@rockclaver/sandcastle 0.7.0

package/dist/sandboxes/podman.js

@@ -0,0 +1,299 @@
+import { createRequire } from 'node:module';
+import { resolveUserMounts, processFileMountParents, formatVolumeMount, defaultImageName, registerShutdown } from '../chunk-VAKEM3U2.js';
+export { defaultImageName } from '../chunk-VAKEM3U2.js';
+import { createBindMountSandboxProvider } from '../chunk-BIWNFKGV.js';
+import { MAX_TAIL_CHARS, BoundedTail } from '../chunk-NGBM7T3E.js';
+import { execFile, execFileSync, spawn } from 'child_process';
+import { randomUUID } from 'crypto';
+import { createInterface } from 'readline';
+
+createRequire(import.meta.url);
+var podman = (options) => {
+  const configuredImageName = options?.imageName;
+  const selinuxLabel = options?.selinuxLabel ?? "z";
+  const userns = options?.userns ?? "keep-id";
+  const containerUid = options?.containerUid ?? 1e3;
+  const containerGid = options?.containerGid ?? 1e3;
+  const maxOutputTailChars = options?.maxOutputTailChars ?? MAX_TAIL_CHARS;
+  const sandboxHomedir = "/home/agent";
+  const userMounts = options?.mounts ? resolveUserMounts(options.mounts, sandboxHomedir) : [];
+  const parentDirsToCreate = processFileMountParents(
+    userMounts,
+    sandboxHomedir
+  );
+  return createBindMountSandboxProvider({
+    name: "podman",
+    env: options?.env,
+    sandboxHomedir,
+    create: async (createOptions) => {
+      const containerName = `sandcastle-${randomUUID()}`;
+      const worktreePath = createOptions.mounts.find(
+        (m) => m.hostPath === createOptions.worktreePath
+      )?.sandboxPath ?? "/home/agent/workspace";
+      const allMounts = [...createOptions.mounts, ...userMounts];
+      const volumeMounts = allMounts.map(
+        (m) => formatVolumeMount(m, selinuxLabel)
+      );
+      const imageName = configuredImageName ?? defaultImageName(createOptions.hostRepoPath);
+      if (process.platform === "darwin" || process.platform === "win32") {
+        await checkPodmanMachine();
+      }
+      await checkImageExists(imageName);
+      const env = { ...createOptions.env, HOME: "/home/agent" };
+      const envArgs = Object.entries(env).flatMap(([key, value]) => [
+        "-e",
+        `${key}=${value}`
+      ]);
+      const volumeArgs = volumeMounts.flatMap((v) => ["-v", v]);
+      const usernsArgs = userns ? [`--userns=keep-id:uid=${containerUid},gid=${containerGid}`] : [];
+      const userArgs = ["--user", `${containerUid}:${containerGid}`];
+      const networks = options?.network ? Array.isArray(options.network) ? options.network : [options.network] : [];
+      const networkArgs = networks.flatMap((n) => ["--network", n]);
+      const groupArgs = (options?.groups ?? []).flatMap((g) => [
+        "--group-add",
+        String(g)
+      ]);
+      const deviceArgs = (options?.devices ?? []).flatMap((d) => [
+        "--device",
+        d
+      ]);
+      const cpusArgs = options?.cpus !== void 0 ? ["--cpus", String(options.cpus)] : [];
+      await new Promise((resolve, reject) => {
+        execFile(
+          "podman",
+          [
+            "run",
+            "-d",
+            "--name",
+            containerName,
+            ...userArgs,
+            ...usernsArgs,
+            ...networkArgs,
+            ...groupArgs,
+            ...deviceArgs,
+            ...cpusArgs,
+            "-w",
+            worktreePath,
+            ...envArgs,
+            ...volumeArgs,
+            "--entrypoint",
+            "sleep",
+            imageName,
+            "infinity"
+          ],
+          (error) => {
+            if (error) {
+              reject(new Error(`podman run failed: ${error.message}`));
+            } else {
+              resolve();
+            }
+          }
+        );
+      });
+      for (const dir of parentDirsToCreate) {
+        await new Promise((resolve, reject) => {
+          execFile(
+            "podman",
+            [
+              "exec",
+              "--user",
+              "0:0",
+              containerName,
+              "sh",
+              "-c",
+              `mkdir -p "$1" && chown "$2" "$1"`,
+              "sh",
+              dir,
+              `${containerUid}:${containerGid}`
+            ],
+            (error) => {
+              if (error) {
+                reject(
+                  new Error(
+                    `Failed to create parent directory '${dir}' in container: ${error.message}`
+                  )
+                );
+              } else {
+                resolve();
+              }
+            }
+          );
+        });
+      }
+      const removeContainerSync = () => {
+        try {
+          execFileSync("podman", ["rm", "-f", containerName], {
+            stdio: "ignore",
+            timeout: 5e3
+          });
+        } catch {
+        }
+      };
+      const unregisterShutdown = registerShutdown(removeContainerSync);
+      const handle = {
+        worktreePath,
+        exec: (command, opts) => {
+          const effectiveCommand = opts?.sudo ? `sudo ${command}` : command;
+          const args = ["exec"];
+          if (opts?.stdin !== void 0) args.push("-i");
+          if (opts?.cwd) args.push("-w", opts.cwd);
+          args.push(containerName, "sh", "-c", effectiveCommand);
+          return new Promise((resolve, reject) => {
+            const proc = spawn("podman", args, {
+              stdio: [
+                opts?.stdin !== void 0 ? "pipe" : "ignore",
+                "pipe",
+                "pipe"
+              ]
+            });
+            if (opts?.stdin !== void 0) {
+              proc.stdin.write(opts.stdin);
+              proc.stdin.end();
+            }
+            proc.on("error", (error) => {
+              reject(new Error(`podman exec failed: ${error.message}`));
+            });
+            if (opts?.onLine) {
+              const onLine = opts.onLine;
+              const stdoutTail = new BoundedTail(maxOutputTailChars, "\n");
+              const stderrTail = new BoundedTail(maxOutputTailChars, "");
+              const rl = createInterface({ input: proc.stdout });
+              rl.on("line", (line) => {
+                stdoutTail.push(line);
+                onLine(line);
+              });
+              proc.stderr.on("data", (chunk) => {
+                stderrTail.push(chunk.toString());
+              });
+              proc.on("close", (code) => {
+                resolve({
+                  stdout: stdoutTail.toString(),
+                  stderr: stderrTail.toString(),
+                  exitCode: code ?? 0
+                });
+              });
+            } else {
+              const stdoutChunks = [];
+              const stderrChunks = [];
+              proc.stdout.on("data", (chunk) => {
+                stdoutChunks.push(chunk.toString());
+              });
+              proc.stderr.on("data", (chunk) => {
+                stderrChunks.push(chunk.toString());
+              });
+              proc.on("close", (code) => {
+                resolve({
+                  stdout: stdoutChunks.join(""),
+                  stderr: stderrChunks.join(""),
+                  exitCode: code ?? 0
+                });
+              });
+            }
+          });
+        },
+        interactiveExec: (args, opts) => {
+          return new Promise((resolve, reject) => {
+            const podmanArgs = ["exec"];
+            if ("isTTY" in opts.stdin && opts.stdin.isTTY) {
+              podmanArgs.push("-it");
+            } else {
+              podmanArgs.push("-i");
+            }
+            if (opts.cwd) podmanArgs.push("-w", opts.cwd);
+            podmanArgs.push(containerName, ...args);
+            const proc = spawn("podman", podmanArgs, {
+              stdio: [opts.stdin, opts.stdout, opts.stderr]
+            });
+            proc.on("error", (error) => {
+              reject(new Error(`podman exec failed: ${error.message}`));
+            });
+            proc.on("close", (code) => {
+              resolve({ exitCode: code ?? 0 });
+            });
+          });
+        },
+        copyFileIn: (hostPath, sandboxPath) => new Promise((resolve, reject) => {
+          execFile(
+            "podman",
+            ["cp", hostPath, `${containerName}:${sandboxPath}`],
+            (error) => {
+              if (error) {
+                reject(new Error(`podman cp (in) failed: ${error.message}`));
+              } else {
+                resolve();
+              }
+            }
+          );
+        }),
+        copyFileOut: (sandboxPath, hostPath) => new Promise((resolve, reject) => {
+          execFile(
+            "podman",
+            ["cp", `${containerName}:${sandboxPath}`, hostPath],
+            (error) => {
+              if (error) {
+                reject(new Error(`podman cp (out) failed: ${error.message}`));
+              } else {
+                resolve();
+              }
+            }
+          );
+        }),
+        close: async () => {
+          unregisterShutdown();
+          await new Promise((resolve, reject) => {
+            execFile("podman", ["rm", "-f", containerName], (error) => {
+              if (error) {
+                reject(new Error(`podman rm failed: ${error.message}`));
+              } else {
+                resolve();
+              }
+            });
+          });
+        }
+      };
+      return handle;
+    }
+  });
+};
+var checkImageExists = (imageName) => new Promise((resolve, reject) => {
+  execFile("podman", ["image", "inspect", imageName], (error) => {
+    if (error) {
+      reject(
+        new Error(
+          `Image '${imageName}' not found locally. Build it first with 'podman build -t ${imageName} .'`
+        )
+      );
+    } else {
+      resolve();
+    }
+  });
+});
+var podmanMachineError = () => new Error(
+  "Podman Machine is not running. Run 'podman machine init && podman machine start' first."
+);
+var checkPodmanMachine = () => new Promise((resolve, reject) => {
+  execFile(
+    "podman",
+    ["machine", "list", "--format", "json"],
+    (error, stdout) => {
+      if (error) {
+        reject(podmanMachineError());
+        return;
+      }
+      try {
+        const machines = JSON.parse(stdout.toString());
+        if (machines.some((m) => m.Running)) {
+          resolve();
+        } else {
+          reject(podmanMachineError());
+        }
+      } catch {
+        reject(podmanMachineError());
+      }
+    }
+  );
+});
+
+export { podman };
+//# sourceMappingURL=podman.js.map
+//# sourceMappingURL=podman.js.map

package/dist/sandboxes/podman.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/sandboxes/podman.ts"],"names":[],"mappings":";;;;;;;;;;AAgJO,IAAM,MAAA,GAAS,CAAC,OAAA,KAA6C;AAClE,EAAA,MAAM,sBAAsB,OAAA,EAAS,SAAA;AACrC,EAAA,MAAM,YAAA,GAAe,SAAS,YAAA,IAAgB,GAAA;AAC9C,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,SAAA;AAClC,EAAA,MAAM,YAAA,GAAe,SAAS,YAAA,IAAgB,GAAA;AAC9C,EAAA,MAAM,YAAA,GAAe,SAAS,YAAA,IAAgB,GAAA;AAC9C,EAAA,MAAM,kBAAA,GAAqB,SAAS,kBAAA,IAAsB,cAAA;AAC1D,EAAA,MAAM,cAAA,GAAiB,aAAA;AACvB,EAAA,MAAM,UAAA,GAAa,SAAS,MAAA,GACxB,iBAAA,CAAkB,QAAQ,MAAA,EAAQ,cAAc,IAChD,EAAC;AAGL,EAAA,MAAM,kBAAA,GAAqB,uBAAA;AAAA,IACzB,UAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAO,8BAAA,CAA+B;AAAA,IACpC,IAAA,EAAM,QAAA;AAAA,IACN,KAAK,OAAA,EAAS,GAAA;AAAA,IACd,cAAA;AAAA,IACA,MAAA,EAAQ,OACN,aAAA,KACoC;AACpC,MAAA,MAAM,aAAA,GAAgB,CAAA,WAAA,EAAc,UAAA,EAAY,CAAA,CAAA;AAEhD,MAAA,MAAM,YAAA,GACJ,cAAc,MAAA,CAAO,IAAA;AAAA,QACnB,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,KAAa,aAAA,CAAc;AAAA,SACnC,WAAA,IAAe,uBAAA;AAGpB,MAAA,MAAM,YAAY,CAAC,GAAG,aAAA,CAAc,MAAA,EAAQ,GAAG,UAAU,CAAA;AACzD,MAAA,MAAM,eAAe,SAAA,CAAU,GAAA;AAAA,QAAI,CAAC,CAAA,KAClC,iBAAA,CAAkB,CAAA,EAAG,YAAY;AAAA,OACnC;AAGA,MAAA,MAAM,SAAA,GACJ,mBAAA,IAAuB,gBAAA,CAAiB,aAAA,CAAc,YAAY,CAAA;AAGpE,MAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,QAAA,IAAY,OAAA,CAAQ,aAAa,OAAA,EAAS;AACjE,QAAA,MAAM,kBAAA,EAAmB;AAAA,MAC3B;AAGA,MAAA,MAAM,iBAAiB,SAAS,CAAA;AAEhC,MAAA,MAAM,MAAM,EAAE,GAAG,aAAA,CAAc,GAAA,EAAK,MAAM,aAAA,EAAc;AACxD,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,CAAE,QAAQ,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAAA,QAC5D,IAAA;AAAA,QACA,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA;AAAA,OAChB,CAAA;AACD,MAAA,MAAM,UAAA,GAAa,aAAa,OAAA,CAAQ,CAAC,MAAM,CAAC,IAAA,EAAM,CAAC,CAAC,CAAA;AACxD,MAAA,MAAM,UAAA,GAAa,SACf,CAAC,CAAA,qBAAA,EAAwB,YAAY,CAAA,KAAA,EAAQ,YAAY,CAAA,CAAE,CAAA,GAC3D,EAAC;AACL,MAAA,MAAM,WAAW,CAAC,QAAA,EAAU,GAAG,YAAY,CAAA,CAAA,EAAI,YAAY,CAAA,CAAE,CAAA;AAC7D,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,OAAA,GACtB,KAAA,CAAM,QAAQ,OAAA,CAAQ,OAAO,CAAA,GAC3B,OAAA,CAAQ,OAAA,GACR,CAAC,OAAA,CAAQ,OAAO,IAClB,EAAC;AACL,MAAA,MAAM,WAAA,GAAc,SAAS,OAAA,CAAQ,CAAC,MAAM,CAAC,WAAA,EAAa,CAAC,CAAC,CAAA;AAC5D,MAAA,MAAM,aAAa,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG,OAAA,CAAQ,CAAC,CAAA,KAAM;AAAA,QACvD,aAAA;AAAA,QACA,OAAO,CAAC;AAAA,OACT,CAAA;AACD,MAAA,MAAM,cAAc,OAAA,EAAS,OAAA,IAAW,EAAC,EAAG,OAAA,CAAQ,CAAC,CAAA,KAAM;AAAA,QACzD,UAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,MAAM,QAAA,GACJ,OAAA,EAAS,IAAA,KAAS,MAAA,GAAY,CAAC,QAAA,EAAU,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAC,CAAA,GAAI,EAAC;AAGpE,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,QAAA,QAAA;AAAA,UACE,QAAA;AAAA,UACA;AAAA,YACE,KAAA;AAAA,YACA,IAAA;AAAA,YACA,QAAA;AAAA,YACA,aAAA;AAAA,YACA,GAAG,QAAA;AAAA,YACH,GAAG,UAAA;AAAA,YACH,GAAG,WAAA;AAAA,YACH,GAAG,SAAA;AAAA,YACH,GAAG,UAAA;AAAA,YACH,GAAG,QAAA;AAAA,YACH,IAAA;AAAA,YACA,YAAA;AAAA,YACA,GAAG,OAAA;AAAA,YACH,GAAG,UAAA;AAAA,YACH,cAAA;AAAA,YACA,OAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,CAAC,KAAA,KAAU;AACT,YAAA,IAAI,KAAA,EAAO;AACT,cAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,YACzD,CAAA,MAAO;AACL,cAAA,OAAA,EAAQ;AAAA,YACV;AAAA,UACF;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AAGD,MAAA,KAAA,MAAW,OAAO,kBAAA,EAAoB;AACpC,QAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,UAAA,QAAA;AAAA,YACE,QAAA;AAAA,YACA;AAAA,cACE,MAAA;AAAA,cACA,QAAA;AAAA,cACA,KAAA;AAAA,cACA,aAAA;AAAA,cACA,IAAA;AAAA,cACA,IAAA;AAAA,cACA,CAAA,gCAAA,CAAA;AAAA,cACA,IAAA;AAAA,cACA,GAAA;AAAA,cACA,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,aACjC;AAAA,YACA,CAAC,KAAA,KAAU;AACT,cAAA,IAAI,KAAA,EAAO;AACT,gBAAA,MAAA;AAAA,kBACE,IAAI,KAAA;AAAA,oBACF,CAAA,mCAAA,EAAsC,GAAG,CAAA,gBAAA,EAAmB,KAAA,CAAM,OAAO,CAAA;AAAA;AAC3E,iBACF;AAAA,cACF,CAAA,MAAO;AACL,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF;AAAA,WACF;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAKA,MAAA,MAAM,sBAAsB,MAAM;AAChC,QAAA,IAAI;AACF,UAAA,YAAA,CAAa,QAAA,EAAU,CAAC,IAAA,EAAM,IAAA,EAAM,aAAa,CAAA,EAAG;AAAA,YAClD,KAAA,EAAO,QAAA;AAAA,YACP,OAAA,EAAS;AAAA,WACV,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AACA,MAAA,MAAM,kBAAA,GAAqB,iBAAiB,mBAAmB,CAAA;AAE/D,MAAA,MAAM,MAAA,GAAiC;AAAA,QACrC,YAAA;AAAA,QAEA,IAAA,EAAM,CACJ,OAAA,EACA,IAAA,KAMwB;AACxB,UAAA,MAAM,gBAAA,GAAmB,IAAA,EAAM,IAAA,GAAO,CAAA,KAAA,EAAQ,OAAO,CAAA,CAAA,GAAK,OAAA;AAC1D,UAAA,MAAM,IAAA,GAAO,CAAC,MAAM,CAAA;AACpB,UAAA,IAAI,IAAA,EAAM,KAAA,KAAU,MAAA,EAAW,IAAA,CAAK,KAAK,IAAI,CAAA;AAC7C,UAAA,IAAI,MAAM,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,KAAK,GAAG,CAAA;AACvC,UAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,IAAA,EAAM,IAAA,EAAM,gBAAgB,CAAA;AAErD,UAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,YAAA,MAAM,IAAA,GAAO,KAAA,CAAM,QAAA,EAAU,IAAA,EAAM;AAAA,cACjC,KAAA,EAAO;AAAA,gBACL,IAAA,EAAM,KAAA,KAAU,MAAA,GAAY,MAAA,GAAS,QAAA;AAAA,gBACrC,MAAA;AAAA,gBACA;AAAA;AACF,aACD,CAAA;AAED,YAAA,IAAI,IAAA,EAAM,UAAU,MAAA,EAAW;AAC7B,cAAA,IAAA,CAAK,KAAA,CAAO,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA;AAC5B,cAAA,IAAA,CAAK,MAAO,GAAA,EAAI;AAAA,YAClB;AAEA,YAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAU;AAC1B,cAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,YAC1D,CAAC,CAAA;AAED,YAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,cAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AACpB,cAAA,MAAM,UAAA,GAAa,IAAI,WAAA,CAAY,kBAAA,EAAoB,IAAI,CAAA;AAC3D,cAAA,MAAM,UAAA,GAAa,IAAI,WAAA,CAAY,kBAAA,EAAoB,EAAE,CAAA;AACzD,cAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAS,CAAA;AAClD,cAAA,EAAA,CAAG,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,KAAS;AACtB,gBAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AACpB,gBAAA,MAAA,CAAO,IAAI,CAAA;AAAA,cACb,CAAC,CAAA;AACD,cAAA,IAAA,CAAK,MAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACzC,gBAAA,UAAA,CAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAU,CAAA;AAAA,cAClC,CAAC,CAAA;AACD,cAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AACzB,gBAAA,OAAA,CAAQ;AAAA,kBACN,MAAA,EAAQ,WAAW,QAAA,EAAS;AAAA,kBAC5B,MAAA,EAAQ,WAAW,QAAA,EAAS;AAAA,kBAC5B,UAAU,IAAA,IAAQ;AAAA,iBACnB,CAAA;AAAA,cACH,CAAC,CAAA;AAAA,YACH,CAAA,MAAO;AACL,cAAA,MAAM,eAAyB,EAAC;AAChC,cAAA,MAAM,eAAyB,EAAC;AAChC,cAAA,IAAA,CAAK,MAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACzC,gBAAA,YAAA,CAAa,IAAA,CAAK,KAAA,CAAM,QAAA,EAAU,CAAA;AAAA,cACpC,CAAC,CAAA;AACD,cAAA,IAAA,CAAK,MAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACzC,gBAAA,YAAA,CAAa,IAAA,CAAK,KAAA,CAAM,QAAA,EAAU,CAAA;AAAA,cACpC,CAAC,CAAA;AACD,cAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AACzB,gBAAA,OAAA,CAAQ;AAAA,kBACN,MAAA,EAAQ,YAAA,CAAa,IAAA,CAAK,EAAE,CAAA;AAAA,kBAC5B,MAAA,EAAQ,YAAA,CAAa,IAAA,CAAK,EAAE,CAAA;AAAA,kBAC5B,UAAU,IAAA,IAAQ;AAAA,iBACnB,CAAA;AAAA,cACH,CAAC,CAAA;AAAA,YACH;AAAA,UACF,CAAC,CAAA;AAAA,QACH,CAAA;AAAA,QAEA,eAAA,EAAiB,CACf,IAAA,EACA,IAAA,KACkC;AAClC,UAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,YAAA,MAAM,UAAA,GAAa,CAAC,MAAM,CAAA;AAE1B,YAAA,IACE,OAAA,IAAW,IAAA,CAAK,KAAA,IACf,IAAA,CAAK,MAA8B,KAAA,EACpC;AACA,cAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,YACvB,CAAA,MAAO;AACL,cAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,YACtB;AACA,YAAA,IAAI,KAAK,GAAA,EAAK,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,KAAK,GAAG,CAAA;AAC5C,YAAA,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,GAAG,IAAI,CAAA;AAEtC,YAAA,MAAM,IAAA,GAAO,KAAA,CAAM,QAAA,EAAU,UAAA,EAAY;AAAA,cACvC,OAAO,CAAC,IAAA,CAAK,OAAO,IAAA,CAAK,MAAA,EAAQ,KAAK,MAAM;AAAA,aAC7C,CAAA;AAED,YAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAiB;AACjC,cAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,YAC1D,CAAC,CAAA;AAED,YAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAwB;AACxC,cAAA,OAAA,CAAQ,EAAE,QAAA,EAAU,IAAA,IAAQ,CAAA,EAAG,CAAA;AAAA,YACjC,CAAC,CAAA;AAAA,UACH,CAAC,CAAA;AAAA,QACH,CAAA;AAAA,QAEA,UAAA,EAAY,CAAC,QAAA,EAAkB,WAAA,KAC7B,IAAI,OAAA,CAAQ,CAAC,SAAS,MAAA,KAAW;AAC/B,UAAA,QAAA;AAAA,YACE,QAAA;AAAA,YACA,CAAC,IAAA,EAAM,QAAA,EAAU,GAAG,aAAa,CAAA,CAAA,EAAI,WAAW,CAAA,CAAE,CAAA;AAAA,YAClD,CAAC,KAAA,KAAU;AACT,cAAA,IAAI,KAAA,EAAO;AACT,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,cAC7D,CAAA,MAAO;AACL,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF;AAAA,WACF;AAAA,QACF,CAAC,CAAA;AAAA,QAEH,WAAA,EAAa,CAAC,WAAA,EAAqB,QAAA,KACjC,IAAI,OAAA,CAAQ,CAAC,SAAS,MAAA,KAAW;AAC/B,UAAA,QAAA;AAAA,YACE,QAAA;AAAA,YACA,CAAC,IAAA,EAAM,CAAA,EAAG,aAAa,CAAA,CAAA,EAAI,WAAW,IAAI,QAAQ,CAAA;AAAA,YAClD,CAAC,KAAA,KAAU;AACT,cAAA,IAAI,KAAA,EAAO;AACT,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,cAC9D,CAAA,MAAO;AACL,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF;AAAA,WACF;AAAA,QACF,CAAC,CAAA;AAAA,QAEH,OAAO,YAA2B;AAChC,UAAA,kBAAA,EAAmB;AACnB,UAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,YAAA,QAAA,CAAS,UAAU,CAAC,IAAA,EAAM,MAAM,aAAa,CAAA,EAAG,CAAC,KAAA,KAAU;AACzD,cAAA,IAAI,KAAA,EAAO;AACT,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,cACxD,CAAA,MAAO;AACL,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF,CAAC,CAAA;AAAA,UACH,CAAC,CAAA;AAAA,QACH;AAAA,OACF;AAEA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAKA,IAAM,mBAAmB,CAAC,SAAA,KACxB,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AACrC,EAAA,QAAA,CAAS,UAAU,CAAC,OAAA,EAAS,WAAW,SAAS,CAAA,EAAG,CAAC,KAAA,KAAU;AAC7D,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA;AAAA,QACE,IAAI,KAAA;AAAA,UACF,CAAA,OAAA,EAAU,SAAS,CAAA,0DAAA,EAA6D,SAAS,CAAA,GAAA;AAAA;AAC3F,OACF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,EAAQ;AAAA,IACV;AAAA,EACF,CAAC,CAAA;AACH,CAAC,CAAA;AAEH,IAAM,kBAAA,GAAqB,MACzB,IAAI,KAAA;AAAA,EACF;AACF,CAAA;AAEF,IAAM,qBAAqB,MACzB,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AACrC,EAAA,QAAA;AAAA,IACE,QAAA;AAAA,IACA,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,MAAM,CAAA;AAAA,IACtC,CAAC,OAAO,MAAA,KAAW;AACjB,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAA,CAAO,oBAAoB,CAAA;AAC3B,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AAG7C,QAAA,IAAI,SAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,CAAA,EAAG;AACnC,UAAA,OAAA,EAAQ;AAAA,QACV,CAAA,MAAO;AACL,UAAA,MAAA,CAAO,oBAAoB,CAAA;AAAA,QAC7B;AAAA,MACF,CAAA,CAAA,MAAQ;AACN,QAAA,MAAA,CAAO,oBAAoB,CAAA;AAAA,MAC7B;AAAA,IACF;AAAA,GACF;AACF,CAAC,CAAA","file":"podman.js","sourcesContent":["/**\n * Podman sandbox provider — creates Podman containers with bind-mounts.\n *\n * Usage:\n *   import { podman } from \"sandcastle/sandboxes/podman\";\n *   await run({ agent: claudeCode(\"claude-opus-4-7\"), sandbox: podman() });\n */\n\nimport {\n  execFile,\n  execFileSync,\n  spawn,\n  type StdioOptions,\n} from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { createInterface } from \"node:readline\";\nimport {\n  createBindMountSandboxProvider,\n  type SandboxProvider,\n  type BindMountCreateOptions,\n  type BindMountSandboxHandle,\n  type ExecResult,\n  type InteractiveExecOptions,\n} from \"../SandboxProvider.js\";\nimport type { MountConfig } from \"../MountConfig.js\";\nimport type { SelinuxLabel } from \"../mountUtils.js\";\nimport {\n  defaultImageName,\n  resolveUserMounts,\n  formatVolumeMount,\n  processFileMountParents,\n} from \"../mountUtils.js\";\nimport { BoundedTail, MAX_TAIL_CHARS } from \"../boundedTail.js\";\nimport { registerShutdown } from \"../shutdownRegistry.js\";\n\nexport interface PodmanOptions {\n  /** Podman image name (default: derived from repo directory name). */\n  readonly imageName?: string;\n  /**\n   * SELinux volume label suffix applied to bind mounts.\n   *\n   * - `\"z\"` — shared label (default). No-op on non-SELinux systems.\n   * - `\"Z\"` — private label; only this container can access the mount.\n   * - `false` — disable labeling entirely.\n   */\n  readonly selinuxLabel?: SelinuxLabel;\n  /**\n   * User namespace mode for rootless Podman.\n   *\n   * - `\"keep-id\"` (default) — maps host UID to `containerUid` inside the\n   *   container via `--userns=keep-id:uid=N,gid=N`, so both bind-mounted\n   *   files and image-built files have correct ownership without chown.\n   * - `false` — disable; use for rootful Podman setups.\n   */\n  readonly userns?: \"keep-id\" | false;\n  /**\n   * The UID of the `agent` user inside the container image (default: 1000).\n   *\n   * Must match the UID set in the Containerfile. Used with `--userns=keep-id`\n   * to map the host user to this UID inside the container.\n   */\n  readonly containerUid?: number;\n  /**\n   * The GID of the `agent` user inside the container image (default: 1000).\n   *\n   * Must match the GID set in the Containerfile. Used with `--userns=keep-id`\n   * to map the host group to this GID inside the container.\n   */\n  readonly containerGid?: number;\n  /**\n   * Additional host directories to bind-mount into the sandbox.\n   *\n   * Each entry specifies a `hostPath` (tilde-expanded) and `sandboxPath`.\n   * If `hostPath` does not exist, sandbox creation fails with a clear error.\n   */\n  readonly mounts?: readonly MountConfig[];\n  /** Environment variables injected by this provider. Merged at launch time with env resolver and agent provider env. */\n  readonly env?: Record<string, string>;\n  /**\n   * Podman network(s) to attach the container to.\n   *\n   * - `\"my-network\"` → `--network my-network`\n   * - `[\"net1\", \"net2\"]` → `--network net1 --network net2`\n   *\n   * When omitted, Podman's default network is used.\n   */\n  readonly network?: string | readonly string[];\n  /**\n   * Supplementary groups to add the container user to, via `--group-add`.\n   *\n   * Accepts group names or numeric GIDs:\n   *\n   * - `[\"docker\"]` → `--group-add docker`\n   * - `[999]` → `--group-add 999`\n   * - `[\"docker\", 999]` → `--group-add docker --group-add 999`\n   *\n   * Useful for granting access to a bind-mounted Docker socket (Docker-outside-of-Docker).\n   * When omitted, no `--group-add` flags are added.\n   */\n  readonly groups?: readonly (string | number)[];\n  /**\n   * Host devices to expose to the container, via `--device`.\n   *\n   * Each entry is a full device spec in `host[:container[:permissions]]` form:\n   *\n   * - `[\"/dev/kvm\"]` → `--device /dev/kvm`\n   * - `[\"/dev/sda:/dev/xvda:rwm\"]` → `--device /dev/sda:/dev/xvda:rwm`\n   * - `[\"/dev/kvm\", \"/dev/fuse\"]` → `--device /dev/kvm --device /dev/fuse`\n   *\n   * Under rootless Podman, exposing a host device often requires host-side\n   * group/permission setup and may interact with `--userns=keep-id`.\n   * When omitted, no `--device` flags are added.\n   */\n  readonly devices?: readonly string[];\n  /**\n   * Maximum number of characters of streamed `exec` output retained per stream\n   * (stdout and stderr) when an `onLine` callback is supplied (default: 64KiB).\n   *\n   * Output is delivered live to `onLine` regardless; this only bounds the tail\n   * returned in `ExecResult`, preventing a long-running agent's output from\n   * overflowing V8's max string length and crashing the run.\n   */\n  readonly maxOutputTailChars?: number;\n  /**\n   * Limit the CPU resources available to the container, via `--cpus`.\n   *\n   * Maps directly to `podman run --cpus`. Accepts fractional values:\n   *\n   * - `2` → `--cpus 2` (at most 2 CPUs)\n   * - `1.5` → `--cpus 1.5` (at most 1.5 CPUs)\n   *\n   * When omitted, no `--cpus` flag is added and the container is unconstrained.\n   */\n  readonly cpus?: number;\n}\n\n/**\n * Create a Podman sandbox provider.\n *\n * The returned provider creates Podman containers with bind-mounts\n * for the worktree and git directories. Calls the `podman` binary\n * on PATH directly. On macOS/Windows, verifies that a Podman Machine\n * is running before container creation.\n */\nexport const podman = (options?: PodmanOptions): SandboxProvider => {\n  const configuredImageName = options?.imageName;\n  const selinuxLabel = options?.selinuxLabel ?? \"z\";\n  const userns = options?.userns ?? \"keep-id\";\n  const containerUid = options?.containerUid ?? 1000;\n  const containerGid = options?.containerGid ?? 1000;\n  const maxOutputTailChars = options?.maxOutputTailChars ?? MAX_TAIL_CHARS;\n  const sandboxHomedir = \"/home/agent\";\n  const userMounts = options?.mounts\n    ? resolveUserMounts(options.mounts, sandboxHomedir)\n    : [];\n  // Validate file mounts and collect parent dirs to create at container start.\n  // Throws at construction time if any file mount parent is outside sandboxHomedir.\n  const parentDirsToCreate = processFileMountParents(\n    userMounts,\n    sandboxHomedir,\n  );\n\n  return createBindMountSandboxProvider({\n    name: \"podman\",\n    env: options?.env,\n    sandboxHomedir,\n    create: async (\n      createOptions: BindMountCreateOptions,\n    ): Promise<BindMountSandboxHandle> => {\n      const containerName = `sandcastle-${randomUUID()}`;\n\n      const worktreePath =\n        createOptions.mounts.find(\n          (m) => m.hostPath === createOptions.worktreePath,\n        )?.sandboxPath ?? \"/home/agent/workspace\";\n\n      // Build volume mount strings with optional SELinux label (internal + user mounts)\n      const allMounts = [...createOptions.mounts, ...userMounts];\n      const volumeMounts = allMounts.map((m) =>\n        formatVolumeMount(m, selinuxLabel),\n      );\n\n      // Resolve image name\n      const imageName =\n        configuredImageName ?? defaultImageName(createOptions.hostRepoPath);\n\n      // Pre-flight: check Podman Machine on macOS/Windows\n      if (process.platform === \"darwin\" || process.platform === \"win32\") {\n        await checkPodmanMachine();\n      }\n\n      // Pre-flight: verify image exists locally\n      await checkImageExists(imageName);\n\n      const env = { ...createOptions.env, HOME: \"/home/agent\" };\n      const envArgs = Object.entries(env).flatMap(([key, value]) => [\n        \"-e\",\n        `${key}=${value}`,\n      ]);\n      const volumeArgs = volumeMounts.flatMap((v) => [\"-v\", v]);\n      const usernsArgs = userns\n        ? [`--userns=keep-id:uid=${containerUid},gid=${containerGid}`]\n        : [];\n      const userArgs = [\"--user\", `${containerUid}:${containerGid}`];\n      const networks = options?.network\n        ? Array.isArray(options.network)\n          ? options.network\n          : [options.network]\n        : [];\n      const networkArgs = networks.flatMap((n) => [\"--network\", n]);\n      const groupArgs = (options?.groups ?? []).flatMap((g) => [\n        \"--group-add\",\n        String(g),\n      ]);\n      const deviceArgs = (options?.devices ?? []).flatMap((d) => [\n        \"--device\",\n        d,\n      ]);\n      const cpusArgs =\n        options?.cpus !== undefined ? [\"--cpus\", String(options.cpus)] : [];\n\n      // Start container via podman run\n      await new Promise<void>((resolve, reject) => {\n        execFile(\n          \"podman\",\n          [\n            \"run\",\n            \"-d\",\n            \"--name\",\n            containerName,\n            ...userArgs,\n            ...usernsArgs,\n            ...networkArgs,\n            ...groupArgs,\n            ...deviceArgs,\n            ...cpusArgs,\n            \"-w\",\n            worktreePath,\n            ...envArgs,\n            ...volumeArgs,\n            \"--entrypoint\",\n            \"sleep\",\n            imageName,\n            \"infinity\",\n          ],\n          (error) => {\n            if (error) {\n              reject(new Error(`podman run failed: ${error.message}`));\n            } else {\n              resolve();\n            }\n          },\n        );\n      });\n\n      // Create parent directories for file mounts and chown to the container user\n      for (const dir of parentDirsToCreate) {\n        await new Promise<void>((resolve, reject) => {\n          execFile(\n            \"podman\",\n            [\n              \"exec\",\n              \"--user\",\n              \"0:0\",\n              containerName,\n              \"sh\",\n              \"-c\",\n              `mkdir -p \"$1\" && chown \"$2\" \"$1\"`,\n              \"sh\",\n              dir,\n              `${containerUid}:${containerGid}`,\n            ],\n            (error) => {\n              if (error) {\n                reject(\n                  new Error(\n                    `Failed to create parent directory '${dir}' in container: ${error.message}`,\n                  ),\n                );\n              } else {\n                resolve();\n              }\n            },\n          );\n        });\n      }\n\n      // Register synchronous container cleanup via the shared shutdown registry\n      // so concurrent sandboxes share a single exit/SIGINT/SIGTERM listener\n      // instead of tripping Node's MaxListenersExceededWarning.\n      const removeContainerSync = () => {\n        try {\n          execFileSync(\"podman\", [\"rm\", \"-f\", containerName], {\n            stdio: \"ignore\",\n            timeout: 5000,\n          });\n        } catch {\n          /* best-effort */\n        }\n      };\n      const unregisterShutdown = registerShutdown(removeContainerSync);\n\n      const handle: BindMountSandboxHandle = {\n        worktreePath,\n\n        exec: (\n          command: string,\n          opts?: {\n            onLine?: (line: string) => void;\n            cwd?: string;\n            sudo?: boolean;\n            stdin?: string;\n          },\n        ): Promise<ExecResult> => {\n          const effectiveCommand = opts?.sudo ? `sudo ${command}` : command;\n          const args = [\"exec\"];\n          if (opts?.stdin !== undefined) args.push(\"-i\");\n          if (opts?.cwd) args.push(\"-w\", opts.cwd);\n          args.push(containerName, \"sh\", \"-c\", effectiveCommand);\n\n          return new Promise((resolve, reject) => {\n            const proc = spawn(\"podman\", args, {\n              stdio: [\n                opts?.stdin !== undefined ? \"pipe\" : \"ignore\",\n                \"pipe\",\n                \"pipe\",\n              ],\n            });\n\n            if (opts?.stdin !== undefined) {\n              proc.stdin!.write(opts.stdin);\n              proc.stdin!.end();\n            }\n\n            proc.on(\"error\", (error) => {\n              reject(new Error(`podman exec failed: ${error.message}`));\n            });\n\n            if (opts?.onLine) {\n              const onLine = opts.onLine;\n              const stdoutTail = new BoundedTail(maxOutputTailChars, \"\\n\");\n              const stderrTail = new BoundedTail(maxOutputTailChars, \"\");\n              const rl = createInterface({ input: proc.stdout! });\n              rl.on(\"line\", (line) => {\n                stdoutTail.push(line);\n                onLine(line);\n              });\n              proc.stderr!.on(\"data\", (chunk: Buffer) => {\n                stderrTail.push(chunk.toString());\n              });\n              proc.on(\"close\", (code) => {\n                resolve({\n                  stdout: stdoutTail.toString(),\n                  stderr: stderrTail.toString(),\n                  exitCode: code ?? 0,\n                });\n              });\n            } else {\n              const stdoutChunks: string[] = [];\n              const stderrChunks: string[] = [];\n              proc.stdout!.on(\"data\", (chunk: Buffer) => {\n                stdoutChunks.push(chunk.toString());\n              });\n              proc.stderr!.on(\"data\", (chunk: Buffer) => {\n                stderrChunks.push(chunk.toString());\n              });\n              proc.on(\"close\", (code) => {\n                resolve({\n                  stdout: stdoutChunks.join(\"\"),\n                  stderr: stderrChunks.join(\"\"),\n                  exitCode: code ?? 0,\n                });\n              });\n            }\n          });\n        },\n\n        interactiveExec: (\n          args: string[],\n          opts: InteractiveExecOptions,\n        ): Promise<{ exitCode: number }> => {\n          return new Promise((resolve, reject) => {\n            const podmanArgs = [\"exec\"];\n            // Allocate a pseudo-terminal when stdin looks like a TTY\n            if (\n              \"isTTY\" in opts.stdin &&\n              (opts.stdin as { isTTY?: boolean }).isTTY\n            ) {\n              podmanArgs.push(\"-it\");\n            } else {\n              podmanArgs.push(\"-i\");\n            }\n            if (opts.cwd) podmanArgs.push(\"-w\", opts.cwd);\n            podmanArgs.push(containerName, ...args);\n\n            const proc = spawn(\"podman\", podmanArgs, {\n              stdio: [opts.stdin, opts.stdout, opts.stderr] as StdioOptions,\n            });\n\n            proc.on(\"error\", (error: Error) => {\n              reject(new Error(`podman exec failed: ${error.message}`));\n            });\n\n            proc.on(\"close\", (code: number | null) => {\n              resolve({ exitCode: code ?? 0 });\n            });\n          });\n        },\n\n        copyFileIn: (hostPath: string, sandboxPath: string): Promise<void> =>\n          new Promise((resolve, reject) => {\n            execFile(\n              \"podman\",\n              [\"cp\", hostPath, `${containerName}:${sandboxPath}`],\n              (error) => {\n                if (error) {\n                  reject(new Error(`podman cp (in) failed: ${error.message}`));\n                } else {\n                  resolve();\n                }\n              },\n            );\n          }),\n\n        copyFileOut: (sandboxPath: string, hostPath: string): Promise<void> =>\n          new Promise((resolve, reject) => {\n            execFile(\n              \"podman\",\n              [\"cp\", `${containerName}:${sandboxPath}`, hostPath],\n              (error) => {\n                if (error) {\n                  reject(new Error(`podman cp (out) failed: ${error.message}`));\n                } else {\n                  resolve();\n                }\n              },\n            );\n          }),\n\n        close: async (): Promise<void> => {\n          unregisterShutdown();\n          await new Promise<void>((resolve, reject) => {\n            execFile(\"podman\", [\"rm\", \"-f\", containerName], (error) => {\n              if (error) {\n                reject(new Error(`podman rm failed: ${error.message}`));\n              } else {\n                resolve();\n              }\n            });\n          });\n        },\n      };\n\n      return handle;\n    },\n  });\n};\n\n// Re-export for backwards compatibility\nexport { defaultImageName };\n\nconst checkImageExists = (imageName: string): Promise<void> =>\n  new Promise<void>((resolve, reject) => {\n    execFile(\"podman\", [\"image\", \"inspect\", imageName], (error) => {\n      if (error) {\n        reject(\n          new Error(\n            `Image '${imageName}' not found locally. Build it first with 'podman build -t ${imageName} .'`,\n          ),\n        );\n      } else {\n        resolve();\n      }\n    });\n  });\n\nconst podmanMachineError = () =>\n  new Error(\n    \"Podman Machine is not running. Run 'podman machine init && podman machine start' first.\",\n  );\n\nconst checkPodmanMachine = (): Promise<void> =>\n  new Promise<void>((resolve, reject) => {\n    execFile(\n      \"podman\",\n      [\"machine\", \"list\", \"--format\", \"json\"],\n      (error, stdout) => {\n        if (error) {\n          reject(podmanMachineError());\n          return;\n        }\n        try {\n          const machines = JSON.parse(stdout.toString()) as Array<{\n            Running?: boolean;\n          }>;\n          if (machines.some((m) => m.Running)) {\n            resolve();\n          } else {\n            reject(podmanMachineError());\n          }\n        } catch {\n          reject(podmanMachineError());\n        }\n      },\n    );\n  });\n"]}

package/dist/sandboxes/vercel.d.ts

@@ -0,0 +1,104 @@
+import { I as IsolatedSandboxProvider } from '../SandboxProvider-EkSMuBp8.js';
+
+/**
+ * Vercel isolated sandbox provider — wraps `@vercel/sandbox` into a SandboxProvider.
+ *
+ * Usage:
+ *   import { vercel } from "sandcastle/sandboxes/vercel";
+ *   await run({ agent: claudeCode("claude-opus-4-7"), sandbox: vercel() });
+ */
+
+/**
+ * Options for creating a Vercel sandbox provider.
+ *
+ * All `@vercel/sandbox` `Sandbox.create()` options are accepted as pass-through,
+ * plus Sandcastle-specific options for auth and branch strategy.
+ */
+interface VercelOptions {
+    /**
+     * Vercel access token.
+     *
+     * Falls back to the SDK's default auth behavior, which reads
+     * `VERCEL_OIDC_TOKEN` (recommended for Vercel-hosted environments) or
+     * `VERCEL_TOKEN` from the environment.
+     */
+    readonly token?: string;
+    /**
+     * The source of the sandbox (git repo, tarball, or snapshot).
+     * Omit to start an empty sandbox.
+     */
+    readonly source?: {
+        type: "git";
+        url: string;
+        depth?: number;
+        revision?: string;
+        username?: string;
+        password?: string;
+    } | {
+        type: "tarball";
+        url: string;
+    } | {
+        type: "snapshot";
+        snapshotId: string;
+    };
+    /** Array of port numbers to expose from the sandbox (up to 4). */
+    readonly ports?: number[];
+    /** Timeout in milliseconds before the sandbox auto-terminates. */
+    readonly timeout?: number;
+    /**
+     * Resources to allocate to the sandbox.
+     * Each vCPU gets 2048 MB of memory.
+     */
+    readonly resources?: {
+        vcpus: number;
+    };
+    /**
+     * The runtime of the sandbox (e.g. `"node24"`, `"node22"`, `"python3.13"`).
+     * Defaults to `"node24"`.
+     */
+    readonly runtime?: string;
+    /**
+     * Network policy for the sandbox.
+     * Defaults to full internet access if not specified.
+     */
+    readonly networkPolicy?: Record<string, unknown>;
+    /**
+     * Vercel project ID to associate sandbox operations with.
+     */
+    readonly projectId?: string;
+    /**
+     * Vercel team ID to associate sandbox operations with.
+     */
+    readonly teamId?: string;
+    /**
+     * Timeout in milliseconds (alias for `timeout`, kept for discoverability).
+     */
+    readonly timeoutMs?: number;
+    /**
+     * Sandbox template shorthand (e.g. `"node-22"`).
+     * Maps to the `runtime` option.
+     */
+    readonly template?: string;
+    /** Environment variables injected by this provider. Merged at launch time with env resolver and agent provider env. */
+    readonly env?: Record<string, string>;
+    /**
+     * Maximum number of characters of streamed `exec` output retained per stream
+     * (stdout and stderr) when an `onLine` callback is supplied (default: 64KiB).
+     *
+     * Output is delivered live to `onLine` regardless; this only bounds the tail
+     * returned in `ExecResult`, preventing a long-running agent's output from
+     * overflowing V8's max string length and crashing the run.
+     */
+    readonly maxOutputTailChars?: number;
+}
+/**
+ * Create a Vercel isolated sandbox provider.
+ *
+ * The returned provider creates Vercel Firecracker microVM sandboxes via
+ * the `@vercel/sandbox` SDK. Each sandbox is ephemeral — one sandbox per run.
+ *
+ * Requires `@vercel/sandbox` to be installed as a peer dependency.
+ */
+declare const vercel: (options?: VercelOptions) => IsolatedSandboxProvider;
+
+export { type VercelOptions, vercel };

package/dist/sandboxes/vercel.js

@@ -0,0 +1,148 @@
+import { createRequire } from 'node:module';
+import { createIsolatedSandboxProvider } from '../chunk-BIWNFKGV.js';
+import { MAX_TAIL_CHARS, BoundedTail } from '../chunk-NGBM7T3E.js';
+import { execSync } from 'child_process';
+import { mkdir, writeFile, stat, readFile, unlink } from 'fs/promises';
+import { tmpdir } from 'os';
+import { dirname, join } from 'path';
+import { Writable } from 'stream';
+
+createRequire(import.meta.url);
+var VERCEL_REPO_PATH = "/vercel/sandbox/workspace";
+var vercel = (options) => createIsolatedSandboxProvider({
+  name: "vercel",
+  env: options?.env,
+  create: async (createOptions) => {
+    const maxOutputTailChars = options?.maxOutputTailChars ?? MAX_TAIL_CHARS;
+    const { Sandbox } = await import('@vercel/sandbox');
+    const createParams = {};
+    if (options?.source) createParams.source = options.source;
+    if (options?.ports) createParams.ports = options.ports;
+    if (options?.resources) createParams.resources = options.resources;
+    if (options?.networkPolicy)
+      createParams.networkPolicy = options.networkPolicy;
+    const resolvedRuntime = options?.runtime ?? options?.template;
+    if (resolvedRuntime) createParams.runtime = resolvedRuntime;
+    const timeoutValue = options?.timeout ?? options?.timeoutMs;
+    if (timeoutValue !== void 0) createParams.timeout = timeoutValue;
+    createParams.env = createOptions.env;
+    if (options?.token) createParams.token = options.token;
+    if (options?.projectId) createParams.projectId = options.projectId;
+    if (options?.teamId) createParams.teamId = options.teamId;
+    const sandbox = await Sandbox.create(
+      createParams
+    );
+    await sandbox.mkDir(VERCEL_REPO_PATH);
+    const handle = {
+      worktreePath: VERCEL_REPO_PATH,
+      exec: async (command, opts) => {
+        if (opts?.onLine) {
+          const onLine = opts.onLine;
+          const stdoutTail = new BoundedTail(maxOutputTailChars, "\n");
+          const stderrTail = new BoundedTail(maxOutputTailChars, "");
+          let partial = "";
+          const stdoutWritable = new Writable({
+            write(chunk, _encoding, callback) {
+              const text = partial + chunk.toString();
+              const lines = text.split("\n");
+              partial = lines.pop() ?? "";
+              for (const line of lines) {
+                stdoutTail.push(line);
+                onLine(line);
+              }
+              callback();
+            },
+            final(callback) {
+              if (partial) {
+                stdoutTail.push(partial);
+                onLine(partial);
+                partial = "";
+              }
+              callback();
+            }
+          });
+          const stderrWritable = new Writable({
+            write(chunk, _encoding, callback) {
+              stderrTail.push(chunk.toString());
+              callback();
+            }
+          });
+          const result2 = await sandbox.runCommand({
+            cmd: "sh",
+            args: ["-c", command],
+            cwd: opts?.cwd ?? VERCEL_REPO_PATH,
+            stdout: stdoutWritable,
+            stderr: stderrWritable,
+            ...opts?.sudo ? { sudo: true } : {}
+          });
+          return {
+            stdout: stdoutTail.toString(),
+            stderr: stderrTail.toString(),
+            exitCode: result2.exitCode
+          };
+        }
+        const result = await sandbox.runCommand({
+          cmd: "sh",
+          args: ["-c", command],
+          cwd: opts?.cwd ?? VERCEL_REPO_PATH,
+          ...opts?.sudo ? { sudo: true } : {}
+        });
+        const stdout = await result.stdout();
+        const stderr = await result.stderr();
+        return {
+          stdout,
+          stderr,
+          exitCode: result.exitCode
+        };
+      },
+      copyIn: async (hostPath, sandboxPath) => {
+        const info = await stat(hostPath);
+        if (info.isDirectory()) {
+          const tarPath = join(
+            tmpdir(),
+            `sandcastle-copyin-${Date.now()}.tar.gz`
+          );
+          execSync(`tar -czf "${tarPath}" -C "${hostPath}" .`);
+          try {
+            const tarContent = await readFile(tarPath);
+            const sandboxTarPath = `/tmp/sandcastle-copyin-${Date.now()}.tar.gz`;
+            await sandbox.writeFiles([
+              { path: sandboxTarPath, content: tarContent }
+            ]);
+            await sandbox.runCommand({
+              cmd: "sh",
+              args: [
+                "-c",
+                `mkdir -p "${sandboxPath}" && tar -xzf "${sandboxTarPath}" -C "${sandboxPath}" && rm -f "${sandboxTarPath}"`
+              ]
+            });
+          } finally {
+            await unlink(tarPath).catch(() => {
+            });
+          }
+        } else {
+          const content = await readFile(hostPath);
+          await sandbox.writeFiles([{ path: sandboxPath, content }]);
+        }
+      },
+      copyFileOut: async (sandboxPath, hostPath) => {
+        const buffer = await sandbox.readFileToBuffer({
+          path: sandboxPath
+        });
+        if (!buffer) {
+          throw new Error(`File not found in Vercel sandbox: ${sandboxPath}`);
+        }
+        await mkdir(dirname(hostPath), { recursive: true });
+        await writeFile(hostPath, buffer);
+      },
+      close: async () => {
+        await sandbox.stop();
+      }
+    };
+    return handle;
+  }
+});
+
+export { vercel };
+//# sourceMappingURL=vercel.js.map
+//# sourceMappingURL=vercel.js.map

package/dist/sandboxes/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/sandboxes/vercel.ts"],"names":["result"],"mappings":";;;;;;;;;;AAsBA,IAAM,gBAAA,GAAmB,2BAAA;AA+GlB,IAAM,MAAA,GAAS,CAAC,OAAA,KACrB,6BAAA,CAA8B;AAAA,EAC5B,IAAA,EAAM,QAAA;AAAA,EACN,KAAK,OAAA,EAAS,GAAA;AAAA,EACd,MAAA,EAAQ,OAAO,aAAA,KAAkD;AAC/D,IAAA,MAAM,kBAAA,GAAqB,SAAS,kBAAA,IAAsB,cAAA;AAE1D,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAElD,IAAA,MAAM,eAAwC,EAAC;AAG/C,IAAA,IAAI,OAAA,EAAS,MAAA,EAAQ,YAAA,CAAa,MAAA,GAAS,OAAA,CAAQ,MAAA;AACnD,IAAA,IAAI,OAAA,EAAS,KAAA,EAAO,YAAA,CAAa,KAAA,GAAQ,OAAA,CAAQ,KAAA;AACjD,IAAA,IAAI,OAAA,EAAS,SAAA,EAAW,YAAA,CAAa,SAAA,GAAY,OAAA,CAAQ,SAAA;AACzD,IAAA,IAAI,OAAA,EAAS,aAAA;AACX,MAAA,YAAA,CAAa,gBAAgB,OAAA,CAAQ,aAAA;AAEvC,IAAA,MAAM,eAAA,GAAkB,OAAA,EAAS,OAAA,IAAW,OAAA,EAAS,QAAA;AACrD,IAAA,IAAI,eAAA,eAA8B,OAAA,GAAU,eAAA;AAG5C,IAAA,MAAM,YAAA,GAAe,OAAA,EAAS,OAAA,IAAW,OAAA,EAAS,SAAA;AAClD,IAAA,IAAI,YAAA,KAAiB,MAAA,EAAW,YAAA,CAAa,OAAA,GAAU,YAAA;AAGvD,IAAA,YAAA,CAAa,MAAM,aAAA,CAAc,GAAA;AAGjC,IAAA,IAAI,OAAA,EAAS,KAAA,EAAO,YAAA,CAAa,KAAA,GAAQ,OAAA,CAAQ,KAAA;AACjD,IAAA,IAAI,OAAA,EAAS,SAAA,EAAW,YAAA,CAAa,SAAA,GAAY,OAAA,CAAQ,SAAA;AACzD,IAAA,IAAI,OAAA,EAAS,MAAA,EAAQ,YAAA,CAAa,MAAA,GAAS,OAAA,CAAQ,MAAA;AAEnD,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAA;AAAA,MAC5B;AAAA,KACF;AAGA,IAAA,MAAM,OAAA,CAAQ,MAAM,gBAAgB,CAAA;AAEpC,IAAA,MAAM,MAAA,GAAgC;AAAA,MACpC,YAAA,EAAc,gBAAA;AAAA,MAEd,IAAA,EAAM,OACJ,OAAA,EACA,IAAA,KAKwB;AACxB,QAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,UAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AACpB,UAAA,MAAM,UAAA,GAAa,IAAI,WAAA,CAAY,kBAAA,EAAoB,IAAI,CAAA;AAC3D,UAAA,MAAM,UAAA,GAAa,IAAI,WAAA,CAAY,kBAAA,EAAoB,EAAE,CAAA;AACzD,UAAA,IAAI,OAAA,GAAU,EAAA;AAEd,UAAA,MAAM,cAAA,GAAiB,IAAI,QAAA,CAAS;AAAA,YAClC,KAAA,CAAM,KAAA,EAAO,SAAA,EAAW,QAAA,EAAU;AAChC,cAAA,MAAM,IAAA,GAAO,OAAA,GAAU,KAAA,CAAM,QAAA,EAAS;AACtC,cAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,cAAA,OAAA,GAAU,KAAA,CAAM,KAAI,IAAK,EAAA;AACzB,cAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,gBAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AACpB,gBAAA,MAAA,CAAO,IAAI,CAAA;AAAA,cACb;AACA,cAAA,QAAA,EAAS;AAAA,YACX,CAAA;AAAA,YACA,MAAM,QAAA,EAAU;AACd,cAAA,IAAI,OAAA,EAAS;AACX,gBAAA,UAAA,CAAW,KAAK,OAAO,CAAA;AACvB,gBAAA,MAAA,CAAO,OAAO,CAAA;AACd,gBAAA,OAAA,GAAU,EAAA;AAAA,cACZ;AACA,cAAA,QAAA,EAAS;AAAA,YACX;AAAA,WACD,CAAA;AAED,UAAA,MAAM,cAAA,GAAiB,IAAI,QAAA,CAAS;AAAA,YAClC,KAAA,CAAM,KAAA,EAAO,SAAA,EAAW,QAAA,EAAU;AAChC,cAAA,UAAA,CAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAU,CAAA;AAChC,cAAA,QAAA,EAAS;AAAA,YACX;AAAA,WACD,CAAA;AAED,UAAA,MAAMA,OAAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW;AAAA,YACtC,GAAA,EAAK,IAAA;AAAA,YACL,IAAA,EAAM,CAAC,IAAA,EAAM,OAAO,CAAA;AAAA,YACpB,GAAA,EAAK,MAAM,GAAA,IAAO,gBAAA;AAAA,YAClB,MAAA,EAAQ,cAAA;AAAA,YACR,MAAA,EAAQ,cAAA;AAAA,YACR,GAAI,IAAA,EAAM,IAAA,GAAO,EAAE,IAAA,EAAM,IAAA,KAAS;AAAC,WACpC,CAAA;AAED,UAAA,OAAO;AAAA,YACL,MAAA,EAAQ,WAAW,QAAA,EAAS;AAAA,YAC5B,MAAA,EAAQ,WAAW,QAAA,EAAS;AAAA,YAC5B,UAAUA,OAAAA,CAAO;AAAA,WACnB;AAAA,QACF;AAEA,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW;AAAA,UACtC,GAAA,EAAK,IAAA;AAAA,UACL,IAAA,EAAM,CAAC,IAAA,EAAM,OAAO,CAAA;AAAA,UACpB,GAAA,EAAK,MAAM,GAAA,IAAO,gBAAA;AAAA,UAClB,GAAI,IAAA,EAAM,IAAA,GAAO,EAAE,IAAA,EAAM,IAAA,KAAS;AAAC,SACpC,CAAA;AAED,QAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,EAAO;AACnC,QAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,EAAO;AAEnC,QAAA,OAAO;AAAA,UACL,MAAA;AAAA,UACA,MAAA;AAAA,UACA,UAAU,MAAA,CAAO;AAAA,SACnB;AAAA,MACF,CAAA;AAAA,MAEA,MAAA,EAAQ,OACN,QAAA,EACA,WAAA,KACkB;AAClB,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAQ,CAAA;AAChC,QAAA,IAAI,IAAA,CAAK,aAAY,EAAG;AACtB,UAAA,MAAM,OAAA,GAAU,IAAA;AAAA,YACd,MAAA,EAAO;AAAA,YACP,CAAA,kBAAA,EAAqB,IAAA,CAAK,GAAA,EAAK,CAAA,OAAA;AAAA,WACjC;AACA,UAAA,QAAA,CAAS,CAAA,UAAA,EAAa,OAAO,CAAA,MAAA,EAAS,QAAQ,CAAA,GAAA,CAAK,CAAA;AACnD,UAAA,IAAI;AACF,YAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,OAAO,CAAA;AACzC,YAAA,MAAM,cAAA,GAAiB,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAA,EAAK,CAAA,OAAA,CAAA;AAC3D,YAAA,MAAM,QAAQ,UAAA,CAAW;AAAA,cACvB,EAAE,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,UAAA;AAAW,aAC7C,CAAA;AACD,YAAA,MAAM,QAAQ,UAAA,CAAW;AAAA,cACvB,GAAA,EAAK,IAAA;AAAA,cACL,IAAA,EAAM;AAAA,gBACJ,IAAA;AAAA,gBACA,aAAa,WAAW,CAAA,eAAA,EAAkB,cAAc,CAAA,MAAA,EAAS,WAAW,eAAe,cAAc,CAAA,CAAA;AAAA;AAC3G,aACD,CAAA;AAAA,UACH,CAAA,SAAE;AACA,YAAA,MAAM,MAAA,CAAO,OAAO,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAAA,UACtC;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,QAAQ,CAAA;AACvC,UAAA,MAAM,OAAA,CAAQ,WAAW,CAAC,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,CAAC,CAAA;AAAA,QAC3D;AAAA,MACF,CAAA;AAAA,MAEA,WAAA,EAAa,OACX,WAAA,EACA,QAAA,KACkB;AAClB,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,gBAAA,CAAiB;AAAA,UAC5C,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,WAAW,CAAA,CAAE,CAAA;AAAA,QACpE;AACA,QAAA,MAAM,MAAM,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,QAAA,MAAM,SAAA,CAAU,UAAU,MAAM,CAAA;AAAA,MAClC,CAAA;AAAA,MAEA,OAAO,YAA2B;AAChC,QAAA,MAAM,QAAQ,IAAA,EAAK;AAAA,MACrB;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAC","file":"vercel.js","sourcesContent":["/**\n * Vercel isolated sandbox provider — wraps `@vercel/sandbox` into a SandboxProvider.\n *\n * Usage:\n *   import { vercel } from \"sandcastle/sandboxes/vercel\";\n *   await run({ agent: claudeCode(\"claude-opus-4-7\"), sandbox: vercel() });\n */\n\nimport { execSync } from \"node:child_process\";\nimport { readFile, unlink, writeFile, mkdir, stat } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { Writable } from \"node:stream\";\nimport {\n  createIsolatedSandboxProvider,\n  type ExecResult,\n  type IsolatedSandboxHandle,\n  type IsolatedSandboxProvider,\n} from \"../SandboxProvider.js\";\nimport { BoundedTail, MAX_TAIL_CHARS } from \"../boundedTail.js\";\n\n/** Worktree path inside the Vercel sandbox. */\nconst VERCEL_REPO_PATH = \"/vercel/sandbox/workspace\";\n\n/**\n * Options for creating a Vercel sandbox provider.\n *\n * All `@vercel/sandbox` `Sandbox.create()` options are accepted as pass-through,\n * plus Sandcastle-specific options for auth and branch strategy.\n */\nexport interface VercelOptions {\n  /**\n   * Vercel access token.\n   *\n   * Falls back to the SDK's default auth behavior, which reads\n   * `VERCEL_OIDC_TOKEN` (recommended for Vercel-hosted environments) or\n   * `VERCEL_TOKEN` from the environment.\n   */\n  readonly token?: string;\n\n  // ---- Pass-through @vercel/sandbox Sandbox.create() options ----\n\n  /**\n   * The source of the sandbox (git repo, tarball, or snapshot).\n   * Omit to start an empty sandbox.\n   */\n  readonly source?:\n    | {\n        type: \"git\";\n        url: string;\n        depth?: number;\n        revision?: string;\n        username?: string;\n        password?: string;\n      }\n    | {\n        type: \"tarball\";\n        url: string;\n      }\n    | {\n        type: \"snapshot\";\n        snapshotId: string;\n      };\n\n  /** Array of port numbers to expose from the sandbox (up to 4). */\n  readonly ports?: number[];\n\n  /** Timeout in milliseconds before the sandbox auto-terminates. */\n  readonly timeout?: number;\n\n  /**\n   * Resources to allocate to the sandbox.\n   * Each vCPU gets 2048 MB of memory.\n   */\n  readonly resources?: {\n    vcpus: number;\n  };\n\n  /**\n   * The runtime of the sandbox (e.g. `\"node24\"`, `\"node22\"`, `\"python3.13\"`).\n   * Defaults to `\"node24\"`.\n   */\n  readonly runtime?: string;\n\n  /**\n   * Network policy for the sandbox.\n   * Defaults to full internet access if not specified.\n   */\n  readonly networkPolicy?: Record<string, unknown>;\n\n  /**\n   * Vercel project ID to associate sandbox operations with.\n   */\n  readonly projectId?: string;\n\n  /**\n   * Vercel team ID to associate sandbox operations with.\n   */\n  readonly teamId?: string;\n\n  /**\n   * Timeout in milliseconds (alias for `timeout`, kept for discoverability).\n   */\n  readonly timeoutMs?: number;\n\n  /**\n   * Sandbox template shorthand (e.g. `\"node-22\"`).\n   * Maps to the `runtime` option.\n   */\n  readonly template?: string;\n\n  /** Environment variables injected by this provider. Merged at launch time with env resolver and agent provider env. */\n  readonly env?: Record<string, string>;\n\n  /**\n   * Maximum number of characters of streamed `exec` output retained per stream\n   * (stdout and stderr) when an `onLine` callback is supplied (default: 64KiB).\n   *\n   * Output is delivered live to `onLine` regardless; this only bounds the tail\n   * returned in `ExecResult`, preventing a long-running agent's output from\n   * overflowing V8's max string length and crashing the run.\n   */\n  readonly maxOutputTailChars?: number;\n}\n\n/**\n * Create a Vercel isolated sandbox provider.\n *\n * The returned provider creates Vercel Firecracker microVM sandboxes via\n * the `@vercel/sandbox` SDK. Each sandbox is ephemeral — one sandbox per run.\n *\n * Requires `@vercel/sandbox` to be installed as a peer dependency.\n */\nexport const vercel = (options?: VercelOptions): IsolatedSandboxProvider =>\n  createIsolatedSandboxProvider({\n    name: \"vercel\",\n    env: options?.env,\n    create: async (createOptions): Promise<IsolatedSandboxHandle> => {\n      const maxOutputTailChars = options?.maxOutputTailChars ?? MAX_TAIL_CHARS;\n      // Dynamic import so the peer dependency is only loaded at runtime\n      const { Sandbox } = await import(\"@vercel/sandbox\");\n\n      const createParams: Record<string, unknown> = {};\n\n      // Pass through SDK options\n      if (options?.source) createParams.source = options.source;\n      if (options?.ports) createParams.ports = options.ports;\n      if (options?.resources) createParams.resources = options.resources;\n      if (options?.networkPolicy)\n        createParams.networkPolicy = options.networkPolicy;\n      // runtime takes precedence over the template convenience alias\n      const resolvedRuntime = options?.runtime ?? options?.template;\n      if (resolvedRuntime) createParams.runtime = resolvedRuntime;\n\n      // Timeout: prefer explicit timeout, fall back to timeoutMs alias\n      const timeoutValue = options?.timeout ?? options?.timeoutMs;\n      if (timeoutValue !== undefined) createParams.timeout = timeoutValue;\n\n      // Merge provider env with Sandcastle env\n      createParams.env = createOptions.env;\n\n      // Auth: pass token and team/project IDs if provided\n      if (options?.token) createParams.token = options.token;\n      if (options?.projectId) createParams.projectId = options.projectId;\n      if (options?.teamId) createParams.teamId = options.teamId;\n\n      const sandbox = await Sandbox.create(\n        createParams as Parameters<typeof Sandbox.create>[0],\n      );\n\n      // Ensure worktree directory exists\n      await sandbox.mkDir(VERCEL_REPO_PATH);\n\n      const handle: IsolatedSandboxHandle = {\n        worktreePath: VERCEL_REPO_PATH,\n\n        exec: async (\n          command: string,\n          opts?: {\n            onLine?: (line: string) => void;\n            cwd?: string;\n            sudo?: boolean;\n          },\n        ): Promise<ExecResult> => {\n          if (opts?.onLine) {\n            const onLine = opts.onLine;\n            const stdoutTail = new BoundedTail(maxOutputTailChars, \"\\n\");\n            const stderrTail = new BoundedTail(maxOutputTailChars, \"\");\n            let partial = \"\";\n\n            const stdoutWritable = new Writable({\n              write(chunk, _encoding, callback) {\n                const text = partial + chunk.toString();\n                const lines = text.split(\"\\n\");\n                partial = lines.pop() ?? \"\";\n                for (const line of lines) {\n                  stdoutTail.push(line);\n                  onLine(line);\n                }\n                callback();\n              },\n              final(callback) {\n                if (partial) {\n                  stdoutTail.push(partial);\n                  onLine(partial);\n                  partial = \"\";\n                }\n                callback();\n              },\n            });\n\n            const stderrWritable = new Writable({\n              write(chunk, _encoding, callback) {\n                stderrTail.push(chunk.toString());\n                callback();\n              },\n            });\n\n            const result = await sandbox.runCommand({\n              cmd: \"sh\",\n              args: [\"-c\", command],\n              cwd: opts?.cwd ?? VERCEL_REPO_PATH,\n              stdout: stdoutWritable,\n              stderr: stderrWritable,\n              ...(opts?.sudo ? { sudo: true } : {}),\n            });\n\n            return {\n              stdout: stdoutTail.toString(),\n              stderr: stderrTail.toString(),\n              exitCode: result.exitCode,\n            };\n          }\n\n          const result = await sandbox.runCommand({\n            cmd: \"sh\",\n            args: [\"-c\", command],\n            cwd: opts?.cwd ?? VERCEL_REPO_PATH,\n            ...(opts?.sudo ? { sudo: true } : {}),\n          });\n\n          const stdout = await result.stdout();\n          const stderr = await result.stderr();\n\n          return {\n            stdout,\n            stderr,\n            exitCode: result.exitCode,\n          };\n        },\n\n        copyIn: async (\n          hostPath: string,\n          sandboxPath: string,\n        ): Promise<void> => {\n          const info = await stat(hostPath);\n          if (info.isDirectory()) {\n            const tarPath = join(\n              tmpdir(),\n              `sandcastle-copyin-${Date.now()}.tar.gz`,\n            );\n            execSync(`tar -czf \"${tarPath}\" -C \"${hostPath}\" .`);\n            try {\n              const tarContent = await readFile(tarPath);\n              const sandboxTarPath = `/tmp/sandcastle-copyin-${Date.now()}.tar.gz`;\n              await sandbox.writeFiles([\n                { path: sandboxTarPath, content: tarContent },\n              ]);\n              await sandbox.runCommand({\n                cmd: \"sh\",\n                args: [\n                  \"-c\",\n                  `mkdir -p \"${sandboxPath}\" && tar -xzf \"${sandboxTarPath}\" -C \"${sandboxPath}\" && rm -f \"${sandboxTarPath}\"`,\n                ],\n              });\n            } finally {\n              await unlink(tarPath).catch(() => {});\n            }\n          } else {\n            const content = await readFile(hostPath);\n            await sandbox.writeFiles([{ path: sandboxPath, content }]);\n          }\n        },\n\n        copyFileOut: async (\n          sandboxPath: string,\n          hostPath: string,\n        ): Promise<void> => {\n          const buffer = await sandbox.readFileToBuffer({\n            path: sandboxPath,\n          });\n          if (!buffer) {\n            throw new Error(`File not found in Vercel sandbox: ${sandboxPath}`);\n          }\n          await mkdir(dirname(hostPath), { recursive: true });\n          await writeFile(hostPath, buffer);\n        },\n\n        close: async (): Promise<void> => {\n          await sandbox.stop();\n        },\n      };\n\n      return handle;\n    },\n  });\n"]}

package/dist/templates/blank/main.mts

@@ -0,0 +1,14 @@
+import { run, agent } from "@ai-hero/sandcastle";
+import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
+
+// Blank template: customize this to build your own orchestration.
+// Run this with: npx tsx .sandcastle/main.mts
+// Or add to package.json scripts: "sandcastle": "npx tsx .sandcastle/main.mts"
+
+await run({
+  // The agent provider is resolved at runtime by agent(): the AGENT env var
+  // (or this baked default) picks the provider, AGENT_MODEL picks the model.
+  agent: agent({ default: "claude-code" }),
+  sandbox: docker(),
+  promptFile: "./.sandcastle/prompt.md",
+});