@straiffi/archon 1.8.23 → 1.10.1

package/dist/server/lib/dockerSandboxEnvironmentOperations.js.map

@@ -1 +1 @@
-{"version":3,"file":"dockerSandboxEnvironmentOperations.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxEnvironmentOperations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,oCAAoC,EACpC,0BAA0B,EAC1B,sBAAsB,GAKvB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,oCAAoC,GAErC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AAGnC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAEzC,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,uBAAuB,EAAE,CACvB,WAAmB,EACnB,SAA4B,EAC5B,OAA2B,EAC3B,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;IACrE,0BAA0B,EAAE,CAAC,WAAmB,EAAE,OAA2B,EAAE,EAAE,CAAC,CAChF,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CACzD;IACD,sBAAsB,EAAE,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA2B,EAAE,EAAE,CAAC,CAC5F,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAC7D;IACD,wBAAwB,EAAE,CAAC,WAAmB,EAAE,OAA0B,EAAE,OAA2B,EAAE,EAAE,CAAC,CAC1G,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAChE;CACF,CAAA;AAQD,MAAM,CAAC,MAAM,2CAA2C,GAAyC;IAC/F,OAAO,EAAE,oBAAoB;IAC7B,iBAAiB,EAAE,8BAA8B;IACjD,MAAM;CACP,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,WAAiC,EACK,EAAE;IACxC,IACE,WAAW,CAAC,aAAa,KAAK,gBAAgB;WAC3C,CAAC,WAAW,CAAC,WAAW;WACxB,CAAC,WAAW,CAAC,cAAc;WAC3B,WAAW,CAAC,iBAAiB,KAAK,kCAAkC,CAAC,WAAW,CAAC,cAAc,CAAC,EACnG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,WAAW;QAC7B,KAAK,EAAE,WAAW,CAAC,cAAc;QACjC,aAAa,EAAE,WAAW,CAAC,qBAAqB;QAChD,QAAQ,EAAE,WAAW,CAAC,iBAAiB;KACxC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,EAClD,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAE3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,EACnD,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9E,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,uBAAuB,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,WAAiC,EACd,EAAE;IACrB,MAAM,WAAW,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAC1E,MAAM,MAAM,GAAG,8BAA8B,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAA;IACrF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,mCAAmC,EAAE,CAAC;YAC7D,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YAChD,SAAQ;QACV,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAA;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,WAAiC,EACjC,eAAqD,2CAA2C,EACtD,EAAE;IAC5C,MAAM,WAAW,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,YAA+B,CAAA;IACnC,IAAI,CAAC;QACH,YAAY,GAAG,gCAAgC,CAAC,WAAW,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,WAAW;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD;iBACxG,CAAC;SACH,CAAA;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,IAAI,aAAkC,CAAA;IACtC,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC1F,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,WAAW;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C;iBACjG,CAAC;SACH,CAAA;IACH,CAAC;IACD,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;YAC1E,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,MAAM,wBAAwB;aACxG,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAA;AAClD,CAAC,CAAA;AAED,MAAM,+BAA+B,GAAG,CACtC,WAAiC,EACjC,OAAwC,EACxC,EAAE;IACF,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,+BAA+B,CAAC;YAC9B,SAAS,EAAE,WAAW,CAAC,UAAU;YACjC,aAAa,EAAE,WAAW,CAAC,EAAE;YAC7B,SAAS,EAAE,0CAA0C;YACrD,SAAS,EAAE,WAAW,CAAC,eAAe;YACtC,OAAO,EAAE,WAAW,CAAC,eAAe;YACpC,OAAO,EAAE,yEAAyE,OAAO,CAAC,WAAW,GAAG;YACxG,QAAQ,EAAE;gBACR,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAiB,CAAA;IAC1B,CAAC;IACD,IACE,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WAC5B,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WACjC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WACjD,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAC1C,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,oDAAoD,CACpF,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,2BAA2B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QACnF,+BAA+B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC/D,IAAI,KAAK,IAAI,CACX,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WACzB,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WAC9B,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WAC9C,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC,EAAE,CAAC;QACF,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,mDAAmD,CACnF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oCAAoC,CAC5C,kBAAkB,QAAQ,CAAC,IAAI,oCAAoC,CACpE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,QAAiB,CAAA;AACvD,CAAC,CAAA"}
+{"version":3,"file":"dockerSandboxEnvironmentOperations.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxEnvironmentOperations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,0BAA0B,EAC1B,sBAAsB,GAKvB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,kDAAkD,EAAE,MAAM,mCAAmC,CAAA;AACtG,OAAO,EACL,oCAAoC,GAErC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AAGnC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAEzC,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,uBAAuB,EAAE,CACvB,WAAmB,EACnB,SAA4B,EAC5B,OAA2B,EAC3B,EAAE,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;IAClF,0BAA0B,EAAE,CAAC,WAAmB,EAAE,OAA2B,EAAE,EAAE,CAAC,CAChF,oBAAoB,CAAC,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,CACtE;IACD,sBAAsB,EAAE,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA2B,EAAE,EAAE,CAAC,CAC5F,oBAAoB,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAC1E;IACD,wBAAwB,EAAE,CAAC,WAAmB,EAAE,OAA0B,EAAE,OAA2B,EAAE,EAAE,CAAC,CAC1G,oBAAoB,CAAC,wBAAwB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAC7E;CACF,CAAA;AAQD,MAAM,CAAC,MAAM,2CAA2C,GAAyC;IAC/F,OAAO,EAAE,oBAAoB;IAC7B,iBAAiB,EAAE,8BAA8B;IACjD,MAAM;CACP,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,WAAiC,EACK,EAAE;IACxC,MAAM,cAAc,GAAG,kDAAkD,CACvE,WAAW,CAAC,gBAAgB,EAC5B,WAAW,CAAC,iBAAiB,EAC7B,WAAW,CAAC,cAAc,CAC3B,CAAA;IACD,IACE,WAAW,CAAC,aAAa,KAAK,gBAAgB;WAC3C,CAAC,WAAW,CAAC,WAAW;WACxB,CAAC,WAAW,CAAC,cAAc;WAC3B,CAAC,cAAc,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,WAAW;QAC7B,KAAK,EAAE,WAAW,CAAC,cAAc;QACjC,aAAa,EAAE,WAAW,CAAC,qBAAqB;QAChD,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,cAAc,CAAC;KAC/D,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,EAClD,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAE3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,EACnD,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9E,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,uBAAuB,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,WAAiC,EACd,EAAE;IACrB,MAAM,WAAW,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAC1E,MAAM,MAAM,GAAG,8BAA8B,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAA;IACrF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,mCAAmC,EAAE,CAAC;YAC7D,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YAChD,SAAQ;QACV,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAA;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,WAAiC,EACjC,eAAqD,2CAA2C,EACtD,EAAE;IAC5C,MAAM,WAAW,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,YAA+B,CAAA;IACnC,IAAI,CAAC;QACH,YAAY,GAAG,gCAAgC,CAAC,WAAW,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,WAAW;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD;iBACxG,CAAC;SACH,CAAA;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,IAAI,aAAkC,CAAA;IACtC,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC1F,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,WAAW;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C;iBACjG,CAAC;SACH,CAAA;IACH,CAAC;IACD,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;YAC1E,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,MAAM,wBAAwB;aACxG,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAA;AAClD,CAAC,CAAA;AAED,MAAM,+BAA+B,GAAG,CACtC,WAAiC,EACjC,OAAwC,EACxC,EAAE;IACF,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,+BAA+B,CAAC;YAC9B,SAAS,EAAE,WAAW,CAAC,UAAU;YACjC,aAAa,EAAE,WAAW,CAAC,EAAE;YAC7B,SAAS,EAAE,0CAA0C;YACrD,SAAS,EAAE,WAAW,CAAC,eAAe;YACtC,OAAO,EAAE,WAAW,CAAC,eAAe;YACpC,OAAO,EAAE,yEAAyE,OAAO,CAAC,WAAW,GAAG;YACxG,QAAQ,EAAE;gBACR,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAiB,CAAA;IAC1B,CAAC;IACD,IACE,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WAC5B,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WACjC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WACjD,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAC1C,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,oDAAoD,CACpF,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,2BAA2B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QACnF,+BAA+B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC/D,IAAI,KAAK,IAAI,CACX,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WACzB,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WAC9B,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WAC9C,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC,EAAE,CAAC;QACF,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,mDAAmD,CACnF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oCAAoC,CAC5C,kBAAkB,QAAQ,CAAC,IAAI,oCAAoC,CACpE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,QAAiB,CAAA;AACvD,CAAC,CAAA"}

package/dist/server/lib/dockerSandboxExecutionEnvironment.js

@@ -6,38 +6,20 @@ import { promisify } from 'node:util';
 import { networkDestinationTarget } from './executionEnvironmentLifecycle.js';
 import { requireExecutionCapabilities } from './executionEnvironmentLifecycle.js';
 import { assertExactSandboxNetworkAllowlist, applyScopedNetworkRules as applyScopedSandboxNetworkRules, checkDestinationAccess as checkSandboxDestinationAccess, inspectGlobalNetworkPosture as inspectSandboxGlobalNetworkPosture, inspectSandboxNetworkRules as inspectScopedSandboxNetworkRules, removeScopedNetworkRules as removeScopedSandboxNetworkRules, } from './dockerSandboxNetworkPolicy.js';
+import { RECOMMENDED_DOCKER_SANDBOX_RELEASE, inspectDockerSandboxRelease, isDockerSandboxReleaseHostQualified, resolveDockerSandboxReleaseProfile, } from './dockerSandboxReleaseProfiles.js';
 export const DOCKER_SANDBOX_PROVIDER = 'docker_sandbox';
-export const QUALIFIED_SBX_VERSION = '0.38.0';
-export const QUALIFIED_SBX_BUILD = 'c022b14634c4bea846ca12870d1d5e97d5868b54';
-export const DOCKER_SANDBOX_ADAPTER_CONTRACT_VERSION = '6';
+export const QUALIFIED_SBX_VERSION = RECOMMENDED_DOCKER_SANDBOX_RELEASE.version;
+export const QUALIFIED_SBX_BUILD = RECOMMENDED_DOCKER_SANDBOX_RELEASE.acceptedBuilds[0];
+export const DOCKER_SANDBOX_ADAPTER_CONTRACT_VERSION = RECOMMENDED_DOCKER_SANDBOX_RELEASE.adapterContractVersion;
 export const DOCKER_SANDBOX_MAX_NAME_BYTES = 63;
-export const QUALIFIED_DOCKER_SANDBOX_TEMPLATES = {
-    opencode: 'docker.io/docker/sandbox-templates@sha256:b2176d0fdd0cf17754b3b9dff13a69bff003d608e43360687b00ce86d2c749d9',
-    claude: 'docker.io/docker/sandbox-templates@sha256:7fa049b8d7a0cf10f6a4200148ee475e94fc4fb5ef50dfacc4257699cb9a34bc',
-};
+export const QUALIFIED_DOCKER_SANDBOX_TEMPLATES = RECOMMENDED_DOCKER_SANDBOX_RELEASE.templates;
 const DEFAULT_TIMEOUT_MS = 15_000;
 const DEFAULT_OUTPUT_LIMIT_BYTES = 256 * 1024;
 const SANDBOX_NAME_HASH_LENGTH = 16;
-const MINIMUM_MACOS_MAJOR = 14;
 const KVM_DEVICE_PATH = '/dev/kvm';
 const execFile = promisify(execFileCallback);
-const QUALIFIED_DOCKER_SANDBOX_HOSTS = [
-    { platform: 'linux', architecture: 'x64' },
-    { platform: 'darwin', architecture: 'arm64' },
-];
-export const isQualifiedDockerSandboxHost = (platform, architecture) => QUALIFIED_DOCKER_SANDBOX_HOSTS.some(host => host.platform === platform && host.architecture === architecture);
-export const dockerSandboxExecutionEnvironmentCapabilities = {
-    isolation: 'microvm',
-    directWritableWorkspace: 'supported',
-    transparentHeadlessStreams: 'supported',
-    credentialBrokering: 'supported',
-    enforcedNetworkAllowlist: 'unknown',
-    persistentEnvironments: 'supported',
-    resourceIsolation: 'unknown',
-    nestedContainers: 'unsupported',
-    publishedPorts: 'unsupported',
-    resourceControls: 'unsupported',
-};
+export const isQualifiedDockerSandboxHost = (platform, architecture) => isDockerSandboxReleaseHostQualified(RECOMMENDED_DOCKER_SANDBOX_RELEASE, platform, architecture);
+export const dockerSandboxExecutionEnvironmentCapabilities = RECOMMENDED_DOCKER_SANDBOX_RELEASE.capabilities;
 export const deriveDockerSandboxGlobalNetworkPosture = (readiness) => readiness.observations.some(observation => (observation.code === 'network_policy' && observation.state === 'ready'))
     ? 'restrictive'
     : 'unobserved';
@@ -45,9 +27,12 @@ export const deriveDockerSandboxExecutionEnvironmentCapabilities = (posture) =>
     ...dockerSandboxExecutionEnvironmentCapabilities,
     enforcedNetworkAllowlist: posture === 'restrictive' ? 'supported' : 'unknown',
 });
-export const dockerSandboxExecutionEnvironmentObservation = (posture = 'unobserved') => ({
-    providerVersion: QUALIFIED_SBX_VERSION,
-    capabilities: deriveDockerSandboxExecutionEnvironmentCapabilities(posture),
+export const dockerSandboxExecutionEnvironmentObservation = (posture = 'unobserved', profile = RECOMMENDED_DOCKER_SANDBOX_RELEASE) => ({
+    providerVersion: profile.version,
+    capabilities: {
+        ...profile.capabilities,
+        enforcedNetworkAllowlist: posture === 'restrictive' ? 'supported' : 'unknown',
+    },
     degradationReasons: posture === 'restrictive'
         ? []
         : ['The selected direct workspace remains writable from the sandbox.'],
@@ -209,20 +194,31 @@ export const parseJsonObject = (command, output) => {
     }
     return record;
 };
-export const parseQualifiedSbxVersion = (output) => {
+export const parseSbxVersionIdentity = (output) => {
     const match = /^sbx version: v(\d+\.\d+\.\d+) ([0-9a-f]{40})\r?\n?$/.exec(output);
     if (!match) {
         throw new SbxContractFailure('version', 'sbx version output did not match the qualified contract');
     }
-    if (match[1] !== QUALIFIED_SBX_VERSION) {
-        throw new SbxContractFailure('version', `Unsupported sbx version ${match[1]}; Archon requires exactly ${QUALIFIED_SBX_VERSION}`);
-    }
-    if (match[2] !== QUALIFIED_SBX_BUILD) {
-        throw new SbxContractFailure('version', `Unsupported sbx build ${match[2]}; Archon requires exactly ${QUALIFIED_SBX_BUILD}`);
+    return { version: match[1], build: match[2] };
+};
+export const parseQualifiedSbxRelease = (output) => {
+    const identity = parseSbxVersionIdentity(output);
+    const profile = resolveDockerSandboxReleaseProfile(identity.version, identity.build);
+    if (!profile) {
+        const release = inspectDockerSandboxRelease(identity.version, identity.build);
+        throw new SbxContractFailure('version', release.status === 'security_blocked'
+            ? release.reason ?? `Docker Sandbox ${identity.version} is blocked due to a security issue.`
+            : release.reason ?? `Unsupported sbx release ${identity.version} build ${identity.build}`);
     }
-    return match[1];
+    return profile;
 };
-export const parseSbxDiagnostics = (output) => {
+export const parseQualifiedSbxVersion = (output) => {
+    return parseQualifiedSbxRelease(output).version;
+};
+export const parseSbxDiagnostics = (output, profile = RECOMMENDED_DOCKER_SANDBOX_RELEASE) => {
+    if (profile.parserContracts.diagnostics !== 'v0.38.0') {
+        throw new SbxContractFailure('diagnose', `No diagnostics parser is registered for ${profile.id}`);
+    }
     const record = parseJsonObject('diagnose', output);
     if (record.version !== '1.0' || !Array.isArray(record.checks)) {
         throw new SbxContractFailure('diagnose', 'sbx diagnose returned an unsupported schema');
@@ -272,7 +268,10 @@ const QUALIFIED_NETWORK_POLICY_STRING_FIELDS = [
     'layer',
     'status',
 ];
-export const parseSbxNetworkPolicy = (output) => {
+export const parseSbxNetworkPolicy = (output, profile = RECOMMENDED_DOCKER_SANDBOX_RELEASE) => {
+    if (profile.parserContracts.networkPolicy !== 'v0.38.0') {
+        throw new SbxContractFailure('policy list', `No network policy parser is registered for ${profile.id}`);
+    }
     const record = parseJsonObject('policy list', output);
     if (Object.keys(record).some(field => field !== 'rules')
         || !Array.isArray(record.rules)
@@ -336,8 +335,8 @@ const macOsMajorVersion = (version) => {
     const match = /^(\d+)(?:\.|$)/.exec(version);
     return match ? Number(match[1]) : null;
 };
-const probeDockerSandboxPlatformReadiness = async (platform, architecture, options) => {
-    if (!isQualifiedDockerSandboxHost(platform, architecture)) {
+const probeDockerSandboxPlatformReadiness = async (platform, architecture, options, profile) => {
+    if (!isDockerSandboxReleaseHostQualified(profile, platform, architecture)) {
         return {
             code: 'platform',
             state: 'unsupported',
@@ -365,7 +364,7 @@ const probeDockerSandboxPlatformReadiness = async (platform, architecture, optio
             remediation: 'Run macOS Sonoma 14 or later on Apple silicon, then recheck.',
         };
     }
-    if (majorVersion < MINIMUM_MACOS_MAJOR) {
+    if (majorVersion < profile.minimumMacosMajor) {
         return {
             code: 'platform',
             state: 'unsupported',
@@ -464,6 +463,9 @@ export const probeDockerSandboxReadiness = async (runner, options = {}) => {
     const architecture = options.architecture ?? process.arch;
     const observations = [];
     let providerVersion = null;
+    let providerBuild = null;
+    let releaseStatus = null;
+    let releaseProfile = null;
     let versionResult;
     try {
         versionResult = await runner.run(['version'], options);
@@ -473,6 +475,9 @@ export const probeDockerSandboxReadiness = async (runner, options = {}) => {
         if (error instanceof SbxCommandFailure && error.kind === 'missing_cli') {
             return {
                 providerVersion: null,
+                providerBuild: null,
+                releaseStatus: null,
+                recommendedVersion: RECOMMENDED_DOCKER_SANDBOX_RELEASE.version,
                 observations: [
                     { code: 'cli', state: 'not_ready', summary: 'sbx CLI is not installed.', remediation: 'Install the qualified sbx release from Docker.' },
                     ...['version', 'platform', 'virtualization', 'daemon', 'docker_login', 'network_policy', 'opencode_template', 'claude_template']
@@ -486,8 +491,25 @@ export const probeDockerSandboxReadiness = async (runner, options = {}) => {
         if (versionResult.exitCode !== 0) {
             throw new SbxContractFailure('version', `sbx version exited with code ${versionResult.exitCode}`);
         }
-        providerVersion = parseQualifiedSbxVersion(versionResult.stdout);
-        observations.push({ code: 'version', state: 'ready', summary: `sbx ${providerVersion} is qualified.`, remediation: null });
+        const identity = parseSbxVersionIdentity(versionResult.stdout);
+        providerVersion = identity.version;
+        providerBuild = identity.build;
+        const release = inspectDockerSandboxRelease(identity.version, identity.build);
+        releaseStatus = release.status;
+        releaseProfile = release.profile;
+        if (!releaseProfile || release.status === 'security_blocked') {
+            throw new SbxContractFailure('version', release.reason ?? `Docker Sandbox ${identity.version} is unsupported.`);
+        }
+        observations.push({
+            code: 'version',
+            state: 'ready',
+            summary: release.status === 'deprecated'
+                ? `sbx ${providerVersion} is qualified but deprecated.`
+                : `sbx ${providerVersion} is qualified and recommended.`,
+            remediation: release.status === 'deprecated'
+                ? `Upgrade to sbx ${RECOMMENDED_DOCKER_SANDBOX_RELEASE.version}.`
+                : null,
+        });
     }
     catch (error) {
         observations.push({
@@ -497,14 +519,30 @@ export const probeDockerSandboxReadiness = async (runner, options = {}) => {
             remediation: `Install sbx ${QUALIFIED_SBX_VERSION}.`,
         });
     }
-    const platformObservation = await probeDockerSandboxPlatformReadiness(platform, architecture, options);
+    if (!releaseProfile || releaseStatus === 'security_blocked') {
+        observations.push(...['platform', 'virtualization', 'daemon', 'docker_login', 'network_policy', 'opencode_template', 'claude_template']
+            .map(code => ({
+            code,
+            state: 'unknown',
+            summary: 'Not checked because the installed sbx release is not supported.',
+            remediation: null,
+        })));
+        return {
+            providerVersion,
+            providerBuild,
+            releaseStatus: releaseStatus ?? 'unsupported',
+            recommendedVersion: RECOMMENDED_DOCKER_SANDBOX_RELEASE.version,
+            observations,
+        };
+    }
+    const platformObservation = await probeDockerSandboxPlatformReadiness(platform, architecture, options, releaseProfile);
     observations.push(platformObservation);
     observations.push(await probeDockerSandboxVirtualizationReadiness(platform, architecture, platformObservation, options.kvmAccess));
     const diagnose = await runner.run(['diagnose', '--output', 'json'], options);
     if (diagnose.exitCode !== 0 && diagnose.stdout.trim().length === 0) {
         throw new SbxContractFailure('diagnose', 'sbx diagnose failed without structured output');
     }
-    const checks = parseSbxDiagnostics(diagnose.stdout);
+    const checks = parseSbxDiagnostics(diagnose.stdout, releaseProfile);
     observations.push(diagnosticObservation(checks, 'daemon', ['daemon'], 'Daemon readiness was not reported.'));
     observations.push(diagnosticObservation(checks, 'docker_login', ['authentication'], 'Docker login readiness was not reported.'));
     const daemonReady = observations.some(observation => observation.code === 'daemon' && observation.state === 'ready');
@@ -521,7 +559,7 @@ export const probeDockerSandboxReadiness = async (runner, options = {}) => {
         }
         else {
             try {
-                const rules = parseSbxNetworkPolicy(policy.stdout);
+                const rules = parseSbxNetworkPolicy(policy.stdout, releaseProfile);
                 const activeGlobalNetworkRules = rules.filter(rule => (rule.scope === 'global'
                     && rule.resourceType === 'network'
                     && rule.status === 'active')).length;
@@ -564,7 +602,13 @@ export const probeDockerSandboxReadiness = async (runner, options = {}) => {
             remediation: 'Review qualified template output before enabling this capability.',
         });
     }
-    return { providerVersion, observations };
+    return {
+        providerVersion,
+        providerBuild,
+        releaseStatus,
+        recommendedVersion: RECOMMENDED_DOCKER_SANDBOX_RELEASE.version,
+        observations,
+    };
 };
 const slug = (value, maximum) => {
     const normalized = value.toLowerCase().replace(/[^a-z0-9.-]+/g, '-').replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, '');
@@ -630,7 +674,10 @@ const resolveInspectionTemplate = (image, imageDigest) => {
             : image;
     return `${repository}@${imageDigest}`;
 };
-export const parseDockerSandboxInspection = (output) => {
+export const parseDockerSandboxInspection = (output, profile = RECOMMENDED_DOCKER_SANDBOX_RELEASE) => {
+    if (profile.parserContracts.inspection !== 'v0.38.0') {
+        throw new SbxContractFailure('inspect', `No inspection parser is registered for ${profile.id}`);
+    }
     const record = parseJsonObject('inspect', output);
     const fields = Object.keys(record).sort();
     const workspace = record.workspace;
@@ -670,12 +717,22 @@ export const requireSuccessfulCommand = (command, result) => {
         throw new SbxContractFailure(command, exitCodeFailureMessage(command, result));
     }
 };
-const isQualifiedMissingSandboxResult = (result) => (result.args[0] === 'inspect'
-    && typeof result.args[1] === 'string'
-    && result.args[1].length > 0
-    && result.exitCode === 1
-    && result.stdout === ''
-    && result.stderr === `ERROR: sandbox '${result.args[1]}' not found\n`);
+const requireReleaseCommandContract = (profile, contract) => {
+    if (!profile.commandContracts.includes(contract)) {
+        throw new SbxContractFailure(contract, `Docker Sandbox release ${profile.id} does not qualify the ${contract} command`);
+    }
+};
+const isQualifiedMissingSandboxResult = (result, profile) => {
+    if (profile.parserContracts.missingSandbox !== 'v0.38.0') {
+        return false;
+    }
+    return result.args[0] === 'inspect'
+        && typeof result.args[1] === 'string'
+        && result.args[1].length > 0
+        && result.exitCode === 1
+        && result.stdout === ''
+        && result.stderr === `ERROR: sandbox '${result.args[1]}' not found\n`;
+};
 export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) => {
     let qualification = null;
     const waitForQualification = (operation, signal) => {
@@ -690,9 +747,9 @@ export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) =>
                 reject(new SbxCommandFailure('cancelled', ['version'], 'sbx version qualification was cancelled'));
             };
             signal.addEventListener('abort', onAbort, { once: true });
-            operation.then(() => {
+            operation.then(profile => {
                 signal.removeEventListener('abort', onAbort);
-                resolve();
+                resolve(profile);
             }, error => {
                 signal.removeEventListener('abort', onAbort);
                 reject(error);
@@ -702,9 +759,6 @@ export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) =>
     const ensureQualified = (options) => {
         const platform = qualificationOptions.platform ?? process.platform;
         const architecture = qualificationOptions.architecture ?? process.arch;
-        if (!isQualifiedDockerSandboxHost(platform, architecture)) {
-            throw new SbxContractFailure('platform', `Unsupported sbx platform ${platform}/${architecture}; Archon requires linux/x64 or darwin/arm64`);
-        }
         if (!qualification) {
             const qualificationCommandOptions = {
                 timeoutMs: options.timeoutMs,
@@ -713,7 +767,11 @@ export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) =>
             };
             const attempt = runner.run(['version'], qualificationCommandOptions).then(result => {
                 requireSuccessfulCommand('version', result);
-                parseQualifiedSbxVersion(result.stdout);
+                const profile = parseQualifiedSbxRelease(result.stdout);
+                if (!isDockerSandboxReleaseHostQualified(profile, platform, architecture)) {
+                    throw new SbxContractFailure('platform', `Unsupported sbx platform ${platform}/${architecture} for ${profile.version}`);
+                }
+                return profile;
             });
             qualification = attempt.catch(error => {
                 qualification = null;
@@ -723,25 +781,34 @@ export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) =>
         return waitForQualification(qualification, options.signal);
     };
     const inspect = async (name, options = {}) => {
-        await ensureQualified(options);
+        const profile = await ensureQualified(options);
+        requireReleaseCommandContract(profile, 'inspect');
         const result = await runner.run(['inspect', name, '--json'], options);
         if (result.exitCode !== 0) {
-            if (isQualifiedMissingSandboxResult(result)) {
+            if (isQualifiedMissingSandboxResult(result, profile)) {
                 return null;
             }
             throw new SbxContractFailure('inspect', exitCodeFailureMessage('inspect', result));
         }
-        return parseDockerSandboxInspection(result.stdout);
+        return parseDockerSandboxInspection(result.stdout, profile);
     };
-    const requireExpected = async (expected, options) => {
+    const inspectExpected = async (expected, options) => {
         const observed = await inspect(expected.name, options);
+        if (observed) {
+            assertInspectionMatches(expected, observed);
+        }
+        return observed;
+    };
+    const requireExpected = async (expected, options) => {
+        const observed = await inspectExpected(expected, options);
         if (!observed) {
             throw new SbxContractFailure('inspect', `Sandbox ${expected.name} does not exist`);
         }
-        assertInspectionMatches(expected, observed);
         return observed;
     };
     const reconnect = async (expected, options = {}) => {
+        const profile = await ensureQualified(options);
+        requireReleaseCommandContract(profile, 'exec');
         let observed = await requireExpected(expected, options);
         if (observed.state === 'stopped') {
             const result = await runner.run(['exec', observed.name, '--', 'true'], options);
@@ -752,6 +819,8 @@ export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) =>
     };
     return {
         create: async (request, options = {}) => {
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'create');
             const name = createDockerSandboxName(request.identity);
             const existing = await inspect(name, options);
             const expected = { name, agent: request.agent, workspacePath: request.workspacePath, template: request.template };
@@ -768,43 +837,89 @@ export const createDockerSandboxAdapter = (runner, qualificationOptions = {}) =>
         inspect,
         reconnect,
         exec: async (expected, command, args, options = {}) => {
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'exec');
             await requireExpected(expected, options);
             const workdir = options.cwd === undefined ? [] : ['--workdir', options.cwd];
             return runner.run(['exec', ...workdir, expected.name, '--', command, ...args], options);
         },
         stop: async (expected, options = {}) => {
-            let observed = await requireExpected(expected, options);
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'stop');
+            let observed = await inspectExpected(expected, options);
+            if (!observed) {
+                return;
+            }
             if (observed.state === 'running') {
-                requireSuccessfulCommand('stop', await runner.run(['stop', expected.name], options));
-                observed = await requireExpected(expected, options);
+                try {
+                    requireSuccessfulCommand('stop', await runner.run(['stop', expected.name], options));
+                }
+                catch (error) {
+                    try {
+                        if (!await inspectExpected(expected, options)) {
+                            return;
+                        }
+                    }
+                    catch {
+                        // Preserve the original stop failure when the follow-up inspection cannot be completed.
+                    }
+                    throw error;
+                }
+                observed = await inspectExpected(expected, options);
+                if (!observed) {
+                    return;
+                }
             }
             if (observed.state !== 'stopped') {
                 throw new DockerSandboxStopVerificationFailure(`Sandbox ${expected.name} did not reach the stopped state`);
             }
         },
         remove: async (expected, options = {}) => {
-            await requireExpected(expected, options);
-            requireSuccessfulCommand('rm', await runner.run(['rm', '--force', expected.name], options));
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'remove');
+            const observed = await inspectExpected(expected, options);
+            if (!observed) {
+                return;
+            }
+            try {
+                requireSuccessfulCommand('rm', await runner.run(['rm', '--force', expected.name], options));
+            }
+            catch (error) {
+                try {
+                    if (!await inspectExpected(expected, options)) {
+                        return;
+                    }
+                }
+                catch {
+                    // Preserve the original removal failure when the follow-up inspection cannot be completed.
+                }
+                throw error;
+            }
         },
         applyScopedNetworkRules: async (sandboxName, resources, options = {}) => {
-            await ensureQualified(options);
-            return applyScopedSandboxNetworkRules(runner, sandboxName, resources, options);
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'policy-allow');
+            return applyScopedSandboxNetworkRules(runner, sandboxName, resources, options, profile);
         },
         inspectSandboxNetworkRules: async (sandboxName, options = {}) => {
-            await ensureQualified(options);
-            return inspectScopedSandboxNetworkRules(runner, sandboxName, options);
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'policy-list');
+            return inspectScopedSandboxNetworkRules(runner, sandboxName, options, profile);
         },
         inspectGlobalNetworkPosture: async (options = {}) => {
-            await ensureQualified(options);
-            return inspectSandboxGlobalNetworkPosture(runner, options);
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'policy-list');
+            return inspectSandboxGlobalNetworkPosture(runner, options, profile);
         },
         checkDestinationAccess: async (sandboxName, target, options = {}) => {
-            await ensureQualified(options);
-            return checkSandboxDestinationAccess(runner, sandboxName, target, options);
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'policy-check');
+            return checkSandboxDestinationAccess(runner, sandboxName, target, options, profile);
         },
         removeScopedNetworkRules: async (sandboxName, ruleIds, options = {}) => {
-            await ensureQualified(options);
-            return removeScopedSandboxNetworkRules(runner, sandboxName, ruleIds, options);
+            const profile = await ensureQualified(options);
+            requireReleaseCommandContract(profile, 'policy-remove');
+            return removeScopedSandboxNetworkRules(runner, sandboxName, ruleIds, options, profile);
         },
     };
 };
@@ -896,6 +1011,7 @@ export const removeScopedRulesBestEffort = async (adapter, sandboxName, ownedRul
     return failures;
 };
 export const createDockerSandboxExecutionEnvironmentLifecycle = (dependencies) => {
+    const releaseProfile = dependencies.releaseProfile ?? RECOMMENDED_DOCKER_SANDBOX_RELEASE;
     const appliedNetworkPolicies = new Map();
     const inspect = async (environment, options = {}) => {
         const expected = dependencies.resolveExpected(environment);
@@ -942,7 +1058,7 @@ export const createDockerSandboxExecutionEnvironmentLifecycle = (dependencies) =
     };
     return {
         prepare: async (request) => {
-            requireExecutionCapabilities(DOCKER_SANDBOX_PROVIDER, dockerSandboxExecutionEnvironmentObservation(), request.requiredCapabilities);
+            requireExecutionCapabilities(DOCKER_SANDBOX_PROVIDER, dockerSandboxExecutionEnvironmentObservation('unobserved', releaseProfile), request.requiredCapabilities);
             if (!request.persistent) {
                 throw new SbxContractFailure('create', 'Docker Sandbox lifecycle requires persistent environments');
             }
@@ -958,7 +1074,7 @@ export const createDockerSandboxExecutionEnvironmentLifecycle = (dependencies) =
             return {
                 id: preparation.id,
                 provider: DOCKER_SANDBOX_PROVIDER,
-                providerVersion: QUALIFIED_SBX_VERSION,
+                providerVersion: releaseProfile.version,
                 externalId: sandbox.name,
                 target: request.target,
                 state: 'ready',