@tanstack/ai-sandbox-cloudflare 0.2.4 → 0.3.0

package/dist/esm/agent.d.ts

@@ -28,3 +28,7 @@ export { createSandboxAgentWorker } from './worker.js';
 export type { ResolveCoordinator } from './worker.js';
 export { DurableObjectRunEventLog } from './run-log-do.js';
 export { timingSafeBearerEqualWeb } from './web-crypto.js';
+export { InMemoryRunEventLog, migrateStoredRunRecord } from './run-log.js';
+export type { RunEventLog, RunEvent, RunEventLogReadOptions, RunLogRecord, RunRecordPatch, } from './run-log.js';
+export { runLogStore, runLogStream } from './durability.js';
+export type { RunLogStreamInit } from './durability.js';

package/dist/esm/agent.js

@@ -1,25 +1,13 @@
-import { createCloudflareSandboxAgent } from "./factory.js";
+import { runLogStore, runLogStream } from "./durability.js";
+import { InMemoryRunEventLog, migrateStoredRunRecord } from "./run-log.js";
+import { DurableObjectRunEventLog } from "./run-log-do.js";
+import { resolveBridgeOrigin, resolvePreviewHost } from "./public-host.js";
 import { SandboxCoordinator } from "./coordinator.js";
-import { PREVIEW_GUIDANCE, exposePreviewTool } from "./preview-tool.js";
+import { timingSafeBearerEqualWeb } from "./web-crypto.js";
 import { ChatSandboxCoordinator } from "./chat-coordinator.js";
 import { ContainerSandboxCoordinator } from "./container-coordinator.js";
-import { parseContainerRunRequest } from "./protocol.js";
 import { createSandboxAgentWorker } from "./worker.js";
-import { DurableObjectRunEventLog } from "./run-log-do.js";
-import { timingSafeBearerEqualWeb } from "./web-crypto.js";
-import { resolveBridgeOrigin, resolvePreviewHost } from "./public-host.js";
-export {
-  ChatSandboxCoordinator,
-  ContainerSandboxCoordinator,
-  DurableObjectRunEventLog,
-  PREVIEW_GUIDANCE,
-  SandboxCoordinator,
-  createCloudflareSandboxAgent,
-  createSandboxAgentWorker,
-  exposePreviewTool,
-  parseContainerRunRequest,
-  resolveBridgeOrigin,
-  resolvePreviewHost,
-  timingSafeBearerEqualWeb
-};
-//# sourceMappingURL=agent.js.map
+import { createCloudflareSandboxAgent } from "./factory.js";
+import { PREVIEW_GUIDANCE, exposePreviewTool } from "./preview-tool.js";
+import { parseContainerRunRequest } from "./protocol.js";
+export { ChatSandboxCoordinator, ContainerSandboxCoordinator, DurableObjectRunEventLog, InMemoryRunEventLog, PREVIEW_GUIDANCE, SandboxCoordinator, createCloudflareSandboxAgent, createSandboxAgentWorker, exposePreviewTool, migrateStoredRunRecord, parseContainerRunRequest, resolveBridgeOrigin, resolvePreviewHost, runLogStore, runLogStream, timingSafeBearerEqualWeb };

package/dist/esm/chat-coordinator.js

@@ -1,135 +1,147 @@
-import { chat, defineChatMiddleware } from "@tanstack/ai";
-import { withSandbox, ToolBridgeProvisionerCapability, createToolBridgeCore, handleBridgeJsonRpc } from "@tanstack/ai-sandbox";
+import { resolveBridgeOrigin } from "./public-host.js";
 import { SandboxCoordinator } from "./coordinator.js";
 import { timingSafeBearerEqualWeb } from "./web-crypto.js";
-import { resolveBridgeOrigin } from "./public-host.js";
-class ChatSandboxCoordinator extends SandboxCoordinator {
-  /**
-   * Live per-run bridges, keyed by runId. In-memory by design: a bridge is only
-   * reachable while its run is in flight, and `ctx.waitUntil(done)` keeps THIS
-   * instance alive (un-hibernated) for the run's whole lifetime — so the agent's
-   * MCP calls always hit the instance that provisioned the bridge. A request for
-   * a run with no live bridge (finished, or never started here) is a hard 404,
-   * not a silent re-provision.
-   */
-  bridges = /* @__PURE__ */ new Map();
-  // ===========================================================================
-  // The one per-model seam: run chat() in the DO
-  // ===========================================================================
-  /**
-   * Run `chat()` IN the DO, streaming its `StreamChunk`s. `stream: true` (with no
-   * outputSchema) makes chat() return an `AsyncIterable<StreamChunk>` directly —
-   * no cast needed for the run driver. Both middlewares run `setup` before
-   * streaming begins: our middleware provides the DO-backed bridge provisioner,
-   * and `withSandbox` provides the sandbox handle the harness adapter needs.
-   */
-  buildRunStream(input) {
-    const { adapter, sandbox, tools, systemPrompts } = this.config(input);
-    const sessionId = input.metadata?.sessionId;
-    const modelOptions = typeof sessionId === "string" && sessionId !== "" ? { sessionId } : void 0;
-    return chat({
-      threadId: input.threadId,
-      adapter,
-      messages: input.messages,
-      stream: true,
-      ...tools !== void 0 ? { tools } : {},
-      ...systemPrompts !== void 0 ? { systemPrompts } : {},
-      ...modelOptions !== void 0 ? { modelOptions } : {},
-      middleware: [
-        this.bridgeProvisionerMiddleware(input),
-        withSandbox(sandbox)
-      ]
-    });
-  }
-  /** Drop the per-run bridge once the run is terminal (override from base). */
-  onRunSettled(runId) {
-    this.bridges.delete(runId);
-  }
-  // ===========================================================================
-  // The DO-backed tool-bridge provisioner + endpoint
-  // ===========================================================================
-  /**
-   * A tiny middleware that PROVIDES our DO-backed {@link ToolBridgeProvisioner}.
-   * The harness adapter reads it via `getOptional` and falls back to the
-   * `node:http` host transport when absent — here we override that so the bridge
-   * is served from this DO's `fetch` handler instead of a TCP listener.
-   */
-  bridgeProvisionerMiddleware(input) {
-    const provisioner = this.makeBridgeProvisioner(input);
-    return defineChatMiddleware({
-      name: "do-tool-bridge-provisioner",
-      provides: [ToolBridgeProvisionerCapability],
-      setup: (ctx) => {
-        ctx.provide(ToolBridgeProvisionerCapability, provisioner);
-      }
-    });
-  }
-  /**
-   * Stand up the per-run bridge: register the tool core + a fresh bearer token
-   * on this DO, and hand back a URL the SANDBOX can reach — the Worker's public
-   * hostname routed to `/_bridge/:runId`. The `threadId` query lets the Worker
-   * route the agent's MCP calls back to THIS coordinator. No raw socket is opened.
-   */
-  makeBridgeProvisioner(input) {
-    const env = this.env;
-    const bridges = this.bridges;
-    const { runId, threadId } = input;
-    const origin = resolveBridgeOrigin(env, input);
-    return {
-      provision(tools, options) {
-        const token = crypto.randomUUID() + crypto.randomUUID().replace(/-/g, "");
-        const core = createToolBridgeCore(tools, {
-          ...options.context !== void 0 ? { context: options.context } : {},
-          ...options.signal !== void 0 ? { signal: options.signal } : {},
-          ...options.permission !== void 0 ? { permission: options.permission } : {}
-        });
-        bridges.set(runId, { token, core });
-        return Promise.resolve({
-          name: "tanstack",
-          url: `${origin}/_bridge/${runId}?threadId=${encodeURIComponent(threadId)}`,
-          token,
-          close: () => {
-            bridges.delete(runId);
-            return Promise.resolve();
-          }
-        });
-      }
-    };
-  }
-  /** Serve `/_bridge/:runId` (the in-sandbox agent's MCP calls) from the base fetch. */
-  handleRoute(request, parts) {
-    if (parts[0] === "_bridge" && typeof parts[1] === "string") {
-      return this.serveBridge(parts[1], request);
-    }
-    return super.handleRoute(request, parts);
-  }
-  /** Serve one MCP JSON-RPC request for a run after a constant-time token check. */
-  async serveBridge(runId, request) {
-    const bridge = this.bridges.get(runId);
-    if (!bridge)
-      return new Response("no active bridge for run", { status: 404 });
-    if (!timingSafeBearerEqualWeb(
-      request.headers.get("authorization") ?? void 0,
-      bridge.token
-    )) {
-      return new Response("unauthorized", { status: 401 });
-    }
-    let message;
-    try {
-      message = await request.json();
-    } catch {
-      return this.jsonResponse({
-        jsonrpc: "2.0",
-        id: null,
-        error: { code: -32700, message: "Parse error" }
-      });
-    }
-    const reply = await handleBridgeJsonRpc(bridge.core, message);
-    if (reply === null) return new Response(null, { status: 202 });
-    return this.jsonResponse(reply);
-  }
-}
-export {
-  ChatSandboxCoordinator
+import { ToolBridgeProvisionerCapability, createToolBridgeCore, handleBridgeJsonRpc, withSandbox } from "@tanstack/ai-sandbox";
+import { chat, defineChatMiddleware } from "@tanstack/ai";
+//#region src/chat-coordinator.ts
+/**
+* `ChatSandboxCoordinator` — the concrete {@link SandboxCoordinator} for the
+* DO-DRIVES model: the Durable Object runs `chat()` ITSELF and hosts the MCP
+* tool-bridge from its own `fetch` handler.
+*
+*     Worker (stateless trigger)
+*        → ChatSandboxCoordinator (this DO: runs chat(), owns the sandbox + log)
+*           → Cloudflare Sandbox (the container the agent executes in)
+*
+* It implements the one per-model seam, {@link buildRunStream}, by running
+* `chat()` in the DO with two middlewares: our DO-backed tool-bridge provisioner
+* (so the bridge is served from this DO instead of a `node:http` listener) and
+* `withSandbox(...)` (the handle the harness adapter needs). The per-run config —
+* which adapter, which sandbox, which chat()-tools — is the subclass's
+* {@link config} method; everything else (run-log, streaming tail, watchdog) is
+* inherited from the base.
+*
+* The MCP tool-bridge lives at `/_bridge/:runId`, gated by a per-run bearer
+* token, served from {@link handleRoute}. The in-sandbox agent reaches it via
+* the Worker's public hostname.
+*
+* NOTE: Workers-runtime code — compiles against the real Cloudflare + TanStack
+* AI types; not runtime-verified in this repo (no Workers runtime here).
+*/
+var ChatSandboxCoordinator = class extends SandboxCoordinator {
+	/**
+	* Live per-run bridges, keyed by runId. In-memory by design: a bridge is only
+	* reachable while its run is in flight, and `ctx.waitUntil(done)` keeps THIS
+	* instance alive (un-hibernated) for the run's whole lifetime — so the agent's
+	* MCP calls always hit the instance that provisioned the bridge. A request for
+	* a run with no live bridge (finished, or never started here) is a hard 404,
+	* not a silent re-provision.
+	*/
+	bridges = /* @__PURE__ */ new Map();
+	/**
+	* Run `chat()` IN the DO, streaming its `StreamChunk`s. `stream: true` (with no
+	* outputSchema) makes chat() return an `AsyncIterable<StreamChunk>` directly —
+	* no cast needed for the run driver. Both middlewares run `setup` before
+	* streaming begins: our middleware provides the DO-backed bridge provisioner,
+	* and `withSandbox` provides the sandbox handle the harness adapter needs.
+	*/
+	buildRunStream(input) {
+		const { adapter, sandbox, tools, systemPrompts } = this.config(input);
+		const sessionId = input.metadata?.sessionId;
+		const modelOptions = typeof sessionId === "string" && sessionId !== "" ? { sessionId } : void 0;
+		return chat({
+			threadId: input.threadId,
+			adapter,
+			messages: input.messages,
+			stream: true,
+			...tools !== void 0 ? { tools } : {},
+			...systemPrompts !== void 0 ? { systemPrompts } : {},
+			...modelOptions !== void 0 ? { modelOptions } : {},
+			middleware: [this.bridgeProvisionerMiddleware(input), withSandbox(sandbox)]
+		});
+	}
+	/** Drop the per-run bridge once the run is terminal (override from base). */
+	onRunSettled(runId) {
+		this.bridges.delete(runId);
+	}
+	/**
+	* A tiny middleware that PROVIDES our DO-backed {@link ToolBridgeProvisioner}.
+	* The harness adapter reads it via `getOptional` and falls back to the
+	* `node:http` host transport when absent — here we override that so the bridge
+	* is served from this DO's `fetch` handler instead of a TCP listener.
+	*/
+	bridgeProvisionerMiddleware(input) {
+		const provisioner = this.makeBridgeProvisioner(input);
+		return defineChatMiddleware({
+			name: "do-tool-bridge-provisioner",
+			provides: [ToolBridgeProvisionerCapability],
+			setup: (ctx) => {
+				ctx.provide(ToolBridgeProvisionerCapability, provisioner);
+			}
+		});
+	}
+	/**
+	* Stand up the per-run bridge: register the tool core + a fresh bearer token
+	* on this DO, and hand back a URL the SANDBOX can reach — the Worker's public
+	* hostname routed to `/_bridge/:runId`. The `threadId` query lets the Worker
+	* route the agent's MCP calls back to THIS coordinator. No raw socket is opened.
+	*/
+	makeBridgeProvisioner(input) {
+		const env = this.env;
+		const bridges = this.bridges;
+		const { runId, threadId } = input;
+		const origin = resolveBridgeOrigin(env, input);
+		return { provision(tools, options) {
+			const token = crypto.randomUUID() + crypto.randomUUID().replace(/-/g, "");
+			const core = createToolBridgeCore(tools, {
+				...options.context !== void 0 ? { context: options.context } : {},
+				...options.signal !== void 0 ? { signal: options.signal } : {},
+				...options.permission !== void 0 ? { permission: options.permission } : {}
+			});
+			bridges.set(runId, {
+				token,
+				core
+			});
+			return Promise.resolve({
+				name: "tanstack",
+				url: `${origin}/_bridge/${runId}?threadId=${encodeURIComponent(threadId)}`,
+				token,
+				close: () => {
+					bridges.delete(runId);
+					return Promise.resolve();
+				}
+			});
+		} };
+	}
+	/** Serve `/_bridge/:runId` (the in-sandbox agent's MCP calls) from the base fetch. */
+	handleRoute(request, parts) {
+		if (parts[0] === "_bridge" && typeof parts[1] === "string") return this.serveBridge(parts[1], request);
+		return super.handleRoute(request, parts);
+	}
+	/** Serve one MCP JSON-RPC request for a run after a constant-time token check. */
+	async serveBridge(runId, request) {
+		const bridge = this.bridges.get(runId);
+		if (!bridge) return new Response("no active bridge for run", { status: 404 });
+		if (!timingSafeBearerEqualWeb(request.headers.get("authorization") ?? void 0, bridge.token)) return new Response("unauthorized", { status: 401 });
+		let message;
+		try {
+			message = await request.json();
+		} catch {
+			return this.jsonResponse({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32700,
+					message: "Parse error"
+				}
+			});
+		}
+		const reply = await handleBridgeJsonRpc(bridge.core, message);
+		if (reply === null) return new Response(null, { status: 202 });
+		return this.jsonResponse(reply);
+	}
 };
-//# sourceMappingURL=chat-coordinator.js.map
+//#endregion
+export { ChatSandboxCoordinator };
+
+//# sourceMappingURL=chat-coordinator.js.map

package/dist/esm/chat-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat-coordinator.js","sources":["../../src/chat-coordinator.ts"],"sourcesContent":["/**\n * `ChatSandboxCoordinator` — the concrete {@link SandboxCoordinator} for the\n * DO-DRIVES model: the Durable Object runs `chat()` ITSELF and hosts the MCP\n * tool-bridge from its own `fetch` handler.\n *\n *     Worker (stateless trigger)\n *        → ChatSandboxCoordinator (this DO: runs chat(), owns the sandbox + log)\n *           → Cloudflare Sandbox (the container the agent executes in)\n *\n * It implements the one per-model seam, {@link buildRunStream}, by running\n * `chat()` in the DO with two middlewares: our DO-backed tool-bridge provisioner\n * (so the bridge is served from this DO instead of a `node:http` listener) and\n * `withSandbox(...)` (the handle the harness adapter needs). The per-run config —\n * which adapter, which sandbox, which chat()-tools — is the subclass's\n * {@link config} method; everything else (run-log, streaming tail, watchdog) is\n * inherited from the base.\n *\n * The MCP tool-bridge lives at `/_bridge/:runId`, gated by a per-run bearer\n * token, served from {@link handleRoute}. The in-sandbox agent reaches it via\n * the Worker's public hostname.\n *\n * NOTE: Workers-runtime code — compiles against the real Cloudflare + TanStack\n * AI types; not runtime-verified in this repo (no Workers runtime here).\n */\nimport { chat, defineChatMiddleware } from '@tanstack/ai'\nimport {\n  ToolBridgeProvisionerCapability,\n  createToolBridgeCore,\n  handleBridgeJsonRpc,\n  withSandbox,\n} from '@tanstack/ai-sandbox'\nimport { SandboxCoordinator, resolveBridgeOrigin } from './coordinator'\nimport { timingSafeBearerEqualWeb } from './web-crypto'\nimport type { StartRunInput } from './coordinator'\nimport type {\n  AnyTextAdapter,\n  AnyTool,\n  StreamChunk,\n  SystemPrompt,\n} from '@tanstack/ai'\nimport type {\n  ProvisionedBridge,\n  SandboxDefinition,\n  ToolBridgeCore,\n  ToolBridgeProvisioner,\n} from '@tanstack/ai-sandbox'\n\n/**\n * The Env bindings a {@link ChatSandboxCoordinator} requires. The bridge origin the\n * SANDBOX calls back on needs a hostname; `PUBLIC_HOSTNAME` is OPTIONAL — when\n * unset, the coordinator derives it from the trigger request (locally →\n * `host.docker.internal`; safe on Cloudflare). See {@link resolveBridgeOrigin}.\n */\nexport interface ChatCoordinatorEnv {\n  /**\n   * Hostname the CONTAINER uses to reach the Worker's tool-bridge (`/_bridge`).\n   * Optional: unset → derived from each trigger request (deployed: the request\n   * host; local dev: `host.docker.internal`). Set it only to override — e.g. a\n   * stable named-tunnel host. See {@link resolveBridgeOrigin}. (Browser-facing\n   * preview URLs use a separate `PREVIEW_HOSTNAME`; see {@link resolvePreviewHost}.)\n   */\n  PUBLIC_HOSTNAME?: string\n}\n\n/** What {@link ChatSandboxCoordinator.config} returns for one run. */\nexport interface ChatRunConfig {\n  /** The harness/text adapter `chat()` runs (e.g. `claudeCodeText('sonnet')`). */\n  adapter: AnyTextAdapter\n  /** The sandbox the agent executes in, projected by `withSandbox`. */\n  sandbox: SandboxDefinition\n  /** chat()-provided server tools bridged into the harness over MCP. */\n  tools?: Array<AnyTool>\n  /** Base system prompts prepended to the run's `chat()` (e.g. `[PREVIEW_GUIDANCE]`). */\n  systemPrompts?: Array<SystemPrompt>\n}\n\n/** Per-run bridge state so `/_bridge/:runId` can authenticate + serve. */\ninterface BridgeState {\n  token: string\n  core: ToolBridgeCore\n}\n\nexport abstract class ChatSandboxCoordinator<\n  TEnv extends ChatCoordinatorEnv = ChatCoordinatorEnv,\n> extends SandboxCoordinator<TEnv> {\n  /**\n   * Live per-run bridges, keyed by runId. In-memory by design: a bridge is only\n   * reachable while its run is in flight, and `ctx.waitUntil(done)` keeps THIS\n   * instance alive (un-hibernated) for the run's whole lifetime — so the agent's\n   * MCP calls always hit the instance that provisioned the bridge. A request for\n   * a run with no live bridge (finished, or never started here) is a hard 404,\n   * not a silent re-provision.\n   */\n  private readonly bridges = new Map<string, BridgeState>()\n\n  // ===========================================================================\n  // Subclass seam: the per-run configuration\n  // ===========================================================================\n\n  /**\n   * Resolve the adapter, sandbox, and chat()-tools for one run. Implemented by\n   * the app subclass (or supplied by {@link createCloudflareSandboxAgent}); this\n   * is the only model-specific input the DO-drives coordinator needs.\n   */\n  protected abstract config(input: StartRunInput): ChatRunConfig\n\n  // ===========================================================================\n  // The one per-model seam: run chat() in the DO\n  // ===========================================================================\n\n  /**\n   * Run `chat()` IN the DO, streaming its `StreamChunk`s. `stream: true` (with no\n   * outputSchema) makes chat() return an `AsyncIterable<StreamChunk>` directly —\n   * no cast needed for the run driver. Both middlewares run `setup` before\n   * streaming begins: our middleware provides the DO-backed bridge provisioner,\n   * and `withSandbox` provides the sandbox handle the harness adapter needs.\n   */\n  protected override buildRunStream(\n    input: StartRunInput,\n  ): AsyncIterable<StreamChunk> {\n    const { adapter, sandbox, tools, systemPrompts } = this.config(input)\n    const sessionId = input.metadata?.sessionId\n    const modelOptions =\n      typeof sessionId === 'string' && sessionId !== ''\n        ? { sessionId }\n        : undefined\n    return chat({\n      threadId: input.threadId,\n      adapter,\n      messages: input.messages,\n      stream: true,\n      ...(tools !== undefined ? { tools } : {}),\n      ...(systemPrompts !== undefined ? { systemPrompts } : {}),\n      ...(modelOptions !== undefined ? { modelOptions } : {}),\n      middleware: [\n        this.bridgeProvisionerMiddleware(input),\n        withSandbox(sandbox),\n      ],\n    })\n  }\n\n  /** Drop the per-run bridge once the run is terminal (override from base). */\n  protected override onRunSettled(runId: string): void {\n    this.bridges.delete(runId)\n  }\n\n  // ===========================================================================\n  // The DO-backed tool-bridge provisioner + endpoint\n  // ===========================================================================\n\n  /**\n   * A tiny middleware that PROVIDES our DO-backed {@link ToolBridgeProvisioner}.\n   * The harness adapter reads it via `getOptional` and falls back to the\n   * `node:http` host transport when absent — here we override that so the bridge\n   * is served from this DO's `fetch` handler instead of a TCP listener.\n   */\n  private bridgeProvisionerMiddleware(input: StartRunInput) {\n    const provisioner = this.makeBridgeProvisioner(input)\n    return defineChatMiddleware({\n      name: 'do-tool-bridge-provisioner',\n      provides: [ToolBridgeProvisionerCapability],\n      setup: (ctx) => {\n        ctx.provide(ToolBridgeProvisionerCapability, provisioner)\n      },\n    })\n  }\n\n  /**\n   * Stand up the per-run bridge: register the tool core + a fresh bearer token\n   * on this DO, and hand back a URL the SANDBOX can reach — the Worker's public\n   * hostname routed to `/_bridge/:runId`. The `threadId` query lets the Worker\n   * route the agent's MCP calls back to THIS coordinator. No raw socket is opened.\n   */\n  private makeBridgeProvisioner(input: StartRunInput): ToolBridgeProvisioner {\n    const env = this.env\n    const bridges = this.bridges\n    const { runId, threadId } = input\n    // Container→Worker origin: `PUBLIC_HOSTNAME` if set, else derived from the\n    // trigger request (locally → host.docker.internal). The bearer token rides\n    // this URL. See `resolveBridgeOrigin`.\n    const origin = resolveBridgeOrigin(env, input)\n    return {\n      provision(tools, options): Promise<ProvisionedBridge> {\n        const token =\n          crypto.randomUUID() + crypto.randomUUID().replace(/-/g, '')\n        const core = createToolBridgeCore(tools, {\n          ...(options.context !== undefined\n            ? { context: options.context }\n            : {}),\n          ...(options.signal !== undefined ? { signal: options.signal } : {}),\n          ...(options.permission !== undefined\n            ? { permission: options.permission }\n            : {}),\n        })\n        bridges.set(runId, { token, core })\n        return Promise.resolve({\n          name: 'tanstack',\n          url: `${origin}/_bridge/${runId}?threadId=${encodeURIComponent(threadId)}`,\n          token,\n          close: () => {\n            bridges.delete(runId)\n            return Promise.resolve()\n          },\n        })\n      },\n    }\n  }\n\n  /** Serve `/_bridge/:runId` (the in-sandbox agent's MCP calls) from the base fetch. */\n  protected override handleRoute(\n    request: Request,\n    parts: Array<string>,\n  ): Promise<Response> | Response {\n    if (parts[0] === '_bridge' && typeof parts[1] === 'string') {\n      return this.serveBridge(parts[1], request)\n    }\n    return super.handleRoute(request, parts)\n  }\n\n  /** Serve one MCP JSON-RPC request for a run after a constant-time token check. */\n  private async serveBridge(\n    runId: string,\n    request: Request,\n  ): Promise<Response> {\n    const bridge = this.bridges.get(runId)\n    if (!bridge)\n      return new Response('no active bridge for run', { status: 404 })\n    if (\n      !timingSafeBearerEqualWeb(\n        request.headers.get('authorization') ?? undefined,\n        bridge.token,\n      )\n    ) {\n      return new Response('unauthorized', { status: 401 })\n    }\n    let message: unknown\n    try {\n      message = await request.json()\n    } catch {\n      // A malformed body must still produce a valid JSON-RPC error so the agent's\n      // MCP client can react, rather than an opaque DO 500 that can wedge the run.\n      return this.jsonResponse({\n        jsonrpc: '2.0',\n        id: null,\n        error: { code: -32700, message: 'Parse error' },\n      })\n    }\n    const reply = await handleBridgeJsonRpc(bridge.core, message)\n    // A notification (no id) yields null → MCP expects an empty 202 ack.\n    if (reply === null) return new Response(null, { status: 202 })\n    return this.jsonResponse(reply)\n  }\n}\n"],"names":[],"mappings":";;;;;AAkFO,MAAe,+BAEZ,mBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAShB,8BAAc,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBZ,eACjB,OAC4B;AAC5B,UAAM,EAAE,SAAS,SAAS,OAAO,kBAAkB,KAAK,OAAO,KAAK;AACpE,UAAM,YAAY,MAAM,UAAU;AAClC,UAAM,eACJ,OAAO,cAAc,YAAY,cAAc,KAC3C,EAAE,cACF;AACN,WAAO,KAAK;AAAA,MACV,UAAU,MAAM;AAAA,MAChB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,QAAQ;AAAA,MACR,GAAI,UAAU,SAAY,EAAE,MAAA,IAAU,CAAA;AAAA,MACtC,GAAI,kBAAkB,SAAY,EAAE,cAAA,IAAkB,CAAA;AAAA,MACtD,GAAI,iBAAiB,SAAY,EAAE,aAAA,IAAiB,CAAA;AAAA,MACpD,YAAY;AAAA,QACV,KAAK,4BAA4B,KAAK;AAAA,QACtC,YAAY,OAAO;AAAA,MAAA;AAAA,IACrB,CACD;AAAA,EACH;AAAA;AAAA,EAGmB,aAAa,OAAqB;AACnD,SAAK,QAAQ,OAAO,KAAK;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,4BAA4B,OAAsB;AACxD,UAAM,cAAc,KAAK,sBAAsB,KAAK;AACpD,WAAO,qBAAqB;AAAA,MAC1B,MAAM;AAAA,MACN,UAAU,CAAC,+BAA+B;AAAA,MAC1C,OAAO,CAAC,QAAQ;AACd,YAAI,QAAQ,iCAAiC,WAAW;AAAA,MAC1D;AAAA,IAAA,CACD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,sBAAsB,OAA6C;AACzE,UAAM,MAAM,KAAK;AACjB,UAAM,UAAU,KAAK;AACrB,UAAM,EAAE,OAAO,SAAA,IAAa;AAI5B,UAAM,SAAS,oBAAoB,KAAK,KAAK;AAC7C,WAAO;AAAA,MACL,UAAU,OAAO,SAAqC;AACpD,cAAM,QACJ,OAAO,eAAe,OAAO,aAAa,QAAQ,MAAM,EAAE;AAC5D,cAAM,OAAO,qBAAqB,OAAO;AAAA,UACvC,GAAI,QAAQ,YAAY,SACpB,EAAE,SAAS,QAAQ,QAAA,IACnB,CAAA;AAAA,UACJ,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAA,IAAW,CAAA;AAAA,UAChE,GAAI,QAAQ,eAAe,SACvB,EAAE,YAAY,QAAQ,eACtB,CAAA;AAAA,QAAC,CACN;AACD,gBAAQ,IAAI,OAAO,EAAE,OAAO,MAAM;AAClC,eAAO,QAAQ,QAAQ;AAAA,UACrB,MAAM;AAAA,UACN,KAAK,GAAG,MAAM,YAAY,KAAK,aAAa,mBAAmB,QAAQ,CAAC;AAAA,UACxE;AAAA,UACA,OAAO,MAAM;AACX,oBAAQ,OAAO,KAAK;AACpB,mBAAO,QAAQ,QAAA;AAAA,UACjB;AAAA,QAAA,CACD;AAAA,MACH;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA,EAGmB,YACjB,SACA,OAC8B;AAC9B,QAAI,MAAM,CAAC,MAAM,aAAa,OAAO,MAAM,CAAC,MAAM,UAAU;AAC1D,aAAO,KAAK,YAAY,MAAM,CAAC,GAAG,OAAO;AAAA,IAC3C;AACA,WAAO,MAAM,YAAY,SAAS,KAAK;AAAA,EACzC;AAAA;AAAA,EAGA,MAAc,YACZ,OACA,SACmB;AACnB,UAAM,SAAS,KAAK,QAAQ,IAAI,KAAK;AACrC,QAAI,CAAC;AACH,aAAO,IAAI,SAAS,4BAA4B,EAAE,QAAQ,KAAK;AACjE,QACE,CAAC;AAAA,MACC,QAAQ,QAAQ,IAAI,eAAe,KAAK;AAAA,MACxC,OAAO;AAAA,IAAA,GAET;AACA,aAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,KAAK;AAAA,IACrD;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAA;AAAA,IAC1B,QAAQ;AAGN,aAAO,KAAK,aAAa;AAAA,QACvB,SAAS;AAAA,QACT,IAAI;AAAA,QACJ,OAAO,EAAE,MAAM,QAAQ,SAAS,cAAA;AAAA,MAAc,CAC/C;AAAA,IACH;AACA,UAAM,QAAQ,MAAM,oBAAoB,OAAO,MAAM,OAAO;AAE5D,QAAI,UAAU,KAAM,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK;AAC7D,WAAO,KAAK,aAAa,KAAK;AAAA,EAChC;AACF;"}
+{"version":3,"file":"chat-coordinator.js","names":[],"sources":["../../src/chat-coordinator.ts"],"sourcesContent":["/**\n * `ChatSandboxCoordinator` — the concrete {@link SandboxCoordinator} for the\n * DO-DRIVES model: the Durable Object runs `chat()` ITSELF and hosts the MCP\n * tool-bridge from its own `fetch` handler.\n *\n *     Worker (stateless trigger)\n *        → ChatSandboxCoordinator (this DO: runs chat(), owns the sandbox + log)\n *           → Cloudflare Sandbox (the container the agent executes in)\n *\n * It implements the one per-model seam, {@link buildRunStream}, by running\n * `chat()` in the DO with two middlewares: our DO-backed tool-bridge provisioner\n * (so the bridge is served from this DO instead of a `node:http` listener) and\n * `withSandbox(...)` (the handle the harness adapter needs). The per-run config —\n * which adapter, which sandbox, which chat()-tools — is the subclass's\n * {@link config} method; everything else (run-log, streaming tail, watchdog) is\n * inherited from the base.\n *\n * The MCP tool-bridge lives at `/_bridge/:runId`, gated by a per-run bearer\n * token, served from {@link handleRoute}. The in-sandbox agent reaches it via\n * the Worker's public hostname.\n *\n * NOTE: Workers-runtime code — compiles against the real Cloudflare + TanStack\n * AI types; not runtime-verified in this repo (no Workers runtime here).\n */\nimport { chat, defineChatMiddleware } from '@tanstack/ai'\nimport {\n  ToolBridgeProvisionerCapability,\n  createToolBridgeCore,\n  handleBridgeJsonRpc,\n  withSandbox,\n} from '@tanstack/ai-sandbox'\nimport { SandboxCoordinator, resolveBridgeOrigin } from './coordinator'\nimport { timingSafeBearerEqualWeb } from './web-crypto'\nimport type { StartRunInput } from './coordinator'\nimport type {\n  AnyTextAdapter,\n  AnyTool,\n  StreamChunk,\n  SystemPrompt,\n} from '@tanstack/ai'\nimport type {\n  ProvisionedBridge,\n  SandboxDefinition,\n  ToolBridgeCore,\n  ToolBridgeProvisioner,\n} from '@tanstack/ai-sandbox'\n\n/**\n * The Env bindings a {@link ChatSandboxCoordinator} requires. The bridge origin the\n * SANDBOX calls back on needs a hostname; `PUBLIC_HOSTNAME` is OPTIONAL — when\n * unset, the coordinator derives it from the trigger request (locally →\n * `host.docker.internal`; safe on Cloudflare). See {@link resolveBridgeOrigin}.\n */\nexport interface ChatCoordinatorEnv {\n  /**\n   * Hostname the CONTAINER uses to reach the Worker's tool-bridge (`/_bridge`).\n   * Optional: unset → derived from each trigger request (deployed: the request\n   * host; local dev: `host.docker.internal`). Set it only to override — e.g. a\n   * stable named-tunnel host. See {@link resolveBridgeOrigin}. (Browser-facing\n   * preview URLs use a separate `PREVIEW_HOSTNAME`; see {@link resolvePreviewHost}.)\n   */\n  PUBLIC_HOSTNAME?: string\n}\n\n/** What {@link ChatSandboxCoordinator.config} returns for one run. */\nexport interface ChatRunConfig {\n  /** The harness/text adapter `chat()` runs (e.g. `claudeCodeText('sonnet')`). */\n  adapter: AnyTextAdapter\n  /** The sandbox the agent executes in, projected by `withSandbox`. */\n  sandbox: SandboxDefinition\n  /** chat()-provided server tools bridged into the harness over MCP. */\n  tools?: Array<AnyTool>\n  /** Base system prompts prepended to the run's `chat()` (e.g. `[PREVIEW_GUIDANCE]`). */\n  systemPrompts?: Array<SystemPrompt>\n}\n\n/** Per-run bridge state so `/_bridge/:runId` can authenticate + serve. */\ninterface BridgeState {\n  token: string\n  core: ToolBridgeCore\n}\n\nexport abstract class ChatSandboxCoordinator<\n  TEnv extends ChatCoordinatorEnv = ChatCoordinatorEnv,\n> extends SandboxCoordinator<TEnv> {\n  /**\n   * Live per-run bridges, keyed by runId. In-memory by design: a bridge is only\n   * reachable while its run is in flight, and `ctx.waitUntil(done)` keeps THIS\n   * instance alive (un-hibernated) for the run's whole lifetime — so the agent's\n   * MCP calls always hit the instance that provisioned the bridge. A request for\n   * a run with no live bridge (finished, or never started here) is a hard 404,\n   * not a silent re-provision.\n   */\n  private readonly bridges = new Map<string, BridgeState>()\n\n  // ===========================================================================\n  // Subclass seam: the per-run configuration\n  // ===========================================================================\n\n  /**\n   * Resolve the adapter, sandbox, and chat()-tools for one run. Implemented by\n   * the app subclass (or supplied by {@link createCloudflareSandboxAgent}); this\n   * is the only model-specific input the DO-drives coordinator needs.\n   */\n  protected abstract config(input: StartRunInput): ChatRunConfig\n\n  // ===========================================================================\n  // The one per-model seam: run chat() in the DO\n  // ===========================================================================\n\n  /**\n   * Run `chat()` IN the DO, streaming its `StreamChunk`s. `stream: true` (with no\n   * outputSchema) makes chat() return an `AsyncIterable<StreamChunk>` directly —\n   * no cast needed for the run driver. Both middlewares run `setup` before\n   * streaming begins: our middleware provides the DO-backed bridge provisioner,\n   * and `withSandbox` provides the sandbox handle the harness adapter needs.\n   */\n  protected override buildRunStream(\n    input: StartRunInput,\n  ): AsyncIterable<StreamChunk> {\n    const { adapter, sandbox, tools, systemPrompts } = this.config(input)\n    const sessionId = input.metadata?.sessionId\n    const modelOptions =\n      typeof sessionId === 'string' && sessionId !== ''\n        ? { sessionId }\n        : undefined\n    return chat({\n      threadId: input.threadId,\n      adapter,\n      messages: input.messages,\n      stream: true,\n      ...(tools !== undefined ? { tools } : {}),\n      ...(systemPrompts !== undefined ? { systemPrompts } : {}),\n      ...(modelOptions !== undefined ? { modelOptions } : {}),\n      middleware: [\n        this.bridgeProvisionerMiddleware(input),\n        withSandbox(sandbox),\n      ],\n    })\n  }\n\n  /** Drop the per-run bridge once the run is terminal (override from base). */\n  protected override onRunSettled(runId: string): void {\n    this.bridges.delete(runId)\n  }\n\n  // ===========================================================================\n  // The DO-backed tool-bridge provisioner + endpoint\n  // ===========================================================================\n\n  /**\n   * A tiny middleware that PROVIDES our DO-backed {@link ToolBridgeProvisioner}.\n   * The harness adapter reads it via `getOptional` and falls back to the\n   * `node:http` host transport when absent — here we override that so the bridge\n   * is served from this DO's `fetch` handler instead of a TCP listener.\n   */\n  private bridgeProvisionerMiddleware(input: StartRunInput) {\n    const provisioner = this.makeBridgeProvisioner(input)\n    return defineChatMiddleware({\n      name: 'do-tool-bridge-provisioner',\n      provides: [ToolBridgeProvisionerCapability],\n      setup: (ctx) => {\n        ctx.provide(ToolBridgeProvisionerCapability, provisioner)\n      },\n    })\n  }\n\n  /**\n   * Stand up the per-run bridge: register the tool core + a fresh bearer token\n   * on this DO, and hand back a URL the SANDBOX can reach — the Worker's public\n   * hostname routed to `/_bridge/:runId`. The `threadId` query lets the Worker\n   * route the agent's MCP calls back to THIS coordinator. No raw socket is opened.\n   */\n  private makeBridgeProvisioner(input: StartRunInput): ToolBridgeProvisioner {\n    const env = this.env\n    const bridges = this.bridges\n    const { runId, threadId } = input\n    // Container→Worker origin: `PUBLIC_HOSTNAME` if set, else derived from the\n    // trigger request (locally → host.docker.internal). The bearer token rides\n    // this URL. See `resolveBridgeOrigin`.\n    const origin = resolveBridgeOrigin(env, input)\n    return {\n      provision(tools, options): Promise<ProvisionedBridge> {\n        const token =\n          crypto.randomUUID() + crypto.randomUUID().replace(/-/g, '')\n        const core = createToolBridgeCore(tools, {\n          ...(options.context !== undefined\n            ? { context: options.context }\n            : {}),\n          ...(options.signal !== undefined ? { signal: options.signal } : {}),\n          ...(options.permission !== undefined\n            ? { permission: options.permission }\n            : {}),\n        })\n        bridges.set(runId, { token, core })\n        return Promise.resolve({\n          name: 'tanstack',\n          url: `${origin}/_bridge/${runId}?threadId=${encodeURIComponent(threadId)}`,\n          token,\n          close: () => {\n            bridges.delete(runId)\n            return Promise.resolve()\n          },\n        })\n      },\n    }\n  }\n\n  /** Serve `/_bridge/:runId` (the in-sandbox agent's MCP calls) from the base fetch. */\n  protected override handleRoute(\n    request: Request,\n    parts: Array<string>,\n  ): Promise<Response> | Response {\n    if (parts[0] === '_bridge' && typeof parts[1] === 'string') {\n      return this.serveBridge(parts[1], request)\n    }\n    return super.handleRoute(request, parts)\n  }\n\n  /** Serve one MCP JSON-RPC request for a run after a constant-time token check. */\n  private async serveBridge(\n    runId: string,\n    request: Request,\n  ): Promise<Response> {\n    const bridge = this.bridges.get(runId)\n    if (!bridge)\n      return new Response('no active bridge for run', { status: 404 })\n    if (\n      !timingSafeBearerEqualWeb(\n        request.headers.get('authorization') ?? undefined,\n        bridge.token,\n      )\n    ) {\n      return new Response('unauthorized', { status: 401 })\n    }\n    let message: unknown\n    try {\n      message = await request.json()\n    } catch {\n      // A malformed body must still produce a valid JSON-RPC error so the agent's\n      // MCP client can react, rather than an opaque DO 500 that can wedge the run.\n      return this.jsonResponse({\n        jsonrpc: '2.0',\n        id: null,\n        error: { code: -32700, message: 'Parse error' },\n      })\n    }\n    const reply = await handleBridgeJsonRpc(bridge.core, message)\n    // A notification (no id) yields null → MCP expects an empty 202 ack.\n    if (reply === null) return new Response(null, { status: 202 })\n    return this.jsonResponse(reply)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAsB,yBAAtB,cAEU,mBAAyB;;;;;;;;;CASjC,0BAA2B,IAAI,IAAyB;;;;;;;;CAwBxD,eACE,OAC4B;EAC5B,MAAM,EAAE,SAAS,SAAS,OAAO,kBAAkB,KAAK,OAAO,KAAK;EACpE,MAAM,YAAY,MAAM,UAAU;EAClC,MAAM,eACJ,OAAO,cAAc,YAAY,cAAc,KAC3C,EAAE,UAAU,IACZ,KAAA;EACN,OAAO,KAAK;GACV,UAAU,MAAM;GAChB;GACA,UAAU,MAAM;GAChB,QAAQ;GACR,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;GACvC,GAAI,kBAAkB,KAAA,IAAY,EAAE,cAAc,IAAI,CAAC;GACvD,GAAI,iBAAiB,KAAA,IAAY,EAAE,aAAa,IAAI,CAAC;GACrD,YAAY,CACV,KAAK,4BAA4B,KAAK,GACtC,YAAY,OAAO,CACrB;EACF,CAAC;CACH;;CAGA,aAAgC,OAAqB;EACnD,KAAK,QAAQ,OAAO,KAAK;CAC3B;;;;;;;CAYA,4BAAoC,OAAsB;EACxD,MAAM,cAAc,KAAK,sBAAsB,KAAK;EACpD,OAAO,qBAAqB;GAC1B,MAAM;GACN,UAAU,CAAC,+BAA+B;GAC1C,QAAQ,QAAQ;IACd,IAAI,QAAQ,iCAAiC,WAAW;GAC1D;EACF,CAAC;CACH;;;;;;;CAQA,sBAA8B,OAA6C;EACzE,MAAM,MAAM,KAAK;EACjB,MAAM,UAAU,KAAK;EACrB,MAAM,EAAE,OAAO,aAAa;EAI5B,MAAM,SAAS,oBAAoB,KAAK,KAAK;EAC7C,OAAO,EACL,UAAU,OAAO,SAAqC;GACpD,MAAM,QACJ,OAAO,WAAW,IAAI,OAAO,WAAW,CAAC,CAAC,QAAQ,MAAM,EAAE;GAC5D,MAAM,OAAO,qBAAqB,OAAO;IACvC,GAAI,QAAQ,YAAY,KAAA,IACpB,EAAE,SAAS,QAAQ,QAAQ,IAC3B,CAAC;IACL,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;IACjE,GAAI,QAAQ,eAAe,KAAA,IACvB,EAAE,YAAY,QAAQ,WAAW,IACjC,CAAC;GACP,CAAC;GACD,QAAQ,IAAI,OAAO;IAAE;IAAO;GAAK,CAAC;GAClC,OAAO,QAAQ,QAAQ;IACrB,MAAM;IACN,KAAK,GAAG,OAAO,WAAW,MAAM,YAAY,mBAAmB,QAAQ;IACvE;IACA,aAAa;KACX,QAAQ,OAAO,KAAK;KACpB,OAAO,QAAQ,QAAQ;IACzB;GACF,CAAC;EACH,EACF;CACF;;CAGA,YACE,SACA,OAC8B;EAC9B,IAAI,MAAM,OAAO,aAAa,OAAO,MAAM,OAAO,UAChD,OAAO,KAAK,YAAY,MAAM,IAAI,OAAO;EAE3C,OAAO,MAAM,YAAY,SAAS,KAAK;CACzC;;CAGA,MAAc,YACZ,OACA,SACmB;EACnB,MAAM,SAAS,KAAK,QAAQ,IAAI,KAAK;EACrC,IAAI,CAAC,QACH,OAAO,IAAI,SAAS,4BAA4B,EAAE,QAAQ,IAAI,CAAC;EACjE,IACE,CAAC,yBACC,QAAQ,QAAQ,IAAI,eAAe,KAAK,KAAA,GACxC,OAAO,KACT,GAEA,OAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;EAErD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,KAAK;EAC/B,QAAQ;GAGN,OAAO,KAAK,aAAa;IACvB,SAAS;IACT,IAAI;IACJ,OAAO;KAAE,MAAM;KAAQ,SAAS;IAAc;GAChD,CAAC;EACH;EACA,MAAM,QAAQ,MAAM,oBAAoB,OAAO,MAAM,OAAO;EAE5D,IAAI,UAAU,MAAM,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAC7D,OAAO,KAAK,aAAa,KAAK;CAChC;AACF"}