@tangle-network/agent-app 0.45.3 → 0.45.5

package/dist/chat-routes/index.js

@@ -100,7 +100,7 @@ import {
   flattenHistory,
   readSandboxBinaryBytes,
   statSandboxFileSize
-} from "../chunk-AOQ4FCSH.js";
+} from "../chunk-QGHQ2IRC.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-73F3CKVK.js";
 import "../chunk-ITCINLSU.js";

package/dist/{chunk-AOQ4FCSH.js → chunk-QGHQ2IRC.js}

@@ -155,6 +155,206 @@ async function readSandboxBinaryBytes(box, absolutePath, expectedSize, options)
   return { succeeded: true, value: { bytes, size: expectedSize } };
 }
 
+// src/sandbox/diagnostics.ts
+var EGRESS_PROXY_RECOVERY_REQUIRED = "EGRESS_PROXY_RECOVERY_REQUIRED";
+var SAFE_ERROR_FIELDS = [
+  "code",
+  "status",
+  "phase",
+  "endpoint",
+  "origin",
+  "retryAfterMs",
+  "sidecarVersion",
+  "containerImage"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function asSafeScalar(value) {
+  if (typeof value === "string" && value.length > 0) return redactDiagnosticText(value);
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  return void 0;
+}
+function redactDiagnosticText(value) {
+  const secretKeyPattern = "(?:(?:[A-Z0-9]+_)*(?:api_?key|auth_?token|access_?token|refresh_?token|key|token|password|secret|credential)|apiKey|authToken|accessToken|refreshToken)";
+  return value.replace(/(['"]authorization['"]\s*:\s*)(['"])[^'"]*\2/gi, "$1$2[REDACTED]$2").replace(/\b(authorization\s*[:=]\s*)(['"])[^'"]*\2/gi, "$1$2[REDACTED]$2").replace(/\b(authorization\s*[:=]\s*)Digest\b[^;}\n]*(?:\r?\n[ \t]+[^;}\n]*)*/gi, "$1[REDACTED]").replace(/\b(authorization\s*[:=]\s*)(?:Basic|Bearer|Negotiate)\s+[^\s;,&}\n]+(?:\r?\n[ \t]+[^\s;,&}\n]+)*/gi, "$1[REDACTED]").replace(new RegExp(`\\b(authorization\\s*[:=]\\s*)(?!(?:Basic|Bearer|Digest|Negotiate)\\b)([A-Za-z][A-Za-z0-9._-]+)\\s+(?!(?:authorization|${secretKeyPattern})\\s*[:=]|['"](?:authorization|${secretKeyPattern})['"]\\s*:)([^}\\n]*(?:\\r?\\n[ \\t]+[^}\\n]*)*)`, "gi"), (_match, prefix, _scheme, valuePart) => {
+    if (valuePart.includes(";") || /\r?\n[ \t]+/.test(valuePart)) return `${prefix}[REDACTED]`;
+    const tokenMatch = valuePart.match(/^\S+(.*)$/);
+    return `${prefix}[REDACTED]${tokenMatch?.[1] ?? ""}`;
+  }).replace(/\b(authorization\s*[:=]\s*)[A-Za-z][\w.-]+\s+[^\s;,&}\n]+(?=[;&}\n]|$)/gi, "$1[REDACTED]").replace(/\b(authorization\s*[:=]\s*)(?!\[REDACTED\])[^'"\s&}]+(?:[;,][^'"\s&}]+)*/gi, "$1[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{6,}\b/g, "sk-[REDACTED]").replace(
+    /([?&][^=&#\s]*(?:token|key|secret|password|authorization)[^=&#\s]*=)[^&#\s]+/gi,
+    "$1[REDACTED]"
+  ).replace(
+    new RegExp(`(['"])(${secretKeyPattern})\\1\\s*:\\s*(['"])[^'"]+\\3`, "gi"),
+    "$1$2$1:$3[REDACTED]$3"
+  ).replace(
+    new RegExp(`\\b(${secretKeyPattern})\\s*([:=])(\\s*)(['"]?)(?!Bearer\\b)[^'"\\s;,&}]+(?:[;,]\\s*[^'"\\s;,&}]+)*`, "gi"),
+    "$1$2$3$4[REDACTED]"
+  );
+}
+function readMessage(value) {
+  if (value instanceof Error) return redactDiagnosticText(value.message);
+  if (typeof value === "string" && value.length > 0) return redactDiagnosticText(value);
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "boolean") return String(value);
+  if (!isRecord(value)) return void 0;
+  const message = value.message;
+  return typeof message === "string" && message.length > 0 ? redactDiagnosticText(message) : void 0;
+}
+function readName(value) {
+  if (value instanceof Error) return redactDiagnosticText(value.name);
+  if (!isRecord(value)) return void 0;
+  const name = value.name;
+  return typeof name === "string" && name.length > 0 ? redactDiagnosticText(name) : void 0;
+}
+function readCause(value) {
+  if (!isRecord(value)) return void 0;
+  return value.cause;
+}
+function serializeSandboxProvisioningError(error, options = {}) {
+  const maxDepth = options.maxDepth ?? 6;
+  const causes = [];
+  const seen = /* @__PURE__ */ new Set();
+  let truncatedAtDepth;
+  let cycle = false;
+  let current = error;
+  let depth = 0;
+  for (; depth < maxDepth && current !== void 0 && current !== null; depth += 1) {
+    if (seen.has(current)) {
+      cycle = true;
+      causes.push({
+        name: "CauseChainCycle",
+        message: `cause chain cycle detected after ${depth} entries`
+      });
+      break;
+    }
+    if (isRecord(current)) seen.add(current);
+    const cause = {};
+    const name = readName(current);
+    const message = readMessage(current);
+    if (name) cause.name = name;
+    if (message) cause.message = message;
+    if (isRecord(current)) {
+      for (const field of SAFE_ERROR_FIELDS) {
+        const safeValue = asSafeScalar(current[field]);
+        if (safeValue !== void 0) {
+          Object.assign(cause, { [field]: safeValue });
+        }
+      }
+    }
+    if (Object.keys(cause).length > 0) causes.push(cause);
+    current = readCause(current);
+  }
+  if (!cycle && isRecord(current) && seen.has(current)) {
+    cycle = true;
+    causes.push({
+      name: "CauseChainCycle",
+      message: `cause chain cycle detected after ${depth} entries`
+    });
+  } else if (current !== void 0 && current !== null && depth >= maxDepth) {
+    truncatedAtDepth = maxDepth;
+    causes.push({
+      name: "CauseChainTruncated",
+      message: `cause chain truncated after ${maxDepth} entries`
+    });
+  }
+  return {
+    message: readMessage(error) ?? "Sandbox unavailable",
+    causes,
+    truncated: truncatedAtDepth !== void 0,
+    truncatedAtDepth,
+    cycle
+  };
+}
+function formatSandboxProvisioningSupportDetails(diagnostics) {
+  const actionableCause = diagnostics.causes.find(
+    (cause) => cause.code !== void 0 || cause.status !== void 0 || cause.phase !== void 0 || cause.endpoint !== void 0 || cause.origin !== void 0 || cause.retryAfterMs !== void 0 || cause.sidecarVersion !== void 0 || cause.containerImage !== void 0
+  ) ?? diagnostics.causes[1];
+  if (!actionableCause) return "Support details: no nested sandbox cause details were available.";
+  const details = [
+    typeof actionableCause.name === "string" ? redactDiagnosticText(actionableCause.name) : void 0,
+    actionableCause.code !== void 0 ? `code=${actionableCause.code}` : void 0,
+    actionableCause.status !== void 0 ? `status=${actionableCause.status}` : void 0,
+    actionableCause.phase !== void 0 ? `phase=${redactDiagnosticText(actionableCause.phase)}` : void 0,
+    actionableCause.endpoint !== void 0 ? `endpoint=${redactDiagnosticText(actionableCause.endpoint)}` : void 0,
+    actionableCause.origin !== void 0 ? `origin=${redactDiagnosticText(actionableCause.origin)}` : void 0,
+    actionableCause.retryAfterMs !== void 0 ? `retryAfterMs=${actionableCause.retryAfterMs}` : void 0,
+    actionableCause.sidecarVersion !== void 0 ? `sidecarVersion=${redactDiagnosticText(actionableCause.sidecarVersion)}` : void 0,
+    actionableCause.containerImage !== void 0 ? `containerImage=${redactDiagnosticText(actionableCause.containerImage)}` : void 0,
+    typeof actionableCause.message === "string" ? redactDiagnosticText(actionableCause.message) : void 0
+  ].filter(Boolean);
+  if (details.length === 0) return "Support details: no nested sandbox cause details were available.";
+  return `Support details: ${details.join("; ")}`;
+}
+function isSandboxAuthFailure(diagnostics) {
+  return diagnostics.causes.some((cause) => {
+    const code = typeof cause.code === "string" ? cause.code.toUpperCase() : void 0;
+    const status = typeof cause.status === "number" ? cause.status : typeof cause.status === "string" ? Number.parseInt(cause.status, 10) : void 0;
+    const name = typeof cause.name === "string" ? cause.name.toLowerCase() : "";
+    const message = typeof cause.message === "string" ? cause.message.toLowerCase() : "";
+    return code === "AUTH_ERROR" || status === 401 || name.includes("autherror") || message.includes("missing or invalid authentication");
+  });
+}
+function isSandboxApiBearerAuthFailure(diagnostics) {
+  return diagnostics.causes.some((cause) => {
+    const status = typeof cause.status === "number" ? cause.status : typeof cause.status === "string" ? Number.parseInt(cause.status, 10) : void 0;
+    if (status !== 401) return false;
+    if (cause.origin !== "sandbox-api") return false;
+    if (typeof cause.endpoint !== "string") return false;
+    const endpointPath = sandboxApiEndpointPath(cause.endpoint);
+    if (!endpointPath) return false;
+    return /^\/v1\/sandboxes\/[^/?#]+(?:\/(?!runtime(?:[/?#]|$))[^?#]*)?(?:[?#].*)?$/.test(endpointPath);
+  });
+}
+function isSandboxApiSandboxMissingFailure(diagnostics) {
+  return diagnostics.causes.some((cause) => {
+    const status = typeof cause.status === "number" ? cause.status : typeof cause.status === "string" ? Number.parseInt(cause.status, 10) : void 0;
+    if (status !== 404) return false;
+    if (cause.origin !== "sandbox-api") return false;
+    if (typeof cause.endpoint !== "string") return false;
+    const endpointPath = sandboxApiEndpointPath(cause.endpoint);
+    if (!endpointPath) return false;
+    return /^\/v1\/sandboxes\/[^/?#]+(?:\/(?!runtime(?:[/?#]|$))[^?#]*)?(?:[?#].*)?$/.test(endpointPath);
+  });
+}
+function isSandboxHostCapacityFailure(diagnostics) {
+  return diagnostics.causes.some((cause) => {
+    if (cause.origin !== "sandbox-api") return false;
+    if (typeof cause.message !== "string") return false;
+    return /host has no available slot|host capacity reservation failed/i.test(cause.message);
+  });
+}
+function sandboxApiEndpointPath(endpoint) {
+  if (endpoint.startsWith("/")) return endpoint;
+  try {
+    const url = new URL(endpoint);
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return null;
+  }
+}
+function formatSandboxProvisioningUserMessage(diagnostics) {
+  if (diagnostics.causes.some((cause) => cause.code === EGRESS_PROXY_RECOVERY_REQUIRED)) {
+    return "Sandbox recovery is required before chat can continue. The stopped sandbox has not been deleted.";
+  }
+  if (diagnostics.causes.some((cause) => cause.code === "vault.hydration_incomplete")) {
+    return "I couldn't finish copying your Vault into the sandbox, so I stopped rather than work from a partial copy. The copy resumes where it left off \u2014 try again in a moment.";
+  }
+  if (isSandboxApiBearerAuthFailure(diagnostics)) {
+    return "I'm unable to reconnect to the sandbox because its sandbox API credential was rejected. Another request may have rotated the bearer used for this operation.";
+  }
+  if (isSandboxAuthFailure(diagnostics)) {
+    return "I'm unable to reconnect to the sandbox because its runtime authentication failed. This can happen when an existing sandbox is reused with stale credentials.";
+  }
+  if (diagnostics.causes.some((cause) => cause.code === "PAYLOAD_TOO_LARGE" || cause.code === "FILE_TOO_LARGE" || cause.status === 413 || cause.status === "413")) {
+    return "An attachment is too large for the sandbox to accept. Use a smaller file and try again.";
+  }
+  if (diagnostics.causes.some((cause) => cause.code === "UPLOAD_BUDGET_EXHAUSTED")) {
+    return "Too much attachment data is staged in the sandbox at once. Retry shortly.";
+  }
+  return "I'm unable to connect to the sandbox right now. This usually means the sandbox service is not configured or is temporarily unavailable.";
+}
+
 // src/sandbox/workspace-sandbox-manager.ts
 function createWorkspaceSandboxManager(opts) {
   return {
@@ -1245,6 +1445,20 @@ async function assertExistingBoxEgress(box, desired, stage, name) {
   );
 }
 async function ensureWorkspaceSandbox(shell, options) {
+  try {
+    return await provisionWorkspaceSandbox(shell, options);
+  } catch (err) {
+    if (!shell.replaceUnbringableBox) throw err;
+    if (options.forceNew) throw err;
+    if (!isUnbringableBoxError(err)) throw err;
+    return await provisionWorkspaceSandbox(shell, { ...options, forceNew: true });
+  }
+}
+function isUnbringableBoxError(error) {
+  if (error instanceof SandboxRecoveryFailedError) return true;
+  return isSandboxHostCapacityFailure(serializeSandboxProvisioningError(error));
+}
+async function provisionWorkspaceSandbox(shell, options) {
   const { workspaceId, userId, harness, forceNew, onProgress, billingOwnerId } = options;
   const resolved = await resolveWorkspaceSandboxClient(shell, workspaceId, userId);
   const { scope, client } = resolved;
@@ -1725,6 +1939,14 @@ export {
   shellQuote,
   statSandboxFileSize,
   readSandboxBinaryBytes,
+  EGRESS_PROXY_RECOVERY_REQUIRED,
+  serializeSandboxProvisioningError,
+  formatSandboxProvisioningSupportDetails,
+  isSandboxAuthFailure,
+  isSandboxApiBearerAuthFailure,
+  isSandboxApiSandboxMissingFailure,
+  isSandboxHostCapacityFailure,
+  formatSandboxProvisioningUserMessage,
   createWorkspaceSandboxManager,
   createSandboxTerminalConnectionRoute,
   createSandboxPrewarmer,
@@ -1776,4 +1998,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-AOQ4FCSH.js.map
+//# sourceMappingURL=chunk-QGHQ2IRC.js.map