@smithers-orchestrator/sandbox 0.20.4 → 0.21.0

package/src/execute.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdir, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { Effect, Metric } from "effect";
@@ -13,16 +14,82 @@ import { SandboxTransport, layerForSandboxRuntime, resolveSandboxRuntime, } from
 /** @typedef {import("./SandboxRuntime.ts").SandboxRuntime} SandboxRuntime */
 /** @typedef {import("./SandboxHandle.ts").SandboxHandle} SandboxHandle */
 /** @typedef {import("./SandboxTransportService.ts").SandboxTransportService} SandboxTransportService */
+/** @typedef {import("./SandboxProvider.ts").SandboxProvider} SandboxProvider */
+/** @typedef {import("./SandboxProvider.ts").SandboxProviderRequest} SandboxProviderRequest */
+/** @typedef {import("./SandboxProvider.ts").SandboxProviderResult} SandboxProviderResult */
 /** @typedef {import("@smithers-orchestrator/observability/SmithersEvent").SmithersEvent} SmithersEvent */
 
 const DEFAULT_MAX_CONCURRENT_SANDBOXES = 10;
+const sandboxProviderRegistry = new Map();
+const sandboxExecutionContext = new AsyncLocalStorage();
+
+/**
+ * @param {SandboxProvider} provider
+ * @returns {() => void}
+ */
+export function registerSandboxProvider(provider) {
+    if (!provider || typeof provider !== "object" || typeof provider.run !== "function") {
+        throw new SmithersError("INVALID_INPUT", "Sandbox provider must be an object with a run(request) function.");
+    }
+    if (typeof provider.id !== "string" || provider.id.trim().length === 0) {
+        throw new SmithersError("INVALID_INPUT", "Sandbox provider must include a non-empty id.");
+    }
+    const id = provider.id.trim();
+    sandboxProviderRegistry.set(id, { ...provider, id });
+    return () => {
+        if (sandboxProviderRegistry.get(id)?.run === provider.run) {
+            sandboxProviderRegistry.delete(id);
+        }
+    };
+}
+
+/**
+ * @param {unknown} value
+ * @returns {SandboxProvider | undefined}
+ */
+export function resolveSandboxProvider(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value === "string") {
+        const provider = sandboxProviderRegistry.get(value);
+        if (!provider) {
+            throw new SmithersError("INVALID_INPUT", `Sandbox provider "${value}" is not registered.`, { provider: value });
+        }
+        return provider;
+    }
+    if (typeof value === "object" && typeof value.run === "function") {
+        const id = typeof value.id === "string" && value.id.trim().length > 0
+            ? value.id.trim()
+            : "custom";
+        return { ...value, id };
+    }
+    throw new SmithersError("INVALID_INPUT", "Sandbox provider must be a registered provider id or a provider object.", { providerType: typeof value });
+}
+/**
+ * @param {unknown} value
+ * @returns {value is SmithersDb}
+ */
+function isSmithersDbAdapter(value) {
+    return Boolean(value &&
+        typeof value === "object" &&
+        typeof value.insertEventWithNextSeq === "function" &&
+        typeof value.listSandboxes === "function");
+}
+/**
+ * @param {ConstructorParameters<typeof SmithersDb>[0] | SmithersDb} db
+ * @returns {SmithersDb}
+ */
+function resolveRuntimeDbAdapter(db) {
+    return isSmithersDbAdapter(db) ? db : new SmithersDb(db);
+}
 /**
  * @param {ConstructorParameters<typeof SmithersDb>[0]} db
  * @param {SmithersEvent} event
  * @returns {Promise<void>}
  */
 async function emitSandboxEvent(db, event) {
-    const adapter = new SmithersDb(db);
+    const adapter = resolveRuntimeDbAdapter(db);
     await adapter.insertEventWithNextSeq({
         runId: event.runId,
         timestampMs: event.timestampMs,
@@ -82,9 +149,156 @@ function requireSandboxHandle(handle, sandboxId) {
         return handle;
     throw new SmithersError("SANDBOX_EXECUTION_FAILED", `Sandbox ${sandboxId} did not initialize correctly.`, { sandboxId });
 }
+/**
+ * @param {unknown} command
+ * @returns {string}
+ */
+function resolveSandboxCommand(command) {
+    return typeof command === "string" && command.trim().length > 0
+        ? command
+        : "smithers up bundle.tsx";
+}
+/**
+ * @param {unknown} value
+ * @returns {Record<string, unknown> | null}
+ */
+function asPlainObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? /** @type {Record<string, unknown>} */ (value)
+        : null;
+}
+/**
+ * @param {unknown} value
+ * @returns {number}
+ */
+function diffBundlePatchCount(value) {
+    const bundle = asPlainObject(value);
+    const patches = Array.isArray(bundle?.patches) ? bundle.patches : [];
+    return patches.length;
+}
+/**
+ * @param {unknown} status
+ * @returns {status is "finished" | "failed" | "cancelled"}
+ */
+function isSandboxBundleStatus(status) {
+    return status === "finished" || status === "failed" || status === "cancelled";
+}
+/**
+ * @param {SandboxProviderResult} result
+ * @param {string} defaultBundlePath
+ * @returns {Promise<{ bundlePath: string; remoteRunId: string | null; workspaceId: string | null; containerId: string | null; }>}
+ */
+async function materializeProviderResult(result, defaultBundlePath) {
+    const source = asPlainObject(result);
+    if (!source) {
+        throw new SmithersError("SANDBOX_EXECUTION_FAILED", "Sandbox provider returned an invalid result.");
+    }
+    if (typeof source.bundlePath === "string" && source.bundlePath.length > 0) {
+        return {
+            bundlePath: source.bundlePath,
+            remoteRunId: typeof source.remoteRunId === "string" ? source.remoteRunId : null,
+            workspaceId: typeof source.workspaceId === "string" ? source.workspaceId : null,
+            containerId: typeof source.containerId === "string" ? source.containerId : null,
+        };
+    }
+    if (!isSandboxBundleStatus(source.status)) {
+        throw new SmithersError("SANDBOX_EXECUTION_FAILED", "Sandbox provider result must include either bundlePath or status.", {
+            status: source.status,
+        });
+    }
+    const remoteRunId = typeof source.remoteRunId === "string"
+        ? source.remoteRunId
+        : typeof source.runId === "string"
+            ? source.runId
+            : null;
+    await writeSandboxBundle({
+        bundlePath: defaultBundlePath,
+        output: source.outputs ?? source.output,
+        status: source.status,
+        runId: remoteRunId ?? undefined,
+        streamLogPath: typeof source.streamLogPath === "string" ? source.streamLogPath : null,
+        patches: Array.isArray(source.patches) ? source.patches : undefined,
+        artifacts: Array.isArray(source.artifacts) ? source.artifacts : undefined,
+        diffBundle: source.diffBundle,
+    });
+    return {
+        bundlePath: defaultBundlePath,
+        remoteRunId,
+        workspaceId: typeof source.workspaceId === "string" ? source.workspaceId : null,
+        containerId: typeof source.containerId === "string" ? source.containerId : null,
+    };
+}
+/**
+ * @param {SandboxProvider} provider
+ * @param {SandboxProviderRequest} request
+ * @returns {Promise<SandboxProviderResult>}
+ */
+async function runSandboxProvider(provider, request) {
+    return sandboxExecutionContext.run({
+        depth: (sandboxExecutionContext.getStore()?.depth ?? 0) + 1,
+        sandboxId: request.sandboxId,
+        runId: request.runId,
+        providerId: provider.id,
+    }, async () => provider.run(request));
+}
+/**
+ * @param {unknown} bundle
+ * @returns {bundle is import("./SandboxProvider.ts").SandboxDiffBundleLike}
+ */
+function isDiffBundleLike(bundle) {
+    const source = asPlainObject(bundle);
+    return Boolean(source &&
+        typeof source.seq === "number" &&
+        typeof source.baseRef === "string" &&
+        Array.isArray(source.patches));
+}
+/**
+ * @param {import("./ValidatedSandboxBundle.ts").ValidatedSandboxBundle} validated
+ * @param {ExecuteSandboxOptions} options
+ */
+async function applyAcceptedSandboxChanges(validated, options) {
+    const diffBundle = validated.manifest.diffBundle;
+    if (diffBundle === undefined) {
+        return;
+    }
+    if (!isDiffBundleLike(diffBundle)) {
+        throw new SmithersError("INVALID_INPUT", "Sandbox bundle diffBundle is malformed.", {
+            sandboxId: options.sandboxId,
+        });
+    }
+    if (typeof options.applyDiffBundle !== "function") {
+        throw new SmithersError("INVALID_INPUT", "Sandbox bundle contains a diffBundle but no diff applier was provided.", {
+            sandboxId: options.sandboxId,
+        });
+    }
+    await options.applyDiffBundle(diffBundle, options.rootDir);
+}
+/**
+ * @param {unknown} config
+ */
+function redactSandboxConfig(config) {
+    const source = asPlainObject(config);
+    if (!source) {
+        return config;
+    }
+    const redacted = { ...source };
+    const env = asPlainObject(source.env);
+    if (env) {
+        redacted.env = Object.fromEntries(Object.keys(env).sort().map((key) => [key, "[redacted]"]));
+    }
+    return redacted;
+}
 export const __executeSandboxInternals = {
     directorySize,
+    diffBundlePatchCount,
+    isDiffBundleLike,
+    materializeProviderResult,
     requireSandboxHandle,
+    redactSandboxConfig,
+    resolveRuntimeDbAdapter,
+    resolveSandboxProvider,
+    resolveSandboxCommand,
+    sandboxExecutionContext,
 };
 /**
  * @returns {number}
@@ -112,24 +326,42 @@ function isSandboxActive(status) {
  */
 export async function executeSandbox(options) {
     const runtime = requireTaskRuntime();
+    const parentSandbox = sandboxExecutionContext.getStore();
+    if (parentSandbox && !options.allowNested) {
+        throw new SmithersError("INVALID_INPUT", "Nested <Sandbox> execution is disabled by default. Set allowNested on the nested sandbox only if the provider and diff policy are explicitly designed for nesting.", {
+            sandboxId: options.sandboxId,
+            parentSandboxId: parentSandbox.sandboxId,
+            parentRunId: parentSandbox.runId,
+            parentProviderId: parentSandbox.providerId,
+        });
+    }
     runtime.heartbeat({
         sandboxId: options.sandboxId,
         stage: "initializing",
         progress: 0,
     });
-    const adapter = new SmithersDb(runtime.db);
-    const requestedRuntime = options.runtime ?? "bubblewrap";
-    const selectedRuntime = resolveSandboxRuntime(requestedRuntime);
+    const runtimeDb = runtime.db ?? options.parentWorkflow?.db;
+    if (!runtimeDb) {
+        throw new SmithersError("TASK_RUNTIME_UNAVAILABLE", "Sandbox execution requires a task runtime database.", {
+            sandboxId: options.sandboxId,
+        });
+    }
+    const adapter = resolveRuntimeDbAdapter(runtimeDb);
+    const provider = resolveSandboxProvider(options.provider);
+    const requestedRuntime = options.runtime;
+    const selectedRuntime = provider ? provider.id : resolveSandboxRuntime(requestedRuntime ?? "bubblewrap");
     const createdAtMs = nowMs();
+    const rawConfig = asPlainObject(options.config) ?? {};
     const configJson = JSON.stringify({
-        runtime: requestedRuntime,
+        provider: provider?.id,
+        runtime: requestedRuntime ?? (provider ? undefined : selectedRuntime),
         selectedRuntime,
         allowNetwork: options.allowNetwork,
         maxOutputBytes: options.maxOutputBytes,
         toolTimeoutMs: options.toolTimeoutMs,
         reviewDiffs: options.reviewDiffs ?? true,
         autoAcceptDiffs: Boolean(options.autoAcceptDiffs),
-        ...options.config,
+        ...redactSandboxConfig(rawConfig),
     });
     const sandboxRoot = join(options.rootDir, ".smithers", "sandboxes", runtime.runId, options.sandboxId);
     const requestBundlePath = join(sandboxRoot, "request-bundle");
@@ -138,6 +370,7 @@ export async function executeSandbox(options) {
    */
     const childLogPath = (childRunId) => join(options.rootDir, ".smithers", "executions", childRunId, "logs", "stream.ndjson");
     let handle = null;
+    let providerRequest = null;
     try {
         const existingSandboxes = await adapter.listSandboxes(runtime.runId);
         const activeSandboxCount = existingSandboxes.filter((row) => isSandboxActive(row?.status)).length;
@@ -162,7 +395,7 @@ export async function executeSandbox(options) {
             completedAtMs: null,
             bundlePath: null,
         });
-        await emitSandboxEvent(runtime.db, {
+        await emitSandboxEvent(runtimeDb, {
             type: "SandboxCreated",
             runId: runtime.runId,
             sandboxId: options.sandboxId,
@@ -179,21 +412,165 @@ export async function executeSandbox(options) {
         await writeFile(join(requestBundlePath, "README.md"), JSON.stringify({
             status: "pending",
             sandboxId: options.sandboxId,
-            runtime: selectedRuntime,
+            provider: selectedRuntime,
+            runtime: provider ? options.runtime : selectedRuntime,
             input: options.input ?? {},
         }, null, 2), "utf8");
+        if (provider) {
+            const bundleSizeBytes = await directorySize(join(requestBundlePath, "README.md"));
+            await emitSandboxEvent(runtimeDb, {
+                type: "SandboxShipped",
+                runId: runtime.runId,
+                sandboxId: options.sandboxId,
+                runtime: selectedRuntime,
+                bundleSizeBytes,
+                timestampMs: nowMs(),
+            });
+            runtime.heartbeat({
+                sandboxId: options.sandboxId,
+                stage: "shipped",
+                progress: 25,
+            });
+            await adapter.upsertSandbox({
+                runId: runtime.runId,
+                sandboxId: options.sandboxId,
+                runtime: selectedRuntime,
+                remoteRunId: null,
+                workspaceId: null,
+                containerId: null,
+                configJson,
+                status: "shipped",
+                shippedAtMs: nowMs(),
+                completedAtMs: null,
+                bundlePath: null,
+            });
+            runtime.heartbeat({
+                sandboxId: options.sandboxId,
+                stage: "executing",
+                progress: 40,
+            });
+            const childStartedMs = performance.now();
+            providerRequest = {
+                runId: runtime.runId,
+                sandboxId: options.sandboxId,
+                input: options.input,
+                rootDir: options.rootDir,
+                requestBundlePath,
+                resultBundlePath: join(sandboxRoot, "result"),
+                workflow: options.workflow,
+                parentWorkflow: options.parentWorkflow,
+                executeChildWorkflow: options.executeChildWorkflow,
+                allowNetwork: options.allowNetwork,
+                maxOutputBytes: options.maxOutputBytes,
+                toolTimeoutMs: options.toolTimeoutMs,
+                config: rawConfig,
+                signal: runtime.signal,
+                heartbeat: runtime.heartbeat,
+            };
+            const providerResult = await runSandboxProvider(provider, providerRequest);
+            const materialized = await materializeProviderResult(providerResult, providerRequest.resultBundlePath);
+            const validated = await validateSandboxBundle(materialized.bundlePath);
+            const totalPatchCount = validated.patchFiles.length + diffBundlePatchCount(validated.manifest.diffBundle);
+            runtime.heartbeat({
+                sandboxId: options.sandboxId,
+                stage: "bundle-collected",
+                progress: 85,
+                bundlePath: validated.bundlePath,
+                patchCount: totalPatchCount,
+            });
+            await emitSandboxEvent(runtimeDb, {
+                type: "SandboxBundleReceived",
+                runId: runtime.runId,
+                sandboxId: options.sandboxId,
+                bundleSizeBytes: validated.bundleSizeBytes,
+                patchCount: totalPatchCount,
+                hasOutputs: validated.manifest.outputs !== undefined,
+                timestampMs: nowMs(),
+            });
+            const reviewDiffs = options.reviewDiffs ?? true;
+            if (reviewDiffs && totalPatchCount > 0) {
+                await emitSandboxEvent(runtimeDb, {
+                    type: "SandboxDiffReviewRequested",
+                    runId: runtime.runId,
+                    sandboxId: options.sandboxId,
+                    patchCount: totalPatchCount,
+                    totalDiffLines: 0,
+                    timestampMs: nowMs(),
+                });
+                if (!options.autoAcceptDiffs) {
+                    await emitSandboxEvent(runtimeDb, {
+                        type: "SandboxDiffRejected",
+                        runId: runtime.runId,
+                        sandboxId: options.sandboxId,
+                        reason: "Diff review approval is required before applying sandbox patches.",
+                        timestampMs: nowMs(),
+                    });
+                    throw new SmithersError("INVALID_INPUT", "Sandbox produced changes that require review approval.", {
+                        sandboxId: options.sandboxId,
+                        patchCount: totalPatchCount,
+                    });
+                }
+                await emitSandboxEvent(runtimeDb, {
+                    type: "SandboxDiffAccepted",
+                    runId: runtime.runId,
+                    sandboxId: options.sandboxId,
+                    patchCount: totalPatchCount,
+                    timestampMs: nowMs(),
+                });
+            }
+            if (!reviewDiffs || totalPatchCount === 0 || options.autoAcceptDiffs) {
+                await applyAcceptedSandboxChanges(validated, options);
+            }
+            await adapter.upsertSandbox({
+                runId: runtime.runId,
+                sandboxId: options.sandboxId,
+                runtime: selectedRuntime,
+                remoteRunId: materialized.remoteRunId ?? validated.manifest.runId ?? null,
+                workspaceId: materialized.workspaceId,
+                containerId: materialized.containerId,
+                configJson,
+                status: validated.manifest.status,
+                shippedAtMs: createdAtMs,
+                completedAtMs: nowMs(),
+                bundlePath: validated.bundlePath,
+            });
+            await emitSandboxEvent(runtimeDb, {
+                type: "SandboxCompleted",
+                runId: runtime.runId,
+                sandboxId: options.sandboxId,
+                remoteRunId: materialized.remoteRunId ?? validated.manifest.runId,
+                runtime: selectedRuntime,
+                status: validated.manifest.status,
+                durationMs: performance.now() - childStartedMs,
+                timestampMs: nowMs(),
+            });
+            runtime.heartbeat({
+                sandboxId: options.sandboxId,
+                stage: "completed",
+                progress: 100,
+                status: validated.manifest.status,
+            });
+            return validated.manifest.outputs;
+        }
         const transportConfig = {
             runId: runtime.runId,
             sandboxId: options.sandboxId,
             runtime: selectedRuntime,
             rootDir: options.rootDir,
-            image: options.config?.image ?? undefined,
+            image: typeof rawConfig.image === "string" ? rawConfig.image : undefined,
+            allowNetwork: options.allowNetwork,
+            env: rawConfig.env,
+            ports: rawConfig.ports,
+            volumes: rawConfig.volumes,
+            memoryLimit: rawConfig.memoryLimit,
+            cpuLimit: rawConfig.cpuLimit,
+            workspace: rawConfig.workspace,
         };
         handle = await transportCall(selectedRuntime, sandboxTransport((svc) => svc.create(transportConfig)));
         const sandboxHandle = requireSandboxHandle(handle, options.sandboxId);
         await transportCall(selectedRuntime, sandboxTransport((svc) => svc.ship(requestBundlePath, sandboxHandle)));
         const bundleSizeBytes = await directorySize(join(requestBundlePath, "README.md"));
-        await emitSandboxEvent(runtime.db, {
+        await emitSandboxEvent(runtimeDb, {
             type: "SandboxShipped",
             runId: runtime.runId,
             sandboxId: options.sandboxId,
@@ -219,7 +596,9 @@ export async function executeSandbox(options) {
             completedAtMs: null,
             bundlePath: null,
         });
-        await transportCall(selectedRuntime, sandboxTransport((svc) => svc.execute("smithers up bundle.tsx", sandboxHandle)));
+        if (options.config?.command) {
+            await transportCall(selectedRuntime, sandboxTransport((svc) => svc.execute(resolveSandboxCommand(options.config?.command), sandboxHandle)));
+        }
         runtime.heartbeat({
             sandboxId: options.sandboxId,
             stage: "executing",
@@ -229,7 +608,12 @@ export async function executeSandbox(options) {
             throw new SmithersError("INVALID_INPUT", `Sandbox ${options.sandboxId} is missing a child workflow executor.`, { sandboxId: options.sandboxId });
         }
         const childStartedMs = performance.now();
-        const child = await options.executeChildWorkflow(options.parentWorkflow, {
+        const child = await sandboxExecutionContext.run({
+            depth: (sandboxExecutionContext.getStore()?.depth ?? 0) + 1,
+            sandboxId: options.sandboxId,
+            runId: runtime.runId,
+            providerId: selectedRuntime,
+        }, async () => options.executeChildWorkflow(options.parentWorkflow, {
             workflow: options.workflow,
             input: options.input,
             parentRunId: runtime.runId,
@@ -238,7 +622,7 @@ export async function executeSandbox(options) {
             maxOutputBytes: options.maxOutputBytes,
             toolTimeoutMs: options.toolTimeoutMs,
             signal: runtime.signal,
-        });
+        }));
         runtime.heartbeat({
             sandboxId: options.sandboxId,
             stage: "child-finished",
@@ -246,7 +630,7 @@ export async function executeSandbox(options) {
             childRunId: child.runId,
             childStatus: child.status,
         });
-        await emitSandboxEvent(runtime.db, {
+        await emitSandboxEvent(runtimeDb, {
             type: "SandboxHeartbeat",
             runId: runtime.runId,
             sandboxId: options.sandboxId,
@@ -263,34 +647,35 @@ export async function executeSandbox(options) {
         });
         const collected = await transportCall(selectedRuntime, sandboxTransport((svc) => svc.collect(sandboxHandle)));
         const validated = await validateSandboxBundle(collected.bundlePath);
+        const totalPatchCount = validated.patchFiles.length + diffBundlePatchCount(validated.manifest.diffBundle);
         runtime.heartbeat({
             sandboxId: options.sandboxId,
             stage: "bundle-collected",
             progress: 85,
             bundlePath: validated.bundlePath,
-            patchCount: validated.patchFiles.length,
+            patchCount: totalPatchCount,
         });
-        await emitSandboxEvent(runtime.db, {
+        await emitSandboxEvent(runtimeDb, {
             type: "SandboxBundleReceived",
             runId: runtime.runId,
             sandboxId: options.sandboxId,
             bundleSizeBytes: validated.bundleSizeBytes,
-            patchCount: validated.patchFiles.length,
+            patchCount: totalPatchCount,
             hasOutputs: validated.manifest.outputs !== undefined,
             timestampMs: nowMs(),
         });
         const reviewDiffs = options.reviewDiffs ?? true;
-        if (reviewDiffs && validated.patchFiles.length > 0) {
-            await emitSandboxEvent(runtime.db, {
+        if (reviewDiffs && totalPatchCount > 0) {
+            await emitSandboxEvent(runtimeDb, {
                 type: "SandboxDiffReviewRequested",
                 runId: runtime.runId,
                 sandboxId: options.sandboxId,
-                patchCount: validated.patchFiles.length,
+                patchCount: totalPatchCount,
                 totalDiffLines: 0,
                 timestampMs: nowMs(),
             });
             if (!options.autoAcceptDiffs) {
-                await emitSandboxEvent(runtime.db, {
+                await emitSandboxEvent(runtimeDb, {
                     type: "SandboxDiffRejected",
                     runId: runtime.runId,
                     sandboxId: options.sandboxId,
@@ -299,17 +684,20 @@ export async function executeSandbox(options) {
                 });
                 throw new SmithersError("INVALID_INPUT", "Sandbox produced patches that require review approval.", {
                     sandboxId: options.sandboxId,
-                    patchCount: validated.patchFiles.length,
+                    patchCount: totalPatchCount,
                 });
             }
-            await emitSandboxEvent(runtime.db, {
+            await emitSandboxEvent(runtimeDb, {
                 type: "SandboxDiffAccepted",
                 runId: runtime.runId,
                 sandboxId: options.sandboxId,
-                patchCount: validated.patchFiles.length,
+                patchCount: totalPatchCount,
                 timestampMs: nowMs(),
             });
         }
+        if (!reviewDiffs || totalPatchCount === 0 || options.autoAcceptDiffs) {
+            await applyAcceptedSandboxChanges(validated, options);
+        }
         await adapter.upsertSandbox({
             runId: runtime.runId,
             sandboxId: options.sandboxId,
@@ -323,7 +711,7 @@ export async function executeSandbox(options) {
             completedAtMs: nowMs(),
             bundlePath: validated.bundlePath,
         });
-        await emitSandboxEvent(runtime.db, {
+        await emitSandboxEvent(runtimeDb, {
             type: "SandboxCompleted",
             runId: runtime.runId,
             sandboxId: options.sandboxId,
@@ -355,7 +743,7 @@ export async function executeSandbox(options) {
             completedAtMs: nowMs(),
             bundlePath: handle?.resultPath ?? null,
         });
-        await emitSandboxEvent(runtime.db, {
+        await emitSandboxEvent(runtimeDb, {
             type: "SandboxFailed",
             runId: runtime.runId,
             sandboxId: options.sandboxId,
@@ -375,5 +763,8 @@ export async function executeSandbox(options) {
         if (handle) {
             await transportCall(selectedRuntime, sandboxTransport((svc) => svc.cleanup(handle))).catch(() => undefined);
         }
+        if (provider && providerRequest && typeof provider.cleanup === "function") {
+            await Promise.resolve(provider.cleanup(providerRequest)).catch(() => undefined);
+        }
     }
 }