@mastra/cloudflare-sandbox 0.3.0-alpha.1 → 0.3.1-alpha.0

package/dist/index.cjs

@@ -158,16 +158,31 @@ function safeJsonParse(value) {
 const DEFAULT_COMMAND_TIMEOUT_MS = 3e5;
 const WORKSPACE_ROOT = "/workspace";
 /**
+* Absolute path to the shell used to interpret bare command strings. Absolute so it
+* resolves even when a custom PATH excludes the standard system directories.
+*/
+const SHELL_PATH = "/bin/bash";
+/**
 * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to
 * every element, so no local escaping is needed. Environment variables are applied
 * with `env`, which keeps each assignment a separate argv element.
+*
+* When no separate arguments are supplied (the shape the built-in Workspace
+* `execute_command` tool uses), `command` is a shell command string — pipes,
+* chaining, quoting, redirection — so it is run through a non-login shell rather
+* than treated as a single executable name. When explicit arguments are given,
+* each element stays a literal argv token.
 */
 function buildArgv(command, args, env) {
 	const assignments = Object.entries(env).map(([key, value]) => {
 		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);
 		return `${key}=${value}`;
 	});
-	const invocation = [command, ...args ?? []];
+	const invocation = args && args.length > 0 ? [command, ...args] : [
+		SHELL_PATH,
+		"-c",
+		command
+	];
 	return assignments.length ? [
 		"env",
 		...assignments,

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["posix","path","MastraSandbox"],"sources":["../src/bridge-client.ts","../src/sandbox.ts"],"sourcesContent":["export interface CloudflareSandboxBridgeClientOptions {\n  baseUrl: string;\n  apiToken?: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */\nexport type CloudflareCommandEvent =\n  | { type: 'stdout'; data: Uint8Array }\n  | { type: 'stderr'; data: Uint8Array }\n  | { type: 'exit'; exitCode: number }\n  | { type: 'error'; message: string; code?: string };\n\nexport interface CloudflareExecRequest {\n  /** Command and arguments. The bridge applies ANSI-C quoting to each element. */\n  argv: string[];\n  timeoutMs?: number;\n  cwd?: string;\n}\n\nexport class CloudflareSandboxBridgeError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string) {\n    super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || 'empty response'}`);\n    this.name = 'CloudflareSandboxBridgeError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nfunction stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\n/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */\nfunction encodeFilePath(absolutePath: string): string {\n  let start = 0;\n  while (start < absolutePath.length && absolutePath[start] === '/') start++;\n  return absolutePath\n    .slice(start)\n    .split('/')\n    .map(segment => encodeURIComponent(segment))\n    .join('/');\n}\n\n/**\n * Client for the Cloudflare Sandbox Bridge Worker.\n *\n * @see https://developers.cloudflare.com/sandbox/bridge/http-api/\n */\nexport class CloudflareSandboxBridgeClient {\n  readonly baseUrl: string;\n  private readonly apiToken?: string;\n  private readonly fetchImpl: typeof globalThis.fetch;\n\n  constructor(options: CloudflareSandboxBridgeClientOptions) {\n    this.baseUrl = stripTrailingSlashes(options.baseUrl);\n    this.apiToken = options.apiToken;\n    this.fetchImpl = options.fetch ?? globalThis.fetch;\n  }\n\n  /** `POST /v1/sandbox` */\n  async createSandbox(): Promise<string> {\n    const created = await this.request<{ id: string }>('/v1/sandbox', { method: 'POST' });\n    return created.id;\n  }\n\n  /** `GET /v1/sandbox/:id/running` */\n  async isRunning(id: string): Promise<boolean> {\n    const status = await this.request<{ running: boolean }>(`/v1/sandbox/${encodeURIComponent(id)}/running`, {});\n    return status.running === true;\n  }\n\n  /** `DELETE /v1/sandbox/:id` */\n  async deleteSandbox(id: string): Promise<void> {\n    await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: 'DELETE' }, true);\n  }\n\n  /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */\n  async writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void> {\n    await this.request(\n      `/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`,\n      {\n        method: 'PUT',\n        body: content as RequestInit['body'],\n        headers: { 'content-type': 'application/octet-stream' },\n      },\n      true,\n    );\n  }\n\n  /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */\n  async exec(\n    id: string,\n    request: CloudflareExecRequest,\n    options: {\n      signal?: AbortSignal;\n      onEvent: (event: CloudflareCommandEvent) => void;\n    },\n  ): Promise<void> {\n    const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {\n      method: 'POST',\n      headers: { ...this.headers(), 'content-type': 'application/json', accept: 'text/event-stream' },\n      body: JSON.stringify({\n        argv: request.argv,\n        ...(request.timeoutMs === undefined ? {} : { timeout_ms: request.timeoutMs }),\n        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n      }),\n      signal: options.signal,\n    });\n\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (!response.body) {\n      throw new Error('Cloudflare Sandbox Bridge returned an empty command stream');\n    }\n\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let buffer = '';\n\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += decoder.decode(value, { stream: !done }).replace(/\\r\\n/g, '\\n');\n      let boundary = buffer.indexOf('\\n\\n');\n      while (boundary !== -1) {\n        this.emitBlock(buffer.slice(0, boundary), options.onEvent);\n        buffer = buffer.slice(boundary + 2);\n        boundary = buffer.indexOf('\\n\\n');\n      }\n      if (done) break;\n    }\n    if (buffer.trim()) this.emitBlock(buffer, options.onEvent);\n  }\n\n  private emitBlock(block: string, onEvent: (event: CloudflareCommandEvent) => void): void {\n    let eventName: string | undefined;\n    const dataLines: string[] = [];\n    for (const line of block.split('\\n')) {\n      if (line.startsWith('event:')) eventName = line.slice(6).trim();\n      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));\n    }\n    const data = dataLines.join('\\n');\n    if (!eventName || !data) return;\n\n    switch (eventName) {\n      case 'stdout':\n      case 'stderr':\n        onEvent({ type: eventName, data: base64ToBytes(data) });\n        return;\n      case 'exit': {\n        const parsed = safeJsonParse(data);\n        onEvent({ type: 'exit', exitCode: typeof parsed?.exit_code === 'number' ? parsed.exit_code : 0 });\n        return;\n      }\n      case 'error': {\n        const parsed = safeJsonParse(data);\n        onEvent({\n          type: 'error',\n          message: typeof parsed?.error === 'string' ? parsed.error : data,\n          code: typeof parsed?.code === 'string' ? parsed.code : undefined,\n        });\n        return;\n      }\n      default:\n        return;\n    }\n  }\n\n  private headers(): Record<string, string> {\n    return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};\n  }\n\n  private async request<T>(path: string, init: RequestInit, allowEmpty = false): Promise<T> {\n    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: { ...this.headers(), ...init.headers },\n    });\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (allowEmpty || response.status === 204) return undefined as T;\n    return response.json() as Promise<T>;\n  }\n}\n\nfunction base64ToBytes(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64'));\n}\n\nfunction safeJsonParse(value: string): Record<string, unknown> | undefined {\n  try {\n    return JSON.parse(value) as Record<string, unknown>;\n  } catch {\n    return undefined;\n  }\n}\n","import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\nimport type {\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  SandboxFileInput,\n  SandboxInfo,\n} from '@mastra/core/workspace';\nimport { MastraSandbox } from '@mastra/core/workspace';\nimport { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client';\n\nconst DEFAULT_COMMAND_TIMEOUT_MS = 300_000;\nconst WORKSPACE_ROOT = '/workspace';\n\ntype InstructionsOption = string | ((options: { defaultInstructions: string }) => string);\ntype BridgeClient = Pick<\n  CloudflareSandboxBridgeClient,\n  'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'\n>;\n\nexport interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** URL of a deployed Cloudflare Sandbox Bridge Worker. */\n  baseUrl: string;\n  /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */\n  apiToken?: string;\n  /** Stable Mastra identifier for this sandbox instance. */\n  id?: string;\n  /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */\n  sandboxId?: string;\n  /** Human-readable name shown in Mastra sandbox metadata. */\n  name?: string;\n  /** Environment variables applied to every command. */\n  env?: Record<string, string>;\n  /** Working directory applied to every command. Must be under /workspace. */\n  workingDirectory?: string;\n  /** Default command timeout in milliseconds. */\n  commandTimeout?: number;\n  /** Custom instructions returned by getInstructions(). */\n  instructions?: InstructionsOption;\n  /** Custom fetch implementation, primarily for advanced networking setup and tests. */\n  fetch?: CloudflareSandboxBridgeClientOptions['fetch'];\n  /** Preconfigured Bridge client, primarily for tests. */\n  client?: BridgeClient;\n}\n\n/**\n * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to\n * every element, so no local escaping is needed. Environment variables are applied\n * with `env`, which keeps each assignment a separate argv element.\n */\nfunction buildArgv(command: string, args: string[] | undefined, env: Record<string, string>): string[] {\n  const assignments = Object.entries(env).map(([key, value]) => {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);\n    return `${key}=${value}`;\n  });\n  const invocation = [command, ...(args ?? [])];\n  return assignments.length ? ['env', ...assignments, ...invocation] : invocation;\n}\n\n/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */\nfunction resolveWorkspacePath(path: string): string {\n  const resolved = posix.resolve(WORKSPACE_ROOT, path);\n  if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) {\n    throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);\n  }\n  return resolved;\n}\n\nexport class CloudflareSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name: string;\n  readonly provider = 'cloudflare-sandbox';\n  status: ProviderStatus = 'pending';\n\n  private readonly client: BridgeClient;\n  private readonly commandTimeout: number;\n  private readonly instructions?: InstructionsOption;\n  private sandboxId?: string;\n  private createdAt = new Date();\n  private lastUsedAt?: Date;\n\n  constructor(options: CloudflareSandboxOptions) {\n    const name = options.name ?? 'Cloudflare Sandbox';\n    super({ ...options, name });\n    this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;\n    this.name = name;\n    this.sandboxId = options.sandboxId;\n    this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;\n    this.instructions = options.instructions;\n    this.client =\n      options.client ??\n      new CloudflareSandboxBridgeClient({ baseUrl: options.baseUrl, apiToken: options.apiToken, fetch: options.fetch });\n  }\n\n  async start(): Promise<void> {\n    if (this.sandboxId) {\n      // The bridge boots the container on demand, so a stopped container is not fatal.\n      const running = await this.client.isRunning(this.sandboxId);\n      if (!running) {\n        this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);\n      }\n      return;\n    }\n    this.sandboxId = await this.client.createSandbox();\n    this.createdAt = new Date();\n  }\n\n  async stop(): Promise<void> {\n    // The bridge exposes create/delete but no suspend operation. Stop detaches this\n    // Mastra lifecycle while preserving the remote sandbox for later reconnection.\n  }\n\n  async destroy(): Promise<void> {\n    if (!this.sandboxId) return;\n    await this.client.deleteSandbox(this.sandboxId);\n    this.sandboxId = undefined;\n  }\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    const sandboxId = this.requireSandboxId();\n\n    const startedAt = Date.now();\n    const timeout = options?.timeout ?? this.commandTimeout;\n    if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError('Command timeout must be positive');\n\n    const controller = new AbortController();\n    let didTimeout = false;\n    const timer = setTimeout(() => {\n      didTimeout = true;\n      controller.abort();\n    }, timeout);\n    const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;\n\n    // stdout and stderr are separate byte streams, so each needs its own streaming decoder.\n    const stdoutDecoder = new TextDecoder();\n    const stderrDecoder = new TextDecoder();\n    let stdout = '';\n    let stderr = '';\n    let exitCode = 1;\n\n    const env = Object.fromEntries(\n      Object.entries({ ...this.getEnv(), ...options?.env }).filter(\n        (entry): entry is [string, string] => entry[1] !== undefined,\n      ),\n    );\n\n    try {\n      await this.client.exec(\n        sandboxId,\n        {\n          argv: buildArgv(command, args, env),\n          timeoutMs: timeout,\n          cwd: options?.cwd ?? this.workingDirectory,\n        },\n        {\n          signal,\n          onEvent: event => {\n            switch (event.type) {\n              case 'stdout': {\n                const chunk = stdoutDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stdout += chunk;\n                options?.onStdout?.(chunk);\n                return;\n              }\n              case 'stderr': {\n                const chunk = stderrDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stderr += chunk;\n                options?.onStderr?.(chunk);\n                return;\n              }\n              case 'exit':\n                exitCode = event.exitCode;\n                return;\n              case 'error':\n                stderr += event.message;\n                options?.onStderr?.(event.message);\n                return;\n            }\n          },\n        },\n      );\n    } catch (error) {\n      if (!signal.aborted) throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    // Flush each decoder so a trailing truncated multi-byte sequence isn't dropped.\n    const stdoutTail = stdoutDecoder.decode();\n    if (stdoutTail) {\n      stdout += stdoutTail;\n      options?.onStdout?.(stdoutTail);\n    }\n    const stderrTail = stderrDecoder.decode();\n    if (stderrTail) {\n      stderr += stderrTail;\n      options?.onStderr?.(stderrTail);\n    }\n\n    this.lastUsedAt = new Date();\n    return {\n      command,\n      args,\n      success: exitCode === 0 && !signal.aborted,\n      exitCode,\n      stdout,\n      stderr,\n      executionTimeMs: Date.now() - startedAt,\n      timedOut: didTimeout,\n      killed: signal.aborted && !didTimeout,\n    };\n  }\n\n  async writeFiles(files: SandboxFileInput[]): Promise<void> {\n    const sandboxId = this.requireSandboxId();\n    // The bridge writes one file per request.\n    for (const file of files) {\n      await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);\n    }\n    this.lastUsedAt = new Date();\n  }\n\n  getInfo(): SandboxInfo {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this.createdAt,\n      lastUsedAt: this.lastUsedAt,\n      metadata: {\n        sandboxId: this.sandboxId,\n        bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : undefined,\n      },\n    };\n  }\n\n  getInstructions(): string {\n    const defaultInstructions =\n      'Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.';\n    return typeof this.instructions === 'function'\n      ? this.instructions({ defaultInstructions })\n      : (this.instructions ?? defaultInstructions);\n  }\n\n  private requireSandboxId(): string {\n    if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);\n    return this.sandboxId;\n  }\n}\n"],"mappings":";;;;;AAoBA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CACA;CAEA,YAAY,QAAgB,MAAc;EACxC,MAAM,6CAA6C,OAAO,KAAK,QAAQ,kBAAkB;EACzF,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qBAAqB,KAAqB;CACjD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;;AAGA,SAAS,eAAe,cAA8B;CACpD,IAAI,QAAQ;CACZ,OAAO,QAAQ,aAAa,UAAU,aAAa,WAAW,KAAK;CACnE,OAAO,aACJ,MAAM,KAAK,CAAC,CACZ,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,mBAAmB,OAAO,CAAC,CAAC,CAC3C,KAAK,GAAG;AACb;;;;;;AAOA,IAAa,gCAAb,MAA2C;CACzC;CACA;CACA;CAEA,YAAY,SAA+C;EACzD,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,KAAK,WAAW,QAAQ;EACxB,KAAK,YAAY,QAAQ,SAAS,WAAW;CAC/C;;CAGA,MAAM,gBAAiC;EAErC,QAAO,MADe,KAAK,QAAwB,eAAe,EAAE,QAAQ,OAAO,CAAC,EAAA,CACrE;CACjB;;CAGA,MAAM,UAAU,IAA8B;EAE5C,QAAO,MADc,KAAK,QAA8B,eAAe,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAA,CAC7F,YAAY;CAC5B;;CAGA,MAAM,cAAc,IAA2B;EAC7C,MAAM,KAAK,QAAQ,eAAe,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,IAAI;CACxF;;CAGA,MAAM,UAAU,IAAY,cAAsB,SAA6C;EAC7F,MAAM,KAAK,QACT,eAAe,mBAAmB,EAAE,EAAE,QAAQ,eAAe,YAAY,KACzE;GACE,QAAQ;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB,2BAA2B;EACxD,GACA,IACF;CACF;;CAGA,MAAM,KACJ,IACA,SACA,SAIe;EACf,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,cAAc,mBAAmB,EAAE,EAAE,QAAQ;GACjG,QAAQ;GACR,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,gBAAgB;IAAoB,QAAQ;GAAoB;GAC9F,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,UAAU;IAC3E,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;GAC1D,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,SAAS,SAAS,KAAK,UAAU;EACvC,MAAM,UAAU,IAAI,YAAY;EAChC,IAAI,SAAS;EAEb,OAAO,MAAM;GACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,UAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,IAAI;GACxE,IAAI,WAAW,OAAO,QAAQ,MAAM;GACpC,OAAO,aAAa,IAAI;IACtB,KAAK,UAAU,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,OAAO;IACzD,SAAS,OAAO,MAAM,WAAW,CAAC;IAClC,WAAW,OAAO,QAAQ,MAAM;GAClC;GACA,IAAI,MAAM;EACZ;EACA,IAAI,OAAO,KAAK,GAAG,KAAK,UAAU,QAAQ,QAAQ,OAAO;CAC3D;CAEA,UAAkB,OAAe,SAAwD;EACvF,IAAI;EACJ,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,GACjC,IAAI,KAAK,WAAW,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;OACzD,IAAI,KAAK,WAAW,OAAO,GAAG,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;EAEnF,MAAM,OAAO,UAAU,KAAK,IAAI;EAChC,IAAI,CAAC,aAAa,CAAC,MAAM;EAEzB,QAAQ,WAAR;GACE,KAAK;GACL,KAAK;IACH,QAAQ;KAAE,MAAM;KAAW,MAAM,cAAc,IAAI;IAAE,CAAC;IACtD;GACF,KAAK,QAAQ;IACX,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KAAE,MAAM;KAAQ,UAAU,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY;IAAE,CAAC;IAChG;GACF;GACA,KAAK,SAAS;IACZ,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KACN,MAAM;KACN,SAAS,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;KAC5D,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,KAAA;IACzD,CAAC;IACD;GACF;GACA,SACE;EACJ;CACF;CAEA,UAA0C;EACxC,OAAO,KAAK,WAAW,EAAE,eAAe,UAAU,KAAK,WAAW,IAAI,CAAC;CACzE;CAEA,MAAc,QAAW,MAAc,MAAmB,aAAa,OAAmB;EACxF,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAC9D,GAAG;GACH,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,GAAG,KAAK;GAAQ;EAChD,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,cAAc,SAAS,WAAW,KAAK,OAAO,KAAA;EAClD,OAAO,SAAS,KAAK;CACvB;AACF;AAEA,SAAS,cAAc,OAA2B;CAChD,OAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAEA,SAAS,cAAc,OAAoD;CACzE,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN;CACF;AACF;;;AC5LA,MAAM,6BAA6B;AACnC,MAAM,iBAAiB;;;;;;AAsCvB,SAAS,UAAU,SAAiB,MAA4B,KAAuC;CACrG,MAAM,cAAc,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,sCAAsC,KAAK;EACtG,OAAO,GAAG,IAAI,GAAG;CACnB,CAAC;CACD,MAAM,aAAa,CAAC,SAAS,GAAI,QAAQ,CAAC,CAAE;CAC5C,OAAO,YAAY,SAAS;EAAC;EAAO,GAAG;EAAa,GAAG;CAAU,IAAI;AACvE;;AAGA,SAAS,qBAAqB,QAAsB;CAClD,MAAM,WAAWA,KAAAA,MAAM,QAAQ,gBAAgBC,MAAI;CACnD,IAAI,aAAa,kBAAkB,CAAC,SAAS,WAAW,GAAG,eAAe,EAAE,GAC1E,MAAM,IAAI,MAAM,kDAAkD,eAAe,IAAIA,QAAM;CAE7F,OAAO;AACT;AAEA,IAAa,oBAAb,cAAuCC,uBAAAA,cAAc;CACnD;CACA;CACA,WAAoB;CACpB,SAAyB;CAEzB;CACA;CACA;CACA;CACA,4BAAoB,IAAI,KAAK;CAC7B;CAEA,YAAY,SAAmC;EAC7C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM;GAAE,GAAG;GAAS;EAAK,CAAC;EAC1B,KAAK,KAAK,QAAQ,MAAM,uBAAA,GAAA,OAAA,WAAA,CAAiC;EACzD,KAAK,OAAO;EACZ,KAAK,YAAY,QAAQ;EACzB,KAAK,iBAAiB,QAAQ,kBAAkB;EAChD,KAAK,eAAe,QAAQ;EAC5B,KAAK,SACH,QAAQ,UACR,IAAI,8BAA8B;GAAE,SAAS,QAAQ;GAAS,UAAU,QAAQ;GAAU,OAAO,QAAQ;EAAM,CAAC;CACpH;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAK,WAAW;GAGlB,IAAI,CAAC,MADiB,KAAK,OAAO,UAAU,KAAK,SAAS,GAExD,KAAK,QAAQ,MAAM,sBAAsB,KAAK,UAAU,4CAA4C;GAEtG;EACF;EACA,KAAK,YAAY,MAAM,KAAK,OAAO,cAAc;EACjD,KAAK,4BAAY,IAAI,KAAK;CAC5B;CAEA,MAAM,OAAsB,CAG5B;CAEA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW;EACrB,MAAM,KAAK,OAAO,cAAc,KAAK,SAAS;EAC9C,KAAK,YAAY,KAAA;CACnB;CAEA,MAAM,eAAe,SAAiB,MAAiB,SAAyD;EAC9G,MAAM,YAAY,KAAK,iBAAiB;EAExC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,kCAAkC;EAEtG,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,MAAM;EACnB,GAAG,OAAO;EACV,MAAM,SAAS,SAAS,cAAc,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,WAAW,CAAC,IAAI,WAAW;EAG7G,MAAM,gBAAgB,IAAI,YAAY;EACtC,MAAM,gBAAgB,IAAI,YAAY;EACtC,IAAI,SAAS;EACb,IAAI,SAAS;EACb,IAAI,WAAW;EAEf,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ;GAAE,GAAG,KAAK,OAAO;GAAG,GAAG,SAAS;EAAI,CAAC,CAAC,CAAC,QACnD,UAAqC,MAAM,OAAO,KAAA,CACrD,CACF;EAEA,IAAI;GACF,MAAM,KAAK,OAAO,KAChB,WACA;IACE,MAAM,UAAU,SAAS,MAAM,GAAG;IAClC,WAAW;IACX,KAAK,SAAS,OAAO,KAAK;GAC5B,GACA;IACE;IACA,UAAS,UAAS;KAChB,QAAQ,MAAM,MAAd;MACE,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK;OACH,WAAW,MAAM;OACjB;MACF,KAAK;OACH,UAAU,MAAM;OAChB,SAAS,WAAW,MAAM,OAAO;OACjC;KACJ;IACF;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,CAAC,OAAO,SAAS,MAAM;EAC7B,UAAU;GACR,aAAa,KAAK;EACpB;EAGA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EACA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EAEA,KAAK,6BAAa,IAAI,KAAK;EAC3B,OAAO;GACL;GACA;GACA,SAAS,aAAa,KAAK,CAAC,OAAO;GACnC;GACA;GACA;GACA,iBAAiB,KAAK,IAAI,IAAI;GAC9B,UAAU;GACV,QAAQ,OAAO,WAAW,CAAC;EAC7B;CACF;CAEA,MAAM,WAAW,OAA0C;EACzD,MAAM,YAAY,KAAK,iBAAiB;EAExC,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,OAAO,UAAU,WAAW,qBAAqB,KAAK,IAAI,GAAG,KAAK,OAAO;EAEtF,KAAK,6BAAa,IAAI,KAAK;CAC7B;CAEA,UAAuB;EACrB,OAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,YAAY,KAAK;GACjB,UAAU;IACR,WAAW,KAAK;IAChB,eAAe,KAAK,kBAAkB,gCAAgC,KAAK,OAAO,UAAU,KAAA;GAC9F;EACF;CACF;CAEA,kBAA0B;EACxB,MAAM,sBACJ;EACF,OAAO,OAAO,KAAK,iBAAiB,aAChC,KAAK,aAAa,EAAE,oBAAoB,CAAC,IACxC,KAAK,gBAAgB;CAC5B;CAEA,mBAAmC;EACjC,IAAI,CAAC,KAAK,WAAW,MAAM,IAAI,MAAM,sBAAsB,KAAK,GAAG,sBAAsB;EACzF,OAAO,KAAK;CACd;AACF"}
+{"version":3,"file":"index.cjs","names":["posix","path","MastraSandbox"],"sources":["../src/bridge-client.ts","../src/sandbox.ts"],"sourcesContent":["export interface CloudflareSandboxBridgeClientOptions {\n  baseUrl: string;\n  apiToken?: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */\nexport type CloudflareCommandEvent =\n  | { type: 'stdout'; data: Uint8Array }\n  | { type: 'stderr'; data: Uint8Array }\n  | { type: 'exit'; exitCode: number }\n  | { type: 'error'; message: string; code?: string };\n\nexport interface CloudflareExecRequest {\n  /** Command and arguments. The bridge applies ANSI-C quoting to each element. */\n  argv: string[];\n  timeoutMs?: number;\n  cwd?: string;\n}\n\nexport class CloudflareSandboxBridgeError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string) {\n    super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || 'empty response'}`);\n    this.name = 'CloudflareSandboxBridgeError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nfunction stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\n/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */\nfunction encodeFilePath(absolutePath: string): string {\n  let start = 0;\n  while (start < absolutePath.length && absolutePath[start] === '/') start++;\n  return absolutePath\n    .slice(start)\n    .split('/')\n    .map(segment => encodeURIComponent(segment))\n    .join('/');\n}\n\n/**\n * Client for the Cloudflare Sandbox Bridge Worker.\n *\n * @see https://developers.cloudflare.com/sandbox/bridge/http-api/\n */\nexport class CloudflareSandboxBridgeClient {\n  readonly baseUrl: string;\n  private readonly apiToken?: string;\n  private readonly fetchImpl: typeof globalThis.fetch;\n\n  constructor(options: CloudflareSandboxBridgeClientOptions) {\n    this.baseUrl = stripTrailingSlashes(options.baseUrl);\n    this.apiToken = options.apiToken;\n    this.fetchImpl = options.fetch ?? globalThis.fetch;\n  }\n\n  /** `POST /v1/sandbox` */\n  async createSandbox(): Promise<string> {\n    const created = await this.request<{ id: string }>('/v1/sandbox', { method: 'POST' });\n    return created.id;\n  }\n\n  /** `GET /v1/sandbox/:id/running` */\n  async isRunning(id: string): Promise<boolean> {\n    const status = await this.request<{ running: boolean }>(`/v1/sandbox/${encodeURIComponent(id)}/running`, {});\n    return status.running === true;\n  }\n\n  /** `DELETE /v1/sandbox/:id` */\n  async deleteSandbox(id: string): Promise<void> {\n    await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: 'DELETE' }, true);\n  }\n\n  /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */\n  async writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void> {\n    await this.request(\n      `/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`,\n      {\n        method: 'PUT',\n        body: content as RequestInit['body'],\n        headers: { 'content-type': 'application/octet-stream' },\n      },\n      true,\n    );\n  }\n\n  /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */\n  async exec(\n    id: string,\n    request: CloudflareExecRequest,\n    options: {\n      signal?: AbortSignal;\n      onEvent: (event: CloudflareCommandEvent) => void;\n    },\n  ): Promise<void> {\n    const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {\n      method: 'POST',\n      headers: { ...this.headers(), 'content-type': 'application/json', accept: 'text/event-stream' },\n      body: JSON.stringify({\n        argv: request.argv,\n        ...(request.timeoutMs === undefined ? {} : { timeout_ms: request.timeoutMs }),\n        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n      }),\n      signal: options.signal,\n    });\n\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (!response.body) {\n      throw new Error('Cloudflare Sandbox Bridge returned an empty command stream');\n    }\n\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let buffer = '';\n\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += decoder.decode(value, { stream: !done }).replace(/\\r\\n/g, '\\n');\n      let boundary = buffer.indexOf('\\n\\n');\n      while (boundary !== -1) {\n        this.emitBlock(buffer.slice(0, boundary), options.onEvent);\n        buffer = buffer.slice(boundary + 2);\n        boundary = buffer.indexOf('\\n\\n');\n      }\n      if (done) break;\n    }\n    if (buffer.trim()) this.emitBlock(buffer, options.onEvent);\n  }\n\n  private emitBlock(block: string, onEvent: (event: CloudflareCommandEvent) => void): void {\n    let eventName: string | undefined;\n    const dataLines: string[] = [];\n    for (const line of block.split('\\n')) {\n      if (line.startsWith('event:')) eventName = line.slice(6).trim();\n      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));\n    }\n    const data = dataLines.join('\\n');\n    if (!eventName || !data) return;\n\n    switch (eventName) {\n      case 'stdout':\n      case 'stderr':\n        onEvent({ type: eventName, data: base64ToBytes(data) });\n        return;\n      case 'exit': {\n        const parsed = safeJsonParse(data);\n        onEvent({ type: 'exit', exitCode: typeof parsed?.exit_code === 'number' ? parsed.exit_code : 0 });\n        return;\n      }\n      case 'error': {\n        const parsed = safeJsonParse(data);\n        onEvent({\n          type: 'error',\n          message: typeof parsed?.error === 'string' ? parsed.error : data,\n          code: typeof parsed?.code === 'string' ? parsed.code : undefined,\n        });\n        return;\n      }\n      default:\n        return;\n    }\n  }\n\n  private headers(): Record<string, string> {\n    return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};\n  }\n\n  private async request<T>(path: string, init: RequestInit, allowEmpty = false): Promise<T> {\n    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: { ...this.headers(), ...init.headers },\n    });\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (allowEmpty || response.status === 204) return undefined as T;\n    return response.json() as Promise<T>;\n  }\n}\n\nfunction base64ToBytes(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64'));\n}\n\nfunction safeJsonParse(value: string): Record<string, unknown> | undefined {\n  try {\n    return JSON.parse(value) as Record<string, unknown>;\n  } catch {\n    return undefined;\n  }\n}\n","import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\nimport type {\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  SandboxFileInput,\n  SandboxInfo,\n} from '@mastra/core/workspace';\nimport { MastraSandbox } from '@mastra/core/workspace';\nimport { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client';\n\nconst DEFAULT_COMMAND_TIMEOUT_MS = 300_000;\nconst WORKSPACE_ROOT = '/workspace';\n\ntype InstructionsOption = string | ((options: { defaultInstructions: string }) => string);\ntype BridgeClient = Pick<\n  CloudflareSandboxBridgeClient,\n  'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'\n>;\n\nexport interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** URL of a deployed Cloudflare Sandbox Bridge Worker. */\n  baseUrl: string;\n  /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */\n  apiToken?: string;\n  /** Stable Mastra identifier for this sandbox instance. */\n  id?: string;\n  /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */\n  sandboxId?: string;\n  /** Human-readable name shown in Mastra sandbox metadata. */\n  name?: string;\n  /** Environment variables applied to every command. */\n  env?: Record<string, string>;\n  /** Working directory applied to every command. Must be under /workspace. */\n  workingDirectory?: string;\n  /** Default command timeout in milliseconds. */\n  commandTimeout?: number;\n  /** Custom instructions returned by getInstructions(). */\n  instructions?: InstructionsOption;\n  /** Custom fetch implementation, primarily for advanced networking setup and tests. */\n  fetch?: CloudflareSandboxBridgeClientOptions['fetch'];\n  /** Preconfigured Bridge client, primarily for tests. */\n  client?: BridgeClient;\n}\n\n/**\n * Absolute path to the shell used to interpret bare command strings. Absolute so it\n * resolves even when a custom PATH excludes the standard system directories.\n */\nconst SHELL_PATH = '/bin/bash';\n\n/**\n * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to\n * every element, so no local escaping is needed. Environment variables are applied\n * with `env`, which keeps each assignment a separate argv element.\n *\n * When no separate arguments are supplied (the shape the built-in Workspace\n * `execute_command` tool uses), `command` is a shell command string — pipes,\n * chaining, quoting, redirection — so it is run through a non-login shell rather\n * than treated as a single executable name. When explicit arguments are given,\n * each element stays a literal argv token.\n */\nfunction buildArgv(command: string, args: string[] | undefined, env: Record<string, string>): string[] {\n  const assignments = Object.entries(env).map(([key, value]) => {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);\n    return `${key}=${value}`;\n  });\n  const invocation = args && args.length > 0 ? [command, ...args] : [SHELL_PATH, '-c', command];\n  return assignments.length ? ['env', ...assignments, ...invocation] : invocation;\n}\n\n/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */\nfunction resolveWorkspacePath(path: string): string {\n  const resolved = posix.resolve(WORKSPACE_ROOT, path);\n  if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) {\n    throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);\n  }\n  return resolved;\n}\n\nexport class CloudflareSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name: string;\n  readonly provider = 'cloudflare-sandbox';\n  status: ProviderStatus = 'pending';\n\n  private readonly client: BridgeClient;\n  private readonly commandTimeout: number;\n  private readonly instructions?: InstructionsOption;\n  private sandboxId?: string;\n  private createdAt = new Date();\n  private lastUsedAt?: Date;\n\n  constructor(options: CloudflareSandboxOptions) {\n    const name = options.name ?? 'Cloudflare Sandbox';\n    super({ ...options, name });\n    this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;\n    this.name = name;\n    this.sandboxId = options.sandboxId;\n    this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;\n    this.instructions = options.instructions;\n    this.client =\n      options.client ??\n      new CloudflareSandboxBridgeClient({ baseUrl: options.baseUrl, apiToken: options.apiToken, fetch: options.fetch });\n  }\n\n  async start(): Promise<void> {\n    if (this.sandboxId) {\n      // The bridge boots the container on demand, so a stopped container is not fatal.\n      const running = await this.client.isRunning(this.sandboxId);\n      if (!running) {\n        this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);\n      }\n      return;\n    }\n    this.sandboxId = await this.client.createSandbox();\n    this.createdAt = new Date();\n  }\n\n  async stop(): Promise<void> {\n    // The bridge exposes create/delete but no suspend operation. Stop detaches this\n    // Mastra lifecycle while preserving the remote sandbox for later reconnection.\n  }\n\n  async destroy(): Promise<void> {\n    if (!this.sandboxId) return;\n    await this.client.deleteSandbox(this.sandboxId);\n    this.sandboxId = undefined;\n  }\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    const sandboxId = this.requireSandboxId();\n\n    const startedAt = Date.now();\n    const timeout = options?.timeout ?? this.commandTimeout;\n    if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError('Command timeout must be positive');\n\n    const controller = new AbortController();\n    let didTimeout = false;\n    const timer = setTimeout(() => {\n      didTimeout = true;\n      controller.abort();\n    }, timeout);\n    const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;\n\n    // stdout and stderr are separate byte streams, so each needs its own streaming decoder.\n    const stdoutDecoder = new TextDecoder();\n    const stderrDecoder = new TextDecoder();\n    let stdout = '';\n    let stderr = '';\n    let exitCode = 1;\n\n    const env = Object.fromEntries(\n      Object.entries({ ...this.getEnv(), ...options?.env }).filter(\n        (entry): entry is [string, string] => entry[1] !== undefined,\n      ),\n    );\n\n    try {\n      await this.client.exec(\n        sandboxId,\n        {\n          argv: buildArgv(command, args, env),\n          timeoutMs: timeout,\n          cwd: options?.cwd ?? this.workingDirectory,\n        },\n        {\n          signal,\n          onEvent: event => {\n            switch (event.type) {\n              case 'stdout': {\n                const chunk = stdoutDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stdout += chunk;\n                options?.onStdout?.(chunk);\n                return;\n              }\n              case 'stderr': {\n                const chunk = stderrDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stderr += chunk;\n                options?.onStderr?.(chunk);\n                return;\n              }\n              case 'exit':\n                exitCode = event.exitCode;\n                return;\n              case 'error':\n                stderr += event.message;\n                options?.onStderr?.(event.message);\n                return;\n            }\n          },\n        },\n      );\n    } catch (error) {\n      if (!signal.aborted) throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    // Flush each decoder so a trailing truncated multi-byte sequence isn't dropped.\n    const stdoutTail = stdoutDecoder.decode();\n    if (stdoutTail) {\n      stdout += stdoutTail;\n      options?.onStdout?.(stdoutTail);\n    }\n    const stderrTail = stderrDecoder.decode();\n    if (stderrTail) {\n      stderr += stderrTail;\n      options?.onStderr?.(stderrTail);\n    }\n\n    this.lastUsedAt = new Date();\n    return {\n      command,\n      args,\n      success: exitCode === 0 && !signal.aborted,\n      exitCode,\n      stdout,\n      stderr,\n      executionTimeMs: Date.now() - startedAt,\n      timedOut: didTimeout,\n      killed: signal.aborted && !didTimeout,\n    };\n  }\n\n  async writeFiles(files: SandboxFileInput[]): Promise<void> {\n    const sandboxId = this.requireSandboxId();\n    // The bridge writes one file per request.\n    for (const file of files) {\n      await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);\n    }\n    this.lastUsedAt = new Date();\n  }\n\n  getInfo(): SandboxInfo {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this.createdAt,\n      lastUsedAt: this.lastUsedAt,\n      metadata: {\n        sandboxId: this.sandboxId,\n        bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : undefined,\n      },\n    };\n  }\n\n  getInstructions(): string {\n    const defaultInstructions =\n      'Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.';\n    return typeof this.instructions === 'function'\n      ? this.instructions({ defaultInstructions })\n      : (this.instructions ?? defaultInstructions);\n  }\n\n  private requireSandboxId(): string {\n    if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);\n    return this.sandboxId;\n  }\n}\n"],"mappings":";;;;;AAoBA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CACA;CAEA,YAAY,QAAgB,MAAc;EACxC,MAAM,6CAA6C,OAAO,KAAK,QAAQ,kBAAkB;EACzF,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qBAAqB,KAAqB;CACjD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;;AAGA,SAAS,eAAe,cAA8B;CACpD,IAAI,QAAQ;CACZ,OAAO,QAAQ,aAAa,UAAU,aAAa,WAAW,KAAK;CACnE,OAAO,aACJ,MAAM,KAAK,CAAC,CACZ,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,mBAAmB,OAAO,CAAC,CAAC,CAC3C,KAAK,GAAG;AACb;;;;;;AAOA,IAAa,gCAAb,MAA2C;CACzC;CACA;CACA;CAEA,YAAY,SAA+C;EACzD,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,KAAK,WAAW,QAAQ;EACxB,KAAK,YAAY,QAAQ,SAAS,WAAW;CAC/C;;CAGA,MAAM,gBAAiC;EAErC,QAAO,MADe,KAAK,QAAwB,eAAe,EAAE,QAAQ,OAAO,CAAC,EAAA,CACrE;CACjB;;CAGA,MAAM,UAAU,IAA8B;EAE5C,QAAO,MADc,KAAK,QAA8B,eAAe,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAA,CAC7F,YAAY;CAC5B;;CAGA,MAAM,cAAc,IAA2B;EAC7C,MAAM,KAAK,QAAQ,eAAe,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,IAAI;CACxF;;CAGA,MAAM,UAAU,IAAY,cAAsB,SAA6C;EAC7F,MAAM,KAAK,QACT,eAAe,mBAAmB,EAAE,EAAE,QAAQ,eAAe,YAAY,KACzE;GACE,QAAQ;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB,2BAA2B;EACxD,GACA,IACF;CACF;;CAGA,MAAM,KACJ,IACA,SACA,SAIe;EACf,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,cAAc,mBAAmB,EAAE,EAAE,QAAQ;GACjG,QAAQ;GACR,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,gBAAgB;IAAoB,QAAQ;GAAoB;GAC9F,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,UAAU;IAC3E,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;GAC1D,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,SAAS,SAAS,KAAK,UAAU;EACvC,MAAM,UAAU,IAAI,YAAY;EAChC,IAAI,SAAS;EAEb,OAAO,MAAM;GACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,UAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,IAAI;GACxE,IAAI,WAAW,OAAO,QAAQ,MAAM;GACpC,OAAO,aAAa,IAAI;IACtB,KAAK,UAAU,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,OAAO;IACzD,SAAS,OAAO,MAAM,WAAW,CAAC;IAClC,WAAW,OAAO,QAAQ,MAAM;GAClC;GACA,IAAI,MAAM;EACZ;EACA,IAAI,OAAO,KAAK,GAAG,KAAK,UAAU,QAAQ,QAAQ,OAAO;CAC3D;CAEA,UAAkB,OAAe,SAAwD;EACvF,IAAI;EACJ,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,GACjC,IAAI,KAAK,WAAW,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;OACzD,IAAI,KAAK,WAAW,OAAO,GAAG,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;EAEnF,MAAM,OAAO,UAAU,KAAK,IAAI;EAChC,IAAI,CAAC,aAAa,CAAC,MAAM;EAEzB,QAAQ,WAAR;GACE,KAAK;GACL,KAAK;IACH,QAAQ;KAAE,MAAM;KAAW,MAAM,cAAc,IAAI;IAAE,CAAC;IACtD;GACF,KAAK,QAAQ;IACX,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KAAE,MAAM;KAAQ,UAAU,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY;IAAE,CAAC;IAChG;GACF;GACA,KAAK,SAAS;IACZ,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KACN,MAAM;KACN,SAAS,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;KAC5D,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,KAAA;IACzD,CAAC;IACD;GACF;GACA,SACE;EACJ;CACF;CAEA,UAA0C;EACxC,OAAO,KAAK,WAAW,EAAE,eAAe,UAAU,KAAK,WAAW,IAAI,CAAC;CACzE;CAEA,MAAc,QAAW,MAAc,MAAmB,aAAa,OAAmB;EACxF,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAC9D,GAAG;GACH,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,GAAG,KAAK;GAAQ;EAChD,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,cAAc,SAAS,WAAW,KAAK,OAAO,KAAA;EAClD,OAAO,SAAS,KAAK;CACvB;AACF;AAEA,SAAS,cAAc,OAA2B;CAChD,OAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAEA,SAAS,cAAc,OAAoD;CACzE,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN;CACF;AACF;;;AC5LA,MAAM,6BAA6B;AACnC,MAAM,iBAAiB;;;;;AAqCvB,MAAM,aAAa;;;;;;;;;;;;AAanB,SAAS,UAAU,SAAiB,MAA4B,KAAuC;CACrG,MAAM,cAAc,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,sCAAsC,KAAK;EACtG,OAAO,GAAG,IAAI,GAAG;CACnB,CAAC;CACD,MAAM,aAAa,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI;EAAC;EAAY;EAAM;CAAO;CAC5F,OAAO,YAAY,SAAS;EAAC;EAAO,GAAG;EAAa,GAAG;CAAU,IAAI;AACvE;;AAGA,SAAS,qBAAqB,QAAsB;CAClD,MAAM,WAAWA,KAAAA,MAAM,QAAQ,gBAAgBC,MAAI;CACnD,IAAI,aAAa,kBAAkB,CAAC,SAAS,WAAW,GAAG,eAAe,EAAE,GAC1E,MAAM,IAAI,MAAM,kDAAkD,eAAe,IAAIA,QAAM;CAE7F,OAAO;AACT;AAEA,IAAa,oBAAb,cAAuCC,uBAAAA,cAAc;CACnD;CACA;CACA,WAAoB;CACpB,SAAyB;CAEzB;CACA;CACA;CACA;CACA,4BAAoB,IAAI,KAAK;CAC7B;CAEA,YAAY,SAAmC;EAC7C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM;GAAE,GAAG;GAAS;EAAK,CAAC;EAC1B,KAAK,KAAK,QAAQ,MAAM,uBAAA,GAAA,OAAA,WAAA,CAAiC;EACzD,KAAK,OAAO;EACZ,KAAK,YAAY,QAAQ;EACzB,KAAK,iBAAiB,QAAQ,kBAAkB;EAChD,KAAK,eAAe,QAAQ;EAC5B,KAAK,SACH,QAAQ,UACR,IAAI,8BAA8B;GAAE,SAAS,QAAQ;GAAS,UAAU,QAAQ;GAAU,OAAO,QAAQ;EAAM,CAAC;CACpH;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAK,WAAW;GAGlB,IAAI,CAAC,MADiB,KAAK,OAAO,UAAU,KAAK,SAAS,GAExD,KAAK,QAAQ,MAAM,sBAAsB,KAAK,UAAU,4CAA4C;GAEtG;EACF;EACA,KAAK,YAAY,MAAM,KAAK,OAAO,cAAc;EACjD,KAAK,4BAAY,IAAI,KAAK;CAC5B;CAEA,MAAM,OAAsB,CAG5B;CAEA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW;EACrB,MAAM,KAAK,OAAO,cAAc,KAAK,SAAS;EAC9C,KAAK,YAAY,KAAA;CACnB;CAEA,MAAM,eAAe,SAAiB,MAAiB,SAAyD;EAC9G,MAAM,YAAY,KAAK,iBAAiB;EAExC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,kCAAkC;EAEtG,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,MAAM;EACnB,GAAG,OAAO;EACV,MAAM,SAAS,SAAS,cAAc,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,WAAW,CAAC,IAAI,WAAW;EAG7G,MAAM,gBAAgB,IAAI,YAAY;EACtC,MAAM,gBAAgB,IAAI,YAAY;EACtC,IAAI,SAAS;EACb,IAAI,SAAS;EACb,IAAI,WAAW;EAEf,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ;GAAE,GAAG,KAAK,OAAO;GAAG,GAAG,SAAS;EAAI,CAAC,CAAC,CAAC,QACnD,UAAqC,MAAM,OAAO,KAAA,CACrD,CACF;EAEA,IAAI;GACF,MAAM,KAAK,OAAO,KAChB,WACA;IACE,MAAM,UAAU,SAAS,MAAM,GAAG;IAClC,WAAW;IACX,KAAK,SAAS,OAAO,KAAK;GAC5B,GACA;IACE;IACA,UAAS,UAAS;KAChB,QAAQ,MAAM,MAAd;MACE,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK;OACH,WAAW,MAAM;OACjB;MACF,KAAK;OACH,UAAU,MAAM;OAChB,SAAS,WAAW,MAAM,OAAO;OACjC;KACJ;IACF;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,CAAC,OAAO,SAAS,MAAM;EAC7B,UAAU;GACR,aAAa,KAAK;EACpB;EAGA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EACA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EAEA,KAAK,6BAAa,IAAI,KAAK;EAC3B,OAAO;GACL;GACA;GACA,SAAS,aAAa,KAAK,CAAC,OAAO;GACnC;GACA;GACA;GACA,iBAAiB,KAAK,IAAI,IAAI;GAC9B,UAAU;GACV,QAAQ,OAAO,WAAW,CAAC;EAC7B;CACF;CAEA,MAAM,WAAW,OAA0C;EACzD,MAAM,YAAY,KAAK,iBAAiB;EAExC,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,OAAO,UAAU,WAAW,qBAAqB,KAAK,IAAI,GAAG,KAAK,OAAO;EAEtF,KAAK,6BAAa,IAAI,KAAK;CAC7B;CAEA,UAAuB;EACrB,OAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,YAAY,KAAK;GACjB,UAAU;IACR,WAAW,KAAK;IAChB,eAAe,KAAK,kBAAkB,gCAAgC,KAAK,OAAO,UAAU,KAAA;GAC9F;EACF;CACF;CAEA,kBAA0B;EACxB,MAAM,sBACJ;EACF,OAAO,OAAO,KAAK,iBAAiB,aAChC,KAAK,aAAa,EAAE,oBAAoB,CAAC,IACxC,KAAK,gBAAgB;CAC5B;CAEA,mBAAmC;EACjC,IAAI,CAAC,KAAK,WAAW,MAAM,IAAI,MAAM,sBAAsB,KAAK,GAAG,sBAAsB;EACzF,OAAO,KAAK;CACd;AACF"}

package/dist/index.js

@@ -157,16 +157,31 @@ function safeJsonParse(value) {
 const DEFAULT_COMMAND_TIMEOUT_MS = 3e5;
 const WORKSPACE_ROOT = "/workspace";
 /**
+* Absolute path to the shell used to interpret bare command strings. Absolute so it
+* resolves even when a custom PATH excludes the standard system directories.
+*/
+const SHELL_PATH = "/bin/bash";
+/**
 * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to
 * every element, so no local escaping is needed. Environment variables are applied
 * with `env`, which keeps each assignment a separate argv element.
+*
+* When no separate arguments are supplied (the shape the built-in Workspace
+* `execute_command` tool uses), `command` is a shell command string — pipes,
+* chaining, quoting, redirection — so it is run through a non-login shell rather
+* than treated as a single executable name. When explicit arguments are given,
+* each element stays a literal argv token.
 */
 function buildArgv(command, args, env) {
 	const assignments = Object.entries(env).map(([key, value]) => {
 		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);
 		return `${key}=${value}`;
 	});
-	const invocation = [command, ...args ?? []];
+	const invocation = args && args.length > 0 ? [command, ...args] : [
+		SHELL_PATH,
+		"-c",
+		command
+	];
 	return assignments.length ? [
 		"env",
 		...assignments,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/bridge-client.ts","../src/sandbox.ts"],"sourcesContent":["export interface CloudflareSandboxBridgeClientOptions {\n  baseUrl: string;\n  apiToken?: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */\nexport type CloudflareCommandEvent =\n  | { type: 'stdout'; data: Uint8Array }\n  | { type: 'stderr'; data: Uint8Array }\n  | { type: 'exit'; exitCode: number }\n  | { type: 'error'; message: string; code?: string };\n\nexport interface CloudflareExecRequest {\n  /** Command and arguments. The bridge applies ANSI-C quoting to each element. */\n  argv: string[];\n  timeoutMs?: number;\n  cwd?: string;\n}\n\nexport class CloudflareSandboxBridgeError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string) {\n    super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || 'empty response'}`);\n    this.name = 'CloudflareSandboxBridgeError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nfunction stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\n/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */\nfunction encodeFilePath(absolutePath: string): string {\n  let start = 0;\n  while (start < absolutePath.length && absolutePath[start] === '/') start++;\n  return absolutePath\n    .slice(start)\n    .split('/')\n    .map(segment => encodeURIComponent(segment))\n    .join('/');\n}\n\n/**\n * Client for the Cloudflare Sandbox Bridge Worker.\n *\n * @see https://developers.cloudflare.com/sandbox/bridge/http-api/\n */\nexport class CloudflareSandboxBridgeClient {\n  readonly baseUrl: string;\n  private readonly apiToken?: string;\n  private readonly fetchImpl: typeof globalThis.fetch;\n\n  constructor(options: CloudflareSandboxBridgeClientOptions) {\n    this.baseUrl = stripTrailingSlashes(options.baseUrl);\n    this.apiToken = options.apiToken;\n    this.fetchImpl = options.fetch ?? globalThis.fetch;\n  }\n\n  /** `POST /v1/sandbox` */\n  async createSandbox(): Promise<string> {\n    const created = await this.request<{ id: string }>('/v1/sandbox', { method: 'POST' });\n    return created.id;\n  }\n\n  /** `GET /v1/sandbox/:id/running` */\n  async isRunning(id: string): Promise<boolean> {\n    const status = await this.request<{ running: boolean }>(`/v1/sandbox/${encodeURIComponent(id)}/running`, {});\n    return status.running === true;\n  }\n\n  /** `DELETE /v1/sandbox/:id` */\n  async deleteSandbox(id: string): Promise<void> {\n    await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: 'DELETE' }, true);\n  }\n\n  /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */\n  async writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void> {\n    await this.request(\n      `/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`,\n      {\n        method: 'PUT',\n        body: content as RequestInit['body'],\n        headers: { 'content-type': 'application/octet-stream' },\n      },\n      true,\n    );\n  }\n\n  /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */\n  async exec(\n    id: string,\n    request: CloudflareExecRequest,\n    options: {\n      signal?: AbortSignal;\n      onEvent: (event: CloudflareCommandEvent) => void;\n    },\n  ): Promise<void> {\n    const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {\n      method: 'POST',\n      headers: { ...this.headers(), 'content-type': 'application/json', accept: 'text/event-stream' },\n      body: JSON.stringify({\n        argv: request.argv,\n        ...(request.timeoutMs === undefined ? {} : { timeout_ms: request.timeoutMs }),\n        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n      }),\n      signal: options.signal,\n    });\n\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (!response.body) {\n      throw new Error('Cloudflare Sandbox Bridge returned an empty command stream');\n    }\n\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let buffer = '';\n\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += decoder.decode(value, { stream: !done }).replace(/\\r\\n/g, '\\n');\n      let boundary = buffer.indexOf('\\n\\n');\n      while (boundary !== -1) {\n        this.emitBlock(buffer.slice(0, boundary), options.onEvent);\n        buffer = buffer.slice(boundary + 2);\n        boundary = buffer.indexOf('\\n\\n');\n      }\n      if (done) break;\n    }\n    if (buffer.trim()) this.emitBlock(buffer, options.onEvent);\n  }\n\n  private emitBlock(block: string, onEvent: (event: CloudflareCommandEvent) => void): void {\n    let eventName: string | undefined;\n    const dataLines: string[] = [];\n    for (const line of block.split('\\n')) {\n      if (line.startsWith('event:')) eventName = line.slice(6).trim();\n      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));\n    }\n    const data = dataLines.join('\\n');\n    if (!eventName || !data) return;\n\n    switch (eventName) {\n      case 'stdout':\n      case 'stderr':\n        onEvent({ type: eventName, data: base64ToBytes(data) });\n        return;\n      case 'exit': {\n        const parsed = safeJsonParse(data);\n        onEvent({ type: 'exit', exitCode: typeof parsed?.exit_code === 'number' ? parsed.exit_code : 0 });\n        return;\n      }\n      case 'error': {\n        const parsed = safeJsonParse(data);\n        onEvent({\n          type: 'error',\n          message: typeof parsed?.error === 'string' ? parsed.error : data,\n          code: typeof parsed?.code === 'string' ? parsed.code : undefined,\n        });\n        return;\n      }\n      default:\n        return;\n    }\n  }\n\n  private headers(): Record<string, string> {\n    return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};\n  }\n\n  private async request<T>(path: string, init: RequestInit, allowEmpty = false): Promise<T> {\n    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: { ...this.headers(), ...init.headers },\n    });\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (allowEmpty || response.status === 204) return undefined as T;\n    return response.json() as Promise<T>;\n  }\n}\n\nfunction base64ToBytes(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64'));\n}\n\nfunction safeJsonParse(value: string): Record<string, unknown> | undefined {\n  try {\n    return JSON.parse(value) as Record<string, unknown>;\n  } catch {\n    return undefined;\n  }\n}\n","import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\nimport type {\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  SandboxFileInput,\n  SandboxInfo,\n} from '@mastra/core/workspace';\nimport { MastraSandbox } from '@mastra/core/workspace';\nimport { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client';\n\nconst DEFAULT_COMMAND_TIMEOUT_MS = 300_000;\nconst WORKSPACE_ROOT = '/workspace';\n\ntype InstructionsOption = string | ((options: { defaultInstructions: string }) => string);\ntype BridgeClient = Pick<\n  CloudflareSandboxBridgeClient,\n  'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'\n>;\n\nexport interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** URL of a deployed Cloudflare Sandbox Bridge Worker. */\n  baseUrl: string;\n  /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */\n  apiToken?: string;\n  /** Stable Mastra identifier for this sandbox instance. */\n  id?: string;\n  /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */\n  sandboxId?: string;\n  /** Human-readable name shown in Mastra sandbox metadata. */\n  name?: string;\n  /** Environment variables applied to every command. */\n  env?: Record<string, string>;\n  /** Working directory applied to every command. Must be under /workspace. */\n  workingDirectory?: string;\n  /** Default command timeout in milliseconds. */\n  commandTimeout?: number;\n  /** Custom instructions returned by getInstructions(). */\n  instructions?: InstructionsOption;\n  /** Custom fetch implementation, primarily for advanced networking setup and tests. */\n  fetch?: CloudflareSandboxBridgeClientOptions['fetch'];\n  /** Preconfigured Bridge client, primarily for tests. */\n  client?: BridgeClient;\n}\n\n/**\n * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to\n * every element, so no local escaping is needed. Environment variables are applied\n * with `env`, which keeps each assignment a separate argv element.\n */\nfunction buildArgv(command: string, args: string[] | undefined, env: Record<string, string>): string[] {\n  const assignments = Object.entries(env).map(([key, value]) => {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);\n    return `${key}=${value}`;\n  });\n  const invocation = [command, ...(args ?? [])];\n  return assignments.length ? ['env', ...assignments, ...invocation] : invocation;\n}\n\n/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */\nfunction resolveWorkspacePath(path: string): string {\n  const resolved = posix.resolve(WORKSPACE_ROOT, path);\n  if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) {\n    throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);\n  }\n  return resolved;\n}\n\nexport class CloudflareSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name: string;\n  readonly provider = 'cloudflare-sandbox';\n  status: ProviderStatus = 'pending';\n\n  private readonly client: BridgeClient;\n  private readonly commandTimeout: number;\n  private readonly instructions?: InstructionsOption;\n  private sandboxId?: string;\n  private createdAt = new Date();\n  private lastUsedAt?: Date;\n\n  constructor(options: CloudflareSandboxOptions) {\n    const name = options.name ?? 'Cloudflare Sandbox';\n    super({ ...options, name });\n    this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;\n    this.name = name;\n    this.sandboxId = options.sandboxId;\n    this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;\n    this.instructions = options.instructions;\n    this.client =\n      options.client ??\n      new CloudflareSandboxBridgeClient({ baseUrl: options.baseUrl, apiToken: options.apiToken, fetch: options.fetch });\n  }\n\n  async start(): Promise<void> {\n    if (this.sandboxId) {\n      // The bridge boots the container on demand, so a stopped container is not fatal.\n      const running = await this.client.isRunning(this.sandboxId);\n      if (!running) {\n        this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);\n      }\n      return;\n    }\n    this.sandboxId = await this.client.createSandbox();\n    this.createdAt = new Date();\n  }\n\n  async stop(): Promise<void> {\n    // The bridge exposes create/delete but no suspend operation. Stop detaches this\n    // Mastra lifecycle while preserving the remote sandbox for later reconnection.\n  }\n\n  async destroy(): Promise<void> {\n    if (!this.sandboxId) return;\n    await this.client.deleteSandbox(this.sandboxId);\n    this.sandboxId = undefined;\n  }\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    const sandboxId = this.requireSandboxId();\n\n    const startedAt = Date.now();\n    const timeout = options?.timeout ?? this.commandTimeout;\n    if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError('Command timeout must be positive');\n\n    const controller = new AbortController();\n    let didTimeout = false;\n    const timer = setTimeout(() => {\n      didTimeout = true;\n      controller.abort();\n    }, timeout);\n    const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;\n\n    // stdout and stderr are separate byte streams, so each needs its own streaming decoder.\n    const stdoutDecoder = new TextDecoder();\n    const stderrDecoder = new TextDecoder();\n    let stdout = '';\n    let stderr = '';\n    let exitCode = 1;\n\n    const env = Object.fromEntries(\n      Object.entries({ ...this.getEnv(), ...options?.env }).filter(\n        (entry): entry is [string, string] => entry[1] !== undefined,\n      ),\n    );\n\n    try {\n      await this.client.exec(\n        sandboxId,\n        {\n          argv: buildArgv(command, args, env),\n          timeoutMs: timeout,\n          cwd: options?.cwd ?? this.workingDirectory,\n        },\n        {\n          signal,\n          onEvent: event => {\n            switch (event.type) {\n              case 'stdout': {\n                const chunk = stdoutDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stdout += chunk;\n                options?.onStdout?.(chunk);\n                return;\n              }\n              case 'stderr': {\n                const chunk = stderrDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stderr += chunk;\n                options?.onStderr?.(chunk);\n                return;\n              }\n              case 'exit':\n                exitCode = event.exitCode;\n                return;\n              case 'error':\n                stderr += event.message;\n                options?.onStderr?.(event.message);\n                return;\n            }\n          },\n        },\n      );\n    } catch (error) {\n      if (!signal.aborted) throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    // Flush each decoder so a trailing truncated multi-byte sequence isn't dropped.\n    const stdoutTail = stdoutDecoder.decode();\n    if (stdoutTail) {\n      stdout += stdoutTail;\n      options?.onStdout?.(stdoutTail);\n    }\n    const stderrTail = stderrDecoder.decode();\n    if (stderrTail) {\n      stderr += stderrTail;\n      options?.onStderr?.(stderrTail);\n    }\n\n    this.lastUsedAt = new Date();\n    return {\n      command,\n      args,\n      success: exitCode === 0 && !signal.aborted,\n      exitCode,\n      stdout,\n      stderr,\n      executionTimeMs: Date.now() - startedAt,\n      timedOut: didTimeout,\n      killed: signal.aborted && !didTimeout,\n    };\n  }\n\n  async writeFiles(files: SandboxFileInput[]): Promise<void> {\n    const sandboxId = this.requireSandboxId();\n    // The bridge writes one file per request.\n    for (const file of files) {\n      await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);\n    }\n    this.lastUsedAt = new Date();\n  }\n\n  getInfo(): SandboxInfo {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this.createdAt,\n      lastUsedAt: this.lastUsedAt,\n      metadata: {\n        sandboxId: this.sandboxId,\n        bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : undefined,\n      },\n    };\n  }\n\n  getInstructions(): string {\n    const defaultInstructions =\n      'Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.';\n    return typeof this.instructions === 'function'\n      ? this.instructions({ defaultInstructions })\n      : (this.instructions ?? defaultInstructions);\n  }\n\n  private requireSandboxId(): string {\n    if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);\n    return this.sandboxId;\n  }\n}\n"],"mappings":";;;;AAoBA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CACA;CAEA,YAAY,QAAgB,MAAc;EACxC,MAAM,6CAA6C,OAAO,KAAK,QAAQ,kBAAkB;EACzF,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qBAAqB,KAAqB;CACjD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;;AAGA,SAAS,eAAe,cAA8B;CACpD,IAAI,QAAQ;CACZ,OAAO,QAAQ,aAAa,UAAU,aAAa,WAAW,KAAK;CACnE,OAAO,aACJ,MAAM,KAAK,CAAC,CACZ,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,mBAAmB,OAAO,CAAC,CAAC,CAC3C,KAAK,GAAG;AACb;;;;;;AAOA,IAAa,gCAAb,MAA2C;CACzC;CACA;CACA;CAEA,YAAY,SAA+C;EACzD,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,KAAK,WAAW,QAAQ;EACxB,KAAK,YAAY,QAAQ,SAAS,WAAW;CAC/C;;CAGA,MAAM,gBAAiC;EAErC,QAAO,MADe,KAAK,QAAwB,eAAe,EAAE,QAAQ,OAAO,CAAC,EAAA,CACrE;CACjB;;CAGA,MAAM,UAAU,IAA8B;EAE5C,QAAO,MADc,KAAK,QAA8B,eAAe,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAA,CAC7F,YAAY;CAC5B;;CAGA,MAAM,cAAc,IAA2B;EAC7C,MAAM,KAAK,QAAQ,eAAe,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,IAAI;CACxF;;CAGA,MAAM,UAAU,IAAY,cAAsB,SAA6C;EAC7F,MAAM,KAAK,QACT,eAAe,mBAAmB,EAAE,EAAE,QAAQ,eAAe,YAAY,KACzE;GACE,QAAQ;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB,2BAA2B;EACxD,GACA,IACF;CACF;;CAGA,MAAM,KACJ,IACA,SACA,SAIe;EACf,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,cAAc,mBAAmB,EAAE,EAAE,QAAQ;GACjG,QAAQ;GACR,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,gBAAgB;IAAoB,QAAQ;GAAoB;GAC9F,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,UAAU;IAC3E,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;GAC1D,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,SAAS,SAAS,KAAK,UAAU;EACvC,MAAM,UAAU,IAAI,YAAY;EAChC,IAAI,SAAS;EAEb,OAAO,MAAM;GACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,UAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,IAAI;GACxE,IAAI,WAAW,OAAO,QAAQ,MAAM;GACpC,OAAO,aAAa,IAAI;IACtB,KAAK,UAAU,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,OAAO;IACzD,SAAS,OAAO,MAAM,WAAW,CAAC;IAClC,WAAW,OAAO,QAAQ,MAAM;GAClC;GACA,IAAI,MAAM;EACZ;EACA,IAAI,OAAO,KAAK,GAAG,KAAK,UAAU,QAAQ,QAAQ,OAAO;CAC3D;CAEA,UAAkB,OAAe,SAAwD;EACvF,IAAI;EACJ,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,GACjC,IAAI,KAAK,WAAW,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;OACzD,IAAI,KAAK,WAAW,OAAO,GAAG,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;EAEnF,MAAM,OAAO,UAAU,KAAK,IAAI;EAChC,IAAI,CAAC,aAAa,CAAC,MAAM;EAEzB,QAAQ,WAAR;GACE,KAAK;GACL,KAAK;IACH,QAAQ;KAAE,MAAM;KAAW,MAAM,cAAc,IAAI;IAAE,CAAC;IACtD;GACF,KAAK,QAAQ;IACX,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KAAE,MAAM;KAAQ,UAAU,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY;IAAE,CAAC;IAChG;GACF;GACA,KAAK,SAAS;IACZ,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KACN,MAAM;KACN,SAAS,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;KAC5D,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,KAAA;IACzD,CAAC;IACD;GACF;GACA,SACE;EACJ;CACF;CAEA,UAA0C;EACxC,OAAO,KAAK,WAAW,EAAE,eAAe,UAAU,KAAK,WAAW,IAAI,CAAC;CACzE;CAEA,MAAc,QAAW,MAAc,MAAmB,aAAa,OAAmB;EACxF,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAC9D,GAAG;GACH,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,GAAG,KAAK;GAAQ;EAChD,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,cAAc,SAAS,WAAW,KAAK,OAAO,KAAA;EAClD,OAAO,SAAS,KAAK;CACvB;AACF;AAEA,SAAS,cAAc,OAA2B;CAChD,OAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAEA,SAAS,cAAc,OAAoD;CACzE,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN;CACF;AACF;;;AC5LA,MAAM,6BAA6B;AACnC,MAAM,iBAAiB;;;;;;AAsCvB,SAAS,UAAU,SAAiB,MAA4B,KAAuC;CACrG,MAAM,cAAc,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,sCAAsC,KAAK;EACtG,OAAO,GAAG,IAAI,GAAG;CACnB,CAAC;CACD,MAAM,aAAa,CAAC,SAAS,GAAI,QAAQ,CAAC,CAAE;CAC5C,OAAO,YAAY,SAAS;EAAC;EAAO,GAAG;EAAa,GAAG;CAAU,IAAI;AACvE;;AAGA,SAAS,qBAAqB,MAAsB;CAClD,MAAM,WAAW,MAAM,QAAQ,gBAAgB,IAAI;CACnD,IAAI,aAAa,kBAAkB,CAAC,SAAS,WAAW,GAAG,eAAe,EAAE,GAC1E,MAAM,IAAI,MAAM,kDAAkD,eAAe,IAAI,MAAM;CAE7F,OAAO;AACT;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD;CACA;CACA,WAAoB;CACpB,SAAyB;CAEzB;CACA;CACA;CACA;CACA,4BAAoB,IAAI,KAAK;CAC7B;CAEA,YAAY,SAAmC;EAC7C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM;GAAE,GAAG;GAAS;EAAK,CAAC;EAC1B,KAAK,KAAK,QAAQ,MAAM,sBAAsB,WAAW;EACzD,KAAK,OAAO;EACZ,KAAK,YAAY,QAAQ;EACzB,KAAK,iBAAiB,QAAQ,kBAAkB;EAChD,KAAK,eAAe,QAAQ;EAC5B,KAAK,SACH,QAAQ,UACR,IAAI,8BAA8B;GAAE,SAAS,QAAQ;GAAS,UAAU,QAAQ;GAAU,OAAO,QAAQ;EAAM,CAAC;CACpH;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAK,WAAW;GAGlB,IAAI,CAAC,MADiB,KAAK,OAAO,UAAU,KAAK,SAAS,GAExD,KAAK,QAAQ,MAAM,sBAAsB,KAAK,UAAU,4CAA4C;GAEtG;EACF;EACA,KAAK,YAAY,MAAM,KAAK,OAAO,cAAc;EACjD,KAAK,4BAAY,IAAI,KAAK;CAC5B;CAEA,MAAM,OAAsB,CAG5B;CAEA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW;EACrB,MAAM,KAAK,OAAO,cAAc,KAAK,SAAS;EAC9C,KAAK,YAAY,KAAA;CACnB;CAEA,MAAM,eAAe,SAAiB,MAAiB,SAAyD;EAC9G,MAAM,YAAY,KAAK,iBAAiB;EAExC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,kCAAkC;EAEtG,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,MAAM;EACnB,GAAG,OAAO;EACV,MAAM,SAAS,SAAS,cAAc,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,WAAW,CAAC,IAAI,WAAW;EAG7G,MAAM,gBAAgB,IAAI,YAAY;EACtC,MAAM,gBAAgB,IAAI,YAAY;EACtC,IAAI,SAAS;EACb,IAAI,SAAS;EACb,IAAI,WAAW;EAEf,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ;GAAE,GAAG,KAAK,OAAO;GAAG,GAAG,SAAS;EAAI,CAAC,CAAC,CAAC,QACnD,UAAqC,MAAM,OAAO,KAAA,CACrD,CACF;EAEA,IAAI;GACF,MAAM,KAAK,OAAO,KAChB,WACA;IACE,MAAM,UAAU,SAAS,MAAM,GAAG;IAClC,WAAW;IACX,KAAK,SAAS,OAAO,KAAK;GAC5B,GACA;IACE;IACA,UAAS,UAAS;KAChB,QAAQ,MAAM,MAAd;MACE,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK;OACH,WAAW,MAAM;OACjB;MACF,KAAK;OACH,UAAU,MAAM;OAChB,SAAS,WAAW,MAAM,OAAO;OACjC;KACJ;IACF;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,CAAC,OAAO,SAAS,MAAM;EAC7B,UAAU;GACR,aAAa,KAAK;EACpB;EAGA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EACA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EAEA,KAAK,6BAAa,IAAI,KAAK;EAC3B,OAAO;GACL;GACA;GACA,SAAS,aAAa,KAAK,CAAC,OAAO;GACnC;GACA;GACA;GACA,iBAAiB,KAAK,IAAI,IAAI;GAC9B,UAAU;GACV,QAAQ,OAAO,WAAW,CAAC;EAC7B;CACF;CAEA,MAAM,WAAW,OAA0C;EACzD,MAAM,YAAY,KAAK,iBAAiB;EAExC,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,OAAO,UAAU,WAAW,qBAAqB,KAAK,IAAI,GAAG,KAAK,OAAO;EAEtF,KAAK,6BAAa,IAAI,KAAK;CAC7B;CAEA,UAAuB;EACrB,OAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,YAAY,KAAK;GACjB,UAAU;IACR,WAAW,KAAK;IAChB,eAAe,KAAK,kBAAkB,gCAAgC,KAAK,OAAO,UAAU,KAAA;GAC9F;EACF;CACF;CAEA,kBAA0B;EACxB,MAAM,sBACJ;EACF,OAAO,OAAO,KAAK,iBAAiB,aAChC,KAAK,aAAa,EAAE,oBAAoB,CAAC,IACxC,KAAK,gBAAgB;CAC5B;CAEA,mBAAmC;EACjC,IAAI,CAAC,KAAK,WAAW,MAAM,IAAI,MAAM,sBAAsB,KAAK,GAAG,sBAAsB;EACzF,OAAO,KAAK;CACd;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/bridge-client.ts","../src/sandbox.ts"],"sourcesContent":["export interface CloudflareSandboxBridgeClientOptions {\n  baseUrl: string;\n  apiToken?: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */\nexport type CloudflareCommandEvent =\n  | { type: 'stdout'; data: Uint8Array }\n  | { type: 'stderr'; data: Uint8Array }\n  | { type: 'exit'; exitCode: number }\n  | { type: 'error'; message: string; code?: string };\n\nexport interface CloudflareExecRequest {\n  /** Command and arguments. The bridge applies ANSI-C quoting to each element. */\n  argv: string[];\n  timeoutMs?: number;\n  cwd?: string;\n}\n\nexport class CloudflareSandboxBridgeError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string) {\n    super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || 'empty response'}`);\n    this.name = 'CloudflareSandboxBridgeError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nfunction stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\n/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */\nfunction encodeFilePath(absolutePath: string): string {\n  let start = 0;\n  while (start < absolutePath.length && absolutePath[start] === '/') start++;\n  return absolutePath\n    .slice(start)\n    .split('/')\n    .map(segment => encodeURIComponent(segment))\n    .join('/');\n}\n\n/**\n * Client for the Cloudflare Sandbox Bridge Worker.\n *\n * @see https://developers.cloudflare.com/sandbox/bridge/http-api/\n */\nexport class CloudflareSandboxBridgeClient {\n  readonly baseUrl: string;\n  private readonly apiToken?: string;\n  private readonly fetchImpl: typeof globalThis.fetch;\n\n  constructor(options: CloudflareSandboxBridgeClientOptions) {\n    this.baseUrl = stripTrailingSlashes(options.baseUrl);\n    this.apiToken = options.apiToken;\n    this.fetchImpl = options.fetch ?? globalThis.fetch;\n  }\n\n  /** `POST /v1/sandbox` */\n  async createSandbox(): Promise<string> {\n    const created = await this.request<{ id: string }>('/v1/sandbox', { method: 'POST' });\n    return created.id;\n  }\n\n  /** `GET /v1/sandbox/:id/running` */\n  async isRunning(id: string): Promise<boolean> {\n    const status = await this.request<{ running: boolean }>(`/v1/sandbox/${encodeURIComponent(id)}/running`, {});\n    return status.running === true;\n  }\n\n  /** `DELETE /v1/sandbox/:id` */\n  async deleteSandbox(id: string): Promise<void> {\n    await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: 'DELETE' }, true);\n  }\n\n  /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */\n  async writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void> {\n    await this.request(\n      `/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`,\n      {\n        method: 'PUT',\n        body: content as RequestInit['body'],\n        headers: { 'content-type': 'application/octet-stream' },\n      },\n      true,\n    );\n  }\n\n  /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */\n  async exec(\n    id: string,\n    request: CloudflareExecRequest,\n    options: {\n      signal?: AbortSignal;\n      onEvent: (event: CloudflareCommandEvent) => void;\n    },\n  ): Promise<void> {\n    const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {\n      method: 'POST',\n      headers: { ...this.headers(), 'content-type': 'application/json', accept: 'text/event-stream' },\n      body: JSON.stringify({\n        argv: request.argv,\n        ...(request.timeoutMs === undefined ? {} : { timeout_ms: request.timeoutMs }),\n        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n      }),\n      signal: options.signal,\n    });\n\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (!response.body) {\n      throw new Error('Cloudflare Sandbox Bridge returned an empty command stream');\n    }\n\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let buffer = '';\n\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += decoder.decode(value, { stream: !done }).replace(/\\r\\n/g, '\\n');\n      let boundary = buffer.indexOf('\\n\\n');\n      while (boundary !== -1) {\n        this.emitBlock(buffer.slice(0, boundary), options.onEvent);\n        buffer = buffer.slice(boundary + 2);\n        boundary = buffer.indexOf('\\n\\n');\n      }\n      if (done) break;\n    }\n    if (buffer.trim()) this.emitBlock(buffer, options.onEvent);\n  }\n\n  private emitBlock(block: string, onEvent: (event: CloudflareCommandEvent) => void): void {\n    let eventName: string | undefined;\n    const dataLines: string[] = [];\n    for (const line of block.split('\\n')) {\n      if (line.startsWith('event:')) eventName = line.slice(6).trim();\n      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));\n    }\n    const data = dataLines.join('\\n');\n    if (!eventName || !data) return;\n\n    switch (eventName) {\n      case 'stdout':\n      case 'stderr':\n        onEvent({ type: eventName, data: base64ToBytes(data) });\n        return;\n      case 'exit': {\n        const parsed = safeJsonParse(data);\n        onEvent({ type: 'exit', exitCode: typeof parsed?.exit_code === 'number' ? parsed.exit_code : 0 });\n        return;\n      }\n      case 'error': {\n        const parsed = safeJsonParse(data);\n        onEvent({\n          type: 'error',\n          message: typeof parsed?.error === 'string' ? parsed.error : data,\n          code: typeof parsed?.code === 'string' ? parsed.code : undefined,\n        });\n        return;\n      }\n      default:\n        return;\n    }\n  }\n\n  private headers(): Record<string, string> {\n    return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};\n  }\n\n  private async request<T>(path: string, init: RequestInit, allowEmpty = false): Promise<T> {\n    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: { ...this.headers(), ...init.headers },\n    });\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (allowEmpty || response.status === 204) return undefined as T;\n    return response.json() as Promise<T>;\n  }\n}\n\nfunction base64ToBytes(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64'));\n}\n\nfunction safeJsonParse(value: string): Record<string, unknown> | undefined {\n  try {\n    return JSON.parse(value) as Record<string, unknown>;\n  } catch {\n    return undefined;\n  }\n}\n","import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\nimport type {\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  SandboxFileInput,\n  SandboxInfo,\n} from '@mastra/core/workspace';\nimport { MastraSandbox } from '@mastra/core/workspace';\nimport { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client';\n\nconst DEFAULT_COMMAND_TIMEOUT_MS = 300_000;\nconst WORKSPACE_ROOT = '/workspace';\n\ntype InstructionsOption = string | ((options: { defaultInstructions: string }) => string);\ntype BridgeClient = Pick<\n  CloudflareSandboxBridgeClient,\n  'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'\n>;\n\nexport interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** URL of a deployed Cloudflare Sandbox Bridge Worker. */\n  baseUrl: string;\n  /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */\n  apiToken?: string;\n  /** Stable Mastra identifier for this sandbox instance. */\n  id?: string;\n  /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */\n  sandboxId?: string;\n  /** Human-readable name shown in Mastra sandbox metadata. */\n  name?: string;\n  /** Environment variables applied to every command. */\n  env?: Record<string, string>;\n  /** Working directory applied to every command. Must be under /workspace. */\n  workingDirectory?: string;\n  /** Default command timeout in milliseconds. */\n  commandTimeout?: number;\n  /** Custom instructions returned by getInstructions(). */\n  instructions?: InstructionsOption;\n  /** Custom fetch implementation, primarily for advanced networking setup and tests. */\n  fetch?: CloudflareSandboxBridgeClientOptions['fetch'];\n  /** Preconfigured Bridge client, primarily for tests. */\n  client?: BridgeClient;\n}\n\n/**\n * Absolute path to the shell used to interpret bare command strings. Absolute so it\n * resolves even when a custom PATH excludes the standard system directories.\n */\nconst SHELL_PATH = '/bin/bash';\n\n/**\n * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to\n * every element, so no local escaping is needed. Environment variables are applied\n * with `env`, which keeps each assignment a separate argv element.\n *\n * When no separate arguments are supplied (the shape the built-in Workspace\n * `execute_command` tool uses), `command` is a shell command string — pipes,\n * chaining, quoting, redirection — so it is run through a non-login shell rather\n * than treated as a single executable name. When explicit arguments are given,\n * each element stays a literal argv token.\n */\nfunction buildArgv(command: string, args: string[] | undefined, env: Record<string, string>): string[] {\n  const assignments = Object.entries(env).map(([key, value]) => {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);\n    return `${key}=${value}`;\n  });\n  const invocation = args && args.length > 0 ? [command, ...args] : [SHELL_PATH, '-c', command];\n  return assignments.length ? ['env', ...assignments, ...invocation] : invocation;\n}\n\n/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */\nfunction resolveWorkspacePath(path: string): string {\n  const resolved = posix.resolve(WORKSPACE_ROOT, path);\n  if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) {\n    throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);\n  }\n  return resolved;\n}\n\nexport class CloudflareSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name: string;\n  readonly provider = 'cloudflare-sandbox';\n  status: ProviderStatus = 'pending';\n\n  private readonly client: BridgeClient;\n  private readonly commandTimeout: number;\n  private readonly instructions?: InstructionsOption;\n  private sandboxId?: string;\n  private createdAt = new Date();\n  private lastUsedAt?: Date;\n\n  constructor(options: CloudflareSandboxOptions) {\n    const name = options.name ?? 'Cloudflare Sandbox';\n    super({ ...options, name });\n    this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;\n    this.name = name;\n    this.sandboxId = options.sandboxId;\n    this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;\n    this.instructions = options.instructions;\n    this.client =\n      options.client ??\n      new CloudflareSandboxBridgeClient({ baseUrl: options.baseUrl, apiToken: options.apiToken, fetch: options.fetch });\n  }\n\n  async start(): Promise<void> {\n    if (this.sandboxId) {\n      // The bridge boots the container on demand, so a stopped container is not fatal.\n      const running = await this.client.isRunning(this.sandboxId);\n      if (!running) {\n        this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);\n      }\n      return;\n    }\n    this.sandboxId = await this.client.createSandbox();\n    this.createdAt = new Date();\n  }\n\n  async stop(): Promise<void> {\n    // The bridge exposes create/delete but no suspend operation. Stop detaches this\n    // Mastra lifecycle while preserving the remote sandbox for later reconnection.\n  }\n\n  async destroy(): Promise<void> {\n    if (!this.sandboxId) return;\n    await this.client.deleteSandbox(this.sandboxId);\n    this.sandboxId = undefined;\n  }\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    const sandboxId = this.requireSandboxId();\n\n    const startedAt = Date.now();\n    const timeout = options?.timeout ?? this.commandTimeout;\n    if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError('Command timeout must be positive');\n\n    const controller = new AbortController();\n    let didTimeout = false;\n    const timer = setTimeout(() => {\n      didTimeout = true;\n      controller.abort();\n    }, timeout);\n    const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;\n\n    // stdout and stderr are separate byte streams, so each needs its own streaming decoder.\n    const stdoutDecoder = new TextDecoder();\n    const stderrDecoder = new TextDecoder();\n    let stdout = '';\n    let stderr = '';\n    let exitCode = 1;\n\n    const env = Object.fromEntries(\n      Object.entries({ ...this.getEnv(), ...options?.env }).filter(\n        (entry): entry is [string, string] => entry[1] !== undefined,\n      ),\n    );\n\n    try {\n      await this.client.exec(\n        sandboxId,\n        {\n          argv: buildArgv(command, args, env),\n          timeoutMs: timeout,\n          cwd: options?.cwd ?? this.workingDirectory,\n        },\n        {\n          signal,\n          onEvent: event => {\n            switch (event.type) {\n              case 'stdout': {\n                const chunk = stdoutDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stdout += chunk;\n                options?.onStdout?.(chunk);\n                return;\n              }\n              case 'stderr': {\n                const chunk = stderrDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stderr += chunk;\n                options?.onStderr?.(chunk);\n                return;\n              }\n              case 'exit':\n                exitCode = event.exitCode;\n                return;\n              case 'error':\n                stderr += event.message;\n                options?.onStderr?.(event.message);\n                return;\n            }\n          },\n        },\n      );\n    } catch (error) {\n      if (!signal.aborted) throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    // Flush each decoder so a trailing truncated multi-byte sequence isn't dropped.\n    const stdoutTail = stdoutDecoder.decode();\n    if (stdoutTail) {\n      stdout += stdoutTail;\n      options?.onStdout?.(stdoutTail);\n    }\n    const stderrTail = stderrDecoder.decode();\n    if (stderrTail) {\n      stderr += stderrTail;\n      options?.onStderr?.(stderrTail);\n    }\n\n    this.lastUsedAt = new Date();\n    return {\n      command,\n      args,\n      success: exitCode === 0 && !signal.aborted,\n      exitCode,\n      stdout,\n      stderr,\n      executionTimeMs: Date.now() - startedAt,\n      timedOut: didTimeout,\n      killed: signal.aborted && !didTimeout,\n    };\n  }\n\n  async writeFiles(files: SandboxFileInput[]): Promise<void> {\n    const sandboxId = this.requireSandboxId();\n    // The bridge writes one file per request.\n    for (const file of files) {\n      await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);\n    }\n    this.lastUsedAt = new Date();\n  }\n\n  getInfo(): SandboxInfo {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this.createdAt,\n      lastUsedAt: this.lastUsedAt,\n      metadata: {\n        sandboxId: this.sandboxId,\n        bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : undefined,\n      },\n    };\n  }\n\n  getInstructions(): string {\n    const defaultInstructions =\n      'Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.';\n    return typeof this.instructions === 'function'\n      ? this.instructions({ defaultInstructions })\n      : (this.instructions ?? defaultInstructions);\n  }\n\n  private requireSandboxId(): string {\n    if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);\n    return this.sandboxId;\n  }\n}\n"],"mappings":";;;;AAoBA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CACA;CAEA,YAAY,QAAgB,MAAc;EACxC,MAAM,6CAA6C,OAAO,KAAK,QAAQ,kBAAkB;EACzF,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qBAAqB,KAAqB;CACjD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;;AAGA,SAAS,eAAe,cAA8B;CACpD,IAAI,QAAQ;CACZ,OAAO,QAAQ,aAAa,UAAU,aAAa,WAAW,KAAK;CACnE,OAAO,aACJ,MAAM,KAAK,CAAC,CACZ,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,mBAAmB,OAAO,CAAC,CAAC,CAC3C,KAAK,GAAG;AACb;;;;;;AAOA,IAAa,gCAAb,MAA2C;CACzC;CACA;CACA;CAEA,YAAY,SAA+C;EACzD,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,KAAK,WAAW,QAAQ;EACxB,KAAK,YAAY,QAAQ,SAAS,WAAW;CAC/C;;CAGA,MAAM,gBAAiC;EAErC,QAAO,MADe,KAAK,QAAwB,eAAe,EAAE,QAAQ,OAAO,CAAC,EAAA,CACrE;CACjB;;CAGA,MAAM,UAAU,IAA8B;EAE5C,QAAO,MADc,KAAK,QAA8B,eAAe,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAA,CAC7F,YAAY;CAC5B;;CAGA,MAAM,cAAc,IAA2B;EAC7C,MAAM,KAAK,QAAQ,eAAe,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,IAAI;CACxF;;CAGA,MAAM,UAAU,IAAY,cAAsB,SAA6C;EAC7F,MAAM,KAAK,QACT,eAAe,mBAAmB,EAAE,EAAE,QAAQ,eAAe,YAAY,KACzE;GACE,QAAQ;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB,2BAA2B;EACxD,GACA,IACF;CACF;;CAGA,MAAM,KACJ,IACA,SACA,SAIe;EACf,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,cAAc,mBAAmB,EAAE,EAAE,QAAQ;GACjG,QAAQ;GACR,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,gBAAgB;IAAoB,QAAQ;GAAoB;GAC9F,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,UAAU;IAC3E,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;GAC1D,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,SAAS,SAAS,KAAK,UAAU;EACvC,MAAM,UAAU,IAAI,YAAY;EAChC,IAAI,SAAS;EAEb,OAAO,MAAM;GACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,UAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,IAAI;GACxE,IAAI,WAAW,OAAO,QAAQ,MAAM;GACpC,OAAO,aAAa,IAAI;IACtB,KAAK,UAAU,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,OAAO;IACzD,SAAS,OAAO,MAAM,WAAW,CAAC;IAClC,WAAW,OAAO,QAAQ,MAAM;GAClC;GACA,IAAI,MAAM;EACZ;EACA,IAAI,OAAO,KAAK,GAAG,KAAK,UAAU,QAAQ,QAAQ,OAAO;CAC3D;CAEA,UAAkB,OAAe,SAAwD;EACvF,IAAI;EACJ,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,GACjC,IAAI,KAAK,WAAW,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;OACzD,IAAI,KAAK,WAAW,OAAO,GAAG,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;EAEnF,MAAM,OAAO,UAAU,KAAK,IAAI;EAChC,IAAI,CAAC,aAAa,CAAC,MAAM;EAEzB,QAAQ,WAAR;GACE,KAAK;GACL,KAAK;IACH,QAAQ;KAAE,MAAM;KAAW,MAAM,cAAc,IAAI;IAAE,CAAC;IACtD;GACF,KAAK,QAAQ;IACX,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KAAE,MAAM;KAAQ,UAAU,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY;IAAE,CAAC;IAChG;GACF;GACA,KAAK,SAAS;IACZ,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KACN,MAAM;KACN,SAAS,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;KAC5D,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,KAAA;IACzD,CAAC;IACD;GACF;GACA,SACE;EACJ;CACF;CAEA,UAA0C;EACxC,OAAO,KAAK,WAAW,EAAE,eAAe,UAAU,KAAK,WAAW,IAAI,CAAC;CACzE;CAEA,MAAc,QAAW,MAAc,MAAmB,aAAa,OAAmB;EACxF,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAC9D,GAAG;GACH,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,GAAG,KAAK;GAAQ;EAChD,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,cAAc,SAAS,WAAW,KAAK,OAAO,KAAA;EAClD,OAAO,SAAS,KAAK;CACvB;AACF;AAEA,SAAS,cAAc,OAA2B;CAChD,OAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAEA,SAAS,cAAc,OAAoD;CACzE,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN;CACF;AACF;;;AC5LA,MAAM,6BAA6B;AACnC,MAAM,iBAAiB;;;;;AAqCvB,MAAM,aAAa;;;;;;;;;;;;AAanB,SAAS,UAAU,SAAiB,MAA4B,KAAuC;CACrG,MAAM,cAAc,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,sCAAsC,KAAK;EACtG,OAAO,GAAG,IAAI,GAAG;CACnB,CAAC;CACD,MAAM,aAAa,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI;EAAC;EAAY;EAAM;CAAO;CAC5F,OAAO,YAAY,SAAS;EAAC;EAAO,GAAG;EAAa,GAAG;CAAU,IAAI;AACvE;;AAGA,SAAS,qBAAqB,MAAsB;CAClD,MAAM,WAAW,MAAM,QAAQ,gBAAgB,IAAI;CACnD,IAAI,aAAa,kBAAkB,CAAC,SAAS,WAAW,GAAG,eAAe,EAAE,GAC1E,MAAM,IAAI,MAAM,kDAAkD,eAAe,IAAI,MAAM;CAE7F,OAAO;AACT;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD;CACA;CACA,WAAoB;CACpB,SAAyB;CAEzB;CACA;CACA;CACA;CACA,4BAAoB,IAAI,KAAK;CAC7B;CAEA,YAAY,SAAmC;EAC7C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM;GAAE,GAAG;GAAS;EAAK,CAAC;EAC1B,KAAK,KAAK,QAAQ,MAAM,sBAAsB,WAAW;EACzD,KAAK,OAAO;EACZ,KAAK,YAAY,QAAQ;EACzB,KAAK,iBAAiB,QAAQ,kBAAkB;EAChD,KAAK,eAAe,QAAQ;EAC5B,KAAK,SACH,QAAQ,UACR,IAAI,8BAA8B;GAAE,SAAS,QAAQ;GAAS,UAAU,QAAQ;GAAU,OAAO,QAAQ;EAAM,CAAC;CACpH;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAK,WAAW;GAGlB,IAAI,CAAC,MADiB,KAAK,OAAO,UAAU,KAAK,SAAS,GAExD,KAAK,QAAQ,MAAM,sBAAsB,KAAK,UAAU,4CAA4C;GAEtG;EACF;EACA,KAAK,YAAY,MAAM,KAAK,OAAO,cAAc;EACjD,KAAK,4BAAY,IAAI,KAAK;CAC5B;CAEA,MAAM,OAAsB,CAG5B;CAEA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW;EACrB,MAAM,KAAK,OAAO,cAAc,KAAK,SAAS;EAC9C,KAAK,YAAY,KAAA;CACnB;CAEA,MAAM,eAAe,SAAiB,MAAiB,SAAyD;EAC9G,MAAM,YAAY,KAAK,iBAAiB;EAExC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,kCAAkC;EAEtG,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,MAAM;EACnB,GAAG,OAAO;EACV,MAAM,SAAS,SAAS,cAAc,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,WAAW,CAAC,IAAI,WAAW;EAG7G,MAAM,gBAAgB,IAAI,YAAY;EACtC,MAAM,gBAAgB,IAAI,YAAY;EACtC,IAAI,SAAS;EACb,IAAI,SAAS;EACb,IAAI,WAAW;EAEf,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ;GAAE,GAAG,KAAK,OAAO;GAAG,GAAG,SAAS;EAAI,CAAC,CAAC,CAAC,QACnD,UAAqC,MAAM,OAAO,KAAA,CACrD,CACF;EAEA,IAAI;GACF,MAAM,KAAK,OAAO,KAChB,WACA;IACE,MAAM,UAAU,SAAS,MAAM,GAAG;IAClC,WAAW;IACX,KAAK,SAAS,OAAO,KAAK;GAC5B,GACA;IACE;IACA,UAAS,UAAS;KAChB,QAAQ,MAAM,MAAd;MACE,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK;OACH,WAAW,MAAM;OACjB;MACF,KAAK;OACH,UAAU,MAAM;OAChB,SAAS,WAAW,MAAM,OAAO;OACjC;KACJ;IACF;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,CAAC,OAAO,SAAS,MAAM;EAC7B,UAAU;GACR,aAAa,KAAK;EACpB;EAGA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EACA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EAEA,KAAK,6BAAa,IAAI,KAAK;EAC3B,OAAO;GACL;GACA;GACA,SAAS,aAAa,KAAK,CAAC,OAAO;GACnC;GACA;GACA;GACA,iBAAiB,KAAK,IAAI,IAAI;GAC9B,UAAU;GACV,QAAQ,OAAO,WAAW,CAAC;EAC7B;CACF;CAEA,MAAM,WAAW,OAA0C;EACzD,MAAM,YAAY,KAAK,iBAAiB;EAExC,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,OAAO,UAAU,WAAW,qBAAqB,KAAK,IAAI,GAAG,KAAK,OAAO;EAEtF,KAAK,6BAAa,IAAI,KAAK;CAC7B;CAEA,UAAuB;EACrB,OAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,YAAY,KAAK;GACjB,UAAU;IACR,WAAW,KAAK;IAChB,eAAe,KAAK,kBAAkB,gCAAgC,KAAK,OAAO,UAAU,KAAA;GAC9F;EACF;CACF;CAEA,kBAA0B;EACxB,MAAM,sBACJ;EACF,OAAO,OAAO,KAAK,iBAAiB,aAChC,KAAK,aAAa,EAAE,oBAAoB,CAAC,IACxC,KAAK,gBAAgB;CAC5B;CAEA,mBAAmC;EACjC,IAAI,CAAC,KAAK,WAAW,MAAM,IAAI,MAAM,sBAAsB,KAAK,GAAG,sBAAsB;EACzF,OAAO,KAAK;CACd;AACF"}

package/dist/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,KAAK,oCAAoC,EAAE,MAAM,iBAAiB,CAAC;AAK3G,KAAK,kBAAkB,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE;IAAE,mBAAmB,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,CAAC,CAAC;AAC1F,KAAK,YAAY,GAAG,IAAI,CACtB,6BAA6B,EAC7B,eAAe,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,GAAG,MAAM,CACvE,CAAC;AAEF,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IACvF,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sFAAsF;IACtF,KAAK,CAAC,EAAE,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACtD,wDAAwD;IACxD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAyBD,qBAAa,iBAAkB,SAAQ,aAAa;IAClD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,wBAAwB;IACzC,MAAM,EAAE,cAAc,CAAa;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAO;IAE1B,YAAY,OAAO,EAAE,wBAAwB,EAW5C;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAW3B;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAG1B;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI7B;IAEK,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+F9G;IAEK,UAAU,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzD;IAED,OAAO,IAAI,WAAW,CAarB;IAED,eAAe,IAAI,MAAM,CAMxB;IAED,OAAO,CAAC,gBAAgB;CAIzB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,KAAK,oCAAoC,EAAE,MAAM,iBAAiB,CAAC;AAK3G,KAAK,kBAAkB,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE;IAAE,mBAAmB,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,CAAC,CAAC;AAC1F,KAAK,YAAY,GAAG,IAAI,CACtB,6BAA6B,EAC7B,eAAe,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,GAAG,MAAM,CACvE,CAAC;AAEF,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IACvF,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sFAAsF;IACtF,KAAK,CAAC,EAAE,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACtD,wDAAwD;IACxD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAqCD,qBAAa,iBAAkB,SAAQ,aAAa;IAClD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,wBAAwB;IACzC,MAAM,EAAE,cAAc,CAAa;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAO;IAE1B,YAAY,OAAO,EAAE,wBAAwB,EAW5C;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAW3B;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAG1B;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI7B;IAEK,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+F9G;IAEK,UAAU,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzD;IAED,OAAO,IAAI,WAAW,CAarB;IAED,eAAe,IAAI,MAAM,CAMxB;IAED,OAAO,CAAC,gBAAgB;CAIzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/cloudflare-sandbox",
-  "version": "0.3.0-alpha.1",
+  "version": "0.3.1-alpha.0",
   "description": "Cloudflare Sandbox provider for Mastra workspaces",
   "type": "module",
   "main": "dist/index.js",
@@ -28,10 +28,10 @@
     "tsdown": "0.22.9",
     "typescript": "^7.0.2",
     "vitest": "4.1.10",
-    "@internal/lint": "0.0.129",
-    "@internal/types-builder": "0.0.104",
-    "@internal/workspace-test-utils": "0.0.73",
-    "@mastra/core": "1.64.0-alpha.7"
+    "@internal/types-builder": "0.0.107",
+    "@internal/workspace-test-utils": "0.0.76",
+    "@internal/lint": "0.0.132",
+    "@mastra/core": "1.66.1-alpha.0"
   },
   "peerDependencies": {
     "@mastra/core": ">=1.12.0-0 <2.0.0-0"