@madarco/agentbox 0.7.0 → 0.8.0

package/dist/{dist-QZGJIBT5.js → dist-ZODPD2I6.js}

@@ -20,7 +20,7 @@ import {
 } from "./chunk-I24B6AXR.js";
 import {
   createCloudProvider
-} from "./chunk-NW5NYTQM.js";
+} from "./chunk-67N47KUS.js";
 import {
   stageClaudeCredentialsForUpload,
   stageClaudeStaticForUpload,
@@ -28,33 +28,35 @@ import {
   stageCodexStaticForUpload,
   stageOpencodeCredentialsForUpload,
   stageOpencodeStaticForUpload
-} from "./chunk-NAVL4R34.js";
-import "./chunk-UK72UQ5U.js";
+} from "./chunk-6OZDFNBF.js";
+import {
+  computeContextSha256,
+  preparedStatePathFor,
+  readCliStamp,
+  readPreparedStateRaw,
+  writePreparedStateRaw
+} from "./chunk-BGK32PZE.js";
+import "./chunk-G3H2L3O2.js";
 
 // ../../packages/sandbox-hetzner/dist/index.js
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { rm as rm2, rename, mkdir as mkdir3 } from "fs/promises";
 import { join as join4 } from "path";
 import { execa as execa4 } from "execa";
 import { resolve as resolvePath } from "path";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, resolve } from "path";
-import { readFile as readFile2 } from "fs/promises";
 import { join as join2 } from "path";
-import { createHash } from "crypto";
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
+import { existsSync } from "fs";
+import { dirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { mkdir, readFile } from "fs/promises";
-import { dirname as dirname3, join, resolve as resolve3 } from "path";
+import { dirname as dirname2, join, resolve as resolve2 } from "path";
 import { execa } from "execa";
 import { execa as execa2 } from "execa";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { mkdir as mkdir2, rm } from "fs/promises";
 import { createServer } from "net";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join3, resolve as resolve4 } from "path";
+import { homedir } from "os";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
 import { execa as execa3 } from "execa";
 function generatePrepareCloudInit(opts) {
   const pubkey = opts.sshPubkey.trim();
@@ -145,51 +147,58 @@ async function pollUntil(label, check, opts = {}) {
     interval = Math.min(interval * 2, max);
   }
 }
-var SCHEMA = 1;
+var SCHEMA = 2;
 function preparedStatePath() {
-  return resolve(homedir(), ".agentbox", "hetzner-prepared.json");
+  return preparedStatePathFor("hetzner");
 }
 function readPreparedState() {
-  const path = preparedStatePath();
-  if (!existsSync(path)) return { schema: SCHEMA, projects: {} };
-  try {
-    const raw = readFileSync(path, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.schema !== SCHEMA) {
-      return { schema: SCHEMA, projects: {} };
-    }
-    return {
-      schema: SCHEMA,
-      base: parsed.base,
-      projects: parsed.projects ?? {}
-    };
-  } catch {
+  const raw = readPreparedStateRaw("hetzner");
+  if (raw === null || typeof raw !== "object") return { schema: SCHEMA, projects: {} };
+  const parsed = raw;
+  if (parsed.schema === 1) {
+    const v1 = parsed;
+    return migrateFromV1(v1);
+  }
+  if (parsed.schema !== SCHEMA) {
     return { schema: SCHEMA, projects: {} };
   }
+  return {
+    schema: SCHEMA,
+    base: parsed.base,
+    projects: parsed.projects ?? {}
+  };
+}
+function migrateFromV1(v1) {
+  const base = v1.base ? {
+    imageId: v1.base.imageId,
+    description: v1.base.description,
+    createdAt: v1.base.createdAt,
+    contextSha256: v1.base.installScriptSha256
+  } : void 0;
+  return {
+    schema: SCHEMA,
+    base,
+    projects: v1.projects ?? {}
+  };
 }
 function writePreparedState(state) {
-  const path = preparedStatePath();
-  mkdirSync(dirname(path), { recursive: true });
-  const body = JSON.stringify(state, null, 2) + "\n";
-  const tmp = `${path}.tmp`;
-  writeFileSync(tmp, body, { mode: 384 });
-  renameSync(tmp, path);
+  writePreparedStateRaw("hetzner", state);
 }
 function updatePreparedState(mutate) {
   const s = readPreparedState();
   mutate(s);
   writePreparedState(s);
 }
-var SELF = dirname2(fileURLToPath(import.meta.url));
+var SELF = dirname(fileURLToPath(import.meta.url));
 function findStagedCliRuntimeRoot() {
   const candidates = [
-    resolve2(SELF, "..", "runtime"),
+    resolve(SELF, "..", "runtime"),
     // <cliRoot>/dist/.. → <cliRoot> then /runtime
-    resolve2(SELF, "..", "..", "runtime")
+    resolve(SELF, "..", "..", "runtime")
     // chunk-NNNN.js at <cliRoot>/dist/<sub>/.. → <cliRoot>/runtime
   ];
   for (const c of candidates) {
-    if (existsSync2(resolve2(c, "hetzner", "scripts", "install-box.sh"))) return c;
+    if (existsSync(resolve(c, "hetzner", "scripts", "install-box.sh"))) return c;
   }
   return void 0;
 }
@@ -200,6 +209,8 @@ var RUNTIME_ASSETS = [
   { name: "agentbox-dockerd-start", remoteBasename: "agentbox-dockerd-start", remoteMode: 493 },
   { name: "agentbox-checkpoint-cleanup", remoteBasename: "agentbox-checkpoint-cleanup", remoteMode: 493 },
   { name: "agentbox-open", remoteBasename: "agentbox-open", remoteMode: 493 },
+  { name: "gh-shim", remoteBasename: "agentbox-gh-shim", remoteMode: 493 },
+  { name: "git-shim", remoteBasename: "agentbox-git-shim", remoteMode: 493 },
   { name: "custom-system-CLAUDE.md", remoteBasename: "agentbox-custom-CLAUDE.md", remoteMode: 420 },
   { name: "claude-managed-settings.json", remoteBasename: "agentbox-managed-settings.json", remoteMode: 420 },
   { name: "agentbox-codex-hooks.json", remoteBasename: "agentbox-codex-hooks.json", remoteMode: 420 },
@@ -215,7 +226,9 @@ function candidatesFor(name, opts = {}) {
     "agentbox-dockerd-start": ["packages/sandbox-docker/scripts/agentbox-dockerd-start"],
     "agentbox-checkpoint-cleanup": ["packages/sandbox-docker/scripts/agentbox-checkpoint-cleanup"],
     "agentbox-open": ["packages/sandbox-docker/scripts/agentbox-open"],
-    "custom-system-CLAUDE.md": ["packages/sandbox-docker/scripts/custom-system-CLAUDE.md"],
+    "gh-shim": ["packages/sandbox-docker/scripts/gh-shim"],
+    "git-shim": ["packages/sandbox-docker/scripts/git-shim"],
+    "custom-system-CLAUDE.md": ["packages/sandbox-hetzner/scripts/custom-system-CLAUDE.md"],
     "claude-managed-settings.json": ["packages/sandbox-docker/scripts/claude-managed-settings.json"],
     "agentbox-codex-hooks.json": ["packages/sandbox-docker/scripts/agentbox-codex-hooks.json"],
     "agentbox-setup-skill.md": ["apps/cli/share/agentbox-setup/SKILL.md"]
@@ -227,16 +240,18 @@ function candidatesFor(name, opts = {}) {
     "agentbox-dockerd-start": ["hetzner/agentbox-dockerd-start", "docker/packages/sandbox-docker/scripts/agentbox-dockerd-start"],
     "agentbox-checkpoint-cleanup": ["hetzner/agentbox-checkpoint-cleanup", "docker/packages/sandbox-docker/scripts/agentbox-checkpoint-cleanup"],
     "agentbox-open": ["hetzner/agentbox-open", "docker/packages/sandbox-docker/scripts/agentbox-open"],
-    "custom-system-CLAUDE.md": ["hetzner/custom-system-CLAUDE.md", "docker/packages/sandbox-docker/scripts/custom-system-CLAUDE.md"],
+    "gh-shim": ["hetzner/gh-shim", "docker/packages/sandbox-docker/scripts/gh-shim"],
+    "git-shim": ["hetzner/git-shim", "docker/packages/sandbox-docker/scripts/git-shim"],
+    "custom-system-CLAUDE.md": ["hetzner/custom-system-CLAUDE.md"],
     "claude-managed-settings.json": ["hetzner/claude-managed-settings.json", "docker/packages/sandbox-docker/scripts/claude-managed-settings.json"],
     "agentbox-codex-hooks.json": ["hetzner/agentbox-codex-hooks.json", "docker/packages/sandbox-docker/scripts/agentbox-codex-hooks.json"],
     "agentbox-setup-skill.md": ["hetzner/agentbox-setup-skill.md", "docker/apps/cli/share/agentbox-setup/SKILL.md"]
   };
   const out = [];
   if (cliRoot) {
-    for (const rel of cliRelative[name] ?? []) out.push(resolve2(cliRoot, rel));
+    for (const rel of cliRelative[name] ?? []) out.push(resolve(cliRoot, rel));
   }
-  for (const rel of monorepoRelative[name] ?? []) out.push(resolve2(monorepo, rel));
+  for (const rel of monorepoRelative[name] ?? []) out.push(resolve(monorepo, rel));
   return out;
 }
 function resolveRuntimeAssets(opts = {}) {
@@ -244,7 +259,7 @@ function resolveRuntimeAssets(opts = {}) {
   const missing = [];
   for (const asset of RUNTIME_ASSETS) {
     const cands = candidatesFor(asset.name, opts);
-    const hit = cands.find((p) => existsSync2(p));
+    const hit = cands.find((p) => existsSync(p));
     if (!hit) {
       missing.push({ name: asset.name, tried: cands });
       continue;
@@ -265,15 +280,15 @@ If you are running from the monorepo, ensure \`pnpm -w build\` has run so packag
 function guessRepoRoot() {
   let cur = SELF;
   for (let i = 0; i < 8; i++) {
-    if (existsSync2(resolve2(cur, "pnpm-workspace.yaml"))) return cur;
-    const parent = dirname2(cur);
+    if (existsSync(resolve(cur, "pnpm-workspace.yaml"))) return cur;
+    const parent = dirname(cur);
     if (parent === cur) break;
     cur = parent;
   }
   return SELF;
 }
 async function mintSshKey(targetDir, comment) {
-  const dir = resolve3(targetDir);
+  const dir = resolve2(targetDir);
   const priv = join(dir, "id_ed25519");
   const pub = `${priv}.pub`;
   await mkdir(dir, { recursive: true, mode: 448 });
@@ -286,14 +301,14 @@ async function mintSshKey(targetDir, comment) {
   return { dir, privatePath: priv, publicPath: pub, publicKey };
 }
 async function mintPrepareKey() {
-  const root = resolve3(homedirOrCwd(), ".agentbox", "hetzner", `prepare-${Date.now().toString(36)}`);
+  const root = resolve2(homedirOrCwd(), ".agentbox", "hetzner", `prepare-${Date.now().toString(36)}`);
   const key = await mintSshKey(root, `agentbox-prepare-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
   return {
     ...key,
     cleanup: async () => {
       try {
         const { rm: rm3 } = await import("fs/promises");
-        await rm3(dirname3(key.privatePath), { recursive: true, force: true });
+        await rm3(dirname2(key.privatePath), { recursive: true, force: true });
       } catch {
       }
     }
@@ -421,16 +436,14 @@ async function prepareHetzner(opts = {}) {
     cliRuntimeRoot: opts.cliRuntimeRoot ?? findStagedCliRuntimeRoot(),
     repoRoot: opts.repoRoot
   });
-  const installAsset = assets.find((a) => a.name === "install-box.sh");
-  if (!installAsset) {
-    throw new Error("prepare: missing install-box.sh asset (this should have been caught earlier)");
-  }
-  const installSha = await sha256OfFile(installAsset.localPath);
+  const contextSha = await computeContextSha256(
+    assets.map((a) => ({ rel: a.name, abs: a.localPath }))
+  );
   if (!opts.force && existingState.base) {
     const remote = await client2.getImage(existingState.base.imageId).catch(() => null);
-    if (remote && existingState.base.installScriptSha256 === installSha) {
+    if (remote && existingState.base.contextSha256 === contextSha) {
       progress(
-        `base snapshot ${String(existingState.base.imageId)} already exists (sha matches); skipping rebuild (pass --force to override)`
+        `base snapshot ${String(existingState.base.imageId)} already exists (fingerprint ${contextSha.slice(0, 12)} matches); skipping rebuild (pass --force to override)`
       );
       return {
         snapshotName: existingState.base.description,
@@ -440,7 +453,9 @@ async function prepareHetzner(opts = {}) {
     if (!remote) {
       progress(`recorded base snapshot ${String(existingState.base.imageId)} is gone on Hetzner; rebuilding`);
     } else {
-      progress(`install script changed; rebuilding base snapshot`);
+      progress(
+        `build context changed (was ${existingState.base.contextSha256?.slice(0, 12) ?? "<none>"}, now ${contextSha.slice(0, 12)}); rebuilding base snapshot`
+      );
     }
   }
   progress("minting ephemeral ssh key");
@@ -566,11 +581,14 @@ The full trace was preserved at /var/log/agentbox/install.log inside any box mad
     );
     progress("persisting hetzner-prepared.json");
     const state = readPreparedState();
+    const cliStamp = readCliStamp();
     state.base = {
       imageId: ready.id,
       description: ready.description,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      installScriptSha256: installSha
+      contextSha256: contextSha,
+      cliVersion: cliStamp.cliVersion,
+      cliCommit: cliStamp.cliCommit
     };
     writePreparedState(state);
     log(`prepare-hetzner: wrote ${preparedStatePath()}`);
@@ -608,10 +626,6 @@ The full trace was preserved at /var/log/agentbox/install.log inside any box mad
     await key.cleanup();
   }
 }
-async function sha256OfFile(path) {
-  const buf = await readFile2(path);
-  return createHash("sha256").update(buf).digest("hex");
-}
 var prepareHetznerProvider = (req) => prepareHetzner({
   name: req.name,
   hostWorkspace: req.hostWorkspace ?? process.cwd(),
@@ -649,11 +663,11 @@ var SshTunnelManager = class {
       boxSshDir,
       forwards: /* @__PURE__ */ new Map()
     };
-    if (existsSync3(controlPath) && await this.isAlive(controlPath)) {
+    if (existsSync2(controlPath) && await this.isAlive(controlPath)) {
       this.boxes.set(opts.boxId, tunnel);
       return;
     }
-    if (existsSync3(controlPath)) {
+    if (existsSync2(controlPath)) {
       await rm(controlPath, { force: true });
     }
     const connectTimeout = opts.connectTimeoutSeconds ?? 10;
@@ -685,7 +699,7 @@ var SshTunnelManager = class {
       `${user}@${opts.vpsHost}`
     ];
     const res = await execa3("ssh", argv, { reject: false });
-    if (res.exitCode !== 0 || !existsSync3(controlPath)) {
+    if (res.exitCode !== 0 || !existsSync2(controlPath)) {
       throw new Error(
         `ssh ControlMaster failed for ${opts.boxId} (exit ${String(res.exitCode)}): ${res.stderr || res.stdout || "(no output)"}`
       );
@@ -695,11 +709,22 @@ var SshTunnelManager = class {
   /**
    * Mint (or fetch the cached) `127.0.0.1:<localPort> → vps:127.0.0.1:<remotePort>`
    * forward. Returns the local port. Idempotent per (boxId, remotePort).
+   *
+   * The cached entry is only returned when the underlying ControlMaster is
+   * still alive — without that check we'd happily hand back a localPort that
+   * stopped listening when the master died (e.g. transient network blip,
+   * host sleep/wake). When the master is dead we drop ALL cached forwards
+   * for this box (they all share one tunnel) and re-mint from scratch.
    */
   async forward(boxId, remotePort) {
     const tunnel = this.getTunnelOrThrow(boxId);
     const cached = tunnel.forwards.get(remotePort);
-    if (cached !== void 0) return cached;
+    if (cached !== void 0 && await this.isAlive(tunnel.controlPath)) {
+      return cached;
+    }
+    if (cached !== void 0) {
+      tunnel.forwards.clear();
+    }
     const localPort = await pickFreePort();
     const argv = [
       "-O",
@@ -720,6 +745,37 @@ var SshTunnelManager = class {
     tunnel.forwards.set(remotePort, localPort);
     return localPort;
   }
+  /**
+   * Tear down a dead ControlMaster + every cached forward for this box,
+   * then re-open from scratch. Idempotent — if the master is already alive
+   * the master open() is a no-op, but the cached forwards still get
+   * cleared so the next forward() call re-mints them. Returns when the
+   * master is open and the box's forwards map is empty (ready for fresh
+   * forward() calls).
+   *
+   * Use case: the cloud-poller observes ECONNREFUSED on the local port and
+   * asks the backend to refresh the preview URL — that path calls into
+   * here so the master + forward both come back fresh.
+   */
+  async refresh(opts) {
+    const existing = this.boxes.get(opts.boxId);
+    if (existing) {
+      const alive = await this.isAlive(existing.controlPath);
+      if (!alive && existsSync2(existing.controlPath)) {
+        try {
+          await execa3(
+            "ssh",
+            ["-O", "exit", "-S", existing.controlPath, "dummy"],
+            { reject: false }
+          );
+        } catch {
+        }
+        await rm(existing.controlPath, { force: true });
+      }
+      existing.forwards.clear();
+    }
+    await this.open(opts);
+  }
   /** Tear down a single forward. Idempotent — unknown ports are no-ops. */
   async unforward(boxId, remotePort) {
     const tunnel = this.getTunnelOrThrow(boxId);
@@ -744,7 +800,7 @@ var SshTunnelManager = class {
   async close(boxId) {
     const tunnel = this.boxes.get(boxId);
     if (!tunnel) return;
-    if (existsSync3(tunnel.controlPath)) {
+    if (existsSync2(tunnel.controlPath)) {
       await execa3("ssh", ["-O", "exit", "-S", tunnel.controlPath, "dummy"], { reject: false });
       await rm(tunnel.controlPath, { force: true });
     }
@@ -790,7 +846,7 @@ var SshTunnelManager = class {
   }
 };
 function defaultBoxSshDir(boxId) {
-  return resolve4(homedir2(), ".agentbox", "boxes", boxId, "ssh");
+  return resolve3(homedir(), ".agentbox", "boxes", boxId, "ssh");
 }
 async function pickFreePort() {
   return new Promise((resolveOk, reject) => {
@@ -922,7 +978,7 @@ async function ensureLiveTarget(sandboxId) {
     throw new Error(`hetzner: server ${String(id)} has no IPv4 address`);
   }
   const state = await ensurePerBoxState(sandboxId);
-  if (!existsSync4(state.identity)) {
+  if (!existsSync3(state.identity)) {
     throw new Error(
       `hetzner: per-box SSH key missing for sandbox ${sandboxId} (expected at ${state.identity}). If this box was created by a different host, you'll need to re-create it on this host.`
     );
@@ -1038,10 +1094,10 @@ var hetznerBackend = {
         }
       }
       try {
-        if (existsSync4(key.dir)) await rm2(key.dir, { recursive: true, force: true });
+        if (existsSync3(key.dir)) await rm2(key.dir, { recursive: true, force: true });
         if (serverId !== null) {
           const finalDir = perBoxDir(String(serverId));
-          if (existsSync4(finalDir)) await rm2(finalDir, { recursive: true, force: true });
+          if (existsSync3(finalDir)) await rm2(finalDir, { recursive: true, force: true });
         }
       } catch {
       }
@@ -1195,6 +1251,18 @@ var hetznerBackend = {
     void _ttl;
     return this.previewUrl(h, port);
   },
+  async refreshPreviewUrl(h, port) {
+    const { state, vpsIp } = await ensureLiveTarget(h.sandboxId);
+    void state;
+    void vpsIp;
+    await tunnels.refresh({
+      boxId: h.sandboxId,
+      vpsHost: vpsIp,
+      identity: state.identity
+    });
+    const localPort = await tunnels.forward(h.sandboxId, port);
+    return { url: `http://127.0.0.1:${String(localPort)}` };
+  },
   async startInBoxPortless(h, opts) {
     const tlsFlag = opts.tls ? "" : "--no-tls";
     const startCmd = `sudo portless proxy start ${tlsFlag} -p ${String(opts.proxyPort)}`.replace(/\s+/g, " ");
@@ -1336,4 +1404,4 @@ export {
   withHetznerRetry,
   writePreparedState
 };
-//# sourceMappingURL=dist-QZGJIBT5.js.map
+//# sourceMappingURL=dist-ZODPD2I6.js.map