@sentry/junior 0.116.1 → 0.117.0

package/dist/{chunk-VBMMMVVQ.js → chunk-FAWBONPC.js}

@@ -1,31 +1,138 @@
 import {
   SANDBOX_WORKSPACE_ROOT,
   getStateAdapter
-} from "./chunk-7CSVG54J.js";
+} from "./chunk-KU6ALEJC.js";
 import {
   sleep
 } from "./chunk-4ZNGQH7C.js";
 import {
   toOptionalTrimmed
-} from "./chunk-CY7NXM32.js";
+} from "./chunk-DS27ZBSP.js";
 import {
   pluginCatalogRuntime
-} from "./chunk-OY2PQQ4P.js";
+} from "./chunk-CU7HTGNI.js";
 import {
   setSpanAttributes,
   setSpanStatus,
   withSpan
-} from "./chunk-F3SWGSPG.js";
+} from "./chunk-72Z3HNTQ.js";
+
+// src/chat/sandbox/snapshot/profile.ts
+import { createHash } from "crypto";
 
 // src/chat/sandbox/runtime-dependencies.ts
 var GLOBAL_RUNTIME_DEPENDENCIES = [
   { type: "system", package: "docker" },
+  { type: "system", package: "spal-release" },
   { type: "system", package: "ripgrep" }
 ];
 
-// src/chat/sandbox/runtime-dependency-snapshots.ts
-import { createHash } from "crypto";
+// src/chat/sandbox/snapshot/profile.ts
+var VERSION = 1;
+var DEFAULT_FLOATING_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+function isExactNpmVersion(version) {
+  return /^\d+\.\d+\.\d+(?:[-+][a-z0-9.]+)?$/i.test(version.trim());
+}
+function isFloating(dep) {
+  return dep.type === "npm" && !isExactNpmVersion(dep.version);
+}
+function mergeDependencies(dependencies2) {
+  const seen = /* @__PURE__ */ new Set();
+  const npmVersions = /* @__PURE__ */ new Map();
+  const merged = [];
+  for (const dependency of dependencies2) {
+    const key = dependency.type === "npm" ? `${dependency.type}:${dependency.package}:${dependency.version}` : "package" in dependency ? `${dependency.type}:package:${dependency.package}` : `${dependency.type}:url:${dependency.url}:${dependency.sha256}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    if (dependency.type === "npm") {
+      const version = npmVersions.get(dependency.package);
+      if (version !== void 0 && version !== dependency.version) {
+        throw new Error(
+          `Conflicting runtime dependency versions for ${dependency.package}: ${version} and ${dependency.version}`
+        );
+      }
+      npmVersions.set(dependency.package, dependency.version);
+    }
+    merged.push(dependency);
+  }
+  return merged;
+}
+function floatingMaxAgeMs() {
+  const raw = process.env.SANDBOX_SNAPSHOT_FLOATING_MAX_AGE_MS;
+  if (!raw?.trim()) {
+    return DEFAULT_FLOATING_MAX_AGE_MS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_FLOATING_MAX_AGE_MS;
+}
+function create(runtime) {
+  const dependencies2 = mergeDependencies([
+    ...GLOBAL_RUNTIME_DEPENDENCIES,
+    ...pluginCatalogRuntime.getRuntimeDependencies()
+  ]);
+  const postinstall2 = pluginCatalogRuntime.getRuntimePostinstall();
+  if (dependencies2.length === 0 && postinstall2.length === 0) {
+    return null;
+  }
+  const rebuildEpoch = process.env.SANDBOX_SNAPSHOT_REBUILD_EPOCH?.trim() ?? "";
+  const floating = dependencies2.some((dependency) => isFloating(dependency)) || postinstall2.length > 0;
+  const hash2 = createHash("sha256").update(
+    JSON.stringify({
+      version: VERSION,
+      runtime,
+      rebuildEpoch,
+      dependencies: dependencies2,
+      postinstall: postinstall2
+    })
+  ).digest("hex");
+  return {
+    hash: hash2,
+    dependencyCount: dependencies2.length,
+    floating,
+    dependencies: dependencies2,
+    postinstall: postinstall2
+  };
+}
+function hash(runtime) {
+  return create(runtime)?.hash;
+}
+function isStale(profile, createdAtMs) {
+  if (!profile.floating) {
+    return false;
+  }
+  const maxAgeMs = floatingMaxAgeMs();
+  return maxAgeMs === 0 || Date.now() - createdAtMs > maxAgeMs;
+}
+
+// src/chat/sandbox/snapshot/resolve.ts
 import { Sandbox } from "@vercel/sandbox";
+import { z } from "zod";
+
+// src/chat/sandbox/credentials.ts
+function getVercelSandboxCredentials() {
+  const token = toOptionalTrimmed(process.env.VERCEL_TOKEN);
+  const teamId = toOptionalTrimmed(process.env.VERCEL_TEAM_ID);
+  const projectId = toOptionalTrimmed(process.env.VERCEL_PROJECT_ID);
+  if (token && teamId && projectId) {
+    return { token, teamId, projectId };
+  }
+  return void 0;
+}
+
+// src/chat/sandbox/resources.ts
+function getSandboxResources() {
+  const value = process.env.SANDBOX_VCPUS?.trim();
+  if (!value || !/^\d+$/.test(value)) {
+    return void 0;
+  }
+  const vcpus = Number(value);
+  if (!Number.isSafeInteger(vcpus) || vcpus <= 0) {
+    return void 0;
+  }
+  return { vcpus };
+}
 
 // src/chat/sandbox/noninteractive-command.ts
 var NON_INTERACTIVE_ENV = {
@@ -96,15 +203,215 @@ async function runNonInteractiveCommand(sandbox, input) {
   return await sandbox.runCommand(command);
 }
 
-// src/chat/sandbox/credentials.ts
-function getVercelSandboxCredentials() {
-  const token = toOptionalTrimmed(process.env.VERCEL_TOKEN);
-  const teamId = toOptionalTrimmed(process.env.VERCEL_TEAM_ID);
-  const projectId = toOptionalTrimmed(process.env.VERCEL_PROJECT_ID);
-  if (token && teamId && projectId) {
-    return { token, teamId, projectId };
+// src/chat/sandbox/snapshot/span.ts
+async function trace(name, op, attributes, callback) {
+  return await withSpan(name, op, {}, callback, attributes);
+}
+
+// src/chat/sandbox/snapshot/install.ts
+async function runOrThrow(sandbox, params, label) {
+  const result = await runNonInteractiveCommand(sandbox, params);
+  if (result.exitCode === 0) {
+    return;
   }
-  return void 0;
+  const detail = result.stderr.trim() || result.stdout.trim() || "command failed";
+  throw new Error(`${label} failed: ${detail}`);
+}
+async function tryRun(sandbox, params) {
+  const result = await runNonInteractiveCommand(sandbox, params);
+  return result.exitCode === 0;
+}
+async function installGh(sandbox) {
+  const installed = await tryRun(sandbox, {
+    cmd: "dnf",
+    args: ["install", "-y", "gh"],
+    sudo: true
+  });
+  if (installed) {
+    return;
+  }
+  const repoAdded = await tryRun(sandbox, {
+    cmd: "dnf",
+    args: [
+      "config-manager",
+      "addrepo",
+      "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"
+    ],
+    sudo: true
+  });
+  if (!repoAdded) {
+    await runOrThrow(
+      sandbox,
+      {
+        cmd: "dnf",
+        args: ["install", "-y", "dnf-command(config-manager)"],
+        sudo: true
+      },
+      "dnf install dnf-command(config-manager)"
+    );
+    await runOrThrow(
+      sandbox,
+      {
+        cmd: "dnf",
+        args: [
+          "config-manager",
+          "--add-repo",
+          "https://cli.github.com/packages/rpm/gh-cli.repo"
+        ],
+        sudo: true
+      },
+      "dnf config-manager --add-repo gh-cli.repo"
+    );
+  }
+  await runOrThrow(
+    sandbox,
+    {
+      cmd: "dnf",
+      args: ["install", "-y", "gh", "--repo", "gh-cli"],
+      sudo: true
+    },
+    "dnf install gh --repo gh-cli"
+  );
+}
+function filePath(url, sha256) {
+  let basename = "package.rpm";
+  try {
+    const candidate = new URL(url).pathname.split("/").filter(Boolean).at(-1);
+    if (candidate) {
+      basename = candidate;
+    }
+  } catch {
+  }
+  const sanitized = basename.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return `/tmp/junior-runtime-${sha256.slice(0, 12)}-${sanitized}`;
+}
+async function installUrl(sandbox, dependency) {
+  const rpmPath = filePath(dependency.url, dependency.sha256);
+  await runOrThrow(
+    sandbox,
+    {
+      cmd: "curl",
+      args: ["-fsSL", dependency.url, "-o", rpmPath]
+    },
+    `curl download ${dependency.url}`
+  );
+  const checksum = await runNonInteractiveCommand(sandbox, {
+    cmd: "sha256sum",
+    args: [rpmPath]
+  });
+  const expected = dependency.sha256;
+  const actual = checksum.stdout.trim().split(/\s+/)[0]?.toLowerCase();
+  if (checksum.exitCode !== 0) {
+    const detail = checksum.stderr.trim() || checksum.stdout.trim() || "command failed";
+    throw new Error(`sha256sum failed: ${detail}`);
+  }
+  if (!actual) {
+    throw new Error("sha256sum produced empty output");
+  }
+  if (actual !== expected) {
+    throw new Error(
+      `checksum mismatch for ${dependency.url}: expected ${expected}, got ${actual}`
+    );
+  }
+  await runOrThrow(
+    sandbox,
+    {
+      cmd: "dnf",
+      args: ["install", "-y", rpmPath],
+      sudo: true
+    },
+    `dnf install ${dependency.url}`
+  );
+}
+async function dependencies(sandbox, values) {
+  const system = values.filter(
+    (dependency) => dependency.type === "system"
+  );
+  const npm = values.filter(
+    (dependency) => dependency.type === "npm"
+  ).map((dependency) => `${dependency.package}@${dependency.version}`);
+  if (system.length > 0) {
+    await trace(
+      "sandbox.snapshot.install_system",
+      "sandbox.snapshot.install.system",
+      {
+        "app.sandbox.snapshot.install.system_count": system.length
+      },
+      async () => {
+        for (const dependency of system) {
+          if ("url" in dependency) {
+            await installUrl(sandbox, dependency);
+          } else if (dependency.package === "gh") {
+            await installGh(sandbox);
+          } else {
+            await runOrThrow(
+              sandbox,
+              {
+                cmd: "dnf",
+                args: ["install", "-y", dependency.package],
+                sudo: true
+              },
+              `dnf install ${dependency.package}`
+            );
+          }
+        }
+      }
+    );
+  }
+  if (npm.length > 0) {
+    await trace(
+      "sandbox.snapshot.install_npm",
+      "sandbox.snapshot.install.npm",
+      {
+        "app.sandbox.snapshot.install.npm_count": npm.length
+      },
+      async () => {
+        await runOrThrow(
+          sandbox,
+          {
+            cmd: "npm",
+            args: [
+              "install",
+              "--global",
+              "--prefix",
+              `${SANDBOX_WORKSPACE_ROOT}/.junior`,
+              ...npm
+            ]
+          },
+          "npm install"
+        );
+      }
+    );
+  }
+}
+async function postinstall(sandbox, commands) {
+  if (commands.length === 0) {
+    return;
+  }
+  await trace(
+    "sandbox.snapshot.runtime_postinstall",
+    "sandbox.snapshot.runtime_postinstall",
+    {
+      "app.sandbox.snapshot.runtime_postinstall.count": commands.length
+    },
+    async () => {
+      for (const command of commands) {
+        const result = await runNonInteractiveCommand(sandbox, {
+          cmd: command.cmd,
+          args: command.args,
+          login: true,
+          pathPrefix: `${SANDBOX_WORKSPACE_ROOT}/.junior/bin:$PATH`,
+          ...command.sudo !== void 0 ? { sudo: command.sudo } : {}
+        });
+        if (result.exitCode !== 0) {
+          const detail = result.stderr.trim() || result.stdout.trim() || "command failed";
+          throw new Error(
+            `runtime-postinstall ${command.cmd} failed: ${detail}`
+          );
+        }
+      }
+    }
+  );
 }
 
 // src/chat/sandbox/workspace.ts
@@ -350,21 +657,21 @@ function bindSandboxFileSystem(fs, signal) {
     return fs;
   }
   return {
-    readFile(filePath, options) {
+    readFile(filePath2, options) {
       signal.throwIfAborted();
-      return fs.readFile(filePath, { ...options, signal });
+      return fs.readFile(filePath2, { ...options, signal });
     },
-    writeFile(filePath, content, options) {
+    writeFile(filePath2, content, options) {
       signal.throwIfAborted();
-      return fs.writeFile(filePath, content, { ...options, signal });
+      return fs.writeFile(filePath2, content, { ...options, signal });
     },
-    readdir(filePath) {
+    readdir(filePath2) {
       signal.throwIfAborted();
-      return fs.readdir(filePath, { signal });
+      return fs.readdir(filePath2, { signal });
     },
-    stat(filePath) {
+    stat(filePath2) {
       signal.throwIfAborted();
-      return fs.stat(filePath, { signal });
+      return fs.stat(filePath2, { signal });
     }
   };
 }
@@ -382,12 +689,12 @@ function createSandboxSession(sandbox, options) {
     }
   };
   const fs = {
-    readFile: async (filePath, readOptions) => await run(async () => await fileSystem.readFile(filePath, readOptions)),
-    writeFile: async (filePath, content, writeOptions) => await run(
-      async () => await fileSystem.writeFile(filePath, content, writeOptions)
+    readFile: async (filePath2, readOptions) => await run(async () => await fileSystem.readFile(filePath2, readOptions)),
+    writeFile: async (filePath2, content, writeOptions) => await run(
+      async () => await fileSystem.writeFile(filePath2, content, writeOptions)
     ),
-    readdir: async (filePath, readOptions) => await run(async () => await fileSystem.readdir(filePath, readOptions)),
-    stat: async (filePath, statOptions) => await run(async () => await fileSystem.stat(filePath, statOptions))
+    readdir: async (filePath2, readOptions) => await run(async () => await fileSystem.readdir(filePath2, readOptions)),
+    stat: async (filePath2, statOptions) => await run(async () => await fileSystem.stat(filePath2, statOptions))
   };
   return {
     sandboxId: sandbox.name,
@@ -432,109 +739,43 @@ function createSandboxSession(sandbox, options) {
   };
 }
 
-// src/chat/sandbox/resources.ts
-function getSandboxResources() {
-  const value = process.env.SANDBOX_VCPUS?.trim();
-  if (!value || !/^\d+$/.test(value)) {
-    return void 0;
-  }
-  const vcpus = Number(value);
-  if (!Number.isSafeInteger(vcpus) || vcpus <= 0) {
-    return void 0;
-  }
-  return { vcpus };
-}
-
-// src/chat/sandbox/runtime-dependency-snapshots.ts
+// src/chat/sandbox/snapshot/resolve.ts
 var SNAPSHOT_CACHE_PREFIX = "junior:sandbox_snapshot_profile";
 var SNAPSHOT_LOCK_PREFIX = "junior:sandbox_snapshot_lock";
-var SNAPSHOT_PROFILE_VERSION = 2;
 var SNAPSHOT_CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
-var SNAPSHOT_BUILD_LOCK_TTL_MS = 10 * 60 * 1e3;
-var SNAPSHOT_WAIT_FOR_LOCK_MS = SNAPSHOT_BUILD_LOCK_TTL_MS + 30 * 1e3;
-var DEFAULT_FLOATING_DEP_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
-var RIPGREP_VERSION = "15.1.0";
-var RIPGREP_ARCHIVE_SHA256 = "1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599";
-var RIPGREP_ARCHIVE_URL = `https://github.com/BurntSushi/ripgrep/releases/download/${RIPGREP_VERSION}/ripgrep-${RIPGREP_VERSION}-x86_64-unknown-linux-musl.tar.gz`;
+var SNAPSHOT_BUILD_LOCK_BUFFER_MS = 30 * 1e3;
+var SNAPSHOT_WAIT_FOR_LOCK_BUFFER_MS = 30 * 1e3;
+var cachedSnapshotSchema = z.object({
+  profileHash: z.string(),
+  snapshotId: z.string(),
+  runtime: z.string(),
+  createdAtMs: z.number(),
+  dependencyCount: z.number()
+}).strict();
 function profileCacheKey(profileHash) {
   return `${SNAPSHOT_CACHE_PREFIX}:${profileHash}`;
 }
 function profileLockKey(profileHash) {
   return `${SNAPSHOT_LOCK_PREFIX}:${profileHash}`;
 }
-function isExactNpmVersion(version) {
-  return /^\d+\.\d+\.\d+(?:[-+][a-z0-9.]+)?$/i.test(version.trim());
-}
-function hasFloatingSelector(dep) {
-  return dep.type === "npm" && !isExactNpmVersion(dep.version);
-}
-function parseFloatingDepMaxAgeMs() {
-  const raw = process.env.SANDBOX_SNAPSHOT_FLOATING_MAX_AGE_MS;
-  if (!raw?.trim()) {
-    return DEFAULT_FLOATING_DEP_MAX_AGE_MS;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed < 0) {
-    return DEFAULT_FLOATING_DEP_MAX_AGE_MS;
-  }
-  return parsed;
-}
-function buildDependencyProfile(runtime) {
-  const dependencies = [
-    ...GLOBAL_RUNTIME_DEPENDENCIES,
-    ...pluginCatalogRuntime.getRuntimeDependencies()
-  ];
-  const postinstall = pluginCatalogRuntime.getRuntimePostinstall();
-  if (dependencies.length === 0 && postinstall.length === 0) {
+async function getCachedSnapshot(profileHash) {
+  const state = getStateAdapter();
+  await state.connect();
+  const raw = await state.get(profileCacheKey(profileHash));
+  if (typeof raw !== "string") {
     return null;
   }
-  const rebuildEpoch = process.env.SANDBOX_SNAPSHOT_REBUILD_EPOCH?.trim() ?? "";
-  const hasFloatingVersions = dependencies.some((dep) => hasFloatingSelector(dep)) || postinstall.length > 0;
-  const hashInput = JSON.stringify({
-    version: SNAPSHOT_PROFILE_VERSION,
-    runtime,
-    rebuildEpoch,
-    dependencies,
-    postinstall
-  });
-  const profileHash = createHash("sha256").update(hashInput).digest("hex");
-  return {
-    profileHash,
-    dependencyCount: dependencies.length,
-    hasFloatingVersions,
-    dependencies,
-    postinstall
-  };
-}
-function getRuntimeDependencyProfileHash(runtime) {
-  return buildDependencyProfile(runtime)?.profileHash;
-}
-function shouldRebuildCachedSnapshot(profile, cached) {
-  if (!profile.hasFloatingVersions) {
-    return false;
-  }
-  const maxAgeMs = parseFloatingDepMaxAgeMs();
-  if (maxAgeMs === 0) {
-    return true;
-  }
-  return Date.now() - cached.createdAtMs > maxAgeMs;
-}
-async function getCachedSnapshot(profileHash) {
+  let value;
   try {
-    const state = getStateAdapter();
-    await state.connect();
-    const raw = await state.get(profileCacheKey(profileHash));
-    if (typeof raw !== "string") {
-      return null;
-    }
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || typeof parsed.profileHash !== "string" || typeof parsed.snapshotId !== "string" || typeof parsed.runtime !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.dependencyCount !== "number") {
-      return null;
-    }
-    return parsed;
+    value = JSON.parse(raw);
   } catch {
-    return null;
+    throw new Error(`Invalid cached sandbox snapshot for ${profileHash}`);
   }
+  const parsed = cachedSnapshotSchema.safeParse(value);
+  if (!parsed.success || parsed.data.profileHash !== profileHash) {
+    throw new Error(`Invalid cached sandbox snapshot for ${profileHash}`);
+  }
+  return parsed.data;
 }
 async function setCachedSnapshot(entry) {
   const state = getStateAdapter();
@@ -545,280 +786,13 @@ async function setCachedSnapshot(entry) {
     SNAPSHOT_CACHE_TTL_MS
   );
 }
-async function withSnapshotSpan(name, op, attributes, callback) {
-  return await withSpan(name, op, {}, callback, attributes);
-}
-async function runOrThrow(sandbox, params, label) {
-  const result = await runNonInteractiveCommand(sandbox, params);
-  if (result.exitCode === 0) {
-    return;
-  }
-  const stderr = result.stderr.trim();
-  const stdout = result.stdout.trim();
-  const detail = stderr || stdout || "command failed";
-  throw new Error(`${label} failed: ${detail}`);
-}
-async function tryRun(sandbox, params) {
-  const result = await runNonInteractiveCommand(sandbox, params);
-  if (result.exitCode === 0) {
-    return { ok: true };
-  }
-  const stderr = result.stderr.trim();
-  const stdout = result.stdout.trim();
-  return { ok: false, detail: stderr || stdout || "command failed" };
-}
-async function installGhCliViaDnf(sandbox) {
-  const direct = await tryRun(sandbox, {
-    cmd: "dnf",
-    args: ["install", "-y", "gh"],
-    sudo: true
-  });
-  if (direct.ok) {
-    return;
-  }
-  const dnf5Repo = await tryRun(sandbox, {
-    cmd: "dnf",
-    args: [
-      "config-manager",
-      "addrepo",
-      "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"
-    ],
-    sudo: true
-  });
-  if (!dnf5Repo.ok) {
-    await runOrThrow(
-      sandbox,
-      {
-        cmd: "dnf",
-        args: ["install", "-y", "dnf-command(config-manager)"],
-        sudo: true
-      },
-      "dnf install dnf-command(config-manager)"
-    );
-    await runOrThrow(
-      sandbox,
-      {
-        cmd: "dnf",
-        args: [
-          "config-manager",
-          "--add-repo",
-          "https://cli.github.com/packages/rpm/gh-cli.repo"
-        ],
-        sudo: true
-      },
-      "dnf config-manager --add-repo gh-cli.repo"
-    );
-  }
-  await runOrThrow(
-    sandbox,
-    {
-      cmd: "dnf",
-      args: ["install", "-y", "gh", "--repo", "gh-cli"],
-      sudo: true
-    },
-    "dnf install gh --repo gh-cli"
-  );
-}
-function runtimeDependencyFilePath(url, sha256) {
-  let urlBasename = "package.rpm";
-  try {
-    const pathname = new URL(url).pathname;
-    const segments = pathname.split("/").filter(Boolean);
-    const candidate = segments[segments.length - 1];
-    if (candidate) {
-      urlBasename = candidate;
-    }
-  } catch {
-  }
-  const sanitizedBasename = urlBasename.replace(/[^a-zA-Z0-9._-]/g, "_");
-  return `/tmp/junior-runtime-${sha256.slice(0, 12)}-${sanitizedBasename}`;
-}
-async function downloadVerifiedRuntimeDependency(sandbox, url, sha256) {
-  const filePath = runtimeDependencyFilePath(url, sha256);
-  await runOrThrow(
-    sandbox,
-    {
-      cmd: "curl",
-      args: ["-fsSL", url, "-o", filePath]
-    },
-    `curl download ${url}`
-  );
-  const checksumResult = await runNonInteractiveCommand(sandbox, {
-    cmd: "sha256sum",
-    args: [filePath]
-  });
-  const checksumStdout = checksumResult.stdout.trim();
-  const checksumStderr = checksumResult.stderr.trim();
-  if (checksumResult.exitCode !== 0) {
-    throw new Error(
-      `sha256sum failed: ${checksumStderr || checksumStdout || "command failed"}`
-    );
-  }
-  const actualChecksum = checksumStdout.split(/\s+/)[0]?.toLowerCase();
-  if (!actualChecksum) {
-    throw new Error("sha256sum produced empty output");
-  }
-  if (actualChecksum !== sha256) {
-    throw new Error(
-      `checksum mismatch for ${url}: expected ${sha256}, got ${actualChecksum}`
-    );
-  }
-  return filePath;
-}
-async function installRipgrep(sandbox) {
-  const archivePath = await downloadVerifiedRuntimeDependency(
-    sandbox,
-    RIPGREP_ARCHIVE_URL,
-    RIPGREP_ARCHIVE_SHA256
-  );
-  const extractedDir = `/tmp/ripgrep-${RIPGREP_VERSION}-x86_64-unknown-linux-musl`;
-  await runOrThrow(
-    sandbox,
-    {
-      cmd: "tar",
-      args: ["-xzf", archivePath, "-C", "/tmp"]
-    },
-    "extract ripgrep"
-  );
-  await runOrThrow(
-    sandbox,
-    {
-      cmd: "mkdir",
-      args: ["-p", `${SANDBOX_WORKSPACE_ROOT}/.junior/bin`]
-    },
-    "create sandbox bin directory"
-  );
-  await runOrThrow(
-    sandbox,
-    {
-      cmd: "install",
-      args: [
-        "-m",
-        "0755",
-        `${extractedDir}/rg`,
-        `${SANDBOX_WORKSPACE_ROOT}/.junior/bin/rg`
-      ]
-    },
-    "install ripgrep"
-  );
-}
-async function installRuntimeDependencies(sandbox, deps) {
-  const systemDeps = deps.filter(
-    (dep) => dep.type === "system"
-  );
-  const npmPackages = deps.filter(
-    (dep) => dep.type === "npm"
-  ).map((dep) => `${dep.package}@${dep.version}`);
-  if (systemDeps.length > 0) {
-    await withSnapshotSpan(
-      "sandbox.snapshot.install_system",
-      "sandbox.snapshot.install.system",
-      {
-        "app.sandbox.snapshot.install.system_count": systemDeps.length
-      },
-      async () => {
-        for (const dep of systemDeps) {
-          if ("url" in dep) {
-            const rpmPath = await downloadVerifiedRuntimeDependency(
-              sandbox,
-              dep.url,
-              dep.sha256
-            );
-            await runOrThrow(
-              sandbox,
-              {
-                cmd: "dnf",
-                args: ["install", "-y", rpmPath],
-                sudo: true
-              },
-              `dnf install ${dep.url}`
-            );
-            continue;
-          }
-          if (dep.package === "ripgrep") {
-            await installRipgrep(sandbox);
-            continue;
-          }
-          if (dep.package === "gh") {
-            await installGhCliViaDnf(sandbox);
-            continue;
-          }
-          await runOrThrow(
-            sandbox,
-            {
-              cmd: "dnf",
-              args: ["install", "-y", dep.package],
-              sudo: true
-            },
-            `dnf install ${dep.package}`
-          );
-        }
-      }
-    );
-  }
-  if (npmPackages.length > 0) {
-    await withSnapshotSpan(
-      "sandbox.snapshot.install_npm",
-      "sandbox.snapshot.install.npm",
-      {
-        "app.sandbox.snapshot.install.npm_count": npmPackages.length
-      },
-      async () => {
-        await runOrThrow(
-          sandbox,
-          {
-            cmd: "npm",
-            args: [
-              "install",
-              "--global",
-              "--prefix",
-              `${SANDBOX_WORKSPACE_ROOT}/.junior`,
-              ...npmPackages
-            ]
-          },
-          "npm install"
-        );
-      }
-    );
-  }
-}
-async function runRuntimePostinstall(sandbox, commands) {
-  if (commands.length === 0) {
-    return;
-  }
-  await withSnapshotSpan(
-    "sandbox.snapshot.runtime_postinstall",
-    "sandbox.snapshot.runtime_postinstall",
-    {
-      "app.sandbox.snapshot.runtime_postinstall.count": commands.length
-    },
-    async () => {
-      for (const command of commands) {
-        const result = await runNonInteractiveCommand(sandbox, {
-          cmd: command.cmd,
-          args: command.args,
-          login: true,
-          pathPrefix: `${SANDBOX_WORKSPACE_ROOT}/.junior/bin:$PATH`,
-          ...command.sudo !== void 0 ? { sudo: command.sudo } : {}
-        });
-        if (result.exitCode === 0) {
-          continue;
-        }
-        const stderr = result.stderr.trim();
-        const stdout = result.stdout.trim();
-        const detail = stderr || stdout || "command failed";
-        throw new Error(`runtime-postinstall ${command.cmd} failed: ${detail}`);
-      }
-    }
-  );
-}
-async function createDependencySnapshot(profile, runtime, timeoutMs) {
-  return await withSnapshotSpan(
+async function build(value, runtime, timeoutMs) {
+  return await trace(
     "sandbox.snapshot.build",
     "sandbox.snapshot.build",
     {
       "app.sandbox.runtime": runtime,
-      "app.sandbox.snapshot.dependency_count": profile.dependencyCount
+      "app.sandbox.snapshot.dependency_count": value.dependencyCount
     },
     async () => {
       const sandboxCredentials = getVercelSandboxCredentials();
@@ -832,13 +806,13 @@ async function createDependencySnapshot(profile, runtime, timeoutMs) {
         })
       );
       try {
-        await installRuntimeDependencies(sandbox, profile.dependencies);
-        await runRuntimePostinstall(sandbox, profile.postinstall);
-        return await withSnapshotSpan(
+        await dependencies(sandbox, value.dependencies);
+        await postinstall(sandbox, value.postinstall);
+        return await trace(
           "sandbox.snapshot.capture",
           "sandbox.snapshot.capture",
           {
-            "app.sandbox.snapshot.dependency_count": profile.dependencyCount
+            "app.sandbox.snapshot.dependency_count": value.dependencyCount
           },
           async () => {
             const snapshot = await sandbox.snapshot();
@@ -854,40 +828,35 @@ async function createDependencySnapshot(profile, runtime, timeoutMs) {
     }
   );
 }
-async function withBuildLock(profileHash, callback, canUseCachedSnapshot, hooks) {
+async function withBuildLock(profileHash, timeoutMs, callback, canUseCachedSnapshot, onWaitingForLock) {
   const state = getStateAdapter();
   await state.connect();
   const lockKey = profileLockKey(profileHash);
-  const tryAcquireLock = async () => await state.acquireLock(lockKey, SNAPSHOT_BUILD_LOCK_TTL_MS);
+  const lockTtlMs = timeoutMs + SNAPSHOT_BUILD_LOCK_BUFFER_MS;
+  const tryAcquireLock = async () => await state.acquireLock(lockKey, lockTtlMs);
   let lock = await tryAcquireLock();
   if (lock) {
     try {
-      const result = await callback();
-      return {
-        snapshotId: result.snapshotId,
-        source: result.source,
-        waitedForLock: false
-      };
+      return await callback();
     } finally {
       await state.releaseLock(lock);
     }
   }
-  return await withSnapshotSpan(
+  return await trace(
     "sandbox.snapshot.lock_wait",
     "sandbox.snapshot.lock_wait",
     {
       "app.sandbox.snapshot.profile_hash": profileHash
     },
     async () => {
-      await hooks?.onWaitingForLock?.();
-      const waitUntil = Date.now() + SNAPSHOT_WAIT_FOR_LOCK_MS;
+      await onWaitingForLock?.();
+      const waitUntil = Date.now() + lockTtlMs + SNAPSHOT_WAIT_FOR_LOCK_BUFFER_MS;
       while (Date.now() < waitUntil) {
         const cached2 = await getCachedSnapshot(profileHash);
         if (cached2?.snapshotId && canUseCachedSnapshot(cached2)) {
           return {
             snapshotId: cached2.snapshotId,
-            source: "wait_cache",
-            waitedForLock: true
+            source: "cache_hit_after_lock_wait"
           };
         }
         lock = await tryAcquireLock();
@@ -896,8 +865,7 @@ async function withBuildLock(profileHash, callback, canUseCachedSnapshot, hooks)
             const result = await callback();
             return {
               snapshotId: result.snapshotId,
-              source: result.source,
-              waitedForLock: true
+              source: result.source === "built" ? "built" : "cache_hit_after_lock_wait"
             };
           } finally {
             await state.releaseLock(lock);
@@ -909,22 +877,18 @@ async function withBuildLock(profileHash, callback, canUseCachedSnapshot, hooks)
       if (cached?.snapshotId && canUseCachedSnapshot(cached)) {
         return {
           snapshotId: cached.snapshotId,
-          source: "wait_cache",
-          waitedForLock: true
+          source: "cache_hit_after_lock_wait"
         };
       }
       throw new Error("Timed out waiting for snapshot build lock");
     }
   );
 }
-function toResolveOutcome(forceRebuild, source, waitedForLock) {
+function toResolveOutcome(forceRebuild, source) {
   if (source === "built") {
     return forceRebuild ? "forced_rebuild" : "rebuilt";
   }
-  if (waitedForLock || source === "wait_cache") {
-    return "cache_hit_after_lock_wait";
-  }
-  return "cache_hit";
+  return source;
 }
 function getRebuildReason(params) {
   if (params.forceRebuild) {
@@ -938,8 +902,8 @@ function getRebuildReason(params) {
   }
   return void 0;
 }
-async function resolveRuntimeDependencySnapshot(params) {
-  return await withSnapshotSpan(
+async function resolve(params) {
+  return await trace(
     "sandbox.snapshot.resolve",
     "sandbox.snapshot.resolve",
     {
@@ -948,25 +912,24 @@ async function resolveRuntimeDependencySnapshot(params) {
     },
     async () => {
       await params.onProgress?.("resolve_start");
-      const resolveStartedAtMs = Date.now();
-      const profile = buildDependencyProfile(params.runtime);
-      if (!profile) {
+      const currentProfile = create(params.runtime);
+      if (!currentProfile) {
         return {
           dependencyCount: 0,
           cacheHit: false,
           resolveOutcome: "no_profile"
         };
       }
-      const cached = await getCachedSnapshot(profile.profileHash);
+      const cached = await getCachedSnapshot(currentProfile.hash);
       const cachedNeedsRebuild = Boolean(
-        cached?.snapshotId && shouldRebuildCachedSnapshot(profile, cached)
+        cached?.snapshotId && isStale(currentProfile, cached.createdAtMs)
       );
       if (!params.forceRebuild && cached?.snapshotId && !cachedNeedsRebuild) {
         await params.onProgress?.("cache_hit");
         return {
           snapshotId: cached.snapshotId,
-          profileHash: profile.profileHash,
-          dependencyCount: profile.dependencyCount,
+          profileHash: currentProfile.hash,
+          dependencyCount: currentProfile.dependencyCount,
           cacheHit: true,
           resolveOutcome: "cache_hit"
         };
@@ -982,60 +945,58 @@ async function resolveRuntimeDependencySnapshot(params) {
           if (params.staleSnapshotId) {
             return candidate.snapshotId !== params.staleSnapshotId;
           }
-          return candidate.createdAtMs > resolveStartedAtMs;
+          return candidate.snapshotId !== cached?.snapshotId;
         }
-        return !shouldRebuildCachedSnapshot(profile, candidate);
+        return !isStale(currentProfile, candidate.createdAtMs);
       };
       const lockResult = await withBuildLock(
-        profile.profileHash,
+        currentProfile.hash,
+        params.timeoutMs,
         async () => {
-          const latest = await getCachedSnapshot(profile.profileHash);
+          const latest = await getCachedSnapshot(currentProfile.hash);
           if (latest?.snapshotId && canUseCachedSnapshot(latest)) {
             await params.onProgress?.("cache_hit");
             return {
               snapshotId: latest.snapshotId,
-              source: "callback_cache"
+              source: "cache_hit"
             };
           }
           await params.onProgress?.("building_snapshot");
-          const nextSnapshotId = await createDependencySnapshot(
-            profile,
+          const nextSnapshotId = await build(
+            currentProfile,
             params.runtime,
             params.timeoutMs
           );
           await setCachedSnapshot({
-            profileHash: profile.profileHash,
+            profileHash: currentProfile.hash,
             snapshotId: nextSnapshotId,
             runtime: params.runtime,
             createdAtMs: Date.now(),
-            dependencyCount: profile.dependencyCount
+            dependencyCount: currentProfile.dependencyCount
           });
           await params.onProgress?.("build_complete");
           return { snapshotId: nextSnapshotId, source: "built" };
         },
         canUseCachedSnapshot,
-        {
-          onWaitingForLock: async () => {
-            await params.onProgress?.("waiting_for_lock");
-          }
+        async () => {
+          await params.onProgress?.("waiting_for_lock");
         }
       );
       return {
         snapshotId: lockResult.snapshotId,
-        profileHash: profile.profileHash,
-        dependencyCount: profile.dependencyCount,
+        profileHash: currentProfile.hash,
+        dependencyCount: currentProfile.dependencyCount,
         cacheHit: lockResult.source !== "built",
         resolveOutcome: toResolveOutcome(
           Boolean(params.forceRebuild),
-          lockResult.source,
-          lockResult.waitedForLock
+          lockResult.source
         ),
         ...rebuildReason ? { rebuildReason } : {}
       };
     }
   );
 }
-function isSnapshotMissingError(error) {
+function isMissingError(error) {
   const searchable = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
   return searchable.includes("snapshot") && (searchable.includes("not found") || searchable.includes("unknown") || searchable.includes("404"));
 }
@@ -1052,10 +1013,10 @@ export {
   buildNonInteractiveShellScript,
   runNonInteractiveCommand,
   getSandboxResources,
-  GLOBAL_RUNTIME_DEPENDENCIES,
+  create,
+  hash,
   bindSandboxFileSystem,
   createSandboxSession,
-  getRuntimeDependencyProfileHash,
-  resolveRuntimeDependencySnapshot,
-  isSnapshotMissingError
+  resolve,
+  isMissingError
 };