@gitterm/sdk 0.0.8 → 0.1.0

package/dist/direct/index.js

@@ -0,0 +1,1802 @@
+// src/direct/client.ts
+import { randomUUID } from "node:crypto";
+import { createOpencodeClient } from "@opencode-ai/sdk";
+import {
+  createOpencodeClient as createOpencodeV2Client
+} from "@opencode-ai/sdk/v2";
+
+// src/direct/ascii.ts
+import { BoxApi, Configuration, waitUntilReady } from "@asciidev/box-sdk";
+
+// src/direct/provisioning.ts
+var DIRECT_OPENCODE_PORT = 4096;
+var DIRECT_OPENCODE_COMMAND = `opencode serve --hostname 0.0.0.0 --port ${DIRECT_OPENCODE_PORT}`;
+var DIRECT_OPENCODE_SERVER_IMAGE = "opeoginni/gitterm-opencode-server:latest";
+var DIRECT_E2B_TEMPLATES = {
+  standard: "gitterm-opencode-server",
+  large: "gitterm-opencode-server-lg"
+};
+function resolveDirectImage(image) {
+  return image?.trim() || DIRECT_OPENCODE_SERVER_IMAGE;
+}
+function directModelAuth(credential) {
+  if (credential.type === "oauth") {
+    if (!credential.refreshToken.trim())
+      throw new Error("OAuth refreshToken is required");
+    if (credential.expiresAt != null && (!Number.isFinite(credential.expiresAt) || credential.expiresAt < 0)) {
+      throw new Error("OAuth expiresAt must be a non-negative Unix epoch time in milliseconds");
+    }
+    return {
+      type: "oauth",
+      refresh: credential.refreshToken,
+      access: credential.accessToken ?? "",
+      expires: credential.expiresAt ?? 0,
+      ...credential.accountId ? { accountId: credential.accountId } : {},
+      ...credential.enterpriseUrl ? { enterpriseUrl: credential.enterpriseUrl } : {}
+    };
+  }
+  if (!credential.apiKey.trim())
+    throw new Error("Model credential apiKey is required");
+  return {
+    type: "api",
+    key: credential.apiKey,
+    ...credential.metadata ? { metadata: credential.metadata } : {}
+  };
+}
+function base64(value) {
+  return Buffer.from(value).toString("base64");
+}
+function validateName(value, kind) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(value) || value === "." || value === "..") {
+    throw new Error(`Invalid ${kind}: ${value}`);
+  }
+  return value;
+}
+function repositoryName(url) {
+  let pathname;
+  try {
+    pathname = new URL(url).pathname;
+  } catch {
+    pathname = url;
+  }
+  const name = pathname.replace(/\/$/, "").split("/").at(-1)?.replace(/\.git$/, "") ?? "";
+  return validateName(name, "repository name");
+}
+function buildDirectProvisioningPlan(input) {
+  if (!input.repo) {
+    const repositoryOnly = [
+      input.branch ? "branch" : undefined,
+      input.checkoutRef ? "checkoutRef" : undefined,
+      input.baseCommit ? "baseCommit" : undefined,
+      input.repositoryCredentials ? "repositoryCredentials" : undefined
+    ].filter(Boolean);
+    if (repositoryOnly.length) {
+      throw new Error(`${repositoryOnly.join(", ")} require repo`);
+    }
+  }
+  const credentials = new Map;
+  for (const credential of input.modelCredentials ?? []) {
+    const providerName = credential.providerName.trim();
+    if (!providerName)
+      throw new Error("Model credential providerName is required");
+    if (credentials.has(providerName)) {
+      throw new Error(`Duplicate model credential: ${providerName}`);
+    }
+    credentials.set(providerName, directModelAuth(credential));
+  }
+  const configuredPlugins = Array.isArray(input.opencode?.config?.plugin) ? input.opencode.config.plugin.filter((plugin) => typeof plugin === "string") : [];
+  const plugins = [...new Set([...configuredPlugins, ...input.opencode?.plugins ?? []])];
+  const environmentVariables = { ...input.environmentVariables };
+  delete environmentVariables.OPENCODE_SERVER_USERNAME;
+  delete environmentVariables.GITTERM_DIRECT_PROVIDER;
+  const config = {
+    $schema: "https://opencode.ai/config.json",
+    ...input.opencode?.config,
+    username: "Gitterm direct",
+    ...plugins.length ? { plugin: plugins } : {}
+  };
+  const files = [
+    {
+      path: "~/.local/share/opencode/auth.json",
+      contentBase64: base64(JSON.stringify(Object.fromEntries(credentials)))
+    },
+    {
+      path: "~/.config/opencode/opencode.json",
+      contentBase64: base64(JSON.stringify(config))
+    },
+    {
+      path: "~/.config/opencode/AGENTS.md",
+      contentBase64: base64("You are running in a direct Gitterm workspace. Follow the user's instructions and verify outcomes before reporting success.")
+    },
+    ...(input.opencode?.skills ?? []).map((skill) => ({
+      path: `~/.config/opencode/skills/${validateName(skill.name, "skill name")}/SKILL.md`,
+      contentBase64: base64(skill.content)
+    }))
+  ];
+  return {
+    workspaceId: input.id,
+    lifecycle: input.lifecycle,
+    repository: input.repo ? {
+      url: input.repo,
+      name: repositoryName(input.repo),
+      branch: input.branch,
+      checkoutRef: input.checkoutRef,
+      baseCommit: input.baseCommit,
+      authUsername: input.repositoryCredentials?.username,
+      authToken: input.repositoryCredentials?.token
+    } : undefined,
+    agent: {
+      files,
+      environmentVariables: {
+        ...environmentVariables,
+        OPENCODE_SERVER_PASSWORD: input.password
+      },
+      command: DIRECT_OPENCODE_COMMAND,
+      port: DIRECT_OPENCODE_PORT
+    },
+    setupCommands: input.setupCommands ?? []
+  };
+}
+function railwayContainerEnvironment(plan) {
+  const repository = plan.repository;
+  return {
+    ...plan.agent.environmentVariables,
+    ...repository ? {
+      REPO_URL: repository.url,
+      REPO_NAME: repository.name,
+      ...repository.branch ? { REPO_BRANCH: repository.branch } : {},
+      ...repository.checkoutRef ? { REPO_CHECKOUT_REF: repository.checkoutRef } : {},
+      ...repository.baseCommit ? { REPO_BASE_COMMIT: repository.baseCommit } : {},
+      ...repository.authToken ? {
+        GITTERM_GIT_USERNAME: repository.authUsername ?? "x-access-token",
+        GITTERM_GIT_TOKEN: repository.authToken
+      } : {}
+    } : {},
+    AGENT_FILES_BASE64: base64(JSON.stringify(plan.agent.files)),
+    ...plan.setupCommands.length ? { WORKSPACE_SETUP_COMMAND_BASE64: base64(setupCommandScript(plan.setupCommands)) } : {},
+    GITTERM_DIRECT_PROVIDER: "railway"
+  };
+}
+function setupCommandScript(commands) {
+  return ["set -eu", ...commands].join(`
+`);
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function cloneRepositoryScript(repository, directory) {
+  const ref = repository.checkoutRef ?? repository.branch;
+  const commands = [
+    `mkdir -p ${shellQuote(directory)}`,
+    ...repository.authToken ? [
+      "mkdir -p /tmp/gitterm",
+      `printf %s ${shellQuote(repository.authToken)} > /tmp/gitterm/git-token`,
+      `printf %s ${shellQuote(repository.authUsername ?? "x-access-token")} > /tmp/gitterm/git-username`,
+      "chmod 600 /tmp/gitterm/git-token /tmp/gitterm/git-username",
+      `git config --global credential.helper ${shellQuote('!f() { [ "$1" = get ] || exit 0; printf "%s\\n" "username=$(cat /tmp/gitterm/git-username)" "password=$(cat /tmp/gitterm/git-token)"; }; f')}`
+    ] : [],
+    `GIT_TERMINAL_PROMPT=0 git clone ${ref ? `--branch ${shellQuote(ref)} ` : ""}${shellQuote(repository.url)} ${shellQuote(directory)}`,
+    ...repository.baseCommit ? [
+      `GIT_TERMINAL_PROMPT=0 git -C ${shellQuote(directory)} fetch --depth 1 origin ${shellQuote(repository.baseCommit)}`,
+      `git -C ${shellQuote(directory)} checkout --detach ${shellQuote(repository.baseCommit)}`
+    ] : [],
+    ...repository.authToken ? ["git config --global --unset-all credential.helper || true", "rm -rf /tmp/gitterm"] : []
+  ];
+  return setupCommandScript(commands);
+}
+async function pinFloatingDockerImage(image) {
+  if (image.includes("@sha256:"))
+    return image;
+  const slash = image.lastIndexOf("/");
+  const colon = image.lastIndexOf(":");
+  const name = colon > slash ? image.slice(0, colon) : image;
+  const tag = colon > slash ? image.slice(colon + 1) : "latest";
+  if (!["latest", "lts", "stable"].includes(tag.toLowerCase()))
+    return image;
+  if (name.includes("/") && name.split("/").length !== 2)
+    return image;
+  const response = await fetch(`https://hub.docker.com/v2/repositories/${name}/tags/${encodeURIComponent(tag)}`);
+  if (!response.ok) {
+    throw new Error(`Could not resolve a digest for Docker image ${image} (${response.status})`);
+  }
+  const body = await response.json();
+  const digest = body.digest || body.images?.find((entry) => entry.digest)?.digest;
+  if (!digest?.startsWith("sha256:")) {
+    throw new Error(`Docker Hub did not return a digest for ${image}`);
+  }
+  return `${name}@${digest}`;
+}
+function basicAuthHeader(password) {
+  return `Basic ${Buffer.from(`opencode:${password}`).toString("base64")}`;
+}
+async function waitForDirectRuntime(runtime, timeoutMs = 60000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), 5000);
+    const ready = await fetch(runtime.url, {
+      headers: {
+        ...runtime.headers,
+        ...runtime.password ? { Authorization: basicAuthHeader(runtime.password) } : {}
+      },
+      signal: controller.signal
+    }).then((response) => response.ok).catch(() => false).finally(() => clearTimeout(timer));
+    if (ready)
+      return;
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  throw new Error("Timed out waiting for the OpenCode runtime");
+}
+
+// src/direct/ascii.ts
+var HOME = "/home/user";
+function serializeHandle(handle) {
+  return JSON.stringify(handle);
+}
+function parseHandle(value) {
+  try {
+    const handle = JSON.parse(value);
+    if (!handle.boxId || !handle.repoDir || !handle.serve?.command || !handle.serve.port) {
+      throw new Error("missing required fields");
+    }
+    return handle;
+  } catch {
+    throw new Error("Invalid Ascii Box direct workspace handle");
+  }
+}
+function createAsciiDirectProvider(config) {
+  if (!config.apiKey.trim())
+    throw new Error("Ascii apiKey is required");
+  const client = new BoxApi(new Configuration({
+    basePath: "https://ascii.dev/api/box/v1",
+    accessToken: config.apiKey
+  }));
+  async function runCommand(boxId, command, cwd, timeoutSeconds = 60) {
+    const result = await client.command({
+      boxId,
+      commandRequest: { command, cwd, timeoutSeconds }
+    });
+    if (result.type !== "command.finished") {
+      throw new Error("Ascii Box command did not finish");
+    }
+    if (!result.success || result.exitCode !== 0) {
+      throw new Error(`Ascii Box command failed: ${result.stderr || result.stdout}`);
+    }
+    return result.stdout;
+  }
+  async function startRuntime(handle) {
+    await runCommand(handle.boxId, `nohup setsid bash -lc ${shellQuote(handle.serve.command)} > /tmp/opencode-server.log 2>&1 </dev/null &`, handle.repoDir);
+  }
+  async function getPublicUrl(handle) {
+    await runCommand(handle.boxId, `host ${handle.serve.port}`);
+    const output = await runCommand(handle.boxId, `host url ${handle.serve.port}`);
+    const value = output.match(/https:\/\/\S+/)?.[0];
+    if (!value) {
+      throw new Error(`Ascii Box did not return a hosted URL for port ${handle.serve.port}`);
+    }
+    const hosted = new URL(value);
+    hosted.search = "";
+    return hosted.toString();
+  }
+  async function deleteBox(boxId) {
+    const response = await fetch(`https://ascii.dev/api/box/v1/boxes/${boxId}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${config.apiKey}` }
+    });
+    if (!response.ok && response.status !== 404) {
+      throw new Error(`Ascii Box deletion failed (${response.status})`);
+    }
+  }
+  return {
+    name: "ascii",
+    capabilities: {
+      persistence: "supported",
+      recommendedLifecycle: "ephemeral",
+      supportsPause: true,
+      ephemeralPause: "stateful",
+      supportsKeepAlive: true
+    },
+    async create(input) {
+      const plan = input.provisioning;
+      const directory = `${HOME}/${plan.repository?.name ?? "workspace"}`;
+      const created = await client.create({
+        createBoxRequest: {
+          type: config.size,
+          ttlSeconds: config.timeoutMs === null ? null : Math.ceil((config.timeoutMs ?? 10 * 60000) / 1000),
+          noEnv: true,
+          env: plan.agent.environmentVariables
+        }
+      });
+      const handle = {
+        boxId: created.box.id,
+        repoDir: directory,
+        serve: { command: plan.agent.command, port: plan.agent.port }
+      };
+      try {
+        await waitUntilReady(client, handle.boxId);
+        await client.update({
+          boxId: handle.boxId,
+          updateBoxRequest: { name: `gitterm-${input.id}` }
+        });
+        await runCommand(handle.boxId, `mkdir -p ${shellQuote(directory)}`);
+        for (const command of config.runtimeSetupCommands ?? [
+          "npm install -g opencode-ai --no-audit --fund=false"
+        ]) {
+          await runCommand(handle.boxId, command, undefined, 600);
+        }
+        if (plan.repository) {
+          await runCommand(handle.boxId, cloneRepositoryScript(plan.repository, directory), "/", 600);
+        }
+        for (const file of plan.agent.files) {
+          const path = file.path.startsWith("~/") ? file.path.slice(2) : file.path;
+          await client.writeFile({
+            boxId: handle.boxId,
+            fileWriteRequest: { path, content: file.contentBase64, encoding: "base64" }
+          });
+        }
+        if (plan.setupCommands.length) {
+          await runCommand(handle.boxId, setupCommandScript(plan.setupCommands), directory, 600);
+        }
+        await startRuntime(handle);
+        const runtime = {
+          url: await getPublicUrl(handle),
+          directory,
+          password: input.password
+        };
+        await waitForDirectRuntime(runtime);
+        return { externalId: serializeHandle(handle), runtime };
+      } catch (error) {
+        await deleteBox(handle.boxId).catch(() => {
+          return;
+        });
+        throw error;
+      }
+    },
+    async status(workspace) {
+      try {
+        const box = (await client.get({ boxId: parseHandle(workspace.externalId).boxId })).box;
+        if (["ready", "idle", "running"].includes(box.state))
+          return "running";
+        if (["init", "provisioning", "provisioned", "cloning", "archiving"].includes(box.state)) {
+          return "pending";
+        }
+        if (box.state === "archived")
+          return "paused";
+        return "terminated";
+      } catch (error) {
+        if (error instanceof Error && /not found|404|does not exist/i.test(error.message)) {
+          return "terminated";
+        }
+        throw error;
+      }
+    },
+    async pause(workspace) {
+      await client.stop({ boxId: parseHandle(workspace.externalId).boxId });
+    },
+    async resume(workspace) {
+      const handle = parseHandle(workspace.externalId);
+      await client.resume({ boxId: handle.boxId, resumeRequest: { noEnv: true } });
+      await waitUntilReady(client, handle.boxId);
+      await startRuntime(handle);
+      const runtime = {
+        ...workspace.runtime,
+        url: await getPublicUrl(handle),
+        headers: undefined
+      };
+      await waitForDirectRuntime(runtime);
+      return runtime;
+    },
+    async terminate(workspace) {
+      await deleteBox(parseHandle(workspace.externalId).boxId);
+    },
+    async keepAlive(workspace, timeoutMs) {
+      await client.update({
+        boxId: parseHandle(workspace.externalId).boxId,
+        updateBoxRequest: { ttlSeconds: Math.ceil(timeoutMs / 1000) }
+      });
+    }
+  };
+}
+
+// src/direct/daytona.ts
+import { Daytona, Image } from "@daytonaio/sdk";
+var WORKSPACE_ROOT = "/workspace";
+var AGENT_SESSION_ID = "gitterm-direct-agent";
+function parseHandle2(externalId) {
+  const handle = JSON.parse(externalId);
+  if (typeof handle.id !== "string" || typeof handle.directory !== "string" || typeof handle.command !== "string" || typeof handle.port !== "number") {
+    throw new Error("Invalid Daytona direct workspace handle");
+  }
+  return handle;
+}
+function createDaytonaDirectProvider(config) {
+  if (!config.apiKey.trim())
+    throw new Error("Daytona apiKey is required");
+  if (!config.target.trim())
+    throw new Error("Daytona target is required");
+  const client = () => new Daytona({ apiKey: config.apiKey, target: config.target });
+  const getSandbox = async (externalId) => {
+    const handle = parseHandle2(externalId);
+    return { handle, sandbox: await client().get(handle.id) };
+  };
+  const execute = async (sandbox, command, cwd) => {
+    const result = await sandbox.process.executeCommand(command, cwd);
+    if (result.exitCode !== 0) {
+      throw new Error(`Daytona command failed with exit code ${result.exitCode}: ${result.result ?? command}`);
+    }
+  };
+  const startAgent = async (sandbox, handle) => {
+    await sandbox.process.createSession(AGENT_SESSION_ID).catch(() => {
+      return;
+    });
+    await sandbox.process.executeSessionCommand(AGENT_SESSION_ID, {
+      command: `cd ${shellQuote(handle.directory)}`
+    });
+    await sandbox.process.executeSessionCommand(AGENT_SESSION_ID, {
+      command: `${handle.command} > /tmp/gitterm-agent.log 2>&1`,
+      runAsync: true
+    });
+  };
+  const runtimeFor = async (sandbox, handle, password) => {
+    const preview = await sandbox.getPreviewLink(handle.port);
+    return {
+      url: preview.url,
+      directory: handle.directory,
+      password,
+      ...preview.token ? {
+        headers: {
+          "x-daytona-preview-token": preview.token,
+          "X-Daytona-Skip-Preview-Warning": "true"
+        }
+      } : {}
+    };
+  };
+  return {
+    name: "daytona",
+    capabilities: {
+      persistence: "supported",
+      recommendedLifecycle: "persistent",
+      supportsPause: true,
+      ephemeralPause: "stateful",
+      supportsKeepAlive: true
+    },
+    async create(input) {
+      const plan = input.provisioning;
+      const directory = `${WORKSPACE_ROOT}/${plan.repository?.name ?? "workspace"}`;
+      const handle = {
+        id: "",
+        directory,
+        command: plan.agent.command,
+        port: plan.agent.port
+      };
+      const common = {
+        name: `gitterm-${input.id}`,
+        envVars: plan.agent.environmentVariables,
+        labels: { gitterm_workspace: input.id },
+        autoDeleteInterval: input.lifecycle === "ephemeral" ? 0 : -1
+      };
+      const sandbox = await client().create({
+        ...common,
+        image: Image.base(await pinFloatingDockerImage(resolveDirectImage(config.image))).entrypoint(["sleep", "infinity"]),
+        resources: {
+          ...config.cpu != null ? { cpu: config.cpu } : {},
+          ...config.memory != null ? { memory: config.memory } : {},
+          ...config.disk != null ? { disk: config.disk } : {}
+        }
+      }, { timeout: 210 });
+      handle.id = sandbox.id;
+      try {
+        await execute(sandbox, `mkdir -p ${shellQuote(directory)}`);
+        if (plan.repository) {
+          const repository = plan.repository;
+          const url = repository.url.endsWith(".git") ? repository.url : `${repository.url}.git`;
+          await sandbox.git.clone(url, directory, repository.checkoutRef ?? repository.branch, undefined, repository.authToken ? repository.authUsername ?? "x-access-token" : undefined, repository.authToken);
+          if (repository.baseCommit) {
+            await execute(sandbox, `git fetch --depth 1 origin ${shellQuote(repository.baseCommit)} && git checkout --detach ${shellQuote(repository.baseCommit)}`, directory);
+          }
+        }
+        const home = await sandbox.getUserHomeDir() ?? "/home/daytona";
+        for (const file of plan.agent.files) {
+          const target = file.path.replace(/^~/, home);
+          const parent = target.slice(0, target.lastIndexOf("/"));
+          await execute(sandbox, `mkdir -p ${shellQuote(parent)} && printf %s ${shellQuote(file.contentBase64)} | base64 -d > ${shellQuote(target)}`);
+        }
+        if (plan.setupCommands.length) {
+          await execute(sandbox, setupCommandScript(plan.setupCommands), directory);
+        }
+        await startAgent(sandbox, handle);
+        const runtime = await runtimeFor(sandbox, handle, input.password);
+        await waitForDirectRuntime(runtime);
+        return { externalId: JSON.stringify(handle), runtime };
+      } catch (error) {
+        await sandbox.delete().catch(() => {
+          return;
+        });
+        throw error;
+      }
+    },
+    async status(workspace) {
+      try {
+        const { sandbox } = await getSandbox(workspace.externalId);
+        await sandbox.refreshData();
+        switch (sandbox.state) {
+          case "started":
+            return "running";
+          case "paused":
+          case "stopped":
+          case "archived":
+            return "paused";
+          case "error":
+          case "build_failed":
+            return "failed";
+          case "destroyed":
+          case "destroying":
+            return "terminated";
+          default:
+            return "pending";
+        }
+      } catch (error) {
+        if (error instanceof Error && /not found|404|does not exist/i.test(error.message)) {
+          return "terminated";
+        }
+        throw error;
+      }
+    },
+    async pause(workspace) {
+      const { sandbox } = await getSandbox(workspace.externalId);
+      await sandbox.refreshData();
+      if (sandbox.state !== "stopped")
+        await sandbox.stop();
+    },
+    async resume(workspace) {
+      const { handle, sandbox } = await getSandbox(workspace.externalId);
+      await sandbox.refreshData();
+      const previousState = sandbox.state;
+      if (previousState !== "started")
+        await sandbox.start();
+      if (previousState !== "started") {
+        await startAgent(sandbox, handle);
+      }
+      const runtime = await runtimeFor(sandbox, handle, workspace.runtime.password);
+      await waitForDirectRuntime(runtime);
+      return runtime;
+    },
+    async terminate(workspace) {
+      const { sandbox } = await getSandbox(workspace.externalId);
+      await sandbox.delete();
+    },
+    async keepAlive(workspace, timeoutMs) {
+      if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("Daytona keep-alive timeout must be positive");
+      }
+      const { sandbox } = await getSandbox(workspace.externalId);
+      await sandbox.setAutostopInterval(Math.max(1, Math.ceil(timeoutMs / 60000)));
+      await sandbox.refreshActivity();
+    }
+  };
+}
+
+// src/direct/e2b.ts
+import { Sandbox } from "e2b";
+var WORKSPACE_ROOT2 = "/home/user/workspace";
+function createE2BDirectProvider(config) {
+  if (!config.apiKey.trim())
+    throw new Error("E2B apiKey is required");
+  const size = config.size ?? "standard";
+  if (size !== "standard" && size !== "large") {
+    throw new Error("E2B size must be standard or large");
+  }
+  const templateId = config.templateId?.trim() || DIRECT_E2B_TEMPLATES[size];
+  const connect = (externalId) => Sandbox.connect(externalId, { apiKey: config.apiKey });
+  return {
+    name: "e2b",
+    capabilities: {
+      persistence: "supported",
+      recommendedLifecycle: "ephemeral",
+      supportsPause: true,
+      ephemeralPause: "stateful",
+      supportsKeepAlive: true
+    },
+    async create(input) {
+      const plan = input.provisioning;
+      const sandbox = await Sandbox.create(templateId, {
+        apiKey: config.apiKey,
+        timeoutMs: config.timeoutMs ?? 10 * 60000,
+        lifecycle: { onTimeout: input.lifecycle === "persistent" ? "pause" : "kill" },
+        network: { allowPublicTraffic: false },
+        envs: plan.agent.environmentVariables
+      });
+      const directory = `${WORKSPACE_ROOT2}/${plan.repository?.name ?? "workspace"}`;
+      try {
+        await sandbox.commands.run(`mkdir -p ${shellQuote(WORKSPACE_ROOT2)}`);
+        if (plan.repository) {
+          await sandbox.git.clone(plan.repository.url, {
+            path: directory,
+            branch: plan.repository.checkoutRef ?? plan.repository.branch,
+            username: plan.repository.authToken ? plan.repository.authUsername ?? "x-access-token" : undefined,
+            password: plan.repository.authToken
+          });
+        } else {
+          await sandbox.commands.run(`mkdir -p ${shellQuote(directory)}`);
+        }
+        if (plan.repository?.baseCommit) {
+          await sandbox.commands.run(`git -C ${shellQuote(directory)} fetch --depth 1 origin ${shellQuote(plan.repository.baseCommit)} && git -C ${shellQuote(directory)} checkout --detach ${shellQuote(plan.repository.baseCommit)}`);
+        }
+        for (const file of plan.agent.files) {
+          const path = file.path.replace(/^~/, "/home/user");
+          const parent = path.slice(0, path.lastIndexOf("/"));
+          await sandbox.commands.run(`mkdir -p ${shellQuote(parent)} && printf %s ${shellQuote(file.contentBase64)} | base64 -d > ${shellQuote(path)}`);
+        }
+        if (plan.setupCommands.length) {
+          await sandbox.commands.run(setupCommandScript(plan.setupCommands), { cwd: directory });
+        }
+        await sandbox.commands.run(plan.agent.command, {
+          cwd: directory,
+          background: true,
+          envs: plan.agent.environmentVariables
+        });
+        const token = sandbox.trafficAccessToken;
+        if (!token)
+          throw new Error("E2B traffic access token is missing");
+        const runtime = {
+          url: `https://${sandbox.getHost(plan.agent.port)}`,
+          directory,
+          password: input.password,
+          headers: { "e2b-traffic-access-token": token }
+        };
+        await waitForDirectRuntime(runtime);
+        return { externalId: sandbox.sandboxId, runtime };
+      } catch (error) {
+        await sandbox.kill().catch(() => {
+          return;
+        });
+        throw error;
+      }
+    },
+    async status(workspace) {
+      try {
+        const info = await Sandbox.getInfo(workspace.externalId, { apiKey: config.apiKey });
+        return info.state === "paused" ? "paused" : info.state === "running" ? "running" : "terminated";
+      } catch (error) {
+        if (error instanceof Error && /not found|404|does not exist/i.test(error.message)) {
+          return "terminated";
+        }
+        throw error;
+      }
+    },
+    async pause(workspace) {
+      await (await connect(workspace.externalId)).pause({ apiKey: config.apiKey });
+    },
+    async resume(workspace) {
+      const sandbox = await connect(workspace.externalId);
+      const token = sandbox.trafficAccessToken;
+      if (!token)
+        throw new Error("E2B traffic access token is missing");
+      const runtime = {
+        ...workspace.runtime,
+        url: `https://${sandbox.getHost(4096)}`,
+        headers: { "e2b-traffic-access-token": token }
+      };
+      await waitForDirectRuntime(runtime);
+      return runtime;
+    },
+    async terminate(workspace) {
+      await Sandbox.kill(workspace.externalId, { apiKey: config.apiKey });
+    },
+    async keepAlive(workspace, timeoutMs) {
+      await Sandbox.setTimeout(workspace.externalId, timeoutMs, { apiKey: config.apiKey });
+    }
+  };
+}
+
+// src/direct/exedev.ts
+var HOME2 = "/home/exedev";
+function serializeHandle2(handle) {
+  return JSON.stringify(handle);
+}
+function parseHandle3(value) {
+  try {
+    const handle = JSON.parse(value);
+    if (!handle.vmName || !handle.repoDir || !handle.serve?.command || !handle.serve.port) {
+      throw new Error("missing required fields");
+    }
+    return handle;
+  } catch {
+    throw new Error("Invalid exe.dev direct workspace handle");
+  }
+}
+function findToken(value) {
+  if (typeof value === "string")
+    return value.match(/exe[01]\.[A-Za-z0-9._-]+/)?.[0];
+  if (Array.isArray(value))
+    return value.map(findToken).find(Boolean);
+  if (value && typeof value === "object") {
+    return Object.values(value).map(findToken).find(Boolean);
+  }
+  return;
+}
+function resultStatus(value) {
+  const data = value;
+  const status = data?.status ?? data?.vms?.[0]?.status;
+  if (status === "running")
+    return "running";
+  if (status === "paused")
+    return "paused";
+  if (status === "creating")
+    return "pending";
+  return "terminated";
+}
+function createExeDevDirectProvider(config) {
+  if (!config.apiToken.trim())
+    throw new Error("exe.dev apiToken is required");
+  async function execute(command) {
+    const response = await fetch("https://exe.dev/exec", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${config.apiToken}`, "Content-Type": "text/plain" },
+      body: command
+    });
+    const text = await response.text();
+    if (!response.ok) {
+      const permissionHint = response.status === 401 || response.status === 403 || /permission|forbidden/i.test(text) ? " exe.dev tokens need cmds covering new, ls, ssh, share, ssh-key, pause, resume, and rm." : "";
+      throw new Error(`exe.dev command failed (${response.status}): ${text}.${permissionHint}`);
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  const runVmCommand = (handle, command) => execute(`ssh ${handle.vmName} -- bash -lc ${shellQuote(command)}`);
+  async function startRuntime(handle) {
+    await runVmCommand(handle, `cd ${shellQuote(handle.repoDir)} && nohup setsid bash -lc ${shellQuote(handle.serve.command)} > /tmp/opencode-server.log 2>&1 </dev/null &`);
+  }
+  async function accessToken(vmName) {
+    const token = findToken(await execute(`ssh-key generate-api-key --vm=${vmName} --label=gitterm-direct --exp=never`));
+    if (!token)
+      throw new Error("exe.dev did not return a VM access token");
+    return token;
+  }
+  async function waitUntilRunning(vmName) {
+    const deadline = Date.now() + 60000;
+    while (Date.now() < deadline) {
+      const status = await execute(`ls ${vmName}`).then(resultStatus).catch(() => "pending");
+      if (status === "running")
+        return;
+      await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    throw new Error("Timed out waiting for exe.dev VM");
+  }
+  async function runtime(handle, password) {
+    const token = await accessToken(handle.vmName);
+    return {
+      url: `https://${handle.vmName}.exe.xyz`,
+      directory: handle.repoDir,
+      password,
+      headers: { "X-Exedev-Authorization": `Bearer ${token}` }
+    };
+  }
+  return {
+    name: "exedev",
+    capabilities: {
+      persistence: "supported",
+      recommendedLifecycle: "ephemeral",
+      supportsPause: true,
+      ephemeralPause: "stateful",
+      supportsKeepAlive: false
+    },
+    async create(input) {
+      const plan = input.provisioning;
+      const vmSuffix = input.id.replace(/[^a-zA-Z0-9]/g, "").slice(0, 20).toLowerCase();
+      const vmName = `gitterm-${vmSuffix}`;
+      const handle = {
+        vmName,
+        repoDir: `${HOME2}/${plan.repository?.name ?? "workspace"}`,
+        serve: { command: plan.agent.command, port: plan.agent.port }
+      };
+      const createArgs = [
+        `new --name=${vmName}`,
+        "--no-email",
+        `--tag=${shellQuote(`gitterm-${input.id}`)}`,
+        `--image=${shellQuote(resolveDirectImage(config.image))}`,
+        config.cpu ? `--cpu=${config.cpu}` : "",
+        config.memory ? `--memory=${shellQuote(config.memory)}` : "",
+        config.disk ? `--disk=${shellQuote(config.disk)}` : "",
+        ...Object.entries(plan.agent.environmentVariables).map(([key, value]) => `--env=${shellQuote(`${key}=${value}`)}`)
+      ].filter(Boolean).join(" ");
+      await execute(createArgs);
+      try {
+        await waitUntilRunning(vmName);
+        await runVmCommand(handle, `mkdir -p ${shellQuote(handle.repoDir)}`);
+        for (const command of config.runtimeSetupCommands ?? []) {
+          await runVmCommand(handle, command);
+        }
+        if (plan.repository) {
+          await runVmCommand(handle, cloneRepositoryScript(plan.repository, handle.repoDir));
+        }
+        for (const file of plan.agent.files) {
+          const path = file.path.startsWith("~/") ? `${HOME2}/${file.path.slice(2)}` : file.path;
+          await runVmCommand(handle, `mkdir -p ${shellQuote(path.slice(0, path.lastIndexOf("/")))} && printf %s ${shellQuote(file.contentBase64)} | base64 -d > ${shellQuote(path)}`);
+        }
+        if (plan.setupCommands.length) {
+          await runVmCommand(handle, `cd ${shellQuote(handle.repoDir)} && ${setupCommandScript(plan.setupCommands)}`);
+        }
+        await startRuntime(handle);
+        await execute(`share port ${vmName} ${handle.serve.port}`);
+        await execute(`share set-private ${vmName}`);
+        const directRuntime = await runtime(handle, input.password);
+        await waitForDirectRuntime(directRuntime);
+        return { externalId: serializeHandle2(handle), runtime: directRuntime };
+      } catch (error) {
+        await execute(`rm ${vmName}`).catch(() => {
+          return;
+        });
+        throw error;
+      }
+    },
+    async status(workspace) {
+      try {
+        return resultStatus(await execute(`ls ${parseHandle3(workspace.externalId).vmName}`));
+      } catch (error) {
+        if (error instanceof Error && /not found|404|does not exist/i.test(error.message)) {
+          return "terminated";
+        }
+        throw error;
+      }
+    },
+    async pause(workspace) {
+      await execute(`pause ${parseHandle3(workspace.externalId).vmName}`);
+    },
+    async resume(workspace) {
+      const handle = parseHandle3(workspace.externalId);
+      await execute(`resume ${handle.vmName}`);
+      await waitUntilRunning(handle.vmName);
+      await execute(`share port ${handle.vmName} ${handle.serve.port}`);
+      await execute(`share set-private ${handle.vmName}`);
+      if (!workspace.runtime.password)
+        throw new Error("exe.dev runtime password is missing");
+      const directRuntime = await runtime(handle, workspace.runtime.password);
+      await waitForDirectRuntime(directRuntime);
+      return directRuntime;
+    },
+    async terminate(workspace) {
+      await execute(`rm ${parseHandle3(workspace.externalId).vmName}`);
+    }
+  };
+}
+
+// src/direct/railway.ts
+var DEFAULT_API_URL = "https://backboard.railway.app/graphql/v2";
+var OPENCODE_SERVER_PORT = 7681;
+var WORKSPACE_ROOT3 = "/workspace";
+var DEPLOYMENT_TIMEOUT_MS = 5 * 60000;
+var SERVICE_CREATE = `
+  mutation DirectServiceCreate($input: ServiceCreateInput!) {
+    serviceCreate(input: $input) { id }
+  }
+`;
+var SERVICE_INSTANCE_UPDATE = `
+  mutation DirectServiceInstanceUpdate(
+    $environmentId: String!
+    $serviceId: String!
+    $input: ServiceInstanceUpdateInput!
+  ) {
+    serviceInstanceUpdate(
+      environmentId: $environmentId
+      serviceId: $serviceId
+      input: $input
+    )
+  }
+`;
+var VOLUME_CREATE = `
+  mutation DirectVolumeCreate($input: VolumeCreateInput!) {
+    volumeCreate(input: $input) { id }
+  }
+`;
+var DOMAIN_CREATE = `
+  mutation DirectDomainCreate($input: ServiceDomainCreateInput!) {
+    serviceDomainCreate(input: $input) { id domain }
+  }
+`;
+var SERVICE_DEPLOY = `
+  mutation DirectServiceDeploy($environmentId: String!, $serviceId: String!) {
+    serviceInstanceDeploy(
+      environmentId: $environmentId
+      serviceId: $serviceId
+      latestCommit: true
+    )
+  }
+`;
+var LATEST_DEPLOYMENT = `
+  query DirectLatestDeployment($environmentId: String!, $serviceId: String!) {
+    serviceInstance(environmentId: $environmentId, serviceId: $serviceId) {
+      latestDeployment { id status }
+    }
+  }
+`;
+var DEPLOYMENT_REMOVE = `
+  mutation DirectDeploymentRemove($id: String!) { deploymentRemove(id: $id) }
+`;
+var SERVICE_DELETE = `
+  mutation DirectServiceDelete($id: String!) { serviceDelete(id: $id) }
+`;
+var VOLUME_DELETE = `
+  mutation DirectVolumeDelete($id: String!) { volumeDelete(volumeId: $id) }
+`;
+var DOMAIN_DELETE = `
+  mutation DirectDomainDelete($id: String!) { serviceDomainDelete(id: $id) }
+`;
+var VARIABLE_UPSERT = `
+  mutation DirectVariableUpsert($input: VariableUpsertInput!) {
+    variableUpsert(input: $input)
+  }
+`;
+function parseHandle4(externalId) {
+  try {
+    const handle = JSON.parse(externalId);
+    if (typeof handle.serviceId !== "string" || typeof handle.domainId !== "string" || typeof handle.domain !== "string" || typeof handle.deploymentId !== "string") {
+      throw new Error("missing fields");
+    }
+    return {
+      serviceId: handle.serviceId,
+      volumeId: handle.volumeId,
+      domainId: handle.domainId,
+      domain: handle.domain,
+      deploymentId: handle.deploymentId
+    };
+  } catch {
+    throw new Error("Invalid Railway direct workspace externalId");
+  }
+}
+function workspaceStatus(status) {
+  switch (status) {
+    case "SUCCESS":
+      return "running";
+    case "SLEEPING":
+    case "REMOVED":
+      return "paused";
+    case "CRASHED":
+    case "FAILED":
+    case "SKIPPED":
+      return "failed";
+    case "BUILDING":
+    case "DEPLOYING":
+    case "INITIALIZING":
+    case "NEEDS_APPROVAL":
+    case "QUEUED":
+    case "REMOVING":
+    case "WAITING":
+      return "pending";
+  }
+}
+function createRailwayDirectProvider(config) {
+  if (!config.apiToken.trim())
+    throw new Error("Railway apiToken is required");
+  if (!config.projectId.trim())
+    throw new Error("Railway projectId is required");
+  if (!config.environmentId.trim())
+    throw new Error("Railway environmentId is required");
+  const apiUrl = config.apiUrl?.trim() || DEFAULT_API_URL;
+  const runtimePort = config.runtimePort ?? OPENCODE_SERVER_PORT;
+  if (!Number.isInteger(runtimePort) || runtimePort < 1 || runtimePort > 65535) {
+    throw new Error("Railway runtimePort must be a valid TCP port");
+  }
+  const request = async (query, variables) => {
+    const response = await fetch(apiUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${config.apiToken}`
+      },
+      body: JSON.stringify({ query, variables })
+    });
+    if (!response.ok) {
+      throw new Error(`Railway API request failed (${response.status} ${response.statusText})`);
+    }
+    const result = await response.json();
+    if (result.errors?.length) {
+      throw new Error(`Railway GraphQL error: ${result.errors.map((error) => error.message).join(", ")}`);
+    }
+    if (!result.data)
+      throw new Error("Railway GraphQL response did not include data");
+    return result.data;
+  };
+  const latestDeployment = async (serviceId) => {
+    const result = await request(LATEST_DEPLOYMENT, { environmentId: config.environmentId, serviceId });
+    return result.serviceInstance?.latestDeployment ?? undefined;
+  };
+  const waitForDeployment = async (serviceId, previousDeploymentId) => {
+    const deadline = Date.now() + DEPLOYMENT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const deployment = await latestDeployment(serviceId);
+      if (deployment && deployment.id !== previousDeploymentId) {
+        if (deployment.status === "SUCCESS")
+          return deployment;
+        if (["CRASHED", "FAILED", "REMOVED", "SKIPPED"].includes(deployment.status)) {
+          throw new Error(`Railway deployment ${deployment.id} ended with ${deployment.status}`);
+        }
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+    throw new Error("Timed out waiting for Railway deployment");
+  };
+  const waitForDeploymentRemoval = async (serviceId, deploymentId) => {
+    const deadline = Date.now() + DEPLOYMENT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const deployment = await latestDeployment(serviceId);
+      if (!deployment || deployment.id !== deploymentId || deployment.status === "REMOVED")
+        return;
+      if (deployment.status === "FAILED" || deployment.status === "CRASHED") {
+        throw new Error(`Railway deployment ${deployment.id} ended with ${deployment.status}`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+    throw new Error("Timed out waiting for Railway deployment removal");
+  };
+  const removeResources = async (handle) => {
+    let failure;
+    for (const operation of [
+      handle.domainId ? () => request(DOMAIN_DELETE, { id: handle.domainId }) : undefined,
+      handle.serviceId ? () => request(SERVICE_DELETE, { id: handle.serviceId }) : undefined,
+      handle.volumeId ? () => request(VOLUME_DELETE, { id: handle.volumeId }) : undefined
+    ]) {
+      if (!operation)
+        continue;
+      await operation().catch((error) => {
+        failure ??= error;
+      });
+    }
+    if (failure)
+      throw failure;
+  };
+  return {
+    name: "railway",
+    capabilities: {
+      persistence: "supported",
+      recommendedLifecycle: "persistent",
+      supportsPause: true,
+      ephemeralPause: "state-losing",
+      supportsKeepAlive: false
+    },
+    async create(input) {
+      const plan = input.provisioning;
+      const handle = {};
+      const region = config.region?.trim();
+      try {
+        const created = await request(SERVICE_CREATE, {
+          input: {
+            projectId: config.projectId,
+            environmentId: config.environmentId,
+            name: input.id,
+            variables: railwayContainerEnvironment(plan)
+          }
+        });
+        handle.serviceId = created.serviceCreate.id;
+        await request(SERVICE_INSTANCE_UPDATE, {
+          environmentId: config.environmentId,
+          serviceId: handle.serviceId,
+          input: {
+            source: { image: resolveDirectImage(config.image) },
+            ...region ? { multiRegionConfig: { [region]: { numReplicas: 1 } } } : {}
+          }
+        });
+        if (input.lifecycle === "persistent") {
+          const volume = await request(VOLUME_CREATE, {
+            input: {
+              projectId: config.projectId,
+              environmentId: config.environmentId,
+              serviceId: handle.serviceId,
+              mountPath: WORKSPACE_ROOT3,
+              ...region ? { region } : {}
+            }
+          });
+          handle.volumeId = volume.volumeCreate.id;
+        }
+        const domain = await request(DOMAIN_CREATE, {
+          input: {
+            environmentId: config.environmentId,
+            serviceId: handle.serviceId,
+            targetPort: runtimePort
+          }
+        });
+        handle.domainId = domain.serviceDomainCreate.id;
+        handle.domain = domain.serviceDomainCreate.domain;
+        const previous = await latestDeployment(handle.serviceId);
+        await request(SERVICE_DEPLOY, {
+          environmentId: config.environmentId,
+          serviceId: handle.serviceId
+        });
+        const deployment = await waitForDeployment(handle.serviceId, previous?.id);
+        handle.deploymentId = deployment.id;
+        const runtime = {
+          url: `https://${handle.domain}`,
+          directory: `${WORKSPACE_ROOT3}/${plan.repository?.name ?? "workspace"}`,
+          password: input.password
+        };
+        await waitForDirectRuntime(runtime);
+        if (plan.repository?.authToken && handle.serviceId) {
+          await request(VARIABLE_UPSERT, {
+            input: {
+              environmentId: config.environmentId,
+              projectId: config.projectId,
+              serviceId: handle.serviceId,
+              name: "GITTERM_GIT_TOKEN",
+              value: "",
+              skipDeploys: true
+            }
+          });
+        }
+        if (!handle.serviceId || !handle.domainId || !handle.domain || !handle.deploymentId) {
+          throw new Error("Railway provisioning completed without all resource identifiers");
+        }
+        const completedHandle = {
+          serviceId: handle.serviceId,
+          volumeId: handle.volumeId,
+          domainId: handle.domainId,
+          domain: handle.domain,
+          deploymentId: handle.deploymentId
+        };
+        return { externalId: JSON.stringify(completedHandle), runtime };
+      } catch (error) {
+        const identifiers = Object.entries(handle).filter(([, value]) => value).map(([key, value]) => `${key}=${value}`).join(", ");
+        try {
+          await removeResources(handle);
+        } catch (cleanupError) {
+          throw new Error(`${error instanceof Error ? error.message : String(error)}; cleanup failed${identifiers ? ` (${identifiers})` : ""}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: cleanupError });
+        }
+        throw error;
+      }
+    },
+    async status(workspace) {
+      const handle = parseHandle4(workspace.externalId);
+      try {
+        const deployment = await latestDeployment(handle.serviceId);
+        return deployment ? workspaceStatus(deployment.status) : "terminated";
+      } catch (error) {
+        if (error instanceof Error && /not found|does not exist/i.test(error.message)) {
+          return "terminated";
+        }
+        throw error;
+      }
+    },
+    async pause(workspace) {
+      const handle = parseHandle4(workspace.externalId);
+      const deployment = await latestDeployment(handle.serviceId);
+      if (!deployment || deployment.status === "REMOVED")
+        return;
+      await request(DEPLOYMENT_REMOVE, { id: deployment.id });
+      await waitForDeploymentRemoval(handle.serviceId, deployment.id);
+    },
+    async resume(workspace) {
+      const handle = parseHandle4(workspace.externalId);
+      const previous = await latestDeployment(handle.serviceId);
+      await request(SERVICE_DEPLOY, {
+        environmentId: config.environmentId,
+        serviceId: handle.serviceId
+      });
+      await waitForDeployment(handle.serviceId, previous?.id);
+      await waitForDirectRuntime(workspace.runtime);
+      return workspace.runtime;
+    },
+    async terminate(workspace) {
+      await removeResources(parseHandle4(workspace.externalId));
+    }
+  };
+}
+
+// src/direct/vercel.ts
+import { Sandbox as Sandbox2 } from "@vercel/sandbox";
+var WORKSPACE_ROOT4 = "/vercel/sandbox";
+function parseHandle5(externalId) {
+  const handle = JSON.parse(externalId);
+  if (typeof handle.name !== "string" || typeof handle.directory !== "string" || typeof handle.command !== "string" || typeof handle.port !== "number") {
+    throw new Error("Invalid Vercel direct workspace handle");
+  }
+  return handle;
+}
+function createVercelDirectProvider(config) {
+  if (!config.apiToken.trim())
+    throw new Error("Vercel apiToken is required");
+  if (!config.teamId.trim())
+    throw new Error("Vercel teamId is required");
+  if (!config.projectId.trim())
+    throw new Error("Vercel projectId is required");
+  const credentials = {
+    token: config.apiToken,
+    teamId: config.teamId,
+    projectId: config.projectId
+  };
+  const getSandbox = async (externalId, resume) => {
+    const handle = parseHandle5(externalId);
+    const sandbox = await Sandbox2.get({ name: handle.name, resume, ...credentials });
+    return { handle, sandbox };
+  };
+  const run = async (sandbox, command, cwd, env) => {
+    const result = await sandbox.runCommand({
+      cmd: "bash",
+      args: ["-lc", command],
+      cwd,
+      env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(`Vercel command failed with exit code ${result.exitCode}: ${(await result.stderr()).trim() || command}`);
+    }
+  };
+  const startAgent = async (sandbox, handle) => {
+    await sandbox.runCommand({
+      cmd: "bash",
+      args: ["-lc", `exec ${handle.command} > /tmp/gitterm-agent.log 2>&1`],
+      cwd: handle.directory,
+      detached: true
+    });
+  };
+  return {
+    name: "vercel",
+    capabilities: {
+      persistence: "supported",
+      recommendedLifecycle: "persistent",
+      supportsPause: true,
+      ephemeralPause: "stateful",
+      supportsKeepAlive: true
+    },
+    async create(input) {
+      const plan = input.provisioning;
+      const handle = {
+        name: `gitterm-${input.id}`,
+        directory: `${WORKSPACE_ROOT4}/${plan.repository?.name ?? "workspace"}`,
+        command: plan.agent.command,
+        port: plan.agent.port
+      };
+      const sandbox = await Sandbox2.create({
+        ...credentials,
+        name: handle.name,
+        persistent: true,
+        keepLastSnapshots: { count: 1 },
+        ports: [handle.port],
+        env: plan.agent.environmentVariables,
+        timeout: config.timeoutMs ?? 10 * 60000,
+        tags: { gitterm_workspace: input.id },
+        ...config.image ? { image: config.image } : { runtime: config.runtime ?? "node24" },
+        ...config.vcpus != null ? { resources: { vcpus: config.vcpus } } : {}
+      });
+      try {
+        await run(sandbox, `mkdir -p ${shellQuote(handle.directory)}`);
+        for (const command of config.runtimeSetupCommands ?? (config.image ? [] : ["npm install -g opencode-ai --no-audit --fund=false"])) {
+          await run(sandbox, command);
+        }
+        if (plan.repository) {
+          const repository = plan.repository;
+          const url = repository.url.endsWith(".git") ? repository.url : `${repository.url}.git`;
+          const askPassPath = "/tmp/gitterm-git-askpass";
+          if (repository.authToken) {
+            await sandbox.writeFiles([
+              {
+                path: askPassPath,
+                mode: 448,
+                content: `#!/bin/sh
+case "$1" in
+  *Username*) printf '%s\\n' "$GITTERM_GIT_USERNAME" ;;
+  *) printf '%s\\n' "$GITTERM_GIT_TOKEN" ;;
+esac
+`
+              }
+            ]);
+          }
+          try {
+            const ref = repository.checkoutRef ?? repository.branch;
+            await run(sandbox, `git clone${ref ? ` --branch ${shellQuote(ref)}` : ""} ${shellQuote(url)} ${shellQuote(handle.directory)}`, undefined, repository.authToken ? {
+              GIT_ASKPASS: askPassPath,
+              GIT_TERMINAL_PROMPT: "0",
+              GITTERM_GIT_USERNAME: repository.authUsername ?? "x-access-token",
+              GITTERM_GIT_TOKEN: repository.authToken
+            } : undefined);
+          } finally {
+            if (repository.authToken) {
+              await sandbox.runCommand("rm", ["-f", askPassPath]).catch(() => {
+                return;
+              });
+            }
+          }
+          if (repository.baseCommit) {
+            await run(sandbox, `git fetch --depth 1 origin ${shellQuote(repository.baseCommit)} && git checkout --detach ${shellQuote(repository.baseCommit)}`, handle.directory);
+          }
+        }
+        const homeResult = await sandbox.runCommand("printenv", ["HOME"]);
+        const home = (await homeResult.stdout()).trim() || "/home/vercel-sandbox";
+        for (const file of plan.agent.files) {
+          const target = file.path.replace(/^~/, home);
+          const parent = target.slice(0, target.lastIndexOf("/"));
+          await run(sandbox, `mkdir -p ${shellQuote(parent)}`);
+          await sandbox.writeFiles([
+            { path: target, content: Buffer.from(file.contentBase64, "base64") }
+          ]);
+        }
+        if (plan.setupCommands.length) {
+          await run(sandbox, setupCommandScript(plan.setupCommands), handle.directory);
+        }
+        await startAgent(sandbox, handle);
+        const runtime = {
+          url: sandbox.domain(handle.port),
+          directory: handle.directory,
+          password: input.password
+        };
+        await waitForDirectRuntime(runtime);
+        return { externalId: JSON.stringify(handle), runtime };
+      } catch (error) {
+        await sandbox.delete().catch(() => {
+          return;
+        });
+        throw error;
+      }
+    },
+    async status(workspace) {
+      try {
+        const { sandbox } = await getSandbox(workspace.externalId, false);
+        if (sandbox.status === "running")
+          return "running";
+        if (["pending", "stopping", "snapshotting"].includes(sandbox.status))
+          return "pending";
+        if (sandbox.status === "stopped")
+          return "paused";
+        if (sandbox.status === "failed")
+          return "failed";
+        return "terminated";
+      } catch (error) {
+        if (error instanceof Error && /not found|404|does not exist/i.test(error.message)) {
+          return "terminated";
+        }
+        throw error;
+      }
+    },
+    async pause(workspace) {
+      const { sandbox } = await getSandbox(workspace.externalId, false);
+      if (sandbox.status !== "stopped")
+        await sandbox.stop();
+    },
+    async resume(workspace) {
+      const handle = parseHandle5(workspace.externalId);
+      const sandbox = await Sandbox2.get({
+        name: handle.name,
+        resume: true,
+        ...credentials,
+        onResume: async (resumed) => startAgent(resumed, handle)
+      });
+      const runtime = {
+        ...workspace.runtime,
+        url: sandbox.domain(handle.port),
+        directory: handle.directory
+      };
+      await waitForDirectRuntime(runtime);
+      return runtime;
+    },
+    async terminate(workspace) {
+      const { sandbox } = await getSandbox(workspace.externalId, false);
+      await sandbox.delete();
+    },
+    async keepAlive(workspace, timeoutMs) {
+      if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("Vercel keep-alive timeout must be positive");
+      }
+      const { sandbox } = await getSandbox(workspace.externalId, false);
+      await sandbox.update({ timeout: timeoutMs });
+    }
+  };
+}
+
+// src/direct/client.ts
+function resolveProvider(provider) {
+  if ("create" in provider)
+    return provider;
+  switch (provider.type) {
+    case "ascii":
+      return createAsciiDirectProvider(provider);
+    case "daytona":
+      return createDaytonaDirectProvider(provider);
+    case "e2b":
+      return createE2BDirectProvider(provider);
+    case "exedev":
+      return createExeDevDirectProvider(provider);
+    case "railway":
+      return createRailwayDirectProvider(provider);
+    case "vercel":
+      return createVercelDirectProvider(provider);
+  }
+}
+function runtimeClient(workspace) {
+  const authorization = workspace.runtime.password ? `Basic ${Buffer.from(`opencode:${workspace.runtime.password}`).toString("base64")}` : undefined;
+  return createOpencodeClient({
+    baseUrl: workspace.runtime.url,
+    directory: workspace.runtime.directory,
+    headers: {
+      ...workspace.runtime.headers,
+      ...authorization ? { Authorization: authorization } : {}
+    }
+  });
+}
+function authClient(workspace) {
+  const authorization = workspace.runtime.password ? `Basic ${Buffer.from(`opencode:${workspace.runtime.password}`).toString("base64")}` : undefined;
+  return createOpencodeV2Client({
+    baseUrl: workspace.runtime.url,
+    directory: workspace.runtime.directory,
+    headers: {
+      ...workspace.runtime.headers,
+      ...authorization ? { Authorization: authorization } : {}
+    }
+  });
+}
+function errorMessage(error) {
+  if (!error)
+    return "OpenCode request failed";
+  if (typeof error === "string")
+    return error;
+  if (typeof error === "object" && "data" in error) {
+    const data = error.data;
+    if (typeof data?.message === "string")
+      return data.message;
+  }
+  if (typeof error === "object" && "message" in error) {
+    const message = error.message;
+    if (typeof message === "string")
+      return message;
+  }
+  return error instanceof Error ? error.message : JSON.stringify(error);
+}
+function authStatus(status) {
+  const common = {
+    createdAt: Number(status.time.created),
+    expiresAt: Number(status.time.expires)
+  };
+  if (status.status === "failed")
+    return { status: "failed", message: status.message, ...common };
+  return { status: status.status, ...common };
+}
+function mapStatus(status, errorName, assistantCompleted = true) {
+  if (errorName === "MessageAbortedError")
+    return "cancelled";
+  if (errorName)
+    return "failed";
+  if (assistantCompleted)
+    return "completed";
+  if (status?.type === "retry")
+    return "retrying";
+  return "running";
+}
+function pollTiming(wait, fallbackTimeoutMs) {
+  const timeoutMs = wait.timeoutMs ?? fallbackTimeoutMs;
+  const pollIntervalMs = wait.pollIntervalMs ?? 1000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
+    throw new Error("timeoutMs must be a finite, non-negative number");
+  }
+  if (!Number.isFinite(pollIntervalMs) || pollIntervalMs < 0) {
+    throw new Error("pollIntervalMs must be a finite, non-negative number");
+  }
+  return { timeoutMs, pollIntervalMs };
+}
+function modelParts(model) {
+  if (!model)
+    return;
+  const separator = model.indexOf("/");
+  if (separator <= 0 || separator === model.length - 1) {
+    throw new Error('model must use the "provider/model" format');
+  }
+  return { providerID: model.slice(0, separator), modelID: model.slice(separator + 1) };
+}
+function createDirectGittermClient(options) {
+  const provider = resolveProvider(options.provider);
+  function assertWorkspace(workspace) {
+    if (workspace.provider !== provider.name) {
+      throw new Error(`Workspace belongs to ${workspace.provider}, not ${provider.name}`);
+    }
+  }
+  function assertRunWorkspace(run, workspace) {
+    assertWorkspace(workspace);
+    if (run.workspaceId !== workspace.id) {
+      throw new Error(`Run belongs to workspace ${run.workspaceId}, not ${workspace.id}`);
+    }
+  }
+  function assertAuthAttempt(attempt, workspace) {
+    assertWorkspace(workspace);
+    if (attempt.workspaceId !== workspace.id) {
+      throw new Error(`OAuth attempt belongs to workspace ${attempt.workspaceId}, not ${workspace.id}`);
+    }
+  }
+  async function getAuthStatus(attempt, workspace) {
+    assertAuthAttempt(attempt, workspace);
+    const result = await authClient(workspace).v2.integration.attempt.status({
+      attemptID: attempt.id
+    });
+    if (result.error || !result.data)
+      throw new Error(errorMessage(result.error));
+    return authStatus(result.data.data);
+  }
+  async function getRun(run, workspace) {
+    assertRunWorkspace(run, workspace);
+    const client = runtimeClient(workspace);
+    const [statuses, messages] = await Promise.all([
+      client.session.status({ query: { directory: workspace.runtime.directory } }),
+      client.session.messages({
+        path: { id: run.sessionId },
+        query: { directory: workspace.runtime.directory }
+      })
+    ]);
+    if (statuses.error || !statuses.data)
+      throw new Error(errorMessage(statuses.error));
+    if (messages.error || !messages.data)
+      throw new Error(errorMessage(messages.error));
+    const related = messages.data.filter((message) => message.info.id === run.messageId || message.info.role === "assistant" && message.info.parentID === run.messageId);
+    const assistant = related.findLast((message) => message.info.role === "assistant");
+    const assistantError = assistant?.info.role === "assistant" ? assistant.info.error : undefined;
+    const assistantCompleted = assistant?.info.role === "assistant" && assistant.info.time.completed != null;
+    const finalText = assistant?.parts.filter((part) => part.type === "text" && !part.ignored).map((part) => part.type === "text" ? part.text : "").join(`
+`).trim();
+    const sessionStatus = statuses.data[run.sessionId];
+    const status = assistant ? mapStatus(sessionStatus, assistantError?.name, Boolean(assistantCompleted)) : mapStatus(sessionStatus, undefined, false);
+    return {
+      ...run,
+      status,
+      error: assistantError ? errorMessage(assistantError) : null,
+      finalText: finalText || null
+    };
+  }
+  return {
+    provider: { name: provider.name, capabilities: provider.capabilities },
+    auth: {
+      async setCredential(workspace, credential) {
+        assertWorkspace(workspace);
+        const providerName = credential.providerName.trim();
+        if (!providerName) {
+          throw new Error("Model credential providerName is required");
+        }
+        const result = await runtimeClient(workspace).auth.set({
+          path: { id: providerName },
+          query: { directory: workspace.runtime.directory },
+          body: directModelAuth(credential)
+        });
+        if (result.error)
+          throw new Error(errorMessage(result.error));
+      },
+      async list(workspace) {
+        assertWorkspace(workspace);
+        const result = await authClient(workspace).v2.integration.list();
+        if (result.error || !result.data)
+          throw new Error(errorMessage(result.error));
+        return result.data.data;
+      },
+      async get(workspace, integrationId) {
+        assertWorkspace(workspace);
+        const result = await authClient(workspace).v2.integration.get({
+          integrationID: integrationId
+        });
+        if (result.error || !result.data)
+          throw new Error(errorMessage(result.error));
+        return result.data.data;
+      },
+      async connectKey(input) {
+        assertWorkspace(input.workspace);
+        const result = await authClient(input.workspace).v2.integration.connect.key({
+          integrationID: input.integrationId,
+          key: input.key,
+          label: input.label
+        });
+        if (result.error)
+          throw new Error(errorMessage(result.error));
+      },
+      async connectOAuth(input) {
+        assertWorkspace(input.workspace);
+        const result = await authClient(input.workspace).v2.integration.connect.oauth({
+          integrationID: input.integrationId,
+          methodID: input.methodId,
+          inputs: input.inputs ?? {},
+          label: input.label
+        });
+        if (result.error || !result.data)
+          throw new Error(errorMessage(result.error));
+        const attempt = result.data.data;
+        return {
+          id: attempt.attemptID,
+          workspaceId: input.workspace.id,
+          integrationId: input.integrationId,
+          url: attempt.url,
+          instructions: attempt.instructions,
+          mode: attempt.mode,
+          createdAt: Number(attempt.time.created),
+          expiresAt: Number(attempt.time.expires)
+        };
+      },
+      async status(attempt, workspace) {
+        return getAuthStatus(attempt, workspace);
+      },
+      async complete(attempt, workspace, code) {
+        assertAuthAttempt(attempt, workspace);
+        if (attempt.mode !== "code")
+          throw new Error("Only code-based OAuth attempts are completed manually");
+        if (!code.trim())
+          throw new Error("OAuth authorization code is required");
+        const result = await authClient(workspace).v2.integration.attempt.complete({
+          attemptID: attempt.id,
+          code
+        });
+        if (result.error)
+          throw new Error(errorMessage(result.error));
+      },
+      async wait(attempt, workspace, wait = {}) {
+        assertAuthAttempt(attempt, workspace);
+        const { timeoutMs, pollIntervalMs } = pollTiming(wait, Math.max(0, attempt.expiresAt - Date.now()));
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() <= deadline) {
+          const status = await getAuthStatus(attempt, workspace);
+          if (status.status === "complete")
+            return status;
+          if (status.status === "failed")
+            throw new Error(status.message);
+          if (status.status === "expired")
+            throw new Error("OAuth attempt expired");
+          const remaining = deadline - Date.now();
+          if (remaining <= 0)
+            break;
+          await new Promise((resolve) => setTimeout(resolve, Math.min(pollIntervalMs, remaining)));
+        }
+        throw new Error(`OAuth attempt timed out after ${timeoutMs}ms`);
+      },
+      async cancel(attempt, workspace) {
+        assertAuthAttempt(attempt, workspace);
+        const result = await authClient(workspace).v2.integration.attempt.cancel({
+          attemptID: attempt.id
+        });
+        if (result.error)
+          throw new Error(errorMessage(result.error));
+      }
+    },
+    workspaces: {
+      async create(input = {}) {
+        const lifecycle = input.lifecycle ?? provider.capabilities.recommendedLifecycle;
+        if (lifecycle === "persistent" && provider.capabilities.persistence === "unsupported") {
+          throw new Error(`${provider.name} does not support persistent direct workspaces`);
+        }
+        const id = input.id ?? randomUUID();
+        const password = randomUUID();
+        const provisioning = buildDirectProvisioningPlan({ ...input, id, lifecycle, password });
+        const created = await provider.create({ ...input, id, lifecycle, password, provisioning });
+        return {
+          id,
+          provider: provider.name,
+          externalId: created.externalId,
+          status: "running",
+          lifecycle,
+          runtime: created.runtime,
+          createdAt: new Date().toISOString()
+        };
+      },
+      async status(workspace) {
+        assertWorkspace(workspace);
+        return { ...workspace, status: await provider.status(workspace) };
+      },
+      async pause(workspace) {
+        assertWorkspace(workspace);
+        if (!provider.pause)
+          throw new Error(`${provider.name} does not support pause`);
+        if (workspace.lifecycle === "ephemeral" && provider.capabilities.ephemeralPause !== "stateful") {
+          throw new Error(`${provider.name} cannot pause an ephemeral workspace without losing state`);
+        }
+        await provider.pause(workspace);
+        return { ...workspace, status: "paused" };
+      },
+      async resume(workspace) {
+        assertWorkspace(workspace);
+        if (!provider.resume)
+          throw new Error(`${provider.name} does not support resume`);
+        const runtime = await provider.resume(workspace);
+        return {
+          ...workspace,
+          status: "running",
+          runtime: { ...workspace.runtime, ...runtime }
+        };
+      },
+      async terminate(workspace) {
+        assertWorkspace(workspace);
+        await provider.terminate(workspace);
+        return { ...workspace, status: "terminated" };
+      },
+      async keepAlive(workspace, timeoutMs) {
+        assertWorkspace(workspace);
+        if (!provider.keepAlive)
+          throw new Error(`${provider.name} does not support keep-alive`);
+        await provider.keepAlive(workspace, timeoutMs);
+      }
+    },
+    runs: {
+      async create(input) {
+        assertWorkspace(input.workspace);
+        const client = runtimeClient(input.workspace);
+        let sessionId = input.sessionId;
+        let title = input.title ?? "Agent run";
+        if (!sessionId) {
+          const created = await client.session.create({
+            body: input.title ? { title: input.title } : undefined,
+            query: { directory: input.workspace.runtime.directory }
+          });
+          if (created.error || !created.data)
+            throw new Error(errorMessage(created.error));
+          sessionId = created.data.id;
+          title = created.data.title;
+        }
+        const messageId = `msg_${randomUUID().replaceAll("-", "")}`;
+        const prompted = await client.session.promptAsync({
+          path: { id: sessionId },
+          query: { directory: input.workspace.runtime.directory },
+          body: {
+            messageID: messageId,
+            parts: [{ type: "text", text: input.prompt }],
+            agent: input.agent,
+            model: modelParts(input.model)
+          }
+        });
+        if (prompted.error)
+          throw new Error(errorMessage(prompted.error));
+        return {
+          id: randomUUID(),
+          workspaceId: input.workspace.id,
+          sessionId,
+          messageId,
+          title,
+          status: "running",
+          error: null,
+          finalText: null,
+          submittedAt: new Date().toISOString()
+        };
+      },
+      get: getRun,
+      async wait(run, workspace, wait = {}) {
+        const { timeoutMs, pollIntervalMs } = pollTiming(wait, 10 * 60000);
+        const deadline = Date.now() + timeoutMs;
+        let current = run;
+        while (Date.now() < deadline) {
+          current = await getRun(current, workspace);
+          if (!["running", "retrying"].includes(current.status))
+            return current;
+          const remaining = deadline - Date.now();
+          if (remaining <= 0)
+            break;
+          await new Promise((resolve) => setTimeout(resolve, Math.min(pollIntervalMs, remaining)));
+        }
+        throw new Error(`Agent run timed out after ${timeoutMs}ms`);
+      },
+      async messages(run, workspace) {
+        assertRunWorkspace(run, workspace);
+        const result = await runtimeClient(workspace).session.messages({
+          path: { id: run.sessionId },
+          query: { directory: workspace.runtime.directory }
+        });
+        if (result.error || !result.data)
+          throw new Error(errorMessage(result.error));
+        return result.data.filter((message) => message.info.id === run.messageId || message.info.role === "assistant" && message.info.parentID === run.messageId).map((message) => ({
+          id: message.info.id,
+          role: message.info.role,
+          text: message.parts.filter((part) => part.type === "text" && !part.ignored).map((part) => part.type === "text" ? part.text : "").join(`
+`).trim(),
+          error: message.info.role === "assistant" && message.info.error ? errorMessage(message.info.error) : null
+        }));
+      },
+      async cancel(run, workspace) {
+        const current = await getRun(run, workspace);
+        if (!["running", "retrying"].includes(current.status))
+          return false;
+        const result = await runtimeClient(workspace).session.abort({
+          path: { id: run.sessionId },
+          query: { directory: workspace.runtime.directory }
+        });
+        if (result.error)
+          throw new Error(errorMessage(result.error));
+        return result.data === true;
+      }
+    }
+  };
+}
+export {
+  createVercelDirectProvider,
+  createRailwayDirectProvider,
+  createExeDevDirectProvider,
+  createE2BDirectProvider,
+  createDirectGittermClient,
+  createDaytonaDirectProvider,
+  createAsciiDirectProvider
+};