@truefoundry/trueforge-core 0.0.0 → 0.1.0-rc.0

package/dist/core/sandbox/SandboxNatsBridge.mjs

@@ -0,0 +1,201 @@
+// src/core/sandbox/SandboxNatsBridge.ts
+import { wsconnect } from "@nats-io/nats-core";
+import { context, defaultTextMapGetter } from "@opentelemetry/api";
+import { suppressTracing, unsuppressTracing, W3CTraceContextPropagator } from "@opentelemetry/core";
+import { randomUUID } from "crypto";
+import { WebSocket } from "ws";
+import { McpConnectionError } from "../errors.mjs";
+import {
+  isAuthRequired,
+  isCallToolResponseCreateSubAgent,
+  isCallToolResponseResult
+} from "../mcp/IMCPServer.mjs";
+import { extractErrorLogFields } from "../util/errorLogFields.mjs";
+import { withTimeout } from "../util/promiseUtils.mjs";
+Object.assign(global, { WebSocket });
+var NATS_CONNECT_TIMEOUT_MS = 1e4;
+var NATS_CONNECT_RETRIES = 3;
+var NATS_CONNECT_BACKOFF_MS = 250;
+var NATS_DRAIN_TIMEOUT_MS = 5e3;
+var SANDBOX_NATS_SUBJECT_ROOT = "sandbox.bridge";
+var SANDBOX_NATS_MCP_LEAF = "mcp";
+var InvalidMCPUsageError = class extends Error {
+  name = "InvalidMCPUsageError";
+};
+function isHttpClientError(error) {
+  if (typeof error !== "object" || error === null || !("status" in error)) {
+    return false;
+  }
+  const { status } = error;
+  return typeof status === "number" && status >= 400 && status < 500;
+}
+function classifyErrorSource(e) {
+  if (e instanceof InvalidMCPUsageError) return "agent";
+  if (isHttpClientError(e)) return "agent";
+  if (e instanceof McpConnectionError && e.statusCode >= 400 && e.statusCode < 500) return "agent";
+  return "gateway";
+}
+var _w3cExtractor = new W3CTraceContextPropagator();
+function extractTraceCarrier(msg) {
+  const carrier = {};
+  const traceparent = msg.headers?.get("traceparent");
+  const tracestate = msg.headers?.get("tracestate");
+  if (traceparent) carrier["traceparent"] = traceparent;
+  if (tracestate) carrier["tracestate"] = tracestate;
+  return carrier;
+}
+var SandboxNatsBridge = class _SandboxNatsBridge {
+  subjectPrefix;
+  nc;
+  toolSets;
+  logger;
+  closed = false;
+  constructor(nc, toolSets, subjectPrefix, logger) {
+    this.nc = nc;
+    this.toolSets = toolSets;
+    this.subjectPrefix = subjectPrefix;
+    this.logger = logger;
+  }
+  static async connect(params) {
+    const subjectPrefix = `${SANDBOX_NATS_SUBJECT_ROOT}.${randomUUID()}`;
+    const logger = params.logger.child({ module: "SandboxNatsBridge" });
+    let lastErr;
+    for (let attempt = 1; attempt <= NATS_CONNECT_RETRIES; attempt++) {
+      try {
+        const nc = await context.with(
+          suppressTracing(context.active()),
+          () => wsconnect({ servers: [params.url], timeout: NATS_CONNECT_TIMEOUT_MS })
+        );
+        logger.info(`Connected to sandbox NATS (attempt ${String(attempt)})`, { subjectPrefix });
+        const bridge = new _SandboxNatsBridge(nc, params.toolSets, subjectPrefix, logger);
+        bridge.subscribe();
+        return bridge;
+      } catch (e) {
+        lastErr = e;
+        logger.warn(`Sandbox NATS connect attempt ${String(attempt)} failed`, extractErrorLogFields(e));
+        if (attempt < NATS_CONNECT_RETRIES) {
+          await new Promise((resolve) => setTimeout(resolve, NATS_CONNECT_BACKOFF_MS));
+        }
+      }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error("Sandbox NATS connect failed");
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    try {
+      await withTimeout(this.nc.drain(), NATS_DRAIN_TIMEOUT_MS);
+    } catch (e) {
+      this.logger.warn("Sandbox NATS drain failed/timed out; forcing close", extractErrorLogFields(e));
+      await this.nc.close().catch(() => {
+      });
+    }
+  }
+  async whenClosed() {
+    await this.nc.closed();
+  }
+  subscribe() {
+    this.nc.subscribe(`${this.subjectPrefix}.${SANDBOX_NATS_MCP_LEAF}`, {
+      callback: (err, msg) => {
+        this.handle(err, msg, (m) => this.route(m));
+      }
+    });
+  }
+  route(msg) {
+    const req = this.decode(msg);
+    switch (req.op) {
+      case "list_tools":
+        return this.handleListTools(req);
+      case "call_tool":
+        return this.handleCallTool(req);
+      default:
+        throw new InvalidMCPUsageError(`Unknown sandbox bridge operation`);
+    }
+  }
+  handle(err, msg, handler) {
+    if (err) {
+      this.logger.error("Sandbox NATS subscription error", extractErrorLogFields(err));
+      return;
+    }
+    if (!msg.reply) {
+      this.logger.warn(`Sandbox NATS request on '${msg.subject}' has no reply subject; dropping`);
+      return;
+    }
+    const ctx = _w3cExtractor.extract(
+      unsuppressTracing(context.active()),
+      extractTraceCarrier(msg),
+      defaultTextMapGetter
+    );
+    context.with(ctx, () => void this.dispatch(msg, handler));
+  }
+  async dispatch(msg, handler) {
+    if (this.closed) {
+      this.logger.warn(`Sandbox NATS bridge is closed; rejecting request on '${msg.subject}'`);
+      try {
+        msg.respond(this.encode({ ok: false, error: "Sandbox NATS bridge is closed", source: "bridge" }));
+      } catch (e) {
+        this.logger.warn(`Failed to send bridge-closed reply on '${msg.subject}'`, extractErrorLogFields(e));
+      }
+      return;
+    }
+    let reply;
+    try {
+      reply = { ok: true, result: await handler(msg) };
+    } catch (e) {
+      const source = classifyErrorSource(e);
+      const errorMessage = e instanceof Error ? e.message : "Unknown sandbox bridge error";
+      this.logger.error(
+        `Sandbox NATS dispatch failed on '${msg.subject}' (source=${source})`,
+        extractErrorLogFields(e)
+      );
+      reply = { ok: false, error: errorMessage, source };
+    }
+    try {
+      msg.respond(this.encode(reply));
+    } catch (e) {
+      this.logger.error("Failed to publish sandbox NATS reply", extractErrorLogFields(e));
+    }
+  }
+  encode(reply) {
+    return new TextEncoder().encode(JSON.stringify(reply));
+  }
+  decode(msg) {
+    return JSON.parse(new TextDecoder().decode(msg.data));
+  }
+  getToolSet(serverName) {
+    const server = this.toolSets.get(serverName);
+    if (!server) {
+      throw new InvalidMCPUsageError(`MCP server '${serverName}' is not available for this agent`);
+    }
+    return server;
+  }
+  async handleListTools(req) {
+    const { server } = req;
+    const mcp = this.getToolSet(server);
+    const response = await mcp.listTools();
+    if (isAuthRequired(response)) {
+      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot list tools from sandbox`);
+    }
+    return response.result;
+  }
+  async handleCallTool(req) {
+    const { server, tool, arguments: args } = req;
+    const response = await this.getToolSet(server).callTool({ name: tool, arguments: args ?? {} });
+    if (isAuthRequired(response)) {
+      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot call tool from sandbox`);
+    }
+    if (isCallToolResponseCreateSubAgent(response)) {
+      throw new InvalidMCPUsageError(`Tool '${server}/${tool}' creates a sub-agent and is not callable from sandbox`);
+    }
+    if (!isCallToolResponseResult(response)) {
+      throw new InvalidMCPUsageError(
+        `Tool '${server}/${tool}' requires interactive handling and is not callable from sandbox`
+      );
+    }
+    return response.result;
+  }
+};
+export {
+  SandboxNatsBridge
+};
+//# sourceMappingURL=SandboxNatsBridge.mjs.map

package/dist/core/sandbox/SandboxNatsBridge.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/sandbox/SandboxNatsBridge.ts"],"sourcesContent":["import { wsconnect, type Msg, type NatsConnection } from '@nats-io/nats-core';\nimport { context, defaultTextMapGetter } from '@opentelemetry/api';\nimport { suppressTracing, unsuppressTracing, W3CTraceContextPropagator } from '@opentelemetry/core';\nimport { randomUUID } from 'node:crypto';\nimport type { Logger } from 'winston';\nimport { WebSocket } from 'ws';\nimport { McpConnectionError } from '../errors';\nimport {\n  isAuthRequired,\n  isCallToolResponseCreateSubAgent,\n  isCallToolResponseResult,\n  type CallToolResolvedResponse,\n  type IToolSet,\n  type ListToolsResolvedResponse,\n} from '../mcp/IMCPServer';\nimport { extractErrorLogFields } from '../util/errorLogFields';\nimport { withTimeout } from '../util/promiseUtils';\n\n// `wsconnect` from @nats-io/nats-core relies on a global WebSocket constructor; in Node we\n// provide it from `ws`. Same pattern as `src/services/NatsService.ts`.\nObject.assign(global, { WebSocket });\n\nconst NATS_CONNECT_TIMEOUT_MS = 10_000;\nconst NATS_CONNECT_RETRIES = 3;\nconst NATS_CONNECT_BACKOFF_MS = 250;\n// Bound on the graceful drain at teardown; on timeout we fall back to nc.close()\nconst NATS_DRAIN_TIMEOUT_MS = 5_000;\n\nconst SANDBOX_NATS_SUBJECT_ROOT = 'sandbox.bridge';\n// Single request/reply subject leaf; the operation is carried in the payload's `op` field so the\n// bridge maintains one subscription instead of one per operation.\nconst SANDBOX_NATS_MCP_LEAF = 'mcp';\n\ntype BridgeRequest =\n  | { op: 'list_tools'; server: string }\n  | { op: 'call_tool'; server: string; tool: string; arguments?: Record<string, unknown> };\n\n// Attributes an application-level failure so the sandbox client can tell who is at fault:\n// 'agent' (bad generated code: wrong server/tool/args or an unsupported path), 'gateway' (our\n// handler failed), or 'bridge' (a NATS bridge lifecycle condition, e.g. the bridge was closed).\n// Pure transport failures never produce an envelope, so they're inferred client-side instead.\ntype BridgeErrorSource = 'gateway' | 'agent' | 'bridge';\n\n// Envelope returned on `msg.reply`. NATS itself always succeeds; the receiver branches on `ok`.\ntype BridgeReply<T> = { ok: true; result: T } | { ok: false; error: string; source: BridgeErrorSource };\n\n// Caller-caused failure: retrying won't help, so it's attributed to the agent's code, not us.\nclass InvalidMCPUsageError extends Error {\n  override readonly name = 'InvalidMCPUsageError';\n}\n\nfunction isHttpClientError(error: unknown): error is { status: number } {\n  if (typeof error !== 'object' || error === null || !('status' in error)) {\n    return false;\n  }\n  const { status } = error;\n  return typeof status === 'number' && status >= 400 && status < 500;\n}\n\n// An InvalidMCPUsageError, a 4xx HTTP-style exception, or a 4xx-hinted McpConnectionError (e.g. a\n// disallowed/unknown tool surfaced by an ToolSet) is caller-caused -> 'agent'; anything else is\n// our bug -> 'gateway'.\nfunction classifyErrorSource(e: unknown): BridgeErrorSource {\n  if (e instanceof InvalidMCPUsageError) return 'agent';\n  if (isHttpClientError(e)) return 'agent';\n  // ...remote servers with a 4xx McpConnectionError (has `statusCode`, not `status`). Same meaning.\n  if (e instanceof McpConnectionError && e.statusCode >= 400 && e.statusCode < 500) return 'agent';\n  return 'gateway';\n}\n\n// Direct W3C extractor, NOT the global `propagation` API. The gateway-wide propagator\n// (SelectivePropagator in src/tracing.ts) refuses to restore traceparent unless the\n// internal-secret headers are present — a deliberate guard against external requests\n// forging trace parents. The NATS bridge is intra-process trusted (sender + receiver\n// share the same Node process and span store), so we bypass that gate here and\n// always honor the trace context the sandbox echoes back.\nconst _w3cExtractor = new W3CTraceContextPropagator();\n\nfunction extractTraceCarrier(msg: Msg): Record<string, string> {\n  const carrier: Record<string, string> = {};\n  const traceparent = msg.headers?.get('traceparent');\n  const tracestate = msg.headers?.get('tracestate');\n  if (traceparent) carrier['traceparent'] = traceparent;\n  if (tracestate) carrier['tracestate'] = tracestate;\n  return carrier;\n}\n\n/**\n * Per-sandbox NATS subscriber. Bridges sandbox-originated MCP tool calls (sent over wss to the\n * sandbox's local nats-server) into the gateway pod's `IToolSet` registry for this agent.\n * The pod that holds the preview URL is the only NATS subscriber, which gives sandbox→gateway\n * traffic pod-affinity for free.\n */\nexport class SandboxNatsBridge {\n  readonly subjectPrefix: string;\n\n  private readonly nc: NatsConnection;\n  private readonly toolSets: Map<string, IToolSet>;\n  private readonly logger: Logger;\n  private closed = false;\n\n  private constructor(nc: NatsConnection, toolSets: Map<string, IToolSet>, subjectPrefix: string, logger: Logger) {\n    this.nc = nc;\n    this.toolSets = toolSets;\n    this.subjectPrefix = subjectPrefix;\n    this.logger = logger;\n  }\n\n  static async connect(params: {\n    url: string;\n    toolSets: Map<string, IToolSet>;\n    logger: Logger;\n  }): Promise<SandboxNatsBridge> {\n    const subjectPrefix = `${SANDBOX_NATS_SUBJECT_ROOT}.${randomUUID()}`;\n    const logger = params.logger.child({ module: 'SandboxNatsBridge' });\n    let lastErr: unknown;\n    for (let attempt = 1; attempt <= NATS_CONNECT_RETRIES; attempt++) {\n      try {\n        const nc = await context.with(suppressTracing(context.active()), () =>\n          wsconnect({ servers: [params.url], timeout: NATS_CONNECT_TIMEOUT_MS }),\n        );\n        logger.info(`Connected to sandbox NATS (attempt ${String(attempt)})`, { subjectPrefix });\n        const bridge = new SandboxNatsBridge(nc, params.toolSets, subjectPrefix, logger);\n        bridge.subscribe();\n        return bridge;\n      } catch (e) {\n        lastErr = e;\n        logger.warn(`Sandbox NATS connect attempt ${String(attempt)} failed`, extractErrorLogFields(e));\n        if (attempt < NATS_CONNECT_RETRIES) {\n          await new Promise(resolve => setTimeout(resolve, NATS_CONNECT_BACKOFF_MS));\n        }\n      }\n    }\n    throw lastErr instanceof Error ? lastErr : new Error('Sandbox NATS connect failed');\n  }\n\n  async close(): Promise<void> {\n    if (this.closed) return;\n    this.closed = true;\n    try {\n      // drain() resolves once pending replies are flushed and the connection closes.\n      await withTimeout(this.nc.drain(), NATS_DRAIN_TIMEOUT_MS);\n    } catch (e) {\n      // drain rejected or timed out, nc.close() terminates all pending requests and subscriptions on the connection.\n      this.logger.warn('Sandbox NATS drain failed/timed out; forcing close', extractErrorLogFields(e));\n      await this.nc.close().catch(() => {\n        /* no-op */\n      });\n    }\n  }\n\n  async whenClosed(): Promise<void> {\n    await this.nc.closed();\n  }\n\n  private subscribe(): void {\n    this.nc.subscribe(`${this.subjectPrefix}.${SANDBOX_NATS_MCP_LEAF}`, {\n      callback: (err, msg) => {\n        this.handle(err, msg, m => this.route(m));\n      },\n    });\n  }\n\n  private route(msg: Msg): Promise<unknown> {\n    const req = this.decode(msg);\n    switch (req.op) {\n      case 'list_tools':\n        return this.handleListTools(req);\n      case 'call_tool':\n        return this.handleCallTool(req);\n      default:\n        throw new InvalidMCPUsageError(`Unknown sandbox bridge operation`);\n    }\n  }\n\n  private handle(err: Error | null, msg: Msg, handler: (msg: Msg) => Promise<unknown>): void {\n    if (err) {\n      this.logger.error('Sandbox NATS subscription error', extractErrorLogFields(err));\n      return;\n    }\n    if (!msg.reply) {\n      this.logger.warn(`Sandbox NATS request on '${msg.subject}' has no reply subject; dropping`);\n      return;\n    }\n\n    // Resume the originating Sandbox: exec span from the per-request traceparent header so\n    // downstream MCP spans nest correctly (falls through to the current context if absent).\n    // unsuppressTracing is required: connect() runs under suppressTracing (to drop the\n    // WS-upgrade span) and nats-core's receive loop reuses that suppressed context, which would\n    // otherwise make propagation.inject no-op and leak a stale traceparent.\n    const ctx = _w3cExtractor.extract(\n      unsuppressTracing(context.active()),\n      extractTraceCarrier(msg),\n      defaultTextMapGetter,\n    );\n    context.with(ctx, () => void this.dispatch(msg, handler));\n  }\n\n  private async dispatch(msg: Msg, handler: (msg: Msg) => Promise<unknown>): Promise<void> {\n    if (this.closed) {\n      this.logger.warn(`Sandbox NATS bridge is closed; rejecting request on '${msg.subject}'`);\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Sandbox NATS bridge is closed', source: 'bridge' }));\n      } catch (e) {\n        this.logger.warn(`Failed to send bridge-closed reply on '${msg.subject}'`, extractErrorLogFields(e));\n      }\n      return;\n    }\n    let reply: BridgeReply<unknown>;\n    try {\n      reply = { ok: true, result: await handler(msg) };\n    } catch (e) {\n      const source = classifyErrorSource(e);\n      const errorMessage = e instanceof Error ? e.message : 'Unknown sandbox bridge error';\n      this.logger.error(\n        `Sandbox NATS dispatch failed on '${msg.subject}' (source=${source})`,\n        extractErrorLogFields(e),\n      );\n      reply = { ok: false, error: errorMessage, source };\n    }\n    try {\n      msg.respond(this.encode(reply));\n    } catch (e) {\n      this.logger.error('Failed to publish sandbox NATS reply', extractErrorLogFields(e));\n    }\n  }\n\n  private encode(reply: BridgeReply<unknown>): Uint8Array {\n    return new TextEncoder().encode(JSON.stringify(reply));\n  }\n\n  private decode(msg: Msg): BridgeRequest {\n    return JSON.parse(new TextDecoder().decode(msg.data)) as BridgeRequest;\n  }\n\n  private getToolSet(serverName: string): IToolSet {\n    const server = this.toolSets.get(serverName);\n    if (!server) {\n      throw new InvalidMCPUsageError(`MCP server '${serverName}' is not available for this agent`);\n    }\n    return server;\n  }\n\n  private async handleListTools(req: { server: string }): Promise<ListToolsResolvedResponse['result']> {\n    const { server } = req;\n    const mcp = this.getToolSet(server);\n    const response = await mcp.listTools();\n    if (isAuthRequired(response)) {\n      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot list tools from sandbox`);\n    }\n    return response.result;\n  }\n\n  private async handleCallTool(req: {\n    server: string;\n    tool: string;\n    arguments?: Record<string, unknown> | undefined;\n  }): Promise<CallToolResolvedResponse['result']> {\n    const { server, tool, arguments: args } = req;\n    const response = await this.getToolSet(server).callTool({ name: tool, arguments: args ?? {} });\n    if (isAuthRequired(response)) {\n      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot call tool from sandbox`);\n    }\n    if (isCallToolResponseCreateSubAgent(response)) {\n      throw new InvalidMCPUsageError(`Tool '${server}/${tool}' creates a sub-agent and is not callable from sandbox`);\n    }\n    if (!isCallToolResponseResult(response)) {\n      // Approval / client-side-tool paths are intentionally out of scope currently.\n      throw new InvalidMCPUsageError(\n        `Tool '${server}/${tool}' requires interactive handling and is not callable from sandbox`,\n      );\n    }\n    return response.result;\n  }\n}\n"],"mappings":";AAAA,SAAS,iBAAgD;AACzD,SAAS,SAAS,4BAA4B;AAC9C,SAAS,iBAAiB,mBAAmB,iCAAiC;AAC9E,SAAS,kBAAkB;AAE3B,SAAS,iBAAiB;AAC1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAI5B,OAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAEhC,IAAM,wBAAwB;AAE9B,IAAM,4BAA4B;AAGlC,IAAM,wBAAwB;AAgB9B,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrB,OAAO;AAC3B;AAEA,SAAS,kBAAkB,OAA6C;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,YAAY,QAAQ;AACvE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,OAAO,IAAI;AACnB,SAAO,OAAO,WAAW,YAAY,UAAU,OAAO,SAAS;AACjE;AAKA,SAAS,oBAAoB,GAA+B;AAC1D,MAAI,aAAa,qBAAsB,QAAO;AAC9C,MAAI,kBAAkB,CAAC,EAAG,QAAO;AAEjC,MAAI,aAAa,sBAAsB,EAAE,cAAc,OAAO,EAAE,aAAa,IAAK,QAAO;AACzF,SAAO;AACT;AAQA,IAAM,gBAAgB,IAAI,0BAA0B;AAEpD,SAAS,oBAAoB,KAAkC;AAC7D,QAAM,UAAkC,CAAC;AACzC,QAAM,cAAc,IAAI,SAAS,IAAI,aAAa;AAClD,QAAM,aAAa,IAAI,SAAS,IAAI,YAAY;AAChD,MAAI,YAAa,SAAQ,aAAa,IAAI;AAC1C,MAAI,WAAY,SAAQ,YAAY,IAAI;AACxC,SAAO;AACT;AAQO,IAAM,oBAAN,MAAM,mBAAkB;AAAA,EACpB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACT,SAAS;AAAA,EAET,YAAY,IAAoB,UAAiC,eAAuB,QAAgB;AAC9G,SAAK,KAAK;AACV,SAAK,WAAW;AAChB,SAAK,gBAAgB;AACrB,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,aAAa,QAAQ,QAIU;AAC7B,UAAM,gBAAgB,GAAG,yBAAyB,IAAI,WAAW,CAAC;AAClE,UAAM,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,oBAAoB,CAAC;AAClE,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,sBAAsB,WAAW;AAChE,UAAI;AACF,cAAM,KAAK,MAAM,QAAQ;AAAA,UAAK,gBAAgB,QAAQ,OAAO,CAAC;AAAA,UAAG,MAC/D,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,GAAG,SAAS,wBAAwB,CAAC;AAAA,QACvE;AACA,eAAO,KAAK,sCAAsC,OAAO,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;AACvF,cAAM,SAAS,IAAI,mBAAkB,IAAI,OAAO,UAAU,eAAe,MAAM;AAC/E,eAAO,UAAU;AACjB,eAAO;AAAA,MACT,SAAS,GAAG;AACV,kBAAU;AACV,eAAO,KAAK,gCAAgC,OAAO,OAAO,CAAC,WAAW,sBAAsB,CAAC,CAAC;AAC9F,YAAI,UAAU,sBAAsB;AAClC,gBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,uBAAuB,CAAC;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,6BAA6B;AAAA,EACpF;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS;AACd,QAAI;AAEF,YAAM,YAAY,KAAK,GAAG,MAAM,GAAG,qBAAqB;AAAA,IAC1D,SAAS,GAAG;AAEV,WAAK,OAAO,KAAK,sDAAsD,sBAAsB,CAAC,CAAC;AAC/F,YAAM,KAAK,GAAG,MAAM,EAAE,MAAM,MAAM;AAAA,MAElC,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,aAA4B;AAChC,UAAM,KAAK,GAAG,OAAO;AAAA,EACvB;AAAA,EAEQ,YAAkB;AACxB,SAAK,GAAG,UAAU,GAAG,KAAK,aAAa,IAAI,qBAAqB,IAAI;AAAA,MAClE,UAAU,CAAC,KAAK,QAAQ;AACtB,aAAK,OAAO,KAAK,KAAK,OAAK,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,MAAM,KAA4B;AACxC,UAAM,MAAM,KAAK,OAAO,GAAG;AAC3B,YAAQ,IAAI,IAAI;AAAA,MACd,KAAK;AACH,eAAO,KAAK,gBAAgB,GAAG;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,eAAe,GAAG;AAAA,MAChC;AACE,cAAM,IAAI,qBAAqB,kCAAkC;AAAA,IACrE;AAAA,EACF;AAAA,EAEQ,OAAO,KAAmB,KAAU,SAA+C;AACzF,QAAI,KAAK;AACP,WAAK,OAAO,MAAM,mCAAmC,sBAAsB,GAAG,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,CAAC,IAAI,OAAO;AACd,WAAK,OAAO,KAAK,4BAA4B,IAAI,OAAO,kCAAkC;AAC1F;AAAA,IACF;AAOA,UAAM,MAAM,cAAc;AAAA,MACxB,kBAAkB,QAAQ,OAAO,CAAC;AAAA,MAClC,oBAAoB,GAAG;AAAA,MACvB;AAAA,IACF;AACA,YAAQ,KAAK,KAAK,MAAM,KAAK,KAAK,SAAS,KAAK,OAAO,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAc,SAAS,KAAU,SAAwD;AACvF,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,KAAK,wDAAwD,IAAI,OAAO,GAAG;AACvF,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,iCAAiC,QAAQ,SAAS,CAAC,CAAC;AAAA,MAClG,SAAS,GAAG;AACV,aAAK,OAAO,KAAK,0CAA0C,IAAI,OAAO,KAAK,sBAAsB,CAAC,CAAC;AAAA,MACrG;AACA;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,cAAQ,EAAE,IAAI,MAAM,QAAQ,MAAM,QAAQ,GAAG,EAAE;AAAA,IACjD,SAAS,GAAG;AACV,YAAM,SAAS,oBAAoB,CAAC;AACpC,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU;AACtD,WAAK,OAAO;AAAA,QACV,oCAAoC,IAAI,OAAO,aAAa,MAAM;AAAA,QAClE,sBAAsB,CAAC;AAAA,MACzB;AACA,cAAQ,EAAE,IAAI,OAAO,OAAO,cAAc,OAAO;AAAA,IACnD;AACA,QAAI;AACF,UAAI,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,IAChC,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,wCAAwC,sBAAsB,CAAC,CAAC;AAAA,IACpF;AAAA,EACF;AAAA,EAEQ,OAAO,OAAyC;AACtD,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACvD;AAAA,EAEQ,OAAO,KAAyB;AACtC,WAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC;AAAA,EACtD;AAAA,EAEQ,WAAW,YAA8B;AAC/C,UAAM,SAAS,KAAK,SAAS,IAAI,UAAU;AAC3C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,qBAAqB,eAAe,UAAU,mCAAmC;AAAA,IAC7F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,gBAAgB,KAAuE;AACnG,UAAM,EAAE,OAAO,IAAI;AACnB,UAAM,MAAM,KAAK,WAAW,MAAM;AAClC,UAAM,WAAW,MAAM,IAAI,UAAU;AACrC,QAAI,eAAe,QAAQ,GAAG;AAC5B,YAAM,IAAI,qBAAqB,eAAe,MAAM,kDAAkD;AAAA,IACxG;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,MAAc,eAAe,KAImB;AAC9C,UAAM,EAAE,QAAQ,MAAM,WAAW,KAAK,IAAI;AAC1C,UAAM,WAAW,MAAM,KAAK,WAAW,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAC7F,QAAI,eAAe,QAAQ,GAAG;AAC5B,YAAM,IAAI,qBAAqB,eAAe,MAAM,iDAAiD;AAAA,IACvG;AACA,QAAI,iCAAiC,QAAQ,GAAG;AAC9C,YAAM,IAAI,qBAAqB,SAAS,MAAM,IAAI,IAAI,wDAAwD;AAAA,IAChH;AACA,QAAI,CAAC,yBAAyB,QAAQ,GAAG;AAEvC,YAAM,IAAI;AAAA,QACR,SAAS,MAAM,IAAI,IAAI;AAAA,MACzB;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AACF;","names":[]}

package/dist/core/sandbox/constants.d.ts

@@ -0,0 +1,10 @@
+/** Stable directory inside the sandbox for user file uploads (mkdir during sandbox init). */
+export declare const SANDBOX_FILE_UPLOADS_DIR = "/tmp/uploads";
+/** Default port of the pod-local NATS WebSocket broker used by the sandbox→gateway MCP bridge. */
+export declare const DEFAULT_SANDBOX_NATS_WS_PORT = 4444;
+/**
+ * Default lifetime of a Daytona signed preview URL for the NATS bridge.
+ * Matches the gateway's default AGENT_RESPONSE_MAX_EXECUTION_TIME_MS (1 hour).
+ */
+export declare const DEFAULT_PREVIEW_URL_EXPIRY_SECONDS = 3600;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/sandbox/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/constants.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AAEvD,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,kCAAkC,OAAO,CAAC"}

package/dist/core/sandbox/constants.js

@@ -0,0 +1,37 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/sandbox/constants.ts
+var constants_exports = {};
+__export(constants_exports, {
+  DEFAULT_PREVIEW_URL_EXPIRY_SECONDS: () => DEFAULT_PREVIEW_URL_EXPIRY_SECONDS,
+  DEFAULT_SANDBOX_NATS_WS_PORT: () => DEFAULT_SANDBOX_NATS_WS_PORT,
+  SANDBOX_FILE_UPLOADS_DIR: () => SANDBOX_FILE_UPLOADS_DIR
+});
+module.exports = __toCommonJS(constants_exports);
+var SANDBOX_FILE_UPLOADS_DIR = "/tmp/uploads";
+var DEFAULT_SANDBOX_NATS_WS_PORT = 4444;
+var DEFAULT_PREVIEW_URL_EXPIRY_SECONDS = 3600;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_PREVIEW_URL_EXPIRY_SECONDS,
+  DEFAULT_SANDBOX_NATS_WS_PORT,
+  SANDBOX_FILE_UPLOADS_DIR
+});
+//# sourceMappingURL=constants.js.map

package/dist/core/sandbox/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/sandbox/constants.ts"],"sourcesContent":["/** Stable directory inside the sandbox for user file uploads (mkdir during sandbox init). */\nexport const SANDBOX_FILE_UPLOADS_DIR = '/tmp/uploads';\n\n/** Default port of the pod-local NATS WebSocket broker used by the sandbox→gateway MCP bridge. */\nexport const DEFAULT_SANDBOX_NATS_WS_PORT = 4444;\n\n/**\n * Default lifetime of a Daytona signed preview URL for the NATS bridge.\n * Matches the gateway's default AGENT_RESPONSE_MAX_EXECUTION_TIME_MS (1 hour).\n */\nexport const DEFAULT_PREVIEW_URL_EXPIRY_SECONDS = 3600;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACO,IAAM,2BAA2B;AAGjC,IAAM,+BAA+B;AAMrC,IAAM,qCAAqC;","names":[]}

package/dist/core/sandbox/constants.mjs

@@ -0,0 +1,10 @@
+// src/core/sandbox/constants.ts
+var SANDBOX_FILE_UPLOADS_DIR = "/tmp/uploads";
+var DEFAULT_SANDBOX_NATS_WS_PORT = 4444;
+var DEFAULT_PREVIEW_URL_EXPIRY_SECONDS = 3600;
+export {
+  DEFAULT_PREVIEW_URL_EXPIRY_SECONDS,
+  DEFAULT_SANDBOX_NATS_WS_PORT,
+  SANDBOX_FILE_UPLOADS_DIR
+};
+//# sourceMappingURL=constants.mjs.map

package/dist/core/sandbox/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/sandbox/constants.ts"],"sourcesContent":["/** Stable directory inside the sandbox for user file uploads (mkdir during sandbox init). */\nexport const SANDBOX_FILE_UPLOADS_DIR = '/tmp/uploads';\n\n/** Default port of the pod-local NATS WebSocket broker used by the sandbox→gateway MCP bridge. */\nexport const DEFAULT_SANDBOX_NATS_WS_PORT = 4444;\n\n/**\n * Default lifetime of a Daytona signed preview URL for the NATS bridge.\n * Matches the gateway's default AGENT_RESPONSE_MAX_EXECUTION_TIME_MS (1 hour).\n */\nexport const DEFAULT_PREVIEW_URL_EXPIRY_SECONDS = 3600;\n"],"mappings":";AACO,IAAM,2BAA2B;AAGjC,IAAM,+BAA+B;AAMrC,IAAM,qCAAqC;","names":[]}

package/dist/core/sandbox/provider/DaytonaProvider.d.ts

@@ -0,0 +1,80 @@
+import { Daytona } from '@daytona/sdk';
+import type { Logger } from 'winston';
+import type { ExecResult, SandboxBuild, SandboxExecParams, SandboxProvider } from './Provider';
+export interface DaytonaSandboxProviderOptions {
+    /** Caller-owned Daytona SDK client (credentials / lifetime). */
+    client: Daytona;
+    tenantName: string;
+    /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */
+    sandboxImage: string;
+    /**
+     * Daytona snapshot name to clone sandboxes from. When omitted it is derived from the image
+     * digest. Callers that create sandboxes pass the persisted build_ref so cloning targets the
+     * snapshot that was actually built, not a speculative name derived from the current image.
+     */
+    buildRef?: string | undefined;
+    timeoutMs: number;
+    autoStopIntervalInMinutes: number;
+    autoArchiveIntervalInMinutes: number;
+    autoDeleteIntervalInMinutes: number;
+    fileMaxBytesForDownload: number;
+    /** Defaults to the built-in sandbox NATS WebSocket port (4444). */
+    natsBridgePort?: number;
+    /** Defaults to 1 hour (same as the gateway's max agent execution time). */
+    previewUrlExpirySeconds?: number;
+    logger: Logger;
+}
+export declare class DaytonaSandboxProvider implements SandboxProvider {
+    private readonly tenantName;
+    /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */
+    private readonly imageUri;
+    /** Daytona snapshot name sandboxes are cloned from; the persisted build_ref, or derived from the image digest. */
+    private readonly buildRef;
+    private readonly timeoutMs;
+    private readonly autoStopIntervalInMinutes;
+    private readonly autoArchiveIntervalInMinutes;
+    private readonly autoDeleteIntervalInMinutes;
+    private readonly fileMaxBytesForDownload;
+    private readonly natsBridgePort;
+    private readonly previewUrlExpirySeconds;
+    private readonly logger;
+    private readonly daytona;
+    private static readonly cachedSandboxes;
+    private static readonly inFlightRecoveries;
+    constructor(options: DaytonaSandboxProviderOptions);
+    private getOrCreateSandbox;
+    private static recoverSandboxIfStopped;
+    private executeWithSandboxRecovery;
+    private restoreExistingSandbox;
+    createSandbox(): Promise<{
+        sandboxId: string;
+    }>;
+    /** Resolves undefined when no snapshot carries that name; auth/other failures throw. */
+    private getSnapshot;
+    /**
+     * Drops a build stuck in a terminal-failure state so a fresh create can reuse its
+     * deterministic name. A concurrent replica may have deleted it already (404) — that
+     * is fine and treated as success.
+     */
+    private deleteFailedBuild;
+    private toBuild;
+    buildImage(): Promise<SandboxBuild>;
+    getImageBuildStatus(): Promise<SandboxBuild>;
+    exec(params: SandboxExecParams): Promise<ExecResult>;
+    private getFileInfo;
+    downloadFile(params: {
+        sandboxId: string;
+        path: string;
+    }): Promise<Buffer>;
+    uploadFile(params: {
+        sandboxId: string;
+        remotePath: string;
+        content: Buffer;
+    }): Promise<void>;
+    private getPreviewUrl;
+    getNatsBridgeUrl(sandboxId: string): Promise<string>;
+    getAdditionalInstructions(): string | undefined;
+    getToolResultDumpDir(): string;
+    getGitCredentialsPath(): string;
+}
+//# sourceMappingURL=DaytonaProvider.d.ts.map

package/dist/core/sandbox/provider/DaytonaProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DaytonaProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/DaytonaProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAgB,MAAM,cAAc,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAStC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AA2ChH,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB,EAAE,MAAM,CAAC;IAClC,4BAA4B,EAAE,MAAM,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,kHAAkH;IAClH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IACtD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAqE;IAE5G,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAEjF,YAAY,OAAO,EAAE,6BAA6B,EAajD;YAEa,kBAAkB;IAsBhC,OAAO,CAAC,MAAM,CAAC,uBAAuB;YAsBxB,0BAA0B;YAiC1B,sBAAsB;IAe9B,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAMpD;IAED,wFAAwF;YAC1E,WAAW;IAWzB;;;;OAIG;YACW,iBAAiB;IAW/B,OAAO,CAAC,OAAO;IAcT,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CA0BxC;IAEK,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAWjD;IAEK,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBzD;YAEa,WAAW;IAKnB,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyB/E;IAEK,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlG;YAGa,aAAa;IAgBrB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQzD;IAED,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED,oBAAoB,IAAI,MAAM,CAE7B;IAED,qBAAqB,IAAI,MAAM,CAG9B;CACF"}