@namzu/sandbox 2.0.2 → 3.0.0

package/src/egress/proxy.ts

@@ -4,6 +4,8 @@ import { request as httpsRequest } from 'node:https'
 import { connect as netConnect } from 'node:net'
 import type { Duplex } from 'node:stream'
 
+import { EgressAddressDenied, blockedLiteralReason, createScreeningLookup } from './address.js'
+import type { ScreeningLookupOptions } from './address.js'
 import { isHostAllowed, splitAuthority } from './allowlist.js'
 
 /**
@@ -59,6 +61,18 @@ export interface EgressProxyOptions {
 	 */
 	readonly upgradeToHttps?: boolean
 	readonly onDenied?: (host: string, reason: string) => void
+	/**
+	 * Allowlisted hosts permitted to resolve to an inward address anyway.
+	 *
+	 * Matched by the allowlist's own rules, so `.internal.example` covers
+	 * subdomains. Per host on purpose: an operator who genuinely proxies to
+	 * one service on a private network needs that one exempted, and a global
+	 * switch to get it would hand every other allowlisted name the same
+	 * reach — which is the hole this screen exists to close.
+	 */
+	readonly allowInwardFor?: readonly string[]
+	/** Injected in tests. Defaults to the platform resolver. */
+	readonly resolveAddresses?: ScreeningLookupOptions['resolve']
 }
 
 export interface RunningEgressProxy {
@@ -79,12 +93,28 @@ export class EgressProxy {
 	private readonly onDenied: ((host: string, reason: string) => void) | undefined
 	/** See the loop guard in `listen`. */
 	private selfPort: number | undefined
+	/**
+	 * The resolver both paths connect through.
+	 *
+	 * Held once rather than built per request so there is exactly one place
+	 * the address screen can be bypassed, and it is visible from here.
+	 */
+	private readonly lookup: ReturnType<typeof createScreeningLookup>
+	private readonly inwardAllowed: readonly string[]
 
 	constructor(options: EgressProxyOptions) {
 		this.resolveAllowed = options.allowedHosts
 		this.credentials = options.credentials ?? []
 		this.upgradeToHttps = options.upgradeToHttps ?? true
 		this.onDenied = options.onDenied
+		this.inwardAllowed = options.allowInwardFor ?? []
+		this.lookup = createScreeningLookup(
+			{
+				...(options.allowInwardFor ? { allowInwardFor: options.allowInwardFor } : {}),
+				...(options.resolveAddresses ? { resolve: options.resolveAddresses } : {}),
+			},
+			isHostAllowed,
+		)
 	}
 
 	async listen(port = 0): Promise<RunningEgressProxy> {
@@ -143,6 +173,18 @@ export class EgressProxy {
 		this.onDenied?.(host, reason)
 	}
 
+	/**
+	 * Why this target may not be dialled as written, or `null`.
+	 *
+	 * Covers the literal-address case only; a name is screened inside
+	 * `this.lookup`, which the socket calls. Both are needed — see
+	 * `blockedLiteralReason` for why one cannot cover the other.
+	 */
+	private literalDenial(host: string): string | null {
+		if (this.inwardAllowed.length > 0 && isHostAllowed(host, this.inwardAllowed)) return null
+		return blockedLiteralReason(host)
+	}
+
 	/** Plain HTTP. The only path where a credential can be stamped on. */
 	private async handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
 		const target = parseTarget(req)
@@ -170,6 +212,20 @@ export class EgressProxy {
 			return
 		}
 
+		const literal = this.literalDenial(target.host)
+		if (literal) {
+			this.deny(target.host, `is a ${literal} address`)
+			res.writeHead(DENIED_STATUS, { 'content-type': 'text/plain' })
+			// Refused BEFORE the credential is looked up, let alone stamped.
+			// The ordering is the point: on this path the token goes on the
+			// headers a few lines below, so a check that ran after it would be
+			// deciding whether to send a request that already carried it.
+			res.end(
+				`Egress denied: ${target.host} is a ${literal} address, which is not reachable from a sandbox.\n`,
+			)
+			return
+		}
+
 		const headers = { ...req.headers }
 		// The proxy re-issues the request, so hop-by-hop headers about the
 		// hop that just ended must not be forwarded.
@@ -192,6 +248,11 @@ export class EgressProxy {
 				method: req.method,
 				path: target.path,
 				headers,
+				// `host` stays the NAME so SNI and certificate validation still
+				// check the name the allowlist approved; only the address the
+				// socket dials is screened. Swapping in the address here would
+				// break TLS verification, which is the wrong way to fix this.
+				lookup: this.lookup,
 			},
 			(response) => {
 				res.writeHead(response.statusCode ?? 502, response.headers)
@@ -200,6 +261,17 @@ export class EgressProxy {
 		)
 
 		upstream.on('error', (err) => {
+			// An address denial is a policy refusal, not a network fault, and
+			// telling them apart is the difference between an agent that stops
+			// and one that retries a forbidden host forever. The credential is
+			// already on `headers` at this point and has still not left the
+			// process: the socket never connected, so nothing was written.
+			if (err instanceof EgressAddressDenied) {
+				this.deny(err.host, `resolves to a ${err.reason} address`)
+				if (!res.headersSent) res.writeHead(DENIED_STATUS, { 'content-type': 'text/plain' })
+				res.end(`${err.message}\n`)
+				return
+			}
 			if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain' })
 			res.end(`Upstream request failed: ${err.message}\n`)
 		})
@@ -216,6 +288,18 @@ export class EgressProxy {
 	 * agent sends anywhere, a strictly larger risk than the one being
 	 * mitigated. A workload that needs brokering speaks plain HTTP to the
 	 * proxy and lets it upgrade upstream.
+	 *
+	 * **And the allowlist here is a check on the name in the CONNECT line,
+	 * which is the only thing about this tunnel that is ever in clear text.**
+	 * The address screen makes it a check on where that name goes, which is a
+	 * real bound — a permitted name can no longer be a route to the host's own
+	 * network. It is not a check on what travels afterwards. Inside the tunnel
+	 * the bytes are the caller's, and the name the caller puts in its own TLS
+	 * handshake or `Host` header is not visible to this process, so against a
+	 * determined caller running inside the sandbox this path bounds the
+	 * DESTINATION and nothing else. Say so plainly rather than let a reader
+	 * infer that a tunnel to an allowlisted host carries only allowlisted
+	 * traffic.
 	 */
 	private async handleConnect(req: IncomingMessage, socket: Duplex, head: Buffer): Promise<void> {
 		const { host, port } = splitAuthority(req.url ?? '')
@@ -229,14 +313,34 @@ export class EgressProxy {
 			return
 		}
 
-		const upstream = netConnect(port ?? 443, host, () => {
+		const literal = this.literalDenial(host)
+		if (literal) {
+			this.deny(host, `is a ${literal} address`)
+			socket.write(
+				`HTTP/1.1 ${DENIED_STATUS} Forbidden\r\nContent-Type: text/plain\r\n\r\nEgress denied: ${host} is a ${literal} address, which is not reachable from a sandbox.\n`,
+			)
+			socket.end()
+			return
+		}
+
+		// Same screened resolver as the plain path. The tunnel carries no
+		// brokered credential, so the loss here is reach rather than a token —
+		// but an allowlisted name pointing inward still turns this proxy into
+		// a route to the host's own network, which is what a sandbox is for.
+		const upstream = netConnect({ port: port ?? 443, host, lookup: this.lookup }, () => {
 			socket.write('HTTP/1.1 200 Connection Established\r\n\r\n')
 			if (head.length > 0) upstream.write(head)
 			upstream.pipe(socket)
 			socket.pipe(upstream)
 		})
 
-		upstream.on('error', () => {
+		upstream.on('error', (err) => {
+			if (err instanceof EgressAddressDenied) {
+				this.deny(err.host, `resolves to a ${err.reason} address`)
+				socket.write(
+					`HTTP/1.1 ${DENIED_STATUS} Forbidden\r\nContent-Type: text/plain\r\n\r\n${err.message}\n`,
+				)
+			}
 			socket.end()
 		})
 		socket.on('error', () => {

package/src/index.ts

@@ -210,6 +210,22 @@ export interface ContainerBackendConfig {
 	 * separately by `EgressPolicy`.
 	 */
 	readonly network?: 'none' | 'bridge' | string
+	/**
+	 * Allowlisted hosts permitted to resolve to an inward address anyway.
+	 *
+	 * The egress boundary refuses a host that resolves to loopback, a
+	 * private range, or the link-local block cloud metadata services answer
+	 * on — whatever the allowlist says, because an allowlisted name whose
+	 * DNS someone else controls is a permitted spelling rather than a
+	 * permitted destination. A deployment that genuinely proxies to one
+	 * service on a private network names that service here.
+	 *
+	 * Per host, matched by the allowlist's own rules so `.internal.example`
+	 * covers subdomains. There is deliberately no switch that turns the
+	 * screen off: one would hand every other allowlisted name the same
+	 * reach, which is the hole the screen exists to close.
+	 */
+	readonly allowInwardFor?: readonly string[]
 	/**
 	 * Optional `--label key=value` pairs applied to the spawned
 	 * container. Hosts use this to make the container findable from
@@ -549,6 +565,7 @@ function pickBackend(config: SandboxProviderConfig): SandboxBackend {
 				? { hostReachability: backend.hostReachability }
 				: {}),
 			...(backend.network !== undefined ? { network: backend.network } : {}),
+			...(backend.allowInwardFor !== undefined ? { allowInwardFor: backend.allowInwardFor } : {}),
 			...(backend.labels !== undefined ? { labels: backend.labels } : {}),
 		})
 	}
@@ -599,6 +616,7 @@ function pickBackend(config: SandboxProviderConfig): SandboxBackend {
 				? { hostReachability: backend.hostReachability }
 				: {}),
 			...(backend.network !== undefined ? { network: backend.network } : {}),
+			...(backend.allowInwardFor !== undefined ? { allowInwardFor: backend.allowInwardFor } : {}),
 			...(backend.labels !== undefined ? { labels: backend.labels } : {}),
 		})
 	}

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=unenforceable-controls.test.d.ts.map

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"unenforceable-controls.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/aci-standby-pool/__tests__/unenforceable-controls.test.ts"],"names":[],"mappings":""}

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js

@@ -1,61 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { assertEnforceable } from '../index.js';
-/**
- * The claim API rejects every property override that is not a config map,
- * so a memory cap, a process cap, environment variables and an egress
- * policy have nowhere to ride through on this backend. They were accepted
- * and dropped: a host that asked for `deny-all` and 512 MB got full
- * outbound network and no cap, with no error and no warning — from the same
- * call shape that IS enforced on the sibling container backend.
- *
- * Switching backends therefore removed the blast-radius controls silently,
- * which is the worst way to lose them. namzu already holds the norm for
- * this next door: a policy accepted and quietly ignored is worse than one
- * that is refused.
- */
-const opts = (extra = {}) => ({
-    workingDirectory: '/w',
-    ...extra,
-});
-describe('controls this backend cannot apply', () => {
-    it.each([
-        ['an egress policy', { egress: { kind: 'deny-all' } }],
-        ['a memory limit', { memoryLimitMb: 512 }],
-        ['a process limit', { maxProcesses: 32 }],
-        ['environment variables', { env: { SECRET: 'x' } }],
-    ])('refuses %s', (_name, extra) => {
-        expect(() => assertEnforceable(opts(extra))).toThrow(/cannot enforce per-sandbox/);
-    });
-    it('names every field it cannot honour, not just the first', () => {
-        try {
-            assertEnforceable(opts({ egress: { kind: 'deny-all' }, memoryLimitMb: 512, maxProcesses: 8 }));
-            expect.unreachable();
-        }
-        catch (err) {
-            const message = err.message;
-            // A host fixing one and hitting the next on the following run
-            // learns the shape one failure at a time.
-            expect(message).toContain('egress');
-            expect(message).toContain('memory');
-            expect(message).toContain('process');
-        }
-    });
-    it('says where the limits do belong', () => {
-        // Refusing without saying what to do instead is a dead end; these
-        // are a property of the pooled profile.
-        expect(() => assertEnforceable(opts({ memoryLimitMb: 512 }))).toThrow(/container group profile/);
-    });
-});
-describe('what it does allow through', () => {
-    it('accepts a request that asks for nothing it cannot apply', () => {
-        expect(() => assertEnforceable(opts())).not.toThrow();
-    });
-    it('accepts a timeout, which is applied by the caller not the pool', () => {
-        expect(() => assertEnforceable(opts({ timeoutMs: 30_000 }))).not.toThrow();
-    });
-    it('treats an empty env bag as asking for nothing', () => {
-        // A host spreading an empty object should not be refused for it.
-        expect(() => assertEnforceable(opts({ env: {} }))).not.toThrow();
-    });
-});
-//# sourceMappingURL=unenforceable-controls.test.js.map

package/dist/backends/aci-standby-pool/__tests__/unenforceable-controls.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"unenforceable-controls.test.js","sourceRoot":"","sources":["../../../../src/backends/aci-standby-pool/__tests__/unenforceable-controls.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;;;;;GAYG;AAEH,MAAM,IAAI,GAAG,CAAC,QAAwC,EAAE,EAAyB,EAAE,CAAC,CAAC;IACpF,gBAAgB,EAAE,IAAI;IACtB,GAAG,KAAK;CACR,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,IAAI,CAAC;QACP,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAW,EAAE,CAAC;QAC/D,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACzC,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;KACnD,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACjE,IAAI,CAAC;YACJ,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9F,MAAM,CAAC,WAAW,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAA;YACtC,8DAA8D;YAC9D,0CAA0C;YAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,kEAAkE;QAClE,wCAAwC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,iEAAiE;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/docker/__tests__/hardening.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=hardening.test.d.ts.map

package/dist/backends/docker/__tests__/hardening.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardening.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/hardening.test.ts"],"names":[],"mappings":""}

package/dist/backends/docker/__tests__/hardening.test.js

@@ -1,32 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { resolveNetwork } from '../index.js';
-/**
- * `EgressPolicy` was accepted by the type, threaded through the options,
- * and silently ignored by this backend. That is worse than not supporting
- * it: a host that set `deny-all` believed the container had no network,
- * and it had whatever `config.network` said.
- */
-describe('resolveNetwork', () => {
-    it('leaves the configured network alone when no policy is supplied', () => {
-        expect(resolveNetwork('bridge', undefined)).toBe('bridge');
-    });
-    it('enforces deny-all natively', () => {
-        // Docker can actually do this one, so there is no excuse for
-        // accepting the policy and ignoring it.
-        expect(resolveNetwork('bridge', { kind: 'deny-all' })).toBe('none');
-    });
-    it('allow-all keeps the configured network', () => {
-        expect(resolveNetwork('my-bridge', { kind: 'allow-all' })).toBe('my-bridge');
-    });
-    it('REFUSES a host allowlist rather than silently granting full access', () => {
-        // This backend has no proxy to filter through. Downgrading a
-        // restrictive policy to "allow everything" is the failure mode that
-        // makes a security control worse than useless.
-        expect(() => resolveNetwork('bridge', { kind: 'static', allowedHosts: ['example.com'] })).toThrow(/cannot enforce an egress policy/);
-        expect(() => resolveNetwork('bridge', { kind: 'resolver', resolve: async () => [] })).toThrow(/cannot enforce an egress policy/);
-    });
-    it('names what it can do, so the failure is actionable', () => {
-        expect(() => resolveNetwork('bridge', { kind: 'static', allowedHosts: [] })).toThrow(/deny-all/);
-    });
-});
-//# sourceMappingURL=hardening.test.js.map

package/dist/backends/docker/__tests__/hardening.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardening.test.js","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/hardening.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;GAKG;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACrC,6DAA6D;QAC7D,wCAAwC;QACxC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,6DAA6D;QAC7D,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,CAAC,GAAG,EAAE,CACX,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;QAE5C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5F,iCAAiC,CACjC,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts

@@ -1,40 +0,0 @@
-/**
- * Docker smoke test — leaf-mount permission semantics.
- *
- * Concern raised in review: the Dockerfile pre-creates only the parent
- * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
- * The runtime claim is that:
- *
- *   1. When `outputs` IS bound, uid 1001 (the worker user) can write
- *      into it.
- *   2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
- *      the path simply does not exist — `stat` returns ENOENT, NOT
- *      a writable empty dir.
- *
- * Both of those are kernel-level mount-namespace properties, not
- * unit-testable. This file exercises them against a real docker
- * daemon. Run via:
- *
- *   pnpm --filter @namzu/sandbox test:smoke
- *   # or, from the monorepo root:
- *   pnpm sandbox:smoke
- *
- * Excluded from the default `pnpm test` run by `vitest.config.ts`.
- *
- * Pre-requisites:
- *   - `docker` CLI on PATH.
- *   - A pre-built reference image. By default this test looks for
- *     `namzu-sandbox-worker:smoke`. Override with the
- *     `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
- *       `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
- *   - A host-side scratch directory the test creates and tears down.
- *
- * On a developer machine without docker the test self-skips with a
- * clear message. On CI (`process.env.CI === 'true'`) the same
- * pre-conditions FAIL FAST instead of skipping, so a CI
- * misconfiguration cannot silently mask a regression — see the
- * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
- * always run with docker available.
- */
-export {};
-//# sourceMappingURL=leaf-permissions.smoke.test.d.ts.map

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"leaf-permissions.smoke.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/leaf-permissions.smoke.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js

@@ -1,157 +0,0 @@
-/**
- * Docker smoke test — leaf-mount permission semantics.
- *
- * Concern raised in review: the Dockerfile pre-creates only the parent
- * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
- * The runtime claim is that:
- *
- *   1. When `outputs` IS bound, uid 1001 (the worker user) can write
- *      into it.
- *   2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
- *      the path simply does not exist — `stat` returns ENOENT, NOT
- *      a writable empty dir.
- *
- * Both of those are kernel-level mount-namespace properties, not
- * unit-testable. This file exercises them against a real docker
- * daemon. Run via:
- *
- *   pnpm --filter @namzu/sandbox test:smoke
- *   # or, from the monorepo root:
- *   pnpm sandbox:smoke
- *
- * Excluded from the default `pnpm test` run by `vitest.config.ts`.
- *
- * Pre-requisites:
- *   - `docker` CLI on PATH.
- *   - A pre-built reference image. By default this test looks for
- *     `namzu-sandbox-worker:smoke`. Override with the
- *     `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
- *       `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
- *   - A host-side scratch directory the test creates and tears down.
- *
- * On a developer machine without docker the test self-skips with a
- * clear message. On CI (`process.env.CI === 'true'`) the same
- * pre-conditions FAIL FAST instead of skipping, so a CI
- * misconfiguration cannot silently mask a regression — see the
- * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
- * always run with docker available.
- */
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { createSandboxProvider } from '../../../index.js';
-const IMAGE = process.env.NAMZU_SANDBOX_SMOKE_IMAGE ?? 'namzu-sandbox-worker:smoke';
-const IS_CI = process.env.CI === 'true';
-function dockerAvailable() {
-    const probe = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], {
-        stdio: 'ignore',
-    });
-    return probe.status === 0;
-}
-function imagePresent(image) {
-    const probe = spawnSync('docker', ['image', 'inspect', image], { stdio: 'ignore' });
-    return probe.status === 0;
-}
-const skipReason = !dockerAvailable()
-    ? 'docker daemon not reachable — skipping smoke test'
-    : !imagePresent(IMAGE)
-        ? `image ${IMAGE} not present — build it with \`docker build -t ${IMAGE} -f packages/sandbox/worker/Dockerfile packages/sandbox\` and re-run`
-        : null;
-// CI fail-fast: the smoke workflow is meant to always have docker +
-// the reference image. Skipping silently in that environment would
-// let a regression land without the test even attempting to run.
-// Locally (no `CI=true`) skipping with a hint is the right behaviour
-// for a developer who hasn't built the image yet.
-if (IS_CI && skipReason) {
-    throw new Error(`smoke test pre-condition not satisfied on CI: ${skipReason}. Configure the workflow to install docker and build the reference image before running.`);
-}
-describe.skipIf(skipReason !== null)('docker smoke — leaf permissions', () => {
-    let outputsHost;
-    beforeAll(() => {
-        outputsHost = mkdtempSync(join(tmpdir(), 'namzu-sandbox-smoke-out-'));
-    });
-    afterAll(() => {
-        if (outputsHost) {
-            rmSync(outputsHost, { recursive: true, force: true });
-        }
-    });
-    it('uid 1001 can write to the outputs bind, and the host sees the file', async () => {
-        const provider = createSandboxProvider({
-            backend: { tier: 'container', image: IMAGE },
-            layout: {
-                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
-            },
-        });
-        const sandbox = await provider.create();
-        try {
-            const result = await sandbox.exec('sh', [
-                '-c',
-                'id -u && echo "smoke" > /mnt/user-data/outputs/hello.txt',
-            ]);
-            expect(result.exitCode).toBe(0);
-            expect(result.stdout.trim()).toBe('1001');
-            // Host-side read confirms the bind round-trips.
-            const hostContent = readFileSync(join(outputsHost, 'hello.txt'), 'utf8');
-            expect(hostContent.trim()).toBe('smoke');
-        }
-        finally {
-            await sandbox.destroy();
-        }
-    }, 60_000);
-    it('unbound leaves do not exist — uploads/transcripts/tool_results are ENOENT, not empty', async () => {
-        const provider = createSandboxProvider({
-            backend: { tier: 'container', image: IMAGE },
-            layout: {
-                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
-                // Intentionally leave uploads / toolResults / transcripts
-                // unbound. The Dockerfile pre-creates only the parents
-                // (`/mnt/user-data`, `/mnt/skills`); leaves should not
-                // exist and `stat` should fail.
-            },
-        });
-        const sandbox = await provider.create();
-        try {
-            for (const leafPath of [
-                '/mnt/user-data/uploads',
-                '/mnt/user-data/tool_results',
-                '/mnt/transcripts',
-            ]) {
-                const result = await sandbox.exec('sh', ['-c', `stat ${leafPath} 2>&1; echo --rc=$?`]);
-                // `stat` returns non-zero on ENOENT; the rc line carries
-                // the failure. Either is the contract; we accept either
-                // "No such file" or "cannot stat" wording across distros.
-                expect(result.stdout).toMatch(/--rc=[1-9]/);
-                expect(result.stdout.toLowerCase()).toMatch(/no such file|cannot stat|does not exist/);
-            }
-        }
-        finally {
-            await sandbox.destroy();
-        }
-    }, 60_000);
-    it('uid 1001 cannot mkdir into the root-owned 0555 parent /mnt/user-data', async () => {
-        const provider = createSandboxProvider({
-            backend: { tier: 'container', image: IMAGE },
-            layout: {
-                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
-            },
-        });
-        const sandbox = await provider.create();
-        try {
-            // The model trying to "create the missing leaf dir" hits
-            // the 0555 root-owned parent and is denied — exactly what
-            // distinguishes "not bound" from "writable empty dir".
-            const result = await sandbox.exec('sh', [
-                '-c',
-                'mkdir /mnt/user-data/fake 2>&1; echo --rc=$?',
-            ]);
-            expect(result.stdout).toMatch(/--rc=[1-9]/);
-            expect(result.stdout.toLowerCase()).toMatch(/permission denied/);
-        }
-        finally {
-            await sandbox.destroy();
-        }
-    }, 60_000);
-});
-//# sourceMappingURL=leaf-permissions.smoke.test.js.map

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"leaf-permissions.smoke.test.js","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/leaf-permissions.smoke.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAElE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,4BAA4B,CAAA;AACnF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAA;AAEvC,SAAS,eAAe;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE;QACjF,KAAK,EAAE,QAAQ;KACf,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE;IACpC,CAAC,CAAC,mDAAmD;IACrD,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,SAAS,KAAK,kDAAkD,KAAK,sEAAsE;QAC7I,CAAC,CAAC,IAAI,CAAA;AAER,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,qEAAqE;AACrE,kDAAkD;AAClD,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,KAAK,CACd,iDAAiD,UAAU,0FAA0F,CACrJ,CAAA;AACF,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC5E,IAAI,WAAmB,CAAA;IAEvB,SAAS,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;aAC/D;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvC,IAAI;gBACJ,0DAA0D;aAC1D,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACzC,gDAAgD;YAChD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;YACxE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;gBAC/D,0DAA0D;gBAC1D,uDAAuD;gBACvD,uDAAuD;gBACvD,gCAAgC;aAChC;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,KAAK,MAAM,QAAQ,IAAI;gBACtB,wBAAwB;gBACxB,6BAA6B;gBAC7B,kBAAkB;aAClB,EAAE,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,QAAQ,qBAAqB,CAAC,CAAC,CAAA;gBACtF,yDAAyD;gBACzD,wDAAwD;gBACxD,0DAA0D;gBAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAA;YACvF,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;aAC/D;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,yDAAyD;YACzD,0DAA0D;YAC1D,uDAAuD;YACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvC,IAAI;gBACJ,8CAA8C;aAC9C,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACjE,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;AACX,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts

@@ -1,16 +0,0 @@
-/**
- * `resolveTimeoutMs` is the guest agent's only guard against a
- * caller-requested `timeoutMs` that has no schema ceiling upstream (it
- * traces back to the bash tool's model-authored `timeout` argument — see
- * `packages/sdk/src/tools/builtins/bash.ts`). A request above the cap must
- * be refused (the sibling `worker/server.js` answers `invalid_timeout` on
- * response), not silently shortened — a caller that asked for more and got
- * less without being told would believe its process was protected for the
- * duration it actually asked for.
- *
- * Pure-function test, no socket/process involved, so it runs on every
- * platform (unlike `backend.test.ts` / `transport.test.ts`, which spawn
- * `/bin/sh` and skip on Windows).
- */
-export {};
-//# sourceMappingURL=agent-timeout-clamp.test.d.ts.map

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-timeout-clamp.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/agent-timeout-clamp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js

@@ -1,37 +0,0 @@
-/**
- * `resolveTimeoutMs` is the guest agent's only guard against a
- * caller-requested `timeoutMs` that has no schema ceiling upstream (it
- * traces back to the bash tool's model-authored `timeout` argument — see
- * `packages/sdk/src/tools/builtins/bash.ts`). A request above the cap must
- * be refused (the sibling `worker/server.js` answers `invalid_timeout` on
- * response), not silently shortened — a caller that asked for more and got
- * less without being told would believe its process was protected for the
- * duration it actually asked for.
- *
- * Pure-function test, no socket/process involved, so it runs on every
- * platform (unlike `backend.test.ts` / `transport.test.ts`, which spawn
- * `/bin/sh` and skip on Windows).
- */
-import { createRequire } from 'node:module';
-import { describe, expect, it } from 'vitest';
-const require_ = createRequire(import.meta.url);
-const agent = require_('../../../../agent/agent.cjs');
-describe('agent.cjs resolveTimeoutMs', () => {
-    it('passes through a caller value within the cap', () => {
-        expect(agent.resolveTimeoutMs(10_000)).toBe(10_000);
-    });
-    it('falls back to the default for an omitted value', () => {
-        expect(agent.resolveTimeoutMs(undefined)).toBe(5 * 60 * 1000);
-    });
-    it('refuses a request far above the cap instead of honoring or silently shortening it', () => {
-        expect(() => agent.resolveTimeoutMs(Number.MAX_SAFE_INTEGER)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(10 ** 12)).toThrow(/timeoutMs/);
-    });
-    it('refuses a non-finite or non-positive value', () => {
-        expect(() => agent.resolveTimeoutMs(0)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(-1)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(Number.NaN)).toThrow(/timeoutMs/);
-        expect(() => agent.resolveTimeoutMs(Number.POSITIVE_INFINITY)).toThrow(/timeoutMs/);
-    });
-});
-//# sourceMappingURL=agent-timeout-clamp.test.js.map

package/dist/backends/firecracker/__tests__/agent-timeout-clamp.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-timeout-clamp.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/agent-timeout-clamp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAM/C,MAAM,KAAK,GAAG,QAAQ,CAAC,6BAA6B,CAAgB,CAAA;AAEpE,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/backend.test.d.ts

@@ -1,13 +0,0 @@
-/**
- * Firecracker `SandboxBackend` end-to-end over the loopback agent.
- *
- * Stubs the orchestrator control plane (`fetch` for `/sandboxes` create
- * + `:delete`) and points the returned vsock handle at a unix-socket
- * loopback running the REAL `agent/agent.cjs`. Proves the full
- * {@link Sandbox} handle the SDK consumes — `exec` / `writeFile` /
- * `readFile` / `listFiles` / `destroy` / `status` — speaks the NDJSON
- * wire over the vsock transport, and that the readiness fence waits on
- * the agent's healthz (not the orchestrator 2xx).
- */
-export {};
-//# sourceMappingURL=backend.test.d.ts.map

package/dist/backends/firecracker/__tests__/backend.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"backend.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/backend.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}