@omg-dev/sandbox 0.4.27 → 0.4.29

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { _ as SandboxClient, a as compileStartScript, c as download, d as templateContentVersionRef, f as templateDefinitionHash, g as SandboxApiError, h as waitForSnapshotUpload, i as check, l as files, m as templateVersionRef, n as apt, o as compileStep, p as templateRuntimeContract, r as bakeTemplate, s as defineTemplate, t as applyTemplate, u as run, v as assertTemplateId } from "./templates-D2llpqYs.mjs";
+import { _ as SandboxClient, a as compileStartScript, c as download, d as templateContentVersionRef, f as templateDefinitionHash, g as SandboxApiError, h as waitForSnapshotUpload, i as check, l as files, m as templateVersionRef, n as apt, o as compileStep, p as templateRuntimeContract, r as bakeTemplate, s as defineTemplate, t as applyTemplate, u as run, v as assertTemplateId } from "./templates-C3mBSGdT.mjs";
 export { SandboxApiError, SandboxClient, applyTemplate, apt, assertTemplateId, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };

package/dist/{templates-D2llpqYs.mjs → templates-C3mBSGdT.mjs}

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
 //#region src/client.ts
@@ -228,6 +228,67 @@ function compileStartScript(start) {
 async function assertExec(label, result) {
 	if (result.exitCode !== 0) throw new Error(`${label} failed (${result.exitCode}): ${(result.stderr || result.stdout).trim().slice(-1200)}`);
 }
+async function runTemplateStep(sandbox, label, script, timeoutMs) {
+	const workDir = `/tmp/omg-template-step-${randomUUID()}`;
+	const pidPath = `${workDir}/pid`;
+	const statusPath = `${workDir}/status`;
+	const stdoutPath = `${workDir}/stdout`;
+	const stderrPath = `${workDir}/stderr`;
+	const wrapper = [
+		"set -u",
+		`mkdir -p ${quote(workDir)}`,
+		`printf '%s\\n' \"$$\" > ${quote(pidPath)}`,
+		`set +e; /bin/bash -lc ${quote(script)} > ${quote(stdoutPath)} 2> ${quote(stderrPath)}`,
+		"code=$?",
+		`printf '%s\\n' \"$code\" > ${quote(`${statusPath}.tmp`)}`,
+		`mv ${quote(`${statusPath}.tmp`)} ${quote(statusPath)}`,
+		"exit \"$code\""
+	].join("\n");
+	const prepared = await sandbox.shell(`mkdir -p ${quote(workDir)}`, { timeoutMs: 1e4 });
+	await assertExec(`${label} workspace preparation`, prepared);
+	const deadline = Date.now() + timeoutMs;
+	const launchDeadline = Math.min(deadline, Date.now() + 1e4);
+	try {
+		if (!(await sandbox.shell(wrapper, { detached: true })).commandId) throw new Error(`${label} did not start as a detached guest command`);
+		while (Date.now() < deadline) {
+			const probe = await sandbox.shell([
+				`if test -f ${quote(statusPath)}; then`,
+				"  printf 'done\\n'",
+				`  cat ${quote(statusPath)}`,
+				`elif test -f ${quote(pidPath)} && kill -0 \"$(cat ${quote(pidPath)})\" 2>/dev/null; then`,
+				"  printf 'running\\n'",
+				`elif test ! -f ${quote(pidPath)}; then`,
+				"  printf 'starting\\n'",
+				"else",
+				"  printf 'lost\\n'",
+				"fi"
+			].join("\n"), { timeoutMs: 1e4 });
+			await assertExec(`${label} status probe`, probe);
+			const [state, rawExitCode] = probe.stdout.trim().split(/\s+/, 2);
+			if (state === "done") {
+				const exitCode = Number(rawExitCode);
+				if (!Number.isInteger(exitCode)) throw new Error(`${label} wrote an invalid exit status: ${JSON.stringify(rawExitCode)}`);
+				const stdout = await sandbox.shell(`cat ${quote(stdoutPath)} 2>/dev/null || true`, { timeoutMs: 1e4 });
+				const stderr = await sandbox.shell(`cat ${quote(stderrPath)} 2>/dev/null || true`, { timeoutMs: 1e4 });
+				await assertExec(`${label} stdout read`, stdout);
+				await assertExec(`${label} stderr read`, stderr);
+				return {
+					exitCode,
+					stdout: stdout.stdout,
+					stderr: stderr.stdout
+				};
+			}
+			if (state === "lost") throw new Error(`${label} guest process exited without a completion record`);
+			if (state === "starting" && Date.now() >= launchDeadline) throw new Error(`${label} guest process never initialized`);
+			if (state !== "running" && state !== "starting") throw new Error(`${label} returned an invalid guest state: ${JSON.stringify(state)}`);
+			await new Promise((resolve) => setTimeout(resolve, 1e3));
+		}
+		await sandbox.shell(`test ! -f ${quote(pidPath)} || kill \"$(cat ${quote(pidPath)})\" 2>/dev/null || true`, { timeoutMs: 1e4 }).catch(() => {});
+		throw new Error(`${label} exceeded its ${timeoutMs}ms guest execution deadline`);
+	} finally {
+		await sandbox.shell(`rm -rf ${quote(workDir)}`, { timeoutMs: 1e4 }).catch(() => {});
+	}
+}
 const FILES_STEP_SKIP_NAMES = new Set([".gitkeep", ".DS_Store"]);
 async function walkSourceDir(dir) {
 	const out = [];
@@ -272,7 +333,8 @@ async function applyTemplate(sandbox, definition, onLog = () => {}) {
 			continue;
 		}
 		const compiled = compileStep(step);
-		await assertExec(`template step ${index + 1}`, await sandbox.shell(compiled.script, { timeoutMs: compiled.timeoutMs ?? 10 * 6e4 }));
+		const label = `template step ${index + 1}`;
+		await assertExec(label, await runTemplateStep(sandbox, label, compiled.script, compiled.timeoutMs ?? 10 * 6e4));
 	}
 	if (definition.start) await sandbox.writeFiles([{
 		path: "/home/user/.omg/template/bootstrap.sh",

package/dist/templates.mjs

@@ -1,2 +1,2 @@
-import { a as compileStartScript, c as download, d as templateContentVersionRef, f as templateDefinitionHash, h as waitForSnapshotUpload, i as check, l as files, m as templateVersionRef, n as apt, o as compileStep, p as templateRuntimeContract, r as bakeTemplate, s as defineTemplate, t as applyTemplate, u as run } from "./templates-D2llpqYs.mjs";
+import { a as compileStartScript, c as download, d as templateContentVersionRef, f as templateDefinitionHash, h as waitForSnapshotUpload, i as check, l as files, m as templateVersionRef, n as apt, o as compileStep, p as templateRuntimeContract, r as bakeTemplate, s as defineTemplate, t as applyTemplate, u as run } from "./templates-C3mBSGdT.mjs";
 export { applyTemplate, apt, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omg-dev/sandbox",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "type": "module",
   "exports": {
     ".": {

package/src/templates.test.ts

@@ -87,28 +87,80 @@ describe("sandbox templates", () => {
     await expect(applyTemplate(sandbox, definition)).rejects.toThrow();
   });
 
+  test("applyTemplate runs install commands out of band from the CDN request window", async () => {
+    const calls: Array<{ script: string; detached?: boolean }> = [];
+    const writes: Array<Array<{ path: string; content: Uint8Array | string; mode?: number }>> = [];
+    const sandbox: Sandbox = {
+      id: "fake",
+      exec: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
+      shell: async (script, options = {}) => {
+        calls.push({ script, detached: options.detached });
+        if (options.detached) return { stdout: "", stderr: "", exitCode: 0, commandId: "cmd-1" };
+        if (script.includes("printf 'done")) return { stdout: "done\n0\n", stderr: "", exitCode: 0 };
+        if (script.includes("/stdout")) return { stdout: "installed\n", stderr: "", exitCode: 0 };
+        if (script.includes("/stderr")) return { stdout: "", stderr: "", exitCode: 0 };
+        return { stdout: "", stderr: "", exitCode: 0 };
+      },
+      writeFiles: async (batch) => { writes.push(batch); },
+      snapshot: async () => ({ id: "snap", sizeBytes: 0, createdAt: new Date(0).toISOString() }),
+      stop: async () => {},
+    };
+
+    await applyTemplate(sandbox, defineTemplate({
+      id: "async-install",
+      version: "1",
+      title: "async install",
+      install: [run({ command: "sleep 120 && echo installed" })],
+    }));
+
+    const detached = calls.find((call) => call.detached);
+    expect(detached).toBeDefined();
+    expect(detached?.script).toContain("sleep 120 && echo installed");
+    expect(calls.some((call) => call.script.includes("printf 'done"))).toBe(true);
+    expect(calls.some((call) => call.script.includes("printf 'starting"))).toBe(true);
+    expect(writes.some((batch) => batch.some((file) => file.path.endsWith("definition.json")))).toBe(true);
+  });
+
+  test("applyTemplate preserves a detached install's failing exit status and stderr", async () => {
+    const sandbox = fakeSandbox();
+    sandbox.shell = async (script, options = {}) => {
+      if (options.detached) return { stdout: "", stderr: "", exitCode: 0, commandId: "cmd-2" };
+      if (script.includes("printf 'done")) return { stdout: "done\n42\n", stderr: "", exitCode: 0 };
+      if (script.includes("/stdout")) return { stdout: "", stderr: "", exitCode: 0 };
+      if (script.includes("/stderr")) return { stdout: "package exploded\n", stderr: "", exitCode: 0 };
+      return { stdout: "", stderr: "", exitCode: 0 };
+    };
+
+    await expect(applyTemplate(sandbox, defineTemplate({
+      id: "async-failure",
+      version: "1",
+      title: "async failure",
+      install: [run({ command: "exit 42" })],
+    }))).rejects.toThrow("package exploded");
+  });
+
   test("LFG owns every runtime dependency and zero-config transport default", () => {
     const lfg = agentTemplates.lfg;
-    expect(templateVersionRef(lfg)).toBe("agent-lfg-v14");
+    expect(templateVersionRef(lfg)).toBe("agent-lfg-v17");
     expect(lfg.install).toContainEqual(apt.packages(["tmux"]));
     expect(lfg.checks).toContainEqual(check.command("tmux"));
     expect(lfg.start?.env?.LIVE_TRANSPORT).toBe("ws");
     expect(lfg.start?.readiness?.port).toBe(8766);
     expect(templateRuntimeContract(lfg, templateVersionRef(lfg))).toEqual({
-      immutableRef: "agent-lfg-v14",
+      immutableRef: "agent-lfg-v17",
       startCommand: "exec /home/user/.omg/template/bootstrap.sh",
       readinessPort: 8766,
       readinessPath: "/",
-      ports: [8766],
+      ports: [8766, 5173],
     });
   });
 
-  test("LFG bakes the react-ts scaffold into /home/user/app at bake time", () => {
+  test("LFG bakes the react-ts scaffold into /home/user/project at bake time", () => {
     const lfg = agentTemplates.lfg;
     const filesSteps = lfg.install.filter((step) => step.kind === "files");
     expect(filesSteps).toHaveLength(1);
     const scaffold = filesSteps[0] as Extract<(typeof filesSteps)[number], { kind: "files" }>;
-    expect(scaffold.destination).toBe("/home/user/app");
+    expect(scaffold.destination).toBe("/home/user/project");
     expect(scaffold.sourceDir.endsWith(join("templates", "react-ts"))).toBe(true);
     // recipe.sh (shadcn init) must run against the baked scaffold, not just
     // land on disk unused — otherwise Computers still improvise shadcn init
@@ -117,6 +169,6 @@ describe("sandbox templates", () => {
       .filter((step): step is Extract<typeof step, { kind: "run" }> => step.kind === "run")
       .map((step) => step.command);
     expect(commands.some((c) => c.includes("recipe.sh"))).toBe(true);
-    expect(lfg.metadata?.lfgRelease).toBe("v0.1.39");
+    expect(lfg.metadata?.lfgRelease).toBe("v0.1.40");
   });
 });

package/src/templates.ts

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { readdir, readFile } from "node:fs/promises";
 import { join, relative } from "node:path";
 import type { Sandbox, SandboxClient, Snapshot } from "./client.js";
@@ -203,6 +203,77 @@ async function assertExec(label: string, result: { exitCode: number; stdout: str
   if (result.exitCode !== 0) throw new Error(`${label} failed (${result.exitCode}): ${(result.stderr || result.stdout).trim().slice(-1200)}`);
 }
 
+// Template installs routinely outlive Cloudflare's request window (apt and
+// package-manager steps can take several minutes). A blocking /exec request
+// therefore makes a healthy guest look failed with a 524. Launch the command
+// inside the guest and make its on-disk completion record the authority; every
+// control-plane request below is short and bounded, while exit status and logs
+// still fail loud exactly once.
+async function runTemplateStep(
+  sandbox: Sandbox,
+  label: string,
+  script: string,
+  timeoutMs: number,
+): Promise<{ exitCode: number; stdout: string; stderr: string }> {
+  const workDir = `/tmp/omg-template-step-${randomUUID()}`;
+  const pidPath = `${workDir}/pid`;
+  const statusPath = `${workDir}/status`;
+  const stdoutPath = `${workDir}/stdout`;
+  const stderrPath = `${workDir}/stderr`;
+  const wrapper = [
+    "set -u",
+    `mkdir -p ${quote(workDir)}`,
+    `printf '%s\\n' \"$$\" > ${quote(pidPath)}`,
+    `set +e; /bin/bash -lc ${quote(script)} > ${quote(stdoutPath)} 2> ${quote(stderrPath)}`,
+    "code=$?",
+    `printf '%s\\n' \"$code\" > ${quote(`${statusPath}.tmp`)}`,
+    `mv ${quote(`${statusPath}.tmp`)} ${quote(statusPath)}`,
+    "exit \"$code\"",
+  ].join("\n");
+
+  const prepared = await sandbox.shell(`mkdir -p ${quote(workDir)}`, { timeoutMs: 10_000 });
+  await assertExec(`${label} workspace preparation`, prepared);
+  const deadline = Date.now() + timeoutMs;
+  const launchDeadline = Math.min(deadline, Date.now() + 10_000);
+  try {
+    const started = await sandbox.shell(wrapper, { detached: true });
+    if (!started.commandId) throw new Error(`${label} did not start as a detached guest command`);
+    while (Date.now() < deadline) {
+      const probe = await sandbox.shell([
+        `if test -f ${quote(statusPath)}; then`,
+        "  printf 'done\\n'",
+        `  cat ${quote(statusPath)}`,
+        `elif test -f ${quote(pidPath)} && kill -0 \"$(cat ${quote(pidPath)})\" 2>/dev/null; then`,
+        "  printf 'running\\n'",
+        `elif test ! -f ${quote(pidPath)}; then`,
+        "  printf 'starting\\n'",
+        "else",
+        "  printf 'lost\\n'",
+        "fi",
+      ].join("\n"), { timeoutMs: 10_000 });
+      await assertExec(`${label} status probe`, probe);
+      const [state, rawExitCode] = probe.stdout.trim().split(/\s+/, 2);
+      if (state === "done") {
+        const exitCode = Number(rawExitCode);
+        if (!Number.isInteger(exitCode)) throw new Error(`${label} wrote an invalid exit status: ${JSON.stringify(rawExitCode)}`);
+        const stdout = await sandbox.shell(`cat ${quote(stdoutPath)} 2>/dev/null || true`, { timeoutMs: 10_000 });
+        const stderr = await sandbox.shell(`cat ${quote(stderrPath)} 2>/dev/null || true`, { timeoutMs: 10_000 });
+        await assertExec(`${label} stdout read`, stdout);
+        await assertExec(`${label} stderr read`, stderr);
+        return { exitCode, stdout: stdout.stdout, stderr: stderr.stdout };
+      }
+      if (state === "lost") throw new Error(`${label} guest process exited without a completion record`);
+      if (state === "starting" && Date.now() >= launchDeadline) throw new Error(`${label} guest process never initialized`);
+      if (state !== "running" && state !== "starting") throw new Error(`${label} returned an invalid guest state: ${JSON.stringify(state)}`);
+      await new Promise((resolve) => setTimeout(resolve, 1_000));
+    }
+    await sandbox.shell(`test ! -f ${quote(pidPath)} || kill \"$(cat ${quote(pidPath)})\" 2>/dev/null || true`, { timeoutMs: 10_000 }).catch(() => {});
+    throw new Error(`${label} exceeded its ${timeoutMs}ms guest execution deadline`);
+  } finally {
+    await sandbox.shell(`rm -rf ${quote(workDir)}`, { timeoutMs: 10_000 }).catch(() => {});
+  }
+}
+
 const FILES_STEP_SKIP_NAMES = new Set([".gitkeep", ".DS_Store"]);
 
 async function walkSourceDir(dir: string): Promise<Array<{ relPath: string; buf: Buffer }>> {
@@ -251,7 +322,8 @@ export async function applyTemplate(sandbox: Sandbox, definition: SandboxTemplat
       continue;
     }
     const compiled = compileStep(step);
-    await assertExec(`template step ${index + 1}`, await sandbox.shell(compiled.script, { timeoutMs: compiled.timeoutMs ?? 10 * 60_000 }));
+    const label = `template step ${index + 1}`;
+    await assertExec(label, await runTemplateStep(sandbox, label, compiled.script, compiled.timeoutMs ?? 10 * 60_000));
   }
   if (definition.start) {
     await sandbox.writeFiles([{ path: "/home/user/.omg/template/bootstrap.sh", content: compileStartScript(definition.start), mode: 0o755 }]);