@smithers-orchestrator/sandbox 0.20.3 → 0.21.0

package/src/index.d.ts

@@ -7,6 +7,7 @@ type SandboxBundleManifest$1 = {
     status: "finished" | "failed" | "cancelled";
     runId?: string;
     patches?: string[];
+    diffBundle?: SandboxDiffBundleLike;
 };
 
 type ValidatedSandboxBundle$1 = {
@@ -39,6 +40,7 @@ declare function writeSandboxBundle(params: {
         path: string;
         content: string;
     }>;
+    diffBundle?: unknown;
 }): Promise<void>;
 /** @typedef {import("./SandboxBundleManifest.ts").SandboxBundleManifest} SandboxBundleManifest */
 /** @typedef {import("./ValidatedSandboxBundle.ts").ValidatedSandboxBundle} ValidatedSandboxBundle */
@@ -55,12 +57,34 @@ type ValidatedSandboxBundle = ValidatedSandboxBundle$1;
 
 type SandboxRuntime$1 = "bubblewrap" | "docker" | "codeplane";
 
+type SandboxPortMapping = {
+    host: number;
+    container: number;
+};
+type SandboxVolumeMount = {
+    host: string;
+    container: string;
+    readonly?: boolean;
+};
+type SandboxWorkspaceSpec = {
+    name: string;
+    snapshotId?: string;
+    idleTimeoutSecs?: number;
+    persistence?: "ephemeral" | "sticky";
+};
 type SandboxTransportConfig$1 = {
     runId: string;
     sandboxId: string;
     runtime: SandboxRuntime$1;
     rootDir: string;
     image?: string;
+    allowNetwork?: boolean;
+    env?: Record<string, string>;
+    ports?: SandboxPortMapping[];
+    volumes?: SandboxVolumeMount[];
+    memoryLimit?: string;
+    cpuLimit?: string;
+    workspace?: SandboxWorkspaceSpec;
 };
 
 type SandboxHandle = {
@@ -70,6 +94,14 @@ type SandboxHandle = {
     sandboxRoot: string;
     requestPath: string;
     resultPath: string;
+    image?: string;
+    allowNetwork?: boolean;
+    env?: Record<string, string>;
+    ports?: SandboxPortMapping[];
+    volumes?: SandboxVolumeMount[];
+    memoryLimit?: string;
+    cpuLimit?: string;
+    workspace?: SandboxWorkspaceSpec;
     containerId?: string;
     workspaceId?: string;
 };
@@ -113,12 +145,71 @@ type ExecuteSandboxChildWorkflow = (parentWorkflow: SandboxWorkflow | undefined,
     status: string;
     output: unknown;
 }>;
+type SandboxBundleStatus = "finished" | "failed" | "cancelled";
+type SandboxDiffBundleLike = {
+    seq: number;
+    baseRef: string;
+    patches: Array<{
+        path: string;
+        operation: "add" | "modify" | "delete";
+        diff: string;
+        binaryContent?: string;
+    }>;
+};
+type SandboxProviderRequest = {
+    runId: string;
+    sandboxId: string;
+    input?: unknown;
+    rootDir: string;
+    requestBundlePath: string;
+    resultBundlePath: string;
+    workflow: SandboxChildWorkflowDefinition;
+    parentWorkflow?: SandboxWorkflow;
+    executeChildWorkflow: ExecuteSandboxChildWorkflow;
+    allowNetwork: boolean;
+    maxOutputBytes: number;
+    toolTimeoutMs: number;
+    config: Record<string, unknown>;
+    signal?: AbortSignal;
+    heartbeat: (data?: unknown) => void;
+};
+type SandboxProviderResult = {
+    bundlePath: string;
+    remoteRunId?: string;
+    workspaceId?: string;
+    containerId?: string;
+} | {
+    status: SandboxBundleStatus;
+    output?: unknown;
+    outputs?: unknown;
+    runId?: string;
+    remoteRunId?: string;
+    workspaceId?: string;
+    containerId?: string;
+    diffBundle?: SandboxDiffBundleLike;
+    patches?: Array<{
+        path: string;
+        content: string;
+    }>;
+    artifacts?: Array<{
+        path: string;
+        content: string;
+    }>;
+    streamLogPath?: string | null;
+};
+type SandboxProvider = {
+    id: string;
+    run: (request: SandboxProviderRequest) => Promise<SandboxProviderResult> | SandboxProviderResult;
+    cleanup?: (request: SandboxProviderRequest) => Promise<void> | void;
+};
 type ExecuteSandboxOptions$1 = {
     parentWorkflow?: SandboxWorkflow;
     sandboxId: string;
+    provider?: SandboxProvider | string;
     runtime?: SandboxRuntime$1;
     workflow: SandboxChildWorkflowDefinition;
     executeChildWorkflow: ExecuteSandboxChildWorkflow;
+    applyDiffBundle?: (bundle: SandboxDiffBundleLike, targetDir: string) => Promise<void>;
     input?: unknown;
     rootDir: string;
     allowNetwork: boolean;
@@ -126,9 +217,13 @@ type ExecuteSandboxOptions$1 = {
     toolTimeoutMs: number;
     reviewDiffs?: boolean;
     autoAcceptDiffs?: boolean;
+    allowNested?: boolean;
     config?: Record<string, unknown>;
 };
 
+declare function registerSandboxProvider(provider: SandboxProvider): () => void;
+declare function resolveSandboxProvider(value: unknown): SandboxProvider | undefined;
+
 /**
  * @param {ExecuteSandboxOptions} options
  * @returns {Promise<unknown>}
@@ -161,4 +256,4 @@ type SandboxBundleResult = SandboxBundleResult$1;
 type SandboxTransportConfig = SandboxTransportConfig$1;
 type SandboxRuntime = SandboxRuntime$1;
 
-export { type ExecuteSandboxOptions, SANDBOX_BUNDLE_OUTPUT_MAX_ARRAY_LENGTH, SANDBOX_BUNDLE_OUTPUT_MAX_DEPTH, SANDBOX_BUNDLE_OUTPUT_MAX_STRING_LENGTH, SANDBOX_BUNDLE_PATH_MAX_LENGTH, SANDBOX_BUNDLE_RUN_ID_MAX_LENGTH, SANDBOX_MAX_BUNDLE_BYTES, SANDBOX_MAX_PATCH_FILES, SANDBOX_MAX_README_BYTES, type SandboxBundleManifest, type SandboxBundleResult, SandboxTransport, type SandboxTransportConfig, type SmithersEvent, type ValidatedSandboxBundle, executeSandbox, layerForSandboxRuntime, makeSandboxTransportLayer, resolveSandboxRuntime, validateSandboxBundle, writeSandboxBundle };
+export { type ExecuteSandboxOptions, SANDBOX_BUNDLE_OUTPUT_MAX_ARRAY_LENGTH, SANDBOX_BUNDLE_OUTPUT_MAX_DEPTH, SANDBOX_BUNDLE_OUTPUT_MAX_STRING_LENGTH, SANDBOX_BUNDLE_PATH_MAX_LENGTH, SANDBOX_BUNDLE_RUN_ID_MAX_LENGTH, SANDBOX_MAX_BUNDLE_BYTES, SANDBOX_MAX_PATCH_FILES, SANDBOX_MAX_README_BYTES, type SandboxBundleManifest, type SandboxBundleResult, type SandboxBundleStatus, type SandboxDiffBundleLike, type SandboxProvider, type SandboxProviderRequest, type SandboxProviderResult, SandboxTransport, type SandboxTransportConfig, type SmithersEvent, type ValidatedSandboxBundle, executeSandbox, layerForSandboxRuntime, makeSandboxTransportLayer, registerSandboxProvider, resolveSandboxProvider, resolveSandboxRuntime, validateSandboxBundle, writeSandboxBundle };

package/src/sandboxPath.js

@@ -50,11 +50,7 @@ export function assertPathWithinRootEffect(rootDir, resolvedPath) {
             if (code && code !== "ENOENT" && code !== "ENOTDIR") {
                 return yield* Effect.fail(err);
             }
-            const parent = dirname(current);
-            if (parent === current) {
-                return yield* Effect.fail(new SmithersError("TOOL_PATH_ESCAPE", "Path escapes sandbox root (via symlink)"));
-            }
-            current = parent;
+            current = dirname(current);
         }
     });
 }

package/src/transport.js

@@ -6,10 +6,10 @@
 // @smithers-type-exports-end
 
 import { Context, Effect, Layer } from "effect";
+import { SmithersError } from "@smithers-orchestrator/errors/SmithersError";
 import { CodeplaneSandboxExecutorLive, DockerSandboxExecutorLive, } from "./effect/http-runner.js";
 import { makeSandboxTransportServiceEffect, } from "./effect/sandbox-entity.js";
 import { BubblewrapSandboxExecutorLive } from "./effect/socket-runner.js";
-import {} from "@smithers-orchestrator/errors/SmithersError";
 /** @typedef {import("./SandboxRuntime.ts").SandboxRuntime} SandboxRuntime */
 
 const SandboxTransportTag = /** @type {Context.TagClass<SandboxTransport, "SandboxTransport", SandboxTransportService>} */ (
@@ -35,8 +35,11 @@ export function layerForSandboxRuntime(runtime) {
         case "codeplane":
             return makeSandboxTransportLayer(CodeplaneSandboxExecutorLive);
         case "bubblewrap":
-        default:
             return makeSandboxTransportLayer(BubblewrapSandboxExecutorLive);
+        default:
+            throw new SmithersError("INVALID_INPUT", `Unsupported sandbox runtime: ${String(runtime)}`, {
+                runtime,
+            });
     }
 }
 /**
@@ -44,8 +47,10 @@ export function layerForSandboxRuntime(runtime) {
  * @returns {SandboxRuntime}
  */
 export function resolveSandboxRuntime(requested) {
-    if (requested !== "docker")
-        return requested;
-    const hasDocker = typeof Bun !== "undefined" ? Boolean(Bun.which("docker")) : false;
-    return hasDocker ? "docker" : "bubblewrap";
+    if (requested !== "docker" && requested !== "codeplane" && requested !== "bubblewrap") {
+        throw new SmithersError("INVALID_INPUT", `Unsupported sandbox runtime: ${String(requested)}`, {
+            runtime: requested,
+        });
+    }
+    return requested;
 }