@luxorai/agentbox-provider 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Luxor Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,221 @@
-# Temporary Holding Version
+# @tenkicloud/agentbox-provider
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Run [AgentBox](https://agent-box.sh) coding agents in [Tenki](https://tenki.cloud) Firecracker
+microVMs — a community provider plugin, published as its own package and registered with
+`agentbox plugin add`.
+
+## What Tenki is
+
+[Tenki](https://tenki.cloud) provisions Firecracker microVMs on demand, driven by the official
+[`@tenkicloud/sandbox`](https://www.npmjs.com/package/@tenkicloud/sandbox) TypeScript SDK — a
+ConnectRPC control plane plus a per-session data plane for command execution and file transfer.
+Each AgentBox box becomes one Tenki session: a full VM with its own kernel, not a shared container.
+
+## What you get
+
+| Feature                   | What it means                                                                                              |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| **A VM per box**          | Every box is its own Firecracker microVM — real kernel isolation, not a shared container                   |
+| **Your project, ready**   | The workspace arrives as a git clone on a per-box branch, carrying your uncommitted and untracked changes  |
+| **Agents preinstalled**   | `claude`, `codex` and `opencode` are in the image; `agentbox tenki claude` drops you straight into one     |
+| **Your setup travels**    | Settings, MCP servers and plugins come from your host; credentials are seeded per box, never baked in      |
+| **Interactive terminal**  | Attach over SSH into a tmux session — detach and come back, and resizing your window works                 |
+| **Public preview URLs**   | Every exposed port gets an HTTPS URL with no tunnel or token to manage; signed URLs for private ports      |
+| **Files in and out**      | `agentbox cp` moves files between your machine and the box, in either direction                            |
+| **Docker inside the box** | `docker build` and `docker run` work in the box, so containerised test suites and compose stacks run there |
+| **Free pause and resume** | Pausing costs nothing and keeps running processes; resuming picks up where you left off                    |
+| **Checkpoints**           | Snapshot a warm box and start new ones from it, dependencies and all                                       |
+| **Long sessions**         | A box you are actively using has its deadline extended for you                                             |
+| **Seconds to a new box**  | A one-time `agentbox prepare` bakes the base image, so every box after that boots ready                    |
+
+## Requirements
+
+- Node.js 20 or newer
+- The `agentbox` CLI (0.27.1 or newer — it must support provider SDK v2)
+- An OpenSSH client (`ssh` and `ssh-keygen`) on the host, used for interactive attach
+- A Tenki account with a workspace and an auth token
+
+## Installation
+
+```bash
+npm i -g @tenkicloud/agentbox-provider
+agentbox plugin add @tenkicloud/agentbox-provider
+agentbox plugin list            # -> tenki … (SDK v2)
+```
+
+AgentBox does not know about `tenki` until `plugin add` records it. A plugin runs in-process with
+full host and credential access, so `plugin add` is the trust boundary — see
+[Security](#security-considerations).
+
+## Authentication
+
+On a terminal, the first `agentbox create --provider tenki` prompts for a token and saves it. To set
+it up ahead of time, expose it as `TENKI_AUTH_TOKEN`:
+
+```bash
+export TENKI_AUTH_TOKEN=...          # or add TENKI_AUTH_TOKEN=… to ~/.agentbox/secrets.env
+agentbox doctor                      # shows the `tenki:` group
+```
+
+`TENKI_API_TOKEN` is accepted as an alias. Credentials are read from the environment first, then
+from `~/.agentbox/secrets.env` (mode `0600`); project `.env` files are never harvested. The token is
+never logged and never included in the published package.
+
+## Basic usage
+
+One-time: bake the AgentBox base image in your Tenki workspace, then create a box. `prepare` boots a
+throwaway builder from Tenki's `sandbox` base, installs tmux, the AgentBox runtime and the coding
+agents, snapshots it, and pins the snapshot id. Every box then boots from that snapshot.
+
+```bash
+agentbox prepare --provider tenki    # bakes the base image; pins the snapshot id locally
+agentbox create --provider tenki
+agentbox tenki claude                # provider-prefix sugar also works
+```
+
+Pin it project-wide with `box.provider: tenki` in `agentbox.yaml`, or per box with
+`--provider tenki`.
+
+## Resource configuration
+
+Because AgentBox does not add config keys for plugin providers, Tenki reads its settings from the
+generic keys plus its own environment variables:
+
+| Setting            | Where                         | Notes                                                      |
+| ------------------ | ----------------------------- | ---------------------------------------------------------- |
+| VM size            | `--size` / `box.size`         | `cpu-memory[-disk]` in GB, e.g. `4-8-20`                   |
+| Default checkpoint | `box.defaultCheckpoint`       | Generic key; no per-provider variant                       |
+| Base image         | `AGENTBOX_TENKI_BASE_IMAGE`   | Tenki base image `prepare` layers onto (default `sandbox`) |
+| Workspace          | `AGENTBOX_TENKI_WORKSPACE_ID` | Defaults to the token's own scope                          |
+| Session lifetime   | `AGENTBOX_TENKI_TIMEOUT_MS`   | Seeds the host keepalive loop                              |
+
+The baked base snapshot id lives in `~/.agentbox/tenki-prepared.json`, managed by this plugin.
+
+## Agent configuration and credentials
+
+`prepare` bakes your host's **static** agent config into the base snapshot — settings, MCP servers,
+plugin registries, and `/workspace` pre-trust — so boxes start with your own setup rather than a
+blank one. It is best-effort: an agent whose config can't be read is skipped with a warning rather
+than failing the bake.
+
+One host-side wrinkle is handled for you: codex leaves a live Unix socket at `~/.codex/ipc/ipc.sock`
+whenever it has run, and the upstream staging helper's `rsync -a` cannot recreate a socket (it exits
+23). `prepare` stages codex through a sanitized shadow of that directory, so its config bakes whether
+or not codex is running.
+
+Credentials are handled separately, and deliberately not baked. AgentBox seeds them per box at
+create time into `~/.agentbox-creds/<agent>/`, which the base image pivots into place with symlinks
+(`~/.claude/.credentials.json`, `~/.codex/auth.json`, `~/.local/share/opencode/auth.json`). That
+keeps auth tokens out of an image that may be long-lived or shared, and lets a refreshed token
+propagate without re-baking.
+
+That seeding only has something to push when AgentBox has host-side credential backups
+(`~/.agentbox/<agent>-credentials.json`), which are captured from boxes you have already used. With
+no backup yet, the symlinks are dangling by design: you log into the agent once inside the box, the
+login lands in `~/.agentbox-creds/`, and AgentBox captures it from there for later boxes.
+
+The base image also creates a `vscode` account as an alias of the box user (same uid, same home).
+The credential seed shipped in the current provider SDK extracts with an in-shell `sudo -u vscode`,
+so without that account the seed fails with `sudo: unknown user vscode` and boxes start logged out.
+The alias keeps seeded files owned by the user the agents actually run as.
+
+## Preview URLs
+
+Every exposed port gets a public HTTPS URL through Tenki's WebProxy — no tunnel and no token
+needed. `agentbox open` and the `expose:` entries in `agentbox.yaml` work as they do on any cloud
+provider. Signed URLs are available for ports you don't want publicly reachable.
+
+## Checkpoint support
+
+Tenki snapshots are **id-addressed**: the platform returns an opaque id rather than a name you
+choose. The plugin stores that id in AgentBox's cloud-checkpoint manifest, so
+`agentbox checkpoint create` / `list` / restore behave the same as on Vercel and E2B. Snapshots are
+taken live — the source box keeps running.
+
+## Troubleshooting
+
+- **`unknown provider "tenki"`** — the plugin isn't registered. Run `agentbox plugin add
+@tenkicloud/agentbox-provider` and confirm with `agentbox plugin list`.
+- **`plugin targets provider SDK vN`** — your `agentbox` CLI is too old. Update to 0.27.1 or newer.
+- **Credentials not found** — check `agentbox doctor`. The token must be in the environment or in
+  `~/.agentbox/secrets.env`, not a project `.env`.
+- **No base image** — run `agentbox prepare --provider tenki`. Boxes boot from a snapshot baked in
+  your own Tenki workspace, so this is required once per workspace. If that snapshot is later deleted
+  (or the token is pointed at another workspace), the next `prepare` notices and re-bakes.
+- **Box expired mid-session** — raise `AGENTBOX_TENKI_TIMEOUT_MS`; the host keepalive extends a
+  working session, but it starts from the lifetime the box was created with.
+- **Attach fails to open a shell** — attach needs `ssh` and `ssh-keygen` on the host. Per-box key
+  material lives in `~/.agentbox/boxes/<session-id>/ssh/`; the certificate is re-minted on every
+  attach, so deleting that directory is safe and simply regenerates it.
+- **Attach as a different user** — set `AGENTBOX_TENKI_SSH_USER` if a custom base image does not run
+  as `tenki`.
+
+## Security considerations
+
+- An AgentBox provider plugin runs **in-process with the CLI**, with full host and credential
+  access. AgentBox does not sandbox plugin code — provisioning infrastructure and handling secrets
+  is the job. `agentbox plugin add` is the consent boundary; only add plugins you trust.
+- The Tenki token is read from the environment or `~/.agentbox/secrets.env` (`0600`), never logged,
+  and never bundled into the published artifact.
+- Each box is an isolated microVM, so an agent cannot reach your host filesystem. Host-side
+  operations that need your credentials (`git push` in particular) are brokered by the AgentBox host
+  relay rather than by handing keys to the box.
+- **The microVM is the boundary, not the in-box user.** Inside a box the agent has passwordless
+  `sudo` and Docker access, which is root-equivalent by design — in-box Docker requires it.
+- Interactive attach trusts the Tenki gateway's TLS rather than an SSH host key (the "host" is a
+  session id, not a stable endpoint). If you override `TENKI_BASE_URL` or `TENKI_GATEWAY_ADDRESS`,
+  point them only at endpoints you trust.
+- Preview URLs are public: anyone holding one can reach the port, with no token. Use the signed
+  (expiring) variant for anything that should not stay durably reachable.
+
+The full trust model, and how to report a vulnerability privately, are in
+[SECURITY.md](./SECURITY.md).
+
+## Uninstallation
+
+```bash
+agentbox plugin remove tenki                       # unregister (leaves the npm package installed)
+npm uninstall -g @tenkicloud/agentbox-provider
+```
+
+Destroy any remaining boxes with `agentbox destroy <name>` first — removing the plugin leaves
+AgentBox unable to manage them. Base images and snapshots in your Tenki workspace are not deleted;
+remove those through Tenki.
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test
+npm run validate:package     # packs, installs in isolation, asserts the plugin contract
+
+agentbox plugin add .        # register this working copy
+agentbox doctor
+```
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full gate set, the test conventions, and what to
+know before running `prepare` against a real (billable) workspace. Release notes are in
+[CHANGELOG.md](./CHANGELOG.md).
+
+## Releasing
+
+Releases run from the **Publish** workflow, and the version in `package.json` is the single source
+of truth for both npm and the git tag:
+
+1. Bump `version` in `package.json` on `main`, and add the matching section to
+   [CHANGELOG.md](./CHANGELOG.md). Both CI and the publish workflow fail if the declared version has
+   no changelog entry (`npm run check:changelog`).
+2. Run the workflow with `dry_run` left on. It runs every CI gate plus `npm publish --dry-run`,
+   and changes nothing.
+3. Run it again with `dry_run` off. It publishes to npm, tags the commit `v<version>`, and cuts a
+   GitHub release with generated notes.
+
+Publishing is idempotent — an already-published version is skipped — so a re-run after a partial
+failure is safe. Authentication is npm trusted publishing (OIDC), so there is no token to rotate.
+
+## License
+
+MIT — see [LICENSE](./LICENSE). Maintained by Luxor Labs. AgentBox itself is a separate project by
+Marco D'Alia; this plugin builds on its public
+[`@madarco/agentbox-provider-sdk`](https://www.npmjs.com/package/@madarco/agentbox-provider-sdk).

package/dist/attach-helper.cjs

@@ -0,0 +1,182 @@
+"use strict";
+
+// src/attach-helper.ts
+var import_sandbox = require("@tenkicloud/sandbox");
+
+// src/env-loader.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var TENKI_KEYS = [
+  "TENKI_AUTH_TOKEN",
+  "TENKI_API_TOKEN",
+  "TENKI_BASE_URL",
+  "TENKI_GATEWAY_ADDRESS"
+];
+var loaded = false;
+function ensureTenkiEnvLoaded() {
+  if (loaded) return;
+  loaded = true;
+  importTenkiFromFile((0, import_node_path.resolve)((0, import_node_os.homedir)(), ".agentbox", "secrets.env"), TENKI_KEYS);
+  if (!process.env.TENKI_AUTH_TOKEN && process.env.TENKI_API_TOKEN) {
+    process.env.TENKI_AUTH_TOKEN = process.env.TENKI_API_TOKEN;
+  }
+}
+function importTenkiFromFile(path, keys) {
+  if (!(0, import_node_fs.existsSync)(path)) return;
+  let body;
+  try {
+    body = (0, import_node_fs.readFileSync)(path, "utf8");
+  } catch {
+    return;
+  }
+  const parsed = parseEnvFile(body);
+  for (const key of keys) {
+    if (process.env[key] !== void 0) continue;
+    const value = parsed[key];
+    if (typeof value === "string") {
+      process.env[key] = value;
+    }
+  }
+}
+function parseEnvFile(body) {
+  const out = {};
+  for (const rawLine of body.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const stripped = line.startsWith("export ") ? line.slice("export ".length) : line;
+    const eq = stripped.indexOf("=");
+    if (eq <= 0) continue;
+    const key = stripped.slice(0, eq).trim();
+    let value = stripped.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/attach-helper.ts
+function parseArgs(argv) {
+  let sessionId;
+  let mode;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--session-id") {
+      sessionId = argv[i + 1];
+      i++;
+    } else if (a === "--proxy") {
+      mode = "proxy";
+    } else if (a === "--detached") {
+      mode = "detached";
+    }
+  }
+  if (!sessionId) {
+    process.stderr.write("attach-helper: --session-id is required\n");
+    process.exit(2);
+  }
+  if (!mode) {
+    process.stderr.write("attach-helper: one of --proxy or --detached is required\n");
+    process.exit(2);
+  }
+  return { sessionId, mode };
+}
+function buildClient() {
+  const authToken = process.env.TENKI_AUTH_TOKEN;
+  if (!authToken) {
+    process.stderr.write("attach-helper: TENKI_AUTH_TOKEN env is required\n");
+    process.exit(2);
+  }
+  const opts = { authToken };
+  if (process.env.TENKI_BASE_URL) opts.baseUrl = process.env.TENKI_BASE_URL;
+  if (process.env.TENKI_GATEWAY_ADDRESS) opts.gatewayAddress = process.env.TENKI_GATEWAY_ADDRESS;
+  return new import_sandbox.TenkiSandbox(opts);
+}
+async function main() {
+  const { sessionId, mode } = parseArgs(process.argv.slice(2));
+  ensureTenkiEnvLoaded();
+  const client = buildClient();
+  let session;
+  try {
+    session = await client.get(sessionId);
+  } catch (err) {
+    process.stderr.write(
+      `attach-helper: could not resolve session ${sessionId}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process.exit(1);
+  }
+  if (session.state !== "RUNNING") {
+    try {
+      await session.resume();
+      await session.waitReady(6e4);
+    } catch {
+    }
+  }
+  if (mode === "detached") {
+    const inner = process.env.AGENTBOX_TENKI_INNER_CMD;
+    if (!inner) {
+      process.stderr.write("attach-helper: AGENTBOX_TENKI_INNER_CMD env is required\n");
+      process.exit(2);
+    }
+    try {
+      const r = await session.run(["bash", "-c", inner], { cwd: "/workspace" });
+      process.exit(r.exitCode ?? 0);
+    } catch (err) {
+      process.stderr.write(
+        `attach-helper: detached pre-start failed: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      process.exit(1);
+    }
+  }
+  let conn;
+  try {
+    conn = await session.ssh();
+  } catch (err) {
+    process.stderr.write(
+      `attach-helper: could not open the SSH transport: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process.exit(1);
+  }
+  process.stdin.on("data", (chunk) => {
+    conn.write(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength)).catch(() => {
+    });
+  });
+  process.stdin.on("end", () => {
+    try {
+      conn.close();
+    } catch {
+    }
+  });
+  let exitCode = 0;
+  try {
+    for (; ; ) {
+      const data = await conn.read();
+      if (data === null) break;
+      process.stdout.write(data);
+    }
+  } catch (err) {
+    process.stderr.write(
+      `attach-helper: SSH transport read failed: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    exitCode = 1;
+  } finally {
+    try {
+      conn.close();
+    } catch {
+    }
+  }
+  process.exit(exitCode);
+}
+main().catch((err) => {
+  process.stderr.write(
+    `attach-helper: unhandled error: ${err instanceof Error ? err.message : String(err)}
+`
+  );
+  process.exit(1);
+});
+//# sourceMappingURL=attach-helper.cjs.map

package/dist/attach-helper.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/attach-helper.ts","../src/env-loader.ts"],"sourcesContent":["/**\n * Standalone helper spawned by `buildTenkiAttach`. Two modes, no interactive\n * shell handling of its own:\n *\n *   --proxy      An `ssh` ProxyCommand. Bridges this process's stdin/stdout to\n *                the session's SSH transport (`session.ssh()`), so the host's\n *                real `ssh` client speaks the SSH protocol end to end and owns\n *                the PTY, auth, and window-resize handling.\n *\n *   --detached   Pre-start. Runs AGENTBOX_TENKI_INNER_CMD once over the\n *                non-interactive data plane and exits. In detached mode the\n *                inner command only CREATES the tmux session, so there is\n *                nothing to attach to and opening a channel would hang the\n *                host's `runDetached` await forever.\n *\n * Why the proxy mode is byte-shuffling and nothing more: `SSHConnection` wraps a\n * WebSocket carrying the RAW SSH wire protocol. It is a transport, not a shell —\n * an earlier version of this helper wrote shell commands into it and got back\n * only the gateway's version banner.\n *\n * Argv: `node attach-helper.cjs (--proxy|--detached) --session-id <id>`\n * Env:\n *   TENKI_AUTH_TOKEN            Tenki credentials (threaded in by build-attach).\n *   AGENTBOX_TENKI_INNER_CMD    Inner bash command (--detached only).\n *   TENKI_BASE_URL,\n *   TENKI_GATEWAY_ADDRESS       Optional control-plane overrides.\n */\n\nimport { TenkiSandbox } from '@tenkicloud/sandbox';\nimport { ensureTenkiEnvLoaded } from './env-loader.js';\n\ninterface ParsedArgs {\n  sessionId: string;\n  mode: 'proxy' | 'detached';\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  let sessionId: string | undefined;\n  let mode: 'proxy' | 'detached' | undefined;\n  for (let i = 0; i < argv.length; i++) {\n    const a = argv[i];\n    if (a === '--session-id') {\n      sessionId = argv[i + 1];\n      i++;\n    } else if (a === '--proxy') {\n      mode = 'proxy';\n    } else if (a === '--detached') {\n      mode = 'detached';\n    }\n  }\n  if (!sessionId) {\n    process.stderr.write('attach-helper: --session-id is required\\n');\n    process.exit(2);\n  }\n  if (!mode) {\n    process.stderr.write('attach-helper: one of --proxy or --detached is required\\n');\n    process.exit(2);\n  }\n  return { sessionId, mode };\n}\n\nfunction buildClient(): TenkiSandbox {\n  const authToken = process.env.TENKI_AUTH_TOKEN;\n  if (!authToken) {\n    process.stderr.write('attach-helper: TENKI_AUTH_TOKEN env is required\\n');\n    process.exit(2);\n  }\n  const opts: ConstructorParameters<typeof TenkiSandbox>[0] = { authToken };\n  if (process.env.TENKI_BASE_URL) opts.baseUrl = process.env.TENKI_BASE_URL;\n  if (process.env.TENKI_GATEWAY_ADDRESS) opts.gatewayAddress = process.env.TENKI_GATEWAY_ADDRESS;\n  return new TenkiSandbox(opts);\n}\n\nasync function main(): Promise<void> {\n  const { sessionId, mode } = parseArgs(process.argv.slice(2));\n  ensureTenkiEnvLoaded();\n\n  const client = buildClient();\n  let session;\n  try {\n    session = await client.get(sessionId);\n  } catch (err) {\n    process.stderr.write(\n      `attach-helper: could not resolve session ${sessionId}: ${err instanceof Error ? err.message : String(err)}\\n`,\n    );\n    process.exit(1);\n  }\n\n  // Defensive: an attach right after resume should already be RUNNING, but wake\n  // a paused box rather than failing the connection.\n  if (session.state !== 'RUNNING') {\n    try {\n      await session.resume();\n      await session.waitReady(60_000);\n    } catch {\n      // fall through — the op below surfaces a clear transport error\n    }\n  }\n\n  if (mode === 'detached') {\n    const inner = process.env.AGENTBOX_TENKI_INNER_CMD;\n    if (!inner) {\n      process.stderr.write('attach-helper: AGENTBOX_TENKI_INNER_CMD env is required\\n');\n      process.exit(2);\n    }\n    try {\n      const r = await session.run(['bash', '-c', inner], { cwd: '/workspace' });\n      process.exit(r.exitCode ?? 0);\n    } catch (err) {\n      process.stderr.write(\n        `attach-helper: detached pre-start failed: ${err instanceof Error ? err.message : String(err)}\\n`,\n      );\n      process.exit(1);\n    }\n  }\n\n  // --proxy: pure transport. stdin -> gateway, gateway -> stdout. `ssh` on the\n  // other side of these pipes does the handshake and runs the remote command.\n  let conn;\n  try {\n    conn = await session.ssh();\n  } catch (err) {\n    process.stderr.write(\n      `attach-helper: could not open the SSH transport: ${err instanceof Error ? err.message : String(err)}\\n`,\n    );\n    process.exit(1);\n  }\n\n  process.stdin.on('data', (chunk: Buffer) => {\n    conn.write(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength)).catch(() => {\n      // transport gone; the read loop below exits and we follow it out\n    });\n  });\n  // ssh closing its end of the pipe means the session is over.\n  process.stdin.on('end', () => {\n    try {\n      conn.close();\n    } catch {\n      // already closed\n    }\n  });\n\n  let exitCode = 0;\n  try {\n    for (;;) {\n      const data = await conn.read();\n      if (data === null) break; // transport closed\n      process.stdout.write(data);\n    }\n  } catch (err) {\n    process.stderr.write(\n      `attach-helper: SSH transport read failed: ${err instanceof Error ? err.message : String(err)}\\n`,\n    );\n    exitCode = 1;\n  } finally {\n    try {\n      conn.close();\n    } catch {\n      // ignore\n    }\n  }\n  process.exit(exitCode);\n}\n\nmain().catch((err) => {\n  process.stderr.write(\n    `attach-helper: unhandled error: ${err instanceof Error ? err.message : String(err)}\\n`,\n  );\n  process.exit(1);\n});\n","/**\n * Tenki env auto-loader. The `@tenkicloud/sandbox` SDK reads `TENKI_AUTH_TOKEN`\n * from `process.env` (and we honor optional `TENKI_BASE_URL` /\n * `TENKI_GATEWAY_ADDRESS` overrides for non-default / self-hosted control\n * planes). We seed those from `~/.agentbox/secrets.env` — the store AgentBox's\n * built-in cloud providers use — so the SDK Just Works after a one-time setup.\n *\n * Lookup order (first wins; process.env is never overwritten):\n *   1. `process.env` (already set in the shell).\n *   2. `~/.agentbox/secrets.env` — written by the credential prompt.\n *\n * `TENKI_API_TOKEN` is accepted as an alias for `TENKI_AUTH_TOKEN`.\n *\n * Project-level `.env` / `.env.local` are intentionally NOT consulted: those\n * files belong to the app code being developed. Put host credentials in\n * `~/.agentbox/secrets.env` (or the shell env).\n *\n * Only TENKI-prefixed keys are imported; the rest of the file is left alone.\n * Idempotent and side-effect-free after the first call.\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { resolve } from 'node:path';\n\nconst TENKI_KEYS = [\n  'TENKI_AUTH_TOKEN',\n  'TENKI_API_TOKEN',\n  'TENKI_BASE_URL',\n  'TENKI_GATEWAY_ADDRESS',\n] as const;\n\nlet loaded = false;\n\nexport function ensureTenkiEnvLoaded(): void {\n  if (loaded) return;\n  loaded = true;\n  importTenkiFromFile(resolve(homedir(), '.agentbox', 'secrets.env'), TENKI_KEYS);\n  // `TENKI_AUTH_TOKEN` is the name the Tenki SDK reads and the one we write.\n  // `TENKI_API_TOKEN` is accepted as an alias because it's the more common\n  // spelling to reach for; normalize it once here so nothing downstream has to\n  // know about two names.\n  if (!process.env.TENKI_AUTH_TOKEN && process.env.TENKI_API_TOKEN) {\n    process.env.TENKI_AUTH_TOKEN = process.env.TENKI_API_TOKEN;\n  }\n}\n\n/**\n * Force a re-read of `~/.agentbox/secrets.env`. Used by the interactive\n * credential flow after it persists the token, so the same process can pick it\n * up without a restart.\n */\nexport function reloadTenkiEnv(): void {\n  loaded = false;\n  ensureTenkiEnvLoaded();\n}\n\nfunction importTenkiFromFile(path: string, keys: readonly string[]): void {\n  if (!existsSync(path)) return;\n  let body: string;\n  try {\n    body = readFileSync(path, 'utf8');\n  } catch {\n    return;\n  }\n  const parsed = parseEnvFile(body);\n  for (const key of keys) {\n    if (process.env[key] !== undefined) continue;\n    const value = parsed[key];\n    if (typeof value === 'string') {\n      process.env[key] = value;\n    }\n  }\n}\n\n/**\n * Minimal `.env` parser: handles `KEY=value`, `KEY=\"value\"`, `KEY='value'`,\n * `export KEY=value`, blank lines, and `#` comments. No variable interpolation\n * — predictable over feature-complete (matches the daytona / vercel / e2b\n * loaders).\n */\nexport function parseEnvFile(body: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const rawLine of body.split(/\\r?\\n/)) {\n    const line = rawLine.trim();\n    if (line.length === 0 || line.startsWith('#')) continue;\n    const stripped = line.startsWith('export ') ? line.slice('export '.length) : line;\n    const eq = stripped.indexOf('=');\n    if (eq <= 0) continue;\n    const key = stripped.slice(0, eq).trim();\n    let value = stripped.slice(eq + 1).trim();\n    if (\n      value.length >= 2 &&\n      ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\")))\n    ) {\n      value = value.slice(1, -1);\n    }\n    out[key] = value;\n  }\n  return out;\n}\n"],"mappings":";;;AA4BA,qBAA6B;;;ACP7B,qBAAyC;AACzC,qBAAwB;AACxB,uBAAwB;AAExB,IAAM,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAI,SAAS;AAEN,SAAS,uBAA6B;AAC3C,MAAI,OAAQ;AACZ,WAAS;AACT,0BAAoB,8BAAQ,wBAAQ,GAAG,aAAa,aAAa,GAAG,UAAU;AAK9E,MAAI,CAAC,QAAQ,IAAI,oBAAoB,QAAQ,IAAI,iBAAiB;AAChE,YAAQ,IAAI,mBAAmB,QAAQ,IAAI;AAAA,EAC7C;AACF;AAYA,SAAS,oBAAoB,MAAc,MAA+B;AACxE,MAAI,KAAC,2BAAW,IAAI,EAAG;AACvB,MAAI;AACJ,MAAI;AACF,eAAO,6BAAa,MAAM,MAAM;AAAA,EAClC,QAAQ;AACN;AAAA,EACF;AACA,QAAM,SAAS,aAAa,IAAI;AAChC,aAAW,OAAO,MAAM;AACtB,QAAI,QAAQ,IAAI,GAAG,MAAM,OAAW;AACpC,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,UAAU;AAC7B,cAAQ,IAAI,GAAG,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAQO,SAAS,aAAa,MAAsC;AACjE,QAAM,MAA8B,CAAC;AACrC,aAAW,WAAW,KAAK,MAAM,OAAO,GAAG;AACzC,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,KAAK,WAAW,KAAK,KAAK,WAAW,GAAG,EAAG;AAC/C,UAAM,WAAW,KAAK,WAAW,SAAS,IAAI,KAAK,MAAM,UAAU,MAAM,IAAI;AAC7E,UAAM,KAAK,SAAS,QAAQ,GAAG;AAC/B,QAAI,MAAM,EAAG;AACb,UAAM,MAAM,SAAS,MAAM,GAAG,EAAE,EAAE,KAAK;AACvC,QAAI,QAAQ,SAAS,MAAM,KAAK,CAAC,EAAE,KAAK;AACxC,QACE,MAAM,UAAU,MACd,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC1C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,IAC9C;AACA,cAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3B;AACA,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;;;ADjEA,SAAS,UAAU,MAA4B;AAC7C,MAAI;AACJ,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,gBAAgB;AACxB,kBAAY,KAAK,IAAI,CAAC;AACtB;AAAA,IACF,WAAW,MAAM,WAAW;AAC1B,aAAO;AAAA,IACT,WAAW,MAAM,cAAc;AAC7B,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,YAAQ,OAAO,MAAM,2CAA2C;AAChE,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,2DAA2D;AAChF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,SAAO,EAAE,WAAW,KAAK;AAC3B;AAEA,SAAS,cAA4B;AACnC,QAAM,YAAY,QAAQ,IAAI;AAC9B,MAAI,CAAC,WAAW;AACd,YAAQ,OAAO,MAAM,mDAAmD;AACxE,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,OAAsD,EAAE,UAAU;AACxE,MAAI,QAAQ,IAAI,eAAgB,MAAK,UAAU,QAAQ,IAAI;AAC3D,MAAI,QAAQ,IAAI,sBAAuB,MAAK,iBAAiB,QAAQ,IAAI;AACzE,SAAO,IAAI,4BAAa,IAAI;AAC9B;AAEA,eAAe,OAAsB;AACnC,QAAM,EAAE,WAAW,KAAK,IAAI,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC3D,uBAAqB;AAErB,QAAM,SAAS,YAAY;AAC3B,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,OAAO,IAAI,SAAS;AAAA,EACtC,SAAS,KAAK;AACZ,YAAQ,OAAO;AAAA,MACb,4CAA4C,SAAS,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,IAC5G;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAIA,MAAI,QAAQ,UAAU,WAAW;AAC/B,QAAI;AACF,YAAM,QAAQ,OAAO;AACrB,YAAM,QAAQ,UAAU,GAAM;AAAA,IAChC,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,SAAS,YAAY;AACvB,UAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAI,CAAC,OAAO;AACV,cAAQ,OAAO,MAAM,2DAA2D;AAChF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI;AACF,YAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE,KAAK,aAAa,CAAC;AACxE,cAAQ,KAAK,EAAE,YAAY,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,cAAQ,OAAO;AAAA,QACb,6CAA6C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,MAC/F;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAIA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,IAAI;AAAA,EAC3B,SAAS,KAAK;AACZ,YAAQ,OAAO;AAAA,MACb,oDAAoD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,IACtG;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,MAAM,GAAG,QAAQ,CAAC,UAAkB;AAC1C,SAAK,MAAM,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC,EAAE,MAAM,MAAM;AAAA,IAEzF,CAAC;AAAA,EACH,CAAC;AAED,UAAQ,MAAM,GAAG,OAAO,MAAM;AAC5B,QAAI;AACF,WAAK,MAAM;AAAA,IACb,QAAQ;AAAA,IAER;AAAA,EACF,CAAC;AAED,MAAI,WAAW;AACf,MAAI;AACF,eAAS;AACP,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,SAAS,KAAM;AACnB,cAAQ,OAAO,MAAM,IAAI;AAAA,IAC3B;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,OAAO;AAAA,MACb,6CAA6C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,IAC/F;AACA,eAAW;AAAA,EACb,UAAE;AACA,QAAI;AACF,WAAK,MAAM;AAAA,IACb,QAAQ;AAAA,IAER;AAAA,EACF;AACA,UAAQ,KAAK,QAAQ;AACvB;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,OAAO;AAAA,IACb,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,EACrF;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}