@hachej/boring-agent 0.1.27 → 0.1.28

package/dist/server/index.d.ts

@@ -134,6 +134,10 @@ declare function buildSnapshotRecipeHash(input: {
 }): string;
 declare function bakeSnapshotIfNeeded(opts: SnapshotBakeOptions): Promise<SnapshotBakeResult>;
 
+/**
+ * uv setup for Python-family runtimes (e.g. Vercel `python3.13`), which already
+ * ship `pip` and usually `uv`. Verify-or-install via the on-PATH `uv`.
+ */
 declare const UV_SETUP_COMMANDS: readonly ["command -v uv >/dev/null 2>&1 || python3 -m pip install --upgrade uv", "uv --version"];
 type DeploymentSnapshotStatus = 'skipped' | 'cache-hit' | 'baked' | 'failed';
 interface DeploymentSnapshotRecipe {

package/dist/server/index.js

@@ -1357,7 +1357,7 @@ function shellQuote(value) {
 function makeInstallCommand(binary, packages) {
   const quoted = packages.map(shellQuote).join(" ");
   if (binary === "dnf") {
-    return `dnf install -y ${quoted}`;
+    return `sudo dnf install -y ${quoted}`;
   }
   return `python3 -m pip install ${quoted}`;
 }
@@ -1550,17 +1550,29 @@ async function bakeSnapshotIfNeeded(opts) {
 }
 
 // src/server/sandbox/snapshots/deploymentSnapshot.ts
+var VERCEL_UV_BIN = "/home/vercel-sandbox/.local/bin/uv";
 var UV_SETUP_COMMANDS = [
   "command -v uv >/dev/null 2>&1 || python3 -m pip install --upgrade uv",
   "uv --version"
 ];
+var NODE_UV_SETUP_COMMANDS = [
+  "command -v pip3 >/dev/null 2>&1 || sudo dnf install -y python3-pip",
+  `[ -x ${VERCEL_UV_BIN} ] || python3 -m pip install --user --upgrade uv`,
+  `${VERCEL_UV_BIN} --version`
+];
+function isNodeFamilyRuntime(runtime) {
+  return typeof runtime === "string" && /^node/i.test(runtime.trim());
+}
+function uvSetupCommandsForRuntime(runtime) {
+  return isNodeFamilyRuntime(runtime) ? NODE_UV_SETUP_COMMANDS : UV_SETUP_COMMANDS;
+}
 function buildDeploymentSnapshotRecipe(opts = {}) {
   return {
     runtime: opts.runtime,
     systemPackages: opts.systemPackages,
     pythonPackages: opts.pythonPackages,
     setupCommands: [
-      ...opts.includeUv === false ? [] : UV_SETUP_COMMANDS,
+      ...opts.includeUv === false ? [] : uvSetupCommandsForRuntime(opts.runtime),
       ...opts.setupCommands ?? []
     ]
   };
@@ -3150,6 +3162,17 @@ async function commandOutput2(adapter, command, args) {
   return result?.stdout?.trim() ?? "";
 }
 async function ensureUv(options) {
+  const explicitUvBin = options.explicitUvBin?.trim();
+  if (explicitUvBin) {
+    try {
+      return {
+        uvBin: explicitUvBin,
+        uvVersion: await commandOutput2(options.adapter, explicitUvBin, ["--version"]) || "uv unknown",
+        installedWorkspaceUv: false
+      };
+    } catch {
+    }
+  }
   try {
     return {
       uvBin: "uv",
@@ -3619,7 +3642,11 @@ async function provisionWorkspaceRuntime(opts) {
       run: () => ensurePythonRuntime({
         adapter: opts.adapter,
         runtimeLayout: opts.runtimeLayout,
-        packages: pythonPackages
+        packages: pythonPackages,
+        // Provider-neutral seam: a deploy/provider (e.g. Vercel Node runtime) may
+        // export the explicit uv path since it is not on the non-interactive exec
+        // PATH. Unset for direct/local — they fall back to bare `uv`.
+        explicitUvBin: getEnv("BORING_AGENT_UV_BIN")?.trim() || void 0
       })
     });
     const result = {
@@ -3739,20 +3766,26 @@ var LOCAL_SANDBOX_WORKSPACE_ROOT = "/workspace";
 function sourceToPath4(source) {
   return source instanceof URL ? fileURLToPath5(source) : source;
 }
-async function assertExistingInsideWorkspace(root, relPath) {
+async function assertExistingInsideWorkspace(root, relPath, enforceSymlinkBoundary) {
   const absPath = validatePath(root, relPath);
   try {
-    await assertRealPathWithinWorkspace(root, absPath);
+    if (enforceSymlinkBoundary) {
+      await assertRealPathWithinWorkspace(root, absPath);
+    } else {
+      await lstat3(absPath);
+    }
     return absPath;
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
 }
-async function prepareWritablePath(root, relPath) {
+async function prepareWritablePath(root, relPath, enforceSymlinkBoundary) {
   const absPath = validatePath(root, relPath);
   await mkdir6(dirname9(absPath), { recursive: true });
-  await assertRealPathWithinWorkspace(root, dirname9(absPath));
+  if (enforceSymlinkBoundary) {
+    await assertRealPathWithinWorkspace(root, dirname9(absPath));
+  }
   try {
     const targetStat = await lstat3(absPath);
     if (targetStat.isSymbolicLink()) {
@@ -3848,36 +3881,39 @@ async function copyExternalSourceIntoWorkspace(paths, sourcePath, opts) {
   });
   return `${LOCAL_SANDBOX_WORKSPACE_ROOT}/${relTarget}`;
 }
-function createWorkspaceFs(workspaceRoot) {
+function createWorkspaceFs(workspaceRoot, opts) {
+  const { enforceSymlinkBoundary } = opts;
   return {
     async exists(workspaceRelativePath) {
-      const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath);
+      const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath, enforceSymlinkBoundary);
       if (!absPath) return false;
       await lstat3(absPath);
       return true;
     },
     async rm(workspaceRelativePath) {
-      const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath);
+      const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath, enforceSymlinkBoundary);
       if (!absPath) return;
       await rm3(absPath, { recursive: true, force: true });
     },
     async mkdir(workspaceRelativePath) {
       const absPath = validatePath(workspaceRoot, workspaceRelativePath);
       await mkdir6(absPath, { recursive: true });
-      await assertRealPathWithinWorkspace(workspaceRoot, absPath);
+      if (enforceSymlinkBoundary) {
+        await assertRealPathWithinWorkspace(workspaceRoot, absPath);
+      }
     },
     async writeText(workspaceRelativePath, content) {
-      const absPath = await prepareWritablePath(workspaceRoot, workspaceRelativePath);
+      const absPath = await prepareWritablePath(workspaceRoot, workspaceRelativePath, enforceSymlinkBoundary);
       await writeFile5(absPath, content, "utf8");
     },
     async readText(workspaceRelativePath) {
-      const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath);
+      const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath, enforceSymlinkBoundary);
       if (!absPath) return null;
       return await readFile6(absPath, "utf8");
     },
     async copyFromHost(hostSourcePath, workspaceRelativeTarget) {
       const sourcePath = sourceToPath4(hostSourcePath);
-      const absTarget = await prepareWritablePath(workspaceRoot, workspaceRelativeTarget);
+      const absTarget = await prepareWritablePath(workspaceRoot, workspaceRelativeTarget, enforceSymlinkBoundary);
       const sourceStat = await stat7(sourcePath);
       await cp3(sourcePath, absTarget, {
         recursive: sourceStat.isDirectory(),
@@ -3896,7 +3932,7 @@ function createDirectProvisioningAdapter(paths, runner = spawnCommand) {
     async resolveInstallSource(source) {
       return sourceToPath4(source);
     },
-    workspaceFs: createWorkspaceFs(paths.workspaceRoot),
+    workspaceFs: createWorkspaceFs(paths.workspaceRoot, { enforceSymlinkBoundary: false }),
     getRuntimeCacheRoot() {
       return paths.cache;
     }
@@ -3938,7 +3974,7 @@ function createLocalProvisioningAdapter(paths, runner = spawnCommand) {
       }
       return await copyExternalSourceIntoWorkspace(paths, realSource, opts);
     },
-    workspaceFs: createWorkspaceFs(paths.workspaceRoot),
+    workspaceFs: createWorkspaceFs(paths.workspaceRoot, { enforceSymlinkBoundary: true }),
     getRuntimeCacheRoot() {
       return paths.cache;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-agent",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "type": "module",
   "license": "MIT",
   "description": "Pane-embeddable coding agent. Ships direct/local/vercel-sandbox execution modes behind one interface.",
@@ -75,7 +75,7 @@
     "use-stick-to-bottom": "^1.1.3",
     "yaml": "^2.8.3",
     "zod": "^3.25.76",
-    "@hachej/boring-ui-kit": "0.1.27"
+    "@hachej/boring-ui-kit": "0.1.28"
   },
   "devDependencies": {
     "@opentelemetry/api": "^1.9.1",