@truefoundry/trueforge-core 0.1.0 → 0.1.1

package/dist/core/sandbox/codeMode/CodeModeDispatcher.mjs

@@ -19,9 +19,15 @@ function isHttpClientError(error) {
   return typeof status === "number" && status >= 400 && status < 500;
 }
 function classifyErrorSource(e) {
-  if (e instanceof InvalidMCPUsageError) return "caller";
-  if (isHttpClientError(e)) return "caller";
-  if (e instanceof McpConnectionError && e.statusCode >= 400 && e.statusCode < 500) return "caller";
+  if (e instanceof InvalidMCPUsageError) {
+    return "caller";
+  }
+  if (isHttpClientError(e)) {
+    return "caller";
+  }
+  if (e instanceof McpConnectionError && e.statusCode >= 400 && e.statusCode < 500) {
+    return "caller";
+  }
   return "internal";
 }
 var _w3cExtractor = new W3CTraceContextPropagator();

package/dist/core/sandbox/codeMode/CodeModeDispatcher.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/core/sandbox/codeMode/CodeModeDispatcher.ts"],"sourcesContent":["import { context, defaultTextMapGetter } from '@opentelemetry/api';\nimport { unsuppressTracing, W3CTraceContextPropagator } from '@opentelemetry/core';\nimport { McpConnectionError } from '../../errors';\nimport {\n  isAuthRequired,\n  isCallToolResponseCreateSubAgent,\n  isCallToolResponseResult,\n  type IToolSet,\n} from '../../mcp/IMCPServer';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeErrorSource, CodeModeReply, CodeModeRequest } from './types';\n\n/** Minimal logger surface used by Code Mode (avoids a hard winston dep for PoC binders). */\nexport interface CodeModeLogger {\n  child(bindings: Record<string, unknown>): CodeModeLogger;\n  error(message: string, meta?: unknown): void;\n}\n\n// Caller-caused failure: retrying won't help.\nclass InvalidMCPUsageError extends Error {\n  override readonly name = 'InvalidMCPUsageError';\n}\n\nfunction isHttpClientError(error: unknown): error is { status: number } {\n  if (typeof error !== 'object' || error === null || !('status' in error)) {\n    return false;\n  }\n  const { status } = error;\n  return typeof status === 'number' && status >= 400 && status < 500;\n}\n\nfunction classifyErrorSource(e: unknown): CodeModeErrorSource {\n  if (e instanceof InvalidMCPUsageError) return 'caller';\n  if (isHttpClientError(e)) return 'caller';\n  if (e instanceof McpConnectionError && e.statusCode >= 400 && e.statusCode < 500) return 'caller';\n  return 'internal';\n}\n\n// Direct W3C extractor, NOT the global `propagation` API. The gateway-wide propagator\n// refuses to restore traceparent unless internal-secret headers are present. Code Mode\n// is intra-process trusted, so we bypass that gate and honor the sandbox carrier.\nconst _w3cExtractor = new W3CTraceContextPropagator();\n\n/**\n * Shared Code Mode policy leaf: tool routing, authz, error `source`. No NATS/UDS.\n */\nexport class CodeModeDispatcher {\n  private readonly toolSets: Map<string, IToolSet>;\n  private readonly logger: CodeModeLogger;\n  private closed = false;\n\n  constructor(params: { toolSets: readonly IToolSet[]; logger: CodeModeLogger }) {\n    this.toolSets = new Map();\n    for (const server of params.toolSets) {\n      this.toolSets.set(server.name, server);\n    }\n    this.logger = params.logger.child({ module: 'CodeModeDispatcher' });\n  }\n\n  close(): void {\n    this.closed = true;\n  }\n\n  async dispatch(params: {\n    request: CodeModeRequest;\n    traceCarrier: Readonly<Record<string, string>>;\n  }): Promise<CodeModeReply> {\n    if (this.closed) {\n      return { ok: false, error: 'Code Mode dispatcher is closed', source: 'transport' };\n    }\n\n    const ctx = _w3cExtractor.extract(\n      unsuppressTracing(context.active()),\n      { ...params.traceCarrier },\n      defaultTextMapGetter,\n    );\n\n    try {\n      const result = await context.with(ctx, () => this.route(params.request));\n      return { ok: true, result };\n    } catch (e) {\n      const source = classifyErrorSource(e);\n      const errorMessage = e instanceof Error ? e.message : 'Unknown Code Mode dispatch error';\n      this.logger.error(`Code Mode dispatch failed (source=${source})`, extractErrorLogFields(e));\n      return { ok: false, error: errorMessage, source };\n    }\n  }\n\n  private route(request: CodeModeRequest): Promise<unknown> {\n    switch (request.op) {\n      case 'list_tools':\n        return this.handleListTools(request);\n      case 'call_tool':\n        return this.handleCallTool(request);\n      default:\n        throw new InvalidMCPUsageError(`Unknown Code Mode operation`);\n    }\n  }\n\n  private getToolSet(serverName: string): IToolSet {\n    const server = this.toolSets.get(serverName);\n    if (!server) {\n      throw new InvalidMCPUsageError(`MCP server '${serverName}' is not available for this agent`);\n    }\n    return server;\n  }\n\n  private async handleListTools(req: { server: string }): Promise<unknown> {\n    const { server } = req;\n    const mcp = this.getToolSet(server);\n    const response = await mcp.listTools();\n    if (isAuthRequired(response)) {\n      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot list tools from sandbox`);\n    }\n    return response.result;\n  }\n\n  private async handleCallTool(req: {\n    server: string;\n    tool: string;\n    arguments?: Record<string, unknown> | undefined;\n  }): Promise<unknown> {\n    const { server, tool, arguments: args } = req;\n    const response = await this.getToolSet(server).callTool({ name: tool, arguments: args ?? {} });\n    if (isAuthRequired(response)) {\n      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot call tool from sandbox`);\n    }\n    if (isCallToolResponseCreateSubAgent(response)) {\n      throw new InvalidMCPUsageError(`Tool '${server}/${tool}' creates a sub-agent and is not callable from sandbox`);\n    }\n    if (!isCallToolResponseResult(response)) {\n      throw new InvalidMCPUsageError(\n        `Tool '${server}/${tool}' requires interactive handling and is not callable from sandbox`,\n      );\n    }\n    return response.result;\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS,4BAA4B;AAC9C,SAAS,mBAAmB,iCAAiC;AAC7D,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B;AAUtC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrB,OAAO;AAC3B;AAEA,SAAS,kBAAkB,OAA6C;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,YAAY,QAAQ;AACvE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,OAAO,IAAI;AACnB,SAAO,OAAO,WAAW,YAAY,UAAU,OAAO,SAAS;AACjE;AAEA,SAAS,oBAAoB,GAAiC;AAC5D,MAAI,aAAa,qBAAsB,QAAO;AAC9C,MAAI,kBAAkB,CAAC,EAAG,QAAO;AACjC,MAAI,aAAa,sBAAsB,EAAE,cAAc,OAAO,EAAE,aAAa,IAAK,QAAO;AACzF,SAAO;AACT;AAKA,IAAM,gBAAgB,IAAI,0BAA0B;AAK7C,IAAM,qBAAN,MAAyB;AAAA,EACb;AAAA,EACA;AAAA,EACT,SAAS;AAAA,EAEjB,YAAY,QAAmE;AAC7E,SAAK,WAAW,oBAAI,IAAI;AACxB,eAAW,UAAU,OAAO,UAAU;AACpC,WAAK,SAAS,IAAI,OAAO,MAAM,MAAM;AAAA,IACvC;AACA,SAAK,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACpE;AAAA,EAEA,QAAc;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,SAAS,QAGY;AACzB,QAAI,KAAK,QAAQ;AACf,aAAO,EAAE,IAAI,OAAO,OAAO,kCAAkC,QAAQ,YAAY;AAAA,IACnF;AAEA,UAAM,MAAM,cAAc;AAAA,MACxB,kBAAkB,QAAQ,OAAO,CAAC;AAAA,MAClC,EAAE,GAAG,OAAO,aAAa;AAAA,MACzB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,MAAM,KAAK,MAAM,OAAO,OAAO,CAAC;AACvE,aAAO,EAAE,IAAI,MAAM,OAAO;AAAA,IAC5B,SAAS,GAAG;AACV,YAAM,SAAS,oBAAoB,CAAC;AACpC,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU;AACtD,WAAK,OAAO,MAAM,qCAAqC,MAAM,KAAK,sBAAsB,CAAC,CAAC;AAC1F,aAAO,EAAE,IAAI,OAAO,OAAO,cAAc,OAAO;AAAA,IAClD;AAAA,EACF;AAAA,EAEQ,MAAM,SAA4C;AACxD,YAAQ,QAAQ,IAAI;AAAA,MAClB,KAAK;AACH,eAAO,KAAK,gBAAgB,OAAO;AAAA,MACrC,KAAK;AACH,eAAO,KAAK,eAAe,OAAO;AAAA,MACpC;AACE,cAAM,IAAI,qBAAqB,6BAA6B;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,WAAW,YAA8B;AAC/C,UAAM,SAAS,KAAK,SAAS,IAAI,UAAU;AAC3C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,qBAAqB,eAAe,UAAU,mCAAmC;AAAA,IAC7F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,gBAAgB,KAA2C;AACvE,UAAM,EAAE,OAAO,IAAI;AACnB,UAAM,MAAM,KAAK,WAAW,MAAM;AAClC,UAAM,WAAW,MAAM,IAAI,UAAU;AACrC,QAAI,eAAe,QAAQ,GAAG;AAC5B,YAAM,IAAI,qBAAqB,eAAe,MAAM,kDAAkD;AAAA,IACxG;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,MAAc,eAAe,KAIR;AACnB,UAAM,EAAE,QAAQ,MAAM,WAAW,KAAK,IAAI;AAC1C,UAAM,WAAW,MAAM,KAAK,WAAW,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAC7F,QAAI,eAAe,QAAQ,GAAG;AAC5B,YAAM,IAAI,qBAAqB,eAAe,MAAM,iDAAiD;AAAA,IACvG;AACA,QAAI,iCAAiC,QAAQ,GAAG;AAC9C,YAAM,IAAI,qBAAqB,SAAS,MAAM,IAAI,IAAI,wDAAwD;AAAA,IAChH;AACA,QAAI,CAAC,yBAAyB,QAAQ,GAAG;AACvC,YAAM,IAAI;AAAA,QACR,SAAS,MAAM,IAAI,IAAI;AAAA,MACzB;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/core/sandbox/codeMode/CodeModeDispatcher.ts"],"sourcesContent":["import { context, defaultTextMapGetter } from '@opentelemetry/api';\nimport { unsuppressTracing, W3CTraceContextPropagator } from '@opentelemetry/core';\nimport { McpConnectionError } from '../../errors';\nimport {\n  isAuthRequired,\n  isCallToolResponseCreateSubAgent,\n  isCallToolResponseResult,\n  type IToolSet,\n} from '../../mcp/IMCPServer';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeErrorSource, CodeModeReply, CodeModeRequest } from './types';\n\n/** Minimal logger surface used by Code Mode (avoids a hard winston dep for PoC binders). */\nexport interface CodeModeLogger {\n  child(bindings: Record<string, unknown>): CodeModeLogger;\n  error(message: string, meta?: unknown): void;\n}\n\n// Caller-caused failure: retrying won't help.\nclass InvalidMCPUsageError extends Error {\n  override readonly name = 'InvalidMCPUsageError';\n}\n\nfunction isHttpClientError(error: unknown): error is { status: number } {\n  if (typeof error !== 'object' || error === null || !('status' in error)) {\n    return false;\n  }\n  const { status } = error;\n  return typeof status === 'number' && status >= 400 && status < 500;\n}\n\nfunction classifyErrorSource(e: unknown): CodeModeErrorSource {\n  if (e instanceof InvalidMCPUsageError) {\n    return 'caller';\n  }\n  if (isHttpClientError(e)) {\n    return 'caller';\n  }\n  if (e instanceof McpConnectionError && e.statusCode >= 400 && e.statusCode < 500) {\n    return 'caller';\n  }\n  return 'internal';\n}\n\n// Direct W3C extractor, NOT the global `propagation` API. The gateway-wide propagator\n// refuses to restore traceparent unless internal-secret headers are present. Code Mode\n// is intra-process trusted, so we bypass that gate and honor the sandbox carrier.\nconst _w3cExtractor = new W3CTraceContextPropagator();\n\n/**\n * Shared Code Mode policy leaf: tool routing, authz, error `source`. No NATS/UDS.\n */\nexport class CodeModeDispatcher {\n  private readonly toolSets: Map<string, IToolSet>;\n  private readonly logger: CodeModeLogger;\n  private closed = false;\n\n  constructor(params: { toolSets: readonly IToolSet[]; logger: CodeModeLogger }) {\n    this.toolSets = new Map();\n    for (const server of params.toolSets) {\n      this.toolSets.set(server.name, server);\n    }\n    this.logger = params.logger.child({ module: 'CodeModeDispatcher' });\n  }\n\n  close(): void {\n    this.closed = true;\n  }\n\n  async dispatch(params: {\n    request: CodeModeRequest;\n    traceCarrier: Readonly<Record<string, string>>;\n  }): Promise<CodeModeReply> {\n    if (this.closed) {\n      return { ok: false, error: 'Code Mode dispatcher is closed', source: 'transport' };\n    }\n\n    const ctx = _w3cExtractor.extract(\n      unsuppressTracing(context.active()),\n      { ...params.traceCarrier },\n      defaultTextMapGetter,\n    );\n\n    try {\n      const result = await context.with(ctx, () => this.route(params.request));\n      return { ok: true, result };\n    } catch (e) {\n      const source = classifyErrorSource(e);\n      const errorMessage = e instanceof Error ? e.message : 'Unknown Code Mode dispatch error';\n      this.logger.error(`Code Mode dispatch failed (source=${source})`, extractErrorLogFields(e));\n      return { ok: false, error: errorMessage, source };\n    }\n  }\n\n  private route(request: CodeModeRequest): Promise<unknown> {\n    switch (request.op) {\n      case 'list_tools':\n        return this.handleListTools(request);\n      case 'call_tool':\n        return this.handleCallTool(request);\n      default:\n        throw new InvalidMCPUsageError(`Unknown Code Mode operation`);\n    }\n  }\n\n  private getToolSet(serverName: string): IToolSet {\n    const server = this.toolSets.get(serverName);\n    if (!server) {\n      throw new InvalidMCPUsageError(`MCP server '${serverName}' is not available for this agent`);\n    }\n    return server;\n  }\n\n  private async handleListTools(req: { server: string }): Promise<unknown> {\n    const { server } = req;\n    const mcp = this.getToolSet(server);\n    const response = await mcp.listTools();\n    if (isAuthRequired(response)) {\n      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot list tools from sandbox`);\n    }\n    return response.result;\n  }\n\n  private async handleCallTool(req: {\n    server: string;\n    tool: string;\n    arguments?: Record<string, unknown> | undefined;\n  }): Promise<unknown> {\n    const { server, tool, arguments: args } = req;\n    const response = await this.getToolSet(server).callTool({ name: tool, arguments: args ?? {} });\n    if (isAuthRequired(response)) {\n      throw new InvalidMCPUsageError(`MCP server '${server}' requires OAuth; cannot call tool from sandbox`);\n    }\n    if (isCallToolResponseCreateSubAgent(response)) {\n      throw new InvalidMCPUsageError(`Tool '${server}/${tool}' creates a sub-agent and is not callable from sandbox`);\n    }\n    if (!isCallToolResponseResult(response)) {\n      throw new InvalidMCPUsageError(\n        `Tool '${server}/${tool}' requires interactive handling and is not callable from sandbox`,\n      );\n    }\n    return response.result;\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS,4BAA4B;AAC9C,SAAS,mBAAmB,iCAAiC;AAC7D,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B;AAUtC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrB,OAAO;AAC3B;AAEA,SAAS,kBAAkB,OAA6C;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,YAAY,QAAQ;AACvE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,OAAO,IAAI;AACnB,SAAO,OAAO,WAAW,YAAY,UAAU,OAAO,SAAS;AACjE;AAEA,SAAS,oBAAoB,GAAiC;AAC5D,MAAI,aAAa,sBAAsB;AACrC,WAAO;AAAA,EACT;AACA,MAAI,kBAAkB,CAAC,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI,aAAa,sBAAsB,EAAE,cAAc,OAAO,EAAE,aAAa,KAAK;AAChF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAKA,IAAM,gBAAgB,IAAI,0BAA0B;AAK7C,IAAM,qBAAN,MAAyB;AAAA,EACb;AAAA,EACA;AAAA,EACT,SAAS;AAAA,EAEjB,YAAY,QAAmE;AAC7E,SAAK,WAAW,oBAAI,IAAI;AACxB,eAAW,UAAU,OAAO,UAAU;AACpC,WAAK,SAAS,IAAI,OAAO,MAAM,MAAM;AAAA,IACvC;AACA,SAAK,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACpE;AAAA,EAEA,QAAc;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,SAAS,QAGY;AACzB,QAAI,KAAK,QAAQ;AACf,aAAO,EAAE,IAAI,OAAO,OAAO,kCAAkC,QAAQ,YAAY;AAAA,IACnF;AAEA,UAAM,MAAM,cAAc;AAAA,MACxB,kBAAkB,QAAQ,OAAO,CAAC;AAAA,MAClC,EAAE,GAAG,OAAO,aAAa;AAAA,MACzB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,MAAM,KAAK,MAAM,OAAO,OAAO,CAAC;AACvE,aAAO,EAAE,IAAI,MAAM,OAAO;AAAA,IAC5B,SAAS,GAAG;AACV,YAAM,SAAS,oBAAoB,CAAC;AACpC,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU;AACtD,WAAK,OAAO,MAAM,qCAAqC,MAAM,KAAK,sBAAsB,CAAC,CAAC;AAC1F,aAAO,EAAE,IAAI,OAAO,OAAO,cAAc,OAAO;AAAA,IAClD;AAAA,EACF;AAAA,EAEQ,MAAM,SAA4C;AACxD,YAAQ,QAAQ,IAAI;AAAA,MAClB,KAAK;AACH,eAAO,KAAK,gBAAgB,OAAO;AAAA,MACrC,KAAK;AACH,eAAO,KAAK,eAAe,OAAO;AAAA,MACpC;AACE,cAAM,IAAI,qBAAqB,6BAA6B;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,WAAW,YAA8B;AAC/C,UAAM,SAAS,KAAK,SAAS,IAAI,UAAU;AAC3C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,qBAAqB,eAAe,UAAU,mCAAmC;AAAA,IAC7F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,gBAAgB,KAA2C;AACvE,UAAM,EAAE,OAAO,IAAI;AACnB,UAAM,MAAM,KAAK,WAAW,MAAM;AAClC,UAAM,WAAW,MAAM,IAAI,UAAU;AACrC,QAAI,eAAe,QAAQ,GAAG;AAC5B,YAAM,IAAI,qBAAqB,eAAe,MAAM,kDAAkD;AAAA,IACxG;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,MAAc,eAAe,KAIR;AACnB,UAAM,EAAE,QAAQ,MAAM,WAAW,KAAK,IAAI;AAC1C,UAAM,WAAW,MAAM,KAAK,WAAW,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAC7F,QAAI,eAAe,QAAQ,GAAG;AAC5B,YAAM,IAAI,qBAAqB,eAAe,MAAM,iDAAiD;AAAA,IACvG;AACA,QAAI,iCAAiC,QAAQ,GAAG;AAC9C,YAAM,IAAI,qBAAqB,SAAS,MAAM,IAAI,IAAI,wDAAwD;AAAA,IAChH;AACA,QAAI,CAAC,yBAAyB,QAAQ,GAAG;AACvC,YAAM,IAAI;AAAA,QACR,SAAS,MAAM,IAAI,IAAI;AAAA,MACzB;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AACF;","names":[]}

package/dist/core/sandbox/codeMode/nats/CodeModeNatsTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CodeModeNatsTransport.d.ts","sourceRoot":"","sources":["../../../../../src/core/sandbox/codeMode/nats/CodeModeNatsTransport.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAKtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAe9D;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,cAAc,CAAuD;IAC7E,OAAO,CAAC,EAAE,CAA6B;IACvC,OAAO,CAAC,UAAU,CAAiC;IAEnD,YAAY,MAAM,EAAE;QAClB,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC;KAChB,EAIA;IAED,KAAK,CAAC,MAAM,EAAE;QACZ,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC;QAClB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAO3C;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAqB1B;YAEa,cAAc;IAkD5B,OAAO,CAAC,SAAS;YAQH,aAAa;IA+C3B,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,MAAM;CAIf"}
+{"version":3,"file":"CodeModeNatsTransport.d.ts","sourceRoot":"","sources":["../../../../../src/core/sandbox/codeMode/nats/CodeModeNatsTransport.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAKtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAe9D;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,cAAc,CAAuD;IAC7E,OAAO,CAAC,EAAE,CAA6B;IACvC,OAAO,CAAC,UAAU,CAAiC;IAEnD,YAAY,MAAM,EAAE;QAClB,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC;KAChB,EAIA;IAED,KAAK,CAAC,MAAM,EAAE;QACZ,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC;QAClB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAO3C;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB1B;YAEa,cAAc;IAkD5B,OAAO,CAAC,SAAS;YAQH,aAAa;IAmD3B,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,MAAM;CAIf"}

package/dist/core/sandbox/codeMode/nats/CodeModeNatsTransport.js

@@ -70,7 +70,9 @@ var CodeModeNatsTransport = class {
     }
     const nc = this.nc;
     this.nc = void 0;
-    if (nc === void 0) return;
+    if (nc === void 0) {
+      return;
+    }
     try {
       await (0, import_promiseUtils.withTimeout)(nc.drain(), NATS_DRAIN_TIMEOUT_MS);
     } catch (e) {
@@ -151,8 +153,12 @@ var CodeModeNatsTransport = class {
     const carrier = {};
     const traceparent = msg.headers?.get("traceparent");
     const tracestate = msg.headers?.get("tracestate");
-    if (traceparent) carrier["traceparent"] = traceparent;
-    if (tracestate) carrier["tracestate"] = tracestate;
+    if (traceparent) {
+      carrier["traceparent"] = traceparent;
+    }
+    if (tracestate) {
+      carrier["tracestate"] = tracestate;
+    }
     let request;
     try {
       request = this.decode(msg);

package/dist/core/sandbox/codeMode/nats/CodeModeNatsTransport.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/core/sandbox/codeMode/nats/CodeModeNatsTransport.ts"],"sourcesContent":["import { wsconnect, type Msg, type NatsConnection } from '@nats-io/nats-core';\nimport { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'node:crypto';\nimport type { Logger } from 'winston';\nimport { WebSocket } from 'ws';\nimport { extractErrorLogFields } from '../../../util/errorLogFields';\nimport { withTimeout } from '../../../util/promiseUtils';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../../constants';\nimport type { CodeModeDispatcher } from '../CodeModeDispatcher';\nimport type { CodeModeTransport } from '../CodeModeTransport';\nimport { CodeModeRequestSchema, type CodeModeReply, type CodeModeRequest } from '../types';\n\n// `wsconnect` from @nats-io/nats-core relies on a global WebSocket constructor; in Node we\n// provide it from `ws`. Same pattern as `src/services/NatsService.ts`.\nObject.assign(global, { WebSocket });\n\nconst NATS_CONNECT_TIMEOUT_MS = 10_000;\nconst NATS_CONNECT_RETRIES = 3;\nconst NATS_CONNECT_BACKOFF_MS = 250;\nconst NATS_DRAIN_TIMEOUT_MS = 5_000;\n\nconst SANDBOX_NATS_SUBJECT_ROOT = 'sandbox.bridge';\nconst SANDBOX_NATS_MCP_LEAF = 'mcp';\n\n/**\n * NATS Code Mode transport. Session cache + connection-drop invalidate live here\n * (no `whenClosed` on the public interface).\n */\nexport class CodeModeNatsTransport implements CodeModeTransport {\n  private readonly resolveHostUrl: (sandboxId: string) => Promise<string>;\n  private readonly sandboxClientNatsUrl: string;\n  private readonly logger: Logger;\n\n  private sessionPromise: Promise<{ env: Record<string, string> }> | undefined;\n  private nc: NatsConnection | undefined;\n  private dispatcher: CodeModeDispatcher | undefined;\n\n  constructor(params: {\n    resolveHostUrl: (sandboxId: string) => Promise<string>;\n    sandboxClientNatsUrl?: string;\n    logger: Logger;\n  }) {\n    this.resolveHostUrl = params.resolveHostUrl;\n    this.sandboxClientNatsUrl = params.sandboxClientNatsUrl ?? `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`;\n    this.logger = params.logger.child({ module: 'CodeModeNatsTransport' });\n  }\n\n  start(params: {\n    codeModeDispatcher: CodeModeDispatcher;\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    this.dispatcher = params.codeModeDispatcher;\n    this.sessionPromise ??= this.connectSession(params).catch((e: unknown) => {\n      this.sessionPromise = undefined;\n      throw e;\n    });\n    return this.sessionPromise;\n  }\n\n  async stop(): Promise<void> {\n    const pending = this.sessionPromise;\n    this.sessionPromise = undefined;\n    if (pending !== undefined) {\n      try {\n        await pending;\n      } catch {\n        // Connect failed; nothing to drain.\n      }\n    }\n    const nc = this.nc;\n    this.nc = undefined;\n    if (nc === undefined) return;\n    try {\n      await withTimeout(nc.drain(), NATS_DRAIN_TIMEOUT_MS);\n    } catch (e) {\n      this.logger.warn('Code Mode NATS drain failed/timed out; forcing close', extractErrorLogFields(e));\n      await nc.close().catch(() => {\n        /* no-op */\n      });\n    }\n  }\n\n  private async connectSession(params: {\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    const url = await this.resolveHostUrl(params.sandboxId);\n    const subjectPrefix = `${SANDBOX_NATS_SUBJECT_ROOT}.${randomUUID()}`;\n    let lastErr: unknown;\n    let nc: NatsConnection | undefined;\n    for (let attempt = 1; attempt <= NATS_CONNECT_RETRIES; attempt++) {\n      try {\n        nc = await context.with(suppressTracing(context.active()), () =>\n          wsconnect({ servers: [url], timeout: NATS_CONNECT_TIMEOUT_MS }),\n        );\n        this.logger.info(`Connected to sandbox NATS (attempt ${String(attempt)})`, { subjectPrefix });\n        break;\n      } catch (e) {\n        lastErr = e;\n        this.logger.warn(`Code Mode NATS connect attempt ${String(attempt)} failed`, extractErrorLogFields(e));\n        if (attempt < NATS_CONNECT_RETRIES) {\n          await new Promise(resolve => setTimeout(resolve, NATS_CONNECT_BACKOFF_MS));\n        }\n      }\n    }\n    if (nc === undefined) {\n      throw lastErr instanceof Error ? lastErr : new Error('Code Mode NATS connect failed');\n    }\n\n    this.nc = nc;\n    this.subscribe(nc, subjectPrefix);\n\n    const cachedPromise = this.sessionPromise;\n    void nc.closed().then(() => {\n      if (this.sessionPromise === cachedPromise) {\n        this.sessionPromise = undefined;\n        this.nc = undefined;\n        this.logger.info('Code Mode NATS connection closed; session invalidated', {\n          sandboxId: params.sandboxId,\n        });\n      }\n    });\n\n    return {\n      env: {\n        TFY_NATS_URL: this.sandboxClientNatsUrl,\n        TFY_NATS_SUBJECT_PREFIX: subjectPrefix,\n        TFY_CM_REQUEST_TIMEOUT_SECONDS: String(params.requestTimeoutSeconds),\n      },\n    };\n  }\n\n  private subscribe(nc: NatsConnection, subjectPrefix: string): void {\n    nc.subscribe(`${subjectPrefix}.${SANDBOX_NATS_MCP_LEAF}`, {\n      callback: (err, msg) => {\n        void this.handleMessage(err, msg);\n      },\n    });\n  }\n\n  private async handleMessage(err: Error | null, msg: Msg): Promise<void> {\n    if (err) {\n      this.logger.error('Code Mode NATS subscription error', extractErrorLogFields(err));\n      return;\n    }\n    if (!msg.reply) {\n      this.logger.warn(`Code Mode NATS request on '${msg.subject}' has no reply subject; dropping`);\n      return;\n    }\n\n    const dispatcher = this.dispatcher;\n    if (dispatcher === undefined) {\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Code Mode dispatcher is not configured', source: 'internal' }));\n      } catch (e) {\n        this.logger.warn(`Failed to send dispatcher-missing reply on '${msg.subject}'`, extractErrorLogFields(e));\n      }\n      return;\n    }\n\n    const carrier: Record<string, string> = {};\n    const traceparent = msg.headers?.get('traceparent');\n    const tracestate = msg.headers?.get('tracestate');\n    if (traceparent) carrier['traceparent'] = traceparent;\n    if (tracestate) carrier['tracestate'] = tracestate;\n\n    let request: CodeModeRequest;\n    try {\n      request = this.decode(msg);\n    } catch (e) {\n      this.logger.error(`Failed to decode Code Mode NATS request on '${msg.subject}'`, extractErrorLogFields(e));\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Malformed Code Mode request', source: 'caller' }));\n      } catch (respondErr) {\n        this.logger.warn(`Failed to send decode-error reply on '${msg.subject}'`, extractErrorLogFields(respondErr));\n      }\n      return;\n    }\n\n    const reply = await dispatcher.dispatch({ request, traceCarrier: carrier });\n    try {\n      msg.respond(this.encode(reply));\n    } catch (e) {\n      this.logger.error('Failed to publish Code Mode NATS reply', extractErrorLogFields(e));\n    }\n  }\n\n  private encode(reply: CodeModeReply): Uint8Array {\n    return new TextEncoder().encode(JSON.stringify(reply));\n  }\n\n  private decode(msg: Msg): CodeModeRequest {\n    const raw: unknown = JSON.parse(new TextDecoder().decode(msg.data));\n    return CodeModeRequestSchema.parse(raw);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAyD;AACzD,iBAAwB;AACxB,kBAAgC;AAChC,yBAA2B;AAE3B,gBAA0B;AAC1B,4BAAsC;AACtC,0BAA4B;AAC5B,uBAA6C;AAG7C,mBAAgF;AAIhF,OAAO,OAAO,QAAQ,EAAE,+BAAU,CAAC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAE9B,IAAM,4BAA4B;AAClC,IAAM,wBAAwB;AAMvB,IAAM,wBAAN,MAAyD;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EAET;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAIT;AACD,SAAK,iBAAiB,OAAO;AAC7B,SAAK,uBAAuB,OAAO,wBAAwB,kBAAkB,OAAO,6CAA4B,CAAC;AACjH,SAAK,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QAIuC;AAC3C,SAAK,aAAa,OAAO;AACzB,SAAK,mBAAmB,KAAK,eAAe,MAAM,EAAE,MAAM,CAAC,MAAe;AACxE,WAAK,iBAAiB;AACtB,YAAM;AAAA,IACR,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,UAAU,KAAK;AACrB,SAAK,iBAAiB;AACtB,QAAI,YAAY,QAAW;AACzB,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK,KAAK;AAChB,SAAK,KAAK;AACV,QAAI,OAAO,OAAW;AACtB,QAAI;AACF,gBAAM,iCAAY,GAAG,MAAM,GAAG,qBAAqB;AAAA,IACrD,SAAS,GAAG;AACV,WAAK,OAAO,KAAK,4DAAwD,6CAAsB,CAAC,CAAC;AACjG,YAAM,GAAG,MAAM,EAAE,MAAM,MAAM;AAAA,MAE7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,QAGgB;AAC3C,UAAM,MAAM,MAAM,KAAK,eAAe,OAAO,SAAS;AACtD,UAAM,gBAAgB,GAAG,yBAAyB,QAAI,+BAAW,CAAC;AAClE,QAAI;AACJ,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,sBAAsB,WAAW;AAChE,UAAI;AACF,aAAK,MAAM,mBAAQ;AAAA,cAAK,6BAAgB,mBAAQ,OAAO,CAAC;AAAA,UAAG,UACzD,4BAAU,EAAE,SAAS,CAAC,GAAG,GAAG,SAAS,wBAAwB,CAAC;AAAA,QAChE;AACA,aAAK,OAAO,KAAK,sCAAsC,OAAO,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;AAC5F;AAAA,MACF,SAAS,GAAG;AACV,kBAAU;AACV,aAAK,OAAO,KAAK,kCAAkC,OAAO,OAAO,CAAC,eAAW,6CAAsB,CAAC,CAAC;AACrG,YAAI,UAAU,sBAAsB;AAClC,gBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,uBAAuB,CAAC;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,QAAW;AACpB,YAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,+BAA+B;AAAA,IACtF;AAEA,SAAK,KAAK;AACV,SAAK,UAAU,IAAI,aAAa;AAEhC,UAAM,gBAAgB,KAAK;AAC3B,SAAK,GAAG,OAAO,EAAE,KAAK,MAAM;AAC1B,UAAI,KAAK,mBAAmB,eAAe;AACzC,aAAK,iBAAiB;AACtB,aAAK,KAAK;AACV,aAAK,OAAO,KAAK,yDAAyD;AAAA,UACxE,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,KAAK;AAAA,QACH,cAAc,KAAK;AAAA,QACnB,yBAAyB;AAAA,QACzB,gCAAgC,OAAO,OAAO,qBAAqB;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,IAAoB,eAA6B;AACjE,OAAG,UAAU,GAAG,aAAa,IAAI,qBAAqB,IAAI;AAAA,MACxD,UAAU,CAAC,KAAK,QAAQ;AACtB,aAAK,KAAK,cAAc,KAAK,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cAAc,KAAmB,KAAyB;AACtE,QAAI,KAAK;AACP,WAAK,OAAO,MAAM,yCAAqC,6CAAsB,GAAG,CAAC;AACjF;AAAA,IACF;AACA,QAAI,CAAC,IAAI,OAAO;AACd,WAAK,OAAO,KAAK,8BAA8B,IAAI,OAAO,kCAAkC;AAC5F;AAAA,IACF;AAEA,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,0CAA0C,QAAQ,WAAW,CAAC,CAAC;AAAA,MAC7G,SAAS,GAAG;AACV,aAAK,OAAO,KAAK,+CAA+C,IAAI,OAAO,SAAK,6CAAsB,CAAC,CAAC;AAAA,MAC1G;AACA;AAAA,IACF;AAEA,UAAM,UAAkC,CAAC;AACzC,UAAM,cAAc,IAAI,SAAS,IAAI,aAAa;AAClD,UAAM,aAAa,IAAI,SAAS,IAAI,YAAY;AAChD,QAAI,YAAa,SAAQ,aAAa,IAAI;AAC1C,QAAI,WAAY,SAAQ,YAAY,IAAI;AAExC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,OAAO,GAAG;AAAA,IAC3B,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,+CAA+C,IAAI,OAAO,SAAK,6CAAsB,CAAC,CAAC;AACzG,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChG,SAAS,YAAY;AACnB,aAAK,OAAO,KAAK,yCAAyC,IAAI,OAAO,SAAK,6CAAsB,UAAU,CAAC;AAAA,MAC7G;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,WAAW,SAAS,EAAE,SAAS,cAAc,QAAQ,CAAC;AAC1E,QAAI;AACF,UAAI,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,IAChC,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,8CAA0C,6CAAsB,CAAC,CAAC;AAAA,IACtF;AAAA,EACF;AAAA,EAEQ,OAAO,OAAkC;AAC/C,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACvD;AAAA,EAEQ,OAAO,KAA2B;AACxC,UAAM,MAAe,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC;AAClE,WAAO,mCAAsB,MAAM,GAAG;AAAA,EACxC;AACF;","names":[]}
+{"version":3,"sources":["../../../../../src/core/sandbox/codeMode/nats/CodeModeNatsTransport.ts"],"sourcesContent":["import { wsconnect, type Msg, type NatsConnection } from '@nats-io/nats-core';\nimport { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'node:crypto';\nimport type { Logger } from 'winston';\nimport { WebSocket } from 'ws';\nimport { extractErrorLogFields } from '../../../util/errorLogFields';\nimport { withTimeout } from '../../../util/promiseUtils';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../../constants';\nimport type { CodeModeDispatcher } from '../CodeModeDispatcher';\nimport type { CodeModeTransport } from '../CodeModeTransport';\nimport { CodeModeRequestSchema, type CodeModeReply, type CodeModeRequest } from '../types';\n\n// `wsconnect` from @nats-io/nats-core relies on a global WebSocket constructor; in Node we\n// provide it from `ws`. Same pattern as `src/services/NatsService.ts`.\nObject.assign(global, { WebSocket });\n\nconst NATS_CONNECT_TIMEOUT_MS = 10_000;\nconst NATS_CONNECT_RETRIES = 3;\nconst NATS_CONNECT_BACKOFF_MS = 250;\nconst NATS_DRAIN_TIMEOUT_MS = 5_000;\n\nconst SANDBOX_NATS_SUBJECT_ROOT = 'sandbox.bridge';\nconst SANDBOX_NATS_MCP_LEAF = 'mcp';\n\n/**\n * NATS Code Mode transport. Session cache + connection-drop invalidate live here\n * (no `whenClosed` on the public interface).\n */\nexport class CodeModeNatsTransport implements CodeModeTransport {\n  private readonly resolveHostUrl: (sandboxId: string) => Promise<string>;\n  private readonly sandboxClientNatsUrl: string;\n  private readonly logger: Logger;\n\n  private sessionPromise: Promise<{ env: Record<string, string> }> | undefined;\n  private nc: NatsConnection | undefined;\n  private dispatcher: CodeModeDispatcher | undefined;\n\n  constructor(params: {\n    resolveHostUrl: (sandboxId: string) => Promise<string>;\n    sandboxClientNatsUrl?: string;\n    logger: Logger;\n  }) {\n    this.resolveHostUrl = params.resolveHostUrl;\n    this.sandboxClientNatsUrl = params.sandboxClientNatsUrl ?? `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`;\n    this.logger = params.logger.child({ module: 'CodeModeNatsTransport' });\n  }\n\n  start(params: {\n    codeModeDispatcher: CodeModeDispatcher;\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    this.dispatcher = params.codeModeDispatcher;\n    this.sessionPromise ??= this.connectSession(params).catch((e: unknown) => {\n      this.sessionPromise = undefined;\n      throw e;\n    });\n    return this.sessionPromise;\n  }\n\n  async stop(): Promise<void> {\n    const pending = this.sessionPromise;\n    this.sessionPromise = undefined;\n    if (pending !== undefined) {\n      try {\n        await pending;\n      } catch {\n        // Connect failed; nothing to drain.\n      }\n    }\n    const nc = this.nc;\n    this.nc = undefined;\n    if (nc === undefined) {\n      return;\n    }\n    try {\n      await withTimeout(nc.drain(), NATS_DRAIN_TIMEOUT_MS);\n    } catch (e) {\n      this.logger.warn('Code Mode NATS drain failed/timed out; forcing close', extractErrorLogFields(e));\n      await nc.close().catch(() => {\n        /* no-op */\n      });\n    }\n  }\n\n  private async connectSession(params: {\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    const url = await this.resolveHostUrl(params.sandboxId);\n    const subjectPrefix = `${SANDBOX_NATS_SUBJECT_ROOT}.${randomUUID()}`;\n    let lastErr: unknown;\n    let nc: NatsConnection | undefined;\n    for (let attempt = 1; attempt <= NATS_CONNECT_RETRIES; attempt++) {\n      try {\n        nc = await context.with(suppressTracing(context.active()), () =>\n          wsconnect({ servers: [url], timeout: NATS_CONNECT_TIMEOUT_MS }),\n        );\n        this.logger.info(`Connected to sandbox NATS (attempt ${String(attempt)})`, { subjectPrefix });\n        break;\n      } catch (e) {\n        lastErr = e;\n        this.logger.warn(`Code Mode NATS connect attempt ${String(attempt)} failed`, extractErrorLogFields(e));\n        if (attempt < NATS_CONNECT_RETRIES) {\n          await new Promise(resolve => setTimeout(resolve, NATS_CONNECT_BACKOFF_MS));\n        }\n      }\n    }\n    if (nc === undefined) {\n      throw lastErr instanceof Error ? lastErr : new Error('Code Mode NATS connect failed');\n    }\n\n    this.nc = nc;\n    this.subscribe(nc, subjectPrefix);\n\n    const cachedPromise = this.sessionPromise;\n    void nc.closed().then(() => {\n      if (this.sessionPromise === cachedPromise) {\n        this.sessionPromise = undefined;\n        this.nc = undefined;\n        this.logger.info('Code Mode NATS connection closed; session invalidated', {\n          sandboxId: params.sandboxId,\n        });\n      }\n    });\n\n    return {\n      env: {\n        TFY_NATS_URL: this.sandboxClientNatsUrl,\n        TFY_NATS_SUBJECT_PREFIX: subjectPrefix,\n        TFY_CM_REQUEST_TIMEOUT_SECONDS: String(params.requestTimeoutSeconds),\n      },\n    };\n  }\n\n  private subscribe(nc: NatsConnection, subjectPrefix: string): void {\n    nc.subscribe(`${subjectPrefix}.${SANDBOX_NATS_MCP_LEAF}`, {\n      callback: (err, msg) => {\n        void this.handleMessage(err, msg);\n      },\n    });\n  }\n\n  private async handleMessage(err: Error | null, msg: Msg): Promise<void> {\n    if (err) {\n      this.logger.error('Code Mode NATS subscription error', extractErrorLogFields(err));\n      return;\n    }\n    if (!msg.reply) {\n      this.logger.warn(`Code Mode NATS request on '${msg.subject}' has no reply subject; dropping`);\n      return;\n    }\n\n    const dispatcher = this.dispatcher;\n    if (dispatcher === undefined) {\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Code Mode dispatcher is not configured', source: 'internal' }));\n      } catch (e) {\n        this.logger.warn(`Failed to send dispatcher-missing reply on '${msg.subject}'`, extractErrorLogFields(e));\n      }\n      return;\n    }\n\n    const carrier: Record<string, string> = {};\n    const traceparent = msg.headers?.get('traceparent');\n    const tracestate = msg.headers?.get('tracestate');\n    if (traceparent) {\n      carrier['traceparent'] = traceparent;\n    }\n    if (tracestate) {\n      carrier['tracestate'] = tracestate;\n    }\n\n    let request: CodeModeRequest;\n    try {\n      request = this.decode(msg);\n    } catch (e) {\n      this.logger.error(`Failed to decode Code Mode NATS request on '${msg.subject}'`, extractErrorLogFields(e));\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Malformed Code Mode request', source: 'caller' }));\n      } catch (respondErr) {\n        this.logger.warn(`Failed to send decode-error reply on '${msg.subject}'`, extractErrorLogFields(respondErr));\n      }\n      return;\n    }\n\n    const reply = await dispatcher.dispatch({ request, traceCarrier: carrier });\n    try {\n      msg.respond(this.encode(reply));\n    } catch (e) {\n      this.logger.error('Failed to publish Code Mode NATS reply', extractErrorLogFields(e));\n    }\n  }\n\n  private encode(reply: CodeModeReply): Uint8Array {\n    return new TextEncoder().encode(JSON.stringify(reply));\n  }\n\n  private decode(msg: Msg): CodeModeRequest {\n    const raw: unknown = JSON.parse(new TextDecoder().decode(msg.data));\n    return CodeModeRequestSchema.parse(raw);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAyD;AACzD,iBAAwB;AACxB,kBAAgC;AAChC,yBAA2B;AAE3B,gBAA0B;AAC1B,4BAAsC;AACtC,0BAA4B;AAC5B,uBAA6C;AAG7C,mBAAgF;AAIhF,OAAO,OAAO,QAAQ,EAAE,+BAAU,CAAC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAE9B,IAAM,4BAA4B;AAClC,IAAM,wBAAwB;AAMvB,IAAM,wBAAN,MAAyD;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EAET;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAIT;AACD,SAAK,iBAAiB,OAAO;AAC7B,SAAK,uBAAuB,OAAO,wBAAwB,kBAAkB,OAAO,6CAA4B,CAAC;AACjH,SAAK,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QAIuC;AAC3C,SAAK,aAAa,OAAO;AACzB,SAAK,mBAAmB,KAAK,eAAe,MAAM,EAAE,MAAM,CAAC,MAAe;AACxE,WAAK,iBAAiB;AACtB,YAAM;AAAA,IACR,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,UAAU,KAAK;AACrB,SAAK,iBAAiB;AACtB,QAAI,YAAY,QAAW;AACzB,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK,KAAK;AAChB,SAAK,KAAK;AACV,QAAI,OAAO,QAAW;AACpB;AAAA,IACF;AACA,QAAI;AACF,gBAAM,iCAAY,GAAG,MAAM,GAAG,qBAAqB;AAAA,IACrD,SAAS,GAAG;AACV,WAAK,OAAO,KAAK,4DAAwD,6CAAsB,CAAC,CAAC;AACjG,YAAM,GAAG,MAAM,EAAE,MAAM,MAAM;AAAA,MAE7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,QAGgB;AAC3C,UAAM,MAAM,MAAM,KAAK,eAAe,OAAO,SAAS;AACtD,UAAM,gBAAgB,GAAG,yBAAyB,QAAI,+BAAW,CAAC;AAClE,QAAI;AACJ,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,sBAAsB,WAAW;AAChE,UAAI;AACF,aAAK,MAAM,mBAAQ;AAAA,cAAK,6BAAgB,mBAAQ,OAAO,CAAC;AAAA,UAAG,UACzD,4BAAU,EAAE,SAAS,CAAC,GAAG,GAAG,SAAS,wBAAwB,CAAC;AAAA,QAChE;AACA,aAAK,OAAO,KAAK,sCAAsC,OAAO,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;AAC5F;AAAA,MACF,SAAS,GAAG;AACV,kBAAU;AACV,aAAK,OAAO,KAAK,kCAAkC,OAAO,OAAO,CAAC,eAAW,6CAAsB,CAAC,CAAC;AACrG,YAAI,UAAU,sBAAsB;AAClC,gBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,uBAAuB,CAAC;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,QAAW;AACpB,YAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,+BAA+B;AAAA,IACtF;AAEA,SAAK,KAAK;AACV,SAAK,UAAU,IAAI,aAAa;AAEhC,UAAM,gBAAgB,KAAK;AAC3B,SAAK,GAAG,OAAO,EAAE,KAAK,MAAM;AAC1B,UAAI,KAAK,mBAAmB,eAAe;AACzC,aAAK,iBAAiB;AACtB,aAAK,KAAK;AACV,aAAK,OAAO,KAAK,yDAAyD;AAAA,UACxE,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,KAAK;AAAA,QACH,cAAc,KAAK;AAAA,QACnB,yBAAyB;AAAA,QACzB,gCAAgC,OAAO,OAAO,qBAAqB;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,IAAoB,eAA6B;AACjE,OAAG,UAAU,GAAG,aAAa,IAAI,qBAAqB,IAAI;AAAA,MACxD,UAAU,CAAC,KAAK,QAAQ;AACtB,aAAK,KAAK,cAAc,KAAK,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cAAc,KAAmB,KAAyB;AACtE,QAAI,KAAK;AACP,WAAK,OAAO,MAAM,yCAAqC,6CAAsB,GAAG,CAAC;AACjF;AAAA,IACF;AACA,QAAI,CAAC,IAAI,OAAO;AACd,WAAK,OAAO,KAAK,8BAA8B,IAAI,OAAO,kCAAkC;AAC5F;AAAA,IACF;AAEA,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,0CAA0C,QAAQ,WAAW,CAAC,CAAC;AAAA,MAC7G,SAAS,GAAG;AACV,aAAK,OAAO,KAAK,+CAA+C,IAAI,OAAO,SAAK,6CAAsB,CAAC,CAAC;AAAA,MAC1G;AACA;AAAA,IACF;AAEA,UAAM,UAAkC,CAAC;AACzC,UAAM,cAAc,IAAI,SAAS,IAAI,aAAa;AAClD,UAAM,aAAa,IAAI,SAAS,IAAI,YAAY;AAChD,QAAI,aAAa;AACf,cAAQ,aAAa,IAAI;AAAA,IAC3B;AACA,QAAI,YAAY;AACd,cAAQ,YAAY,IAAI;AAAA,IAC1B;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,OAAO,GAAG;AAAA,IAC3B,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,+CAA+C,IAAI,OAAO,SAAK,6CAAsB,CAAC,CAAC;AACzG,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChG,SAAS,YAAY;AACnB,aAAK,OAAO,KAAK,yCAAyC,IAAI,OAAO,SAAK,6CAAsB,UAAU,CAAC;AAAA,MAC7G;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,WAAW,SAAS,EAAE,SAAS,cAAc,QAAQ,CAAC;AAC1E,QAAI;AACF,UAAI,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,IAChC,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,8CAA0C,6CAAsB,CAAC,CAAC;AAAA,IACtF;AAAA,EACF;AAAA,EAEQ,OAAO,OAAkC;AAC/C,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACvD;AAAA,EAEQ,OAAO,KAA2B;AACxC,UAAM,MAAe,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC;AAClE,WAAO,mCAAsB,MAAM,GAAG;AAAA,EACxC;AACF;","names":[]}

package/dist/core/sandbox/codeMode/nats/CodeModeNatsTransport.mjs

@@ -46,7 +46,9 @@ var CodeModeNatsTransport = class {
     }
     const nc = this.nc;
     this.nc = void 0;
-    if (nc === void 0) return;
+    if (nc === void 0) {
+      return;
+    }
     try {
       await withTimeout(nc.drain(), NATS_DRAIN_TIMEOUT_MS);
     } catch (e) {
@@ -127,8 +129,12 @@ var CodeModeNatsTransport = class {
     const carrier = {};
     const traceparent = msg.headers?.get("traceparent");
     const tracestate = msg.headers?.get("tracestate");
-    if (traceparent) carrier["traceparent"] = traceparent;
-    if (tracestate) carrier["tracestate"] = tracestate;
+    if (traceparent) {
+      carrier["traceparent"] = traceparent;
+    }
+    if (tracestate) {
+      carrier["tracestate"] = tracestate;
+    }
     let request;
     try {
       request = this.decode(msg);

package/dist/core/sandbox/codeMode/nats/CodeModeNatsTransport.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/core/sandbox/codeMode/nats/CodeModeNatsTransport.ts"],"sourcesContent":["import { wsconnect, type Msg, type NatsConnection } from '@nats-io/nats-core';\nimport { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'node:crypto';\nimport type { Logger } from 'winston';\nimport { WebSocket } from 'ws';\nimport { extractErrorLogFields } from '../../../util/errorLogFields';\nimport { withTimeout } from '../../../util/promiseUtils';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../../constants';\nimport type { CodeModeDispatcher } from '../CodeModeDispatcher';\nimport type { CodeModeTransport } from '../CodeModeTransport';\nimport { CodeModeRequestSchema, type CodeModeReply, type CodeModeRequest } from '../types';\n\n// `wsconnect` from @nats-io/nats-core relies on a global WebSocket constructor; in Node we\n// provide it from `ws`. Same pattern as `src/services/NatsService.ts`.\nObject.assign(global, { WebSocket });\n\nconst NATS_CONNECT_TIMEOUT_MS = 10_000;\nconst NATS_CONNECT_RETRIES = 3;\nconst NATS_CONNECT_BACKOFF_MS = 250;\nconst NATS_DRAIN_TIMEOUT_MS = 5_000;\n\nconst SANDBOX_NATS_SUBJECT_ROOT = 'sandbox.bridge';\nconst SANDBOX_NATS_MCP_LEAF = 'mcp';\n\n/**\n * NATS Code Mode transport. Session cache + connection-drop invalidate live here\n * (no `whenClosed` on the public interface).\n */\nexport class CodeModeNatsTransport implements CodeModeTransport {\n  private readonly resolveHostUrl: (sandboxId: string) => Promise<string>;\n  private readonly sandboxClientNatsUrl: string;\n  private readonly logger: Logger;\n\n  private sessionPromise: Promise<{ env: Record<string, string> }> | undefined;\n  private nc: NatsConnection | undefined;\n  private dispatcher: CodeModeDispatcher | undefined;\n\n  constructor(params: {\n    resolveHostUrl: (sandboxId: string) => Promise<string>;\n    sandboxClientNatsUrl?: string;\n    logger: Logger;\n  }) {\n    this.resolveHostUrl = params.resolveHostUrl;\n    this.sandboxClientNatsUrl = params.sandboxClientNatsUrl ?? `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`;\n    this.logger = params.logger.child({ module: 'CodeModeNatsTransport' });\n  }\n\n  start(params: {\n    codeModeDispatcher: CodeModeDispatcher;\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    this.dispatcher = params.codeModeDispatcher;\n    this.sessionPromise ??= this.connectSession(params).catch((e: unknown) => {\n      this.sessionPromise = undefined;\n      throw e;\n    });\n    return this.sessionPromise;\n  }\n\n  async stop(): Promise<void> {\n    const pending = this.sessionPromise;\n    this.sessionPromise = undefined;\n    if (pending !== undefined) {\n      try {\n        await pending;\n      } catch {\n        // Connect failed; nothing to drain.\n      }\n    }\n    const nc = this.nc;\n    this.nc = undefined;\n    if (nc === undefined) return;\n    try {\n      await withTimeout(nc.drain(), NATS_DRAIN_TIMEOUT_MS);\n    } catch (e) {\n      this.logger.warn('Code Mode NATS drain failed/timed out; forcing close', extractErrorLogFields(e));\n      await nc.close().catch(() => {\n        /* no-op */\n      });\n    }\n  }\n\n  private async connectSession(params: {\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    const url = await this.resolveHostUrl(params.sandboxId);\n    const subjectPrefix = `${SANDBOX_NATS_SUBJECT_ROOT}.${randomUUID()}`;\n    let lastErr: unknown;\n    let nc: NatsConnection | undefined;\n    for (let attempt = 1; attempt <= NATS_CONNECT_RETRIES; attempt++) {\n      try {\n        nc = await context.with(suppressTracing(context.active()), () =>\n          wsconnect({ servers: [url], timeout: NATS_CONNECT_TIMEOUT_MS }),\n        );\n        this.logger.info(`Connected to sandbox NATS (attempt ${String(attempt)})`, { subjectPrefix });\n        break;\n      } catch (e) {\n        lastErr = e;\n        this.logger.warn(`Code Mode NATS connect attempt ${String(attempt)} failed`, extractErrorLogFields(e));\n        if (attempt < NATS_CONNECT_RETRIES) {\n          await new Promise(resolve => setTimeout(resolve, NATS_CONNECT_BACKOFF_MS));\n        }\n      }\n    }\n    if (nc === undefined) {\n      throw lastErr instanceof Error ? lastErr : new Error('Code Mode NATS connect failed');\n    }\n\n    this.nc = nc;\n    this.subscribe(nc, subjectPrefix);\n\n    const cachedPromise = this.sessionPromise;\n    void nc.closed().then(() => {\n      if (this.sessionPromise === cachedPromise) {\n        this.sessionPromise = undefined;\n        this.nc = undefined;\n        this.logger.info('Code Mode NATS connection closed; session invalidated', {\n          sandboxId: params.sandboxId,\n        });\n      }\n    });\n\n    return {\n      env: {\n        TFY_NATS_URL: this.sandboxClientNatsUrl,\n        TFY_NATS_SUBJECT_PREFIX: subjectPrefix,\n        TFY_CM_REQUEST_TIMEOUT_SECONDS: String(params.requestTimeoutSeconds),\n      },\n    };\n  }\n\n  private subscribe(nc: NatsConnection, subjectPrefix: string): void {\n    nc.subscribe(`${subjectPrefix}.${SANDBOX_NATS_MCP_LEAF}`, {\n      callback: (err, msg) => {\n        void this.handleMessage(err, msg);\n      },\n    });\n  }\n\n  private async handleMessage(err: Error | null, msg: Msg): Promise<void> {\n    if (err) {\n      this.logger.error('Code Mode NATS subscription error', extractErrorLogFields(err));\n      return;\n    }\n    if (!msg.reply) {\n      this.logger.warn(`Code Mode NATS request on '${msg.subject}' has no reply subject; dropping`);\n      return;\n    }\n\n    const dispatcher = this.dispatcher;\n    if (dispatcher === undefined) {\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Code Mode dispatcher is not configured', source: 'internal' }));\n      } catch (e) {\n        this.logger.warn(`Failed to send dispatcher-missing reply on '${msg.subject}'`, extractErrorLogFields(e));\n      }\n      return;\n    }\n\n    const carrier: Record<string, string> = {};\n    const traceparent = msg.headers?.get('traceparent');\n    const tracestate = msg.headers?.get('tracestate');\n    if (traceparent) carrier['traceparent'] = traceparent;\n    if (tracestate) carrier['tracestate'] = tracestate;\n\n    let request: CodeModeRequest;\n    try {\n      request = this.decode(msg);\n    } catch (e) {\n      this.logger.error(`Failed to decode Code Mode NATS request on '${msg.subject}'`, extractErrorLogFields(e));\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Malformed Code Mode request', source: 'caller' }));\n      } catch (respondErr) {\n        this.logger.warn(`Failed to send decode-error reply on '${msg.subject}'`, extractErrorLogFields(respondErr));\n      }\n      return;\n    }\n\n    const reply = await dispatcher.dispatch({ request, traceCarrier: carrier });\n    try {\n      msg.respond(this.encode(reply));\n    } catch (e) {\n      this.logger.error('Failed to publish Code Mode NATS reply', extractErrorLogFields(e));\n    }\n  }\n\n  private encode(reply: CodeModeReply): Uint8Array {\n    return new TextEncoder().encode(JSON.stringify(reply));\n  }\n\n  private decode(msg: Msg): CodeModeRequest {\n    const raw: unknown = JSON.parse(new TextDecoder().decode(msg.data));\n    return CodeModeRequestSchema.parse(raw);\n  }\n}\n"],"mappings":";AAAA,SAAS,iBAAgD;AACzD,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAE3B,SAAS,iBAAiB;AAC1B,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAC5B,SAAS,oCAAoC;AAG7C,SAAS,6BAAuE;AAIhF,OAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAE9B,IAAM,4BAA4B;AAClC,IAAM,wBAAwB;AAMvB,IAAM,wBAAN,MAAyD;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EAET;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAIT;AACD,SAAK,iBAAiB,OAAO;AAC7B,SAAK,uBAAuB,OAAO,wBAAwB,kBAAkB,OAAO,4BAA4B,CAAC;AACjH,SAAK,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QAIuC;AAC3C,SAAK,aAAa,OAAO;AACzB,SAAK,mBAAmB,KAAK,eAAe,MAAM,EAAE,MAAM,CAAC,MAAe;AACxE,WAAK,iBAAiB;AACtB,YAAM;AAAA,IACR,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,UAAU,KAAK;AACrB,SAAK,iBAAiB;AACtB,QAAI,YAAY,QAAW;AACzB,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK,KAAK;AAChB,SAAK,KAAK;AACV,QAAI,OAAO,OAAW;AACtB,QAAI;AACF,YAAM,YAAY,GAAG,MAAM,GAAG,qBAAqB;AAAA,IACrD,SAAS,GAAG;AACV,WAAK,OAAO,KAAK,wDAAwD,sBAAsB,CAAC,CAAC;AACjG,YAAM,GAAG,MAAM,EAAE,MAAM,MAAM;AAAA,MAE7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,QAGgB;AAC3C,UAAM,MAAM,MAAM,KAAK,eAAe,OAAO,SAAS;AACtD,UAAM,gBAAgB,GAAG,yBAAyB,IAAI,WAAW,CAAC;AAClE,QAAI;AACJ,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,sBAAsB,WAAW;AAChE,UAAI;AACF,aAAK,MAAM,QAAQ;AAAA,UAAK,gBAAgB,QAAQ,OAAO,CAAC;AAAA,UAAG,MACzD,UAAU,EAAE,SAAS,CAAC,GAAG,GAAG,SAAS,wBAAwB,CAAC;AAAA,QAChE;AACA,aAAK,OAAO,KAAK,sCAAsC,OAAO,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;AAC5F;AAAA,MACF,SAAS,GAAG;AACV,kBAAU;AACV,aAAK,OAAO,KAAK,kCAAkC,OAAO,OAAO,CAAC,WAAW,sBAAsB,CAAC,CAAC;AACrG,YAAI,UAAU,sBAAsB;AAClC,gBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,uBAAuB,CAAC;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,QAAW;AACpB,YAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,+BAA+B;AAAA,IACtF;AAEA,SAAK,KAAK;AACV,SAAK,UAAU,IAAI,aAAa;AAEhC,UAAM,gBAAgB,KAAK;AAC3B,SAAK,GAAG,OAAO,EAAE,KAAK,MAAM;AAC1B,UAAI,KAAK,mBAAmB,eAAe;AACzC,aAAK,iBAAiB;AACtB,aAAK,KAAK;AACV,aAAK,OAAO,KAAK,yDAAyD;AAAA,UACxE,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,KAAK;AAAA,QACH,cAAc,KAAK;AAAA,QACnB,yBAAyB;AAAA,QACzB,gCAAgC,OAAO,OAAO,qBAAqB;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,IAAoB,eAA6B;AACjE,OAAG,UAAU,GAAG,aAAa,IAAI,qBAAqB,IAAI;AAAA,MACxD,UAAU,CAAC,KAAK,QAAQ;AACtB,aAAK,KAAK,cAAc,KAAK,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cAAc,KAAmB,KAAyB;AACtE,QAAI,KAAK;AACP,WAAK,OAAO,MAAM,qCAAqC,sBAAsB,GAAG,CAAC;AACjF;AAAA,IACF;AACA,QAAI,CAAC,IAAI,OAAO;AACd,WAAK,OAAO,KAAK,8BAA8B,IAAI,OAAO,kCAAkC;AAC5F;AAAA,IACF;AAEA,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,0CAA0C,QAAQ,WAAW,CAAC,CAAC;AAAA,MAC7G,SAAS,GAAG;AACV,aAAK,OAAO,KAAK,+CAA+C,IAAI,OAAO,KAAK,sBAAsB,CAAC,CAAC;AAAA,MAC1G;AACA;AAAA,IACF;AAEA,UAAM,UAAkC,CAAC;AACzC,UAAM,cAAc,IAAI,SAAS,IAAI,aAAa;AAClD,UAAM,aAAa,IAAI,SAAS,IAAI,YAAY;AAChD,QAAI,YAAa,SAAQ,aAAa,IAAI;AAC1C,QAAI,WAAY,SAAQ,YAAY,IAAI;AAExC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,OAAO,GAAG;AAAA,IAC3B,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,+CAA+C,IAAI,OAAO,KAAK,sBAAsB,CAAC,CAAC;AACzG,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChG,SAAS,YAAY;AACnB,aAAK,OAAO,KAAK,yCAAyC,IAAI,OAAO,KAAK,sBAAsB,UAAU,CAAC;AAAA,MAC7G;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,WAAW,SAAS,EAAE,SAAS,cAAc,QAAQ,CAAC;AAC1E,QAAI;AACF,UAAI,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,IAChC,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,0CAA0C,sBAAsB,CAAC,CAAC;AAAA,IACtF;AAAA,EACF;AAAA,EAEQ,OAAO,OAAkC;AAC/C,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACvD;AAAA,EAEQ,OAAO,KAA2B;AACxC,UAAM,MAAe,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC;AAClE,WAAO,sBAAsB,MAAM,GAAG;AAAA,EACxC;AACF;","names":[]}
+{"version":3,"sources":["../../../../../src/core/sandbox/codeMode/nats/CodeModeNatsTransport.ts"],"sourcesContent":["import { wsconnect, type Msg, type NatsConnection } from '@nats-io/nats-core';\nimport { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'node:crypto';\nimport type { Logger } from 'winston';\nimport { WebSocket } from 'ws';\nimport { extractErrorLogFields } from '../../../util/errorLogFields';\nimport { withTimeout } from '../../../util/promiseUtils';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../../constants';\nimport type { CodeModeDispatcher } from '../CodeModeDispatcher';\nimport type { CodeModeTransport } from '../CodeModeTransport';\nimport { CodeModeRequestSchema, type CodeModeReply, type CodeModeRequest } from '../types';\n\n// `wsconnect` from @nats-io/nats-core relies on a global WebSocket constructor; in Node we\n// provide it from `ws`. Same pattern as `src/services/NatsService.ts`.\nObject.assign(global, { WebSocket });\n\nconst NATS_CONNECT_TIMEOUT_MS = 10_000;\nconst NATS_CONNECT_RETRIES = 3;\nconst NATS_CONNECT_BACKOFF_MS = 250;\nconst NATS_DRAIN_TIMEOUT_MS = 5_000;\n\nconst SANDBOX_NATS_SUBJECT_ROOT = 'sandbox.bridge';\nconst SANDBOX_NATS_MCP_LEAF = 'mcp';\n\n/**\n * NATS Code Mode transport. Session cache + connection-drop invalidate live here\n * (no `whenClosed` on the public interface).\n */\nexport class CodeModeNatsTransport implements CodeModeTransport {\n  private readonly resolveHostUrl: (sandboxId: string) => Promise<string>;\n  private readonly sandboxClientNatsUrl: string;\n  private readonly logger: Logger;\n\n  private sessionPromise: Promise<{ env: Record<string, string> }> | undefined;\n  private nc: NatsConnection | undefined;\n  private dispatcher: CodeModeDispatcher | undefined;\n\n  constructor(params: {\n    resolveHostUrl: (sandboxId: string) => Promise<string>;\n    sandboxClientNatsUrl?: string;\n    logger: Logger;\n  }) {\n    this.resolveHostUrl = params.resolveHostUrl;\n    this.sandboxClientNatsUrl = params.sandboxClientNatsUrl ?? `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`;\n    this.logger = params.logger.child({ module: 'CodeModeNatsTransport' });\n  }\n\n  start(params: {\n    codeModeDispatcher: CodeModeDispatcher;\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    this.dispatcher = params.codeModeDispatcher;\n    this.sessionPromise ??= this.connectSession(params).catch((e: unknown) => {\n      this.sessionPromise = undefined;\n      throw e;\n    });\n    return this.sessionPromise;\n  }\n\n  async stop(): Promise<void> {\n    const pending = this.sessionPromise;\n    this.sessionPromise = undefined;\n    if (pending !== undefined) {\n      try {\n        await pending;\n      } catch {\n        // Connect failed; nothing to drain.\n      }\n    }\n    const nc = this.nc;\n    this.nc = undefined;\n    if (nc === undefined) {\n      return;\n    }\n    try {\n      await withTimeout(nc.drain(), NATS_DRAIN_TIMEOUT_MS);\n    } catch (e) {\n      this.logger.warn('Code Mode NATS drain failed/timed out; forcing close', extractErrorLogFields(e));\n      await nc.close().catch(() => {\n        /* no-op */\n      });\n    }\n  }\n\n  private async connectSession(params: {\n    sandboxId: string;\n    requestTimeoutSeconds: number;\n  }): Promise<{ env: Record<string, string> }> {\n    const url = await this.resolveHostUrl(params.sandboxId);\n    const subjectPrefix = `${SANDBOX_NATS_SUBJECT_ROOT}.${randomUUID()}`;\n    let lastErr: unknown;\n    let nc: NatsConnection | undefined;\n    for (let attempt = 1; attempt <= NATS_CONNECT_RETRIES; attempt++) {\n      try {\n        nc = await context.with(suppressTracing(context.active()), () =>\n          wsconnect({ servers: [url], timeout: NATS_CONNECT_TIMEOUT_MS }),\n        );\n        this.logger.info(`Connected to sandbox NATS (attempt ${String(attempt)})`, { subjectPrefix });\n        break;\n      } catch (e) {\n        lastErr = e;\n        this.logger.warn(`Code Mode NATS connect attempt ${String(attempt)} failed`, extractErrorLogFields(e));\n        if (attempt < NATS_CONNECT_RETRIES) {\n          await new Promise(resolve => setTimeout(resolve, NATS_CONNECT_BACKOFF_MS));\n        }\n      }\n    }\n    if (nc === undefined) {\n      throw lastErr instanceof Error ? lastErr : new Error('Code Mode NATS connect failed');\n    }\n\n    this.nc = nc;\n    this.subscribe(nc, subjectPrefix);\n\n    const cachedPromise = this.sessionPromise;\n    void nc.closed().then(() => {\n      if (this.sessionPromise === cachedPromise) {\n        this.sessionPromise = undefined;\n        this.nc = undefined;\n        this.logger.info('Code Mode NATS connection closed; session invalidated', {\n          sandboxId: params.sandboxId,\n        });\n      }\n    });\n\n    return {\n      env: {\n        TFY_NATS_URL: this.sandboxClientNatsUrl,\n        TFY_NATS_SUBJECT_PREFIX: subjectPrefix,\n        TFY_CM_REQUEST_TIMEOUT_SECONDS: String(params.requestTimeoutSeconds),\n      },\n    };\n  }\n\n  private subscribe(nc: NatsConnection, subjectPrefix: string): void {\n    nc.subscribe(`${subjectPrefix}.${SANDBOX_NATS_MCP_LEAF}`, {\n      callback: (err, msg) => {\n        void this.handleMessage(err, msg);\n      },\n    });\n  }\n\n  private async handleMessage(err: Error | null, msg: Msg): Promise<void> {\n    if (err) {\n      this.logger.error('Code Mode NATS subscription error', extractErrorLogFields(err));\n      return;\n    }\n    if (!msg.reply) {\n      this.logger.warn(`Code Mode NATS request on '${msg.subject}' has no reply subject; dropping`);\n      return;\n    }\n\n    const dispatcher = this.dispatcher;\n    if (dispatcher === undefined) {\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Code Mode dispatcher is not configured', source: 'internal' }));\n      } catch (e) {\n        this.logger.warn(`Failed to send dispatcher-missing reply on '${msg.subject}'`, extractErrorLogFields(e));\n      }\n      return;\n    }\n\n    const carrier: Record<string, string> = {};\n    const traceparent = msg.headers?.get('traceparent');\n    const tracestate = msg.headers?.get('tracestate');\n    if (traceparent) {\n      carrier['traceparent'] = traceparent;\n    }\n    if (tracestate) {\n      carrier['tracestate'] = tracestate;\n    }\n\n    let request: CodeModeRequest;\n    try {\n      request = this.decode(msg);\n    } catch (e) {\n      this.logger.error(`Failed to decode Code Mode NATS request on '${msg.subject}'`, extractErrorLogFields(e));\n      try {\n        msg.respond(this.encode({ ok: false, error: 'Malformed Code Mode request', source: 'caller' }));\n      } catch (respondErr) {\n        this.logger.warn(`Failed to send decode-error reply on '${msg.subject}'`, extractErrorLogFields(respondErr));\n      }\n      return;\n    }\n\n    const reply = await dispatcher.dispatch({ request, traceCarrier: carrier });\n    try {\n      msg.respond(this.encode(reply));\n    } catch (e) {\n      this.logger.error('Failed to publish Code Mode NATS reply', extractErrorLogFields(e));\n    }\n  }\n\n  private encode(reply: CodeModeReply): Uint8Array {\n    return new TextEncoder().encode(JSON.stringify(reply));\n  }\n\n  private decode(msg: Msg): CodeModeRequest {\n    const raw: unknown = JSON.parse(new TextDecoder().decode(msg.data));\n    return CodeModeRequestSchema.parse(raw);\n  }\n}\n"],"mappings":";AAAA,SAAS,iBAAgD;AACzD,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAE3B,SAAS,iBAAiB;AAC1B,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAC5B,SAAS,oCAAoC;AAG7C,SAAS,6BAAuE;AAIhF,OAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAE9B,IAAM,4BAA4B;AAClC,IAAM,wBAAwB;AAMvB,IAAM,wBAAN,MAAyD;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EAET;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAIT;AACD,SAAK,iBAAiB,OAAO;AAC7B,SAAK,uBAAuB,OAAO,wBAAwB,kBAAkB,OAAO,4BAA4B,CAAC;AACjH,SAAK,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QAIuC;AAC3C,SAAK,aAAa,OAAO;AACzB,SAAK,mBAAmB,KAAK,eAAe,MAAM,EAAE,MAAM,CAAC,MAAe;AACxE,WAAK,iBAAiB;AACtB,YAAM;AAAA,IACR,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,UAAU,KAAK;AACrB,SAAK,iBAAiB;AACtB,QAAI,YAAY,QAAW;AACzB,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK,KAAK;AAChB,SAAK,KAAK;AACV,QAAI,OAAO,QAAW;AACpB;AAAA,IACF;AACA,QAAI;AACF,YAAM,YAAY,GAAG,MAAM,GAAG,qBAAqB;AAAA,IACrD,SAAS,GAAG;AACV,WAAK,OAAO,KAAK,wDAAwD,sBAAsB,CAAC,CAAC;AACjG,YAAM,GAAG,MAAM,EAAE,MAAM,MAAM;AAAA,MAE7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,QAGgB;AAC3C,UAAM,MAAM,MAAM,KAAK,eAAe,OAAO,SAAS;AACtD,UAAM,gBAAgB,GAAG,yBAAyB,IAAI,WAAW,CAAC;AAClE,QAAI;AACJ,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,sBAAsB,WAAW;AAChE,UAAI;AACF,aAAK,MAAM,QAAQ;AAAA,UAAK,gBAAgB,QAAQ,OAAO,CAAC;AAAA,UAAG,MACzD,UAAU,EAAE,SAAS,CAAC,GAAG,GAAG,SAAS,wBAAwB,CAAC;AAAA,QAChE;AACA,aAAK,OAAO,KAAK,sCAAsC,OAAO,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;AAC5F;AAAA,MACF,SAAS,GAAG;AACV,kBAAU;AACV,aAAK,OAAO,KAAK,kCAAkC,OAAO,OAAO,CAAC,WAAW,sBAAsB,CAAC,CAAC;AACrG,YAAI,UAAU,sBAAsB;AAClC,gBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,uBAAuB,CAAC;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,QAAW;AACpB,YAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,+BAA+B;AAAA,IACtF;AAEA,SAAK,KAAK;AACV,SAAK,UAAU,IAAI,aAAa;AAEhC,UAAM,gBAAgB,KAAK;AAC3B,SAAK,GAAG,OAAO,EAAE,KAAK,MAAM;AAC1B,UAAI,KAAK,mBAAmB,eAAe;AACzC,aAAK,iBAAiB;AACtB,aAAK,KAAK;AACV,aAAK,OAAO,KAAK,yDAAyD;AAAA,UACxE,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,KAAK;AAAA,QACH,cAAc,KAAK;AAAA,QACnB,yBAAyB;AAAA,QACzB,gCAAgC,OAAO,OAAO,qBAAqB;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,IAAoB,eAA6B;AACjE,OAAG,UAAU,GAAG,aAAa,IAAI,qBAAqB,IAAI;AAAA,MACxD,UAAU,CAAC,KAAK,QAAQ;AACtB,aAAK,KAAK,cAAc,KAAK,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cAAc,KAAmB,KAAyB;AACtE,QAAI,KAAK;AACP,WAAK,OAAO,MAAM,qCAAqC,sBAAsB,GAAG,CAAC;AACjF;AAAA,IACF;AACA,QAAI,CAAC,IAAI,OAAO;AACd,WAAK,OAAO,KAAK,8BAA8B,IAAI,OAAO,kCAAkC;AAC5F;AAAA,IACF;AAEA,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,0CAA0C,QAAQ,WAAW,CAAC,CAAC;AAAA,MAC7G,SAAS,GAAG;AACV,aAAK,OAAO,KAAK,+CAA+C,IAAI,OAAO,KAAK,sBAAsB,CAAC,CAAC;AAAA,MAC1G;AACA;AAAA,IACF;AAEA,UAAM,UAAkC,CAAC;AACzC,UAAM,cAAc,IAAI,SAAS,IAAI,aAAa;AAClD,UAAM,aAAa,IAAI,SAAS,IAAI,YAAY;AAChD,QAAI,aAAa;AACf,cAAQ,aAAa,IAAI;AAAA,IAC3B;AACA,QAAI,YAAY;AACd,cAAQ,YAAY,IAAI;AAAA,IAC1B;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,OAAO,GAAG;AAAA,IAC3B,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,+CAA+C,IAAI,OAAO,KAAK,sBAAsB,CAAC,CAAC;AACzG,UAAI;AACF,YAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChG,SAAS,YAAY;AACnB,aAAK,OAAO,KAAK,yCAAyC,IAAI,OAAO,KAAK,sBAAsB,UAAU,CAAC;AAAA,MAC7G;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,WAAW,SAAS,EAAE,SAAS,cAAc,QAAQ,CAAC;AAC1E,QAAI;AACF,UAAI,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,IAChC,SAAS,GAAG;AACV,WAAK,OAAO,MAAM,0CAA0C,sBAAsB,CAAC,CAAC;AAAA,IACtF;AAAA,EACF;AAAA,EAEQ,OAAO,OAAkC;AAC/C,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACvD;AAAA,EAEQ,OAAO,KAA2B;AACxC,UAAM,MAAe,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC;AAClE,WAAO,sBAAsB,MAAM,GAAG;AAAA,EACxC;AACF;","names":[]}

package/dist/core/sandbox/provider/DaytonaProvider.d.ts

@@ -5,6 +5,13 @@ import type { ExecResult, SandboxBuild, SandboxExecParams, SandboxProvider } fro
 export interface DaytonaSandboxProviderOptions {
     /** Caller-owned Daytona SDK client (credentials / lifetime). */
     client: Daytona;
+    /**
+     * Same API key the client was built with; used for the register-only snapshot POST because the
+     * SDK's `snapshot.create` polls to a terminal state instead of returning once registered.
+     */
+    apiKey: string;
+    /** Daytona API base URL (including `/api`). Defaults to the SDK's public cloud endpoint. */
+    apiUrl?: string | undefined;
     tenantName: string;
     /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */
     sandboxImage: string;
@@ -38,6 +45,8 @@ export declare class DaytonaSandboxProvider implements SandboxProvider {
     private readonly fileMaxBytesForDownload;
     private readonly natsBridgePort;
     private readonly previewUrlExpirySeconds;
+    private readonly apiKey;
+    private readonly apiUrl;
     private readonly logger;
     private readonly daytona;
     private static readonly cachedSandboxes;
@@ -59,6 +68,14 @@ export declare class DaytonaSandboxProvider implements SandboxProvider {
      */
     private deleteFailedBuild;
     private toBuild;
+    /**
+     * Registers the snapshot and returns its initial state without waiting for the build.
+     *
+     * The SDK's `snapshot.create` issues this same POST and then polls until the snapshot is active
+     * or failed (minutes on a cold image pull). Configure only needs the registration result, so
+     * credential errors surface on the request while build progress stays observable via `getSnapshot`.
+     */
+    private registerSnapshot;
     buildImage(): Promise<SandboxBuild>;
     getImageBuildStatus(): Promise<SandboxBuild>;
     exec(params: SandboxExecParams): Promise<ExecResult>;

package/dist/core/sandbox/provider/DaytonaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DaytonaProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/DaytonaProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAgB,MAAM,cAAc,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAQtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AA2ChH,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB,EAAE,MAAM,CAAC;IAClC,4BAA4B,EAAE,MAAM,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,kHAAkH;IAClH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IACtD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAqE;IAE5G,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAEjF,YAAY,OAAO,EAAE,6BAA6B,EAajD;YAEa,kBAAkB;IAsBhC,OAAO,CAAC,MAAM,CAAC,uBAAuB;YAsBxB,0BAA0B;YAiC1B,sBAAsB;IAe9B,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAMpD;IAED,wFAAwF;YAC1E,WAAW;IAWzB;;;;OAIG;YACW,iBAAiB;IAW/B,OAAO,CAAC,OAAO;IAcT,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CA0BxC;IAEK,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAWjD;IAEK,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBzD;YAEa,WAAW;IAKnB,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyB/E;IAEK,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlG;YAGa,aAAa;IAgB3B,uBAAuB,IAAI,iBAAiB,CAa3C;IAED,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED,oBAAoB,IAAI,MAAM,CAE7B;IAED,qBAAqB,IAAI,MAAM,CAG9B;CACF"}
+{"version":3,"file":"DaytonaProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/sandbox/provider/DaytonaProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAgB,MAAM,cAAc,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAQtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AAsDhH,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB,EAAE,MAAM,CAAC;IAClC,4BAA4B,EAAE,MAAM,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,kHAAkH;IAClH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IACtD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAqE;IAE5G,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAEjF,YAAY,OAAO,EAAE,6BAA6B,EAejD;YAEa,kBAAkB;IAwBhC,OAAO,CAAC,MAAM,CAAC,uBAAuB;YA4BxB,0BAA0B;YAqC1B,sBAAsB;IAe9B,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAMpD;IAED,wFAAwF;YAC1E,WAAW;IAWzB;;;;OAIG;YACW,iBAAiB;IAW/B,OAAO,CAAC,OAAO;IAcf;;;;;;OAMG;YACW,gBAAgB;IAgCxB,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAiCxC;IAEK,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,CAWjD;IAEK,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBzD;YAEa,WAAW;IAKnB,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B/E;IAEK,UAAU,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlG;YAGa,aAAa;IAgB3B,uBAAuB,IAAI,iBAAiB,CAa3C;IAED,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED,oBAAoB,IAAI,MAAM,CAE7B;IAED,qBAAqB,IAAI,MAAM,CAG9B;CACF"}

package/dist/core/sandbox/provider/DaytonaProvider.js

@@ -32,12 +32,17 @@ var import_SandboxErrors = require("../SandboxErrors.js");
 var import_CodeModeNatsTransport = require("../codeMode/nats/CodeModeNatsTransport.js");
 var import_constants = require("../constants.js");
 var SANDBOX_NOT_FOUND_STATUS = 404;
+var SNAPSHOT_CONFLICT_STATUS = 409;
 var SANDBOX_STATE_STARTED = "started";
 var BUILD_STATE_ACTIVE = "active";
 var BUILD_STATE_INACTIVE = "inactive";
 var BUILD_STATE_ERROR = "error";
 var BUILD_STATE_BUILD_FAILED = "build_failed";
 var IMAGE_BUILD_NAME_PREFIX = "trueforge-build-";
+var DEFAULT_DAYTONA_API_URL = "https://app.daytona.io/api";
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
 function imageDigest(image) {
   const lastSegment = image.slice(image.lastIndexOf("/") + 1);
   const colon = lastSegment.lastIndexOf(":");
@@ -54,8 +59,11 @@ function isFailedBuildState(state) {
 }
 function httpUrlToWsUrl(url) {
   const parsed = new URL(url);
-  if (parsed.protocol === "https:") parsed.protocol = "wss:";
-  else if (parsed.protocol === "http:") parsed.protocol = "ws:";
+  if (parsed.protocol === "https:") {
+    parsed.protocol = "wss:";
+  } else if (parsed.protocol === "http:") {
+    parsed.protocol = "ws:";
+  }
   return parsed.toString();
 }
 var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
@@ -71,6 +79,8 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
   fileMaxBytesForDownload;
   natsBridgePort;
   previewUrlExpirySeconds;
+  apiKey;
+  apiUrl;
   logger;
   daytona;
   static cachedSandboxes = /* @__PURE__ */ new Map();
@@ -78,6 +88,8 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
   static inFlightRecoveries = /* @__PURE__ */ new Map();
   constructor(options) {
     this.daytona = options.client;
+    this.apiKey = options.apiKey;
+    this.apiUrl = options.apiUrl ?? DEFAULT_DAYTONA_API_URL;
     this.tenantName = options.tenantName;
     this.imageUri = options.sandboxImage;
     this.buildRef = options.buildRef ?? deriveImageBuildName(imageDigest(options.sandboxImage));
@@ -93,7 +105,9 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
   async getOrCreateSandbox(sandboxId) {
     if (sandboxId) {
       const cached = _DaytonaSandboxProvider.cachedSandboxes.get(sandboxId);
-      if (cached) return cached;
+      if (cached) {
+        return cached;
+      }
     }
     const sandbox = sandboxId ? await this.restoreExistingSandbox(sandboxId) : await this.daytona.create({
       name: `${this.tenantName}.${(0, import_crypto.randomUUID)()}`,
@@ -109,12 +123,18 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
   // Returns true iff the caller should retry: either we restarted a stopped sandbox, or the cache entry is missing and the retry will rebuild it via the cold path.
   static recoverSandboxIfStopped(sandboxId) {
     const existing = _DaytonaSandboxProvider.inFlightRecoveries.get(sandboxId);
-    if (existing) return existing;
+    if (existing) {
+      return existing;
+    }
     const cached = _DaytonaSandboxProvider.cachedSandboxes.get(sandboxId);
-    if (!cached) return Promise.resolve(true);
+    if (!cached) {
+      return Promise.resolve(true);
+    }
     const recovery = (async () => {
       await cached.sandbox.refreshData();
-      if (cached.sandbox.state === SANDBOX_STATE_STARTED) return false;
+      if (cached.sandbox.state === SANDBOX_STATE_STARTED) {
+        return false;
+      }
       await cached.sandbox.start();
       return true;
     })().finally(() => {
@@ -127,7 +147,9 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
     try {
       return await operation();
     } catch (originalError) {
-      if (!(originalError instanceof import_sdk.DaytonaError)) throw originalError;
+      if (!(originalError instanceof import_sdk.DaytonaError)) {
+        throw originalError;
+      }
       let recovered;
       try {
         recovered = await _DaytonaSandboxProvider.recoverSandboxIfStopped(sandboxId);
@@ -138,7 +160,9 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
         });
         throw new Error("Sandbox is unavailable; recovery attempt failed.", { cause: recoveryError });
       }
-      if (!recovered) throw originalError;
+      if (!recovered) {
+        throw originalError;
+      }
       try {
         return await operation();
       } catch (retryError) {
@@ -209,6 +233,40 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
         return { status: "pending", reason: `Sandbox image build in progress (${state}).`, metadata };
     }
   }
+  /**
+   * Registers the snapshot and returns its initial state without waiting for the build.
+   *
+   * The SDK's `snapshot.create` issues this same POST and then polls until the snapshot is active
+   * or failed (minutes on a cold image pull). Configure only needs the registration result, so
+   * credential errors surface on the request while build progress stays observable via `getSnapshot`.
+   */
+  async registerSnapshot() {
+    let response;
+    try {
+      response = await fetch(`${this.apiUrl}/snapshots`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ name: this.buildRef, imageName: this.imageUri })
+      });
+    } catch (error) {
+      throw new Error("Daytona snapshot registration request failed.", { cause: error });
+    }
+    const body = await response.json().catch(() => null);
+    if (!response.ok) {
+      const message = isRecord(body) && typeof body["message"] === "string" ? body["message"] : `Daytona snapshot registration failed (${String(response.status)})`;
+      throw new import_sdk.DaytonaError(message, response.status);
+    }
+    if (!isRecord(body) || typeof body["state"] !== "string") {
+      throw new import_sdk.DaytonaError("Failed to register snapshot. Daytona didn't return a snapshot state.");
+    }
+    return {
+      state: body["state"],
+      errorReason: typeof body["errorReason"] === "string" ? body["errorReason"] : null
+    };
+  }
   async buildImage() {
     const existing = await this.getSnapshot(this.buildRef);
     if (existing) {
@@ -221,14 +279,20 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
       }
       await this.deleteFailedBuild(existing);
     }
-    void this.daytona.snapshot.create({ name: this.buildRef, image: this.imageUri }).catch((error) => {
-      this.logger.error(`Daytona snapshot create failed: name=${this.buildRef}`, (0, import_errorLogFields.extractErrorLogFields)(error));
-    });
-    return {
-      status: "pending",
-      reason: "Sandbox image build started.",
-      metadata: { build_ref: this.buildRef, image_uri: this.imageUri }
-    };
+    try {
+      const registered = await this.registerSnapshot();
+      return this.toBuild(registered.state, registered.errorReason);
+    } catch (error) {
+      if (error instanceof import_sdk.DaytonaError && error.statusCode === SNAPSHOT_CONFLICT_STATUS) {
+        this.logger.info(`Daytona snapshot already created concurrently: name=${this.buildRef}`);
+        return {
+          status: "pending",
+          reason: "Sandbox image build started by another server replica.",
+          metadata: { build_ref: this.buildRef, image_uri: this.imageUri }
+        };
+      }
+      throw error;
+    }
   }
   async getImageBuildStatus() {
     const snapshot = await this.getSnapshot(this.buildRef);
@@ -284,7 +348,9 @@ var DaytonaSandboxProvider = class _DaytonaSandboxProvider {
           return await sandbox.fs.downloadFile(params.path);
         });
       } catch (e) {
-        if (e instanceof import_SandboxErrors.SandboxPathIsDirectoryError || e instanceof import_SandboxErrors.SandboxFileTooLargeError) throw e;
+        if (e instanceof import_SandboxErrors.SandboxPathIsDirectoryError || e instanceof import_SandboxErrors.SandboxFileTooLargeError) {
+          throw e;
+        }
         if (e instanceof import_sdk.DaytonaError && e.statusCode === SANDBOX_NOT_FOUND_STATUS) {
           throw new import_SandboxErrors.SandboxFileNotFoundError(params.path);
         }

package/dist/core/sandbox/provider/DaytonaProvider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/core/sandbox/provider/DaytonaProvider.ts"],"sourcesContent":["import type { Sandbox, Snapshot } from '@daytona/sdk';\nimport { Daytona, DaytonaError } from '@daytona/sdk';\nimport { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'crypto';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport {\n  SandboxFileNotFoundError,\n  SandboxFileTooLargeError,\n  SandboxNotAvailableError,\n  SandboxPathIsDirectoryError,\n} from '../SandboxErrors';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_PREVIEW_URL_EXPIRY_SECONDS, DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport type { ExecResult, SandboxBuild, SandboxExecParams, SandboxFileInfo, SandboxProvider } from './Provider';\n\nconst SANDBOX_NOT_FOUND_STATUS = 404;\nconst SANDBOX_STATE_STARTED = 'started';\n\nconst BUILD_STATE_ACTIVE = 'active';\nconst BUILD_STATE_INACTIVE = 'inactive';\nconst BUILD_STATE_ERROR = 'error';\nconst BUILD_STATE_BUILD_FAILED = 'build_failed';\n\nconst IMAGE_BUILD_NAME_PREFIX = 'trueforge-build-';\n\n/**\n * Digest portion of a container image reference (the tag/digest after the final `:`)\n * The release image is always published with an explicit digest tag\n */\nfunction imageDigest(image: string): string {\n  const lastSegment = image.slice(image.lastIndexOf('/') + 1);\n  const colon = lastSegment.lastIndexOf(':');\n  if (colon === -1) {\n    throw new Error(`Sandbox image reference has no tag/digest: ${image}`);\n  }\n  return lastSegment.slice(colon + 1);\n}\n\n/** Deterministic build name per image digest so every server replica converges on one build. */\nfunction deriveImageBuildName(digest: string): string {\n  return `${IMAGE_BUILD_NAME_PREFIX}${digest}`;\n}\n\n/** Terminal-failure build states: a build stuck here never becomes ready on its own. */\nfunction isFailedBuildState(state: Snapshot['state']): boolean {\n  return state === BUILD_STATE_ERROR || state === BUILD_STATE_BUILD_FAILED;\n}\n\n/** Convert Daytona https preview URLs to wss for the NATS client. */\nfunction httpUrlToWsUrl(url: string): string {\n  const parsed = new URL(url);\n  if (parsed.protocol === 'https:') parsed.protocol = 'wss:';\n  else if (parsed.protocol === 'http:') parsed.protocol = 'ws:';\n  return parsed.toString();\n}\n\nexport interface DaytonaSandboxProviderOptions {\n  /** Caller-owned Daytona SDK client (credentials / lifetime). */\n  client: Daytona;\n  tenantName: string;\n  /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */\n  sandboxImage: string;\n  /**\n   * Daytona snapshot name to clone sandboxes from. When omitted it is derived from the image\n   * digest. Callers that create sandboxes pass the persisted build_ref so cloning targets the\n   * snapshot that was actually built, not a speculative name derived from the current image.\n   */\n  buildRef?: string | undefined;\n  timeoutMs: number;\n  autoStopIntervalInMinutes: number;\n  autoArchiveIntervalInMinutes: number;\n  autoDeleteIntervalInMinutes: number;\n  fileMaxBytesForDownload: number;\n  /** Defaults to the built-in sandbox NATS WebSocket port (4444). */\n  natsBridgePort?: number;\n  /** Defaults to 1 hour (same as the gateway's max agent execution time). */\n  previewUrlExpirySeconds?: number;\n  logger: Logger;\n}\n\nexport class DaytonaSandboxProvider implements SandboxProvider {\n  private readonly tenantName: string;\n  /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */\n  private readonly imageUri: string;\n  /** Daytona snapshot name sandboxes are cloned from; the persisted build_ref, or derived from the image digest. */\n  private readonly buildRef: string;\n  private readonly timeoutMs: number;\n  private readonly autoStopIntervalInMinutes: number;\n  private readonly autoArchiveIntervalInMinutes: number;\n  private readonly autoDeleteIntervalInMinutes: number;\n  private readonly fileMaxBytesForDownload: number;\n  private readonly natsBridgePort: number;\n  private readonly previewUrlExpirySeconds: number;\n  private readonly logger: Logger;\n  private readonly daytona: Daytona;\n  private static readonly cachedSandboxes = new Map<string, { sandbox: Sandbox; defaultTimeoutMs: number }>();\n  // De-dupes concurrent recovery attempts on the same sandbox to a single refreshData+start round-trip.\n  private static readonly inFlightRecoveries = new Map<string, Promise<boolean>>();\n\n  constructor(options: DaytonaSandboxProviderOptions) {\n    this.daytona = options.client;\n    this.tenantName = options.tenantName;\n    this.imageUri = options.sandboxImage;\n    this.buildRef = options.buildRef ?? deriveImageBuildName(imageDigest(options.sandboxImage));\n    this.timeoutMs = options.timeoutMs;\n    this.autoStopIntervalInMinutes = options.autoStopIntervalInMinutes;\n    this.autoArchiveIntervalInMinutes = options.autoArchiveIntervalInMinutes;\n    this.autoDeleteIntervalInMinutes = options.autoDeleteIntervalInMinutes;\n    this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n    this.natsBridgePort = options.natsBridgePort ?? DEFAULT_SANDBOX_NATS_WS_PORT;\n    this.previewUrlExpirySeconds = options.previewUrlExpirySeconds ?? DEFAULT_PREVIEW_URL_EXPIRY_SECONDS;\n    this.logger = options.logger.child({ module: 'DaytonaProvider' });\n  }\n\n  private async getOrCreateSandbox(sandboxId?: string): Promise<{ sandbox: Sandbox; defaultTimeoutMs: number }> {\n    if (sandboxId) {\n      const cached = DaytonaSandboxProvider.cachedSandboxes.get(sandboxId);\n      if (cached) return cached;\n    }\n\n    const sandbox = sandboxId\n      ? await this.restoreExistingSandbox(sandboxId)\n      : await this.daytona.create({\n          name: `${this.tenantName}.${randomUUID()}`,\n          snapshot: this.buildRef,\n          autoStopInterval: this.autoStopIntervalInMinutes,\n          autoArchiveInterval: this.autoArchiveIntervalInMinutes,\n          autoDeleteInterval: this.autoDeleteIntervalInMinutes,\n        });\n\n    const entry = { sandbox, defaultTimeoutMs: this.timeoutMs };\n    DaytonaSandboxProvider.cachedSandboxes.set(sandbox.name, entry);\n    return entry;\n  }\n\n  // Returns true iff the caller should retry: either we restarted a stopped sandbox, or the cache entry is missing and the retry will rebuild it via the cold path.\n  private static recoverSandboxIfStopped(sandboxId: string): Promise<boolean> {\n    const existing = DaytonaSandboxProvider.inFlightRecoveries.get(sandboxId);\n    if (existing) return existing;\n\n    const cached = DaytonaSandboxProvider.cachedSandboxes.get(sandboxId);\n    // Cache may have been evicted by a concurrent error path; signal retry so getOrCreateSandbox rebuilds via restoreExistingSandbox.\n    if (!cached) return Promise.resolve(true);\n\n    const recovery = (async () => {\n      await cached.sandbox.refreshData();\n      if (cached.sandbox.state === SANDBOX_STATE_STARTED) return false;\n      // start() covers both stopped and archived per Daytona; throws on unrecoverable states (error/destroyed).\n      await cached.sandbox.start();\n      return true;\n    })().finally(() => {\n      DaytonaSandboxProvider.inFlightRecoveries.delete(sandboxId);\n    });\n\n    DaytonaSandboxProvider.inFlightRecoveries.set(sandboxId, recovery);\n    return recovery;\n  }\n\n  private async executeWithSandboxRecovery<T>(sandboxId: string, operation: () => Promise<T>): Promise<T> {\n    try {\n      return await operation();\n    } catch (originalError) {\n      // TODO: Narrow to a specific Daytona error code once @daytona/sdk exposes one for \"sandbox not running\".\n      if (!(originalError instanceof DaytonaError)) throw originalError;\n\n      let recovered: boolean;\n      try {\n        recovered = await DaytonaSandboxProvider.recoverSandboxIfStopped(sandboxId);\n      } catch (recoveryError) {\n        this.logger.error('Sandbox recovery failed', {\n          ...extractErrorLogFields(recoveryError),\n          originalError: extractErrorLogFields(originalError),\n        });\n        throw new Error('Sandbox is unavailable; recovery attempt failed.', { cause: recoveryError });\n      }\n\n      if (!recovered) throw originalError;\n\n      try {\n        return await operation();\n      } catch (retryError) {\n        this.logger.error('Sandbox operation failed after successful recovery', {\n          ...extractErrorLogFields(retryError),\n          originalError: extractErrorLogFields(originalError),\n        });\n        // Rethrow as-is so callers can match domain error types (SandboxPathIsDirectoryError, DaytonaError statusCode mappings, etc.).\n        throw retryError;\n      }\n    }\n  }\n\n  private async restoreExistingSandbox(sandboxId: string): Promise<Sandbox> {\n    try {\n      const sandbox = await this.daytona.get(sandboxId);\n      if (sandbox.state !== SANDBOX_STATE_STARTED) {\n        await sandbox.start();\n      }\n      return sandbox;\n    } catch (ex) {\n      if (ex instanceof DaytonaError && ex.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n        throw new SandboxNotAvailableError(sandboxId);\n      }\n      throw ex;\n    }\n  }\n\n  async createSandbox(): Promise<{ sandboxId: string }> {\n    return context.with(suppressTracing(context.active()), async () => {\n      const { sandbox } = await this.getOrCreateSandbox();\n      this.logger.debug(`Sandbox created: name=${sandbox.name}`);\n      return { sandboxId: sandbox.name };\n    });\n  }\n\n  /** Resolves undefined when no snapshot carries that name; auth/other failures throw. */\n  private async getSnapshot(name: string): Promise<Snapshot | undefined> {\n    try {\n      return await this.daytona.snapshot.get(name);\n    } catch (error) {\n      if (error instanceof DaytonaError && error.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n        return undefined;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Drops a build stuck in a terminal-failure state so a fresh create can reuse its\n   * deterministic name. A concurrent replica may have deleted it already (404) — that\n   * is fine and treated as success.\n   */\n  private async deleteFailedBuild(snapshot: Snapshot): Promise<void> {\n    try {\n      await this.daytona.snapshot.delete(snapshot);\n    } catch (error) {\n      if (error instanceof DaytonaError && error.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n        return;\n      }\n      throw error;\n    }\n  }\n\n  private toBuild(state: Snapshot['state'], errorReason: string | null): SandboxBuild {\n    const metadata = { build_ref: this.buildRef, image_uri: this.imageUri };\n    switch (state) {\n      case BUILD_STATE_ACTIVE:\n        return { status: 'ready', reason: null, metadata };\n      case BUILD_STATE_ERROR:\n      case BUILD_STATE_BUILD_FAILED:\n        return { status: 'failed', reason: errorReason ?? `Sandbox image build failed (${state}).`, metadata };\n      default:\n        // pending / building / pulling / removing / future states: not ready yet.\n        return { status: 'pending', reason: `Sandbox image build in progress (${state}).`, metadata };\n    }\n  }\n\n  async buildImage(): Promise<SandboxBuild> {\n    const existing = await this.getSnapshot(this.buildRef);\n    if (existing) {\n      // Daytona parks unused snapshots as 'inactive' after ~2 idle weeks; reactivate rather than rebuild.\n      if (existing.state === BUILD_STATE_INACTIVE) {\n        const activated = await this.daytona.snapshot.activate(existing);\n        return this.toBuild(activated.state, activated.errorReason);\n      }\n      if (!isFailedBuildState(existing.state)) {\n        return this.toBuild(existing.state, existing.errorReason);\n      }\n      // A failed build keeps the deterministic name occupied and never self-heals, so\n      // re-saving settings (which calls buildImage) could never retry. Drop it, then recreate.\n      await this.deleteFailedBuild(existing);\n    }\n    // Fire the create in the background: the SDK's snapshot.create polls until the snapshot is\n    // terminal (minutes on a cold image pull), but Daytona registers it on the first request, so\n    // progress is observed via getImageBuildStatus. A concurrent-create conflict is harmless.\n    void this.daytona.snapshot.create({ name: this.buildRef, image: this.imageUri }).catch((error: unknown) => {\n      this.logger.error(`Daytona snapshot create failed: name=${this.buildRef}`, extractErrorLogFields(error));\n    });\n    return {\n      status: 'pending',\n      reason: 'Sandbox image build started.',\n      metadata: { build_ref: this.buildRef, image_uri: this.imageUri },\n    };\n  }\n\n  async getImageBuildStatus(): Promise<SandboxBuild> {\n    const snapshot = await this.getSnapshot(this.buildRef);\n    // Read-only: a missing build reports pending; PUT /settings/sandbox-providers starts the build.\n    if (!snapshot) {\n      return {\n        status: 'pending',\n        reason: 'Sandbox image build not started.',\n        metadata: { build_ref: this.buildRef, image_uri: this.imageUri },\n      };\n    }\n    return this.toBuild(snapshot.state, snapshot.errorReason);\n  }\n\n  async exec(params: SandboxExecParams): Promise<ExecResult> {\n    return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n      try {\n        return await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox, defaultTimeoutMs } = await this.getOrCreateSandbox(params.sandboxId);\n          const response = await sandbox.process.executeCommand(\n            params.command,\n            params.cwd,\n            params.env ?? {},\n            params.timeoutSeconds ?? defaultTimeoutMs / 1000,\n          );\n          return {\n            success: true,\n            response: { exitCode: response.exitCode, result: response.result },\n          };\n        });\n      } catch (e: unknown) {\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        this.logger.error('Sandbox execution error', extractErrorLogFields(e));\n        const message = e instanceof Error ? e.message : 'Unknown error';\n        return { success: false, error: message };\n      }\n    });\n  }\n\n  private async getFileInfo(sandbox: Sandbox, path: string): Promise<SandboxFileInfo> {\n    const details = await sandbox.fs.getFileDetails(path);\n    return { size: details.size, isDir: details.isDir };\n  }\n\n  async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n    return context.with(suppressTracing(context.active()), async () => {\n      try {\n        return await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox } = await this.getOrCreateSandbox(params.sandboxId);\n\n          const info = await this.getFileInfo(sandbox, params.path);\n          if (info.isDir) {\n            throw new SandboxPathIsDirectoryError(params.path);\n          }\n          if (info.size > this.fileMaxBytesForDownload) {\n            throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n          }\n\n          return await sandbox.fs.downloadFile(params.path);\n        });\n      } catch (e: unknown) {\n        if (e instanceof SandboxPathIsDirectoryError || e instanceof SandboxFileTooLargeError) throw e;\n        if (e instanceof DaytonaError && e.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n          throw new SandboxFileNotFoundError(params.path);\n        }\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        throw e;\n      }\n    });\n  }\n\n  async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n    return context.with(suppressTracing(context.active()), async () => {\n      try {\n        await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox } = await this.getOrCreateSandbox(params.sandboxId);\n          await sandbox.fs.uploadFile(params.content, params.remotePath);\n        });\n      } catch (e: unknown) {\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        throw e;\n      }\n    });\n  }\n\n  // Mints a signed, time-limited https preview URL exposing the given sandbox port.\n  private async getPreviewUrl(params: { sandboxId: string; port: number; expiresInSeconds: number }): Promise<string> {\n    return context.with(suppressTracing(context.active()), async () => {\n      try {\n        return await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox } = await this.getOrCreateSandbox(params.sandboxId);\n          const signed = await sandbox.getSignedPreviewUrl(params.port, params.expiresInSeconds);\n          return signed.url;\n        });\n      } catch (e: unknown) {\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        this.logger.error('Failed to create signed preview URL', extractErrorLogFields(e));\n        throw e;\n      }\n    });\n  }\n\n  createCodeModeTransport(): CodeModeTransport {\n    return new CodeModeNatsTransport({\n      resolveHostUrl: async (sandboxId: string) => {\n        const previewUrl = await this.getPreviewUrl({\n          sandboxId,\n          port: this.natsBridgePort,\n          expiresInSeconds: this.previewUrlExpirySeconds,\n        });\n        return httpUrlToWsUrl(previewUrl);\n      },\n      sandboxClientNatsUrl: `ws://localhost:${String(this.natsBridgePort)}`,\n      logger: this.logger,\n    });\n  }\n\n  getAdditionalInstructions(): string | undefined {\n    return undefined;\n  }\n\n  getToolResultDumpDir(): string {\n    return '/tmp/tool-results';\n  }\n\n  getGitCredentialsPath(): string {\n    // Isolated container per sandbox; absolute path so GIT_CONFIG_* needs no $HOME expansion.\n    return '/tmp/.git-credentials';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,iBAAsC;AACtC,iBAAwB;AACxB,kBAAgC;AAChC,oBAA2B;AAE3B,4BAAsC;AACtC,2BAKO;AAEP,mCAAsC;AACtC,uBAAiF;AAGjF,IAAM,2BAA2B;AACjC,IAAM,wBAAwB;AAE9B,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAC7B,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AAEjC,IAAM,0BAA0B;AAMhC,SAAS,YAAY,OAAuB;AAC1C,QAAM,cAAc,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1D,QAAM,QAAQ,YAAY,YAAY,GAAG;AACzC,MAAI,UAAU,IAAI;AAChB,UAAM,IAAI,MAAM,8CAA8C,KAAK,EAAE;AAAA,EACvE;AACA,SAAO,YAAY,MAAM,QAAQ,CAAC;AACpC;AAGA,SAAS,qBAAqB,QAAwB;AACpD,SAAO,GAAG,uBAAuB,GAAG,MAAM;AAC5C;AAGA,SAAS,mBAAmB,OAAmC;AAC7D,SAAO,UAAU,qBAAqB,UAAU;AAClD;AAGA,SAAS,eAAe,KAAqB;AAC3C,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MAAI,OAAO,aAAa,SAAU,QAAO,WAAW;AAAA,WAC3C,OAAO,aAAa,QAAS,QAAO,WAAW;AACxD,SAAO,OAAO,SAAS;AACzB;AA0BO,IAAM,yBAAN,MAAM,wBAAkD;AAAA,EAC5C;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACjB,OAAwB,kBAAkB,oBAAI,IAA4D;AAAA;AAAA,EAE1G,OAAwB,qBAAqB,oBAAI,IAA8B;AAAA,EAE/E,YAAY,SAAwC;AAClD,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ;AAC1B,SAAK,WAAW,QAAQ;AACxB,SAAK,WAAW,QAAQ,YAAY,qBAAqB,YAAY,QAAQ,YAAY,CAAC;AAC1F,SAAK,YAAY,QAAQ;AACzB,SAAK,4BAA4B,QAAQ;AACzC,SAAK,+BAA+B,QAAQ;AAC5C,SAAK,8BAA8B,QAAQ;AAC3C,SAAK,0BAA0B,QAAQ;AACvC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,0BAA0B,QAAQ,2BAA2B;AAClE,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAClE;AAAA,EAEA,MAAc,mBAAmB,WAA6E;AAC5G,QAAI,WAAW;AACb,YAAM,SAAS,wBAAuB,gBAAgB,IAAI,SAAS;AACnE,UAAI,OAAQ,QAAO;AAAA,IACrB;AAEA,UAAM,UAAU,YACZ,MAAM,KAAK,uBAAuB,SAAS,IAC3C,MAAM,KAAK,QAAQ,OAAO;AAAA,MACxB,MAAM,GAAG,KAAK,UAAU,QAAI,0BAAW,CAAC;AAAA,MACxC,UAAU,KAAK;AAAA,MACf,kBAAkB,KAAK;AAAA,MACvB,qBAAqB,KAAK;AAAA,MAC1B,oBAAoB,KAAK;AAAA,IAC3B,CAAC;AAEL,UAAM,QAAQ,EAAE,SAAS,kBAAkB,KAAK,UAAU;AAC1D,4BAAuB,gBAAgB,IAAI,QAAQ,MAAM,KAAK;AAC9D,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAe,wBAAwB,WAAqC;AAC1E,UAAM,WAAW,wBAAuB,mBAAmB,IAAI,SAAS;AACxE,QAAI,SAAU,QAAO;AAErB,UAAM,SAAS,wBAAuB,gBAAgB,IAAI,SAAS;AAEnE,QAAI,CAAC,OAAQ,QAAO,QAAQ,QAAQ,IAAI;AAExC,UAAM,YAAY,YAAY;AAC5B,YAAM,OAAO,QAAQ,YAAY;AACjC,UAAI,OAAO,QAAQ,UAAU,sBAAuB,QAAO;AAE3D,YAAM,OAAO,QAAQ,MAAM;AAC3B,aAAO;AAAA,IACT,GAAG,EAAE,QAAQ,MAAM;AACjB,8BAAuB,mBAAmB,OAAO,SAAS;AAAA,IAC5D,CAAC;AAED,4BAAuB,mBAAmB,IAAI,WAAW,QAAQ;AACjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,2BAA8B,WAAmB,WAAyC;AACtG,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,SAAS,eAAe;AAEtB,UAAI,EAAE,yBAAyB,yBAAe,OAAM;AAEpD,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,wBAAuB,wBAAwB,SAAS;AAAA,MAC5E,SAAS,eAAe;AACtB,aAAK,OAAO,MAAM,2BAA2B;AAAA,UAC3C,OAAG,6CAAsB,aAAa;AAAA,UACtC,mBAAe,6CAAsB,aAAa;AAAA,QACpD,CAAC;AACD,cAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,cAAc,CAAC;AAAA,MAC9F;AAEA,UAAI,CAAC,UAAW,OAAM;AAEtB,UAAI;AACF,eAAO,MAAM,UAAU;AAAA,MACzB,SAAS,YAAY;AACnB,aAAK,OAAO,MAAM,sDAAsD;AAAA,UACtE,OAAG,6CAAsB,UAAU;AAAA,UACnC,mBAAe,6CAAsB,aAAa;AAAA,QACpD,CAAC;AAED,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,uBAAuB,WAAqC;AACxE,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,QAAQ,IAAI,SAAS;AAChD,UAAI,QAAQ,UAAU,uBAAuB;AAC3C,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,aAAO;AAAA,IACT,SAAS,IAAI;AACX,UAAI,cAAc,2BAAgB,GAAG,eAAe,0BAA0B;AAC5E,cAAM,IAAI,8CAAyB,SAAS;AAAA,MAC9C;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgD;AACpD,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,YAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB;AAClD,WAAK,OAAO,MAAM,yBAAyB,QAAQ,IAAI,EAAE;AACzD,aAAO,EAAE,WAAW,QAAQ,KAAK;AAAA,IACnC,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAc,YAAY,MAA6C;AACrE,QAAI;AACF,aAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,IAAI;AAAA,IAC7C,SAAS,OAAO;AACd,UAAI,iBAAiB,2BAAgB,MAAM,eAAe,0BAA0B;AAClF,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,kBAAkB,UAAmC;AACjE,QAAI;AACF,YAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ;AAAA,IAC7C,SAAS,OAAO;AACd,UAAI,iBAAiB,2BAAgB,MAAM,eAAe,0BAA0B;AAClF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,QAAQ,OAA0B,aAA0C;AAClF,UAAM,WAAW,EAAE,WAAW,KAAK,UAAU,WAAW,KAAK,SAAS;AACtE,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS;AAAA,MACnD,KAAK;AAAA,MACL,KAAK;AACH,eAAO,EAAE,QAAQ,UAAU,QAAQ,eAAe,+BAA+B,KAAK,MAAM,SAAS;AAAA,MACvG;AAEE,eAAO,EAAE,QAAQ,WAAW,QAAQ,oCAAoC,KAAK,MAAM,SAAS;AAAA,IAChG;AAAA,EACF;AAAA,EAEA,MAAM,aAAoC;AACxC,UAAM,WAAW,MAAM,KAAK,YAAY,KAAK,QAAQ;AACrD,QAAI,UAAU;AAEZ,UAAI,SAAS,UAAU,sBAAsB;AAC3C,cAAM,YAAY,MAAM,KAAK,QAAQ,SAAS,SAAS,QAAQ;AAC/D,eAAO,KAAK,QAAQ,UAAU,OAAO,UAAU,WAAW;AAAA,MAC5D;AACA,UAAI,CAAC,mBAAmB,SAAS,KAAK,GAAG;AACvC,eAAO,KAAK,QAAQ,SAAS,OAAO,SAAS,WAAW;AAAA,MAC1D;AAGA,YAAM,KAAK,kBAAkB,QAAQ;AAAA,IACvC;AAIA,SAAK,KAAK,QAAQ,SAAS,OAAO,EAAE,MAAM,KAAK,UAAU,OAAO,KAAK,SAAS,CAAC,EAAE,MAAM,CAAC,UAAmB;AACzG,WAAK,OAAO,MAAM,wCAAwC,KAAK,QAAQ,QAAI,6CAAsB,KAAK,CAAC;AAAA,IACzG,CAAC;AACD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU,EAAE,WAAW,KAAK,UAAU,WAAW,KAAK,SAAS;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,MAAM,sBAA6C;AACjD,UAAM,WAAW,MAAM,KAAK,YAAY,KAAK,QAAQ;AAErD,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,UAAU,EAAE,WAAW,KAAK,UAAU,WAAW,KAAK,SAAS;AAAA,MACjE;AAAA,IACF;AACA,WAAO,KAAK,QAAQ,SAAS,OAAO,SAAS,WAAW;AAAA,EAC1D;AAAA,EAEA,MAAM,KAAK,QAAgD;AACzD,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAiC;AACtF,UAAI;AACF,eAAO,MAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AACzE,gBAAM,EAAE,SAAS,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AACpF,gBAAM,WAAW,MAAM,QAAQ,QAAQ;AAAA,YACrC,OAAO;AAAA,YACP,OAAO;AAAA,YACP,OAAO,OAAO,CAAC;AAAA,YACf,OAAO,kBAAkB,mBAAmB;AAAA,UAC9C;AACA,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,UAAU,EAAE,UAAU,SAAS,UAAU,QAAQ,SAAS,OAAO;AAAA,UACnE;AAAA,QACF,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,aAAK,OAAO,MAAM,+BAA2B,6CAAsB,CAAC,CAAC;AACrE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,SAAkB,MAAwC;AAClF,UAAM,UAAU,MAAM,QAAQ,GAAG,eAAe,IAAI;AACpD,WAAO,EAAE,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM;AAAA,EACpD;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,UAAI;AACF,eAAO,MAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AACzE,gBAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AAElE,gBAAM,OAAO,MAAM,KAAK,YAAY,SAAS,OAAO,IAAI;AACxD,cAAI,KAAK,OAAO;AACd,kBAAM,IAAI,iDAA4B,OAAO,IAAI;AAAA,UACnD;AACA,cAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,kBAAM,IAAI,8CAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,UACzF;AAEA,iBAAO,MAAM,QAAQ,GAAG,aAAa,OAAO,IAAI;AAAA,QAClD,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,YAAI,aAAa,oDAA+B,aAAa,8CAA0B,OAAM;AAC7F,YAAI,aAAa,2BAAgB,EAAE,eAAe,0BAA0B;AAC1E,gBAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,QAChD;AACA,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,UAAI;AACF,cAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AAClE,gBAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AAClE,gBAAM,QAAQ,GAAG,WAAW,OAAO,SAAS,OAAO,UAAU;AAAA,QAC/D,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAc,cAAc,QAAwF;AAClH,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,UAAI;AACF,eAAO,MAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AACzE,gBAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AAClE,gBAAM,SAAS,MAAM,QAAQ,oBAAoB,OAAO,MAAM,OAAO,gBAAgB;AACrF,iBAAO,OAAO;AAAA,QAChB,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,aAAK,OAAO,MAAM,2CAAuC,6CAAsB,CAAC,CAAC;AACjF,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,0BAA6C;AAC3C,WAAO,IAAI,mDAAsB;AAAA,MAC/B,gBAAgB,OAAO,cAAsB;AAC3C,cAAM,aAAa,MAAM,KAAK,cAAc;AAAA,UAC1C;AAAA,UACA,MAAM,KAAK;AAAA,UACX,kBAAkB,KAAK;AAAA,QACzB,CAAC;AACD,eAAO,eAAe,UAAU;AAAA,MAClC;AAAA,MACA,sBAAsB,kBAAkB,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,4BAAgD;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAE9B,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/core/sandbox/provider/DaytonaProvider.ts"],"sourcesContent":["import type { Sandbox, Snapshot } from '@daytona/sdk';\nimport { Daytona, DaytonaError } from '@daytona/sdk';\nimport { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport { randomUUID } from 'crypto';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport {\n  SandboxFileNotFoundError,\n  SandboxFileTooLargeError,\n  SandboxNotAvailableError,\n  SandboxPathIsDirectoryError,\n} from '../SandboxErrors';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_PREVIEW_URL_EXPIRY_SECONDS, DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport type { ExecResult, SandboxBuild, SandboxExecParams, SandboxFileInfo, SandboxProvider } from './Provider';\n\nconst SANDBOX_NOT_FOUND_STATUS = 404;\n/** Another replica already registered this build name; its create is the one that counts. */\nconst SNAPSHOT_CONFLICT_STATUS = 409;\nconst SANDBOX_STATE_STARTED = 'started';\n\nconst BUILD_STATE_ACTIVE = 'active';\nconst BUILD_STATE_INACTIVE = 'inactive';\nconst BUILD_STATE_ERROR = 'error';\nconst BUILD_STATE_BUILD_FAILED = 'build_failed';\n\nconst IMAGE_BUILD_NAME_PREFIX = 'trueforge-build-';\n/** Same default the Daytona SDK applies when `DaytonaConfig.apiUrl` is omitted. */\nconst DEFAULT_DAYTONA_API_URL = 'https://app.daytona.io/api';\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/**\n * Digest portion of a container image reference (the tag/digest after the final `:`)\n * The release image is always published with an explicit digest tag\n */\nfunction imageDigest(image: string): string {\n  const lastSegment = image.slice(image.lastIndexOf('/') + 1);\n  const colon = lastSegment.lastIndexOf(':');\n  if (colon === -1) {\n    throw new Error(`Sandbox image reference has no tag/digest: ${image}`);\n  }\n  return lastSegment.slice(colon + 1);\n}\n\n/** Deterministic build name per image digest so every server replica converges on one build. */\nfunction deriveImageBuildName(digest: string): string {\n  return `${IMAGE_BUILD_NAME_PREFIX}${digest}`;\n}\n\n/** Terminal-failure build states: a build stuck here never becomes ready on its own. */\nfunction isFailedBuildState(state: Snapshot['state']): boolean {\n  return state === BUILD_STATE_ERROR || state === BUILD_STATE_BUILD_FAILED;\n}\n\n/** Convert Daytona https preview URLs to wss for the NATS client. */\nfunction httpUrlToWsUrl(url: string): string {\n  const parsed = new URL(url);\n  if (parsed.protocol === 'https:') {\n    parsed.protocol = 'wss:';\n  } else if (parsed.protocol === 'http:') {\n    parsed.protocol = 'ws:';\n  }\n  return parsed.toString();\n}\n\nexport interface DaytonaSandboxProviderOptions {\n  /** Caller-owned Daytona SDK client (credentials / lifetime). */\n  client: Daytona;\n  /**\n   * Same API key the client was built with; used for the register-only snapshot POST because the\n   * SDK's `snapshot.create` polls to a terminal state instead of returning once registered.\n   */\n  apiKey: string;\n  /** Daytona API base URL (including `/api`). Defaults to the SDK's public cloud endpoint. */\n  apiUrl?: string | undefined;\n  tenantName: string;\n  /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */\n  sandboxImage: string;\n  /**\n   * Daytona snapshot name to clone sandboxes from. When omitted it is derived from the image\n   * digest. Callers that create sandboxes pass the persisted build_ref so cloning targets the\n   * snapshot that was actually built, not a speculative name derived from the current image.\n   */\n  buildRef?: string | undefined;\n  timeoutMs: number;\n  autoStopIntervalInMinutes: number;\n  autoArchiveIntervalInMinutes: number;\n  autoDeleteIntervalInMinutes: number;\n  fileMaxBytesForDownload: number;\n  /** Defaults to the built-in sandbox NATS WebSocket port (4444). */\n  natsBridgePort?: number;\n  /** Defaults to 1 hour (same as the gateway's max agent execution time). */\n  previewUrlExpirySeconds?: number;\n  logger: Logger;\n}\n\nexport class DaytonaSandboxProvider implements SandboxProvider {\n  private readonly tenantName: string;\n  /** Release-owned sandbox image reference; built into a Daytona snapshot and cloned per sandbox. */\n  private readonly imageUri: string;\n  /** Daytona snapshot name sandboxes are cloned from; the persisted build_ref, or derived from the image digest. */\n  private readonly buildRef: string;\n  private readonly timeoutMs: number;\n  private readonly autoStopIntervalInMinutes: number;\n  private readonly autoArchiveIntervalInMinutes: number;\n  private readonly autoDeleteIntervalInMinutes: number;\n  private readonly fileMaxBytesForDownload: number;\n  private readonly natsBridgePort: number;\n  private readonly previewUrlExpirySeconds: number;\n  private readonly apiKey: string;\n  private readonly apiUrl: string;\n  private readonly logger: Logger;\n  private readonly daytona: Daytona;\n  private static readonly cachedSandboxes = new Map<string, { sandbox: Sandbox; defaultTimeoutMs: number }>();\n  // De-dupes concurrent recovery attempts on the same sandbox to a single refreshData+start round-trip.\n  private static readonly inFlightRecoveries = new Map<string, Promise<boolean>>();\n\n  constructor(options: DaytonaSandboxProviderOptions) {\n    this.daytona = options.client;\n    this.apiKey = options.apiKey;\n    this.apiUrl = options.apiUrl ?? DEFAULT_DAYTONA_API_URL;\n    this.tenantName = options.tenantName;\n    this.imageUri = options.sandboxImage;\n    this.buildRef = options.buildRef ?? deriveImageBuildName(imageDigest(options.sandboxImage));\n    this.timeoutMs = options.timeoutMs;\n    this.autoStopIntervalInMinutes = options.autoStopIntervalInMinutes;\n    this.autoArchiveIntervalInMinutes = options.autoArchiveIntervalInMinutes;\n    this.autoDeleteIntervalInMinutes = options.autoDeleteIntervalInMinutes;\n    this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n    this.natsBridgePort = options.natsBridgePort ?? DEFAULT_SANDBOX_NATS_WS_PORT;\n    this.previewUrlExpirySeconds = options.previewUrlExpirySeconds ?? DEFAULT_PREVIEW_URL_EXPIRY_SECONDS;\n    this.logger = options.logger.child({ module: 'DaytonaProvider' });\n  }\n\n  private async getOrCreateSandbox(sandboxId?: string): Promise<{ sandbox: Sandbox; defaultTimeoutMs: number }> {\n    if (sandboxId) {\n      const cached = DaytonaSandboxProvider.cachedSandboxes.get(sandboxId);\n      if (cached) {\n        return cached;\n      }\n    }\n\n    const sandbox = sandboxId\n      ? await this.restoreExistingSandbox(sandboxId)\n      : await this.daytona.create({\n          name: `${this.tenantName}.${randomUUID()}`,\n          snapshot: this.buildRef,\n          autoStopInterval: this.autoStopIntervalInMinutes,\n          autoArchiveInterval: this.autoArchiveIntervalInMinutes,\n          autoDeleteInterval: this.autoDeleteIntervalInMinutes,\n        });\n\n    const entry = { sandbox, defaultTimeoutMs: this.timeoutMs };\n    DaytonaSandboxProvider.cachedSandboxes.set(sandbox.name, entry);\n    return entry;\n  }\n\n  // Returns true iff the caller should retry: either we restarted a stopped sandbox, or the cache entry is missing and the retry will rebuild it via the cold path.\n  private static recoverSandboxIfStopped(sandboxId: string): Promise<boolean> {\n    const existing = DaytonaSandboxProvider.inFlightRecoveries.get(sandboxId);\n    if (existing) {\n      return existing;\n    }\n\n    const cached = DaytonaSandboxProvider.cachedSandboxes.get(sandboxId);\n    // Cache may have been evicted by a concurrent error path; signal retry so getOrCreateSandbox rebuilds via restoreExistingSandbox.\n    if (!cached) {\n      return Promise.resolve(true);\n    }\n\n    const recovery = (async () => {\n      await cached.sandbox.refreshData();\n      if (cached.sandbox.state === SANDBOX_STATE_STARTED) {\n        return false;\n      }\n      // start() covers both stopped and archived per Daytona; throws on unrecoverable states (error/destroyed).\n      await cached.sandbox.start();\n      return true;\n    })().finally(() => {\n      DaytonaSandboxProvider.inFlightRecoveries.delete(sandboxId);\n    });\n\n    DaytonaSandboxProvider.inFlightRecoveries.set(sandboxId, recovery);\n    return recovery;\n  }\n\n  private async executeWithSandboxRecovery<T>(sandboxId: string, operation: () => Promise<T>): Promise<T> {\n    try {\n      return await operation();\n    } catch (originalError) {\n      // TODO: Narrow to a specific Daytona error code once @daytona/sdk exposes one for \"sandbox not running\".\n      if (!(originalError instanceof DaytonaError)) {\n        throw originalError;\n      }\n\n      let recovered: boolean;\n      try {\n        recovered = await DaytonaSandboxProvider.recoverSandboxIfStopped(sandboxId);\n      } catch (recoveryError) {\n        this.logger.error('Sandbox recovery failed', {\n          ...extractErrorLogFields(recoveryError),\n          originalError: extractErrorLogFields(originalError),\n        });\n        throw new Error('Sandbox is unavailable; recovery attempt failed.', { cause: recoveryError });\n      }\n\n      if (!recovered) {\n        throw originalError;\n      }\n\n      try {\n        return await operation();\n      } catch (retryError) {\n        this.logger.error('Sandbox operation failed after successful recovery', {\n          ...extractErrorLogFields(retryError),\n          originalError: extractErrorLogFields(originalError),\n        });\n        // Rethrow as-is so callers can match domain error types (SandboxPathIsDirectoryError, DaytonaError statusCode mappings, etc.).\n        throw retryError;\n      }\n    }\n  }\n\n  private async restoreExistingSandbox(sandboxId: string): Promise<Sandbox> {\n    try {\n      const sandbox = await this.daytona.get(sandboxId);\n      if (sandbox.state !== SANDBOX_STATE_STARTED) {\n        await sandbox.start();\n      }\n      return sandbox;\n    } catch (ex) {\n      if (ex instanceof DaytonaError && ex.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n        throw new SandboxNotAvailableError(sandboxId);\n      }\n      throw ex;\n    }\n  }\n\n  async createSandbox(): Promise<{ sandboxId: string }> {\n    return context.with(suppressTracing(context.active()), async () => {\n      const { sandbox } = await this.getOrCreateSandbox();\n      this.logger.debug(`Sandbox created: name=${sandbox.name}`);\n      return { sandboxId: sandbox.name };\n    });\n  }\n\n  /** Resolves undefined when no snapshot carries that name; auth/other failures throw. */\n  private async getSnapshot(name: string): Promise<Snapshot | undefined> {\n    try {\n      return await this.daytona.snapshot.get(name);\n    } catch (error) {\n      if (error instanceof DaytonaError && error.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n        return undefined;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Drops a build stuck in a terminal-failure state so a fresh create can reuse its\n   * deterministic name. A concurrent replica may have deleted it already (404) — that\n   * is fine and treated as success.\n   */\n  private async deleteFailedBuild(snapshot: Snapshot): Promise<void> {\n    try {\n      await this.daytona.snapshot.delete(snapshot);\n    } catch (error) {\n      if (error instanceof DaytonaError && error.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n        return;\n      }\n      throw error;\n    }\n  }\n\n  private toBuild(state: string, errorReason: string | null): SandboxBuild {\n    const metadata = { build_ref: this.buildRef, image_uri: this.imageUri };\n    switch (state) {\n      case BUILD_STATE_ACTIVE:\n        return { status: 'ready', reason: null, metadata };\n      case BUILD_STATE_ERROR:\n      case BUILD_STATE_BUILD_FAILED:\n        return { status: 'failed', reason: errorReason ?? `Sandbox image build failed (${state}).`, metadata };\n      default:\n        // pending / building / pulling / removing / future states: not ready yet.\n        return { status: 'pending', reason: `Sandbox image build in progress (${state}).`, metadata };\n    }\n  }\n\n  /**\n   * Registers the snapshot and returns its initial state without waiting for the build.\n   *\n   * The SDK's `snapshot.create` issues this same POST and then polls until the snapshot is active\n   * or failed (minutes on a cold image pull). Configure only needs the registration result, so\n   * credential errors surface on the request while build progress stays observable via `getSnapshot`.\n   */\n  private async registerSnapshot(): Promise<{ state: string; errorReason: string | null }> {\n    let response: Response;\n    try {\n      response = await fetch(`${this.apiUrl}/snapshots`, {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${this.apiKey}`,\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify({ name: this.buildRef, imageName: this.imageUri }),\n      });\n    } catch (error) {\n      throw new Error('Daytona snapshot registration request failed.', { cause: error });\n    }\n\n    const body: unknown = await response.json().catch(() => null);\n    if (!response.ok) {\n      const message =\n        isRecord(body) && typeof body['message'] === 'string'\n          ? body['message']\n          : `Daytona snapshot registration failed (${String(response.status)})`;\n      throw new DaytonaError(message, response.status);\n    }\n    if (!isRecord(body) || typeof body['state'] !== 'string') {\n      throw new DaytonaError(\"Failed to register snapshot. Daytona didn't return a snapshot state.\");\n    }\n    return {\n      state: body['state'],\n      errorReason: typeof body['errorReason'] === 'string' ? body['errorReason'] : null,\n    };\n  }\n\n  async buildImage(): Promise<SandboxBuild> {\n    const existing = await this.getSnapshot(this.buildRef);\n    if (existing) {\n      // Daytona parks unused snapshots as 'inactive' after ~2 idle weeks; reactivate rather than rebuild.\n      if (existing.state === BUILD_STATE_INACTIVE) {\n        const activated = await this.daytona.snapshot.activate(existing);\n        return this.toBuild(activated.state, activated.errorReason);\n      }\n      if (!isFailedBuildState(existing.state)) {\n        return this.toBuild(existing.state, existing.errorReason);\n      }\n      // A failed build keeps the deterministic name occupied and never self-heals, so\n      // re-saving settings (which calls buildImage) could never retry. Drop it, then recreate.\n      await this.deleteFailedBuild(existing);\n    }\n\n    try {\n      const registered = await this.registerSnapshot();\n      // Registration returns pending almost always; map whatever Daytona sent so a fast\n      // active/error still surfaces correctly without a follow-up GET.\n      return this.toBuild(registered.state, registered.errorReason);\n    } catch (error) {\n      // A losing concurrent create is not a build failure: the winner owns the deterministic name.\n      if (error instanceof DaytonaError && error.statusCode === SNAPSHOT_CONFLICT_STATUS) {\n        this.logger.info(`Daytona snapshot already created concurrently: name=${this.buildRef}`);\n        return {\n          status: 'pending',\n          reason: 'Sandbox image build started by another server replica.',\n          metadata: { build_ref: this.buildRef, image_uri: this.imageUri },\n        };\n      }\n      throw error;\n    }\n  }\n\n  async getImageBuildStatus(): Promise<SandboxBuild> {\n    const snapshot = await this.getSnapshot(this.buildRef);\n    // Read-only: a missing build reports pending; PUT /settings/sandbox-providers starts the build.\n    if (!snapshot) {\n      return {\n        status: 'pending',\n        reason: 'Sandbox image build not started.',\n        metadata: { build_ref: this.buildRef, image_uri: this.imageUri },\n      };\n    }\n    return this.toBuild(snapshot.state, snapshot.errorReason);\n  }\n\n  async exec(params: SandboxExecParams): Promise<ExecResult> {\n    return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n      try {\n        return await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox, defaultTimeoutMs } = await this.getOrCreateSandbox(params.sandboxId);\n          const response = await sandbox.process.executeCommand(\n            params.command,\n            params.cwd,\n            params.env ?? {},\n            params.timeoutSeconds ?? defaultTimeoutMs / 1000,\n          );\n          return {\n            success: true,\n            response: { exitCode: response.exitCode, result: response.result },\n          };\n        });\n      } catch (e: unknown) {\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        this.logger.error('Sandbox execution error', extractErrorLogFields(e));\n        const message = e instanceof Error ? e.message : 'Unknown error';\n        return { success: false, error: message };\n      }\n    });\n  }\n\n  private async getFileInfo(sandbox: Sandbox, path: string): Promise<SandboxFileInfo> {\n    const details = await sandbox.fs.getFileDetails(path);\n    return { size: details.size, isDir: details.isDir };\n  }\n\n  async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n    return context.with(suppressTracing(context.active()), async () => {\n      try {\n        return await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox } = await this.getOrCreateSandbox(params.sandboxId);\n\n          const info = await this.getFileInfo(sandbox, params.path);\n          if (info.isDir) {\n            throw new SandboxPathIsDirectoryError(params.path);\n          }\n          if (info.size > this.fileMaxBytesForDownload) {\n            throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n          }\n\n          return await sandbox.fs.downloadFile(params.path);\n        });\n      } catch (e: unknown) {\n        if (e instanceof SandboxPathIsDirectoryError || e instanceof SandboxFileTooLargeError) {\n          throw e;\n        }\n        if (e instanceof DaytonaError && e.statusCode === SANDBOX_NOT_FOUND_STATUS) {\n          throw new SandboxFileNotFoundError(params.path);\n        }\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        throw e;\n      }\n    });\n  }\n\n  async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n    return context.with(suppressTracing(context.active()), async () => {\n      try {\n        await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox } = await this.getOrCreateSandbox(params.sandboxId);\n          await sandbox.fs.uploadFile(params.content, params.remotePath);\n        });\n      } catch (e: unknown) {\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        throw e;\n      }\n    });\n  }\n\n  // Mints a signed, time-limited https preview URL exposing the given sandbox port.\n  private async getPreviewUrl(params: { sandboxId: string; port: number; expiresInSeconds: number }): Promise<string> {\n    return context.with(suppressTracing(context.active()), async () => {\n      try {\n        return await this.executeWithSandboxRecovery(params.sandboxId, async () => {\n          const { sandbox } = await this.getOrCreateSandbox(params.sandboxId);\n          const signed = await sandbox.getSignedPreviewUrl(params.port, params.expiresInSeconds);\n          return signed.url;\n        });\n      } catch (e: unknown) {\n        DaytonaSandboxProvider.cachedSandboxes.delete(params.sandboxId);\n        this.logger.error('Failed to create signed preview URL', extractErrorLogFields(e));\n        throw e;\n      }\n    });\n  }\n\n  createCodeModeTransport(): CodeModeTransport {\n    return new CodeModeNatsTransport({\n      resolveHostUrl: async (sandboxId: string) => {\n        const previewUrl = await this.getPreviewUrl({\n          sandboxId,\n          port: this.natsBridgePort,\n          expiresInSeconds: this.previewUrlExpirySeconds,\n        });\n        return httpUrlToWsUrl(previewUrl);\n      },\n      sandboxClientNatsUrl: `ws://localhost:${String(this.natsBridgePort)}`,\n      logger: this.logger,\n    });\n  }\n\n  getAdditionalInstructions(): string | undefined {\n    return undefined;\n  }\n\n  getToolResultDumpDir(): string {\n    return '/tmp/tool-results';\n  }\n\n  getGitCredentialsPath(): string {\n    // Isolated container per sandbox; absolute path so GIT_CONFIG_* needs no $HOME expansion.\n    return '/tmp/.git-credentials';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,iBAAsC;AACtC,iBAAwB;AACxB,kBAAgC;AAChC,oBAA2B;AAE3B,4BAAsC;AACtC,2BAKO;AAEP,mCAAsC;AACtC,uBAAiF;AAGjF,IAAM,2BAA2B;AAEjC,IAAM,2BAA2B;AACjC,IAAM,wBAAwB;AAE9B,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAC7B,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AAEjC,IAAM,0BAA0B;AAEhC,IAAM,0BAA0B;AAEhC,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAMA,SAAS,YAAY,OAAuB;AAC1C,QAAM,cAAc,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1D,QAAM,QAAQ,YAAY,YAAY,GAAG;AACzC,MAAI,UAAU,IAAI;AAChB,UAAM,IAAI,MAAM,8CAA8C,KAAK,EAAE;AAAA,EACvE;AACA,SAAO,YAAY,MAAM,QAAQ,CAAC;AACpC;AAGA,SAAS,qBAAqB,QAAwB;AACpD,SAAO,GAAG,uBAAuB,GAAG,MAAM;AAC5C;AAGA,SAAS,mBAAmB,OAAmC;AAC7D,SAAO,UAAU,qBAAqB,UAAU;AAClD;AAGA,SAAS,eAAe,KAAqB;AAC3C,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MAAI,OAAO,aAAa,UAAU;AAChC,WAAO,WAAW;AAAA,EACpB,WAAW,OAAO,aAAa,SAAS;AACtC,WAAO,WAAW;AAAA,EACpB;AACA,SAAO,OAAO,SAAS;AACzB;AAiCO,IAAM,yBAAN,MAAM,wBAAkD;AAAA,EAC5C;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACjB,OAAwB,kBAAkB,oBAAI,IAA4D;AAAA;AAAA,EAE1G,OAAwB,qBAAqB,oBAAI,IAA8B;AAAA,EAE/E,YAAY,SAAwC;AAClD,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ;AACtB,SAAK,SAAS,QAAQ,UAAU;AAChC,SAAK,aAAa,QAAQ;AAC1B,SAAK,WAAW,QAAQ;AACxB,SAAK,WAAW,QAAQ,YAAY,qBAAqB,YAAY,QAAQ,YAAY,CAAC;AAC1F,SAAK,YAAY,QAAQ;AACzB,SAAK,4BAA4B,QAAQ;AACzC,SAAK,+BAA+B,QAAQ;AAC5C,SAAK,8BAA8B,QAAQ;AAC3C,SAAK,0BAA0B,QAAQ;AACvC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,0BAA0B,QAAQ,2BAA2B;AAClE,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAClE;AAAA,EAEA,MAAc,mBAAmB,WAA6E;AAC5G,QAAI,WAAW;AACb,YAAM,SAAS,wBAAuB,gBAAgB,IAAI,SAAS;AACnE,UAAI,QAAQ;AACV,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,UAAU,YACZ,MAAM,KAAK,uBAAuB,SAAS,IAC3C,MAAM,KAAK,QAAQ,OAAO;AAAA,MACxB,MAAM,GAAG,KAAK,UAAU,QAAI,0BAAW,CAAC;AAAA,MACxC,UAAU,KAAK;AAAA,MACf,kBAAkB,KAAK;AAAA,MACvB,qBAAqB,KAAK;AAAA,MAC1B,oBAAoB,KAAK;AAAA,IAC3B,CAAC;AAEL,UAAM,QAAQ,EAAE,SAAS,kBAAkB,KAAK,UAAU;AAC1D,4BAAuB,gBAAgB,IAAI,QAAQ,MAAM,KAAK;AAC9D,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAe,wBAAwB,WAAqC;AAC1E,UAAM,WAAW,wBAAuB,mBAAmB,IAAI,SAAS;AACxE,QAAI,UAAU;AACZ,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,wBAAuB,gBAAgB,IAAI,SAAS;AAEnE,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,QAAQ,IAAI;AAAA,IAC7B;AAEA,UAAM,YAAY,YAAY;AAC5B,YAAM,OAAO,QAAQ,YAAY;AACjC,UAAI,OAAO,QAAQ,UAAU,uBAAuB;AAClD,eAAO;AAAA,MACT;AAEA,YAAM,OAAO,QAAQ,MAAM;AAC3B,aAAO;AAAA,IACT,GAAG,EAAE,QAAQ,MAAM;AACjB,8BAAuB,mBAAmB,OAAO,SAAS;AAAA,IAC5D,CAAC;AAED,4BAAuB,mBAAmB,IAAI,WAAW,QAAQ;AACjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,2BAA8B,WAAmB,WAAyC;AACtG,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,SAAS,eAAe;AAEtB,UAAI,EAAE,yBAAyB,0BAAe;AAC5C,cAAM;AAAA,MACR;AAEA,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,wBAAuB,wBAAwB,SAAS;AAAA,MAC5E,SAAS,eAAe;AACtB,aAAK,OAAO,MAAM,2BAA2B;AAAA,UAC3C,OAAG,6CAAsB,aAAa;AAAA,UACtC,mBAAe,6CAAsB,aAAa;AAAA,QACpD,CAAC;AACD,cAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,cAAc,CAAC;AAAA,MAC9F;AAEA,UAAI,CAAC,WAAW;AACd,cAAM;AAAA,MACR;AAEA,UAAI;AACF,eAAO,MAAM,UAAU;AAAA,MACzB,SAAS,YAAY;AACnB,aAAK,OAAO,MAAM,sDAAsD;AAAA,UACtE,OAAG,6CAAsB,UAAU;AAAA,UACnC,mBAAe,6CAAsB,aAAa;AAAA,QACpD,CAAC;AAED,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,uBAAuB,WAAqC;AACxE,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,QAAQ,IAAI,SAAS;AAChD,UAAI,QAAQ,UAAU,uBAAuB;AAC3C,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,aAAO;AAAA,IACT,SAAS,IAAI;AACX,UAAI,cAAc,2BAAgB,GAAG,eAAe,0BAA0B;AAC5E,cAAM,IAAI,8CAAyB,SAAS;AAAA,MAC9C;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgD;AACpD,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,YAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB;AAClD,WAAK,OAAO,MAAM,yBAAyB,QAAQ,IAAI,EAAE;AACzD,aAAO,EAAE,WAAW,QAAQ,KAAK;AAAA,IACnC,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAc,YAAY,MAA6C;AACrE,QAAI;AACF,aAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,IAAI;AAAA,IAC7C,SAAS,OAAO;AACd,UAAI,iBAAiB,2BAAgB,MAAM,eAAe,0BAA0B;AAClF,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,kBAAkB,UAAmC;AACjE,QAAI;AACF,YAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ;AAAA,IAC7C,SAAS,OAAO;AACd,UAAI,iBAAiB,2BAAgB,MAAM,eAAe,0BAA0B;AAClF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,QAAQ,OAAe,aAA0C;AACvE,UAAM,WAAW,EAAE,WAAW,KAAK,UAAU,WAAW,KAAK,SAAS;AACtE,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS;AAAA,MACnD,KAAK;AAAA,MACL,KAAK;AACH,eAAO,EAAE,QAAQ,UAAU,QAAQ,eAAe,+BAA+B,KAAK,MAAM,SAAS;AAAA,MACvG;AAEE,eAAO,EAAE,QAAQ,WAAW,QAAQ,oCAAoC,KAAK,MAAM,SAAS;AAAA,IAChG;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,mBAA2E;AACvF,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,GAAG,KAAK,MAAM,cAAc;AAAA,QACjD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,MAAM;AAAA,UACpC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAM,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC;AAAA,MACxE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,MAAM,iDAAiD,EAAE,OAAO,MAAM,CAAC;AAAA,IACnF;AAEA,UAAM,OAAgB,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAC5D,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,UACJ,SAAS,IAAI,KAAK,OAAO,KAAK,SAAS,MAAM,WACzC,KAAK,SAAS,IACd,yCAAyC,OAAO,SAAS,MAAM,CAAC;AACtE,YAAM,IAAI,wBAAa,SAAS,SAAS,MAAM;AAAA,IACjD;AACA,QAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,OAAO,MAAM,UAAU;AACxD,YAAM,IAAI,wBAAa,sEAAsE;AAAA,IAC/F;AACA,WAAO;AAAA,MACL,OAAO,KAAK,OAAO;AAAA,MACnB,aAAa,OAAO,KAAK,aAAa,MAAM,WAAW,KAAK,aAAa,IAAI;AAAA,IAC/E;AAAA,EACF;AAAA,EAEA,MAAM,aAAoC;AACxC,UAAM,WAAW,MAAM,KAAK,YAAY,KAAK,QAAQ;AACrD,QAAI,UAAU;AAEZ,UAAI,SAAS,UAAU,sBAAsB;AAC3C,cAAM,YAAY,MAAM,KAAK,QAAQ,SAAS,SAAS,QAAQ;AAC/D,eAAO,KAAK,QAAQ,UAAU,OAAO,UAAU,WAAW;AAAA,MAC5D;AACA,UAAI,CAAC,mBAAmB,SAAS,KAAK,GAAG;AACvC,eAAO,KAAK,QAAQ,SAAS,OAAO,SAAS,WAAW;AAAA,MAC1D;AAGA,YAAM,KAAK,kBAAkB,QAAQ;AAAA,IACvC;AAEA,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,iBAAiB;AAG/C,aAAO,KAAK,QAAQ,WAAW,OAAO,WAAW,WAAW;AAAA,IAC9D,SAAS,OAAO;AAEd,UAAI,iBAAiB,2BAAgB,MAAM,eAAe,0BAA0B;AAClF,aAAK,OAAO,KAAK,uDAAuD,KAAK,QAAQ,EAAE;AACvF,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,EAAE,WAAW,KAAK,UAAU,WAAW,KAAK,SAAS;AAAA,QACjE;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,sBAA6C;AACjD,UAAM,WAAW,MAAM,KAAK,YAAY,KAAK,QAAQ;AAErD,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,UAAU,EAAE,WAAW,KAAK,UAAU,WAAW,KAAK,SAAS;AAAA,MACjE;AAAA,IACF;AACA,WAAO,KAAK,QAAQ,SAAS,OAAO,SAAS,WAAW;AAAA,EAC1D;AAAA,EAEA,MAAM,KAAK,QAAgD;AACzD,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAiC;AACtF,UAAI;AACF,eAAO,MAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AACzE,gBAAM,EAAE,SAAS,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AACpF,gBAAM,WAAW,MAAM,QAAQ,QAAQ;AAAA,YACrC,OAAO;AAAA,YACP,OAAO;AAAA,YACP,OAAO,OAAO,CAAC;AAAA,YACf,OAAO,kBAAkB,mBAAmB;AAAA,UAC9C;AACA,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,UAAU,EAAE,UAAU,SAAS,UAAU,QAAQ,SAAS,OAAO;AAAA,UACnE;AAAA,QACF,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,aAAK,OAAO,MAAM,+BAA2B,6CAAsB,CAAC,CAAC;AACrE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,SAAkB,MAAwC;AAClF,UAAM,UAAU,MAAM,QAAQ,GAAG,eAAe,IAAI;AACpD,WAAO,EAAE,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM;AAAA,EACpD;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,UAAI;AACF,eAAO,MAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AACzE,gBAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AAElE,gBAAM,OAAO,MAAM,KAAK,YAAY,SAAS,OAAO,IAAI;AACxD,cAAI,KAAK,OAAO;AACd,kBAAM,IAAI,iDAA4B,OAAO,IAAI;AAAA,UACnD;AACA,cAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,kBAAM,IAAI,8CAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,UACzF;AAEA,iBAAO,MAAM,QAAQ,GAAG,aAAa,OAAO,IAAI;AAAA,QAClD,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,YAAI,aAAa,oDAA+B,aAAa,+CAA0B;AACrF,gBAAM;AAAA,QACR;AACA,YAAI,aAAa,2BAAgB,EAAE,eAAe,0BAA0B;AAC1E,gBAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,QAChD;AACA,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,UAAI;AACF,cAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AAClE,gBAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AAClE,gBAAM,QAAQ,GAAG,WAAW,OAAO,SAAS,OAAO,UAAU;AAAA,QAC/D,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAc,cAAc,QAAwF;AAClH,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,UAAI;AACF,eAAO,MAAM,KAAK,2BAA2B,OAAO,WAAW,YAAY;AACzE,gBAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,mBAAmB,OAAO,SAAS;AAClE,gBAAM,SAAS,MAAM,QAAQ,oBAAoB,OAAO,MAAM,OAAO,gBAAgB;AACrF,iBAAO,OAAO;AAAA,QAChB,CAAC;AAAA,MACH,SAAS,GAAY;AACnB,gCAAuB,gBAAgB,OAAO,OAAO,SAAS;AAC9D,aAAK,OAAO,MAAM,2CAAuC,6CAAsB,CAAC,CAAC;AACjF,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,0BAA6C;AAC3C,WAAO,IAAI,mDAAsB;AAAA,MAC/B,gBAAgB,OAAO,cAAsB;AAC3C,cAAM,aAAa,MAAM,KAAK,cAAc;AAAA,UAC1C;AAAA,UACA,MAAM,KAAK;AAAA,UACX,kBAAkB,KAAK;AAAA,QACzB,CAAC;AACD,eAAO,eAAe,UAAU;AAAA,MAClC;AAAA,MACA,sBAAsB,kBAAkB,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,4BAAgD;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAE9B,WAAO;AAAA,EACT;AACF;","names":[]}