@luxorai/agentbox-provider 0.0.0-stage → 0.1.1

package/dist/index.js

@@ -0,0 +1,1603 @@
+// src/index.ts
+import {
+  createCloudProvider,
+  currentCloudBaseFingerprint,
+  listCloudCheckpoints,
+  readCliStamp as readCliStamp2,
+  removeCloudCheckpointDir,
+  resolveCloudCheckpoint,
+  SDK_API_VERSION,
+  writeCloudCheckpointManifest
+} from "@madarco/agentbox-provider-sdk";
+
+// src/backend.ts
+import { createReadStream, createWriteStream, rmSync } from "fs";
+import { basename, posix } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+
+// src/sdk.ts
+import { TenkiSandbox } from "@tenkicloud/sandbox";
+import { UserFacingError } from "@madarco/agentbox-provider-sdk";
+
+// src/env-loader.ts
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { resolve } from "path";
+var TENKI_KEYS = [
+  "TENKI_AUTH_TOKEN",
+  "TENKI_API_TOKEN",
+  "TENKI_BASE_URL",
+  "TENKI_GATEWAY_ADDRESS"
+];
+var loaded = false;
+function ensureTenkiEnvLoaded() {
+  if (loaded) return;
+  loaded = true;
+  importTenkiFromFile(resolve(homedir(), ".agentbox", "secrets.env"), TENKI_KEYS);
+  if (!process.env.TENKI_AUTH_TOKEN && process.env.TENKI_API_TOKEN) {
+    process.env.TENKI_AUTH_TOKEN = process.env.TENKI_API_TOKEN;
+  }
+}
+function reloadTenkiEnv() {
+  loaded = false;
+  ensureTenkiEnvLoaded();
+}
+function importTenkiFromFile(path, keys) {
+  if (!existsSync(path)) return;
+  let body;
+  try {
+    body = readFileSync(path, "utf8");
+  } catch {
+    return;
+  }
+  const parsed = parseEnvFile(body);
+  for (const key of keys) {
+    if (process.env[key] !== void 0) continue;
+    const value = parsed[key];
+    if (typeof value === "string") {
+      process.env[key] = value;
+    }
+  }
+}
+function parseEnvFile(body) {
+  const out = {};
+  for (const rawLine of body.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const stripped = line.startsWith("export ") ? line.slice("export ".length) : line;
+    const eq = stripped.indexOf("=");
+    if (eq <= 0) continue;
+    const key = stripped.slice(0, eq).trim();
+    let value = stripped.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/sdk.ts
+import {
+  SandboxError,
+  MissingAuthTokenError,
+  SessionNotFoundError,
+  SessionTerminatedError,
+  SessionExpiredError,
+  SnapshotNotFoundError,
+  SnapshotFailedError,
+  UnauthorizedError,
+  PermissionDeniedError,
+  QuotaExceededError,
+  CapacityUnavailableError,
+  RateLimitedError,
+  InvalidStateError,
+  FileNotFoundError
+} from "@tenkicloud/sandbox";
+function resolveAuthToken() {
+  ensureTenkiEnvLoaded();
+  const t = process.env.TENKI_AUTH_TOKEN;
+  if (!t) {
+    throw new UserFacingError(
+      "Tenki credentials not configured.\nSet TENKI_AUTH_TOKEN (your auth token from https://tenki.cloud) in the environment or in ~/.agentbox/secrets.env. Running `agentbox create --provider tenki` on a terminal also prompts for it."
+    );
+  }
+  return t;
+}
+function hasUsableCredentials() {
+  ensureTenkiEnvLoaded();
+  return Boolean(process.env.TENKI_AUTH_TOKEN);
+}
+function getTenkiClient() {
+  const opts = { authToken: resolveAuthToken() };
+  const baseUrl = process.env.TENKI_BASE_URL;
+  if (baseUrl) opts.baseUrl = baseUrl;
+  const gatewayAddress = process.env.TENKI_GATEWAY_ADDRESS;
+  if (gatewayAddress) opts.gatewayAddress = gatewayAddress;
+  return new TenkiSandbox(opts);
+}
+
+// src/retry.ts
+var DEFAULT_BACKOFF = [1e3, 2e3, 4e3];
+var DEFAULT_ATTEMPT_TIMEOUT_MS = 3e4;
+var AttemptTimeoutError = class extends Error {
+  constructor(method, ms) {
+    super(`tenki ${method}: per-attempt timeout after ${String(ms)}ms`);
+    this.name = "AttemptTimeoutError";
+  }
+};
+function connectCodeOf(err) {
+  if (!err || typeof err !== "object") return void 0;
+  const code = err.code;
+  return typeof code === "string" ? code : void 0;
+}
+function statusCodeOf(err) {
+  if (!err || typeof err !== "object") return void 0;
+  for (const key of ["statusCode", "status"]) {
+    const v = err[key];
+    if (typeof v === "number") return v;
+  }
+  return void 0;
+}
+var RETRIABLE_CONNECT_CODES = /* @__PURE__ */ new Set([
+  "unavailable",
+  "resource_exhausted",
+  "deadline_exceeded",
+  "aborted"
+]);
+function isRetriable(err, allowAmbiguous) {
+  if (err instanceof AttemptTimeoutError) return allowAmbiguous;
+  const name = err instanceof Error ? err.name : void 0;
+  if (name === "RateLimitedError" || name === "CapacityUnavailableError") return true;
+  if (name === "UnauthorizedError" || name === "PermissionDeniedError" || name === "MissingAuthTokenError" || name === "SessionNotFoundError" || name === "SnapshotNotFoundError" || name === "QuotaExceededError" || name === "InvalidStateError" || name === "FileNotFoundError") {
+    return false;
+  }
+  const connectCode = connectCodeOf(err);
+  if (connectCode !== void 0 && RETRIABLE_CONNECT_CODES.has(connectCode)) {
+    return connectCode === "unavailable" || connectCode === "resource_exhausted" ? true : allowAmbiguous;
+  }
+  const status = statusCodeOf(err);
+  if (status !== void 0) {
+    if (status === 429) return true;
+    if (status >= 500 && status <= 599) return allowAmbiguous;
+    return false;
+  }
+  if (err && typeof err === "object") {
+    const candidates = [err, err.cause];
+    for (const c of candidates) {
+      if (!c || typeof c !== "object") continue;
+      const code = c.code;
+      if (code === "ECONNRESET" || code === "ETIMEDOUT" || code === "ECONNABORTED" || code === "EAI_AGAIN" || code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EPIPE" || code === "UND_ERR_SOCKET" || code === "UND_ERR_CONNECT_TIMEOUT") {
+        return allowAmbiguous;
+      }
+    }
+  }
+  return false;
+}
+async function withTenkiRetry(opts, fn) {
+  const backoff = opts.backoffMs ?? DEFAULT_BACKOFF;
+  const maxAttempts = backoff.length + 1;
+  const timeoutMs = opts.attemptTimeoutMs ?? DEFAULT_ATTEMPT_TIMEOUT_MS;
+  const log2 = opts.onRetry ?? defaultRetryLog;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await raceTimeout(fn(), timeoutMs, opts.method);
+    } catch (err) {
+      const last = attempt === maxAttempts;
+      if (last || !isRetriable(err, opts.retryOnAmbiguous)) throw err;
+      const delay = backoff[attempt - 1] ?? backoff[backoff.length - 1] ?? 4e3;
+      log2(
+        `tenki ${opts.method}: attempt ${String(attempt)} failed (${errorSummary(err)}); retrying in ${String(delay)}ms`
+      );
+      await sleep(delay);
+    }
+  }
+  throw new Error(`withTenkiRetry: exhausted attempts for ${opts.method}`);
+}
+function defaultRetryLog(line) {
+  process.stderr.write(`
+[tenki-retry] ${line}
+`);
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function raceTimeout(p, ms, method) {
+  let timer;
+  try {
+    return await Promise.race([
+      p,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new AttemptTimeoutError(method, ms)), ms);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function errorSummary(err) {
+  if (err instanceof Error) {
+    const code = connectCodeOf(err) ?? statusCodeOf(err);
+    return code !== void 0 ? `${err.name}(${String(code)}): ${truncate(err.message)}` : `${err.name}: ${truncate(err.message)}`;
+  }
+  return truncate(String(err));
+}
+function truncate(s, max = 160) {
+  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
+}
+
+// src/prepared-state.ts
+import {
+  preparedStatePathFor,
+  readPreparedStateRaw,
+  UserFacingError as UserFacingError2,
+  writePreparedStateRaw
+} from "@madarco/agentbox-provider-sdk";
+var SCHEMA = 2;
+function preparedStatePath() {
+  return preparedStatePathFor("tenki");
+}
+function readPreparedState() {
+  const raw = readPreparedStateRaw("tenki");
+  if (raw === null || typeof raw !== "object") return { schema: SCHEMA };
+  const parsed = raw;
+  if (parsed.schema !== SCHEMA) {
+    return { schema: SCHEMA };
+  }
+  return { schema: SCHEMA, base: parsed.base };
+}
+function writePreparedState(state) {
+  writePreparedStateRaw("tenki", state);
+}
+function updatePreparedState(mutate) {
+  const s = readPreparedState();
+  mutate(s);
+  writePreparedState(s);
+}
+async function currentTenkiBaseFingerprintLive() {
+  return void 0;
+}
+function ensureTenkiBaseImage() {
+  const state = readPreparedState();
+  if (state.base !== void 0) return;
+  throw new UserFacingError2(
+    "no Tenki base image found.\nRun `agentbox prepare --provider tenki` first \u2014 it bakes a snapshot carrying the agentbox runtime (agentbox-ctl, claude/codex/opencode, tmux) in your Tenki workspace so per-box `create` boots ready in seconds."
+  );
+}
+
+// src/build-attach.ts
+import { execFile } from "child_process";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { promisify } from "util";
+import {
+  hostTermForCloud,
+  renderInnerCommand,
+  UserFacingError as UserFacingError3
+} from "@madarco/agentbox-provider-sdk";
+var execFileAsync = promisify(execFile);
+var SELF = dirname(fileURLToPath(import.meta.url));
+var SSH_USER = process.env.AGENTBOX_TENKI_SSH_USER?.trim() || "tenki";
+var CERT_TTL_MS = 60 * 6e4;
+function resolveAttachHelperPath() {
+  const candidates = [
+    resolve2(SELF, "attach-helper.cjs"),
+    resolve2(SELF, "..", "dist", "attach-helper.cjs")
+  ];
+  for (const p of candidates) {
+    if (existsSync2(p)) return p;
+  }
+  return candidates[0];
+}
+function sshKeyDir(sandboxId) {
+  return resolve2(homedir2(), ".agentbox", "boxes", sandboxId, "ssh");
+}
+async function ensureKeypair(sandboxId) {
+  const dir = sshKeyDir(sandboxId);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const keyPath = join(dir, "id_ed25519");
+  if (!existsSync2(keyPath)) {
+    try {
+      await execFileAsync("ssh-keygen", [
+        "-t",
+        "ed25519",
+        "-N",
+        "",
+        "-C",
+        `agentbox-tenki-${sandboxId}`,
+        "-q",
+        "-f",
+        keyPath
+      ]);
+    } catch (err) {
+      throw new UserFacingError3(
+        "tenki attach: could not generate an SSH key \u2014 `ssh-keygen` is required (it ships with OpenSSH, alongside the `ssh` client this attach also needs).\n" + (err instanceof Error ? err.message : String(err))
+      );
+    }
+    chmodSync(keyPath, 384);
+  }
+  return { keyPath, publicKey: readFileSync2(`${keyPath}.pub`, "utf8").trim() };
+}
+async function issueCert(sandboxId, keyPath, publicKey) {
+  const cert = await getTenkiClient().issueSandboxSSHCert(sandboxId, publicKey, {
+    ttlMs: CERT_TTL_MS
+  });
+  const certPath = `${keyPath}-cert.pub`;
+  writeFileSync(certPath, cert.sshCert.trim() + "\n", { mode: 384 });
+  return certPath;
+}
+function shq(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+async function buildTenkiAttach(box, kind, opts) {
+  const sandboxId = box.cloud?.sandboxId;
+  if (!sandboxId) {
+    throw new Error(`tenki box ${box.name} has no sandboxId \u2014 record is malformed`);
+  }
+  const helper = resolveAttachHelperPath();
+  if (!existsSync2(helper)) {
+    throw new Error(
+      `tenki attach helper not found at ${helper} \u2014 the installed @tenkicloud/agentbox-provider is missing dist/attach-helper.cjs; reinstall the package.`
+    );
+  }
+  const authToken = resolveAuthToken();
+  const inner = renderInnerCommand(kind, opts);
+  const hostTerm = hostTermForCloud();
+  const env = {
+    // The ProxyCommand child opens the gateway WebSocket, so it needs the token.
+    TENKI_AUTH_TOKEN: authToken,
+    AGENTBOX_HOST_TERM: hostTerm,
+    // `ssh -t` propagates the local TERM to the remote PTY.
+    TERM: hostTerm
+  };
+  if (process.env.TENKI_BASE_URL) env.TENKI_BASE_URL = process.env.TENKI_BASE_URL;
+  if (process.env.TENKI_GATEWAY_ADDRESS)
+    env.TENKI_GATEWAY_ADDRESS = process.env.TENKI_GATEWAY_ADDRESS;
+  if (opts?.detached) {
+    return {
+      argv: [process.execPath, helper, "--detached", "--session-id", sandboxId],
+      env: { ...env, AGENTBOX_TENKI_INNER_CMD: inner }
+    };
+  }
+  const { keyPath, publicKey } = await ensureKeypair(sandboxId);
+  const certPath = await issueCert(sandboxId, keyPath, publicKey);
+  const proxyCommand = `${shq(process.execPath)} ${shq(helper)} --proxy --session-id ${shq(sandboxId)}`;
+  const argv = [
+    "ssh",
+    "-o",
+    `ProxyCommand=${proxyCommand}`,
+    // Only ever offer the key we just minted a cert for; without this ssh may
+    // walk the user's agent/default identities first and exhaust auth attempts.
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    keyPath,
+    "-o",
+    `CertificateFile=${certPath}`,
+    // The gateway terminates the connection, and the "host" is a session id
+    // rather than a stable endpoint — so there is no host key worth pinning, and
+    // recording one would just churn the user's known_hosts.
+    "-o",
+    "StrictHostKeyChecking=no",
+    "-o",
+    "UserKnownHostsFile=/dev/null",
+    // Suppresses the "Permanently added … to the list of known hosts" banner
+    // that would otherwise print over the agent's first screen.
+    "-o",
+    "LogLevel=ERROR",
+    // Force a PTY: the remote command is `tmux attach`, which needs one.
+    "-t",
+    `${SSH_USER}@${sandboxId}`,
+    inner
+  ];
+  return { argv, env };
+}
+
+// src/backend.ts
+var TENKI_WEB_PORT = 8080;
+var DEFAULT_MAX_DURATION_MS = 45 * 6e4;
+var PROVISION_TIMEOUT_MS = 3e5;
+var decoder = new TextDecoder();
+function mapState(s) {
+  switch (s) {
+    case "RUNNING":
+    case "CREATING":
+    case "RESUMING":
+      return "running";
+    case "PAUSED":
+    case "PAUSING":
+    // USER_SHUTDOWN is a stopped-but-not-terminated VM (0.4.0+). The API groups
+    // it with PAUSED as an existing, non-active state, so treat it as paused so
+    // an op that needs the box live resumes it rather than agentbox concluding
+    // the box is gone and recreating it.
+    case "USER_SHUTDOWN":
+      return "paused";
+    default:
+      return "missing";
+  }
+}
+function isGone(err) {
+  const name = err instanceof Error ? err.name : "";
+  return name === "SessionNotFoundError" || name === "SessionTerminatedError" || name === "SessionExpiredError";
+}
+function safeName(name) {
+  return name.replace(/[\u0000-\u001f]/g, "").slice(0, 200);
+}
+function previewSlug(sandboxId, port) {
+  const id = sandboxId.replace(/[^a-z0-9]/gi, "").slice(-12).toLowerCase() || "box";
+  return `ab-${id}-${String(port)}`;
+}
+var REFRESH_MIN_TTL_MS = 6e4;
+function findPermanentShare(shares, port) {
+  return shares.find((p) => p.port === port && p.expiresAt === void 0);
+}
+function findExpiringShare(shares, port, minRemainingMs, nowMs) {
+  return shares.find(
+    (p) => p.port === port && p.expiresAt !== void 0 && p.expiresAt.getTime() - nowMs >= minRemainingMs
+  );
+}
+async function resolveSession(handle) {
+  return getTenkiClient().get(handle.sandboxId);
+}
+function resolveOwnerScope() {
+  const envWorkspace = process.env.AGENTBOX_TENKI_WORKSPACE_ID?.trim();
+  return envWorkspace ? { workspaceId: envWorkspace } : {};
+}
+async function ensureLive(session) {
+  if (session.state === "PAUSED" || session.state === "PAUSING" || session.state === "USER_SHUTDOWN") {
+    await session.resume();
+    await session.waitReady(PROVISION_TIMEOUT_MS);
+  }
+}
+function shq2(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+var stageSeq = 0;
+function stageName(kind) {
+  stageSeq += 1;
+  return `.agentbox-${kind}-${String(process.pid)}-${String(stageSeq)}.tmp`;
+}
+var workdirCache = /* @__PURE__ */ new Map();
+async function resolveGuestWorkdir(session) {
+  const cached = workdirCache.get(session.id);
+  if (cached !== void 0) return cached;
+  const r = await session.run(["bash", "-c", "pwd"]);
+  const wd = decoder.decode(r.stdout).trim() || "/";
+  workdirCache.set(session.id, wd);
+  return wd;
+}
+function isUnderWorkdir(path, workdir) {
+  if (!posix.isAbsolute(path)) return true;
+  const p = posix.normalize(path);
+  const d = posix.normalize(workdir);
+  return p === d || p.startsWith(d.endsWith("/") ? d : `${d}/`);
+}
+async function moveStagedTo(session, relStage, remotePath) {
+  const script = [
+    "set -eu",
+    "if command -v sudo >/dev/null 2>&1; then SUDO='sudo -n'; else SUDO=''; fi",
+    `src="$(pwd)/${relStage}"`,
+    `$SUDO mkdir -p ${shq2(posix.dirname(remotePath))}`,
+    `$SUDO mv -f "$src" ${shq2(remotePath)}`
+  ].join("\n");
+  const r = await session.run(["bash", "-c", script]);
+  if (r.exitCode !== 0) {
+    try {
+      await session.run(["bash", "-c", `rm -f ${shq2(relStage)}`]);
+    } catch {
+    }
+    throw new Error(
+      `tenki uploadFile: staging move to ${remotePath} failed (exit ${String(r.exitCode)}): ${decoder.decode(r.stderr).trim()}`
+    );
+  }
+}
+async function copyIntoStage(session, remotePath, relStage) {
+  const script = [
+    "set -eu",
+    "if command -v sudo >/dev/null 2>&1; then SUDO='sudo -n'; else SUDO=''; fi",
+    `dst="$(pwd)/${relStage}"`,
+    `$SUDO cp -f ${shq2(remotePath)} "$dst"`,
+    // The RPC reads as the guest user; ensure it owns the staged copy.
+    `$SUDO chown "$(id -u):$(id -g)" "$dst" 2>/dev/null || true`
+  ].join("\n");
+  const r = await session.run(["bash", "-c", script]);
+  if (r.exitCode !== 0) {
+    throw new Error(
+      `tenki downloadFile: staging copy from ${remotePath} failed (exit ${String(r.exitCode)}): ${decoder.decode(r.stderr).trim()}`
+    );
+  }
+}
+function parseTenkiSize(spec) {
+  if (!spec) return void 0;
+  const parts = spec.trim().split("-");
+  if (parts.length !== 2 && parts.length !== 3) return void 0;
+  const nums = parts.map((p) => Number(p));
+  if (nums.some((n) => !Number.isInteger(n) || n <= 0)) return void 0;
+  return { cpu: nums[0], memoryGb: nums[1], diskGb: nums[2] };
+}
+var tenkiBackend = {
+  name: "tenki",
+  webProxyPort: TENKI_WEB_PORT,
+  async provision(req) {
+    const log2 = req.onLog ?? (() => {
+    });
+    if (req.snapshot === void 0) ensureTenkiBaseImage();
+    const snapshotId = req.snapshot ?? readPreparedState().base?.snapshotId;
+    if (!snapshotId) {
+      throw new Error(
+        "tenki provision: no base snapshot available \u2014 `agentbox prepare --provider tenki` must run first"
+      );
+    }
+    let cpuCores = req.resources?.cpu ?? 2;
+    let memoryMb = (req.resources?.memory ?? 4) * 1024;
+    let diskSizeGb = req.resources?.disk ?? 8;
+    if (req.size && req.size.trim().length > 0) {
+      const parsed = parseTenkiSize(req.size);
+      if (parsed) {
+        cpuCores = parsed.cpu;
+        memoryMb = parsed.memoryGb * 1024;
+        if (parsed.diskGb !== void 0) diskSizeGb = parsed.diskGb;
+      } else {
+        (req.onLog ?? (() => {
+        }))(
+          `tenki: ignoring invalid size '${req.size}' (expected 'cpu-memory' or 'cpu-memory-disk' GB, e.g. '4-8')`
+        );
+      }
+    }
+    const maxDurationMs = req.timeoutMs ?? DEFAULT_MAX_DURATION_MS;
+    const client = getTenkiClient();
+    const { workspaceId } = resolveOwnerScope();
+    const session = await withTenkiRetry(
+      { method: "provision", retryOnAmbiguous: false, attemptTimeoutMs: 12e4, backoffMs: [] },
+      () => client.create({
+        name: safeName(req.name),
+        snapshotId,
+        ...workspaceId ? { workspaceId } : {},
+        env: req.env,
+        cpuCores,
+        memoryMb,
+        diskSizeGb,
+        // Inbound is required for preview URLs (exposePort); outbound for the
+        // agents' network. Tenki has no domain-allowlist primitive, so
+        // req.networkPolicy 'deny-all' maps to allowOutbound:false, else allow.
+        allowInbound: true,
+        allowOutbound: req.networkPolicy !== "deny-all",
+        maxDurationMs,
+        // Marker so list()/prune can filter to agentbox-managed sessions.
+        metadata: { agentbox: "true", "agentbox.name": safeName(req.name) },
+        tags: ["agentbox"],
+        // Return as soon as the session exists; we own the wait below so a
+        // readiness timeout can't lose the id.
+        waitReady: false
+      })
+    );
+    try {
+      await session.waitReady(PROVISION_TIMEOUT_MS);
+    } catch (err) {
+      await session.close().catch(() => void 0);
+      throw err;
+    }
+    log2(`tenki: created session ${session.id} (${req.snapshot ? "snapshot" : "image"})`);
+    return { sandboxId: session.id };
+  },
+  async get(sandboxId) {
+    return withTenkiRetry({ method: "get", retryOnAmbiguous: true }, async () => {
+      try {
+        await getTenkiClient().get(sandboxId);
+        return { sandboxId };
+      } catch (err) {
+        if (isGone(err)) return null;
+        throw err;
+      }
+    });
+  },
+  async list() {
+    return withTenkiRetry({ method: "list", retryOnAmbiguous: true }, async () => {
+      const sessions = await getTenkiClient().list();
+      const out = [];
+      for (const s of sessions) {
+        if (s.metadata?.["agentbox"] !== "true") continue;
+        const summary = { sandboxId: s.id, state: mapState(s.state) };
+        const friendly = s.metadata?.["agentbox.name"] ?? s.name;
+        if (friendly) summary.name = friendly;
+        out.push(summary);
+      }
+      return out;
+    });
+  },
+  async start(h) {
+    await withTenkiRetry(
+      { method: "start", retryOnAmbiguous: true, attemptTimeoutMs: PROVISION_TIMEOUT_MS },
+      async () => {
+        const session = await resolveSession(h);
+        await ensureLive(session);
+      }
+    );
+  },
+  // No separate "stop VM, keep record" in the high-level SDK — pause IS the
+  // cold-storage state (it captures a pause snapshot). stop ≡ pause.
+  async stop(h) {
+    await this.pause(h);
+  },
+  async pause(h) {
+    await withTenkiRetry(
+      { method: "pause", retryOnAmbiguous: true, attemptTimeoutMs: 12e4 },
+      async () => {
+        const session = await resolveSession(h);
+        if (session.state === "PAUSED" || session.state === "PAUSING" || session.state === "USER_SHUTDOWN")
+          return;
+        await session.pause();
+      }
+    );
+  },
+  async resume(h) {
+    await this.start(h);
+  },
+  async destroy(h) {
+    await withTenkiRetry(
+      { method: "destroy", retryOnAmbiguous: true, attemptTimeoutMs: 12e4 },
+      async () => {
+        try {
+          const session = await resolveSession(h);
+          await session.close();
+        } catch (err) {
+          if (isGone(err)) return;
+          throw err;
+        }
+      }
+    );
+    try {
+      rmSync(sshKeyDir(h.sandboxId), { recursive: true, force: true });
+    } catch {
+    }
+  },
+  async state(h) {
+    return withTenkiRetry({ method: "state", retryOnAmbiguous: true }, async () => {
+      try {
+        const session = await resolveSession(h);
+        return mapState(session.state);
+      } catch (err) {
+        if (isGone(err)) return "missing";
+        throw err;
+      }
+    });
+  },
+  // The host keepalive loop calls this while the agent is active. `extend` is
+  // ADDITIVE (extends by N ms), and the SDK doesn't expose the remaining time
+  // readably, so we extend by `target - current` (the host owns the deadline
+  // bookkeeping, same as vercel). The host only calls when target > current.
+  async renewTimeout(h, targetDeadlineEpochMs, currentDeadlineEpochMs) {
+    const deltaMs = Math.max(0, targetDeadlineEpochMs - currentDeadlineEpochMs);
+    if (deltaMs === 0) return;
+    await withTenkiRetry({ method: "renewTimeout", retryOnAmbiguous: true }, async () => {
+      const session = await resolveSession(h);
+      await session.extend(deltaMs);
+    });
+  },
+  async exec(h, cmd, opts) {
+    const timeoutMs = opts?.attemptTimeoutMs ?? 3e5;
+    return withTenkiRetry(
+      {
+        method: "exec",
+        retryOnAmbiguous: opts?.noRetry ? false : true,
+        attemptTimeoutMs: timeoutMs,
+        backoffMs: opts?.noRetry ? [] : void 0
+      },
+      async () => {
+        const session = await resolveSession(h);
+        await ensureLive(session);
+        const r = await session.run(["bash", "-c", cmd], {
+          ...opts?.cwd !== void 0 ? { cwd: opts.cwd } : {},
+          ...opts?.env !== void 0 ? { env: opts.env } : {},
+          ...opts?.user === "root" ? { privileged: true } : {}
+        });
+        return {
+          exitCode: r.exitCode,
+          stdout: decoder.decode(r.stdout),
+          stderr: decoder.decode(r.stderr)
+        };
+      }
+    );
+  },
+  async uploadFile(h, localPath, remotePath) {
+    await withTenkiRetry(
+      { method: "uploadFile", retryOnAmbiguous: true, attemptTimeoutMs: 3e5 },
+      async () => {
+        const session = await resolveSession(h);
+        await ensureLive(session);
+        const workdir = await resolveGuestWorkdir(session);
+        const web = () => Readable.toWeb(createReadStream(localPath));
+        if (isUnderWorkdir(remotePath, workdir)) {
+          await session.writeFileStream(remotePath, web(), { mode: 420 });
+          return;
+        }
+        const stage = stageName("upload");
+        await session.writeFileStream(stage, web(), { mode: 420 });
+        await moveStagedTo(session, stage, remotePath);
+      }
+    );
+  },
+  async downloadFile(h, remotePath, localPath) {
+    await withTenkiRetry(
+      { method: "downloadFile", retryOnAmbiguous: true, attemptTimeoutMs: 3e5 },
+      async () => {
+        const session = await resolveSession(h);
+        await ensureLive(session);
+        const workdir = await resolveGuestWorkdir(session);
+        const sink = (web) => pipeline(Readable.fromWeb(web), createWriteStream(localPath));
+        if (isUnderWorkdir(remotePath, workdir)) {
+          const web = await session.readFileStream(
+            remotePath
+          );
+          await sink(web);
+          return;
+        }
+        const stage = stageName("download");
+        await copyIntoStage(session, remotePath, stage);
+        try {
+          const web = await session.readFileStream(
+            stage
+          );
+          await sink(web);
+        } finally {
+          await session.remove(stage).catch(() => void 0);
+        }
+      }
+    );
+  },
+  async listFiles(h, remoteDir) {
+    return withTenkiRetry({ method: "listFiles", retryOnAmbiguous: true }, async () => {
+      const session = await resolveSession(h);
+      await ensureLive(session);
+      const entries = await session.list(remoteDir);
+      return entries.map((e) => ({ name: basename(e.path), isDir: e.isDir }));
+    });
+  },
+  async previewUrl(h, port) {
+    return withTenkiRetry({ method: "previewUrl", retryOnAmbiguous: true }, async () => {
+      const session = await resolveSession(h);
+      const shares = await session.listExposedPorts();
+      const existing = findPermanentShare(shares, port);
+      if (existing) return { url: existing.previewUrl };
+      if (shares.some((p) => p.port === port)) {
+        await session.unexposePort(port).catch(() => void 0);
+      }
+      const exposed = await session.exposePort(port, { slug: previewSlug(h.sandboxId, port) });
+      return { url: exposed.previewUrl };
+    });
+  },
+  // Tenki preview URLs are public + browser-usable; expiry maps to ttlMs.
+  // NOTE: the API rejects `slug` + `ttlMs` together (`expires_at is not
+  // supported when slug is set`), so an expiring share can't carry our stable
+  // slug — we mint a server-assigned URL instead. Re-exposing therefore churns
+  // the URL, which is inherent to an expiring (signed) share.
+  async signedPreviewUrl(h, port, expiresInSeconds) {
+    return withTenkiRetry({ method: "signedPreviewUrl", retryOnAmbiguous: true }, async () => {
+      const session = await resolveSession(h);
+      const ttlMs = Math.max(1, expiresInSeconds) * 1e3;
+      const shares = await session.listExposedPorts();
+      const existing = findExpiringShare(shares, port, ttlMs, Date.now());
+      if (existing) return { url: existing.previewUrl };
+      if (shares.some((p) => p.port === port)) {
+        await session.unexposePort(port).catch(() => void 0);
+      }
+      const exposed = await session.exposePort(port, { ttlMs });
+      return { url: exposed.previewUrl };
+    });
+  },
+  // Re-mint a share when the cached URL stops responding (host poller).
+  async refreshPreviewUrl(h, port) {
+    return withTenkiRetry({ method: "refreshPreviewUrl", retryOnAmbiguous: true }, async () => {
+      const session = await resolveSession(h);
+      const prior = (await session.listExposedPorts()).find((p) => p.port === port);
+      const priorRemainingMs = prior?.expiresAt === void 0 ? void 0 : prior.expiresAt.getTime() - Date.now();
+      try {
+        await session.unexposePort(port);
+      } catch {
+      }
+      if (priorRemainingMs !== void 0) {
+        const exposed2 = await session.exposePort(port, {
+          ttlMs: Math.max(REFRESH_MIN_TTL_MS, priorRemainingMs)
+        });
+        return { url: exposed2.previewUrl };
+      }
+      const exposed = await session.exposePort(port, { slug: previewSlug(h.sandboxId, port) });
+      return { url: exposed.previewUrl };
+    });
+  },
+  /**
+   * Probe whether a snapshot id is still bootable. Returns false on any lookup
+   * failure (treated by the cloud-provider as "gone" so it falls back to a
+   * from-base boot rather than erroring the user).
+   */
+  async snapshotExists(snapshotName) {
+    return withTenkiRetry({ method: "snapshotExists", retryOnAmbiguous: true }, async () => {
+      try {
+        const snap = await getTenkiClient().getSnapshot(snapshotName);
+        return snap.state === "READY";
+      } catch {
+        return false;
+      }
+    });
+  }
+};
+
+// src/prepare.ts
+import {
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  mkdtempSync,
+  readdirSync,
+  rmSync as rmSync2,
+  statSync,
+  symlinkSync
+} from "fs";
+import { homedir as homedir5, tmpdir } from "os";
+import { join as join2 } from "path";
+import {
+  readCliStamp,
+  resolveSharedRuntimeAsset,
+  stageClaudeStaticForUpload,
+  stageCodexStaticForUpload,
+  stageOpencodeStaticForUpload,
+  UserFacingError as UserFacingError4
+} from "@madarco/agentbox-provider-sdk";
+
+// src/credentials.ts
+import { homedir as homedir4 } from "os";
+import { resolve as resolve4 } from "path";
+import { hostOpenCommand } from "@madarco/agentbox-provider-sdk";
+import { cancel, confirm, intro, isCancel, log, note, outro, password } from "@clack/prompts";
+
+// src/secrets.ts
+import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+function secretsEnvPath() {
+  return resolve3(homedir3(), ".agentbox", "secrets.env");
+}
+function writeManagedSecrets(managedKeys, record) {
+  for (const k of managedKeys) delete process.env[k];
+  for (const [k, v] of Object.entries(record)) process.env[k] = v;
+  const path = secretsEnvPath();
+  mkdirSync2(dirname2(path), { recursive: true });
+  let existing = "";
+  if (existsSync3(path)) {
+    try {
+      existing = readFileSync3(path, "utf8");
+    } catch {
+      existing = "";
+    }
+  }
+  const kept = existing.split(/\r?\n/).filter((line) => {
+    const stripped = line.startsWith("export ") ? line.slice("export ".length) : line;
+    const eq = stripped.indexOf("=");
+    if (eq <= 0) return true;
+    return !managedKeys.includes(stripped.slice(0, eq).trim());
+  }).join("\n").replace(/\s+$/u, "");
+  const lines = Object.entries(record).map(([k, v]) => `${k}=${v}`);
+  const body = (kept ? `${kept}
+` : "") + lines.join("\n") + "\n";
+  const tmp = `${path}.tmp`;
+  writeFileSync2(tmp, body, { mode: 384 });
+  try {
+    chmodSync2(tmp, 384);
+  } catch {
+  }
+  renameSync(tmp, path);
+  try {
+    chmodSync2(path, 384);
+  } catch {
+  }
+}
+
+// src/credentials.ts
+function exitOnCancel(v) {
+  if (isCancel(v)) {
+    cancel("Cancelled.");
+    process.exit(130);
+  }
+  return v;
+}
+var DASHBOARD_URL = "https://tenki.cloud";
+var DOCS_URL = "https://tenki.cloud/docs";
+var MANAGED_KEYS = ["TENKI_AUTH_TOKEN"];
+async function ensureTenkiCredentials(opts = {}) {
+  ensureTenkiEnvLoaded();
+  if (!opts.force && hasUsableCredentials()) return;
+  if (!process.stdin.isTTY) return;
+  intro("Tenki setup");
+  note(
+    `AgentBox needs a Tenki workspace auth token to provision sandboxes.
+Create one in your Tenki dashboard (${DASHBOARD_URL}; see ${DOCS_URL}), then paste it below.
+The token is stored in \`~/.agentbox/secrets.env\` (mode 0600) \u2014 no .env.local harvesting.`,
+    "Credentials required"
+  );
+  const openIt = exitOnCancel(
+    await confirm({
+      message: `Open ${DASHBOARD_URL} to create a token?`,
+      initialValue: true
+    })
+  );
+  if (openIt) openDashboard();
+  const token = exitOnCancel(
+    await password({
+      message: "Paste your Tenki auth token (tk_\u2026)",
+      validate: (v) => v && v.trim().length > 0 ? void 0 : "Cannot be empty"
+    })
+  );
+  persistCredentials({ authToken: token.trim() });
+  reloadTenkiEnv();
+  log.success(`Tenki credentials saved to ${secretsPath()}`);
+  outro("Setup complete.");
+}
+function persistCredentials(creds) {
+  writeManagedSecrets(MANAGED_KEYS, { TENKI_AUTH_TOKEN: creds.authToken });
+}
+function setTenkiCredentials(fields) {
+  const token = (fields.token ?? "").trim();
+  if (!token) {
+    return { ok: false, error: "token is required", status: { configured: false } };
+  }
+  persistCredentials({ authToken: token });
+  const cred = readTenkiCredStatus();
+  return { ok: true, status: { configured: cred.auth !== "none", label: cred.auth } };
+}
+function openDashboard() {
+  import("child_process").then(({ spawnSync }) => {
+    const r = spawnSync(hostOpenCommand(), [DASHBOARD_URL], { stdio: "ignore" });
+    if (r.status !== 0) {
+      log.warn(`Could not auto-open the browser \u2014 visit ${DASHBOARD_URL} manually.`);
+    }
+  }).catch(() => {
+    log.warn(`Could not auto-open the browser \u2014 visit ${DASHBOARD_URL} manually.`);
+  });
+}
+function secretsPath() {
+  return resolve4(homedir4(), ".agentbox", "secrets.env");
+}
+function readTenkiCredStatus() {
+  const shellHad = process.env.TENKI_AUTH_TOKEN !== void 0;
+  ensureTenkiEnvLoaded();
+  const token = process.env.TENKI_AUTH_TOKEN;
+  if (!token) return { auth: "none", source: "none" };
+  return { auth: "token", token, source: shellHad ? "env" : "secrets.env" };
+}
+function maskKey(value) {
+  if (value.length <= 8) return "*".repeat(value.length);
+  return `${value.slice(0, 4)}\u2026${"*".repeat(8)}${value.slice(-4)}`;
+}
+
+// src/prepare.ts
+var BUILDER_CPU = 2;
+var BUILDER_MEMORY_MB = 4096;
+var BUILDER_DISK_GB = 20;
+var BUILDER_MAX_DURATION_MS = 45 * 6e4;
+var BUILDER_READY_TIMEOUT_MS = 24e4;
+var BOX_USER = "tenki";
+var BOX_HOME = `/home/${BOX_USER}`;
+var BOX_DIRS = [
+  "/workspace",
+  "/run/agentbox",
+  "/var/log/agentbox",
+  "/var/lib/agentbox",
+  "/etc/agentbox",
+  "/etc/claude-code",
+  "/usr/local/share/agentbox"
+];
+var OWNED_PATHS = [
+  BOX_HOME,
+  "/workspace",
+  "/run/agentbox",
+  "/var/log/agentbox",
+  "/var/lib/agentbox"
+];
+var PREPARE_ASSETS = [
+  { shared: "ctl.cjs", dest: "/usr/local/bin/agentbox-ctl", mode: "0755" },
+  { shared: "agentbox-vnc-start", dest: "/usr/local/bin/agentbox-vnc-start", mode: "0755" },
+  { shared: "agentbox-dockerd-start", dest: "/usr/local/bin/agentbox-dockerd-start", mode: "0755" },
+  {
+    shared: "agentbox-portless-trust",
+    dest: "/usr/local/bin/agentbox-portless-trust",
+    mode: "0755"
+  },
+  {
+    shared: "agentbox-checkpoint-cleanup",
+    dest: "/usr/local/bin/agentbox-checkpoint-cleanup",
+    mode: "0755"
+  },
+  { shared: "agentbox-open", dest: "/usr/local/bin/agentbox-open", mode: "0755" },
+  { shared: "gh-shim", dest: "/usr/local/bin/gh", mode: "0755" },
+  { shared: "git-shim", dest: "/usr/local/bin/git", mode: "0755" },
+  { shared: "ntn-shim", dest: "/usr/local/bin/ntn", mode: "0755" },
+  { shared: "linear-shim", dest: "/usr/local/bin/linear", mode: "0755" },
+  {
+    shared: "claude-managed-settings.json",
+    dest: "/etc/claude-code/managed-settings.json",
+    mode: "0644"
+  },
+  {
+    shared: "agentbox-codex-hooks.json",
+    dest: "/usr/local/share/agentbox/codex-hooks.json",
+    mode: "0644"
+  },
+  {
+    shared: "agentbox-setup-skill.md",
+    dest: "/usr/local/share/agentbox/setup-guide.md",
+    mode: "0644"
+  },
+  {
+    shared: "opencode-agentbox-plugin.js",
+    dest: "/usr/local/share/agentbox/opencode-agentbox-plugin.js",
+    mode: "0644"
+  }
+];
+function stagedAssetPath(shared) {
+  return `/tmp/agentbox-stage-${shared}`;
+}
+var AGENT_PACKAGES = ["@anthropic-ai/claude-code", "@openai/codex", "opencode-ai"];
+var PROFILE_SH = `# Auto-loaded by login shells; box.env is written at create time.
+if [ -r /etc/agentbox/box.env ]; then
+  set -a
+  . /etc/agentbox/box.env
+  set +a
+fi
+case ":$PATH:" in
+  *:${BOX_HOME}/.local/bin:*) : ;;
+  *) PATH=${BOX_HOME}/.local/bin:$PATH ;;
+esac
+export PATH
+export COLORTERM=\${COLORTERM:-truecolor}
+export DISABLE_AUTOUPDATER=\${DISABLE_AUTOUPDATER:-1}
+export BROWSER=\${BROWSER:-/usr/local/bin/agentbox-open}
+`;
+function buildInstallPlan() {
+  const quoted = (paths) => paths.map((p) => `"${p}"`).join(" ");
+  return [
+    {
+      name: "apt-packages",
+      root: true,
+      timeoutMs: 6e5,
+      // tmux: the one hard dependency the base image lacks, and every
+      // interactive attach runs inside a tmux session.
+      //
+      // docker.io: in-box Docker. Verified working on a Tenki microVM — cgroup2,
+      // native overlay2 (not the slow vfs fallback), and the shared
+      // `agentbox-dockerd-start` launcher brings the daemon up. Containers do
+      // not need nested virtualization, so the absence of /dev/kvm is irrelevant.
+      command: [
+        "set -euo pipefail",
+        "export DEBIAN_FRONTEND=noninteractive",
+        "apt-get update -qq",
+        "apt-get install -y --no-install-recommends tmux docker.io",
+        // The agent runs unprivileged. Login shells (attach, tmux) reach the
+        // daemon through this group; Tenki's guest agent starts its exec
+        // processes without supplementary groups, so those rely instead on the
+        // socket mode the dockerd launcher sets. Both paths are covered.
+        `usermod -aG docker ${BOX_USER}`
+      ].join("\n")
+    },
+    {
+      name: "box-dirs",
+      root: true,
+      command: `set -euo pipefail
+mkdir -p ${quoted(BOX_DIRS)}
+chmod 755 /workspace`
+    },
+    {
+      name: "vscode-user",
+      root: true,
+      // AgentBox's credential seed (as inlined in the published provider SDK)
+      // extracts with an in-shell `sudo -u vscode`, so the box needs a real
+      // `vscode` account or the seed dies with "sudo: unknown user vscode" and
+      // every box starts logged out. We add it as an ALIAS of the box user
+      // (same uid/gid, same home, `-o` to permit the duplicate uid) rather than
+      // a separate account: files then land owned by the user the agents
+      // actually run as, and Tenki's own guest agent keeps its identity.
+      //
+      // The CLI has since switched to `backend.exec(…, { user })` with no
+      // in-shell sudo; this step stays harmless once the SDK catches up.
+      command: [
+        "set -euo pipefail",
+        "if ! id vscode >/dev/null 2>&1; then",
+        `  useradd -o -u "$(id -u ${BOX_USER})" -g "$(id -g ${BOX_USER})" -d ${BOX_HOME} -s /bin/bash vscode`,
+        "fi",
+        "id vscode >/dev/null"
+      ].join("\n")
+    },
+    {
+      name: "vscode-home-link",
+      root: true,
+      // agentbox-ctl hardcodes /home/vscode/... credential paths and the profile
+      // shim puts /home/vscode/.local/bin on PATH. A symlink satisfies both
+      // without renaming the platform's own user.
+      command: `set -euo pipefail
+ln -sfn ${BOX_HOME} /home/vscode`
+    },
+    {
+      name: "runtime-assets",
+      root: true,
+      command: [
+        "set -euo pipefail",
+        ...PREPARE_ASSETS.map(
+          ({ shared, dest, mode }) => `install -D -m ${mode} "${stagedAssetPath(shared)}" "${dest}"`
+        ),
+        // `xdg-open` is what agents and browsers actually invoke; route it to the
+        // relay-backed opener so a link opens on the *host*, not in the box.
+        "ln -sf /usr/local/bin/agentbox-open /usr/local/bin/xdg-open",
+        `rm -f ${quoted(PREPARE_ASSETS.map((a) => stagedAssetPath(a.shared)))}`
+      ].join("\n")
+    },
+    {
+      name: "agent-dirs",
+      // Runs as the box user so its own home comes out correctly owned.
+      //
+      // The credential PIVOT is the point of this step. AgentBox's cloud scaffold
+      // seeds per-agent credentials at CREATE time — for a backend with no volume
+      // primitive (us, like vercel/e2b/hetzner) it uploads them straight into
+      // `~/.agentbox-creds/<agent>/`. Those symlinks are what make the agents
+      // actually read them; without the layout baked here, the seed lands in a
+      // directory nothing consults and every box starts logged out.
+      command: [
+        "set -euo pipefail",
+        `mkdir -p ${BOX_HOME}/.claude/skills/agentbox-setup ${BOX_HOME}/.codex   ${BOX_HOME}/.local/share/opencode ${BOX_HOME}/.agentbox-creds/claude   ${BOX_HOME}/.agentbox-creds/codex ${BOX_HOME}/.agentbox-creds/opencode`,
+        `ln -sf ${BOX_HOME}/.agentbox-creds/claude/.credentials.json ${BOX_HOME}/.claude/.credentials.json`,
+        `ln -sf ${BOX_HOME}/.agentbox-creds/codex/auth.json ${BOX_HOME}/.codex/auth.json`,
+        `ln -sf ${BOX_HOME}/.agentbox-creds/opencode/auth.json ${BOX_HOME}/.local/share/opencode/auth.json`,
+        `ln -sf ${BOX_HOME}/.claude/_claude.json ${BOX_HOME}/.claude.json`,
+        // The in-box first-run wizard the setup prompt refers to.
+        `cp /usr/local/share/agentbox/setup-guide.md ${BOX_HOME}/.claude/skills/agentbox-setup/SKILL.md`
+      ].join("\n")
+    },
+    {
+      name: "coding-agents",
+      // npm's global prefix is writable by the box user in Tenki's base image, so
+      // this needs no elevation — and installing as the box user keeps the
+      // resulting file ownership right.
+      timeoutMs: 18e5,
+      command: `set -euo pipefail
+npm install -g ${AGENT_PACKAGES.join(" ")}`
+    },
+    {
+      name: "login-shell-env",
+      root: true,
+      command: [
+        "set -euo pipefail",
+        "cat > /etc/profile.d/agentbox.sh <<'AGENTBOX_PROFILE'",
+        PROFILE_SH.trimEnd(),
+        "AGENTBOX_PROFILE",
+        "chmod 0644 /etc/profile.d/agentbox.sh"
+      ].join("\n")
+    },
+    {
+      name: "ownership",
+      root: true,
+      // Last: the steps above wrote as root, and the box runs unprivileged.
+      command: `set -euo pipefail
+chown -R ${BOX_USER}:${BOX_USER} ${quoted(OWNED_PATHS)}`
+    },
+    {
+      name: "verify",
+      // Fail the bake here rather than pinning a snapshot that cannot supervise a
+      // box. `agentbox-ctl` is the one that really matters.
+      command: [
+        "set -euo pipefail",
+        "command -v tmux >/dev/null",
+        "command -v agentbox-ctl >/dev/null",
+        // In-box docker: the binaries plus the box user's group membership, so a
+        // login shell in the box reaches the daemon without sudo.
+        "command -v docker >/dev/null",
+        "command -v dockerd >/dev/null",
+        `id -nG ${BOX_USER} | tr ' ' '\\n' | grep -qx docker`,
+        "test -x /usr/local/bin/agentbox-ctl",
+        "test -f /etc/claude-code/managed-settings.json",
+        'for a in claude codex opencode; do command -v "$a" >/dev/null || { echo "agent $a missing" >&2; exit 1; }; done',
+        // The credential pivot must be symlinks pointing into ~/.agentbox-creds,
+        // or the create-time credential seed lands where nothing reads it. A
+        // dangling link is expected and fine here: the target file only appears
+        // when a box is created.
+        `for l in "${BOX_HOME}/.claude/.credentials.json" "${BOX_HOME}/.codex/auth.json"   "${BOX_HOME}/.local/share/opencode/auth.json" "${BOX_HOME}/.claude.json"; do   test -L "$l" || { echo "credential pivot missing: $l" >&2; exit 1; }; done`,
+        `test -d "${BOX_HOME}/.agentbox-creds/claude"`,
+        // The credential seed runs `sudo -u vscode`; without this the seed fails
+        // silently-ish at create and boxes start unauthenticated.
+        "id vscode >/dev/null",
+        `test "$(id -u vscode)" = "$(id -u ${BOX_USER})"`,
+        `test -f "${BOX_HOME}/.claude/skills/agentbox-setup/SKILL.md"`
+      ].join("\n")
+    }
+  ];
+}
+function shadowCodexHome(hostHome) {
+  const source = join2(hostHome, ".codex");
+  try {
+    if (!lstatSync(source).isDirectory()) return null;
+  } catch {
+    return null;
+  }
+  const root = mkdtempSync(join2(tmpdir(), "agentbox-tenki-codex-shadow-"));
+  const mirror = (from, to, depth) => {
+    if (depth > 12) return;
+    mkdirSync3(to, { recursive: true });
+    for (const entry of readdirSync(from, { withFileTypes: true })) {
+      if (entry.name === "auth.json") continue;
+      const src = join2(from, entry.name);
+      const dest = join2(to, entry.name);
+      let stat;
+      try {
+        stat = statSync(src);
+      } catch {
+        continue;
+      }
+      if (stat.isDirectory()) {
+        mirror(src, dest, depth + 1);
+      } else if (stat.isFile()) {
+        try {
+          symlinkSync(src, dest);
+        } catch {
+        }
+      }
+    }
+  };
+  try {
+    mirror(source, join2(root, ".codex"), 0);
+  } catch {
+    rmSync2(root, { recursive: true, force: true });
+    return null;
+  }
+  return { home: root, cleanup: () => rmSync2(root, { recursive: true, force: true }) };
+}
+async function bakeAgentStaticConfig(handle, hostWorkspace, progress) {
+  progress("staging host agent static config");
+  const stagings = [];
+  const stageOne = async (kind, stage, dest) => {
+    let tar;
+    try {
+      tar = await stage();
+    } catch (err) {
+      progress(
+        `WARNING: could not stage ${kind} config (${err instanceof Error ? err.message.split("\n")[0] : String(err)}) \u2014 continuing without it`
+      );
+      return;
+    }
+    for (const w of tar.warnings) progress(w);
+    if (tar.tarballPath) stagings.push({ kind, tar, dest });
+    else await tar.cleanup();
+  };
+  try {
+    await stageOne(
+      "claude",
+      () => stageClaudeStaticForUpload(hostWorkspace ? { hostWorkspace } : {}),
+      `${BOX_HOME}/.claude`
+    );
+    const codexShadow = shadowCodexHome(homedir5());
+    try {
+      await stageOne(
+        "codex",
+        () => codexShadow ? stageCodexStaticForUpload({ hostHome: codexShadow.home }) : stageCodexStaticForUpload(),
+        `${BOX_HOME}/.codex`
+      );
+    } finally {
+      codexShadow?.cleanup();
+    }
+    await stageOne(
+      "opencode",
+      () => stageOpencodeStaticForUpload(),
+      `${BOX_HOME}/.local/share/opencode`
+    );
+    if (stagings.length === 0) {
+      progress("no host agent config to bake (boxes will start unconfigured)");
+      return;
+    }
+    for (const st of stagings) {
+      const remote = `/tmp/agentbox-${st.kind}-static.tar.gz`;
+      progress(`baking ${st.kind} static config`);
+      try {
+        await tenkiBackend.uploadFile(handle, st.tar.tarballPath, remote);
+        const extract = [
+          "set -euo pipefail",
+          `mkdir -p "${st.dest}"`,
+          `tar -xzf "${remote}" -C "${st.dest}" --no-same-permissions --no-same-owner -m`,
+          `rm -f "${remote}"`
+        ].join("\n");
+        const r = await tenkiBackend.exec(handle, extract, { attemptTimeoutMs: 3e5 });
+        if (r.exitCode !== 0) {
+          progress(
+            `WARNING: ${st.kind} static config did not extract (exit ${String(r.exitCode)}) \u2014 continuing`
+          );
+        }
+      } catch (err) {
+        progress(
+          `WARNING: ${st.kind} static config failed to bake (${err instanceof Error ? err.message.split("\n")[0] : String(err)}) \u2014 continuing`
+        );
+      }
+    }
+  } finally {
+    for (const st of stagings) await st.tar.cleanup();
+  }
+}
+async function snapshotExists(snapshotId) {
+  try {
+    const snap = await getTenkiClient().getSnapshot(snapshotId);
+    return snap.state === void 0 || snap.state === "READY";
+  } catch {
+    return false;
+  }
+}
+function snapshotLabel() {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").replace("T", "_").replace("Z", "");
+  return `agentbox-base-${stamp}`.toLowerCase();
+}
+async function prepareTenki(opts = {}) {
+  await ensureTenkiCredentials();
+  resolveAuthToken();
+  const client = getTenkiClient();
+  const log2 = opts.onLog ?? (() => {
+  });
+  const progress = (s) => log2(`prepare-tenki: ${s}`);
+  const existing = readPreparedState();
+  if (!opts.force && existing.base) {
+    if (await snapshotExists(existing.base.snapshotId)) {
+      progress(
+        `base snapshot ${existing.base.snapshotId} already prepared; skipping (pass --force to rebake)`
+      );
+      return { snapshotName: existing.base.snapshotId };
+    }
+    progress(
+      `recorded base snapshot ${existing.base.snapshotId} no longer exists in this workspace; re-baking`
+    );
+  }
+  const assets = PREPARE_ASSETS.map((asset) => ({
+    ...asset,
+    localPath: resolveSharedRuntimeAsset(asset.shared)
+  }));
+  const baseImage = opts.baseImage ?? process.env.AGENTBOX_TENKI_BASE_IMAGE;
+  const workspaceId = opts.workspaceId ?? process.env.AGENTBOX_TENKI_WORKSPACE_ID;
+  progress("booting builder sandbox");
+  const builder = await client.create({
+    name: "agentbox-prepare",
+    ...baseImage ? { image: baseImage } : {},
+    ...workspaceId ? { workspaceId } : {},
+    cpuCores: opts.cpuCount ?? BUILDER_CPU,
+    memoryMb: opts.memoryMB ?? BUILDER_MEMORY_MB,
+    diskSizeGb: opts.diskSizeGB ?? BUILDER_DISK_GB,
+    maxDurationMs: BUILDER_MAX_DURATION_MS,
+    allowOutbound: true,
+    // The builder serves no traffic; it only needs egress for apt and npm.
+    allowInbound: false,
+    waitReady: true,
+    waitTimeoutMs: BUILDER_READY_TIMEOUT_MS,
+    // Marker so `list`/prune can tell an in-flight bake from a real box.
+    metadata: { agentbox: "true", "agentbox.role": "prepare" }
+  });
+  const handle = { sandboxId: builder.id };
+  progress(`builder ${builder.id} ready`);
+  try {
+    progress(`uploading ${String(assets.length)} runtime assets`);
+    for (const asset of assets) {
+      await tenkiBackend.uploadFile(handle, asset.localPath, stagedAssetPath(asset.shared));
+    }
+    const plan = buildInstallPlan();
+    for (const [index, step] of plan.entries()) {
+      progress(`[${String(index + 1)}/${String(plan.length)}] ${step.name}`);
+      const result = await tenkiBackend.exec(handle, step.command, {
+        ...step.root ? { user: "root" } : {},
+        ...step.timeoutMs ? { attemptTimeoutMs: step.timeoutMs } : {}
+      });
+      if (result.exitCode !== 0) {
+        const detail = (result.stderr || result.stdout || "").trim().split("\n").slice(-12).join("\n");
+        throw new UserFacingError4(
+          `tenki prepare: step '${step.name}' failed (exit ${String(result.exitCode)})` + (detail ? `:
+${detail}` : "")
+        );
+      }
+    }
+    await bakeAgentStaticConfig(handle, opts.hostWorkspace, progress);
+    progress("snapshotting the builder (this takes a minute)");
+    const label = snapshotLabel();
+    const snapshot = await client.createSnapshotAndWait(builder.id, { name: label });
+    const cliStamp = readCliStamp();
+    writePreparedState({
+      schema: 2,
+      base: {
+        snapshotId: snapshot.id,
+        snapshotName: label,
+        cliVersion: cliStamp.cliVersion,
+        cliCommit: cliStamp.cliCommit,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    });
+    progress(`wrote ${preparedStatePath()}`);
+    progress(`prepare complete \u2014 base snapshot ${snapshot.id}`);
+    return { snapshotName: snapshot.id };
+  } finally {
+    try {
+      const session = await client.get(builder.id);
+      await session.close();
+      progress(`builder ${builder.id} destroyed`);
+    } catch (err) {
+      progress(
+        `WARNING: could not destroy builder ${builder.id} \u2014 terminate it manually: ` + (err instanceof Error ? err.message : String(err))
+      );
+    }
+  }
+}
+var prepareTenkiProvider = (req) => prepareTenki({
+  name: req.name,
+  hostWorkspace: req.hostWorkspace ?? process.cwd(),
+  force: req.force,
+  // `--size` sizes the BOX at create time (the backend applies cpu/memory/disk
+  // per session), so it deliberately does not size the builder here.
+  onLog: req.onLog
+});
+
+// src/provider-module.ts
+import {
+  errSummary
+} from "@madarco/agentbox-provider-sdk";
+function readCredStatusSummary() {
+  const cred = readTenkiCredStatus();
+  return { configured: cred.auth !== "none", label: cred.auth };
+}
+async function doctorChecks() {
+  try {
+    const cred = readTenkiCredStatus();
+    const credRes = cred.auth === "none" ? {
+      label: "credentials",
+      status: "warn",
+      detail: "not configured",
+      // No `tenki login` command exists for a plugin provider: point at
+      // the two places the token is actually read from. An interactive
+      // `create` also prompts for it.
+      hint: `set TENKI_AUTH_TOKEN in the environment or in ${secretsPath()}`
+    } : {
+      label: "credentials",
+      status: "ok",
+      detail: `${cred.token ? maskKey(cred.token) : "token"} (${cred.source})`
+    };
+    const prepared = readPreparedState();
+    const baseRes = prepared.base?.snapshotId ? {
+      label: "base image",
+      status: "ok",
+      // Snapshot ids are long opaque UUIDs; show a short prefix plus the CLI
+      // version that baked it, which is what actually tells you if it's stale.
+      detail: `${prepared.base.snapshotId.slice(0, 18)}\u2026 (${prepared.base.cliVersion ?? "\u2014"})`
+    } : {
+      label: "base image",
+      status: "warn",
+      detail: "not prepared",
+      hint: "`agentbox prepare --provider tenki`"
+    };
+    return [credRes, baseRes];
+  } catch (err) {
+    return [{ label: "credentials", status: "warn", detail: errSummary(err) }];
+  }
+}
+
+// src/index.ts
+var PROVIDER_NAME = "tenki";
+var BACKEND_NAME = PROVIDER_NAME;
+var cloudProvider = createCloudProvider(tenkiBackend, {
+  defaultResources: { cpu: 2, memory: 4, disk: 8 },
+  launchDockerd: true
+});
+function envTimeoutMs() {
+  const raw = process.env.AGENTBOX_TENKI_TIMEOUT_MS?.trim();
+  if (!raw) return void 0;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : void 0;
+}
+function createTenkiBox(req) {
+  const requested = req.providerOptions?.["timeoutMs"];
+  const timeoutMs = typeof requested === "number" && requested > 0 ? requested : envTimeoutMs() ?? DEFAULT_MAX_DURATION_MS;
+  return cloudProvider.create({
+    ...req,
+    providerOptions: { ...req.providerOptions, timeoutMs }
+  });
+}
+async function createTenkiSnapshot(sessionId, name) {
+  return withTenkiRetry(
+    { method: "createSnapshot", retryOnAmbiguous: false, attemptTimeoutMs: 9e5, backoffMs: [] },
+    async () => {
+      const snap = await getTenkiClient().createSnapshotAndWait(sessionId, { name });
+      return snap.id;
+    }
+  );
+}
+async function deleteTenkiSnapshot(snapshotId) {
+  await withTenkiRetry({ method: "deleteSnapshot", retryOnAmbiguous: true }, async () => {
+    try {
+      await getTenkiClient().deleteSnapshot(snapshotId);
+    } catch (err) {
+      const name = err instanceof Error ? err.name : "";
+      const msg = err instanceof Error ? err.message : String(err);
+      if (name === "SnapshotNotFoundError" || /not.?found|404/i.test(msg)) return;
+      throw err;
+    }
+  });
+}
+function snapshotLabel2(boxName, checkpointName) {
+  const sanitize = (s) => s.toLowerCase().replace(/[^a-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "");
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").replace("T", "_").replace("Z", "");
+  return `agentbox-${sanitize(boxName)}-${sanitize(checkpointName)}-${sanitize(ts)}`;
+}
+var tenkiCheckpoint = {
+  async create(box, name) {
+    if (!box.projectRoot) {
+      throw new Error(
+        "cloud checkpoint requires the box to have a project root (run `agentbox checkpoint` from inside the project)"
+      );
+    }
+    if (!box.cloud?.sandboxId) {
+      throw new Error(`tenki box ${box.name} has no sandboxId \u2014 record is malformed`);
+    }
+    const label = snapshotLabel2(box.name, name);
+    const snapshotId = await createTenkiSnapshot(box.cloud.sandboxId, label);
+    const info = await writeCloudCheckpointManifest(box.projectRoot, BACKEND_NAME, name, {
+      snapshotName: snapshotId,
+      sourceBoxId: box.id,
+      sourceBoxName: box.name,
+      baseProvider: BACKEND_NAME,
+      baseFingerprint: currentCloudBaseFingerprint(BACKEND_NAME),
+      cliVersion: readCliStamp2().cliVersion
+    });
+    return { ref: info.name };
+  },
+  async list(projectRoot) {
+    const entries = await listCloudCheckpoints(projectRoot, BACKEND_NAME);
+    return entries.map((e) => ({ ref: e.name, createdAt: e.manifest.createdAt }));
+  },
+  async remove(projectRoot, ref) {
+    const entry = await resolveCloudCheckpoint(projectRoot, BACKEND_NAME, ref);
+    if (!entry) return;
+    await deleteTenkiSnapshot(entry.manifest.snapshotName);
+    await removeCloudCheckpointDir(projectRoot, BACKEND_NAME, ref);
+  }
+};
+var tenkiProvider = {
+  ...cloudProvider,
+  create: createTenkiBox,
+  prepare: prepareTenkiProvider,
+  buildAttach: buildTenkiAttach,
+  checkpoint: tenkiCheckpoint,
+  baseFingerprint: () => currentTenkiBaseFingerprintLive()
+};
+var providerModule = {
+  provider: tenkiProvider,
+  backend: tenkiBackend,
+  ensureCredentials: ensureTenkiCredentials,
+  readCredStatus: readCredStatusSummary,
+  setCredentials: (fields) => Promise.resolve(setTenkiCredentials(fields)),
+  currentBaseFingerprintLive: () => currentTenkiBaseFingerprintLive(),
+  doctorChecks
+};
+export {
+  PREPARE_ASSETS,
+  PROVIDER_NAME,
+  SDK_API_VERSION,
+  buildInstallPlan,
+  buildTenkiAttach,
+  currentTenkiBaseFingerprintLive,
+  ensureTenkiBaseImage,
+  ensureTenkiCredentials,
+  ensureTenkiEnvLoaded,
+  maskKey,
+  prepareTenki,
+  prepareTenkiProvider,
+  preparedStatePath,
+  providerModule,
+  readPreparedState,
+  readTenkiCredStatus,
+  reloadTenkiEnv,
+  secretsPath,
+  setTenkiCredentials,
+  shadowCodexHome,
+  stagedAssetPath,
+  tenkiBackend,
+  tenkiProvider,
+  updatePreparedState,
+  writePreparedState
+};
+//# sourceMappingURL=index.js.map