@tianshu-ai/tianshu 0.3.0

package/plugins/microsandbox/dist/build/builder.js

@@ -0,0 +1,257 @@
+// Snapshot builder.
+//
+// Takes a SandboxSpec, runs an apt/pip/npm/exec sequence inside a
+// short-lived "builder" sandbox, captures a snapshot, and tears the
+// builder down. The pattern mirrors the closed-source repo's
+// buildWarmSnapshot() but parametrised by the spec instead of
+// hard-coded.
+//
+// On the host we keep:
+// - a Snapshot in microsandbox's DB (~/.microsandbox/snapshots/<name>)
+// - a metadata json in the user's home dir for the agent to list
+//
+// We do NOT export tar.zst by default; that's an opt-in for backups
+// and out of scope for v0.
+import { promises as fs } from "node:fs";
+let msbModuleP = null;
+function loadMsb() {
+    if (!msbModuleP)
+        msbModuleP = import("microsandbox");
+    return msbModuleP;
+}
+export class BuildFailedError extends Error {
+    stderr;
+    code = "BUILD_FAILED";
+    constructor(message, 
+    /** Raw stdout/stderr from the failing step. */
+    stderr) {
+        super(message);
+        this.stderr = stderr;
+        this.name = "BuildFailedError";
+    }
+}
+const LOG_LINE_CAP = 200;
+const LOG_BYTE_CAP = 8_000;
+export async function buildSnapshot(opts) {
+    const start = Date.now();
+    const { Sandbox, Snapshot } = await loadMsb();
+    const builderName = `${opts.sandboxName}-build-${opts.buildId}`;
+    const snapshotName = `${opts.sandboxName}-${opts.buildId}`;
+    const cpus = opts.spec.cpus ?? opts.defaultCpus ?? 4;
+    const memoryMib = opts.spec.memoryMib ?? opts.defaultMemoryMib ?? 4096;
+    const log = opts.onLog ?? (() => { });
+    const captured = [];
+    const cap = (line) => {
+        captured.push(line);
+        log(line);
+    };
+    if (opts.fromSnapshot) {
+        cap(`[builder] starting: from_snapshot=${opts.fromSnapshot} cpus=${cpus} memMib=${memoryMib}`);
+    }
+    else {
+        cap(`[builder] starting: image=${opts.spec.image} cpus=${cpus} memMib=${memoryMib}`);
+    }
+    await fs.mkdir(opts.workspaceDir, { recursive: true });
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let builder = Sandbox
+        .builder(builderName)
+        .cpus(cpus)
+        .memory(memoryMib)
+        .volume("/workspace", (m) => m.bind(opts.workspaceDir))
+        .replace(true);
+    if (opts.fromSnapshot) {
+        // Layer this build on top of an existing snapshot. The Sandboxfile's
+        // `image:` field is ignored — the snapshot already pins it.
+        builder = builder.fromSnapshot(opts.fromSnapshot);
+    }
+    else {
+        builder = builder.image(opts.spec.image);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const base = await builder.create();
+    try {
+        if (opts.spec.apt && opts.spec.apt.length > 0) {
+            cap(`[builder] apt-get install ${opts.spec.apt.length} pkg(s)`);
+            await runStepWithHeartbeat("apt-get", cap, () => runStep(base, "sh", [
+                "-c",
+                [
+                    "apt-get update -qq",
+                    `DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends ${opts.spec.apt.join(" ")}`,
+                ].join(" && "),
+            ], cap));
+        }
+        if (opts.spec.pip && opts.spec.pip.length > 0) {
+            cap(`[builder] pip install ${opts.spec.pip.length} pkg(s)`);
+            await runStepWithHeartbeat("pip install", cap, () => runStep(base, "pip", ["install", "--quiet", ...opts.spec.pip], cap));
+        }
+        if (opts.spec.npm && opts.spec.npm.length > 0) {
+            cap(`[builder] npm install -g ${opts.spec.npm.length} pkg(s)`);
+            await runStepWithHeartbeat("npm install", cap, () => runStep(base, "sh", ["-c", `npm install -g ${opts.spec.npm.join(" ")} 2>&1 | tail -3`], cap));
+        }
+        if (opts.spec.exec && opts.spec.exec.length > 0) {
+            for (let i = 0; i < opts.spec.exec.length; i++) {
+                const cmd = opts.spec.exec[i];
+                cap(`[builder] exec[${i}] ${cmd.slice(0, 120)}`);
+                await runStepWithHeartbeat(`exec[${i}]`, cap, () => runStep(base, "sh", ["-c", cmd], cap));
+            }
+        }
+        // Critical sync before snapshot — async page-cache writes on the
+        // upper layer aren't on disk yet otherwise (mirrors closed-source).
+        cap(`[builder] sync`);
+        await runStep(base, "sync", [], cap);
+        cap(`[builder] stop (graceful)`);
+        // SDK exposes stop() / stopWithTimeout(ms); the legacy stopAndWait()
+        // was renamed. stop() blocks until the sandbox is fully stopped,
+        // which is what we need before snapshotting (source must be stopped).
+        if (typeof base.stopWithTimeout === "function") {
+            await base.stopWithTimeout(30_000);
+        }
+        else if (typeof base.stop === "function") {
+            await base.stop();
+        }
+        else if (typeof base.stopAndWait === "function") {
+            // back-compat with older SDKs
+            await base.stopAndWait();
+        }
+        else {
+            throw new Error("microsandbox SDK exposes neither stop() nor stopWithTimeout() — cannot snapshot");
+        }
+        cap(`[builder] snapshotting -> "${snapshotName}"`);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        await Snapshot
+            .builder(builderName)
+            .name(snapshotName)
+            .force()
+            .create();
+    }
+    finally {
+        // Cleanup is best-effort. On the success path the sandbox is
+        // already stopped (we did that just before snapshotting), but
+        // on a failed exec step it's still running, and the modern SDK
+        // refuses to `Sandbox.remove(name)` a running sandbox
+        // ("sandbox still running: cannot remove ..."). So always try
+        // to force the sandbox down first, then remove.
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const b = base;
+            if (typeof b.kill === "function") {
+                await b.kill();
+            }
+            else if (typeof b.killWithTimeout === "function") {
+                await b.killWithTimeout(5_000);
+            }
+            else if (typeof b.stopWithTimeout === "function") {
+                await b.stopWithTimeout(5_000);
+            }
+            else if (typeof b.stop === "function") {
+                await b.stop();
+            }
+        }
+        catch {
+            /* may have already exited */
+        }
+        // SDK rename: removePersisted() -> static Sandbox.remove(name).
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const SandboxAny = Sandbox;
+            if (typeof base.removePersisted === "function") {
+                await base.removePersisted();
+            }
+            else if (typeof SandboxAny.remove === "function") {
+                await SandboxAny.remove(builderName);
+            }
+        }
+        catch (err) {
+            cap(`[builder] cleanup remove failed (non-fatal): ${err.message}`);
+        }
+    }
+    const durationMs = Date.now() - start;
+    cap(`[builder] done in ${(durationMs / 1000).toFixed(1)}s`);
+    return {
+        snapshotName,
+        baseImage: opts.fromSnapshot ?? opts.spec.image,
+        durationMs,
+        logTail: tailJoin(captured),
+    };
+}
+/**
+ * Wrap a long-running step (apt-get / pip install / npm) with a
+ * heartbeat that pings `cap` every few seconds while we wait. The
+ * underlying SDK exec is synchronous (we only see stdout when the
+ * process exits), so without this the build would appear frozen for
+ * 30+ seconds while apt downloads packages.
+ */
+async function runStepWithHeartbeat(label, cap, step) {
+    const start = Date.now();
+    const HEARTBEAT_MS = 3000;
+    let ticks = 0;
+    const timer = setInterval(() => {
+        ticks++;
+        const elapsed = ((Date.now() - start) / 1000).toFixed(0);
+        cap(`[builder] … ${label} still running (${elapsed}s elapsed)`);
+    }, HEARTBEAT_MS);
+    try {
+        await step();
+    }
+    finally {
+        clearInterval(timer);
+        if (ticks > 0) {
+            const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+            cap(`[builder] ✓ ${label} finished in ${elapsed}s`);
+        }
+    }
+}
+async function runStep(base, cmd, args, cap) {
+    const r = await base.exec(cmd, args);
+    if (r.code !== 0) {
+        const stderr = r.stderr().slice(0, 1500);
+        cap(`[builder] step failed (code=${r.code}): ${stderr}`);
+        throw new BuildFailedError(`${cmd} ${args.join(" ").slice(0, 80)} → exit ${r.code}`, stderr);
+    }
+}
+function tailJoin(lines) {
+    const last = lines.slice(-LOG_LINE_CAP).join("\n");
+    if (Buffer.byteLength(last, "utf8") <= LOG_BYTE_CAP)
+        return last;
+    // Trim from the front (head of the tail) until under the byte cap
+    // so the most recent lines stay visible.
+    let s = last;
+    while (Buffer.byteLength(s, "utf8") > LOG_BYTE_CAP) {
+        const nl = s.indexOf("\n");
+        if (nl < 0)
+            return s.slice(s.length - LOG_BYTE_CAP);
+        s = s.slice(nl + 1);
+    }
+    return s;
+}
+/** Resolves to true iff `~/.microsandbox/snapshots/<name>` exists.
+ *  Used by the runner to decide between fromSnapshot vs image. */
+export async function snapshotExists(name) {
+    try {
+        const { Snapshot } = await loadMsb();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        await Snapshot.open(name);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Best-effort delete of a snapshot from microsandbox's DB. */
+export async function removeSnapshot(name) {
+    try {
+        const { Snapshot } = await loadMsb();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const s = await Snapshot.open(name);
+        if (typeof s.remove === "function") {
+            await s.remove();
+        }
+        else if (typeof s.removePersisted === "function") {
+            await s.removePersisted();
+        }
+    }
+    catch {
+        /* idempotent */
+    }
+}
+//# sourceMappingURL=builder.js.map

package/plugins/microsandbox/dist/build/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/build/builder.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AACpE,6DAA6D;AAC7D,8DAA8D;AAC9D,cAAc;AACd,EAAE;AACF,uBAAuB;AACvB,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,2BAA2B;AAE3B,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAMzC,IAAI,UAAU,GAA8B,IAAI,CAAC;AACjD,SAAS,OAAO;IACd,IAAI,CAAC,UAAU;QAAE,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC;AACpB,CAAC;AAyDD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAK9B;IAJF,IAAI,GAAG,cAAuB,CAAC;IACxC,YACE,OAAe;IACf,+CAA+C;IACtC,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAe;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IAE9C,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,WAAW,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;IAChE,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IAE3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE;QAC3B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,CAAC;IACZ,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,GAAG,CACD,qCAAqC,IAAI,CAAC,YAAY,SAAS,IAAI,WAAW,SAAS,EAAE,CAC1F,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CACD,6BAA6B,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,WAAW,SAAS,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvD,8DAA8D;IAC9D,IAAI,OAAO,GAAS,OAAe;SAChC,OAAO,CAAC,WAAW,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC;SACV,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAkC,EAAE,EAAE,CAC3D,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B;SACA,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,qEAAqE;QACrE,4DAA4D;QAC5D,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,8DAA8D;IAC9D,MAAM,IAAI,GAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;IAEzC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,6BAA6B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC;YAChE,MAAM,oBAAoB,CACxB,SAAS,EACT,GAAG,EACH,GAAG,EAAE,CACH,OAAO,CACL,IAAI,EACJ,IAAI,EACJ;gBACE,IAAI;gBACJ;oBACE,oBAAoB;oBACpB,iFAAiF,IAAI,CAAC,IAAI,CAAC,GAAI,CAAC,IAAI,CAClG,GAAG,CACJ,EAAE;iBACJ,CAAC,IAAI,CAAC,MAAM,CAAC;aACf,EACD,GAAG,CACJ,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC;YAC5D,MAAM,oBAAoB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,CAClD,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAI,CAAC,EAAE,GAAG,CAAC,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC;YAC/D,MAAM,oBAAoB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,CAClD,OAAO,CACL,IAAI,EACJ,IAAI,EACJ,CAAC,IAAI,EAAE,kBAAkB,IAAI,CAAC,IAAI,CAAC,GAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EACnE,GAAG,CACJ,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;gBAC/B,GAAG,CAAC,kBAAkB,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjD,MAAM,oBAAoB,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CACjD,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,oEAAoE;QACpE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACtB,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAErC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACjC,qEAAqE;QACrE,iEAAiE;QACjE,sEAAsE;QACtE,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAClD,8BAA8B;YAC9B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,8BAA8B,YAAY,GAAG,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAO,QAAgB;aACpB,OAAO,CAAC,WAAW,CAAC;aACpB,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,EAAE;aACP,MAAM,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,6DAA6D;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,sDAAsD;QACtD,8DAA8D;QAC9D,gDAAgD;QAChD,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,CAAC,GAAG,IAAW,CAAC;YACtB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACjB,CAAC;iBAAM,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;QACD,gEAAgE;QAChE,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,UAAU,GAAG,OAAc,CAAC;YAClC,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC;iBAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CACD,gDAAiD,GAAa,CAAC,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACtC,GAAG,CAAC,qBAAqB,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;QAC/C,UAAU;QACV,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;KAC5B,CAAC;AACJ,CAAC;AASD;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,GAA2B,EAC3B,IAAyB;IAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,eAAe,KAAK,mBAAmB,OAAO,YAAY,CAAC,CAAC;IAClE,CAAC,EAAE,YAAY,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,eAAe,KAAK,gBAAgB,OAAO,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAgB,EAChB,GAAW,EACX,IAAc,EACd,GAA2B;IAE3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,+BAA+B,CAAC,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EACxD,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAe;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IACjE,kEAAkE;IAClE,yCAAyC;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;QACpD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;kEACkE;AAClE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACrC,8DAA8D;QAC9D,MAAO,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACrC,8DAA8D;QAC9D,MAAM,CAAC,GAAG,MAAO,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACnD,MAAM,CAAC,CAAC,eAAe,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC"}

package/plugins/microsandbox/dist/build/metadata.d.ts

@@ -0,0 +1,27 @@
+export interface BuildMetadata {
+    buildId: string;
+    snapshotName: string;
+    baseImage: string;
+    /** ISO timestamp when build finished. */
+    builtAt: string;
+    /** Wall time the build took, in ms. */
+    durationMs: number;
+    /** Tail of the build log (200 lines / 8 KB). */
+    logTail: string;
+    /** Path (under user home) to the Sandboxfile that produced this. */
+    sandboxfilePath: string;
+    /**
+     * If this build layered on top of an existing snapshot rather
+     * than booting from a docker image, the source snapshot name.
+     * Lets the UI render a parent chain ("based on: build-X") so the
+     * operator can trace the lineage. Absent for image-rooted builds.
+     */
+    basedOnSnapshot?: string;
+}
+export declare const USER_BUILDS_REL = "sandbox/builds";
+export declare function userBuildsDir(userHomeDir: string): string;
+export declare function buildMetaPath(userHomeDir: string, buildId: string): string;
+export declare function writeBuildMetadata(userHomeDir: string, meta: BuildMetadata): Promise<void>;
+export declare function readBuildMetadata(userHomeDir: string, buildId: string): Promise<BuildMetadata | null>;
+export declare function listBuildMetadata(userHomeDir: string): Promise<BuildMetadata[]>;
+//# sourceMappingURL=metadata.d.ts.map

package/plugins/microsandbox/dist/build/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/build/metadata.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAEhD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,EAAE,CAAC,CAkB1B"}

package/plugins/microsandbox/dist/build/metadata.js

@@ -0,0 +1,55 @@
+// Per-user build metadata.
+//
+// Each successful build leaves a small JSON file in the user's home
+// at `<userHome>/sandbox/builds/<buildId>.json` so the agent can
+// list past builds without poking at microsandbox's internal DB.
+//
+// The snapshot itself stays in microsandbox's snapshot store
+// (`~/.microsandbox/snapshots/<name>`); we don't try to mirror the
+// big artifact into user space.
+import * as path from "node:path";
+import { promises as fs } from "node:fs";
+export const USER_BUILDS_REL = "sandbox/builds";
+export function userBuildsDir(userHomeDir) {
+    return path.join(userHomeDir, USER_BUILDS_REL);
+}
+export function buildMetaPath(userHomeDir, buildId) {
+    return path.join(userBuildsDir(userHomeDir), `${buildId}.json`);
+}
+export async function writeBuildMetadata(userHomeDir, meta) {
+    const p = buildMetaPath(userHomeDir, meta.buildId);
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    await fs.writeFile(p, JSON.stringify(meta, null, 2) + "\n", "utf8");
+}
+export async function readBuildMetadata(userHomeDir, buildId) {
+    try {
+        const raw = await fs.readFile(buildMetaPath(userHomeDir, buildId), "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function listBuildMetadata(userHomeDir) {
+    const dir = userBuildsDir(userHomeDir);
+    let entries;
+    try {
+        entries = await fs.readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of entries) {
+        if (!name.endsWith(".json"))
+            continue;
+        const buildId = name.slice(0, -".json".length);
+        const meta = await readBuildMetadata(userHomeDir, buildId);
+        if (meta)
+            out.push(meta);
+    }
+    // Newest first.
+    out.sort((a, b) => (a.builtAt < b.builtAt ? 1 : a.builtAt > b.builtAt ? -1 : 0));
+    return out;
+}
+//# sourceMappingURL=metadata.js.map

package/plugins/microsandbox/dist/build/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/build/metadata.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,iEAAiE;AACjE,EAAE;AACF,6DAA6D;AAC7D,mEAAmE;AACnE,gCAAgC;AAEhC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAuBzC,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,OAAe;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,IAAmB;IAEnB,MAAM,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB;IAEnB,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,gBAAgB;IAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/plugins/microsandbox/dist/build/pointer.d.ts

@@ -0,0 +1,51 @@
+/**
+ * One snapshot reference. Same shape that the legacy single-pointer
+ * file used at the top level.
+ */
+export interface SandboxPointer {
+    snapshotName: string;
+    baseImage: string;
+    /** ISO timestamp. */
+    publishedAt: string;
+    /** Best-effort attribution; populated from AgentToolContext.userId. */
+    publishedBy?: string;
+}
+/** Roles that can have an independent active snapshot. */
+export type SandboxRole = "browser" | "task";
+/**
+ * Tenant-level pointer file shape: one entry per role, plus the
+ * legacy top-level fields kept in sync with the browser role for
+ * backwards compatibility.
+ */
+export interface SandboxPointers {
+    browser: SandboxPointer | null;
+    task: SandboxPointer | null;
+}
+export declare function pointerPath(workspaceDir: string): string;
+/**
+ * Read the legacy single pointer (= the browser role). Kept for
+ * the runner's start path which still consumes one snapshot today;
+ * PR-B will switch the runner to `readPointers().task` for the
+ * per-task pool.
+ */
+export declare function readPointer(workspaceDir: string): Promise<SandboxPointer | null>;
+/**
+ * Read both role pointers. Auto-upgrades legacy single-pointer
+ * files (top-level snapshotName only) by mirroring the legacy entry
+ * to both browser and task roles — matches the pre-split sharing
+ * behaviour until the operator splits them apart in the UI.
+ */
+export declare function readPointers(workspaceDir: string): Promise<SandboxPointers>;
+/**
+ * Legacy single-pointer write — sets BOTH roles to the same
+ * snapshot. Used by `tenant_config_write` callers that still think
+ * one-pointer; equivalent to clicking "Use as Both" in the UI.
+ */
+export declare function writePointer(workspaceDir: string, pointer: SandboxPointer): Promise<void>;
+/**
+ * Persist both role pointers. Also writes the legacy top-level
+ * fields (mirroring the browser role) so older readers (current
+ * runner, external tools) keep working without changes.
+ */
+export declare function writePointers(workspaceDir: string, pointers: SandboxPointers): Promise<void>;
+//# sourceMappingURL=pointer.d.ts.map

package/plugins/microsandbox/dist/build/pointer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pointer.d.ts","sourceRoot":"","sources":["../../src/build/pointer.ts"],"names":[],"mappings":"AAsCA;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0DAA0D;AAC1D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAKD,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAoBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CAsB1B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/plugins/microsandbox/dist/build/pointer.js

@@ -0,0 +1,130 @@
+// Tenant-level "current snapshot" pointer.
+//
+// Stored as JSON at `<tenant>/_tenant/sandbox/current.json`. Two
+// independent role pointers — the long-lived browser sandbox and
+// the future per-task sandbox can pin different snapshots:
+//
+//   {
+//     "browser": {
+//       "snapshotName": "tianshu-default-2026-06-07-1",
+//       "baseImage":    "python:3.12-slim",
+//       "publishedAt":  "2026-06-07T08:30:00.000Z",
+//       "publishedBy":  "user_admin"
+//     },
+//     "task": { ... same shape, may differ from browser ... },
+//
+//     // Legacy compatibility — older code (the runner today, third-
+//     // party tools) still reads the top-level snapshotName field.
+//     // We mirror the browser pointer here on every write so old
+//     // readers continue to work without changes.
+//     "snapshotName": "...",
+//     "baseImage":    "...",
+//     "publishedAt":  "...",
+//     "publishedBy":  "..."
+//   }
+//
+// Old single-pointer files written before this PR are auto-upgraded
+// on read: the top-level fields are promoted to both `browser` and
+// `task` so behaviour matches the previous shared-snapshot model
+// until the user picks them apart in the admin UI.
+//
+// `_tenant/sandbox/` is a tenant-shared dir under workspace; the
+// agent's per-user fs tools cannot reach it, but the microsandbox
+// plugin can write here directly because it owns the publish
+// workflow.
+import * as path from "node:path";
+import { promises as fs } from "node:fs";
+const TENANT_SANDBOX_DIR = "_tenant/sandbox";
+const POINTER_BASENAME = "current.json";
+export function pointerPath(workspaceDir) {
+    return path.join(workspaceDir, TENANT_SANDBOX_DIR, POINTER_BASENAME);
+}
+function parseEntry(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const r = raw;
+    if (typeof r.snapshotName !== "string" ||
+        typeof r.baseImage !== "string" ||
+        typeof r.publishedAt !== "string") {
+        return null;
+    }
+    return {
+        snapshotName: r.snapshotName,
+        baseImage: r.baseImage,
+        publishedAt: r.publishedAt,
+        publishedBy: typeof r.publishedBy === "string" ? r.publishedBy : undefined,
+    };
+}
+/**
+ * Read the legacy single pointer (= the browser role). Kept for
+ * the runner's start path which still consumes one snapshot today;
+ * PR-B will switch the runner to `readPointers().task` for the
+ * per-task pool.
+ */
+export async function readPointer(workspaceDir) {
+    const all = await readPointers(workspaceDir);
+    return all.browser;
+}
+/**
+ * Read both role pointers. Auto-upgrades legacy single-pointer
+ * files (top-level snapshotName only) by mirroring the legacy entry
+ * to both browser and task roles — matches the pre-split sharing
+ * behaviour until the operator splits them apart in the UI.
+ */
+export async function readPointers(workspaceDir) {
+    const p = pointerPath(workspaceDir);
+    let raw;
+    try {
+        raw = await fs.readFile(p, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return { browser: null, task: null };
+        }
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { browser: null, task: null };
+    }
+    const legacyTop = parseEntry(parsed);
+    const browser = parseEntry(parsed.browser) ?? legacyTop;
+    const task = parseEntry(parsed.task) ?? legacyTop;
+    return { browser, task };
+}
+/**
+ * Legacy single-pointer write — sets BOTH roles to the same
+ * snapshot. Used by `tenant_config_write` callers that still think
+ * one-pointer; equivalent to clicking "Use as Both" in the UI.
+ */
+export async function writePointer(workspaceDir, pointer) {
+    await writePointers(workspaceDir, { browser: pointer, task: pointer });
+}
+/**
+ * Persist both role pointers. Also writes the legacy top-level
+ * fields (mirroring the browser role) so older readers (current
+ * runner, external tools) keep working without changes.
+ */
+export async function writePointers(workspaceDir, pointers) {
+    const p = pointerPath(workspaceDir);
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    // Legacy mirror: choose browser when present, fall back to task,
+    // so no role being unset doesn't strand the legacy reader.
+    const legacy = pointers.browser ?? pointers.task;
+    const out = {
+        browser: pointers.browser,
+        task: pointers.task,
+    };
+    if (legacy) {
+        out.snapshotName = legacy.snapshotName;
+        out.baseImage = legacy.baseImage;
+        out.publishedAt = legacy.publishedAt;
+        if (legacy.publishedBy !== undefined)
+            out.publishedBy = legacy.publishedBy;
+    }
+    await fs.writeFile(p, JSON.stringify(out, null, 2) + "\n", "utf8");
+}
+//# sourceMappingURL=pointer.js.map

package/plugins/microsandbox/dist/build/pointer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pointer.js","sourceRoot":"","sources":["../../src/build/pointer.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,iEAAiE;AACjE,iEAAiE;AACjE,2DAA2D;AAC3D,EAAE;AACF,MAAM;AACN,mBAAmB;AACnB,wDAAwD;AACxD,4CAA4C;AAC5C,oDAAoD;AACpD,qCAAqC;AACrC,SAAS;AACT,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,kEAAkE;AAClE,mDAAmD;AACnD,6BAA6B;AAC7B,6BAA6B;AAC7B,6BAA6B;AAC7B,4BAA4B;AAC5B,MAAM;AACN,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,mDAAmD;AACnD,EAAE;AACF,iEAAiE;AACjE,kEAAkE;AAClE,6DAA6D;AAC7D,YAAY;AAEZ,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AA4BzC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IACE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB;IAEpB,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,OAAuB;IAEvB,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,QAAyB;IAEzB,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,iEAAiE;IACjE,2DAA2D;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC;IACjD,MAAM,GAAG,GAA4B;QACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACvC,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACrC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC"}

package/plugins/microsandbox/dist/build/sandboxfile.d.ts

@@ -0,0 +1,15 @@
+export interface SandboxSpec {
+    image: string;
+    cpus?: number;
+    memoryMib?: number;
+    apt?: string[];
+    pip?: string[];
+    npm?: string[];
+    exec?: string[];
+}
+export declare class SandboxfileError extends Error {
+    readonly line: number;
+    constructor(message: string, line: number);
+}
+export declare function parseSandboxfile(source: string): SandboxSpec;
+//# sourceMappingURL=sandboxfile.d.ts.map

package/plugins/microsandbox/dist/build/sandboxfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxfile.d.ts","sourceRoot":"","sources":["../../src/build/sandboxfile.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAeD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAc5D"}