@geminixiang/mikan 1.0.0-beta.9 → 1.0.0-beta.90

package/dist/sandbox/host.d.ts

@@ -1,6 +1,9 @@
 import type { ExecOptions, ExecResult, Executor, HostSandboxConfig, RuntimePathContext, SandboxAdapter } from "./types.js";
 export declare class HostExecutor implements Executor {
     exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    readFile(path: string): Promise<string>;
+    readFileBase64(path: string): Promise<string>;
+    writeFile(path: string, content: string): Promise<void>;
     getWorkspacePath(hostPath: string): string;
     getPathContext(hostWorkspaceRoot: string): RuntimePathContext;
     getSandboxConfig(): HostSandboxConfig;

package/dist/sandbox/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AAWpB,qBAAa,YAAa,YAAW,QAAQ;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuEtE;IAED,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,iBAAiB,CAEpC;CACF;AAED,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,iBAAiB,CAIhE,CAAC"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AAiBpB,qBAAa,YAAa,YAAW,QAAQ;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAsCtE;IAEK,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5C;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAElD;IAEK,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5D;IAED,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,iBAAiB,CAEpC;CACF;AAsBD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,iBAAiB,CAMhE,CAAC"}

package/dist/sandbox/host.js

@@ -1,6 +1,8 @@
-import { spawn } from "child_process";
-import { killProcessTree } from "./utils.js";
-import { createMountedRuntimePathContext } from "./path-context.js";
+import { spawn } from "node:child_process";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from "./utils.js";
+const MAX_CAPTURE_CHARS = 10 * 1024 * 1024;
 function parseHostSandboxArg(value) {
     if (value === "host") {
         return { type: "host" };
@@ -10,14 +12,8 @@ function parseHostSandboxArg(value) {
 export class HostExecutor {
     async exec(command, options) {
         return new Promise((resolve, reject) => {
-            const shell = process.platform === "win32" ? "cmd" : "sh";
-            const shellArgs = process.platform === "win32" ? ["/c"] : ["-c"];
-            const child = spawn(shell, [...shellArgs, command], {
-                detached: true,
-                stdio: ["ignore", "pipe", "pipe"],
-            });
-            let stdout = "";
-            let stderr = "";
+            const child = spawnShell(command, options?.cwd);
+            const capture = captureOutput(child);
             let timedOut = false;
             const timeoutHandle = options?.timeout && options.timeout > 0
                 ? setTimeout(() => {
@@ -25,36 +21,15 @@ export class HostExecutor {
                     killProcessTree(child.pid);
                 }, options.timeout * 1000)
                 : undefined;
-            const onAbort = () => {
+            const unlinkSignal = linkAbortSignal(options?.signal, () => {
                 if (child.pid)
                     killProcessTree(child.pid);
-            };
-            if (options?.signal) {
-                if (options.signal.aborted) {
-                    onAbort();
-                }
-                else {
-                    options.signal.addEventListener("abort", onAbort, { once: true });
-                }
-            }
-            child.stdout?.on("data", (data) => {
-                stdout += data.toString();
-                if (stdout.length > 10 * 1024 * 1024) {
-                    stdout = stdout.slice(0, 10 * 1024 * 1024);
-                }
-            });
-            child.stderr?.on("data", (data) => {
-                stderr += data.toString();
-                if (stderr.length > 10 * 1024 * 1024) {
-                    stderr = stderr.slice(0, 10 * 1024 * 1024);
-                }
             });
             child.on("close", (code) => {
                 if (timeoutHandle)
                     clearTimeout(timeoutHandle);
-                if (options?.signal) {
-                    options.signal.removeEventListener("abort", onAbort);
-                }
+                unlinkSignal();
+                const { stdout, stderr } = capture;
                 if (options?.signal?.aborted) {
                     reject(new Error(`${stdout}\n${stderr}\nCommand aborted`.trim()));
                     return;
@@ -67,6 +42,18 @@ export class HostExecutor {
             });
         });
     }
+    async readFile(path) {
+        return readFile(path, "utf-8");
+    }
+    async readFileBase64(path) {
+        return (await readFile(path)).toString("base64");
+    }
+    async writeFile(path, content) {
+        await mkdir(dirname(path), { recursive: true });
+        const stage = `${path}.mikan-stage`;
+        await writeFile(stage, content, "utf-8");
+        await rename(stage, path);
+    }
     getWorkspacePath(hostPath) {
         return hostPath;
     }
@@ -77,8 +64,28 @@ export class HostExecutor {
         return { type: "host" };
     }
 }
+function spawnShell(command, cwd) {
+    const isWindows = process.platform === "win32";
+    return spawn(isWindows ? "cmd" : "sh", [isWindows ? "/c" : "-c", command], {
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        cwd: cwd ? cwd : undefined,
+    });
+}
+function captureOutput(child) {
+    const capture = { stdout: "", stderr: "" };
+    for (const stream of ["stdout", "stderr"]) {
+        child[stream]?.setEncoding("utf8");
+        child[stream]?.on("data", (chunk) => {
+            capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);
+        });
+    }
+    return capture;
+}
 export const hostSandboxAdapter = {
     type: "host",
+    credentials: { env: false, fileMounts: false },
+    workspace: { managedProjection: false },
     parse: parseHostSandboxArg,
     createExecutor: () => new HostExecutor(),
 };

package/dist/sandbox/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAStC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAEjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;gBAClD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { spawn } from \"child_process\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { killProcessTree } from \"./utils.js\";\nimport { createMountedRuntimePathContext } from \"./path-context.js\";\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const shell = process.platform === \"win32\" ? \"cmd\" : \"sh\";\n      const shellArgs = process.platform === \"win32\" ? [\"/c\"] : [\"-c\"];\n\n      const child = spawn(shell, [...shellArgs, command], {\n        detached: true,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      });\n\n      let stdout = \"\";\n      let stderr = \"\";\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const onAbort = () => {\n        if (child.pid) killProcessTree(child.pid);\n      };\n\n      if (options?.signal) {\n        if (options.signal.aborted) {\n          onAbort();\n        } else {\n          options.signal.addEventListener(\"abort\", onAbort, { once: true });\n        }\n      }\n\n      child.stdout?.on(\"data\", (data) => {\n        stdout += data.toString();\n        if (stdout.length > 10 * 1024 * 1024) {\n          stdout = stdout.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.stderr?.on(\"data\", (data) => {\n        stderr += data.toString();\n        if (stderr.length > 10 * 1024 * 1024) {\n          stderr = stderr.slice(0, 10 * 1024 * 1024);\n        }\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        if (options?.signal) {\n          options.signal.removeEventListener(\"abort\", onAbort);\n        }\n\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;gBACzD,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,YAAY,EAAE,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;gBACnC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACzE,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from \"./utils.js\";\n\nconst MAX_CAPTURE_CHARS = 10 * 1024 * 1024;\n\ninterface Capture {\n  stdout: string;\n  stderr: string;\n}\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const child = spawnShell(command, options?.cwd);\n      const capture = captureOutput(child);\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const unlinkSignal = linkAbortSignal(options?.signal, () => {\n        if (child.pid) killProcessTree(child.pid);\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        unlinkSignal();\n\n        const { stdout, stderr } = capture;\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  async readFile(path: string): Promise<string> {\n    return readFile(path, \"utf-8\");\n  }\n\n  async readFileBase64(path: string): Promise<string> {\n    return (await readFile(path)).toString(\"base64\");\n  }\n\n  async writeFile(path: string, content: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true });\n    const stage = `${path}.mikan-stage`;\n    await writeFile(stage, content, \"utf-8\");\n    await rename(stage, path);\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nfunction spawnShell(command: string, cwd?: string): ChildProcess {\n  const isWindows = process.platform === \"win32\";\n  return spawn(isWindows ? \"cmd\" : \"sh\", [isWindows ? \"/c\" : \"-c\", command], {\n    detached: true,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    cwd: cwd ? cwd : undefined,\n  });\n}\n\nfunction captureOutput(child: ChildProcess): Capture {\n  const capture: Capture = { stdout: \"\", stderr: \"\" };\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    child[stream]?.setEncoding(\"utf8\");\n    child[stream]?.on(\"data\", (chunk: string) => {\n      capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);\n    });\n  }\n  return capture;\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  credentials: { env: false, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}

package/dist/sandbox/identity.d.ts

@@ -0,0 +1,12 @@
+import type { OfficeAddress } from "../types.js";
+import type { CredentialScope, SandboxConfig } from "./types.js";
+export declare function credentialAuthorizationKey(baseConfig: SandboxConfig, scope: CredentialScope): string;
+export declare function userCredentialKey(userId: string): string;
+export declare function containerCredentialKey(container: string): string;
+export declare function runtimeResourceKey(baseConfig: SandboxConfig, ids: {
+    userId: string;
+    address: OfficeAddress;
+}): string;
+export declare function sanitizeIdentitySegment(value: string): string;
+export declare function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/sandbox/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIjE,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,aAAa,EACzB,KAAK,EAAE,eAAe,GACrB,MAAM,CAIR;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC9C,MAAM,CAIR;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/sandbox/identity.js

@@ -0,0 +1,42 @@
+import { createHash } from "node:crypto";
+import { officeKey } from "../office/index.js";
+const IDENTITY_HASH_LENGTH = 12;
+export function credentialAuthorizationKey(baseConfig, scope) {
+    if (baseConfig.type === "host")
+        return userCredentialKey(scope.userId);
+    if (baseConfig.type === "container")
+        return containerCredentialKey(baseConfig.container);
+    return officeKey(scope.address);
+}
+export function userCredentialKey(userId) {
+    return identityKey("user", userId);
+}
+export function containerCredentialKey(container) {
+    return identityKey("container", container);
+}
+export function runtimeResourceKey(baseConfig, ids) {
+    if (baseConfig.type === "container")
+        return identityKey("container", baseConfig.container);
+    if (baseConfig.type === "host")
+        return identityKey("user", ids.userId);
+    return officeKey(ids.address);
+}
+export function sanitizeIdentitySegment(value) {
+    const sanitized = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return sanitized || "unknown";
+}
+export function scopeCloudflareSandboxId(baseId, resourceKey) {
+    return `${baseId}-${resourceKey}`;
+}
+function identityKey(kind, value) {
+    const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, "") || "unknown";
+    const hash = createHash("sha256")
+        .update(`${kind}\0${value}`)
+        .digest("hex")
+        .slice(0, IDENTITY_HASH_LENGTH);
+    return `${readable}-${hash}`;
+}
+//# sourceMappingURL=identity.js.map

package/dist/sandbox/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/sandbox/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,0BAA0B,CACxC,UAAyB,EACzB,KAAsB;IAEtB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,sBAAsB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAmB;IAC1E,OAAO,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAA0B,EAAE,KAAa;IAC5D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAClC,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { officeKey } from \"../office/index.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport type { CredentialScope, SandboxConfig } from \"./types.js\";\n\nconst IDENTITY_HASH_LENGTH = 12;\n\nexport function credentialAuthorizationKey(\n  baseConfig: SandboxConfig,\n  scope: CredentialScope,\n): string {\n  if (baseConfig.type === \"host\") return userCredentialKey(scope.userId);\n  if (baseConfig.type === \"container\") return containerCredentialKey(baseConfig.container);\n  return officeKey(scope.address);\n}\n\nexport function userCredentialKey(userId: string): string {\n  return identityKey(\"user\", userId);\n}\n\nexport function containerCredentialKey(container: string): string {\n  return identityKey(\"container\", container);\n}\n\nexport function runtimeResourceKey(\n  baseConfig: SandboxConfig,\n  ids: { userId: string; address: OfficeAddress },\n): string {\n  if (baseConfig.type === \"container\") return identityKey(\"container\", baseConfig.container);\n  if (baseConfig.type === \"host\") return identityKey(\"user\", ids.userId);\n  return officeKey(ids.address);\n}\n\nexport function sanitizeIdentitySegment(value: string): string {\n  const sanitized = value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"unknown\";\n}\n\nexport function scopeCloudflareSandboxId(baseId: string, resourceKey: string): string {\n  return `${baseId}-${resourceKey}`;\n}\n\nfunction identityKey(kind: \"user\" | \"container\", value: string): string {\n  const readable = sanitizeIdentitySegment(value).slice(0, 40).replace(/-+$/g, \"\") || \"unknown\";\n  const hash = createHash(\"sha256\")\n    .update(`${kind}\\0${value}`)\n    .digest(\"hex\")\n    .slice(0, IDENTITY_HASH_LENGTH);\n  return `${readable}-${hash}`;\n}\n"]}

package/dist/sandbox/index.d.ts

@@ -1,17 +1,7 @@
-import { ContainerExecutor } from "./container.js";
-import { FirecrackerExecutor } from "./firecracker.js";
-import { CloudflareSandboxExecutor } from "./cloudflare.js";
-import { HostExecutor } from "./host.js";
-import type { Executor, SandboxAdapter, SandboxConfig } from "./types.js";
 export type { CloudflareSandboxConfig, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter, SandboxConfig, } from "./types.js";
-export { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, HostExecutor };
-export { SandboxError } from "./errors.js";
-declare const sandboxAdapters: readonly [SandboxAdapter<import("./types.js").HostSandboxConfig>, SandboxAdapter<import("./types.js").ContainerSandboxConfig>, SandboxAdapter<import("./types.js").ImageSandboxConfig>, SandboxAdapter<import("./types.js").FirecrackerSandboxConfig>, SandboxAdapter<import("./types.js").CloudflareSandboxConfig>];
-export declare function getSandboxAdapters(): readonly [...typeof sandboxAdapters];
-export declare function parseSandboxArg(value: string): SandboxConfig;
-export declare function validateSandbox(config: SandboxConfig): Promise<void>;
-/**
- * Create an executor that runs commands on host, in Docker, in a Firecracker VM, or through a Cloudflare sandbox bridge.
- */
-export declare function createExecutor(config: SandboxConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;
+export { CloudflareSandboxExecutor } from "./cloudflare.js";
+export { ContainerExecutor } from "./container.js";
+export { HostExecutor } from "./host.js";
+export { SandboxError } from "./utils.js";
+export { assertSandboxSupportsWorkspacePolicy, createExecutor, getSandboxAdapters, getSandboxCredentialCapabilities, getSandboxWorkspaceCapabilities, getUnresolvedSandboxPathContext, parseSandboxArg, validateSandbox, } from "./registry.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAA6B,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,QAAA,MAAM,eAAe,sTAMX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CASV"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,kBAAkB,EAClB,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC/B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC"}

package/dist/sandbox/index.js

@@ -1,52 +1,6 @@
-import { ContainerExecutor, containerSandboxAdapter } from "./container.js";
-import { FirecrackerExecutor, firecrackerSandboxAdapter } from "./firecracker.js";
-import { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from "./cloudflare.js";
-import { HostExecutor, hostSandboxAdapter } from "./host.js";
-import { imageSandboxAdapter } from "./image.js";
-import { SandboxError } from "./errors.js";
-export { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, HostExecutor };
-export { SandboxError } from "./errors.js";
-const sandboxAdapters = [
-    hostSandboxAdapter,
-    containerSandboxAdapter,
-    imageSandboxAdapter,
-    firecrackerSandboxAdapter,
-    cloudflareSandboxAdapter,
-];
-const sandboxAdapterByType = new Map(sandboxAdapters.map((adapter) => [adapter.type, adapter]));
-export function getSandboxAdapters() {
-    return sandboxAdapters;
-}
-export function parseSandboxArg(value) {
-    for (const adapter of sandboxAdapters) {
-        const config = adapter.parse(value);
-        if (config) {
-            return config;
-        }
-    }
-    if (value.startsWith("docker:")) {
-        throw new SandboxError(`Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`);
-    }
-    throw new SandboxError(`Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', 'firecracker:<vm-id>:<host-path>', or 'cloudflare:<sandbox-id>'`);
-}
-export async function validateSandbox(config) {
-    const adapter = sandboxAdapterByType.get(config.type);
-    if (!adapter) {
-        throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);
-    }
-    await adapter.validate?.(config);
-}
-/**
- * Create an executor that runs commands on host, in Docker, in a Firecracker VM, or through a Cloudflare sandbox bridge.
- */
-export function createExecutor(config, env, ensureReady) {
-    const adapter = sandboxAdapterByType.get(config.type);
-    if (!adapter) {
-        throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);
-    }
-    if (!adapter.createExecutor) {
-        throw new SandboxError("Error: image sandbox must resolve to a concrete container executor");
-    }
-    return adapter.createExecutor(config, env, ensureReady);
-}
+export { CloudflareSandboxExecutor } from "./cloudflare.js";
+export { ContainerExecutor } from "./container.js";
+export { HostExecutor } from "./host.js";
+export { SandboxError } from "./utils.js";
+export { assertSandboxSupportsWorkspacePolicy, createExecutor, getSandboxAdapters, getSandboxCredentialCapabilities, getSandboxWorkspaceCapabilities, getUnresolvedSandboxPathContext, parseSandboxArg, validateSandbox, } from "./registry.js";
 //# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAY3C,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,yBAAyB;IACzB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,oIAAoI,CAC1K,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["import { ContainerExecutor, containerSandboxAdapter } from \"./container.js\";\nimport { FirecrackerExecutor, firecrackerSandboxAdapter } from \"./firecracker.js\";\nimport { CloudflareSandboxExecutor, cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { HostExecutor, hostSandboxAdapter } from \"./host.js\";\nimport { imageSandboxAdapter } from \"./image.js\";\nimport { SandboxError } from \"./errors.js\";\nimport type { Executor, SandboxAdapter, SandboxConfig } from \"./types.js\";\n\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport { CloudflareSandboxExecutor, ContainerExecutor, FirecrackerExecutor, HostExecutor };\nexport { SandboxError } from \"./errors.js\";\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  firecrackerSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', 'firecracker:<vm-id>:<host-path>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n\n  await adapter.validate?.(config);\n}\n\n/**\n * Create an executor that runs commands on host, in Docker, in a Firecracker VM, or through a Cloudflare sandbox bridge.\n */\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = sandboxAdapterByType.get(config.type);\n  if (!adapter) {\n    throw new SandboxError(`Error: Unsupported sandbox type '${config.type}'`);\n  }\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,kBAAkB,EAClB,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC/B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC","sourcesContent":["export type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\nexport { CloudflareSandboxExecutor } from \"./cloudflare.js\";\nexport { ContainerExecutor } from \"./container.js\";\nexport { HostExecutor } from \"./host.js\";\nexport { SandboxError } from \"./utils.js\";\nexport {\n  assertSandboxSupportsWorkspacePolicy,\n  createExecutor,\n  getSandboxAdapters,\n  getSandboxCredentialCapabilities,\n  getSandboxWorkspaceCapabilities,\n  getUnresolvedSandboxPathContext,\n  parseSandboxArg,\n  validateSandbox,\n} from \"./registry.js\";\n"]}

package/dist/sandbox/layout.d.ts

@@ -0,0 +1,5 @@
+export declare const GUEST_WORKSPACE_ROOT = "/workspace";
+export declare function guestWorkspacePath(relativePath: string): string;
+export declare function guestPublicOfficePath(officeKey: string): string;
+export declare function guestHomePath(relativePath: string): string;
+//# sourceMappingURL=layout.d.ts.map

package/dist/sandbox/layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/sandbox/layout.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAIjD,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/sandbox/layout.js

@@ -0,0 +1,13 @@
+export const GUEST_WORKSPACE_ROOT = "/workspace";
+const GUEST_PUBLIC_OFFICES_DIR = `${GUEST_WORKSPACE_ROOT}/public`;
+const GUEST_HOME = "/root";
+export function guestWorkspacePath(relativePath) {
+    return `${GUEST_WORKSPACE_ROOT}/${relativePath.replace(/^\/+/, "")}`;
+}
+export function guestPublicOfficePath(officeKey) {
+    return `${GUEST_PUBLIC_OFFICES_DIR}/${officeKey}`;
+}
+export function guestHomePath(relativePath) {
+    return `${GUEST_HOME}/${relativePath.replace(/^\/+/, "")}`;
+}
+//# sourceMappingURL=layout.js.map

package/dist/sandbox/layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/sandbox/layout.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,wBAAwB,GAAG,GAAG,oBAAoB,SAAS,CAAC;AAClE,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,OAAO,GAAG,oBAAoB,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,GAAG,wBAAwB,IAAI,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB;IAChD,OAAO,GAAG,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC","sourcesContent":["export const GUEST_WORKSPACE_ROOT = \"/workspace\";\nconst GUEST_PUBLIC_OFFICES_DIR = `${GUEST_WORKSPACE_ROOT}/public`;\nconst GUEST_HOME = \"/root\";\n\nexport function guestWorkspacePath(relativePath: string): string {\n  return `${GUEST_WORKSPACE_ROOT}/${relativePath.replace(/^\\/+/, \"\")}`;\n}\n\nexport function guestPublicOfficePath(officeKey: string): string {\n  return `${GUEST_PUBLIC_OFFICES_DIR}/${officeKey}`;\n}\n\nexport function guestHomePath(relativePath: string): string {\n  return `${GUEST_HOME}/${relativePath.replace(/^\\/+/, \"\")}`;\n}\n"]}

package/dist/sandbox/provisioner.d.ts

@@ -0,0 +1,64 @@
+import type { DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus } from "../types.js";
+export declare class DockerContainerManager {
+    private readonly image;
+    private state;
+    private inflight;
+    private keyQueues;
+    private static readonly MANAGED_LABEL;
+    private static readonly IMAGE_MODE_LABEL;
+    private static readonly VAULT_ID_LABEL_KEY;
+    private static readonly CONVERSATION_ID_LABEL_KEY;
+    private static readonly MOUNT_SIGNATURE_LABEL_KEY;
+    private readonly limits?;
+    private readonly boostLimits?;
+    private readonly boostedKeys;
+    private readonly overrideLimits;
+    private readonly execFileImpl;
+    constructor(image: string, options?: DockerContainerManagerOptions);
+    static containerName(containerKey: string): string;
+    static networkName(containerKey: string): string;
+    private serialize;
+    provision(containerKey: string, options?: ProvisionOptions): Promise<string>;
+    private provisionInner;
+    boost(containerKey: string): Promise<SandboxLimitStatus>;
+    setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;
+    getLimitStatus(containerKey: string): SandboxLimitStatus;
+    getDefaultLimits(): ResourceLimits | undefined;
+    getBoostLimits(): ResourceLimits | undefined;
+    stop(containerKey: string): Promise<void>;
+    private stopInner;
+    remove(containerKey: string): Promise<void>;
+    private removeInner;
+    stopIdle(maxIdleMs: number): Promise<void>;
+    reconcile(workspaceRoot: string): Promise<void>;
+    private setState;
+    private getContainerName;
+    private mountArgs;
+    private toBindSpec;
+    private runContainer;
+    private effectiveLimits;
+    private resourceLimitArgs;
+    private applyResourceLimits;
+    private runtimeDrift;
+    private hasBindMountDrift;
+    private expectedBinds;
+    private sameBinds;
+    private hasMountSignatureDrift;
+    private mountSignature;
+    private mountSourceFingerprint;
+    private inspectBindMounts;
+    private hasImageDrift;
+    private localImageId;
+    private replaceContainer;
+    private hasNetworkModeDrift;
+    private ensureNetwork;
+    private inspectStatus;
+    private listContainerNamesByLabel;
+    private parseNameLines;
+    private inspectContainerDetails;
+    private normalizeDockerValue;
+    private parseDockerTimestamp;
+    private containerKeyFromContainerName;
+    private forceRemoveContainer;
+}
+//# sourceMappingURL=provisioner.d.ts.map

package/dist/sandbox/provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAIrB,qBAAa,sBAAsB;IAiB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAE9C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IAgCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAavB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;YAEa,WAAW;IAyBnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAa1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,aAAa;YAYb,YAAY;YAeZ,gBAAgB;YAehB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;IAmBvC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IAuBrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;CAgBnC"}