@geminixiang/mikan 1.0.0-beta.78 → 1.0.0-beta.79

package/dist/sandbox/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AA8FpB,qBAAa,iBAAkB,YAAW,QAAQ;IAI9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IALtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IAEnD,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtE;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAQ1E,CAAC"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AA+FpB,qBAAa,iBAAkB,YAAW,QAAQ;IAI9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IALtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IAEnD,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtE;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAQ1E,CAAC"}

package/dist/sandbox/container.js

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { SandboxError, createMountedRuntimePathContext, execReadFile, execReadFileBase64, execSimple, execWriteFile, shellEscape, } from "./utils.js";
 import { HostExecutor } from "./host.js";
 import { GUEST_WORKSPACE_ROOT } from "./layout.js";
+import { errorMessage } from "../unknown-values.js";
 const PRIVATE_DIR_MODE = 0o700;
 const PRIVATE_FILE_MODE = 0o600;
 function parseContainerSandboxArg(value) {
@@ -129,7 +130,7 @@ async function ensureContainerRunning(container) {
         await execSimple("docker", ["start", container]);
     }
     catch (error) {
-        const details = error instanceof Error ? error.message : String(error);
+        const details = errorMessage(error);
         throw new Error(`Container "${container}" is not available. ` +
             `Expected a pre-existing container or image provisioning to keep it running.\n${details}`.trim(), { cause: error });
     }

package/dist/sandbox/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EACL,YAAY,EACZ,+BAA+B,EAC/B,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,OAAe,EACf,WAAoB,EACpB,GAAY;IAEZ,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,eAAe,OAAO,MAAM,OAAO,IAAI,SAAS,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,0BAA0B,CACjC,GAA4B;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAG5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;QAFjC,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;QAC5B,gBAAW,GAAX,WAAW,CAAsB;QAL1B,iBAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAMhD,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,OAAO,EACP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,GAAG,CACb,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACpD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAqB;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,OAAqB;QAChD,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,OAAqB;QAC5D,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport {\n  SandboxError,\n  createMountedRuntimePathContext,\n  execReadFile,\n  execReadFileBase64,\n  execSimple,\n  execWriteFile,\n  shellEscape,\n} from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n  cwd?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);\n  return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${shellEscape(command)}`;\n}\n\nconst GITHUB_CREDENTIAL_KEY = \"credential.https://github.com.helper\";\n\nfunction withGitHubCredentialHelper(\n  env?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!env || !hasGitHubToken(env) || env.GIT_CONFIG_COUNT !== undefined) {\n    return env;\n  }\n  return {\n    ...env,\n    GIT_CONFIG_COUNT: \"2\",\n    GIT_CONFIG_KEY_0: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_0: \"\",\n    GIT_CONFIG_KEY_1: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_1: \"!gh auth git-credential\",\n  };\n}\n\nfunction hasGitHubToken(env: Record<string, string>): boolean {\n  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  private readonly hostExecutor = new HostExecutor();\n\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const env = withGitHubCredentialHelper(this.env);\n    const temp = env ? createSecureEnvFile(env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        command,\n        temp?.envFilePath,\n        options?.cwd,\n      );\n      const { cwd: _cwd, ...hostOptions } = options ?? {};\n      return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  readFile(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFile(this, path, options);\n  }\n\n  readFileBase64(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFileBase64(this, path, options);\n  }\n\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void> {\n    return execWriteFile(this, path, content, options);\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return GUEST_WORKSPACE_ROOT;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  credentials: { env: true, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${value.replace(/\\r?\\n/g, \"\")}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EACL,YAAY,EACZ,+BAA+B,EAC/B,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,OAAe,EACf,WAAoB,EACpB,GAAY;IAEZ,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,eAAe,OAAO,MAAM,OAAO,IAAI,SAAS,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,0BAA0B,CACjC,GAA4B;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAG5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;QAFjC,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;QAC5B,gBAAW,GAAX,WAAW,CAAsB;QAL1B,iBAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAMhD,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,OAAO,EACP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,GAAG,CACb,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACpD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAqB;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,OAAqB;QAChD,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,OAAqB;QAC5D,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport {\n  SandboxError,\n  createMountedRuntimePathContext,\n  execReadFile,\n  execReadFileBase64,\n  execSimple,\n  execWriteFile,\n  shellEscape,\n} from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\nimport { errorMessage } from \"../unknown-values.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n  cwd?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);\n  return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${shellEscape(command)}`;\n}\n\nconst GITHUB_CREDENTIAL_KEY = \"credential.https://github.com.helper\";\n\nfunction withGitHubCredentialHelper(\n  env?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!env || !hasGitHubToken(env) || env.GIT_CONFIG_COUNT !== undefined) {\n    return env;\n  }\n  return {\n    ...env,\n    GIT_CONFIG_COUNT: \"2\",\n    GIT_CONFIG_KEY_0: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_0: \"\",\n    GIT_CONFIG_KEY_1: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_1: \"!gh auth git-credential\",\n  };\n}\n\nfunction hasGitHubToken(env: Record<string, string>): boolean {\n  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  private readonly hostExecutor = new HostExecutor();\n\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const env = withGitHubCredentialHelper(this.env);\n    const temp = env ? createSecureEnvFile(env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        command,\n        temp?.envFilePath,\n        options?.cwd,\n      );\n      const { cwd: _cwd, ...hostOptions } = options ?? {};\n      return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  readFile(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFile(this, path, options);\n  }\n\n  readFileBase64(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFileBase64(this, path, options);\n  }\n\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void> {\n    return execWriteFile(this, path, content, options);\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return GUEST_WORKSPACE_ROOT;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  credentials: { env: true, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = errorMessage(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${value.replace(/\\r?\\n/g, \"\")}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n"]}

package/dist/sandbox/host.js

@@ -69,7 +69,7 @@ function spawnShell(command, cwd) {
     return spawn(isWindows ? "cmd" : "sh", [isWindows ? "/c" : "-c", command], {
         detached: true,
         stdio: ["ignore", "pipe", "pipe"],
-        ...(cwd ? { cwd } : {}),
+        cwd: cwd ? cwd : undefined,
     });
 }
 function captureOutput(child) {

package/dist/sandbox/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;gBACzD,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,YAAY,EAAE,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;gBACnC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACzE,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from \"./utils.js\";\n\nconst MAX_CAPTURE_CHARS = 10 * 1024 * 1024;\n\ninterface Capture {\n  stdout: string;\n  stderr: string;\n}\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const child = spawnShell(command, options?.cwd);\n      const capture = captureOutput(child);\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const unlinkSignal = linkAbortSignal(options?.signal, () => {\n        if (child.pid) killProcessTree(child.pid);\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        unlinkSignal();\n\n        const { stdout, stderr } = capture;\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  async readFile(path: string): Promise<string> {\n    return readFile(path, \"utf-8\");\n  }\n\n  async readFileBase64(path: string): Promise<string> {\n    return (await readFile(path)).toString(\"base64\");\n  }\n\n  async writeFile(path: string, content: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true });\n    const stage = `${path}.mikan-stage`;\n    await writeFile(stage, content, \"utf-8\");\n    await rename(stage, path);\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nfunction spawnShell(command: string, cwd?: string): ChildProcess {\n  const isWindows = process.platform === \"win32\";\n  return spawn(isWindows ? \"cmd\" : \"sh\", [isWindows ? \"/c\" : \"-c\", command], {\n    detached: true,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    ...(cwd ? { cwd } : {}),\n  });\n}\n\nfunction captureOutput(child: ChildProcess): Capture {\n  const capture: Capture = { stdout: \"\", stderr: \"\" };\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    child[stream]?.setEncoding(\"utf8\");\n    child[stream]?.on(\"data\", (chunk: string) => {\n      capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);\n    });\n  }\n  return capture;\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  credentials: { env: false, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;gBACzD,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,YAAY,EAAE,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;gBACnC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACzE,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from \"./utils.js\";\n\nconst MAX_CAPTURE_CHARS = 10 * 1024 * 1024;\n\ninterface Capture {\n  stdout: string;\n  stderr: string;\n}\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const child = spawnShell(command, options?.cwd);\n      const capture = captureOutput(child);\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const unlinkSignal = linkAbortSignal(options?.signal, () => {\n        if (child.pid) killProcessTree(child.pid);\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        unlinkSignal();\n\n        const { stdout, stderr } = capture;\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  async readFile(path: string): Promise<string> {\n    return readFile(path, \"utf-8\");\n  }\n\n  async readFileBase64(path: string): Promise<string> {\n    return (await readFile(path)).toString(\"base64\");\n  }\n\n  async writeFile(path: string, content: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true });\n    const stage = `${path}.mikan-stage`;\n    await writeFile(stage, content, \"utf-8\");\n    await rename(stage, path);\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nfunction spawnShell(command: string, cwd?: string): ChildProcess {\n  const isWindows = process.platform === \"win32\";\n  return spawn(isWindows ? \"cmd\" : \"sh\", [isWindows ? \"/c\" : \"-c\", command], {\n    detached: true,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    cwd: cwd ? cwd : undefined,\n  });\n}\n\nfunction captureOutput(child: ChildProcess): Capture {\n  const capture: Capture = { stdout: \"\", stderr: \"\" };\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    child[stream]?.setEncoding(\"utf8\");\n    child[stream]?.on(\"data\", (chunk: string) => {\n      capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);\n    });\n  }\n  return capture;\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  credentials: { env: false, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}

package/dist/sandbox/identity.d.ts

@@ -1,6 +1,5 @@
 import type { OfficeAddress } from "../types.js";
 import type { CredentialScope, SandboxConfig } from "./types.js";
-export type { CredentialScope } from "./types.js";
 export declare function credentialAuthorizationKey(baseConfig: SandboxConfig, scope: CredentialScope): string;
 export declare function legacyExactCredentialAuthorizationKey(baseConfig: SandboxConfig, scope: CredentialScope): string | undefined;
 export declare function legacyConversationCredentialKey(rawConversationId: string): string;

package/dist/sandbox/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,CAIR;AAED,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,+BAA+B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC9C,MAAM,CAIR;AAED,wBAAgB,6BAA6B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIjE,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,CAIR;AAED,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,+BAA+B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC9C,MAAM,CAIR;AAED,wBAAgB,6BAA6B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/sandbox/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAM/C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,0BAA0B,CACxC,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,aAAa,UAAU,CAAC,SAAS,EAAE,CAAC;IAChF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,iBAAyB;IACvE,OAAO,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,iBAAyB;IACrE,OAAO,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAmB;IAC1E,OAAO,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAA2C,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAClC,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { officeKey } from \"../office/index.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport type { CredentialScope, SandboxConfig } from \"./types.js\";\n\nexport type { CredentialScope } from \"./types.js\";\n\nconst IDENTITY_HASH_LENGTH = 12;\n\nexport function credentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string {\n  if (baseConfig.type === \"host\") return identityKey(\"user\", scope.userId);\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  return officeKey(scope.address);\n}\n\nexport function legacyExactCredentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string | undefined {\n  if (baseConfig.type === \"host\") return scope.userId;\n  if (baseConfig.type === \"container\") return `container-${baseConfig.container}`;\n  return undefined;\n}\n\nexport function legacyConversationCredentialKey(rawConversationId: string): string {\n  return identityKey(\"conversation\", rawConversationId);\n}\n\nexport function runtimeResourceKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; address: OfficeAddress },\n): string {\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  if (baseConfig.type === \"host\") return identityKey(\"user\", ids.userId);\n  return officeKey(ids.address);\n}\n\nexport function legacyConversationResourceKey(rawConversationId: string): string {\n  return identityKey(\"conversation\", rawConversationId);\n}\n\nexport function sanitizeIdentitySegment(value: string): string {\n  const sanitized = value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"unknown\";\n}\n\nexport function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string {\n  return `${baseId}-${resourceKey}`;\n}\n\nfunction identityKey(kind: \"user\" | \"conversation\" | \"container\", value: string): string {\n  const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, \"\") || \"unknown\";\n  const hash = createHash(\"sha256\")\n    .update(`${kind}\\0${value}`)\n    .digest(\"hex\")\n    .slice(0, IDENTITY_HASH_LENGTH);\n  return `${readable}-${hash}`;\n}\n"]}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,0BAA0B,CACxC,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,aAAa,UAAU,CAAC,SAAS,EAAE,CAAC;IAChF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,iBAAyB;IACvE,OAAO,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,iBAAyB;IACrE,OAAO,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAmB;IAC1E,OAAO,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAA2C,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAClC,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { officeKey } from \"../office/index.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport type { CredentialScope, SandboxConfig } from \"./types.js\";\n\nconst IDENTITY_HASH_LENGTH = 12;\n\nexport function credentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string {\n  if (baseConfig.type === \"host\") return identityKey(\"user\", scope.userId);\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  return officeKey(scope.address);\n}\n\nexport function legacyExactCredentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string | undefined {\n  if (baseConfig.type === \"host\") return scope.userId;\n  if (baseConfig.type === \"container\") return `container-${baseConfig.container}`;\n  return undefined;\n}\n\nexport function legacyConversationCredentialKey(rawConversationId: string): string {\n  return identityKey(\"conversation\", rawConversationId);\n}\n\nexport function runtimeResourceKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; address: OfficeAddress },\n): string {\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  if (baseConfig.type === \"host\") return identityKey(\"user\", ids.userId);\n  return officeKey(ids.address);\n}\n\nexport function legacyConversationResourceKey(rawConversationId: string): string {\n  return identityKey(\"conversation\", rawConversationId);\n}\n\nexport function sanitizeIdentitySegment(value: string): string {\n  const sanitized = value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"unknown\";\n}\n\nexport function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string {\n  return `${baseId}-${resourceKey}`;\n}\n\nfunction identityKey(kind: \"user\" | \"conversation\" | \"container\", value: string): string {\n  const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, \"\") || \"unknown\";\n  const hash = createHash(\"sha256\")\n    .update(`${kind}\\0${value}`)\n    .digest(\"hex\")\n    .slice(0, IDENTITY_HASH_LENGTH);\n  return `${readable}-${hash}`;\n}\n"]}

package/dist/sandbox/index.d.ts

@@ -1,17 +1,7 @@
-import { ContainerExecutor } from "./container.js";
-import { CloudflareSandboxExecutor } from "./cloudflare.js";
-import { HostExecutor } from "./host.js";
-import type { Executor, ImageSandboxConfig, RuntimePathContext, SandboxAdapter, SandboxConfig } from "./types.js";
 export type { CloudflareSandboxConfig, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter, SandboxConfig, } from "./types.js";
-export { CloudflareSandboxExecutor, ContainerExecutor, HostExecutor };
+export { CloudflareSandboxExecutor } from "./cloudflare.js";
+export { ContainerExecutor } from "./container.js";
+export { HostExecutor } from "./host.js";
 export { SandboxError } from "./utils.js";
-declare const sandboxAdapters: readonly [SandboxAdapter<import("./types.js").HostSandboxConfig>, SandboxAdapter<import("./types.js").ContainerSandboxConfig>, SandboxAdapter<ImageSandboxConfig>, SandboxAdapter<import("./types.js").CloudflareSandboxConfig>];
-export declare function getSandboxAdapters(): readonly [...typeof sandboxAdapters];
-export declare function getSandboxCredentialCapabilities(type: SandboxConfig["type"]): SandboxAdapter["credentials"];
-export declare function getSandboxWorkspaceCapabilities(type: SandboxConfig["type"]): SandboxAdapter["workspace"];
-export declare function assertSandboxSupportsWorkspacePolicy(sandboxConfig: SandboxConfig, visibility: "public" | "private", officeKey: string): void;
-export declare function parseSandboxArg(value: string): SandboxConfig;
-export declare function validateSandbox(config: SandboxConfig): Promise<void>;
-export declare function createExecutor(config: SandboxConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;
-export declare function getUnresolvedSandboxPathContext(sandboxConfig: SandboxConfig, hostWorkspaceRoot: string): RuntimePathContext;
+export { assertSandboxSupportsWorkspacePolicy, createExecutor, getSandboxAdapters, getSandboxCredentialCapabilities, getSandboxWorkspaceCapabilities, getUnresolvedSandboxPathContext, parseSandboxArg, validateSandbox, } from "./registry.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAA4B,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAI7D,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA+B1C,QAAA,MAAM,eAAe,kOAKX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAQD,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,aAAa,CAAC,CAE/B;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,WAAW,CAAC,CAE7B;AAID,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,QAAQ,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAChB,IAAI,CASN;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAMV;AAED,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CAMpB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,kBAAkB,EAClB,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC/B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC"}

package/dist/sandbox/index.js

@@ -1,95 +1,6 @@
-import { ContainerExecutor, containerSandboxAdapter } from "./container.js";
-import { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from "./cloudflare.js";
-import { HostExecutor, hostSandboxAdapter } from "./host.js";
-import { createMountedRuntimePathContext, execSimple, SandboxError } from "./utils.js";
-import { GUEST_WORKSPACE_ROOT } from "./layout.js";
-import * as log from "../log.js";
-export { CloudflareSandboxExecutor, ContainerExecutor, HostExecutor };
+export { CloudflareSandboxExecutor } from "./cloudflare.js";
+export { ContainerExecutor } from "./container.js";
+export { HostExecutor } from "./host.js";
 export { SandboxError } from "./utils.js";
-function parseImageSandboxArg(value) {
-    if (!value.startsWith("image:")) {
-        return undefined;
-    }
-    const image = value.slice("image:".length);
-    if (!image) {
-        throw new SandboxError("Error: image sandbox requires image name (e.g., image:ubuntu:24.04)");
-    }
-    return { type: "image", image };
-}
-async function validateImageSandbox(config) {
-    try {
-        await execSimple("docker", ["--version"]);
-    }
-    catch {
-        throw new SandboxError("Error: Docker is not installed or not in PATH");
-    }
-    console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);
-}
-const imageSandboxAdapter = {
-    type: "image",
-    credentials: { env: true, fileMounts: true },
-    workspace: { managedProjection: true },
-    parse: parseImageSandboxArg,
-    validate: validateImageSandbox,
-};
-const sandboxAdapters = [
-    hostSandboxAdapter,
-    containerSandboxAdapter,
-    imageSandboxAdapter,
-    cloudflareSandboxAdapter,
-];
-const sandboxAdapterByType = new Map(sandboxAdapters.map((adapter) => [adapter.type, adapter]));
-export function getSandboxAdapters() {
-    return sandboxAdapters;
-}
-function requireSandboxAdapter(type) {
-    const adapter = sandboxAdapterByType.get(type);
-    if (!adapter)
-        throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);
-    return adapter;
-}
-export function getSandboxCredentialCapabilities(type) {
-    return requireSandboxAdapter(type).credentials;
-}
-export function getSandboxWorkspaceCapabilities(type) {
-    return requireSandboxAdapter(type).workspace;
-}
-const warnedUnenforcedPrivacy = new Set();
-export function assertSandboxSupportsWorkspacePolicy(sandboxConfig, visibility, officeKey) {
-    const capabilities = getSandboxWorkspaceCapabilities(sandboxConfig.type);
-    if (capabilities.managedProjection || visibility === "public")
-        return;
-    if (warnedUnenforcedPrivacy.has(officeKey))
-        return;
-    warnedUnenforcedPrivacy.add(officeKey);
-    log.logWarning(`Sandbox '${sandboxConfig.type}' cannot enforce private office visibility for ${officeKey}`, "host, container, and cloudflare backends share one filesystem; use image:* to isolate private channels and DMs");
-}
-export function parseSandboxArg(value) {
-    for (const adapter of sandboxAdapters) {
-        const config = adapter.parse(value);
-        if (config) {
-            return config;
-        }
-    }
-    if (value.startsWith("docker:")) {
-        throw new SandboxError(`Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`);
-    }
-    throw new SandboxError(`Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', or 'cloudflare:<sandbox-id>'`);
-}
-export async function validateSandbox(config) {
-    await requireSandboxAdapter(config.type).validate?.(config);
-}
-export function createExecutor(config, env, ensureReady) {
-    const adapter = requireSandboxAdapter(config.type);
-    if (!adapter.createExecutor) {
-        throw new SandboxError("Error: image sandbox must resolve to a concrete container executor");
-    }
-    return adapter.createExecutor(config, env, ensureReady);
-}
-export function getUnresolvedSandboxPathContext(sandboxConfig, hostWorkspaceRoot) {
-    if (sandboxConfig.type === "image") {
-        return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);
-    }
-    return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);
-}
+export { assertSandboxSupportsWorkspacePolicy, createExecutor, getSandboxAdapters, getSandboxCredentialCapabilities, getSandboxWorkspaceCapabilities, getUnresolvedSandboxPathContext, parseSandboxArg, validateSandbox, } from "./registry.js";
 //# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAkBjC,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,qEAAqE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC5D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,mBAAmB,GAAuC;IAC9D,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5C,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;IACtC,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA2B;IACxD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,GAAG,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAA2B;IAE3B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAA2B;IAE3B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD,MAAM,UAAU,oCAAoC,CAClD,aAA4B,EAC5B,UAAgC,EAChC,SAAiB;IAEjB,MAAM,YAAY,GAAG,+BAA+B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,iBAAiB,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IACtE,IAAI,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IACnD,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,GAAG,CAAC,UAAU,CACZ,YAAY,aAAa,CAAC,IAAI,kDAAkD,SAAS,EAAE,EAC3F,gHAAgH,CACjH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,iGAAiG,CACvI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,aAA4B,EAC5B,iBAAyB;IAEzB,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,cAAc,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { ContainerExecutor, containerSandboxAdapter } from \"./container.js\";\nimport { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { HostExecutor, hostSandboxAdapter } from \"./host.js\";\nimport { createMountedRuntimePathContext, execSimple, SandboxError } from \"./utils.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\nimport * as log from \"../log.js\";\nimport type {\n  Executor,\n  ImageSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\n\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport { CloudflareSandboxExecutor, ContainerExecutor, HostExecutor };\nexport { SandboxError } from \"./utils.js\";\n\nfunction parseImageSandboxArg(value: string): ImageSandboxConfig | undefined {\n  if (!value.startsWith(\"image:\")) {\n    return undefined;\n  }\n\n  const image = value.slice(\"image:\".length);\n  if (!image) {\n    throw new SandboxError(\"Error: image sandbox requires image name (e.g., image:ubuntu:24.04)\");\n  }\n  return { type: \"image\", image };\n}\n\nasync function validateImageSandbox(config: ImageSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n  console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);\n}\n\nconst imageSandboxAdapter: SandboxAdapter<ImageSandboxConfig> = {\n  type: \"image\",\n  credentials: { env: true, fileMounts: true },\n  workspace: { managedProjection: true },\n  parse: parseImageSandboxArg,\n  validate: validateImageSandbox,\n};\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nfunction requireSandboxAdapter(type: SandboxConfig[\"type\"]): SandboxAdapter {\n  const adapter = sandboxAdapterByType.get(type);\n  if (!adapter) throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);\n  return adapter;\n}\n\nexport function getSandboxCredentialCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"credentials\"] {\n  return requireSandboxAdapter(type).credentials;\n}\n\nexport function getSandboxWorkspaceCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"workspace\"] {\n  return requireSandboxAdapter(type).workspace;\n}\n\nconst warnedUnenforcedPrivacy = new Set<string>();\n\nexport function assertSandboxSupportsWorkspacePolicy(\n  sandboxConfig: SandboxConfig,\n  visibility: \"public\" | \"private\",\n  officeKey: string,\n): void {\n  const capabilities = getSandboxWorkspaceCapabilities(sandboxConfig.type);\n  if (capabilities.managedProjection || visibility === \"public\") return;\n  if (warnedUnenforcedPrivacy.has(officeKey)) return;\n  warnedUnenforcedPrivacy.add(officeKey);\n  log.logWarning(\n    `Sandbox '${sandboxConfig.type}' cannot enforce private office visibility for ${officeKey}`,\n    \"host, container, and cloudflare backends share one filesystem; use image:* to isolate private channels and DMs\",\n  );\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  await requireSandboxAdapter(config.type).validate?.(config);\n}\n\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = requireSandboxAdapter(config.type);\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n\nexport function getUnresolvedSandboxPathContext(\n  sandboxConfig: SandboxConfig,\n  hostWorkspaceRoot: string,\n): RuntimePathContext {\n  if (sandboxConfig.type === \"image\") {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,kBAAkB,EAClB,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC/B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC","sourcesContent":["export type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport { CloudflareSandboxExecutor } from \"./cloudflare.js\";\nexport { ContainerExecutor } from \"./container.js\";\nexport { HostExecutor } from \"./host.js\";\nexport { SandboxError } from \"./utils.js\";\nexport {\n  assertSandboxSupportsWorkspacePolicy,\n  createExecutor,\n  getSandboxAdapters,\n  getSandboxCredentialCapabilities,\n  getSandboxWorkspaceCapabilities,\n  getUnresolvedSandboxPathContext,\n  parseSandboxArg,\n  validateSandbox,\n} from \"./registry.js\";\n"]}

package/dist/sandbox/provisioner.d.ts

@@ -1,4 +1,3 @@
-export type { ContainerBindTranslator, ContainerMount, DockerContainerManagerOptions, HomeVolumeMigrationOutcome, ManagedContainerInventoryEntry, ProvisionOptions, ResourceLimits, SandboxLimitStatus, } from "../types.js";
 import type { ContainerBindTranslator, DockerContainerManagerOptions, HomeVolumeMigrationOutcome, ManagedContainerInventoryEntry, ProvisionOptions, ResourceLimits, SandboxLimitStatus } from "../types.js";
 export declare class DockerContainerManager {
     private readonly image;

package/dist/sandbox/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAsCA,YAAY,EACV,uBAAuB,EACvB,cAAc,EACd,6BAA6B,EAC7B,0BAA0B,EAC1B,8BAA8B,EAC9B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,uBAAuB,EAEvB,6BAA6B,EAC7B,0BAA0B,EAC1B,8BAA8B,EAC9B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAarB,qBAAa,sBAAsB;IAqB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IApBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,cAAc,CAAC,CAA0B;IACjD,OAAO,CAAC,gBAAgB,CAAoC;IAC5D,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAmB;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAyB;IAExE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElD;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IA6CtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAgBvB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;YAEa,WAAW;IA+BnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,gCAAgC,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1F;IAED,2BAA2B,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAErE;IAEK,6BAA6B,CAAC,OAAO,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjE;IAED,OAAO,CAAC,sBAAsB;YAYhB,2BAA2B;YAkC3B,2BAA2B;YAsD3B,sBAAsB;YAiCtB,mCAAmC;YAqBnC,qBAAqB;YAarB,cAAc;YAcd,qBAAqB;YASrB,iCAAiC;YAcjC,2BAA2B;IAyBnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAqD/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAqD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAgB1B,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;IAqB/B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,iBAAiB;YAKX,aAAa;YAIb,aAAa;YAYb,YAAY;YAeZ,gBAAgB;YAchB,gBAAgB;YAchB,0BAA0B;IAelC,SAAS,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAmB3D;IAEK,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAM5D;IAED,OAAO,CAAC,gBAAgB;IAIxB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAE7E;YAEa,wBAAwB;YA6CxB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAsBzB,0BAA0B;IAoBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IAwBrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAiBpB,qBAAqB;CAOpC"}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,uBAAuB,EAEvB,6BAA6B,EAC7B,0BAA0B,EAC1B,8BAA8B,EAC9B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAerB,qBAAa,sBAAsB;IAqB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IApBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,cAAc,CAAC,CAA0B;IACjD,OAAO,CAAC,gBAAgB,CAAoC;IAC5D,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAmB;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAyB;IAExE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAE9C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElD;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IA6CtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAavB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;YAEa,WAAW;IA4BnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,gCAAgC,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1F;IAED,2BAA2B,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAErE;IAEK,6BAA6B,CAAC,OAAO,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjE;IAED,OAAO,CAAC,sBAAsB;YAYhB,2BAA2B;YAkC3B,2BAA2B;YAsD3B,sBAAsB;YAiCtB,mCAAmC;YAqBnC,qBAAqB;YAarB,cAAc;YAcd,qBAAqB;YASrB,iCAAiC;YAcjC,2BAA2B;IAyBnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAqD/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAqD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAgB1B,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;IAqB/B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,iBAAiB;YAKX,aAAa;YAIb,aAAa;YAYb,YAAY;YAeZ,gBAAgB;YAchB,gBAAgB;YAWhB,0BAA0B;IAelC,SAAS,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAmB3D;IAEK,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAM5D;IAED,OAAO,CAAC,gBAAgB;IAIxB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAE7E;YAEa,wBAAwB;YA6CxB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAmBzB,0BAA0B;IAiBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IAwBrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAiBpB,qBAAqB;CAOpC"}

package/dist/sandbox/provisioner.js

@@ -20,6 +20,7 @@ function isDockerNotFoundError(err) {
         /network [^\n]+ not found/.test(haystack) ||
         /error: no such [^\n]+/.test(haystack));
 }
+import { errorMessage } from "../unknown-values.js";
 function bindSpecToMount(bindSpec) {
     const readOnly = bindSpec.endsWith(":ro");
     const spec = readOnly ? bindSpec.slice(0, -3) : bindSpec;
@@ -27,7 +28,7 @@ function bindSpecToMount(bindSpec) {
     return {
         source: spec.slice(0, separator),
         target: spec.slice(separator + 1),
-        ...(readOnly ? { readOnly: true } : {}),
+        readOnly: readOnly ? true : undefined,
     };
 }
 export class DockerContainerManager {
@@ -169,7 +170,7 @@ export class DockerContainerManager {
             log.logInfo(`Container ${containerName} stopped (idle)`);
         }
         catch (err) {
-            log.logWarning(`Failed to stop container ${containerName}`, err instanceof Error ? err.message : String(err));
+            log.logWarning(`Failed to stop container ${containerName}`, errorMessage(err));
         }
     }
     remove(containerKey, options = {}) {
@@ -187,7 +188,7 @@ export class DockerContainerManager {
             log.logInfo(`Network ${networkName} removed`);
         }
         catch (err) {
-            log.logWarning(`Failed to remove network ${networkName}`, err instanceof Error ? err.message : String(err));
+            log.logWarning(`Failed to remove network ${networkName}`, errorMessage(err));
         }
         await this.removeMigrateSnapshot(containerName);
         if (options.purgeHome)
@@ -241,7 +242,7 @@ export class DockerContainerManager {
                 await this.migrateContainerLayout(containerName);
             }
             catch (err) {
-                log.logWarning(`Container layout migration failed for ${containerName}; leaving it in place`, err instanceof Error ? err.message : String(err));
+                log.logWarning(`Container layout migration failed for ${containerName}; leaving it in place`, errorMessage(err));
             }
             await new Promise((resolve) => setTimeout(resolve, delayMs));
         }
@@ -565,7 +566,7 @@ export class DockerContainerManager {
             await this.execFileImpl("docker", args);
         }
         catch (err) {
-            log.logWarning(`Failed to apply resource limits to container ${containerName}`, err instanceof Error ? err.message : String(err));
+            log.logWarning(`Failed to apply resource limits to container ${containerName}`, errorMessage(err));
             reportUserFacingError(err, {
                 domain: "sandbox",
                 surface: "sandbox_provision",
@@ -727,7 +728,7 @@ export class DockerContainerManager {
         catch (err) {
             if (isDockerNotFoundError(err))
                 return;
-            log.logWarning(`Failed to remove home volume ${volumeName}`, err instanceof Error ? err.message : String(err));
+            log.logWarning(`Failed to remove home volume ${volumeName}`, errorMessage(err));
         }
     }
     async replaceHomeVolumeContainer(containerKey, containerName, mounts, options) {
@@ -749,7 +750,7 @@ export class DockerContainerManager {
                 : false;
             entries.push({
                 containerName,
-                ...(containerKey ? { containerKey } : {}),
+                containerKey,
                 running: status === "running",
                 homeVolume,
                 imageStale: await this.hasImageDrift(containerName),
@@ -872,7 +873,7 @@ export class DockerContainerManager {
             return this.parseNameLines(stdout);
         }
         catch (err) {
-            log.logWarning("Failed to list labeled managed containers", err instanceof Error ? err.message : String(err));
+            log.logWarning("Failed to list labeled managed containers", errorMessage(err));
             return [];
         }
     }
@@ -889,7 +890,7 @@ export class DockerContainerManager {
             return this.parseNameLines(stdout);
         }
         catch (err) {
-            log.logWarning("Failed to list legacy managed containers", err instanceof Error ? err.message : String(err));
+            log.logWarning("Failed to list legacy managed containers", errorMessage(err));
             return [];
         }
     }
@@ -914,7 +915,7 @@ export class DockerContainerManager {
             return { running, startedAtMs, conversationId };
         }
         catch (err) {
-            log.logWarning(`Failed to inspect container ${containerName} during reconcile`, err instanceof Error ? err.message : String(err));
+            log.logWarning(`Failed to inspect container ${containerName} during reconcile`, errorMessage(err));
             return undefined;
         }
     }
@@ -945,7 +946,7 @@ export class DockerContainerManager {
             return true;
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            const message = errorMessage(err);
             if (/no such container/i.test(message))
                 return true;
             log.logWarning(failureLog, message);