@tangle-network/agent-app 0.39.0 → 0.39.2

package/dist/{chunk-CDYYR3Z7.js → chunk-DBIG2PHS.js}

@@ -6,10 +6,10 @@ import {
   base64UrlEncodeText,
   constantTimeEqual,
   hmacSha256Base64Url
-} from "./chunk-VT5DI6GL.js";
+} from "./chunk-FDJ6JQCI.js";
 import {
   buildAppToolMcpServer
-} from "./chunk-A76ZHWNF.js";
+} from "./chunk-RH74YJIK.js";
 import {
   resolveTangleExecutionEnvironment,
   trimOrNull
@@ -19,6 +19,7 @@ import {
 import {
   Sandbox
 } from "@tangle-network/sandbox";
+import { createHash } from "crypto";
 
 // src/sandbox/outcome.ts
 var ok = (value) => ({ succeeded: true, value });
@@ -592,21 +593,70 @@ function execWithTimeout(box, cmd, timeoutMs) {
     );
   });
 }
+var TRANSIENT_EXEC_STATUS_CODES = /* @__PURE__ */ new Set([408, 409, 425, 429, 500, 502, 503, 504]);
+var TRANSIENT_EXEC_CODE_RE = /^(ECONNRESET|ECONNREFUSED|ETIMEDOUT|EPIPE|ECONNABORTED)$/i;
+var TRANSIENT_EXEC_MESSAGE_RE = /\b(408|409|425|429|500|502|503|504)\b|rate.?limit|too many requests|\bfetch failed\b|network error|connection reset|socket hang up|timed? out|service unavailable|bad gateway|gateway timeout|internal server error|\b(?:sidecar|runtime|exec(?:ution)?|terminal|sandbox|service|command(?:s)?|proxy)\b.{0,80}\bnot ready\b|\bnot ready\b.{0,80}\b(?:sidecar|runtime|exec(?:ution)?|terminal|sandbox|service|command(?:s)?|proxy)\b/i;
+var RUNTIME_AUTH_REFRESH_SKEW_MS = 6e4;
+function errorStatus(err) {
+  const rawStatus = err.status ?? err.statusCode ?? (err.response && typeof err.response === "object" ? err.response.status : void 0);
+  if (typeof rawStatus === "number") return rawStatus;
+  if (typeof rawStatus === "string" && /^\d+$/.test(rawStatus)) return Number(rawStatus);
+  return void 0;
+}
+function retryAfterMs(err, seen = /* @__PURE__ */ new Set()) {
+  if (!err || typeof err !== "object") return void 0;
+  if (seen.has(err)) return void 0;
+  seen.add(err);
+  const e = err;
+  if (typeof e.retryAfterMs === "number") return e.retryAfterMs;
+  return retryAfterMs(e.cause, seen);
+}
+function isTransientExecError(err, seen = /* @__PURE__ */ new Set()) {
+  if (!err || typeof err !== "object") return false;
+  if (seen.has(err)) return false;
+  seen.add(err);
+  const e = err;
+  const status = errorStatus(e);
+  if (status !== void 0 && TRANSIENT_EXEC_STATUS_CODES.has(status)) return true;
+  if (typeof e.code === "string") {
+    if (TRANSIENT_EXEC_CODE_RE.test(e.code)) return true;
+    if (/rate.?limit|too.?many.?requests|429|server.?error|service.?unavailable/i.test(e.code)) return true;
+  }
+  if (typeof e.message === "string" && TRANSIENT_EXEC_MESSAGE_RE.test(e.message)) return true;
+  return isTransientExecError(e.cause, seen);
+}
+function isRuntimeExecAuthError(err, seen = /* @__PURE__ */ new Set()) {
+  if (!err || typeof err !== "object") return false;
+  if (seen.has(err)) return false;
+  seen.add(err);
+  const e = err;
+  if (errorStatus(e) === 401) return true;
+  if (typeof e.code === "string" && /^(AUTH_ERROR|AUTHENTICATION_ERROR|UNAUTHORIZED|UNAUTHENTICATED|ERR_UNAUTHORIZED|ERR_UNAUTHENTICATED|401)$/i.test(e.code)) {
+    return true;
+  }
+  if (typeof e.name === "string" && /^(AuthError|AuthenticationError|UnauthorizedError|UnauthenticatedError|SandboxAuthError)$/i.test(e.name)) {
+    return true;
+  }
+  return isRuntimeExecAuthError(e.cause, seen);
+}
+function isRuntimeAuthRefreshDenied(err) {
+  if (!err || typeof err !== "object") return false;
+  return isRuntimeExecAuthError(err) || errorStatus(err) === 403;
+}
 function transientExecError(err) {
   if (err instanceof ProfileWriteExecTimeoutError) return { retryable: true };
-  if (err && typeof err === "object") {
-    const e = err;
-    const retryAfterMs = typeof e.retryAfterMs === "number" ? e.retryAfterMs : void 0;
-    if (e.status === 429) return { retryable: true, retryAfterMs };
-    if (typeof e.code === "string" && /rate.?limit|too.?many.?requests|429/i.test(e.code)) {
-      return { retryable: true, retryAfterMs };
-    }
-    if (typeof e.message === "string" && /\b429\b|rate.?limit|too many requests/i.test(e.message)) {
-      return { retryable: true, retryAfterMs };
-    }
-  }
+  if (isTransientExecError(err)) return { retryable: true, retryAfterMs: retryAfterMs(err) };
   return { retryable: false };
 }
+function deferredProfileWriteFailed(stage, name, cause) {
+  return new Error(`deferred file write failed on ${stage} box ${name}: ${cause.message}`, { cause });
+}
+var SandboxRuntimeAuthRefreshError = class extends Error {
+  constructor(stage, name, detail, cause) {
+    super(`${stage} sandbox auth refresh failed for ${name}: ${detail}`, { cause });
+    this.name = "SandboxRuntimeAuthRefreshError";
+  }
+};
 async function writeProfileFilesToBox(box, files, options = {}) {
   const execTimeoutMs = options.execTimeoutMs ?? PROFILE_WRITE_EXEC_TIMEOUT_MS;
   const paceMs = options.paceMs ?? PROFILE_WRITE_PACE_MS;
@@ -616,12 +666,19 @@ async function writeProfileFilesToBox(box, files, options = {}) {
     if (mount.resource.kind !== "inline") continue;
     const content = mount.resource.content ?? "";
     const b64 = Buffer.from(content, "utf8").toString("base64");
+    const b64Chunks = [];
+    for (let i = 0; i < b64.length; i += PROFILE_WRITE_B64_CHUNK_CHARS) {
+      b64Chunks.push(b64.slice(i, i + PROFILE_WRITE_B64_CHUNK_CHARS));
+    }
+    const expectedSha256 = createHash("sha256").update(content, "utf8").digest("hex");
     const path = mount.path;
     const dir = path.replace(/\/[^/]*$/, "");
     const isBin = /(^|\/)(s?bin)\//.test(path);
     const executable = mount.executable ?? isBin;
     const q = shellPath(path);
     const qb64 = shellPath(`${path}.b64`);
+    const qtmp = shellPath(`${path}.tmp`);
+    const qpartPrefix = shellPath(`${path}.b64.part.`);
     const step = async (cmd) => {
       for (let attempt = 0; ; attempt++) {
         if (execStarted && paceMs > 0) await sleep(paceMs);
@@ -637,35 +694,37 @@ async function writeProfileFilesToBox(box, files, options = {}) {
           }
           return ok(void 0);
         } catch (err) {
-          const { retryable, retryAfterMs } = transientExecError(err);
+          const { retryable, retryAfterMs: retryAfterMs2 } = transientExecError(err);
           if (retryable && attempt < maxRetries) {
             const backoff = Math.min(
               PROFILE_WRITE_RETRY_BASE_MS * 2 ** attempt,
               PROFILE_WRITE_RETRY_MAX_MS
             );
-            await sleep(retryAfterMs ?? backoff);
+            await sleep(retryAfterMs2 ?? backoff);
             continue;
           }
           return fail(new Error(`writeProfileFilesToBox: exec failed for ${path}`, { cause: err }));
         }
       }
     };
-    const mkdir = dir && dir !== path ? `mkdir -p ${shellPath(dir)} && ` : "";
-    let res = await step(`${mkdir}: > ${qb64}`);
+    const mkdir = dir && dir !== path ? `mkdir -p ${shellPath(dir)}` : ":";
+    let res = await step(mkdir);
     if (!res.succeeded) return res;
-    for (let i = 0; i < b64.length; i += PROFILE_WRITE_B64_CHUNK_CHARS) {
-      const slice = b64.slice(i, i + PROFILE_WRITE_B64_CHUNK_CHARS);
-      res = await step(`printf '%s' '${slice}' >> ${qb64}`);
+    for (let i = 0; i < b64Chunks.length; i++) {
+      const slice = b64Chunks[i];
+      res = await step(`printf '%s' '${slice}' > ${shellPath(`${path}.b64.part.${i}`)}`);
       if (!res.succeeded) return res;
     }
-    const chmod = executable ? ` && chmod +x ${q}` : "";
-    res = await step(`base64 -d ${qb64} > ${q} && rm -f ${qb64}${chmod}`);
+    const chmod = executable ? `chmod +x ${q} || exit 1; ` : "";
+    const checksumMismatch = shellSingleQuote(`writeProfileFilesToBox: checksum mismatch for ${path}`);
+    const finalCmd = `expected='${expectedSha256}'; if [ -f ${q} ] && [ "$(sha256sum ${q} | awk '{print $1}')" = "$expected" ]; then ${chmod}rm -f ${qb64} ${qtmp}; i=0; while [ "$i" -lt ${b64Chunks.length} ]; do rm -f ${qpartPrefix}$i; i=$((i+1)); done; exit 0; fi; : > ${qb64} && i=0; while [ "$i" -lt ${b64Chunks.length} ]; do cat ${qpartPrefix}$i >> ${qb64} || exit 1; i=$((i+1)); done && base64 -d ${qb64} > ${qtmp} && [ "$(sha256sum ${qtmp} | awk '{print $1}')" = "$expected" ] || { echo ${checksumMismatch} >&2; exit 1; }; mv ${qtmp} ${q} && ${executable ? `chmod +x ${q} && ` : ""}[ "$(sha256sum ${q} | awk '{print $1}')" = "$expected" ] || { echo ${checksumMismatch} >&2; exit 1; }; rm -f ${qb64} ${qtmp}; i=0; while [ "$i" -lt ${b64Chunks.length} ]; do rm -f ${qpartPrefix}$i; i=$((i+1)); done`;
+    res = await step(finalCmd);
     if (!res.succeeded) return res;
   }
   return ok(void 0);
 }
-async function materializeDeferredFilesForExistingBox(shell, box, workspaceId, userId) {
-  if (!shell.deferProfileFiles) return ok(void 0);
+async function materializeDeferredFilesForExistingBox(shell, client, box, stage, name, workspaceId, userId) {
+  if (!shell.deferProfileFiles) return ok(box);
   const connectedIntegrationIds = await shell.connectedIntegrationIds(workspaceId);
   const buildCtx = {
     workspaceId,
@@ -675,8 +734,8 @@ async function materializeDeferredFilesForExistingBox(shell, box, workspaceId, u
   const files = await shell.files(buildCtx);
   const fullProfile = shell.profile({ extraFiles: files });
   const { deferredFiles } = splitDeferredProfileFiles(fullProfile);
-  if (deferredFiles.length === 0) return ok(void 0);
-  return writeProfileFilesToBox(box, deferredFiles);
+  if (deferredFiles.length === 0) return ok(box);
+  return writeDeferredFilesWithRuntimeAuthRefresh(client, box, deferredFiles, stage, name);
 }
 async function listRunning(client, name) {
   try {
@@ -726,6 +785,22 @@ function sandboxRuntimeUrl(box) {
   const connection = box.connection;
   return connection?.sidecarUrl ?? connection?.runtimeUrl;
 }
+function runtimeAuthExpiresAtMs(value) {
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === "number") return value;
+  if (typeof value !== "string" || value.trim() === "") return void 0;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? void 0 : parsed;
+}
+function hasFreshRuntimeExecAuth(box, now = Date.now()) {
+  const connection = box.connection;
+  const token = connection?.authToken ?? connection?.sidecarToken;
+  if (!sandboxRuntimeUrl(box) || !token) return false;
+  const expiresAt = runtimeAuthExpiresAtMs(
+    connection?.authTokenExpiresAt ?? connection?.sidecarTokenExpiresAt
+  );
+  return expiresAt === void 0 || expiresAt > now + RUNTIME_AUTH_REFRESH_SKEW_MS;
+}
 function sandboxEdgeFailed(box) {
   const connection = box.connection;
   return connection?.edgeStatus === "failed" || Boolean(connection?.edgeError);
@@ -747,6 +822,84 @@ async function refreshRuntimeConnection(client, box) {
   }
   return current;
 }
+async function bestEffortRefreshRuntimeExecAuth(client, box, stage, name) {
+  let current = box;
+  try {
+    await current.refresh();
+    if (hasFreshRuntimeExecAuth(current)) return ok(current);
+  } catch (err) {
+    if (isRuntimeAuthRefreshDenied(err)) {
+      return fail(
+        new SandboxRuntimeAuthRefreshError(
+          stage,
+          name,
+          "runtime exec auth refresh was unauthorized",
+          err
+        )
+      );
+    }
+  }
+  try {
+    const latest = await client.get(current.id);
+    if (latest) current = latest;
+    if (hasFreshRuntimeExecAuth(current)) return ok(current);
+  } catch (err) {
+    if (isRuntimeAuthRefreshDenied(err)) {
+      return fail(
+        new SandboxRuntimeAuthRefreshError(
+          stage,
+          name,
+          "runtime exec auth re-fetch was unauthorized",
+          err
+        )
+      );
+    }
+  }
+  return ok(current);
+}
+async function refreshRuntimeExecAuth(client, box, stage, name) {
+  let current = box;
+  let lastError;
+  const deadline = Date.now() + RUNTIME_CONNECTION_WAIT_MS;
+  while (Date.now() < deadline) {
+    try {
+      await current.refresh();
+      if (hasFreshRuntimeExecAuth(current)) return ok(current);
+      const latest = await client.get(current.id);
+      if (latest) current = latest;
+      if (hasFreshRuntimeExecAuth(current)) return ok(current);
+    } catch (err) {
+      lastError = err;
+    }
+    await new Promise((resolve) => setTimeout(resolve, RUNTIME_CONNECTION_POLL_MS));
+  }
+  const detail = sandboxRuntimeUrl(current) ? "runtime exec credentials are missing or expired after refresh" : "runtime connection is missing after refresh";
+  return fail(new SandboxRuntimeAuthRefreshError(stage, name, detail, lastError));
+}
+async function writeDeferredFilesWithRuntimeAuthRefresh(client, box, files, stage, name) {
+  let writeBox = box;
+  if (!hasFreshRuntimeExecAuth(writeBox)) {
+    const refreshed2 = await bestEffortRefreshRuntimeExecAuth(client, writeBox, stage, name);
+    if (!refreshed2.succeeded) return fail(refreshed2.error);
+    writeBox = refreshed2.value;
+  }
+  const first = await writeProfileFilesToBox(writeBox, files);
+  if (first.succeeded) return ok(writeBox);
+  if (!isRuntimeExecAuthError(first.error)) return fail(first.error);
+  const refreshed = await refreshRuntimeExecAuth(client, writeBox, stage, name);
+  if (!refreshed.succeeded) return fail(refreshed.error);
+  const second = await writeProfileFilesToBox(refreshed.value, files);
+  if (second.succeeded) return ok(refreshed.value);
+  if (!isRuntimeExecAuthError(second.error)) return fail(second.error);
+  return fail(
+    new SandboxRuntimeAuthRefreshError(
+      stage,
+      name,
+      "runtime exec remained unauthorized after auth refresh",
+      second.error
+    )
+  );
+}
 async function isReusableBox(box, harness, probe) {
   if (sandboxEdgeFailed(box)) return false;
   if (!sandboxRuntimeUrl(box)) return false;
@@ -784,17 +937,26 @@ async function ensureWorkspaceSandbox(shell, options) {
     } else if (found.metadata?.harness === harness) {
       const ready = await refreshRuntimeConnection(client, found);
       if (await isReusableBox(ready, harness, shell.livenessProbe)) {
-        const written = await materializeDeferredFilesForExistingBox(shell, ready, workspaceId, userId);
+        const written = await materializeDeferredFilesForExistingBox(
+          shell,
+          client,
+          ready,
+          "reused",
+          name,
+          workspaceId,
+          userId
+        );
         if (!written.succeeded) {
-          throw new Error(`deferred file write failed on reused box ${name}`, { cause: written.error });
+          throw deferredProfileWriteFailed("reused", name, written.error);
         }
+        const reusedBox = written.value;
         if (shell.bootstrap) {
-          const boot = await shell.bootstrap(ready, scope);
+          const boot = await shell.bootstrap(reusedBox, scope);
           if (!boot.succeeded) {
             throw new Error(`bootstrap failed on reused box ${name}`, { cause: boot.error });
           }
         }
-        return ready;
+        return reusedBox;
       }
       const dropped = await deleteBox(ready);
       if (!dropped.succeeded) {
@@ -818,17 +980,26 @@ async function ensureWorkspaceSandbox(shell, options) {
     if (resumed.succeeded && resumed.value) {
       const box2 = await refreshRuntimeConnection(client, resumed.value);
       if (await isReusableBox(box2, harness, shell.livenessProbe)) {
-        const written = await materializeDeferredFilesForExistingBox(shell, box2, workspaceId, userId);
+        const written = await materializeDeferredFilesForExistingBox(
+          shell,
+          client,
+          box2,
+          "resumed",
+          name,
+          workspaceId,
+          userId
+        );
         if (!written.succeeded) {
-          throw new Error(`deferred file write failed on resumed box ${name}`, { cause: written.error });
+          throw deferredProfileWriteFailed("resumed", name, written.error);
         }
+        const resumedBox = written.value;
         if (shell.bootstrap) {
-          const boot = await shell.bootstrap(box2, scope);
+          const boot = await shell.bootstrap(resumedBox, scope);
           if (!boot.succeeded) {
             throw new Error(`bootstrap failed on resumed box ${name}`, { cause: boot.error });
           }
         }
-        return box2;
+        return resumedBox;
       }
       const dropped = await deleteBox(box2);
       if (!dropped.succeeded) {
@@ -892,7 +1063,7 @@ async function ensureWorkspaceSandbox(shell, options) {
   if (deferredFiles.length > 0) {
     const written = await writeProfileFilesToBox(box, deferredFiles);
     if (!written.succeeded) {
-      throw new Error(`deferred file write failed on new box ${name}`, { cause: written.error });
+      throw deferredProfileWriteFailed("new", name, written.error);
     }
   }
   if (shell.bootstrap) {
@@ -1190,6 +1361,7 @@ export {
   buildSandboxToolPathSetupScript,
   runSandboxToolPathSetup,
   splitDeferredProfileFiles,
+  SandboxRuntimeAuthRefreshError,
   writeProfileFilesToBox,
   ensureWorkspaceSandbox,
   resolveModel,
@@ -1211,4 +1383,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-CDYYR3Z7.js.map
+//# sourceMappingURL=chunk-DBIG2PHS.js.map