@omg-dev/sandbox 0.4.40 → 0.4.42

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { _ as SandboxApiError, a as check, c as defineTemplate, d as run, f as templateContentVersionRef, g as waitForSnapshotUpload, h as templateVersionRef, i as bakeTemplate, l as download, m as templateRuntimeContract, n as applyTemplate, o as compileStartScript, p as templateDefinitionHash, r as apt, s as compileStep, t as APT_FORCE_IPV4_SNIPPET, u as files, v as SandboxClient, y as assertTemplateId } from "./templates-D-Ap1Yxk.mjs";
-export { APT_FORCE_IPV4_SNIPPET, SandboxApiError, SandboxClient, applyTemplate, apt, assertTemplateId, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };
+import { _ as waitForSnapshotUpload, a as canonicalTemplateSourceDir, b as assertTemplateId, c as compileStep, d as files, f as run, g as templateVersionRef, h as templateRuntimeContract, i as bakeTemplate, l as defineTemplate, m as templateDefinitionHash, n as applyTemplate, o as check, p as templateContentVersionRef, r as apt, s as compileStartScript, t as APT_FORCE_IPV4_SNIPPET, u as download, v as SandboxApiError, y as SandboxClient } from "./templates-DRLyKqoS.mjs";
+export { APT_FORCE_IPV4_SNIPPET, SandboxApiError, SandboxClient, applyTemplate, apt, assertTemplateId, bakeTemplate, canonicalTemplateSourceDir, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };

package/dist/{templates-D-Ap1Yxk.mjs → templates-DRLyKqoS.mjs}

@@ -167,8 +167,24 @@ function templateContentVersionRef(definition, contentKey) {
 	const hash = createHash("sha256").update(`${templateDefinitionHash(definition)}\n${contentKey.trim()}`).digest("hex").slice(0, 8);
 	return refWithSuffix(definition.id, `-v${definition.version.toLowerCase().replace(/[^a-z0-9-]+/g, "-")}-${hash}`);
 }
+function canonicalTemplateSourceDir(sourceDir) {
+	const normalized = sourceDir.replaceAll("\\", "/").replace(/\/+$/, "");
+	const marker = normalized.lastIndexOf("/templates/");
+	return marker < 0 ? normalized : normalized.slice(marker + 1);
+}
 function templateDefinitionHash(definition) {
-	return createHash("sha256").update(JSON.stringify(definition)).digest("hex");
+	const canonical = {
+		...definition,
+		install: definition.install.map((step) => step.kind === "files" ? {
+			...step,
+			sourceDir: canonicalTemplateSourceDir(step.sourceDir)
+		} : step),
+		__rendered: {
+			start: definition.start ? compileStartScript(definition.start) : null,
+			install: definition.install.map((step) => step.kind === "files" ? null : compileStep(step).script)
+		}
+	};
+	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 function templateRuntimeContract(definition, immutableRef) {
 	return {
@@ -189,7 +205,8 @@ const PROXY_ENV_VARS = [
 	"ANTHROPIC_API_KEY",
 	"OPENAI_BASE_URL",
 	"OPENAI_API_KEY",
-	"OMG_MEDIA_URL"
+	"OMG_MEDIA_URL",
+	"OMG_SCHEDULE_URL"
 ];
 function commandForUser(command, user) {
 	if (!user) return `/bin/bash -lc ${quote(command)}`;
@@ -421,4 +438,4 @@ async function resolveTemplateVersion(client, versionRef) {
 	}
 }
 //#endregion
-export { SandboxApiError as _, check as a, defineTemplate as c, run as d, templateContentVersionRef as f, waitForSnapshotUpload as g, templateVersionRef as h, bakeTemplate as i, download as l, templateRuntimeContract as m, applyTemplate as n, compileStartScript as o, templateDefinitionHash as p, apt as r, compileStep as s, APT_FORCE_IPV4_SNIPPET as t, files as u, SandboxClient as v, assertTemplateId as y };
+export { waitForSnapshotUpload as _, canonicalTemplateSourceDir as a, assertTemplateId as b, compileStep as c, files as d, run as f, templateVersionRef as g, templateRuntimeContract as h, bakeTemplate as i, defineTemplate as l, templateDefinitionHash as m, applyTemplate as n, check as o, templateContentVersionRef as p, apt as r, compileStartScript as s, APT_FORCE_IPV4_SNIPPET as t, download as u, SandboxApiError as v, SandboxClient as y };

package/dist/templates.mjs

@@ -1,2 +1,2 @@
-import { a as check, c as defineTemplate, d as run, f as templateContentVersionRef, g as waitForSnapshotUpload, h as templateVersionRef, i as bakeTemplate, l as download, m as templateRuntimeContract, n as applyTemplate, o as compileStartScript, p as templateDefinitionHash, r as apt, s as compileStep, t as APT_FORCE_IPV4_SNIPPET, u as files } from "./templates-D-Ap1Yxk.mjs";
-export { APT_FORCE_IPV4_SNIPPET, applyTemplate, apt, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };
+import { _ as waitForSnapshotUpload, a as canonicalTemplateSourceDir, c as compileStep, d as files, f as run, g as templateVersionRef, h as templateRuntimeContract, i as bakeTemplate, l as defineTemplate, m as templateDefinitionHash, n as applyTemplate, o as check, p as templateContentVersionRef, r as apt, s as compileStartScript, t as APT_FORCE_IPV4_SNIPPET, u as download } from "./templates-DRLyKqoS.mjs";
+export { APT_FORCE_IPV4_SNIPPET, applyTemplate, apt, bakeTemplate, canonicalTemplateSourceDir, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omg-dev/sandbox",
-  "version": "0.4.40",
+  "version": "0.4.42",
   "type": "module",
   "exports": {
     ".": {

package/src/client.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { SandboxClient } from "./client";
-import { bakeTemplate, defineTemplate, templateContentVersionRef, templateVersionRef } from "./templates";
+import { bakeTemplate, defineTemplate, files, templateContentVersionRef, templateVersionRef } from "./templates";
 
 interface RecordedCall { method: string; path: string; body?: unknown; owner?: string | null }
 
@@ -63,6 +63,33 @@ describe("template version identity", () => {
     expect(templateContentVersionRef(bumped, "rootfs-sha-1")).not.toBe(ref);
   });
 
+  test("content ref does not depend on where the repo is checked out", () => {
+    // A files step carries an absolute sourceDir resolved from the authoring
+    // checkout, so hashing it raw gave CI (/home/runner/actions-runner/_work/…)
+    // and any other checkout different identities for byte-identical content.
+    // The updater's bake gate recomputes the published ref to decide whether
+    // the pinned version is live — a path-dependent ref would report a perfectly
+    // baked template as unbaked and rebake it every hour.
+    const at = (root: string) =>
+      defineTemplate({
+        ...definition,
+        install: [files.copy({ sourceDir: `${root}/templates/react-ts`, destination: "/home/user/project" })],
+      });
+    expect(templateContentVersionRef(at("/home/runner/actions-runner/_work/vibes/vibes"), "rootfs-sha-1")).toBe(
+      templateContentVersionRef(at("/home/dev/lfg-worktrees/lfg-a0f114"), "rootfs-sha-1"),
+    );
+    // …but which directory is copied still changes the identity.
+    expect(templateContentVersionRef(at("/repo"), "rootfs-sha-1")).not.toBe(
+      templateContentVersionRef(
+        defineTemplate({
+          ...definition,
+          install: [files.copy({ sourceDir: "/repo/templates/react-ts-start", destination: "/home/user/project" })],
+        }),
+        "rootfs-sha-1",
+      ),
+    );
+  });
+
   test("empty content key fails loud instead of falling back to the static ref", () => {
     expect(() => templateContentVersionRef(definition, "")).toThrow(/content key/);
     expect(() => templateContentVersionRef(definition, "   ")).toThrow(/content key/);

package/src/templates.test.ts

@@ -1,7 +1,12 @@
 import { describe, expect, test } from "bun:test";
 import { join } from "node:path";
 import { applyTemplate, apt, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateRuntimeContract, templateVersionRef } from "./templates";
-import { agentTemplates, CLOUD_COMPUTER_DEFAULT_FOLDER } from "../../../templates/agent-catalog";
+import {
+  agentTemplates,
+  CLOUD_COMPUTER_DEFAULT_FOLDER,
+  FREE_OPENCODE_MODEL,
+  OPENCODE_GLOBAL_CONFIG,
+} from "../../../templates/agent-catalog";
 import type { Sandbox } from "./client";
 
 const FIXTURE_DIR = join(import.meta.dirname, "__fixtures__", "mini-template");
@@ -158,7 +163,12 @@ describe("sandbox templates", () => {
 
   test("LFG owns every runtime dependency and zero-config transport default", () => {
     const lfg = agentTemplates.lfg;
-    expect(templateVersionRef(lfg)).toBe("agent-lfg-v81");
+    // Derived, not a literal: update-lfg-app.yml bumps this template's version
+    // on every LFG release, so a hardcoded ref rots the moment a release lands
+    // (this asserted v81 while the catalog was already at v102, leaving
+    // ci-packages red-in-waiting for the next packages/** change).
+    const lfgRef = `agent-lfg-v${lfg.version}`;
+    expect(templateVersionRef(lfg)).toBe(lfgRef);
     expect(lfg.install).toContainEqual(apt.packages(["tmux"]));
     expect(lfg.checks).toContainEqual(check.command("tmux"));
     expect(lfg.checks).toContainEqual(check.file("/home/user/lfg/omg-start.sh"));
@@ -166,7 +176,7 @@ describe("sandbox templates", () => {
     expect(lfg.start?.env?.LIVE_TRANSPORT).toBe("ws");
     expect(lfg.start?.readiness?.port).toBe(8766);
     expect(templateRuntimeContract(lfg, templateVersionRef(lfg))).toEqual({
-      immutableRef: "agent-lfg-v81",
+      immutableRef: lfgRef,
       restoreKind: "full_rootfs",
       startCommand: "exec /home/user/.omg/template/bootstrap.sh",
       readinessPort: 8766,
@@ -177,6 +187,11 @@ describe("sandbox templates", () => {
     const commands = lfg.install
       .filter((step): step is Extract<typeof step, { kind: "run" }> => step.kind === "run")
       .map((step) => step.command);
+    const packageInstalls = commands.filter((command) => command.includes("bun install"));
+    expect(packageInstalls).toHaveLength(6);
+    for (const command of packageInstalls) {
+      expect(command).toContain("trap 'rm -rf /home/user/.bun/install/cache' EXIT");
+    }
     const startScript = commands.find((command) => command.includes("OMG_START_EOF"));
     expect(startScript).toBeDefined();
     expect(startScript!).toContain("LFG_CONNECT_EVENTS=1");
@@ -192,6 +207,31 @@ describe("sandbox templates", () => {
     expect(startScript!).toContain('cd "$LFG_ROOT"');
   });
 
+  test("OpenCode utility agents stay on the credential-free model", () => {
+    expect(OPENCODE_GLOBAL_CONFIG).toEqual({
+      $schema: "https://opencode.ai/config.json",
+      model: FREE_OPENCODE_MODEL,
+      small_model: FREE_OPENCODE_MODEL,
+      agent: {
+        title: { model: FREE_OPENCODE_MODEL },
+        summary: { model: FREE_OPENCODE_MODEL },
+        compaction: { model: FREE_OPENCODE_MODEL },
+      },
+    });
+
+    expect(Object.keys(agentTemplates)).toEqual(["lfg"]);
+    const commands = agentTemplates.lfg.install
+      .filter((step): step is Extract<typeof step, { kind: "run" }> => step.kind === "run")
+      .map((step) => step.command);
+    const config = commands.find((command) => command.includes("opencode.jsonc"));
+    expect(config).toBeDefined();
+    expect(config).toContain(`\"small_model\":\"${FREE_OPENCODE_MODEL}\"`);
+    expect(config).toContain(`\"title\":{\"model\":\"${FREE_OPENCODE_MODEL}\"}`);
+    expect(config).toContain(`\"summary\":{\"model\":\"${FREE_OPENCODE_MODEL}\"}`);
+    expect(config).toContain(`\"compaction\":{\"model\":\"${FREE_OPENCODE_MODEL}\"}`);
+    expect(agentTemplates.lfg.checks).toContainEqual(check.file("/home/user/.config/opencode/opencode.jsonc"));
+  });
+
   test("LFG bakes the react-ts scaffold into /home/user/project at bake time", () => {
     const lfg = agentTemplates.lfg;
     const filesSteps = lfg.install.filter((step) => step.kind === "files");

package/src/templates.ts

@@ -138,8 +138,48 @@ export function templateContentVersionRef(definition: SandboxTemplate, contentKe
   return refWithSuffix(definition.id, `-v${definition.version.toLowerCase().replace(/[^a-z0-9-]+/g, "-")}-${hash}`);
 }
 
+// A files step's sourceDir is an absolute path the definition resolved from
+// whatever checkout authored it (templates/agent-catalog.ts builds it from
+// import.meta.dirname), so hashing it raw makes the bake identity depend on
+// WHERE the repo happens to live: byte-identical content hashes differently
+// under /home/runner/actions-runner/_work/... than under a local worktree.
+// Strip the checkout prefix so the ref a bake published can be recomputed
+// anywhere — that reproducibility is what lets template-bake-status.ts ask the
+// registry "is the definition on main the one that is live?" instead of
+// inferring it from whether this run happened to change the pin.
+export function canonicalTemplateSourceDir(sourceDir: string): string {
+  const normalized = sourceDir.replaceAll("\\", "/").replace(/\/+$/, "");
+  const marker = normalized.lastIndexOf("/templates/");
+  return marker < 0 ? normalized : normalized.slice(marker + 1);
+}
+
+// NOTE: this still hashes the definition, not the bytes under a files step's
+// sourceDir — a templates/react-ts-only change does not invalidate a snapshot
+// that copies it, and still needs a hand-bumped `version` (see the comment on
+// files.copy in templates/agent-catalog.ts).
 export function templateDefinitionHash(definition: SandboxTemplate): string {
-  return createHash("sha256").update(JSON.stringify(definition)).digest("hex");
+  const canonical = {
+    ...definition,
+    install: definition.install.map((step) =>
+      step.kind === "files"
+        ? { ...step, sourceDir: canonicalTemplateSourceDir(step.sourceDir) }
+        : step,
+    ),
+    // The rendered codegen, not just the definition. The generators
+    // (compileStartScript / commandForUser / compileStep) are part of what a
+    // snapshot bakes — the definition alone missed the OMG_SCHEDULE_URL
+    // supervisor-wrapper fix on 2026-08-13: every template answered "reused
+    // existing immutable version" and the fleet kept forking snapshots whose
+    // baked serve env predated the change. Hashing the rendered scripts makes
+    // any generator change invalidate exactly the templates it affects.
+    __rendered: {
+      start: definition.start ? compileStartScript(definition.start) : null,
+      install: definition.install.map((step) =>
+        step.kind === "files" ? null : compileStep(step).script,
+      ),
+    },
+  };
+  return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 
 export function templateRuntimeContract(definition: SandboxTemplate, immutableRef?: string) {
@@ -163,7 +203,16 @@ function quote(value: string): string { return `'${value.replaceAll("'", `'\"'\"
 // literal VAR=value args to env(1) is not "preserving" the invoking shell's
 // env (which sudoers' env_reset would still block) — it is env(1) itself
 // setting them in the de-privileged child, which needs no sudoers policy.
-const PROXY_ENV_VARS = ["OMG_AI_URL", "ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY", "OPENAI_BASE_URL", "OPENAI_API_KEY", "OMG_MEDIA_URL"];
+//
+// THIS LIST HAS THREE COPIES that must stay in sync — a var missing here is
+// invisible to the template's long-lived `start` process (the baked serve)
+// while still present on ad-hoc execs, which is exactly the split that made
+// OMG_SCHEDULE_URL silently absent from every fresh Computer's lfg serve
+// (wake-hooks e2e, 2026-08-13) while an in-VM probe of the same var worked:
+//   1. apps/infra/internal/orchestrator/manager.go (ExecContext — the source)
+//   2. apps/infra/internal/agenttemplates/catalog.go (legacy agent-serve.sh)
+//   3. here (current bootstrap.sh supervisor wrapper)
+const PROXY_ENV_VARS = ["OMG_AI_URL", "ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY", "OPENAI_BASE_URL", "OPENAI_API_KEY", "OMG_MEDIA_URL", "OMG_SCHEDULE_URL"];
 
 function commandForUser(command: string, user?: string): string {
   if (!user) return `/bin/bash -lc ${quote(command)}`;