@geminixiang/mikan 1.0.0-beta.9 → 1.0.0-beta.91

package/dist/harness/execution-env.js

@@ -0,0 +1,245 @@
+import { randomBytes } from "node:crypto";
+import { posix } from "node:path";
+import { ExecutionError, FileError, err, ok, } from "@earendil-works/pi-durable/env";
+import { NodeExecutionEnv } from "@earendil-works/pi-durable/env/node";
+import { execAppendFile, execWriteFile, shellEscape } from "../sandbox/utils.js";
+import { errorMessage } from "../unknown-values.js";
+const SPILL_DIR = ".mikan/bash-output";
+export function createSandboxExecutionEnv(executor, sandboxType, runtimeWorkspaceRoot) {
+    if (sandboxType === "host") {
+        return new NodeExecutionEnv({ cwd: runtimeWorkspaceRoot });
+    }
+    return new ShellExecutionEnv(executor, runtimeWorkspaceRoot);
+}
+class ShellExecutionEnv {
+    constructor(executor, runtimeWorkspaceRoot) {
+        this.executor = executor;
+        this.id = `mikan-sandbox:${randomBytes(8).toString("hex")}`;
+        this.cwd = runtimeWorkspaceRoot;
+    }
+    async absolutePath(path, _context) {
+        return ok(posix.isAbsolute(path) ? posix.normalize(path) : posix.resolve(this.cwd, path));
+    }
+    async joinPath(parts, _context) {
+        return ok(posix.join(...parts));
+    }
+    readTextFile(path, context) {
+        return this.fileOp(() => this.executor.readFile(path, this.execOptions(context)));
+    }
+    openTextLineReader(path, context) {
+        return this.fileOp(async () => {
+            const content = await this.executor.readFile(path, this.execOptions(context));
+            return new ShellTextLineReader(content);
+        });
+    }
+    async readBinaryFile(path, context) {
+        return this.fileOp(async () => Buffer.from(await this.executor.readFileBase64(path, this.execOptions(context)), "base64"));
+    }
+    readTextLines(path, options, context) {
+        return this.fileOp(async () => {
+            const max = options?.maxLines;
+            const command = max === undefined
+                ? `cat ${shellEscape(path)}`
+                : `head -n ${Math.max(0, Math.floor(max))} ${shellEscape(path)}`;
+            const { stdout } = await this.run(command, context);
+            const lines = stdout.split("\n");
+            if (lines.at(-1) === "")
+                lines.pop();
+            return lines;
+        });
+    }
+    writeFile(path, content, context) {
+        return this.fileOp(() => execWriteFile(this.executor, path, content, this.execOptions(context)));
+    }
+    appendFile(path, content, context) {
+        return this.fileOp(() => execAppendFile(this.executor, path, content, this.execOptions(context)));
+    }
+    truncateFile(path, size, context) {
+        return this.fileOp(async () => {
+            await this.run(`truncate -s ${Math.max(0, Math.floor(size))} ${shellEscape(path)}`, context);
+        });
+    }
+    flushFile(path, context) {
+        return this.fileOp(async () => {
+            await this.run(`sync ${shellEscape(path)}`, context);
+        });
+    }
+    renameFile(sourcePath, destinationPath, context) {
+        return this.fileOp(async () => {
+            await this.run(`mv -f ${shellEscape(sourcePath)} ${shellEscape(destinationPath)}`, context);
+        });
+    }
+    fileInfo(path, context) {
+        return this.fileOp(async () => {
+            const escaped = shellEscape(path);
+            const probe = await this.executor.exec(`if [ -L ${escaped} ]; then printf 'symlink'; elif [ -d ${escaped} ]; then printf 'directory'; ` +
+                `elif [ -f ${escaped} ]; then printf 'file'; else exit 1; fi`, this.execOptions(context));
+            if (probe.code !== 0)
+                throw new Error(`No such file or directory: ${path}`);
+            const kind = probe.stdout.trim();
+            let size = 0;
+            if (kind === "file") {
+                const stat = await this.executor.exec(`wc -c < ${escaped}`, this.execOptions(context));
+                if (stat.code === 0)
+                    size = Number.parseInt(stat.stdout.trim(), 10) || 0;
+            }
+            let mtimeMs = 0;
+            const mtime = await this.executor.exec(`date -r ${escaped} +%s`, this.execOptions(context));
+            if (mtime.code === 0)
+                mtimeMs = (Number.parseInt(mtime.stdout.trim(), 10) || 0) * 1000;
+            return { name: posix.basename(path), path, kind, size, mtimeMs };
+        });
+    }
+    async listDir(path, context) {
+        return this.fileOp(async () => {
+            const { stdout } = await this.run(`ls -A ${shellEscape(path)}`, context);
+            const names = stdout.split("\n").filter(Boolean).toSorted();
+            const entries = [];
+            for (const name of names) {
+                const child = posix.join(path, name);
+                const info = await this.fileInfo(child, context);
+                if (info.ok)
+                    entries.push(info.value);
+            }
+            return entries;
+        });
+    }
+    canonicalPath(path, context) {
+        return this.fileOp(async () => (await this.run(`realpath ${shellEscape(path)}`, context)).stdout.trim());
+    }
+    async exists(path, context) {
+        try {
+            const result = await this.executor.exec(`test -e ${shellEscape(path)}`, this.execOptions(context));
+            return ok(result.code === 0);
+        }
+        catch (error) {
+            return err(toFileError(error));
+        }
+    }
+    createDir(path, options, context) {
+        return this.fileOp(async () => {
+            const flag = options?.recursive === false ? "" : "-p ";
+            await this.run(`mkdir ${flag}${shellEscape(path)}`, context);
+        });
+    }
+    remove(path, options, context) {
+        return this.fileOp(async () => {
+            const recursive = options?.recursive ? "-r" : "";
+            const force = options?.force ? "-f" : "";
+            await this.run(`rm ${recursive} ${force} ${shellEscape(path)}`, context);
+        });
+    }
+    createTempDir(prefix, context) {
+        return this.fileOp(async () => {
+            const template = prefix === undefined ? "" : shellEscape(`${prefix}XXXXXX`);
+            const { stdout } = await this.run(`mktemp -d ${template}`.trim(), context);
+            return stdout.trim();
+        });
+    }
+    createTempFile(options, context) {
+        return this.fileOp(async () => {
+            const template = options?.prefix === undefined && options?.suffix === undefined
+                ? ""
+                : shellEscape(`${options?.prefix ?? ""}XXXXXX${options?.suffix ?? ""}`);
+            const { stdout } = await this.run(`mktemp ${template}`.trim(), context);
+            return stdout.trim();
+        });
+    }
+    async cleanup(_context) { }
+    async exec(command, options, context) {
+        try {
+            const result = await this.executor.exec(command, {
+                cwd: options?.cwd || undefined,
+                timeout: options?.timeout || undefined,
+                signal: context.abortSignal,
+            });
+            const combined = [result.stdout, result.stderr].filter((part) => part.length > 0).join("\n");
+            if (combined.length > 0)
+                options?.onOutput?.(combined, context);
+            return ok({ exitCode: result.code, spillPath: await this.spill(combined, options, context) });
+        }
+        catch (error) {
+            return err(toExecutionError(error, context));
+        }
+    }
+    async spill(output, options, context) {
+        const limits = options?.spill;
+        if (!limits)
+            return undefined;
+        const lines = output.split("\n").length;
+        if (Buffer.byteLength(output, "utf8") <= limits.afterBytes && lines <= limits.afterLines)
+            return undefined;
+        try {
+            const spillPath = posix.join(this.cwd, SPILL_DIR, `${randomBytes(8).toString("hex")}.log`);
+            await this.executor.writeFile(spillPath, output, this.execOptions(context));
+            return spillPath;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    execOptions(context) {
+        return { signal: context.abortSignal };
+    }
+    async run(command, context) {
+        const result = await this.executor.exec(command, this.execOptions(context));
+        if (result.code !== 0) {
+            throw new Error(result.stderr.trim() || `Command failed (${result.code}): ${command}`);
+        }
+        return result;
+    }
+    async fileOp(op) {
+        try {
+            return ok(await op());
+        }
+        catch (error) {
+            return err(toFileError(error));
+        }
+    }
+}
+class ShellTextLineReader {
+    constructor(content) {
+        this.content = content;
+        this.offset = 0;
+    }
+    async readLine(_context) {
+        if (this.offset >= this.content.length)
+            return ok(undefined);
+        const newline = this.content.indexOf("\n", this.offset);
+        if (newline === -1) {
+            const text = this.content.slice(this.offset);
+            this.offset = this.content.length;
+            return ok({ text, terminated: false });
+        }
+        const text = this.content.slice(this.offset, newline);
+        this.offset = newline + 1;
+        return ok({ text, terminated: true });
+    }
+    async close(_context) {
+        this.offset = this.content.length;
+    }
+}
+function toFileError(error) {
+    const message = errorMessage(error);
+    if (/aborted/i.test(message))
+        return new FileError("aborted", message);
+    if (/no such file|not found/i.test(message))
+        return new FileError("not_found", message);
+    if (/permission denied/i.test(message))
+        return new FileError("permission_denied", message);
+    if (/not a directory/i.test(message))
+        return new FileError("not_directory", message);
+    if (/is a directory/i.test(message))
+        return new FileError("is_directory", message);
+    return new FileError("unknown", message, undefined, error instanceof Error ? error : undefined);
+}
+function toExecutionError(error, context) {
+    const message = errorMessage(error);
+    if (context.abortSignal?.aborted || /aborted/i.test(message)) {
+        return new ExecutionError("aborted", message);
+    }
+    if (/timed out/i.test(message))
+        return new ExecutionError("timeout", message);
+    return new ExecutionError("unknown", message, error instanceof Error ? error : undefined);
+}
+//# sourceMappingURL=execution-env.js.map

package/dist/harness/execution-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-env.js","sourceRoot":"","sources":["../../src/harness/execution-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,cAAc,EACd,SAAS,EACT,GAAG,EACH,EAAE,GASH,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,WAAkC,EAClC,oBAA4B;IAE5B,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,iBAAiB;IAIrB,YACmB,QAAkB,EACnC,oBAA4B;wBADX,QAAQ;QAGzB,IAAI,CAAC,EAAE,GAAG,iBAAiB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAiB;QAChD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,QAAiB;QAC/C,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,OAAgB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,OAAgB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,aAAa,CACX,IAAY,EACZ,OAA0C,EAC1C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,QAAQ,CAAC;YAC9B,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE;gBAC5B,CAAC,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CACtB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CACtB,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,OAAgB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,OAAgB;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CACR,UAAkB,EAClB,eAAuB,EACvB,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAgB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACpC,WAAW,OAAO,wCAAwC,OAAO,+BAA+B;gBAC9F,aAAa,OAAO,yCAAyC,EAC/D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAc,CAAC;YAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;oBAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,IAAI,CAAC,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAgB;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACrC,WAAW,WAAW,CAAC,IAAI,CAAC,EAAE,EAC9B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4C,EAC5C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CACJ,IAAY,EACZ,OAA6D,EAC7D,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,MAA0B,EAAE,OAAgB;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,OAAyD,EACzD,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GACZ,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;gBAC5D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,SAAS,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAiB,IAAkB,CAAC;IAElD,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAqC,EACrC,OAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;gBAC/C,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,SAAS;gBAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS;gBACtC,MAAM,EAAE,OAAO,CAAC,WAAW;aAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,MAAc,EACd,OAAqC,EACrC,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU;YACtF,OAAO,SAAS,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3F,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAgB;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,OAAe,EACf,OAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,mBAAmB,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAI,EAAoB;QAC1C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,MAAM,mBAAmB;IAGvB,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAFpC,WAAM,GAAG,CAAC,CAAC;IAE4B,CAAC;IAEhD,KAAK,CAAC,QAAQ,CAAC,QAAiB;QAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAiB;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACpC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3F,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAgB;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport type { Context } from \"@earendil-works/chord\";\nimport {\n  ExecutionError,\n  FileError,\n  err,\n  ok,\n  type ExecutionEnv,\n  type FileInfo,\n  type FileKind,\n  type Result,\n  type ShellExecOptions,\n  type ShellExecResult,\n  type TextLine,\n  type TextLineReader,\n} from \"@earendil-works/pi-durable/env\";\nimport { NodeExecutionEnv } from \"@earendil-works/pi-durable/env/node\";\nimport type { Executor, SandboxConfig } from \"../sandbox/types.js\";\nimport { execAppendFile, execWriteFile, shellEscape } from \"../sandbox/utils.js\";\nimport { errorMessage } from \"../unknown-values.js\";\n\nconst SPILL_DIR = \".mikan/bash-output\";\n\nexport function createSandboxExecutionEnv(\n  executor: Executor,\n  sandboxType: SandboxConfig[\"type\"],\n  runtimeWorkspaceRoot: string,\n): ExecutionEnv {\n  if (sandboxType === \"host\") {\n    return new NodeExecutionEnv({ cwd: runtimeWorkspaceRoot });\n  }\n  return new ShellExecutionEnv(executor, runtimeWorkspaceRoot);\n}\n\nclass ShellExecutionEnv implements ExecutionEnv {\n  readonly id: string;\n  readonly cwd: string;\n\n  constructor(\n    private readonly executor: Executor,\n    runtimeWorkspaceRoot: string,\n  ) {\n    this.id = `mikan-sandbox:${randomBytes(8).toString(\"hex\")}`;\n    this.cwd = runtimeWorkspaceRoot;\n  }\n\n  async absolutePath(path: string, _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.isAbsolute(path) ? posix.normalize(path) : posix.resolve(this.cwd, path));\n  }\n\n  async joinPath(parts: string[], _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.join(...parts));\n  }\n\n  readTextFile(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(() => this.executor.readFile(path, this.execOptions(context)));\n  }\n\n  openTextLineReader(path: string, context: Context): Promise<Result<TextLineReader, FileError>> {\n    return this.fileOp(async () => {\n      const content = await this.executor.readFile(path, this.execOptions(context));\n      return new ShellTextLineReader(content);\n    });\n  }\n\n  async readBinaryFile(path: string, context: Context): Promise<Result<Uint8Array, FileError>> {\n    return this.fileOp(async () =>\n      Buffer.from(await this.executor.readFileBase64(path, this.execOptions(context)), \"base64\"),\n    );\n  }\n\n  readTextLines(\n    path: string,\n    options: { maxLines?: number } | undefined,\n    context: Context,\n  ): Promise<Result<string[], FileError>> {\n    return this.fileOp(async () => {\n      const max = options?.maxLines;\n      const command =\n        max === undefined\n          ? `cat ${shellEscape(path)}`\n          : `head -n ${Math.max(0, Math.floor(max))} ${shellEscape(path)}`;\n      const { stdout } = await this.run(command, context);\n      const lines = stdout.split(\"\\n\");\n      if (lines.at(-1) === \"\") lines.pop();\n      return lines;\n    });\n  }\n\n  writeFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(() =>\n      execWriteFile(this.executor, path, content, this.execOptions(context)),\n    );\n  }\n\n  appendFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(() =>\n      execAppendFile(this.executor, path, content, this.execOptions(context)),\n    );\n  }\n\n  truncateFile(path: string, size: number, context: Context): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      await this.run(`truncate -s ${Math.max(0, Math.floor(size))} ${shellEscape(path)}`, context);\n    });\n  }\n\n  flushFile(path: string, context: Context): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      await this.run(`sync ${shellEscape(path)}`, context);\n    });\n  }\n\n  renameFile(\n    sourcePath: string,\n    destinationPath: string,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      await this.run(`mv -f ${shellEscape(sourcePath)} ${shellEscape(destinationPath)}`, context);\n    });\n  }\n\n  fileInfo(path: string, context: Context): Promise<Result<FileInfo, FileError>> {\n    return this.fileOp(async () => {\n      const escaped = shellEscape(path);\n      const probe = await this.executor.exec(\n        `if [ -L ${escaped} ]; then printf 'symlink'; elif [ -d ${escaped} ]; then printf 'directory'; ` +\n          `elif [ -f ${escaped} ]; then printf 'file'; else exit 1; fi`,\n        this.execOptions(context),\n      );\n      if (probe.code !== 0) throw new Error(`No such file or directory: ${path}`);\n      const kind = probe.stdout.trim() as FileKind;\n      let size = 0;\n      if (kind === \"file\") {\n        const stat = await this.executor.exec(`wc -c < ${escaped}`, this.execOptions(context));\n        if (stat.code === 0) size = Number.parseInt(stat.stdout.trim(), 10) || 0;\n      }\n      let mtimeMs = 0;\n      const mtime = await this.executor.exec(`date -r ${escaped} +%s`, this.execOptions(context));\n      if (mtime.code === 0) mtimeMs = (Number.parseInt(mtime.stdout.trim(), 10) || 0) * 1000;\n      return { name: posix.basename(path), path, kind, size, mtimeMs };\n    });\n  }\n\n  async listDir(path: string, context: Context): Promise<Result<FileInfo[], FileError>> {\n    return this.fileOp(async () => {\n      const { stdout } = await this.run(`ls -A ${shellEscape(path)}`, context);\n      const names = stdout.split(\"\\n\").filter(Boolean).toSorted();\n      const entries: FileInfo[] = [];\n      for (const name of names) {\n        const child = posix.join(path, name);\n        const info = await this.fileInfo(child, context);\n        if (info.ok) entries.push(info.value);\n      }\n      return entries;\n    });\n  }\n\n  canonicalPath(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () =>\n      (await this.run(`realpath ${shellEscape(path)}`, context)).stdout.trim(),\n    );\n  }\n\n  async exists(path: string, context: Context): Promise<Result<boolean, FileError>> {\n    try {\n      const result = await this.executor.exec(\n        `test -e ${shellEscape(path)}`,\n        this.execOptions(context),\n      );\n      return ok(result.code === 0);\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n\n  createDir(\n    path: string,\n    options: { recursive?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const flag = options?.recursive === false ? \"\" : \"-p \";\n      await this.run(`mkdir ${flag}${shellEscape(path)}`, context);\n    });\n  }\n\n  remove(\n    path: string,\n    options: { recursive?: boolean; force?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const recursive = options?.recursive ? \"-r\" : \"\";\n      const force = options?.force ? \"-f\" : \"\";\n      await this.run(`rm ${recursive} ${force} ${shellEscape(path)}`, context);\n    });\n  }\n\n  createTempDir(prefix: string | undefined, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template = prefix === undefined ? \"\" : shellEscape(`${prefix}XXXXXX`);\n      const { stdout } = await this.run(`mktemp -d ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  createTempFile(\n    options: { prefix?: string; suffix?: string } | undefined,\n    context: Context,\n  ): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template =\n        options?.prefix === undefined && options?.suffix === undefined\n          ? \"\"\n          : shellEscape(`${options?.prefix ?? \"\"}XXXXXX${options?.suffix ?? \"\"}`);\n      const { stdout } = await this.run(`mktemp ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  async cleanup(_context: Context): Promise<void> {}\n\n  async exec(\n    command: string,\n    options: ShellExecOptions | undefined,\n    context: Context,\n  ): Promise<Result<ShellExecResult, ExecutionError>> {\n    try {\n      const result = await this.executor.exec(command, {\n        cwd: options?.cwd || undefined,\n        timeout: options?.timeout || undefined,\n        signal: context.abortSignal,\n      });\n      const combined = [result.stdout, result.stderr].filter((part) => part.length > 0).join(\"\\n\");\n      if (combined.length > 0) options?.onOutput?.(combined, context);\n      return ok({ exitCode: result.code, spillPath: await this.spill(combined, options, context) });\n    } catch (error) {\n      return err(toExecutionError(error, context));\n    }\n  }\n\n  private async spill(\n    output: string,\n    options: ShellExecOptions | undefined,\n    context: Context,\n  ): Promise<string | undefined> {\n    const limits = options?.spill;\n    if (!limits) return undefined;\n    const lines = output.split(\"\\n\").length;\n    if (Buffer.byteLength(output, \"utf8\") <= limits.afterBytes && lines <= limits.afterLines)\n      return undefined;\n    try {\n      const spillPath = posix.join(this.cwd, SPILL_DIR, `${randomBytes(8).toString(\"hex\")}.log`);\n      await this.executor.writeFile(spillPath, output, this.execOptions(context));\n      return spillPath;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private execOptions(context: Context): { signal: AbortSignal | undefined } {\n    return { signal: context.abortSignal };\n  }\n\n  private async run(\n    command: string,\n    context: Context,\n  ): Promise<{ stdout: string; stderr: string }> {\n    const result = await this.executor.exec(command, this.execOptions(context));\n    if (result.code !== 0) {\n      throw new Error(result.stderr.trim() || `Command failed (${result.code}): ${command}`);\n    }\n    return result;\n  }\n\n  private async fileOp<T>(op: () => Promise<T>): Promise<Result<T, FileError>> {\n    try {\n      return ok(await op());\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n}\n\nclass ShellTextLineReader implements TextLineReader {\n  private offset = 0;\n\n  constructor(private readonly content: string) {}\n\n  async readLine(_context: Context): Promise<Result<TextLine | undefined, FileError>> {\n    if (this.offset >= this.content.length) return ok(undefined);\n    const newline = this.content.indexOf(\"\\n\", this.offset);\n    if (newline === -1) {\n      const text = this.content.slice(this.offset);\n      this.offset = this.content.length;\n      return ok({ text, terminated: false });\n    }\n    const text = this.content.slice(this.offset, newline);\n    this.offset = newline + 1;\n    return ok({ text, terminated: true });\n  }\n\n  async close(_context: Context): Promise<void> {\n    this.offset = this.content.length;\n  }\n}\n\nfunction toFileError(error: unknown): FileError {\n  const message = errorMessage(error);\n  if (/aborted/i.test(message)) return new FileError(\"aborted\", message);\n  if (/no such file|not found/i.test(message)) return new FileError(\"not_found\", message);\n  if (/permission denied/i.test(message)) return new FileError(\"permission_denied\", message);\n  if (/not a directory/i.test(message)) return new FileError(\"not_directory\", message);\n  if (/is a directory/i.test(message)) return new FileError(\"is_directory\", message);\n  return new FileError(\"unknown\", message, undefined, error instanceof Error ? error : undefined);\n}\n\nfunction toExecutionError(error: unknown, context: Context): ExecutionError {\n  const message = errorMessage(error);\n  if (context.abortSignal?.aborted || /aborted/i.test(message)) {\n    return new ExecutionError(\"aborted\", message);\n  }\n  if (/timed out/i.test(message)) return new ExecutionError(\"timeout\", message);\n  return new ExecutionError(\"unknown\", message, error instanceof Error ? error : undefined);\n}\n"]}

package/dist/harness/execution-resolver.d.ts

@@ -0,0 +1,23 @@
+import { DockerContainerManager } from "../sandbox/provisioner.js";
+import type { ActorContext } from "../types.js";
+import type { SandboxConfig } from "../sandbox/types.js";
+import type { VaultManager } from "../vault/types.js";
+import type { WorkspaceProjection, Workspace } from "../office/types.js";
+export declare class ActorExecutionResolver {
+    private baseConfig;
+    private vaultManager;
+    private provisioner;
+    private workspace;
+    constructor(baseConfig: SandboxConfig, vaultManager: Pick<VaultManager, "hasEntry" | "resolve" | "copySharedVaultTo">, provisioner: Pick<DockerContainerManager, "provision"> | undefined, workspace: Workspace);
+    resolve(context: ActorContext): Promise<{
+        executor: import("../sandbox/types.js").Executor;
+        pathContext: import("../sandbox/types.js").RuntimePathContext;
+        projection: WorkspaceProjection;
+    }>;
+    private resolvePlan;
+    private ensureDefaultSharedVault;
+    private resolveSandboxConfig;
+    private buildEnsureReadyCallback;
+    private resolveMounts;
+}
+//# sourceMappingURL=execution-resolver.d.ts.map

package/dist/harness/execution-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAkB,YAAY,EAAiB,MAAM,aAAa,CAAC;AAM/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,SAAS;IAJnB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,SAAS,GAAG,mBAAmB,CAAC,EAC9E,WAAW,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,GAAG,SAAS,EAClE,SAAS,EAAE,SAAS,EAC1B;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY;;;;OAYlC;IAED,OAAO,CAAC,WAAW;IAoCnB,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,aAAa;CA4BtB"}

package/dist/harness/execution-resolver.js

@@ -0,0 +1,152 @@
+import { posix } from "node:path";
+import { loadGlobalSettings } from "../settings/index.js";
+import { DockerContainerManager } from "../sandbox/provisioner.js";
+import { assertSandboxSupportsWorkspacePolicy, createExecutor, getSandboxCredentialCapabilities, } from "../sandbox/registry.js";
+import { reportUserFacingError } from "../observability/index.js";
+import { normalizeSharedVaultName } from "../vault/index.js";
+import { allowsAmbientDefaultSharedVault, resolveVaultInjection } from "../vault/index.js";
+import { credentialAuthorizationKey, runtimeResourceKey, scopeCloudflareSandboxId, } from "../sandbox/identity.js";
+import { resolveWorkspaceProjection } from "../office/projection.js";
+export class ActorExecutionResolver {
+    constructor(baseConfig, vaultManager, provisioner, workspace) {
+        this.baseConfig = baseConfig;
+        this.vaultManager = vaultManager;
+        this.provisioner = provisioner;
+        this.workspace = workspace;
+    }
+    async resolve(context) {
+        const { plan, projection } = this.resolvePlan(context);
+        const executor = createExecutor(plan.sandboxConfig, plan.env, this.buildEnsureReadyCallback(plan, context.address.conversationId));
+        return {
+            executor,
+            pathContext: executor.getPathContext(this.workspace.root),
+            projection,
+        };
+    }
+    resolvePlan(context) {
+        const scope = { userId: context.userId, address: context.address };
+        const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);
+        const resourceKey = runtimeResourceKey(this.baseConfig, {
+            userId: context.userId,
+            address: context.address,
+        });
+        this.ensureDefaultSharedVault(credentialKey, context.trustModel);
+        const vault = this.vaultManager.resolve(credentialKey);
+        const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);
+        const office = this.workspace.office(context.address);
+        const projection = resolveWorkspaceProjection(office);
+        const injection = resolveVaultInjection({
+            vault,
+            capabilities,
+            sandboxType: this.baseConfig.type,
+            address: office.address,
+        });
+        const mounts = this.resolveMounts(injection.mounts, projection);
+        assertSandboxSupportsWorkspacePolicy(this.baseConfig, projection.visibility, office.key);
+        return {
+            plan: {
+                credentialKey,
+                resourceKey,
+                sandboxConfig: this.resolveSandboxConfig(resourceKey),
+                env: injection.env,
+                mounts,
+            },
+            projection,
+        };
+    }
+    ensureDefaultSharedVault(credentialKey, trustModel) {
+        if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type }))
+            return;
+        if (this.vaultManager.hasEntry(credentialKey))
+            return;
+        let profile;
+        try {
+            profile = loadGlobalSettings().sandbox?.defaultSharedVault;
+        }
+        catch {
+            return;
+        }
+        if (!profile || normalizeSharedVaultName(profile) !== profile)
+            return;
+        this.vaultManager.copySharedVaultTo(profile, credentialKey);
+    }
+    resolveSandboxConfig(resourceKey) {
+        if (this.baseConfig.type === "cloudflare") {
+            return {
+                type: "cloudflare",
+                sandboxId: scopeCloudflareSandboxId(this.baseConfig.sandboxId, resourceKey),
+            };
+        }
+        if (this.baseConfig.type !== "image")
+            return this.baseConfig;
+        return {
+            type: "container",
+            container: DockerContainerManager.containerName(resourceKey),
+        };
+    }
+    buildEnsureReadyCallback(plan, conversationId) {
+        if (this.baseConfig.type !== "image" || plan.sandboxConfig.type !== "container") {
+            return undefined;
+        }
+        return async () => {
+            const expected = plan.sandboxConfig.type === "container" ? plan.sandboxConfig.container : "";
+            let actual;
+            try {
+                actual = await this.provisioner?.provision(plan.resourceKey, {
+                    containerName: expected,
+                    mounts: plan.mounts,
+                    conversationId,
+                });
+            }
+            catch (err) {
+                reportUserFacingError(err, {
+                    domain: "sandbox",
+                    surface: "sandbox_provision",
+                    operation: "ensure_image_container_ready",
+                    severity: "error",
+                    context: {
+                        sandboxType: "image",
+                        conversationId,
+                        credentialKey: plan.credentialKey,
+                        resourceKey: plan.resourceKey,
+                        expectedContainer: expected,
+                        hasVault: Boolean(plan.env || plan.mounts.length > 0),
+                    },
+                });
+                throw err;
+            }
+            if (actual && actual !== expected) {
+                throw new Error(`Provisioner returned container "${actual}" for resource key "${plan.resourceKey}", expected "${expected}"`);
+            }
+        };
+    }
+    resolveMounts(vaultMounts, projection) {
+        const protectedMounts = projection.mounts;
+        for (let index = 0; index < vaultMounts.length; index += 1) {
+            const vaultMount = vaultMounts[index];
+            if (vaultMount === undefined)
+                continue;
+            const workspaceCollision = protectedMounts.find((protectedMount) => targetsOverlap(protectedMount.target, vaultMount.target));
+            if (workspaceCollision) {
+                throw new Error(`Vault mount target "${vaultMount.target}" overlaps protected workspace target "${workspaceCollision.target}"`);
+            }
+            const vaultCollision = vaultMounts
+                .slice(0, index)
+                .find((other) => targetsOverlap(other.target, vaultMount.target));
+            if (vaultCollision) {
+                throw new Error(`Vault mount target "${vaultMount.target}" overlaps vault target "${vaultCollision.target}"`);
+            }
+        }
+        return [...protectedMounts, ...vaultMounts];
+    }
+}
+function targetsOverlap(left, right) {
+    const a = normalizeMountTarget(left);
+    const b = normalizeMountTarget(right);
+    return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+function normalizeMountTarget(value) {
+    const normalized = posix.normalize(value);
+    return normalized.replace(/\/+$/, "") || "/";
+}
+//# sourceMappingURL=execution-resolver.js.map

package/dist/harness/execution-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA8E,EAC9E,WAAkE,EAClE,SAAoB;0BAHpB,UAAU;4BACV,YAAY;2BACZ,WAAW;yBACX,SAAS;IAChB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,cAAc,CAC7B,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CACpE,CAAC;QACF,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACzD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAqB;QAIvC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,oCAAoC,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACzF,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa;gBACb,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBACrD,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;aACP;YACD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,aAAqB,EACrB,UAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAChG,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAEtD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAAC,WAAmB;QAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,IAAmB,EACnB,cAAsB;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;oBAC3D,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtD;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,uBAAuB,IAAI,CAAC,WAAW,gBAAgB,QAAQ,GAAG,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,WAA6B,EAC7B,UAA+B;QAE/B,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CACjE,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CACzD,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,0CAA0C,kBAAkB,CAAC,MAAM,GAAG,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,WAAW;iBAC/B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,cAAc,CAAC,MAAM,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["import { posix } from \"node:path\";\n\nimport { loadGlobalSettings } from \"../settings/index.js\";\nimport { DockerContainerManager } from \"../sandbox/provisioner.js\";\nimport type { ContainerMount, ActorContext, ExecutionPlan } from \"../types.js\";\nimport {\n  assertSandboxSupportsWorkspacePolicy,\n  createExecutor,\n  getSandboxCredentialCapabilities,\n} from \"../sandbox/registry.js\";\nimport type { SandboxConfig } from \"../sandbox/types.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport { normalizeSharedVaultName } from \"../vault/index.js\";\nimport type { VaultManager } from \"../vault/types.js\";\nimport { allowsAmbientDefaultSharedVault, resolveVaultInjection } from \"../vault/index.js\";\nimport {\n  credentialAuthorizationKey,\n  runtimeResourceKey,\n  scopeCloudflareSandboxId,\n} from \"../sandbox/identity.js\";\nimport { resolveWorkspaceProjection } from \"../office/projection.js\";\nimport type { WorkspaceProjection, Workspace } from \"../office/types.js\";\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: Pick<VaultManager, \"hasEntry\" | \"resolve\" | \"copySharedVaultTo\">,\n    private provisioner: Pick<DockerContainerManager, \"provision\"> | undefined,\n    private workspace: Workspace,\n  ) {}\n\n  async resolve(context: ActorContext) {\n    const { plan, projection } = this.resolvePlan(context);\n    const executor = createExecutor(\n      plan.sandboxConfig,\n      plan.env,\n      this.buildEnsureReadyCallback(plan, context.address.conversationId),\n    );\n    return {\n      executor,\n      pathContext: executor.getPathContext(this.workspace.root),\n      projection,\n    };\n  }\n\n  private resolvePlan(context: ActorContext): {\n    plan: ExecutionPlan;\n    projection: WorkspaceProjection;\n  } {\n    const scope = { userId: context.userId, address: context.address };\n    const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);\n    const resourceKey = runtimeResourceKey(this.baseConfig, {\n      userId: context.userId,\n      address: context.address,\n    });\n    this.ensureDefaultSharedVault(credentialKey, context.trustModel);\n\n    const vault = this.vaultManager.resolve(credentialKey);\n    const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);\n    const office = this.workspace.office(context.address);\n    const projection = resolveWorkspaceProjection(office);\n    const injection = resolveVaultInjection({\n      vault,\n      capabilities,\n      sandboxType: this.baseConfig.type,\n      address: office.address,\n    });\n    const mounts = this.resolveMounts(injection.mounts, projection);\n    assertSandboxSupportsWorkspacePolicy(this.baseConfig, projection.visibility, office.key);\n    return {\n      plan: {\n        credentialKey,\n        resourceKey,\n        sandboxConfig: this.resolveSandboxConfig(resourceKey),\n        env: injection.env,\n        mounts,\n      },\n      projection,\n    };\n  }\n\n  private ensureDefaultSharedVault(\n    credentialKey: string,\n    trustModel: ActorContext[\"trustModel\"],\n  ): void {\n    if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type })) return;\n    if (this.vaultManager.hasEntry(credentialKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n    this.vaultManager.copySharedVaultTo(profile, credentialKey);\n  }\n\n  private resolveSandboxConfig(resourceKey: string): SandboxConfig {\n    if (this.baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: scopeCloudflareSandboxId(this.baseConfig.sandboxId, resourceKey),\n      };\n    }\n    if (this.baseConfig.type !== \"image\") return this.baseConfig;\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(resourceKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    plan: ExecutionPlan,\n    conversationId: string,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || plan.sandboxConfig.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = plan.sandboxConfig.type === \"container\" ? plan.sandboxConfig.container : \"\";\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(plan.resourceKey, {\n          containerName: expected,\n          mounts: plan.mounts,\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            credentialKey: plan.credentialKey,\n            resourceKey: plan.resourceKey,\n            expectedContainer: expected,\n            hasVault: Boolean(plan.env || plan.mounts.length > 0),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for resource key \"${plan.resourceKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(\n    vaultMounts: ContainerMount[],\n    projection: WorkspaceProjection,\n  ): ContainerMount[] {\n    const protectedMounts = projection.mounts;\n    for (let index = 0; index < vaultMounts.length; index += 1) {\n      const vaultMount = vaultMounts[index];\n      if (vaultMount === undefined) continue;\n      const workspaceCollision = protectedMounts.find((protectedMount) =>\n        targetsOverlap(protectedMount.target, vaultMount.target),\n      );\n      if (workspaceCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps protected workspace target \"${workspaceCollision.target}\"`,\n        );\n      }\n\n      const vaultCollision = vaultMounts\n        .slice(0, index)\n        .find((other) => targetsOverlap(other.target, vaultMount.target));\n      if (vaultCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps vault target \"${vaultCollision.target}\"`,\n        );\n      }\n    }\n    return [...protectedMounts, ...vaultMounts];\n  }\n}\n\nfunction targetsOverlap(left: string, right: string): boolean {\n  const a = normalizeMountTarget(left);\n  const b = normalizeMountTarget(right);\n  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);\n}\n\nfunction normalizeMountTarget(value: string): string {\n  const normalized = posix.normalize(value);\n  return normalized.replace(/\\/+$/, \"\") || \"/\";\n}\n"]}

package/dist/harness/http.d.ts

@@ -1,16 +1,4 @@
-/** Idle timeout applied to HTTP headers/body when none is configured. */
 export declare const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300000;
-/**
- * Parse an idle-timeout setting into milliseconds.
- *
- * Accepts a non-negative number of milliseconds or its string form;
- * `"disabled"` (case-insensitive) yields `0`. Returns `undefined` for
- * anything unparseable so callers can fall back to the default.
- */
 export declare function parseHttpIdleTimeoutMs(value: unknown): number | undefined;
-/**
- * Install the global HTTP dispatcher and fetch. A timeout of `0` disables
- * idle timeouts. Safe to call more than once; the last call wins.
- */
 export declare function configureHttpDispatcher(timeoutMs?: number): void;
 //# sourceMappingURL=http.d.ts.map

package/dist/harness/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAmBA,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAKpD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAqC,GAAG,IAAI,CA2B9F"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAKpD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAqC,GAAG,IAAI,CAsB9F"}

package/dist/harness/http.js

@@ -1,32 +1,7 @@
-/**
- * Global HTTP dispatcher configuration for the mikan harness.
- *
- * mikan is a long-running headless process whose LLM traffic goes through
- * global `fetch`. Node's built-in fetch ignores `HTTP_PROXY`/`HTTPS_PROXY`/
- * `NO_PROXY` and offers no idle-timeout control, so a proxied deployment
- * cannot reach providers and a silently stalled streaming response would
- * hang a session without ever erroring (auto-retry never kicks in).
- *
- * `configureHttpDispatcher` installs undici's `EnvHttpProxyAgent` as the
- * global dispatcher (proxy support via the standard env vars) with
- * headers/body idle timeouts, and swaps global `fetch` to undici's so both
- * share one implementation. A caller that deliberately replaced `fetch`
- * after module load is left alone.
- *
- * Design adapted from pi-coding-agent's http-dispatcher.
- */
 import * as undici from "undici";
-/** Idle timeout applied to HTTP headers/body when none is configured. */
 export const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;
 const originalGlobalFetch = globalThis.fetch;
 let installedGlobalFetch;
-/**
- * Parse an idle-timeout setting into milliseconds.
- *
- * Accepts a non-negative number of milliseconds or its string form;
- * `"disabled"` (case-insensitive) yields `0`. Returns `undefined` for
- * anything unparseable so callers can fall back to the default.
- */
 export function parseHttpIdleTimeoutMs(value) {
     if (typeof value === "string") {
         const trimmed = value.trim();
@@ -41,10 +16,6 @@ export function parseHttpIdleTimeoutMs(value) {
     }
     return Math.floor(value);
 }
-/**
- * Install the global HTTP dispatcher and fetch. A timeout of `0` disables
- * idle timeouts. Safe to call more than once; the last call wins.
- */
 export function configureHttpDispatcher(timeoutMs = DEFAULT_HTTP_IDLE_TIMEOUT_MS) {
     const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);
     if (normalizedTimeoutMs === undefined) {
@@ -55,15 +26,10 @@ export function configureHttpDispatcher(timeoutMs = DEFAULT_HTTP_IDLE_TIMEOUT_MS
         bodyTimeout: normalizedTimeoutMs,
         headersTimeout: normalizedTimeoutMs,
     }));
-    // Node's built-in fetch uses its own bundled undici and never sees the
-    // dispatcher installed above, so global fetch must be swapped to undici's.
     const shouldInstallGlobals = installedGlobalFetch === undefined
         ? globalThis.fetch === originalGlobalFetch
         : globalThis.fetch === installedGlobalFetch;
     if (shouldInstallGlobals) {
-        // `install` swaps global fetch to undici's; it only exists in undici >= 7,
-        // whose types aren't guaranteed here, so access it defensively and no-op
-        // on older undici (runtime behavior unchanged from the original `?.` call).
         undici.install?.();
         installedGlobalFetch = globalThis.fetch;
     }

package/dist/harness/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,yEAAyE;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC;AAC7C,IAAI,oBAAyD,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAS,GAAW,4BAA4B;IACtF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,mBAAmB,CACxB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,mBAAmB;KACpC,CAAC,CACH,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,oBAAoB,GACxB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,mBAAmB;QAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,oBAAoB,CAAC;IAChD,IAAI,oBAAoB,EAAE,CAAC;QACzB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC3E,MAAmC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC;IAC1C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Global HTTP dispatcher configuration for the mikan harness.\n *\n * mikan is a long-running headless process whose LLM traffic goes through\n * global `fetch`. Node's built-in fetch ignores `HTTP_PROXY`/`HTTPS_PROXY`/\n * `NO_PROXY` and offers no idle-timeout control, so a proxied deployment\n * cannot reach providers and a silently stalled streaming response would\n * hang a session without ever erroring (auto-retry never kicks in).\n *\n * `configureHttpDispatcher` installs undici's `EnvHttpProxyAgent` as the\n * global dispatcher (proxy support via the standard env vars) with\n * headers/body idle timeouts, and swaps global `fetch` to undici's so both\n * share one implementation. A caller that deliberately replaced `fetch`\n * after module load is left alone.\n *\n * Design adapted from pi-coding-agent's http-dispatcher.\n */\nimport * as undici from \"undici\";\n\n/** Idle timeout applied to HTTP headers/body when none is configured. */\nexport const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;\n\nconst originalGlobalFetch = globalThis.fetch;\nlet installedGlobalFetch: typeof globalThis.fetch | undefined;\n\n/**\n * Parse an idle-timeout setting into milliseconds.\n *\n * Accepts a non-negative number of milliseconds or its string form;\n * `\"disabled\"` (case-insensitive) yields `0`. Returns `undefined` for\n * anything unparseable so callers can fall back to the default.\n */\nexport function parseHttpIdleTimeoutMs(value: unknown): number | undefined {\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (trimmed.toLowerCase() === \"disabled\") return 0;\n    if (trimmed.length === 0) return undefined;\n    return parseHttpIdleTimeoutMs(Number(trimmed));\n  }\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n    return undefined;\n  }\n  return Math.floor(value);\n}\n\n/**\n * Install the global HTTP dispatcher and fetch. A timeout of `0` disables\n * idle timeouts. Safe to call more than once; the last call wins.\n */\nexport function configureHttpDispatcher(timeoutMs: number = DEFAULT_HTTP_IDLE_TIMEOUT_MS): void {\n  const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);\n  if (normalizedTimeoutMs === undefined) {\n    throw new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);\n  }\n\n  undici.setGlobalDispatcher(\n    new undici.EnvHttpProxyAgent({\n      allowH2: false,\n      bodyTimeout: normalizedTimeoutMs,\n      headersTimeout: normalizedTimeoutMs,\n    }),\n  );\n\n  // Node's built-in fetch uses its own bundled undici and never sees the\n  // dispatcher installed above, so global fetch must be swapped to undici's.\n  const shouldInstallGlobals =\n    installedGlobalFetch === undefined\n      ? globalThis.fetch === originalGlobalFetch\n      : globalThis.fetch === installedGlobalFetch;\n  if (shouldInstallGlobals) {\n    // `install` swaps global fetch to undici's; it only exists in undici >= 7,\n    // whose types aren't guaranteed here, so access it defensively and no-op\n    // on older undici (runtime behavior unchanged from the original `?.` call).\n    (undici as { install?: () => void }).install?.();\n    installedGlobalFetch = globalThis.fetch;\n  }\n}\n"]}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC;AAC7C,IAAI,oBAAyD,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAS,GAAW,4BAA4B;IACtF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,mBAAmB,CACxB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,mBAAmB;KACpC,CAAC,CACH,CAAC;IAEF,MAAM,oBAAoB,GACxB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,mBAAmB;QAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,oBAAoB,CAAC;IAChD,IAAI,oBAAoB,EAAE,CAAC;QACxB,MAAmC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC;IAC1C,CAAC;AACH,CAAC","sourcesContent":["import * as undici from \"undici\";\n\nexport const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;\n\nconst originalGlobalFetch = globalThis.fetch;\nlet installedGlobalFetch: typeof globalThis.fetch | undefined;\n\nexport function parseHttpIdleTimeoutMs(value: unknown): number | undefined {\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (trimmed.toLowerCase() === \"disabled\") return 0;\n    if (trimmed.length === 0) return undefined;\n    return parseHttpIdleTimeoutMs(Number(trimmed));\n  }\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n    return undefined;\n  }\n  return Math.floor(value);\n}\n\nexport function configureHttpDispatcher(timeoutMs: number = DEFAULT_HTTP_IDLE_TIMEOUT_MS): void {\n  const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);\n  if (normalizedTimeoutMs === undefined) {\n    throw new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);\n  }\n\n  undici.setGlobalDispatcher(\n    new undici.EnvHttpProxyAgent({\n      allowH2: false,\n      bodyTimeout: normalizedTimeoutMs,\n      headersTimeout: normalizedTimeoutMs,\n    }),\n  );\n\n  const shouldInstallGlobals =\n    installedGlobalFetch === undefined\n      ? globalThis.fetch === originalGlobalFetch\n      : globalThis.fetch === installedGlobalFetch;\n  if (shouldInstallGlobals) {\n    (undici as { install?: () => void }).install?.();\n    installedGlobalFetch = globalThis.fetch;\n  }\n}\n"]}