throw new Error(\"Command aborted\", { cause: error });\n        }\n        throw new Error(`Command timed out after ${options?.timeout} seconds`, { cause: error });\n      }\n      throw error;\n    } finally {\n      if (timeoutHandle) clearTimeout(timeoutHandle);\n      if (options?.signal) {\n        options.signal.removeEventListener(\"abort\", onAbort);\n      }\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return this.cwd;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: this.cwd,\n    };\n  }\n\n  getSandboxConfig(): CloudflareSandboxConfig {\n    return { type: \"cloudflare\", sandboxId: this.sandboxId };\n  }\n}\n\nexport const cloudflareSandboxAdapter: SandboxAdapter<CloudflareSandboxConfig> = {\n  type: \"cloudflare\",\n  parse: parseCloudflareSandboxArg,\n  validate: validateCloudflareSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new CloudflareSandboxExecutor(config.sandboxId, env, ensureReady),\n};\n\nfunction resolveCloudflareSandboxUrl(): URL {\n  const raw = readEnv(\"CLOUDFLARE_SANDBOX_URL\");\n  if (!raw) {\n    throw new SandboxError(\n      \"Error: CLOUDFLARE_SANDBOX_URL or MIKAN_CLOUDFLARE_SANDBOX_URL is required for cloudflare sandbox mode\",\n    );\n  }\n\n  try {\n    return new URL(raw);\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: invalid CLOUDFLARE_SANDBOX_URL: ${detail}`);\n  }\n}\n\nfunction buildCloudflareHeaders(): Record<string, string> {\n  const token = readEnv(\"CLOUDFLARE_SANDBOX_TOKEN\");\n  return token ? { authorization: `Bearer ${token}` } : {};\n}\n"]}
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/sandbox/cloudflare.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAiB5C,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,OAAgC;IACvE,MAAM,GAAG,GAAG,2BAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;YACpD,OAAO,EAAE,sBAAsB,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,kEAAkE,QAAQ,CAAC,MAAM,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kDAAkD,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAAyB;IAGpC,YACmB,SAAiB,EACjB,GAA4B,EAC7C,YAAkC;yBAFjB,SAAS;mBACT,GAAG;QAGpB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,wBAAwB,CAAC,IAAI,sBAAsB,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;YACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAA0B;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC;YACF,IAAI,OAAO,EAAE,OAAO;gBAAE,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE;gBAC5E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,sBAAsB,EAAE;iBAC5B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;YAEtE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,KAAK;oBACV,MAAM,CAAC,MAAM;oBACb,2CAA2C,QAAQ,CAAC,MAAM,EAAE,CAC/D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,OAAO,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,aAAa;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO;YACL,iBAAiB;YACjB,oBAAoB,EAAE,IAAI,CAAC,GAAG;SAC/B,CAAC;IACJ,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA4C;IAC/E,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,yBAAyB;IAChC,QAAQ,EAAE,yBAAyB;IACnC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CACpE,CAAC;AAEF,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,YAAY,CACpB,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC","sourcesContent":["import type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { readEnv } from \"../env.js\";\nimport { SandboxError } from \"./errors.js\";\n\nconst DEFAULT_CLOUDFLARE_CWD = \"/workspace\";\n\ninterface CloudflareExecPayload {\n  sandboxId: string;\n  command: string;\n  timeoutSeconds?: number;\n  cwd?: string;\n  env?: Record<string, string>;\n}\n\ninterface CloudflareExecResponse {\n  stdout?: string;\n  stderr?: string;\n  code?: number;\n  error?: string;\n}\n\nfunction parseCloudflareSandboxArg(value: string): CloudflareSandboxConfig | undefined {\n  if (!value.startsWith(\"cloudflare:\")) {\n    return undefined;\n  }\n\n  const sandboxId = value.slice(\"cloudflare:\".length).trim();\n  if (!sandboxId) {\n    throw new SandboxError(\n      \"Error: cloudflare sandbox requires sandbox id (e.g., cloudflare:slack-u123)\",\n    );\n  }\n\n  return { type: \"cloudflare\", sandboxId };\n}\n\nasync function validateCloudflareSandbox(_config: CloudflareSandboxConfig): Promise<void> {\n  const url = resolveCloudflareSandboxUrl();\n  try {\n    const response = await fetch(new URL(\"/health\", url), {\n      headers: buildCloudflareHeaders(),\n    });\n    if (!response.ok) {\n      throw new SandboxError(\n        `Error: Cloudflare sandbox bridge health check failed with HTTP ${response.status}`,\n      );\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: Cloudflare sandbox bridge is not reachable: ${detail}`);\n  }\n\n  console.log(\n    `  Cloudflare sandbox bridge enabled. Base URL: ${url.toString().replace(/\\/$/, \"\")}`,\n  );\n}\n\nexport class CloudflareSandboxExecutor implements Executor {\n  private readonly cwd: string;\n\n  constructor(\n    private readonly sandboxId: string,\n    private readonly env?: Record<string, string>,\n    _ensureReady?: () => Promise<void>,\n  ) {\n    this.cwd = readEnv(\"CLOUDFLARE_SANDBOX_CWD\") || DEFAULT_CLOUDFLARE_CWD;\n  }\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    const controller = new AbortController();\n    const timeoutHandle =\n      options?.timeout && options.timeout > 0\n        ? setTimeout(() => controller.abort(), options.timeout * 1000)\n        : undefined;\n\n    const onAbort = () => controller.abort();\n    if (options?.signal) {\n      if (options.signal.aborted) {\n        controller.abort();\n      } else {\n        options.signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n    }\n\n    try {\n      const payload: CloudflareExecPayload = {\n        sandboxId: this.sandboxId,\n        command,\n        cwd: this.cwd,\n      };\n      if (options?.timeout) payload.timeoutSeconds = options.timeout;\n      if (this.env && Object.keys(this.env).length > 0) payload.env = this.env;\n\n      const response = await fetch(new URL(\"/exec\", resolveCloudflareSandboxUrl()), {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          ...buildCloudflareHeaders(),\n        },\n        body: JSON.stringify(payload),\n        signal: controller.signal,\n      });\n\n      const raw = (await response.text()).trim();\n      const parsed = raw ? (JSON.parse(raw) as CloudflareExecResponse) : {};\n\n      if (!response.ok) {\n        throw new Error(\n          parsed.error ||\n            parsed.stderr ||\n            `Cloudflare sandbox bridge returned HTTP ${response.status}`,\n        );\n      }\n\n      return {\n        stdout: parsed.stdout || \"\",\n        stderr: parsed.stderr || \"\",\n        code: parsed.code ?? 0,\n      };\n    } catch (error) {\n      if (controller.signal.aborted) {\n        if (options?.signal?.aborted) {\n          throw new Error(\"Command aborted\", { cause: error });\n        }\n        throw new Error(`Command timed out after ${options?.timeout} seconds`, { cause: error });\n      }\n      throw error;\n    } finally {\n      if (timeoutHandle) clearTimeout(timeoutHandle);\n      if (options?.signal) {\n        options.signal.removeEventListener(\"abort\", onAbort);\n      }\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return this.cwd;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: this.cwd,\n    };\n  }\n\n  getSandboxConfig(): CloudflareSandboxConfig {\n    return { type: \"cloudflare\", sandboxId: this.sandboxId };\n  }\n}\n\nexport const cloudflareSandboxAdapter: SandboxAdapter<CloudflareSandboxConfig> = {\n  type: \"cloudflare\",\n  parse: parseCloudflareSandboxArg,\n  validate: validateCloudflareSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new CloudflareSandboxExecutor(config.sandboxId, env, ensureReady),\n};\n\nfunction resolveCloudflareSandboxUrl(): URL {\n  const raw = readEnv(\"CLOUDFLARE_SANDBOX_URL\");\n  if (!raw) {\n    throw new SandboxError(\n      \"Error: CLOUDFLARE_SANDBOX_URL or MIKAN_CLOUDFLARE_SANDBOX_URL is required for cloudflare sandbox mode\",\n    );\n  }\n\n  try {\n    return new URL(raw);\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new SandboxError(`Error: invalid CLOUDFLARE_SANDBOX_URL: ${detail}`);\n  }\n}\n\nfunction buildCloudflareHeaders(): Record<string, string> {\n  const token = readEnv(\"CLOUDFLARE_SANDBOX_TOKEN\");\n  return token ? { authorization: `Bearer ${token}` } : {};\n}\n"]}

package/dist/sandbox/container.d.ts

@@ -1,7 +1,4 @@
 import type { ContainerSandboxConfig, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter } from "./types.js";
-export declare function parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined;
-export declare function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void>;
-export declare function buildContainerExecCommand(container: string, command: string, envFilePath?: string): string;
 export declare class ContainerExecutor implements Executor {
     private container;
     private env?;

package/dist/sandbox/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AASpB,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAY1F;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B5F;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAGR;AAiBD,qBAAa,iBAAkB,YAAW,QAAQ;IAE9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IAHtB,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAM1E,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple, shellEscape } from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nexport async function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nexport function buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;\n}\n\nfunction withRuntimeBootstrap(command: string, env?: Record<string, string>): string {\n  if (!hasGitHubToken(env)) {\n    return command;\n  }\n\n  return [\n    \"if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then gh auth setup-git >/dev/null 2>&1 || true; fi\",\n    command,\n  ].join(\"\\n\");\n}\n\nfunction hasGitHubToken(env?: Record<string, string>): boolean {\n  return Boolean(env?.GH_TOKEN || env?.GITHUB_TOKEN || env?.GITHUB_OAUTH_ACCESS_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const hostExecutor = new HostExecutor();\n    const temp = this.env ? createSecureEnvFile(this.env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        withRuntimeBootstrap(command, this.env),\n        temp?.envFilePath,\n      );\n      return await hostExecutor.exec(dockerCmd, options);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n\nfunction sanitizeEnvValue(value: string): string {\n  return value.replace(/\\r?\\n/g, \"\");\n}\n"]}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AA8EpB,qBAAa,iBAAkB,YAAW,QAAQ;IAE9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IAHtB,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAM1E,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple, shellEscape } from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;\n}\n\nfunction withRuntimeBootstrap(command: string, env?: Record<string, string>): string {\n  if (!hasGitHubToken(env)) {\n    return command;\n  }\n\n  return [\n    \"if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then gh auth setup-git >/dev/null 2>&1 || true; fi\",\n    command,\n  ].join(\"\\n\");\n}\n\nfunction hasGitHubToken(env?: Record<string, string>): boolean {\n  return Boolean(env?.GH_TOKEN || env?.GITHUB_TOKEN || env?.GITHUB_OAUTH_ACCESS_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const hostExecutor = new HostExecutor();\n    const temp = this.env ? createSecureEnvFile(this.env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        withRuntimeBootstrap(command, this.env),\n        temp?.envFilePath,\n      );\n      return await hostExecutor.exec(dockerCmd, options);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n\nfunction sanitizeEnvValue(value: string): string {\n  return value.replace(/\\r?\\n/g, \"\");\n}\n"]}

package/dist/sandbox/container.js

@@ -7,7 +7,7 @@ import { HostExecutor } from "./host.js";
 import { createMountedRuntimePathContext } from "./path-context.js";
 const PRIVATE_DIR_MODE = 0o700;
 const PRIVATE_FILE_MODE = 0o600;
-export function parseContainerSandboxArg(value) {
+function parseContainerSandboxArg(value) {
     if (!value.startsWith("container:")) {
         return undefined;
     }
@@ -17,7 +17,7 @@ export function parseContainerSandboxArg(value) {
     }
     return { type: "container", container };
 }
-export async function validateContainerSandbox(config) {
+async function validateContainerSandbox(config) {
     try {
         await execSimple("docker", ["--version"]);
     }
@@ -47,7 +47,7 @@ export async function validateContainerSandbox(config) {
     }
     console.log(`  Container '${config.container}' is running.`);
 }
-export function buildContainerExecCommand(container, command, envFilePath) {
+function buildContainerExecCommand(container, command, envFilePath) {
     const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : "";
     return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;
 }

package/dist/sandbox/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IAC3E,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,OAAe,EACf,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,eAAe,OAAO,iBAAiB,SAAS,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,GAA4B;IACzE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,wHAAwH;QACxH,OAAO;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,YAAY,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,OAAO,iBAAiB;IAC5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;yBAFjC,SAAS;mBACT,GAAG;2BACH,WAAW;IAClB,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EACvC,IAAI,EAAE,WAAW,CAClB,CAAC;YACF,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple, shellEscape } from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nexport async function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nexport function buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;\n}\n\nfunction withRuntimeBootstrap(command: string, env?: Record<string, string>): string {\n  if (!hasGitHubToken(env)) {\n    return command;\n  }\n\n  return [\n    \"if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then gh auth setup-git >/dev/null 2>&1 || true; fi\",\n    command,\n  ].join(\"\\n\");\n}\n\nfunction hasGitHubToken(env?: Record<string, string>): boolean {\n  return Boolean(env?.GH_TOKEN || env?.GITHUB_TOKEN || env?.GITHUB_OAUTH_ACCESS_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const hostExecutor = new HostExecutor();\n    const temp = this.env ? createSecureEnvFile(this.env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        withRuntimeBootstrap(command, this.env),\n        temp?.envFilePath,\n      );\n      return await hostExecutor.exec(dockerCmd, options);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n\nfunction sanitizeEnvValue(value: string): string {\n  return value.replace(/\\r?\\n/g, \"\");\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,OAAe,EACf,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,eAAe,OAAO,iBAAiB,SAAS,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,GAA4B;IACzE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,wHAAwH;QACxH,OAAO;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,YAAY,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,OAAO,iBAAiB;IAC5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;yBAFjC,SAAS;mBACT,GAAG;2BACH,WAAW;IAClB,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EACvC,IAAI,EAAE,WAAW,CAClB,CAAC;YACF,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { execSimple, shellEscape } from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  return `docker exec ${envPart}-w /workspace ${container} sh -c ${shellEscape(command)}`;\n}\n\nfunction withRuntimeBootstrap(command: string, env?: Record<string, string>): string {\n  if (!hasGitHubToken(env)) {\n    return command;\n  }\n\n  return [\n    \"if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then gh auth setup-git >/dev/null 2>&1 || true; fi\",\n    command,\n  ].join(\"\\n\");\n}\n\nfunction hasGitHubToken(env?: Record<string, string>): boolean {\n  return Boolean(env?.GH_TOKEN || env?.GITHUB_TOKEN || env?.GITHUB_OAUTH_ACCESS_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const hostExecutor = new HostExecutor();\n    const temp = this.env ? createSecureEnvFile(this.env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        withRuntimeBootstrap(command, this.env),\n        temp?.envFilePath,\n      );\n      return await hostExecutor.exec(dockerCmd, options);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, \"/workspace\");\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${sanitizeEnvValue(value)}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n\nfunction sanitizeEnvValue(value: string): string {\n  return value.replace(/\\r?\\n/g, \"\");\n}\n"]}

package/dist/sandbox/firecracker.d.ts

@@ -1,6 +1,4 @@
 import type { ExecOptions, ExecResult, Executor, FirecrackerSandboxConfig, RuntimePathContext, SandboxAdapter } from "./types.js";
-export declare function parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined;
-export declare function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void>;
 export declare class FirecrackerExecutor implements Executor {
     private vmId;
     private hostPath;

package/dist/sandbox/firecracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../src/sandbox/firecracker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AAKpB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CA8B9F;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6ChG;AAED,qBAAa,mBAAoB,YAAW,QAAQ;IAEhD,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,GAAG,CAAC;IALd,YACU,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAe,EACxB,OAAO,GAAE,MAAW,EACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAClC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqGtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAK5D;IAED,gBAAgB,IAAI,wBAAwB,CAQ3C;CACF;AAgBD,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,wBAAwB,CAM9E,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  FirecrackerSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { execSimple, killProcessTree, shellEscape } from \"./utils.js\";\n\nexport function parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined {\n  if (!value.startsWith(\"firecracker:\")) {\n    return undefined;\n  }\n\n  const arg = value.slice(\"firecracker:\".length);\n  // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n  // Example: firecracker:vm1:/home/user/workspace\n  //          firecracker:vm1:/home/user/workspace:root\n  //          firecracker:vm1:/home/user/workspace:root:22\n  const parts = arg.split(\":\");\n  if (parts.length < 2) {\n    throw new SandboxError(\n      \"Error: firecracker sandbox requires vm-id and host-path\\n\" +\n        \"Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\\n\" +\n        \"Example: firecracker:vm1:/home/user/workspace\",\n    );\n  }\n  const vmId = parts[0];\n  const hostPath = parts[1];\n  const sshUser = parts[2] || \"root\";\n  const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;\n\n  if (!vmId || !hostPath) {\n    throw new SandboxError(\"Error: firecracker sandbox requires vm-id and host-path\");\n  }\n  if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {\n    throw new SandboxError(\"Error: invalid SSH port\");\n  }\n  return { type: \"firecracker\", vmId, hostPath, sshUser, sshPort };\n}\n\nexport async function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void> {\n  // Check if fc-agent or firecracker CLI is available\n  try {\n    await execSimple(\"fc-agent\", [\"--version\"]);\n  } catch {\n    // Try alternative: firecracker\n    try {\n      await execSimple(\"firecracker\", [\"--version\"]);\n    } catch {\n      throw new SandboxError(\n        \"Error: Firecracker tools (fc-agent or firecracker) not found in PATH\",\n        [\"Install firecracker: https://github.com/firecracker-microvm/firecracker\"],\n      );\n    }\n  }\n\n  // Check if VM is running using fc-agent\n  try {\n    const result = await execSimple(\"fc-agent\", [\"status\", config.vmId]);\n    if (!result.includes(\"running\") && !result.includes(\"Running\")) {\n      throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [\n        `Start it with: fc-agent start ${config.vmId}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    // Try alternative: firecracker-ctl or direct check\n    try {\n      await execSimple(\"firecracker-ctl\", [\"status\", config.vmId]);\n    } catch {\n      console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);\n      console.error(\"Make sure the VM is started before running mikan.\");\n    }\n  }\n\n  // Verify host path exists\n  try {\n    await execSimple(\"ls\", [\"-d\", config.hostPath]);\n  } catch {\n    throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);\n  }\n\n  console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);\n}\n\nexport class FirecrackerExecutor implements Executor {\n  constructor(\n    private vmId: string,\n    private hostPath: string,\n    private sshUser: string = \"root\",\n    private sshPort: number = 22,\n    private env?: Record<string, string>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (!this.env || Object.keys(this.env).length === 0) {\n      const sshCmd =\n        this.sshPort === 22\n          ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`\n          : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;\n      const hostExecutor = new HostExecutor();\n      return hostExecutor.exec(sshCmd, options);\n    }\n\n    return new Promise((resolve, reject) => {\n      const sshArgs = [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"ConnectTimeout=10\"];\n      if (this.sshPort !== 22) {\n        sshArgs.push(\"-p\", String(this.sshPort));\n      }\n      sshArgs.push(`${this.sshUser}@${this.vmId}`, \"sh\", \"-se\");\n\n      const child = spawn(\"ssh\", sshArgs, {\n        detached: true,\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n      let settled = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              if (child.pid) killProcessTree(child.pid);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.on(\"error\", (error) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n        reject(error);\n      });\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stdin?.on(\"error\", (error) => {\n        stderr += `${error.message}\\n`;\n      });\n      child.stdin?.end(buildRemoteScript(command, this.env));\n\n      child.on(\"close\", (code) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: \"/workspace\",\n    };\n  }\n\n  getSandboxConfig(): FirecrackerSandboxConfig {\n    return {\n      type: \"firecracker\",\n      vmId: this.vmId,\n      hostPath: this.hostPath,\n      sshUser: this.sshUser,\n      sshPort: this.sshPort,\n    };\n  }\n}\n\nfunction buildRemoteScript(command: string, env?: Record<string, string>): string {\n  const exports = env\n    ? Object.entries(env)\n        .map(([key, value]) => {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n            throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);\n          }\n          return `export ${key}=${shellEscape(value)}`;\n        })\n        .join(\"\\n\") + \"\\n\"\n    : \"\";\n  return `${exports}${command}\\n`;\n}\n\nexport const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig> = {\n  type: \"firecracker\",\n  parse: parseFirecrackerSandboxArg,\n  validate: validateFirecrackerSandbox,\n  createExecutor: (config, env) =>\n    new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),\n};\n"]}
+{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../src/sandbox/firecracker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AAoFpB,qBAAa,mBAAoB,YAAW,QAAQ;IAEhD,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,GAAG,CAAC;IALd,YACU,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAe,EACxB,OAAO,GAAE,MAAW,EACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAClC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqGtE;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAK5D;IAED,gBAAgB,IAAI,wBAAwB,CAQ3C;CACF;AAgBD,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,wBAAwB,CAM9E,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  FirecrackerSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { execSimple, killProcessTree, shellEscape } from \"./utils.js\";\n\nfunction parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined {\n  if (!value.startsWith(\"firecracker:\")) {\n    return undefined;\n  }\n\n  const arg = value.slice(\"firecracker:\".length);\n  // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n  // Example: firecracker:vm1:/home/user/workspace\n  //          firecracker:vm1:/home/user/workspace:root\n  //          firecracker:vm1:/home/user/workspace:root:22\n  const parts = arg.split(\":\");\n  if (parts.length < 2) {\n    throw new SandboxError(\n      \"Error: firecracker sandbox requires vm-id and host-path\\n\" +\n        \"Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\\n\" +\n        \"Example: firecracker:vm1:/home/user/workspace\",\n    );\n  }\n  const vmId = parts[0];\n  const hostPath = parts[1];\n  const sshUser = parts[2] || \"root\";\n  const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;\n\n  if (!vmId || !hostPath) {\n    throw new SandboxError(\"Error: firecracker sandbox requires vm-id and host-path\");\n  }\n  if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {\n    throw new SandboxError(\"Error: invalid SSH port\");\n  }\n  return { type: \"firecracker\", vmId, hostPath, sshUser, sshPort };\n}\n\nasync function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void> {\n  // Check if fc-agent or firecracker CLI is available\n  try {\n    await execSimple(\"fc-agent\", [\"--version\"]);\n  } catch {\n    // Try alternative: firecracker\n    try {\n      await execSimple(\"firecracker\", [\"--version\"]);\n    } catch {\n      throw new SandboxError(\n        \"Error: Firecracker tools (fc-agent or firecracker) not found in PATH\",\n        [\"Install firecracker: https://github.com/firecracker-microvm/firecracker\"],\n      );\n    }\n  }\n\n  // Check if VM is running using fc-agent\n  try {\n    const result = await execSimple(\"fc-agent\", [\"status\", config.vmId]);\n    if (!result.includes(\"running\") && !result.includes(\"Running\")) {\n      throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [\n        `Start it with: fc-agent start ${config.vmId}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    // Try alternative: firecracker-ctl or direct check\n    try {\n      await execSimple(\"firecracker-ctl\", [\"status\", config.vmId]);\n    } catch {\n      console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);\n      console.error(\"Make sure the VM is started before running mikan.\");\n    }\n  }\n\n  // Verify host path exists\n  try {\n    await execSimple(\"ls\", [\"-d\", config.hostPath]);\n  } catch {\n    throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);\n  }\n\n  console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);\n}\n\nexport class FirecrackerExecutor implements Executor {\n  constructor(\n    private vmId: string,\n    private hostPath: string,\n    private sshUser: string = \"root\",\n    private sshPort: number = 22,\n    private env?: Record<string, string>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (!this.env || Object.keys(this.env).length === 0) {\n      const sshCmd =\n        this.sshPort === 22\n          ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`\n          : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;\n      const hostExecutor = new HostExecutor();\n      return hostExecutor.exec(sshCmd, options);\n    }\n\n    return new Promise((resolve, reject) => {\n      const sshArgs = [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"ConnectTimeout=10\"];\n      if (this.sshPort !== 22) {\n        sshArgs.push(\"-p\", String(this.sshPort));\n      }\n      sshArgs.push(`${this.sshUser}@${this.vmId}`, \"sh\", \"-se\");\n\n      const child = spawn(\"ssh\", sshArgs, {\n        detached: true,\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n      let settled = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              if (child.pid) killProcessTree(child.pid);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.on(\"error\", (error) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n        reject(error);\n      });\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stdin?.on(\"error\", (error) => {\n        stderr += `${error.message}\\n`;\n      });\n      child.stdin?.end(buildRemoteScript(command, this.env));\n\n      child.on(\"close\", (code) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: \"/workspace\",\n    };\n  }\n\n  getSandboxConfig(): FirecrackerSandboxConfig {\n    return {\n      type: \"firecracker\",\n      vmId: this.vmId,\n      hostPath: this.hostPath,\n      sshUser: this.sshUser,\n      sshPort: this.sshPort,\n    };\n  }\n}\n\nfunction buildRemoteScript(command: string, env?: Record<string, string>): string {\n  const exports = env\n    ? Object.entries(env)\n        .map(([key, value]) => {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n            throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);\n          }\n          return `export ${key}=${shellEscape(value)}`;\n        })\n        .join(\"\\n\") + \"\\n\"\n    : \"\";\n  return `${exports}${command}\\n`;\n}\n\nexport const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig> = {\n  type: \"firecracker\",\n  parse: parseFirecrackerSandboxArg,\n  validate: validateFirecrackerSandbox,\n  createExecutor: (config, env) =>\n    new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),\n};\n"]}

package/dist/sandbox/firecracker.js

@@ -2,7 +2,7 @@ import { spawn } from "child_process";
 import { SandboxError } from "./errors.js";
 import { HostExecutor } from "./host.js";
 import { execSimple, killProcessTree, shellEscape } from "./utils.js";
-export function parseFirecrackerSandboxArg(value) {
+function parseFirecrackerSandboxArg(value) {
     if (!value.startsWith("firecracker:")) {
         return undefined;
     }
@@ -29,7 +29,7 @@ export function parseFirecrackerSandboxArg(value) {
     }
     return { type: "firecracker", vmId, hostPath, sshUser, sshPort };
 }
-export async function validateFirecrackerSandbox(config) {
+async function validateFirecrackerSandbox(config) {
     // Check if fc-agent or firecracker CLI is available
     try {
         await execSimple("fc-agent", ["--version"]);

package/dist/sandbox/firecracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAStC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/C,oEAAoE;IACpE,gDAAgD;IAChD,qDAAqD;IACrD,wDAAwD;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CACpB,2DAA2D;YACzD,oEAAoE;YACpE,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,yDAAyD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAgC;IAC/E,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,sEAAsE,EACtE,CAAC,yEAAyE,CAAC,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,YAAY,CAAC,0BAA0B,MAAM,CAAC,IAAI,mBAAmB,EAAE;gBAC/E,iCAAiC,MAAM,CAAC,IAAI,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;YAC9E,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,QAAQ,mBAAmB,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,OAAO,mBAAmB;IAC9B,YACU,IAAY,EACZ,QAAgB,EAChB,OAAO,GAAW,MAAM,EACxB,OAAO,GAAW,EAAE,EACpB,GAA4B;oBAJ5B,IAAI;wBACJ,QAAQ;uBACR,OAAO;uBACP,OAAO;mBACP,GAAG;IACV,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,EAAE;gBACjB,CAAC,CAAC,wDAAwD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE;gBACnH,CAAC,CAAC,2DAA2D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3I,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAE1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;gBAClC,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAEvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO;YACL,iBAAiB;YACjB,oBAAoB,EAAE,YAAY;SACnC,CAAC;IACJ,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,GAA4B;IACtE,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;aAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,YAAY,CAAC,sDAAsD,GAAG,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,UAAU,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACtB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,OAAO,GAAG,OAAO,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAA6C;IACjF,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,0BAA0B;IACjC,QAAQ,EAAE,0BAA0B;IACpC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAC9B,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;CAC7F,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  FirecrackerSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { execSimple, killProcessTree, shellEscape } from \"./utils.js\";\n\nexport function parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined {\n  if (!value.startsWith(\"firecracker:\")) {\n    return undefined;\n  }\n\n  const arg = value.slice(\"firecracker:\".length);\n  // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n  // Example: firecracker:vm1:/home/user/workspace\n  //          firecracker:vm1:/home/user/workspace:root\n  //          firecracker:vm1:/home/user/workspace:root:22\n  const parts = arg.split(\":\");\n  if (parts.length < 2) {\n    throw new SandboxError(\n      \"Error: firecracker sandbox requires vm-id and host-path\\n\" +\n        \"Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\\n\" +\n        \"Example: firecracker:vm1:/home/user/workspace\",\n    );\n  }\n  const vmId = parts[0];\n  const hostPath = parts[1];\n  const sshUser = parts[2] || \"root\";\n  const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;\n\n  if (!vmId || !hostPath) {\n    throw new SandboxError(\"Error: firecracker sandbox requires vm-id and host-path\");\n  }\n  if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {\n    throw new SandboxError(\"Error: invalid SSH port\");\n  }\n  return { type: \"firecracker\", vmId, hostPath, sshUser, sshPort };\n}\n\nexport async function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void> {\n  // Check if fc-agent or firecracker CLI is available\n  try {\n    await execSimple(\"fc-agent\", [\"--version\"]);\n  } catch {\n    // Try alternative: firecracker\n    try {\n      await execSimple(\"firecracker\", [\"--version\"]);\n    } catch {\n      throw new SandboxError(\n        \"Error: Firecracker tools (fc-agent or firecracker) not found in PATH\",\n        [\"Install firecracker: https://github.com/firecracker-microvm/firecracker\"],\n      );\n    }\n  }\n\n  // Check if VM is running using fc-agent\n  try {\n    const result = await execSimple(\"fc-agent\", [\"status\", config.vmId]);\n    if (!result.includes(\"running\") && !result.includes(\"Running\")) {\n      throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [\n        `Start it with: fc-agent start ${config.vmId}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    // Try alternative: firecracker-ctl or direct check\n    try {\n      await execSimple(\"firecracker-ctl\", [\"status\", config.vmId]);\n    } catch {\n      console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);\n      console.error(\"Make sure the VM is started before running mikan.\");\n    }\n  }\n\n  // Verify host path exists\n  try {\n    await execSimple(\"ls\", [\"-d\", config.hostPath]);\n  } catch {\n    throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);\n  }\n\n  console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);\n}\n\nexport class FirecrackerExecutor implements Executor {\n  constructor(\n    private vmId: string,\n    private hostPath: string,\n    private sshUser: string = \"root\",\n    private sshPort: number = 22,\n    private env?: Record<string, string>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (!this.env || Object.keys(this.env).length === 0) {\n      const sshCmd =\n        this.sshPort === 22\n          ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`\n          : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;\n      const hostExecutor = new HostExecutor();\n      return hostExecutor.exec(sshCmd, options);\n    }\n\n    return new Promise((resolve, reject) => {\n      const sshArgs = [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"ConnectTimeout=10\"];\n      if (this.sshPort !== 22) {\n        sshArgs.push(\"-p\", String(this.sshPort));\n      }\n      sshArgs.push(`${this.sshUser}@${this.vmId}`, \"sh\", \"-se\");\n\n      const child = spawn(\"ssh\", sshArgs, {\n        detached: true,\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n      let settled = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              if (child.pid) killProcessTree(child.pid);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.on(\"error\", (error) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n        reject(error);\n      });\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stdin?.on(\"error\", (error) => {\n        stderr += `${error.message}\\n`;\n      });\n      child.stdin?.end(buildRemoteScript(command, this.env));\n\n      child.on(\"close\", (code) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: \"/workspace\",\n    };\n  }\n\n  getSandboxConfig(): FirecrackerSandboxConfig {\n    return {\n      type: \"firecracker\",\n      vmId: this.vmId,\n      hostPath: this.hostPath,\n      sshUser: this.sshUser,\n      sshPort: this.sshPort,\n    };\n  }\n}\n\nfunction buildRemoteScript(command: string, env?: Record<string, string>): string {\n  const exports = env\n    ? Object.entries(env)\n        .map(([key, value]) => {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n            throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);\n          }\n          return `export ${key}=${shellEscape(value)}`;\n        })\n        .join(\"\\n\") + \"\\n\"\n    : \"\";\n  return `${exports}${command}\\n`;\n}\n\nexport const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig> = {\n  type: \"firecracker\",\n  parse: parseFirecrackerSandboxArg,\n  validate: validateFirecrackerSandbox,\n  createExecutor: (config, env) =>\n    new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),\n};\n"]}
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAStC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtE,SAAS,0BAA0B,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/C,oEAAoE;IACpE,gDAAgD;IAChD,qDAAqD;IACrD,wDAAwD;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CACpB,2DAA2D;YACzD,oEAAoE;YACpE,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,yDAAyD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,MAAgC;IACxE,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,sEAAsE,EACtE,CAAC,yEAAyE,CAAC,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,YAAY,CAAC,0BAA0B,MAAM,CAAC,IAAI,mBAAmB,EAAE;gBAC/E,iCAAiC,MAAM,CAAC,IAAI,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;YAC9E,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,QAAQ,mBAAmB,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,OAAO,mBAAmB;IAC9B,YACU,IAAY,EACZ,QAAgB,EAChB,OAAO,GAAW,MAAM,EACxB,OAAO,GAAW,EAAE,EACpB,GAA4B;oBAJ5B,IAAI;wBACJ,QAAQ;uBACR,OAAO;uBACP,OAAO;mBACP,GAAG;IACV,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,EAAE;gBACjB,CAAC,CAAC,wDAAwD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE;gBACnH,CAAC,CAAC,2DAA2D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3I,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAE1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;gBAClC,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAEvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO;YACL,iBAAiB;YACjB,oBAAoB,EAAE,YAAY;SACnC,CAAC;IACJ,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,GAA4B;IACtE,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;aAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,YAAY,CAAC,sDAAsD,GAAG,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,UAAU,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACtB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,OAAO,GAAG,OAAO,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAA6C;IACjF,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,0BAA0B;IACjC,QAAQ,EAAE,0BAA0B;IACpC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAC9B,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;CAC7F,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  FirecrackerSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { execSimple, killProcessTree, shellEscape } from \"./utils.js\";\n\nfunction parseFirecrackerSandboxArg(value: string): FirecrackerSandboxConfig | undefined {\n  if (!value.startsWith(\"firecracker:\")) {\n    return undefined;\n  }\n\n  const arg = value.slice(\"firecracker:\".length);\n  // Format: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\n  // Example: firecracker:vm1:/home/user/workspace\n  //          firecracker:vm1:/home/user/workspace:root\n  //          firecracker:vm1:/home/user/workspace:root:22\n  const parts = arg.split(\":\");\n  if (parts.length < 2) {\n    throw new SandboxError(\n      \"Error: firecracker sandbox requires vm-id and host-path\\n\" +\n        \"Usage: firecracker:<vm-id>:<host-path>[:<ssh-user>[:<ssh-port>]]\\n\" +\n        \"Example: firecracker:vm1:/home/user/workspace\",\n    );\n  }\n  const vmId = parts[0];\n  const hostPath = parts[1];\n  const sshUser = parts[2] || \"root\";\n  const sshPort = parts[3] ? parseInt(parts[3], 10) : 22;\n\n  if (!vmId || !hostPath) {\n    throw new SandboxError(\"Error: firecracker sandbox requires vm-id and host-path\");\n  }\n  if (isNaN(sshPort) || sshPort <= 0 || sshPort > 65535) {\n    throw new SandboxError(\"Error: invalid SSH port\");\n  }\n  return { type: \"firecracker\", vmId, hostPath, sshUser, sshPort };\n}\n\nasync function validateFirecrackerSandbox(config: FirecrackerSandboxConfig): Promise<void> {\n  // Check if fc-agent or firecracker CLI is available\n  try {\n    await execSimple(\"fc-agent\", [\"--version\"]);\n  } catch {\n    // Try alternative: firecracker\n    try {\n      await execSimple(\"firecracker\", [\"--version\"]);\n    } catch {\n      throw new SandboxError(\n        \"Error: Firecracker tools (fc-agent or firecracker) not found in PATH\",\n        [\"Install firecracker: https://github.com/firecracker-microvm/firecracker\"],\n      );\n    }\n  }\n\n  // Check if VM is running using fc-agent\n  try {\n    const result = await execSimple(\"fc-agent\", [\"status\", config.vmId]);\n    if (!result.includes(\"running\") && !result.includes(\"Running\")) {\n      throw new SandboxError(`Error: Firecracker VM '${config.vmId}' is not running.`, [\n        `Start it with: fc-agent start ${config.vmId}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    // Try alternative: firecracker-ctl or direct check\n    try {\n      await execSimple(\"firecracker-ctl\", [\"status\", config.vmId]);\n    } catch {\n      console.error(`Warning: Could not verify if VM '${config.vmId}' is running.`);\n      console.error(\"Make sure the VM is started before running mikan.\");\n    }\n  }\n\n  // Verify host path exists\n  try {\n    await execSimple(\"ls\", [\"-d\", config.hostPath]);\n  } catch {\n    throw new SandboxError(`Error: Host path '${config.hostPath}' does not exist.`);\n  }\n\n  console.log(`  Firecracker VM '${config.vmId}' configured with workspace '${config.hostPath}'.`);\n}\n\nexport class FirecrackerExecutor implements Executor {\n  constructor(\n    private vmId: string,\n    private hostPath: string,\n    private sshUser: string = \"root\",\n    private sshPort: number = 22,\n    private env?: Record<string, string>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (!this.env || Object.keys(this.env).length === 0) {\n      const sshCmd =\n        this.sshPort === 22\n          ? `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`\n          : `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p ${this.sshPort} ${this.sshUser}@${this.vmId} sh -c ${shellEscape(command)}`;\n      const hostExecutor = new HostExecutor();\n      return hostExecutor.exec(sshCmd, options);\n    }\n\n    return new Promise((resolve, reject) => {\n      const sshArgs = [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"ConnectTimeout=10\"];\n      if (this.sshPort !== 22) {\n        sshArgs.push(\"-p\", String(this.sshPort));\n      }\n      sshArgs.push(`${this.sshUser}@${this.vmId}`, \"sh\", \"-se\");\n\n      const child = spawn(\"ssh\", sshArgs, {\n        detached: true,\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n      let settled = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              if (child.pid) killProcessTree(child.pid);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.on(\"error\", (error) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n        reject(error);\n      });\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stdin?.on(\"error\", (error) => {\n        stderr += `${error.message}\\n`;\n      });\n      child.stdin?.end(buildRemoteScript(command, this.env));\n\n      child.on(\"close\", (code) => {\n        if (settled) return;\n        settled = true;\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return \"/workspace\";\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return {\n      hostWorkspaceRoot,\n      runtimeWorkspaceRoot: \"/workspace\",\n    };\n  }\n\n  getSandboxConfig(): FirecrackerSandboxConfig {\n    return {\n      type: \"firecracker\",\n      vmId: this.vmId,\n      hostPath: this.hostPath,\n      sshUser: this.sshUser,\n      sshPort: this.sshPort,\n    };\n  }\n}\n\nfunction buildRemoteScript(command: string, env?: Record<string, string>): string {\n  const exports = env\n    ? Object.entries(env)\n        .map(([key, value]) => {\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n            throw new SandboxError(`Invalid environment variable name for firecracker: ${key}`);\n          }\n          return `export ${key}=${shellEscape(value)}`;\n        })\n        .join(\"\\n\") + \"\\n\"\n    : \"\";\n  return `${exports}${command}\\n`;\n}\n\nexport const firecrackerSandboxAdapter: SandboxAdapter<FirecrackerSandboxConfig> = {\n  type: \"firecracker\",\n  parse: parseFirecrackerSandboxArg,\n  validate: validateFirecrackerSandbox,\n  createExecutor: (config, env) =>\n    new FirecrackerExecutor(config.vmId, config.hostPath, config.sshUser, config.sshPort, env),\n};\n"]}