@opengeni/runtime 0.4.0 → 0.6.0

package/dist/{chunk-HGQ252FL.js → chunk-BHA2SU3H.js}

@@ -249,8 +249,9 @@ var modalProvider = {
     if (settings.modalWorkspacePersistence) {
       options.workspacePersistence = settings.modalWorkspacePersistence;
     }
-    if (settings.modalImageRef) {
-      options.image = ModalImageSelector.fromTag(settings.modalImageRef);
+    const imageSelector = resolveModalImageSelector(settings);
+    if (imageSelector) {
+      options.image = imageSelector;
     }
     if (settings.modalTokenId) {
       options.tokenId = settings.modalTokenId;
@@ -264,6 +265,55 @@ var modalProvider = {
     return new ModalSandboxClient(options);
   }
 };
+var defaultModalLoader = () => import("modal");
+var resolvedRegistryImages = /* @__PURE__ */ new Map();
+var inFlightRegistryImages = /* @__PURE__ */ new Map();
+function registryImageCacheKey(settings) {
+  return [
+    settings.modalImageRef ?? "",
+    settings.modalImageRegistrySecret ?? "",
+    settings.modalEnvironment ?? ""
+  ].join("|");
+}
+async function ensureModalRegistryImage(settings, loadModal = defaultModalLoader) {
+  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {
+    return;
+  }
+  const key = registryImageCacheKey(settings);
+  if (resolvedRegistryImages.has(key)) {
+    return;
+  }
+  let pending = inFlightRegistryImages.get(key);
+  if (!pending) {
+    pending = (async () => {
+      const modal = await loadModal();
+      const client = new modal.ModalClient(modalClientOptions(settings));
+      const secret = await modal.Secret.fromName(
+        settings.modalImageRegistrySecret,
+        settings.modalEnvironment ? { environment: settings.modalEnvironment } : void 0
+      );
+      const image = client.images.fromRegistry(settings.modalImageRef, secret);
+      resolvedRegistryImages.set(key, image);
+    })().finally(() => {
+      inFlightRegistryImages.delete(key);
+    });
+    inFlightRegistryImages.set(key, pending);
+  }
+  await pending;
+}
+function cachedModalRegistryImage(settings) {
+  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {
+    return void 0;
+  }
+  return resolvedRegistryImages.get(registryImageCacheKey(settings));
+}
+function resolveModalImageSelector(settings) {
+  if (!settings.modalImageRef) {
+    return void 0;
+  }
+  const registryImage = cachedModalRegistryImage(settings);
+  return registryImage ? ModalImageSelector.fromImage(registryImage) : ModalImageSelector.fromTag(settings.modalImageRef);
+}
 function modalClientOptions(settings) {
   return {
     ...settings.modalTokenId ? { tokenId: settings.modalTokenId } : {},
@@ -637,6 +687,17 @@ function setSelfhostedApplyDiff(fn) {
   injectedApplyDiff = fn;
 }
 var SELFHOSTED_DEFAULT_TIMEOUT_MS = 3e4;
+var SELFHOSTED_EXEC_ENV_ALLOWLIST = ["OPENGENI_TOOLSPACE_URL", "OPENGENI_TOOLSPACE_TOKEN_FILE"];
+function selfhostedExecEnv(environment) {
+  const env = {};
+  for (const key of SELFHOSTED_EXEC_ENV_ALLOWLIST) {
+    const value = environment[key];
+    if (value) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
 var SELFHOSTED_RELAY_STREAM_PATH = "/stream";
 var SelfhostedSession = class {
   backendId = "selfhosted";
@@ -733,7 +794,11 @@ var SelfhostedSession = class {
       // SELFHOSTED_VIRTUAL_ROOT). Empty → the session workingDir (itself "" by
       // default ⇒ the agent runs in its workspace_root).
       cwd: toMachinePath(args.workdir, this.workingDir),
-      env: {},
+      // The machine owns its own shell environment; the manifest env is NOT
+      // exported here. The ONE exception is the non-secret toolspace pointers
+      // (URL + token-file path), so a programmatic `ogtool` call and the token-
+      // seed hook can find the tool surface. See SELFHOSTED_EXEC_ENV_ALLOWLIST.
+      env: selfhostedExecEnv(this.state.environment),
       stdin: new Uint8Array(0),
       timeoutMs: 0
     };
@@ -3621,6 +3686,7 @@ export {
   SandboxProviderUnavailableError,
   modalSandboxAttributionEnvironment,
   modalSandboxAttributionTags,
+  ensureModalRegistryImage,
   tagModalSandbox,
   terminateModalSandboxById,
   sweepModalOrphanSandboxes,
@@ -3711,4 +3777,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-HGQ252FL.js.map
+//# sourceMappingURL=chunk-BHA2SU3H.js.map