@intentic/sandbox-run 1.244.0 → 1.246.1

package/README.md

@@ -10,12 +10,19 @@ app); this package is why they cannot disagree about what one is.
 
 - Define the container's identity: its name, image, labels and volumes.
 - Define its posture: which capabilities it gets, and which it is denied.
-- Bound a local workspace to a share of its machine (35%, held between 4 and 24 GiB, plus a swap allowance),
-  so a runaway build or local model is killed inside its cgroup instead of exhausting the desktop or WSL VM.
-  A share rather than a number because the cap is per container and the host pays cap x count: two sandboxes
-  have to fit. `localSandboxMemory` is the policy, pure arithmetic on a byte count so this package stays
-  browser-importable; the caller that can measure passes the result as `memory`/`memorySwap`, and one that
-  cannot gets `LOCAL_SANDBOX_MEMORY`. Hosted providers keep owning their machine limits.
+- Bound a local workspace to its share of the machine, and carry the owner's own asks about that share. The
+  derived memory cap is everything the docker engine has minus a fixed 3 GiB the host keeps (floor 4 GiB,
+  swap unbounded; `index.ts` says why each of those replaced a fraction and a no-swap rule that froze real
+  machines). CPUs are unbounded unless asked. Three replayed env vars carry what the owner asked for instead,
+  said once ON the container and re-emitted onto every container that replaces it: `SANDBOX_MEMORY` (whole
+  GiB, held inside the same bounds), `SANDBOX_CPUS` (whole cores, at most the engine's), and `SANDBOX_RUNTIME`
+  (allowlisted directives the owner added beyond the approved overlay's, `--privileged`, `--gpus=all`). The
+  run carries the UNION of the overlay's directives and the owner's, and stamps the overlay's half on the
+  container as `SANDBOX_OVERLAY_RUNTIME`, so a reader can tell a capability's demand (which a view draws locked)
+  from an owner's ask (which they may withdraw). The policy is pure arithmetic so this package stays
+  browser-importable; the caller that can measure (`intentic sandbox run-command`, inside the image) reads
+  /proc and the probe's own env for the seeds and passes the results in. Hosted providers keep owning their
+  machine limits.
 - Define the environment allowlist: what is allowed to cross into the box.
 - Carry an optional sandbox definition (`definition`, a `sandbox.toml` text) into the box as
   `SANDBOX_DEFINITION_SEED` (base64, so its quotes and newlines never meet a shell): the daemon seeds an EMPTY

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export declare const SANDBOX_CAPABILITIES: readonly ["SYS_ADMIN", "SYS_PTRACE"];
 export declare const LOCAL_SANDBOX_MEMORY = "7g";
 export declare const SANDBOX_MEMORY_SWAP = "-1";
 export declare const localSandboxMemory: (totalBytes: number, override?: string) => string;
+export declare const localSandboxCpus: (engineCpus: number, override?: string) => string | undefined;
 export declare const RUNTIME_DIRECTIVE_PREFIX = "# intentic:runtime ";
 export declare const RUNTIME_DIRECTIVES: readonly ["--device=/dev/net/tun", "--cap-add=NET_ADMIN", "--privileged", "--gpus=all"];
 export interface OptionalDirective {
@@ -29,7 +30,10 @@ export interface OptionalDirective {
 export declare const OPTIONAL_DIRECTIVES: readonly OptionalDirective[];
 export declare const optionalDirective: (token: string) => OptionalDirective | undefined;
 export declare const runtimeDirectivesOf: (overlay: string) => string[];
-export declare const REPLAY_ENV: readonly ["WORKSPACE_ROOT", "HISTORY_ROOT", "AGENT_AUTH_DIR", "SANDBOX_HOST", "SANDBOX_PORT", "SANDBOX_NAME", "PREVIEW_PORT", "GOOGLE_CLIENT_ID", "CONNECT_TOKEN", "OWNER_EMAIL", "WEB_ORIGIN", "SANDBOX_PUBLIC_URL", "PLATFORM_URL", "SANDBOX_GRANT", "INGRESS_URL", "CLOUDFLARE_API_TOKEN", "HOST_SSH_KEY", "SELF_HOST_USER", "SYNC_PAIR_TOKEN", "HOST_PAIR_TOKEN", "HOST_PLATFORM", "HOST_LABEL", "SELF_HOST_ADDRESS", "SELF_HOST_VIA", "SANDBOX_MEMORY", "RUNNER_PARENT_URL", "RUNNER_PAIR_TOKEN"];
+export declare const HOST_RUNTIME_ENV = "SANDBOX_RUNTIME";
+export declare const hostRuntimeOf: (value: string | undefined) => string[];
+export declare const OVERLAY_RUNTIME_ENV = "SANDBOX_OVERLAY_RUNTIME";
+export declare const REPLAY_ENV: readonly ["WORKSPACE_ROOT", "HISTORY_ROOT", "AGENT_AUTH_DIR", "SANDBOX_HOST", "SANDBOX_PORT", "SANDBOX_NAME", "PREVIEW_PORT", "GOOGLE_CLIENT_ID", "CONNECT_TOKEN", "OWNER_EMAIL", "WEB_ORIGIN", "SANDBOX_PUBLIC_URL", "PLATFORM_URL", "SANDBOX_GRANT", "INGRESS_URL", "CLOUDFLARE_API_TOKEN", "HOST_SSH_KEY", "SELF_HOST_USER", "SYNC_PAIR_TOKEN", "HOST_PAIR_TOKEN", "HOST_PLATFORM", "HOST_LABEL", "SELF_HOST_ADDRESS", "SELF_HOST_VIA", "SANDBOX_MEMORY", "SANDBOX_CPUS", "SANDBOX_RUNTIME", "RUNNER_PARENT_URL", "RUNNER_PAIR_TOKEN"];
 export declare const parseNulEnv: (dump: string) => [string, string][];
 export declare const replayableEnv: (pairs: readonly (readonly [string, string])[]) => [string, string][];
 export declare const HEALTH: {
@@ -49,6 +53,8 @@ export interface SandboxRun {
     readonly definition?: string;
     readonly env?: readonly (readonly [string, string])[];
     readonly runtime?: readonly string[];
+    readonly hostRuntime?: readonly string[];
+    readonly cpus?: string;
     readonly mounts?: readonly string[];
     readonly memory?: string;
     readonly ports?: readonly string[];

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAExD,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,YAO1C,CAAC;AAkBH,eAAO,MAAM,oBAAoB,YAAI,WAAW,EAAE,YAAY,CAAU,CAAC;AAiBzE,eAAO,MAAM,oBAAoB,OAAO,CAAC;AA8BzC,eAAO,MAAM,mBAAmB,OAAO,CAAC;AA4CxC,eAAO,MAAM,kBAAkB,eAAgB,MAAM,aAAa,MAAM,KAAG,MAS1E,CAAC;AAUF,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,kBAAkB,YAAI,uBAAuB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AA6B1H,MAAM,WAAW,iBAAiB;IAE9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5H;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAO3D,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAAW,MAAM,KAAG,iBAAiB,GAAG,SAAuE,CAAC;AAS9I,eAAO,MAAM,mBAAmB,YAAa,MAAM,KAAG,MAAM,EAc3D,CAAC;AAOF,eAAO,MAAM,UAAU,YACnB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,EAMd,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAGjB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,EAWf,gBAAgB,EAMhB,mBAAmB,EACnB,mBAAmB,CACb,CAAC;AAIX,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAOjD,CAAC;AAKX,eAAO,MAAM,aAAa,UAAW,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAIxF,CAAC;AAKP,eAAO,MAAM,MAAM;aAAK,GAAG;aAA4C,QAAQ,EAAE,EAAE;aAAE,eAAe,EAAE,CAAC;CAAW,CAAC;AAyBnH,eAAO,MAAM,eAAe,cAAe,MAAM,KAAG,MAA0F,CAAC;AAS/I,eAAO,MAAM,sBAAsB,cAAe,MAAM,KAAG,MAA0D,CAAC;AAGtH,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAEtD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAOpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAUhC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC5B;AAKD,eAAO,MAAM,cAAc,QAAS,UAAU,KAAG,MAAM,EA0DtD,CAAC;AAIF,eAAO,MAAM,iBAAiB,QAAS,UAAU,KAAG,MAAsE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAExD,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,YAO1C,CAAC;AAkBH,eAAO,MAAM,oBAAoB,YAAI,WAAW,EAAE,YAAY,CAAU,CAAC;AAiBzE,eAAO,MAAM,oBAAoB,OAAO,CAAC;AA8BzC,eAAO,MAAM,mBAAmB,OAAO,CAAC;AA4CxC,eAAO,MAAM,kBAAkB,eAAgB,MAAM,aAAa,MAAM,KAAG,MAS1E,CAAC;AAkBF,eAAO,MAAM,gBAAgB,eAAgB,MAAM,aAAa,MAAM,KAAG,MAAM,GAAG,SAUjF,CAAC;AAUF,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,kBAAkB,YAAI,uBAAuB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AA6B1H,MAAM,WAAW,iBAAiB;IAE9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5H;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAO3D,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAAW,MAAM,KAAG,iBAAiB,GAAG,SAAuE,CAAC;AAyB9I,eAAO,MAAM,mBAAmB,YAAa,MAAM,KAAG,MAAM,EAOvD,CAAC;AAcN,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,eAAO,MAAM,aAAa,UAAW,MAAM,GAAG,SAAS,KAAG,MAAM,EAA4E,CAAC;AAQ7I,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAO7D,eAAO,MAAM,UAAU,YACnB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,EAMd,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAGjB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,EAWf,gBAAgB,EAGhB,cAAc,EACd,iBAAiB,EAMjB,mBAAmB,EACnB,mBAAmB,CACb,CAAC;AAIX,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAOjD,CAAC;AAKX,eAAO,MAAM,aAAa,UAAW,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAIxF,CAAC;AAKP,eAAO,MAAM,MAAM;aAAK,GAAG;aAA4C,QAAQ,EAAE,EAAE;aAAE,eAAe,EAAE,CAAC;CAAW,CAAC;AAyBnH,eAAO,MAAM,eAAe,cAAe,MAAM,KAAG,MAA0F,CAAC;AAS/I,eAAO,MAAM,sBAAsB,cAAe,MAAM,KAAG,MAA0D,CAAC;AAGtH,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAEtD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGrC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAIzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAOpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAUhC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC5B;AA+DD,eAAO,MAAM,cAAc,QAAS,UAAU,KAAG,MAAM,EAyCtD,CAAC;AAIF,eAAO,MAAM,iBAAiB,QAAS,UAAU,KAAG,MAAsE,CAAC"}

package/dist/index.js

@@ -34,6 +34,17 @@ export const localSandboxMemory = (totalBytes, override) => {
     }
     return capString(Math.max(totalBytes - SANDBOX_MEMORY_RESERVE, SANDBOX_MEMORY_FLOOR));
 };
+export const localSandboxCpus = (engineCpus, override) => {
+    if (override === undefined || override.trim() === "") {
+        return undefined;
+    }
+    const asked = /^(\d+)$/u.exec(override.trim());
+    if (asked === null || Number(asked[1]) < 1) {
+        throw new Error(`SANDBOX_CPUS must be a whole number of CPUs, at least 1 (e.g. '4'), got '${override}'`);
+    }
+    const measured = Number.isFinite(engineCpus) && engineCpus >= 1;
+    return String(measured ? Math.min(Number(asked[1]), Math.floor(engineCpus)) : Number(asked[1]));
+};
 export const RUNTIME_DIRECTIVE_PREFIX = "# intentic:runtime ";
 export const RUNTIME_DIRECTIVES = ["--device=/dev/net/tun", "--cap-add=NET_ADMIN", "--privileged", "--gpus=all"];
 export const OPTIONAL_DIRECTIVES = [
@@ -45,21 +56,26 @@ export const OPTIONAL_DIRECTIVES = [
     },
 ];
 export const optionalDirective = (token) => OPTIONAL_DIRECTIVES.find((entry) => entry.token === token);
-export const runtimeDirectivesOf = (overlay) => {
-    const tokens = new Set();
-    for (const line of overlay.split("\n")) {
-        if (!line.startsWith(RUNTIME_DIRECTIVE_PREFIX)) {
+const allowlistedTokens = (tokens, source) => {
+    const seen = new Set();
+    for (const token of tokens) {
+        if (token === "") {
             continue;
         }
-        for (const token of line.slice(RUNTIME_DIRECTIVE_PREFIX.length).trim().split(/\s+/)) {
-            if (!RUNTIME_DIRECTIVES.includes(token)) {
-                throw new Error(`unsupported runtime directive '${token}' in the approved overlay`);
-            }
-            tokens.add(token);
+        if (!RUNTIME_DIRECTIVES.includes(token)) {
+            throw new Error(`unsupported runtime directive '${token}' in ${source}`);
         }
+        seen.add(token);
     }
-    return [...tokens];
+    return [...seen];
 };
+export const runtimeDirectivesOf = (overlay) => allowlistedTokens(overlay
+    .split("\n")
+    .filter((line) => line.startsWith(RUNTIME_DIRECTIVE_PREFIX))
+    .flatMap((line) => line.slice(RUNTIME_DIRECTIVE_PREFIX.length).trim().split(/\s+/)), "the approved overlay");
+export const HOST_RUNTIME_ENV = "SANDBOX_RUNTIME";
+export const hostRuntimeOf = (value) => allowlistedTokens((value ?? "").trim().split(/\s+/), HOST_RUNTIME_ENV);
+export const OVERLAY_RUNTIME_ENV = "SANDBOX_OVERLAY_RUNTIME";
 export const REPLAY_ENV = [
     "WORKSPACE_ROOT",
     "HISTORY_ROOT",
@@ -86,6 +102,8 @@ export const REPLAY_ENV = [
     "SELF_HOST_ADDRESS",
     "SELF_HOST_VIA",
     "SANDBOX_MEMORY",
+    "SANDBOX_CPUS",
+    "SANDBOX_RUNTIME",
     "RUNNER_PARENT_URL",
     "RUNNER_PAIR_TOKEN",
 ];
@@ -105,9 +123,40 @@ const LOCAL_PORT_BASE = 28000;
 const LOCAL_PORT_SPAN = 4000;
 export const localDaemonPort = (sandboxId) => LOCAL_PORT_BASE + (Number.parseInt(sandboxId.slice(0, 6), 16) % LOCAL_PORT_SPAN);
 export const localDaemonUrlInsecure = (sandboxId) => `http://127.0.0.1:${localDaemonPort(sandboxId)}`;
-export const sandboxRunArgv = (run) => {
-    const asked = OPTIONAL_DIRECTIVES.filter((entry) => (run.runtime ?? []).includes(entry.token));
+const resourceArgs = (run) => run.init === false
+    ? []
+    : ["--memory", run.memory ?? LOCAL_SANDBOX_MEMORY, "--memory-swap", SANDBOX_MEMORY_SWAP, ...(run.cpus === undefined ? [] : ["--cpus", run.cpus])];
+const directiveArgs = (run) => {
+    const overlay = run.runtime ?? [];
+    const union = new Set([...overlay, ...(run.hostRuntime ?? [])]);
+    const asked = OPTIONAL_DIRECTIVES.filter((entry) => union.has(entry.token));
     const dropped = new Set(asked.filter((entry) => (run.unsupported ?? []).includes(entry.token)).map((entry) => entry.token));
+    return {
+        flags: Array.from(union).filter((token) => !dropped.has(token)),
+        stamps: [
+            ...asked.flatMap((entry) => ["-e", `${entry.env}=${dropped.has(entry.token) ? "unsupported" : "all"}`]),
+            ...(overlay.length === 0 ? [] : ["-e", `${OVERLAY_RUNTIME_ENV}=${Array.from(new Set(overlay)).join(" ")}`]),
+        ],
+    };
+};
+const publishArgs = (run) => [
+    ...(run.ports ?? []).flatMap((port) => ["-p", port]),
+    ...(run.sandboxId !== undefined && run.localPublish !== false ? ["-p", `127.0.0.1:${localDaemonPort(run.sandboxId)}:${LOCAL_PORT}`] : []),
+];
+const identityEnv = (run) => [
+    "-e",
+    `SANDBOX_NAME=${run.names.container}`,
+    "-e",
+    `SANDBOX_IMAGE=${run.image}`,
+    "-e",
+    `SANDBOX_BASE_IMAGE=${run.baseImage}`,
+    ...(run.environmentHash === undefined ? [] : ["-e", `SANDBOX_ENVIRONMENT_HASH=${run.environmentHash}`]),
+    ...(run.channel === undefined ? [] : ["-e", `SANDBOX_CHANNEL=${run.channel}`]),
+    ...(run.previousImage === undefined ? [] : ["-e", `SANDBOX_PREVIOUS_IMAGE=${run.previousImage}`]),
+    ...(run.definition === undefined ? [] : ["-e", `SANDBOX_DEFINITION_SEED=${Buffer.from(run.definition, "utf8").toString("base64")}`]),
+];
+export const sandboxRunArgv = (run) => {
+    const directives = directiveArgs(run);
     return [
         "run",
         "-d",
@@ -127,11 +176,10 @@ export const sandboxRunArgv = (run) => {
         "max-size=10m",
         "--log-opt",
         "max-file=3",
-        ...(run.init === false ? [] : ["--memory", run.memory ?? LOCAL_SANDBOX_MEMORY, "--memory-swap", SANDBOX_MEMORY_SWAP]),
+        ...resourceArgs(run),
         ...SANDBOX_CAPABILITIES.map((cap) => `--cap-add=${cap}`),
-        ...(run.runtime ?? []).filter((token) => !dropped.has(token)),
-        ...(run.ports ?? []).flatMap((port) => ["-p", port]),
-        ...(run.sandboxId !== undefined && run.localPublish !== false ? ["-p", `127.0.0.1:${localDaemonPort(run.sandboxId)}:${LOCAL_PORT}`] : []),
+        ...directives.flags,
+        ...publishArgs(run),
         "-v",
         `${run.names.workspaceVolume}:/work`,
         "-v",
@@ -139,17 +187,8 @@ export const sandboxRunArgv = (run) => {
         "-v",
         `${run.names.dockerVolume}:/var/lib/docker`,
         ...(run.mounts ?? []).flatMap((mount) => ["-v", mount]),
-        "-e",
-        `SANDBOX_NAME=${run.names.container}`,
-        "-e",
-        `SANDBOX_IMAGE=${run.image}`,
-        "-e",
-        `SANDBOX_BASE_IMAGE=${run.baseImage}`,
-        ...(run.environmentHash === undefined ? [] : ["-e", `SANDBOX_ENVIRONMENT_HASH=${run.environmentHash}`]),
-        ...(run.channel === undefined ? [] : ["-e", `SANDBOX_CHANNEL=${run.channel}`]),
-        ...(run.previousImage === undefined ? [] : ["-e", `SANDBOX_PREVIOUS_IMAGE=${run.previousImage}`]),
-        ...(run.definition === undefined ? [] : ["-e", `SANDBOX_DEFINITION_SEED=${Buffer.from(run.definition, "utf8").toString("base64")}`]),
-        ...asked.flatMap((entry) => ["-e", `${entry.env}=${dropped.has(entry.token) ? "unsupported" : "all"}`]),
+        ...identityEnv(run),
+        ...directives.stamps,
         ...(run.env ?? []).flatMap(([name, value]) => ["-e", `${name}=${value}`]),
         run.image,
     ];

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4BxC,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAWxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAgB,EAAE,CAAC,CAAC;IACzD,SAAS,EAAE,oBAAoB,IAAI,EAAE;IACrC,eAAe,EAAE,2BAA2B,IAAI,EAAE;IAClD,eAAe,EAAE,sBAAsB,IAAI,EAAE;IAC7C,aAAa,EAAE,oBAAoB,IAAI,EAAE;IACzC,YAAY,EAAE,mBAAmB,IAAI,EAAE;IACvC,OAAO,EAAE,sBAAsB,IAAI,EAAE;CACxC,CAAC,CAAC;AAkBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAC;AAiBzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAStB,MAAM,sBAAsB,GAAG,CAAC,GAAG,GAAG,CAAC;AACvC,MAAM,oBAAoB,GAAG,CAAC,GAAG,GAAG,CAAC;AAkBrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAIxC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAa9F,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,UAAkB,EAAU,EAAE;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sEAAsE,QAAQ,GAAG,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7H,CAAC,CAAC;AAmBF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAkB,EAAE,QAAiB,EAAU,EAAE;IAEhF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,oBAAoB,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAwC1H,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC7D;QACI,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC7C;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAiC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAS9I,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAY,EAAE;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC7C,SAAS;QACb,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,IAAI,CAAE,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,2BAA2B,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACvB,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,UAAU,GAAG;IACtB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,cAAc;IAMd,eAAe;IACf,aAAa;IACb,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IAGjB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,eAAe;IAWf,gBAAgB;IAMhB,mBAAmB;IACnB,mBAAmB;CACb,CAAC;AAIX,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC5D,IAAI;KACC,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IACX,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA6C,EAAsB,EAAE,CAC/F,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAqB,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAKP,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,oBAAoB,WAAW,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAW,CAAC;AAmBnH,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAK7B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC;AAS/I,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,oBAAoB,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AAoEtH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAY,EAAE;IAKxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5H,OAAO;QACH,KAAK;QACL,IAAI;QACJ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,WAAW;QACX,gBAAgB;QAChB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,SAAS;QACnB,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5D,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO;QACjB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAChE,YAAY;QACZ,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,WAAW;QACX,cAAc;QACd,WAAW;QACX,YAAY;QAGZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,oBAAoB,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACrH,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzI,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,QAAQ;QAKpC,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,WAAW;QACrC,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,kBAAkB;QAC3C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI;QACJ,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE;QACrC,IAAI;QACJ,iBAAiB,GAAG,CAAC,KAAK,EAAE;QAC5B,IAAI;QACJ,sBAAsB,GAAG,CAAC,SAAS,EAAE;QACrC,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,4BAA4B,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;QACvG,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,0BAA0B,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,2BAA2B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,KAAK;KACZ,CAAC;AACN,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAe,EAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4BxC,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAWxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAgB,EAAE,CAAC,CAAC;IACzD,SAAS,EAAE,oBAAoB,IAAI,EAAE;IACrC,eAAe,EAAE,2BAA2B,IAAI,EAAE;IAClD,eAAe,EAAE,sBAAsB,IAAI,EAAE;IAC7C,aAAa,EAAE,oBAAoB,IAAI,EAAE;IACzC,YAAY,EAAE,mBAAmB,IAAI,EAAE;IACvC,OAAO,EAAE,sBAAsB,IAAI,EAAE;CACxC,CAAC,CAAC;AAkBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAC;AAiBzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAStB,MAAM,sBAAsB,GAAG,CAAC,GAAG,GAAG,CAAC;AACvC,MAAM,oBAAoB,GAAG,CAAC,GAAG,GAAG,CAAC;AAkBrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAIxC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAa9F,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,UAAkB,EAAU,EAAE;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sEAAsE,QAAQ,GAAG,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7H,CAAC,CAAC;AAmBF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAkB,EAAE,QAAiB,EAAU,EAAE;IAEhF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,oBAAoB,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC;AAkBF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAE,QAAiB,EAAsB,EAAE;IAC1F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4EAA4E,QAAQ,GAAG,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAwC1H,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC7D;QACI,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC7C;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAiC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAU9I,MAAM,iBAAiB,GAAG,CAAC,MAAyB,EAAE,MAAc,EAAY,EAAE;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACf,SAAS;QACb,CAAC;QACD,IAAI,CAAE,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,QAAQ,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAY,EAAE,CAC7D,iBAAiB,CACb,OAAO;KACF,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;KAC3D,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EACvF,sBAAsB,CACzB,CAAC;AAcN,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAClD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAY,EAAE,CAAC,iBAAiB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAQ7I,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAO7D,MAAM,CAAC,MAAM,UAAU,GAAG;IACtB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,cAAc;IAMd,eAAe;IACf,aAAa;IACb,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IAGjB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,eAAe;IAWf,gBAAgB;IAGhB,cAAc;IACd,iBAAiB;IAMjB,mBAAmB;IACnB,mBAAmB;CACb,CAAC;AAIX,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC5D,IAAI;KACC,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IACX,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA6C,EAAsB,EAAE,CAC/F,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAqB,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAKP,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,oBAAoB,WAAW,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAW,CAAC;AAmBnH,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAK7B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC;AAS/I,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,oBAAoB,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AA+EtH,MAAM,YAAY,GAAG,CAAC,GAAe,EAAY,EAAE,CAC/C,GAAG,CAAC,IAAI,KAAK,KAAK;IACd,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,oBAAoB,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAe1J,MAAM,aAAa,GAAG,CAAC,GAAe,EAA2D,EAAE;IAC/F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5H,OAAO;QACH,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,EAAE;YACJ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACvG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,mBAAmB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9G;KACJ,CAAC;AACN,CAAC,CAAC;AAIF,MAAM,WAAW,GAAG,CAAC,GAAe,EAAY,EAAE,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAC5I,CAAC;AAIF,MAAM,WAAW,GAAG,CAAC,GAAe,EAAY,EAAE,CAAC;IAC/C,IAAI;IACJ,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE;IACrC,IAAI;IACJ,iBAAiB,GAAG,CAAC,KAAK,EAAE;IAC5B,IAAI;IACJ,sBAAsB,GAAG,CAAC,SAAS,EAAE;IACrC,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,4BAA4B,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,0BAA0B,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IACjG,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,2BAA2B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;CACvI,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAY,EAAE;IACxD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO;QACH,KAAK;QACL,IAAI;QACJ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,WAAW;QACX,gBAAgB;QAChB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,SAAS;QACnB,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5D,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO;QACjB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAChE,YAAY;QACZ,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,WAAW;QACX,cAAc;QACd,WAAW;QACX,YAAY;QACZ,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC;QACxD,GAAG,UAAU,CAAC,KAAK;QACnB,GAAG,WAAW,CAAC,GAAG,CAAC;QACnB,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,QAAQ;QAKpC,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,WAAW;QACrC,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,kBAAkB;QAC3C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,GAAG,WAAW,CAAC,GAAG,CAAC;QACnB,GAAG,UAAU,CAAC,MAAM;QACpB,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,KAAK;KACZ,CAAC;AACN,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAe,EAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/sandbox-run",
-  "version": "1.244.0",
+  "version": "1.246.1",
   "description": "The sandbox container's run contract, names, capability posture, env allowlist, runtime directives, and the docker-run emitter every creation path composes from",
   "license": "MIT",
   "type": "module",
@@ -52,7 +52,7 @@
     }
   },
   "dependencies": {
-    "@intentic/constants": "1.244.0",
+    "@intentic/constants": "1.246.1",
     "tslib": "2.8.1"
   },
   "devDependencies": {