npm - @truefoundry/trueforge-core - Versions diffs - 0.2.0 → 0.2.1 - Mend

@truefoundry/trueforge-core 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (34) hide show

package/dist/core/index.d.ts +1 -0
package/dist/core/index.d.ts.map +1 -1
package/dist/core/index.js +7 -0
package/dist/core/index.js.map +1 -1
package/dist/core/index.mjs +4 -0
package/dist/core/index.mjs.map +1 -1
package/dist/core/llm/VercelAILLM.d.ts.map +1 -1
package/dist/core/llm/VercelAILLM.js +7 -0
package/dist/core/llm/VercelAILLM.js.map +1 -1
package/dist/core/llm/VercelAILLM.mjs +7 -0
package/dist/core/llm/VercelAILLM.mjs.map +1 -1
package/dist/core/mcp/RemoteMCP.d.ts +2 -1
package/dist/core/mcp/RemoteMCP.d.ts.map +1 -1
package/dist/core/mcp/RemoteMCP.js +65 -20
package/dist/core/mcp/RemoteMCP.js.map +1 -1
package/dist/core/mcp/RemoteMCP.mjs +65 -20
package/dist/core/mcp/RemoteMCP.mjs.map +1 -1
package/dist/core/mcp/remoteMcpClient.d.ts.map +1 -1
package/dist/core/mcp/remoteMcpClient.js +2 -5
package/dist/core/mcp/remoteMcpClient.js.map +1 -1
package/dist/core/mcp/remoteMcpClient.mjs +2 -5
package/dist/core/mcp/remoteMcpClient.mjs.map +1 -1
package/dist/core/sandbox/provider/TFYSandboxProvider.d.ts.map +1 -1
package/dist/core/sandbox/provider/TFYSandboxProvider.js +19 -6
package/dist/core/sandbox/provider/TFYSandboxProvider.js.map +1 -1
package/dist/core/sandbox/provider/TFYSandboxProvider.mjs +19 -7
package/dist/core/sandbox/provider/TFYSandboxProvider.mjs.map +1 -1
package/dist/core/util/ssrfGuard.d.ts +10 -0
package/dist/core/util/ssrfGuard.d.ts.map +1 -0
package/dist/core/util/ssrfGuard.js +333 -0
package/dist/core/util/ssrfGuard.js.map +1 -0
package/dist/core/util/ssrfGuard.mjs +305 -0
package/dist/core/util/ssrfGuard.mjs.map +1 -0
package/package.json +1 -1

package/dist/core/sandbox/provider/TFYSandboxProvider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport dedent from 'dedent';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path/posix';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport {\n SandboxFileNotFoundError,\n SandboxFileTooLargeError,\n SandboxPathIsDirectoryError,\n validateSandboxOwnedByTenant,\n} from '../SandboxErrors';\nimport { absolutizeRelativeExecEnv } from './execEnv';\nimport {\n ensureExecSuccess,\n shellEscape,\n type ExecResult,\n type SandboxBuild,\n type SandboxExecParams,\n type SandboxFileInfo,\n type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\nconst TFY_MCP_CLIENT_BIN = 'mcp-client/bin';\n\n/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). /\nexport function withMcpClientOnPath(path: string): string {\n const rest = path.split(':').filter(part => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);\n return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(':')}`;\n}\n\nfunction parsePwdAndPath(text: string): { root: string; inheritedPath: string } \| undefined {\n const lines = text.replace(/\\r\\n/g, '\\n').split('\\n');\n const root = lines[0];\n if (!root?.startsWith('/')) {\n return undefined;\n }\n return { root, inheritedPath: lines[1] ?? '' };\n}\n\nexport interface TFYSandboxProviderOptions {\n serverUrl: string;\n natsBridgeUrl: string;\n tenantName: string;\n fileMaxBytesForDownload: number;\n defaultExecTimeoutMs?: number \| undefined;\n logger: Logger;\n}\n\ninterface StatResult {\n size: number;\n type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n readonly type = 'truefoundry';\n private readonly serverUrl: string;\n private readonly natsBridgeUrl: string;\n private readonly tenantName: string;\n private readonly fileMaxBytesForDownload: number;\n private readonly defaultExecTimeoutSeconds: number;\n private readonly logger: Logger;\n /* Discovered via `pwd` + `$PATH` — never a hardcoded host layout. /\n private readonly sandboxLayouts = new Map<string, { root: string; inheritedPath: string }>();\n\n constructor(options: TFYSandboxProviderOptions) {\n this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n this.natsBridgeUrl = options.natsBridgeUrl;\n this.tenantName = options.tenantName;\n this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS 1000) / 1000);\n this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n }\n\n // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n private static readonly readyBuild: SandboxBuild = {\n status: 'ready',\n reason: null,\n metadata: null,\n };\n\n buildImage(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n getImageBuildStatus(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n createSandbox(): Promise<{ sandboxId: string }> {\n const sandboxId = `${this.tenantName}.${randomUUID()}`;\n this.logger.debug(`Sandbox created: id=${sandboxId}`);\n return Promise.resolve({ sandboxId });\n }\n\n /*\n No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative\n * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so\n * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.\n /\n async exec(params: SandboxExecParams): Promise<ExecResult> {\n validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);\n const incoming = params.env ?? {};\n const env = absolutizeRelativeExecEnv({\n root,\n env: { ...incoming, PATH: withMcpClientOnPath(incoming['PATH'] ?? inheritedPath) },\n });\n return this.postExec({ ...params, env });\n }\n\n private async sandboxLayout(sandboxId: string): Promise<{ root: string; inheritedPath: string }> {\n const cached = this.sandboxLayouts.get(sandboxId);\n if (cached !== undefined) {\n return cached;\n }\n const result = await this.postExec({\n sandboxId,\n command: 'printf \\'%s\\\\n%s\\\\n\\' \"$(pwd)\" \"$PATH\"',\n });\n if (!result.success) {\n throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);\n }\n const parsed = parsePwdAndPath(result.response.result);\n if (parsed === undefined) {\n throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);\n }\n this.sandboxLayouts.set(sandboxId, parsed);\n return parsed;\n }\n\n private async postExec(params: SandboxExecParams): Promise<ExecResult> {\n return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n // request timeout and the client abort timer; fall back to the provider default otherwise.\n const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n const body = {\n sandbox_id: params.sandboxId,\n command: params.command,\n cwd: params.cwd,\n env: params.env,\n timeout: timeoutSeconds,\n };\n\n const controller = new AbortController();\n const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) 1000;\n const timer = setTimeout(() => {\n controller.abort();\n }, clientTimeoutMs);\n\n try {\n const response = await fetch(`${this.serverUrl}/exec`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(body),\n signal: controller.signal,\n });\n\n if (!response.ok) {\n const text = await response.text();\n this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n }\n\n const result = (await response.json()) as ExecResult;\n return result;\n } catch (e: unknown) {\n if (e instanceof Error && e.name === 'AbortError') {\n this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n }\n this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n const message = e instanceof Error ? e.message : 'Unknown error';\n return { success: false, error: message };\n } finally {\n clearTimeout(timer);\n }\n });\n }\n\n private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to stat file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n const parsed = JSON.parse(result.response.result) as StatResult;\n return { size: parsed.size, isDir: parsed.type === 'directory' };\n }\n\n async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n const info = await this.getFileInfo(params);\n if (info.isDir) {\n throw new SandboxPathIsDirectoryError(params.path);\n }\n if (info.size > this.fileMaxBytesForDownload) {\n throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n }\n\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `base64 -w0 ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to download file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n return Buffer.from(result.response.result.trim(), 'base64');\n }\n\n async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n const encoded = params.content.toString('base64');\n const escapedPath = shellEscape(params.remotePath);\n\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `echo ${shellEscape(encoded)} \| base64 -d > ${escapedPath}`,\n });\n ensureExecSuccess(result);\n }\n\n // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n createCodeModeTransport(): CodeModeTransport {\n return new CodeModeNatsTransport({\n resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n logger: this.logger,\n mcpClientInstall: { remotePath: join('mcp-client', 'mcp_client.py') },\n });\n }\n\n getAdditionalInstructions(): string {\n return dedent`\n SANDBOX RULES:\n - The Agent's first sandbox command should be \\`pwd\\` to discover the working directory.\n - uploads, skills, and tool-results live in that working directory (not /tmp or /opt).\n - ALL file creation and writes MUST stay within that working directory.\n - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n `;\n }\n\n // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.\n // uploads, skills, tool-results, skill_downloader.py, .git-credentials\n // mcp-client/mcp_client.py (no /usr/local/bin symlink)\n getToolResultDumpDir(): string {\n return 'tool-results';\n }\n\n getGitCredentialsPath(): string {\n return '.git-credentials';\n }\n\n getFileUploadsDir(): string {\n return 'uploads';\n }\n\n getSkillsDir(): string {\n return 'skills';\n }\n\n getSkillDownloaderPath(): string {\n return 'skill_downloader.py';\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAwB;AACxB,kBAAgC;AAChC,oBAAmB;AACnB,yBAA2B;AAC3B,mBAAqB;AAErB,4BAAsC;AAEtC,mCAAsC;AACtC,uBAA6C;AAC7C,2BAKO;AACP,qBAA0C;AAC1C,sBAQO;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAEtC,IAAM,qBAAqB;AAGpB,SAAS,oBAAoB,MAAsB;AACxD,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,UAAQ,KAAK,SAAS,KAAK,SAAS,kBAAkB;AAC1F,SAAO,KAAK,WAAW,IAAI,qBAAqB,GAAG,kBAAkB,IAAI,KAAK,KAAK,GAAG,CAAC;AACzF;AAEA,SAAS,gBAAgB,MAAmE;AAC1F,QAAM,QAAQ,KAAK,QAAQ,SAAS,IAAI,EAAE,MAAM,IAAI;AACpD,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM,WAAW,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,eAAe,MAAM,CAAC,KAAK,GAAG;AAC/C;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EAChD,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,iBAAiB,oBAAI,IAAqD;AAAA,EAE3F,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,QAAI,+BAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAAgD;AACzD,2DAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AACzF,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,KAAK,cAAc,OAAO,SAAS;AACzE,UAAM,WAAW,OAAO,OAAO,CAAC;AAChC,UAAM,UAAM,0CAA0B;AAAA,MACpC;AAAA,MACA,KAAK,EAAE,GAAG,UAAU,MAAM,oBAAoB,SAAS,MAAM,KAAK,aAAa,EAAE;AAAA,IACnF,CAAC;AACD,WAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,cAAc,WAAqE;AAC/F,UAAM,SAAS,KAAK,eAAe,IAAI,SAAS;AAChD,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,SAAS;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,gDAAgD,OAAO,KAAK,EAAE;AAAA,IAChF;AACA,UAAM,SAAS,gBAAgB,OAAO,SAAS,MAAM;AACrD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,MAAM,EAAE;AAAA,IAC1F;AACA,SAAK,eAAe,IAAI,WAAW,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,QAAgD;AACrE,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,SAAK,6CAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,2BAAuB,6CAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,kDAA8C,6BAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,iDAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,8CAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,kBAAc,6BAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,UAAM,UAAU,OAAO,QAAQ,SAAS,QAAQ;AAChD,UAAM,kBAAc,6BAAY,OAAO,UAAU;AAEjD,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,YAAQ,6BAAY,OAAO,CAAC,kBAAkB,WAAW;AAAA,IACpE,CAAC;AACD,2CAAkB,MAAM;AAAA,EAC1B;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,mDAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,6CAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,MACb,kBAAkB,EAAE,gBAAY,mBAAK,cAAc,eAAe,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO,cAAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT;AAAA;AAAA;AAAA;AAAA,EAKA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,oBAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,eAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAiC;AAC/B,WAAO;AAAA,EACT;AACF;","names":["dedent"]}
1	+ {"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport dedent from 'dedent';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path/posix';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport {\n SandboxFileNotFoundError,\n SandboxFileTooLargeError,\n SandboxPathIsDirectoryError,\n validateSandboxOwnedByTenant,\n} from '../SandboxErrors';\nimport { absolutizeRelativeExecEnv } from './execEnv';\nimport {\n shellEscape,\n type ExecResult,\n type SandboxBuild,\n type SandboxExecParams,\n type SandboxFileInfo,\n type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\n// TFY sandbox file upload timeout (same as Daytona SDK uploadFile default timeout).\nconst FILE_UPLOAD_TIMEOUT_MS = 30 * 60 * 1000;\n\nconst TFY_MCP_CLIENT_BIN = 'mcp-client/bin';\n\n/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). /\nexport function withMcpClientOnPath(path: string): string {\n const rest = path.split(':').filter(part => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);\n return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(':')}`;\n}\n\nfunction parsePwdAndPath(text: string): { root: string; inheritedPath: string } \| undefined {\n const lines = text.replace(/\\r\\n/g, '\\n').split('\\n');\n const root = lines[0];\n if (!root?.startsWith('/')) {\n return undefined;\n }\n return { root, inheritedPath: lines[1] ?? '' };\n}\n\nexport interface TFYSandboxProviderOptions {\n serverUrl: string;\n natsBridgeUrl: string;\n tenantName: string;\n fileMaxBytesForDownload: number;\n defaultExecTimeoutMs?: number \| undefined;\n logger: Logger;\n}\n\ninterface StatResult {\n size: number;\n type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n readonly type = 'truefoundry';\n private readonly serverUrl: string;\n private readonly natsBridgeUrl: string;\n private readonly tenantName: string;\n private readonly fileMaxBytesForDownload: number;\n private readonly defaultExecTimeoutSeconds: number;\n private readonly logger: Logger;\n /* Discovered via `pwd` + `$PATH` — never a hardcoded host layout. /\n private readonly sandboxLayouts = new Map<string, { root: string; inheritedPath: string }>();\n\n constructor(options: TFYSandboxProviderOptions) {\n this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n this.natsBridgeUrl = options.natsBridgeUrl;\n this.tenantName = options.tenantName;\n this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS 1000) / 1000);\n this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n }\n\n // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n private static readonly readyBuild: SandboxBuild = {\n status: 'ready',\n reason: null,\n metadata: null,\n };\n\n buildImage(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n getImageBuildStatus(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n createSandbox(): Promise<{ sandboxId: string }> {\n const sandboxId = `${this.tenantName}.${randomUUID()}`;\n this.logger.debug(`Sandbox created: id=${sandboxId}`);\n return Promise.resolve({ sandboxId });\n }\n\n /*\n No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative\n * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so\n * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.\n /\n async exec(params: SandboxExecParams): Promise<ExecResult> {\n validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);\n const incoming = params.env ?? {};\n const env = absolutizeRelativeExecEnv({\n root,\n env: { ...incoming, PATH: withMcpClientOnPath(incoming['PATH'] ?? inheritedPath) },\n });\n return this.postExec({ ...params, env });\n }\n\n private async sandboxLayout(sandboxId: string): Promise<{ root: string; inheritedPath: string }> {\n const cached = this.sandboxLayouts.get(sandboxId);\n if (cached !== undefined) {\n return cached;\n }\n const result = await this.postExec({\n sandboxId,\n command: 'printf \\'%s\\\\n%s\\\\n\\' \"$(pwd)\" \"$PATH\"',\n });\n if (!result.success) {\n throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);\n }\n const parsed = parsePwdAndPath(result.response.result);\n if (parsed === undefined) {\n throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);\n }\n this.sandboxLayouts.set(sandboxId, parsed);\n return parsed;\n }\n\n private async postExec(params: SandboxExecParams): Promise<ExecResult> {\n return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n // request timeout and the client abort timer; fall back to the provider default otherwise.\n const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n const body = {\n sandbox_id: params.sandboxId,\n command: params.command,\n cwd: params.cwd,\n env: params.env,\n timeout: timeoutSeconds,\n };\n\n const controller = new AbortController();\n const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) 1000;\n const timer = setTimeout(() => {\n controller.abort();\n }, clientTimeoutMs);\n\n try {\n const response = await fetch(`${this.serverUrl}/exec`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(body),\n signal: controller.signal,\n });\n\n if (!response.ok) {\n const text = await response.text();\n this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n }\n\n const result = (await response.json()) as ExecResult;\n return result;\n } catch (e: unknown) {\n if (e instanceof Error && e.name === 'AbortError') {\n this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n }\n this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n const message = e instanceof Error ? e.message : 'Unknown error';\n return { success: false, error: message };\n } finally {\n clearTimeout(timer);\n }\n });\n }\n\n private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to stat file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n const parsed = JSON.parse(result.response.result) as StatResult;\n return { size: parsed.size, isDir: parsed.type === 'directory' };\n }\n\n async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n const info = await this.getFileInfo(params);\n if (info.isDir) {\n throw new SandboxPathIsDirectoryError(params.path);\n }\n if (info.size > this.fileMaxBytesForDownload) {\n throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n }\n\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `base64 -w0 ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to download file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n return Buffer.from(result.response.result.trim(), 'base64');\n }\n\n async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n\n return context.with(suppressTracing(context.active()), async () => {\n const query = new URLSearchParams({ sandbox_id: params.sandboxId, path: params.remotePath });\n const response = await fetch(`${this.serverUrl}/files/upload?${query.toString()}`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/octet-stream' },\n body: params.content,\n signal: AbortSignal.timeout(FILE_UPLOAD_TIMEOUT_MS),\n });\n if (!response.ok) {\n throw new Error(\n `File upload to sandbox failed: Sandbox server returned ${String(response.status)}: ${await response.text()}`,\n );\n }\n\n const result = (await response.json()) as { success: true } \| { success: false; error: string };\n if (!result.success) {\n throw new Error(`File upload to sandbox failed: ${result.error}`);\n }\n });\n }\n\n // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n createCodeModeTransport(): CodeModeTransport {\n return new CodeModeNatsTransport({\n resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n logger: this.logger,\n mcpClientInstall: { remotePath: join('mcp-client', 'mcp_client.py') },\n });\n }\n\n getAdditionalInstructions(): string {\n return dedent`\n SANDBOX RULES:\n - The Agent's first sandbox command should be \\`pwd\\` to discover the working directory.\n - uploads, skills, and tool-results live in that working directory (not /tmp or /opt).\n - ALL file creation and writes MUST stay within that working directory.\n - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n `;\n }\n\n // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.\n // uploads, skills, tool-results, skill_downloader.py, .git-credentials\n // mcp-client/mcp_client.py (no /usr/local/bin symlink)\n getToolResultDumpDir(): string {\n return 'tool-results';\n }\n\n getGitCredentialsPath(): string {\n return '.git-credentials';\n }\n\n getFileUploadsDir(): string {\n return 'uploads';\n }\n\n getSkillsDir(): string {\n return 'skills';\n }\n\n getSkillDownloaderPath(): string {\n return 'skill_downloader.py';\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAwB;AACxB,kBAAgC;AAChC,oBAAmB;AACnB,yBAA2B;AAC3B,mBAAqB;AAErB,4BAAsC;AAEtC,mCAAsC;AACtC,uBAA6C;AAC7C,2BAKO;AACP,qBAA0C;AAC1C,sBAOO;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAGtC,IAAM,yBAAyB,KAAK,KAAK;AAEzC,IAAM,qBAAqB;AAGpB,SAAS,oBAAoB,MAAsB;AACxD,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,UAAQ,KAAK,SAAS,KAAK,SAAS,kBAAkB;AAC1F,SAAO,KAAK,WAAW,IAAI,qBAAqB,GAAG,kBAAkB,IAAI,KAAK,KAAK,GAAG,CAAC;AACzF;AAEA,SAAS,gBAAgB,MAAmE;AAC1F,QAAM,QAAQ,KAAK,QAAQ,SAAS,IAAI,EAAE,MAAM,IAAI;AACpD,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM,WAAW,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,eAAe,MAAM,CAAC,KAAK,GAAG;AAC/C;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EAChD,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,iBAAiB,oBAAI,IAAqD;AAAA,EAE3F,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,QAAI,+BAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAAgD;AACzD,2DAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AACzF,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,KAAK,cAAc,OAAO,SAAS;AACzE,UAAM,WAAW,OAAO,OAAO,CAAC;AAChC,UAAM,UAAM,0CAA0B;AAAA,MACpC;AAAA,MACA,KAAK,EAAE,GAAG,UAAU,MAAM,oBAAoB,SAAS,MAAM,KAAK,aAAa,EAAE;AAAA,IACnF,CAAC;AACD,WAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,cAAc,WAAqE;AAC/F,UAAM,SAAS,KAAK,eAAe,IAAI,SAAS;AAChD,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,SAAS;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,gDAAgD,OAAO,KAAK,EAAE;AAAA,IAChF;AACA,UAAM,SAAS,gBAAgB,OAAO,SAAS,MAAM;AACrD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,MAAM,EAAE;AAAA,IAC1F;AACA,SAAK,eAAe,IAAI,WAAW,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,QAAgD;AACrE,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,SAAK,6CAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,2BAAuB,6CAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,kDAA8C,6BAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,iDAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,8CAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,kBAAc,6BAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,8CAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,2DAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AAEzF,WAAO,mBAAQ,SAAK,6BAAgB,mBAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,YAAM,QAAQ,IAAI,gBAAgB,EAAE,YAAY,OAAO,WAAW,MAAM,OAAO,WAAW,CAAC;AAC3F,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,iBAAiB,MAAM,SAAS,CAAC,IAAI;AAAA,QACjF,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,2BAA2B;AAAA,QACtD,MAAM,OAAO;AAAA,QACb,QAAQ,YAAY,QAAQ,sBAAsB;AAAA,MACpD,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI;AAAA,UACR,0DAA0D,OAAO,SAAS,MAAM,CAAC,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,QAC7G;AAAA,MACF;AAEA,YAAM,SAAU,MAAM,SAAS,KAAK;AACpC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,MAAM,kCAAkC,OAAO,KAAK,EAAE;AAAA,MAClE;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,mDAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,6CAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,MACb,kBAAkB,EAAE,gBAAY,mBAAK,cAAc,eAAe,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO,cAAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT;AAAA;AAAA;AAAA;AAAA,EAKA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,oBAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,eAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAiC;AAC/B,WAAO;AAAA,EACT;AACF;","names":["dedent"]}

package/dist/core/sandbox/provider/TFYSandboxProvider.mjs CHANGED Viewed

@@ -15,11 +15,11 @@ import {
 } from "../SandboxErrors.mjs";
 import { absolutizeRelativeExecEnv } from "./execEnv.mjs";
 import {
-  ensureExecSuccess,
   shellEscape
 } from "./Provider.mjs";
 var DEFAULT_TIMEOUT_SECONDS = 60;
 var CLIENT_TIMEOUT_BUFFER_SECONDS = 5;
+var FILE_UPLOAD_TIMEOUT_MS = 30 * 60 * 1e3;
 var TFY_MCP_CLIENT_BIN = "mcp-client/bin";
 function withMcpClientOnPath(path) {
   const rest = path.split(":").filter((part) => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);
@@ -179,13 +179,25 @@ var TFYSandboxProvider = class _TFYSandboxProvider {
     return Buffer.from(result.response.result.trim(), "base64");
   }
   async uploadFile(params) {
-    const encoded = params.content.toString("base64");
-    const escapedPath = shellEscape(params.remotePath);
-    const result = await this.exec({
-      sandboxId: params.sandboxId,
-      command: `echo ${shellEscape(encoded)} | base64 -d > ${escapedPath}`
+    validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });
+    return context.with(suppressTracing(context.active()), async () => {
+      const query = new URLSearchParams({ sandbox_id: params.sandboxId, path: params.remotePath });
+      const response = await fetch(`${this.serverUrl}/files/upload?${query.toString()}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/octet-stream" },
+        body: params.content,
+        signal: AbortSignal.timeout(FILE_UPLOAD_TIMEOUT_MS)
+      });
+      if (!response.ok) {
+        throw new Error(
+          `File upload to sandbox failed: Sandbox server returned ${String(response.status)}: ${await response.text()}`
+        );
+      }
+      const result = await response.json();
+      if (!result.success) {
+        throw new Error(`File upload to sandbox failed: ${result.error}`);
+      }
     });
-    ensureExecSuccess(result);
   }
   // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).
   createCodeModeTransport() {

package/dist/core/sandbox/provider/TFYSandboxProvider.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport dedent from 'dedent';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path/posix';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport {\n SandboxFileNotFoundError,\n SandboxFileTooLargeError,\n SandboxPathIsDirectoryError,\n validateSandboxOwnedByTenant,\n} from '../SandboxErrors';\nimport { absolutizeRelativeExecEnv } from './execEnv';\nimport {\n ensureExecSuccess,\n shellEscape,\n type ExecResult,\n type SandboxBuild,\n type SandboxExecParams,\n type SandboxFileInfo,\n type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\nconst TFY_MCP_CLIENT_BIN = 'mcp-client/bin';\n\n/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). /\nexport function withMcpClientOnPath(path: string): string {\n const rest = path.split(':').filter(part => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);\n return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(':')}`;\n}\n\nfunction parsePwdAndPath(text: string): { root: string; inheritedPath: string } \| undefined {\n const lines = text.replace(/\\r\\n/g, '\\n').split('\\n');\n const root = lines[0];\n if (!root?.startsWith('/')) {\n return undefined;\n }\n return { root, inheritedPath: lines[1] ?? '' };\n}\n\nexport interface TFYSandboxProviderOptions {\n serverUrl: string;\n natsBridgeUrl: string;\n tenantName: string;\n fileMaxBytesForDownload: number;\n defaultExecTimeoutMs?: number \| undefined;\n logger: Logger;\n}\n\ninterface StatResult {\n size: number;\n type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n readonly type = 'truefoundry';\n private readonly serverUrl: string;\n private readonly natsBridgeUrl: string;\n private readonly tenantName: string;\n private readonly fileMaxBytesForDownload: number;\n private readonly defaultExecTimeoutSeconds: number;\n private readonly logger: Logger;\n /* Discovered via `pwd` + `$PATH` — never a hardcoded host layout. /\n private readonly sandboxLayouts = new Map<string, { root: string; inheritedPath: string }>();\n\n constructor(options: TFYSandboxProviderOptions) {\n this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n this.natsBridgeUrl = options.natsBridgeUrl;\n this.tenantName = options.tenantName;\n this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS 1000) / 1000);\n this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n }\n\n // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n private static readonly readyBuild: SandboxBuild = {\n status: 'ready',\n reason: null,\n metadata: null,\n };\n\n buildImage(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n getImageBuildStatus(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n createSandbox(): Promise<{ sandboxId: string }> {\n const sandboxId = `${this.tenantName}.${randomUUID()}`;\n this.logger.debug(`Sandbox created: id=${sandboxId}`);\n return Promise.resolve({ sandboxId });\n }\n\n /*\n No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative\n * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so\n * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.\n /\n async exec(params: SandboxExecParams): Promise<ExecResult> {\n validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);\n const incoming = params.env ?? {};\n const env = absolutizeRelativeExecEnv({\n root,\n env: { ...incoming, PATH: withMcpClientOnPath(incoming['PATH'] ?? inheritedPath) },\n });\n return this.postExec({ ...params, env });\n }\n\n private async sandboxLayout(sandboxId: string): Promise<{ root: string; inheritedPath: string }> {\n const cached = this.sandboxLayouts.get(sandboxId);\n if (cached !== undefined) {\n return cached;\n }\n const result = await this.postExec({\n sandboxId,\n command: 'printf \\'%s\\\\n%s\\\\n\\' \"$(pwd)\" \"$PATH\"',\n });\n if (!result.success) {\n throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);\n }\n const parsed = parsePwdAndPath(result.response.result);\n if (parsed === undefined) {\n throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);\n }\n this.sandboxLayouts.set(sandboxId, parsed);\n return parsed;\n }\n\n private async postExec(params: SandboxExecParams): Promise<ExecResult> {\n return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n // request timeout and the client abort timer; fall back to the provider default otherwise.\n const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n const body = {\n sandbox_id: params.sandboxId,\n command: params.command,\n cwd: params.cwd,\n env: params.env,\n timeout: timeoutSeconds,\n };\n\n const controller = new AbortController();\n const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) 1000;\n const timer = setTimeout(() => {\n controller.abort();\n }, clientTimeoutMs);\n\n try {\n const response = await fetch(`${this.serverUrl}/exec`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(body),\n signal: controller.signal,\n });\n\n if (!response.ok) {\n const text = await response.text();\n this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n }\n\n const result = (await response.json()) as ExecResult;\n return result;\n } catch (e: unknown) {\n if (e instanceof Error && e.name === 'AbortError') {\n this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n }\n this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n const message = e instanceof Error ? e.message : 'Unknown error';\n return { success: false, error: message };\n } finally {\n clearTimeout(timer);\n }\n });\n }\n\n private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to stat file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n const parsed = JSON.parse(result.response.result) as StatResult;\n return { size: parsed.size, isDir: parsed.type === 'directory' };\n }\n\n async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n const info = await this.getFileInfo(params);\n if (info.isDir) {\n throw new SandboxPathIsDirectoryError(params.path);\n }\n if (info.size > this.fileMaxBytesForDownload) {\n throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n }\n\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `base64 -w0 ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to download file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n return Buffer.from(result.response.result.trim(), 'base64');\n }\n\n async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n const encoded = params.content.toString('base64');\n const escapedPath = shellEscape(params.remotePath);\n\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `echo ${shellEscape(encoded)} \| base64 -d > ${escapedPath}`,\n });\n ensureExecSuccess(result);\n }\n\n // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n createCodeModeTransport(): CodeModeTransport {\n return new CodeModeNatsTransport({\n resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n logger: this.logger,\n mcpClientInstall: { remotePath: join('mcp-client', 'mcp_client.py') },\n });\n }\n\n getAdditionalInstructions(): string {\n return dedent`\n SANDBOX RULES:\n - The Agent's first sandbox command should be \\`pwd\\` to discover the working directory.\n - uploads, skills, and tool-results live in that working directory (not /tmp or /opt).\n - ALL file creation and writes MUST stay within that working directory.\n - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n `;\n }\n\n // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.\n // uploads, skills, tool-results, skill_downloader.py, .git-credentials\n // mcp-client/mcp_client.py (no /usr/local/bin symlink)\n getToolResultDumpDir(): string {\n return 'tool-results';\n }\n\n getGitCredentialsPath(): string {\n return '.git-credentials';\n }\n\n getFileUploadsDir(): string {\n return 'uploads';\n }\n\n getSkillsDir(): string {\n return 'skills';\n }\n\n getSkillDownloaderPath(): string {\n return 'skill_downloader.py';\n }\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,OAAO,YAAY;AACnB,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AAErB,SAAS,6BAA6B;AAEtC,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OAMK;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAEtC,IAAM,qBAAqB;AAGpB,SAAS,oBAAoB,MAAsB;AACxD,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,UAAQ,KAAK,SAAS,KAAK,SAAS,kBAAkB;AAC1F,SAAO,KAAK,WAAW,IAAI,qBAAqB,GAAG,kBAAkB,IAAI,KAAK,KAAK,GAAG,CAAC;AACzF;AAEA,SAAS,gBAAgB,MAAmE;AAC1F,QAAM,QAAQ,KAAK,QAAQ,SAAS,IAAI,EAAE,MAAM,IAAI;AACpD,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM,WAAW,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,eAAe,MAAM,CAAC,KAAK,GAAG;AAC/C;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EAChD,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,iBAAiB,oBAAI,IAAqD;AAAA,EAE3F,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,IAAI,WAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAAgD;AACzD,iCAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AACzF,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,KAAK,cAAc,OAAO,SAAS;AACzE,UAAM,WAAW,OAAO,OAAO,CAAC;AAChC,UAAM,MAAM,0BAA0B;AAAA,MACpC;AAAA,MACA,KAAK,EAAE,GAAG,UAAU,MAAM,oBAAoB,SAAS,MAAM,KAAK,aAAa,EAAE;AAAA,IACnF,CAAC;AACD,WAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,cAAc,WAAqE;AAC/F,UAAM,SAAS,KAAK,eAAe,IAAI,SAAS;AAChD,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,SAAS;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,gDAAgD,OAAO,KAAK,EAAE;AAAA,IAChF;AACA,UAAM,SAAS,gBAAgB,OAAO,SAAS,MAAM;AACrD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,MAAM,EAAE;AAAA,IAC1F;AACA,SAAK,eAAe,IAAI,WAAW,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,QAAgD;AACrE,WAAO,QAAQ,KAAK,gBAAgB,QAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,KAAK,sBAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,uBAAuB,sBAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,8CAA8C,YAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,4BAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,yBAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,cAAc,YAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,UAAM,UAAU,OAAO,QAAQ,SAAS,QAAQ;AAChD,UAAM,cAAc,YAAY,OAAO,UAAU;AAEjD,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,QAAQ,YAAY,OAAO,CAAC,kBAAkB,WAAW;AAAA,IACpE,CAAC;AACD,sBAAkB,MAAM;AAAA,EAC1B;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,sBAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,4BAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,MACb,kBAAkB,EAAE,YAAY,KAAK,cAAc,eAAe,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT;AAAA;AAAA;AAAA;AAAA,EAKA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,oBAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,eAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAiC;AAC/B,WAAO;AAAA,EACT;AACF;","names":[]}
1	+ {"version":3,"sources":["../../../../src/core/sandbox/provider/TFYSandboxProvider.ts"],"sourcesContent":["import { context } from '@opentelemetry/api';\nimport { suppressTracing } from '@opentelemetry/core';\nimport dedent from 'dedent';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path/posix';\nimport type { Logger } from 'winston';\nimport { extractErrorLogFields } from '../../util/errorLogFields';\nimport type { CodeModeTransport } from '../codeMode/CodeModeTransport';\nimport { CodeModeNatsTransport } from '../codeMode/nats/CodeModeNatsTransport';\nimport { DEFAULT_SANDBOX_NATS_WS_PORT } from '../constants';\nimport {\n SandboxFileNotFoundError,\n SandboxFileTooLargeError,\n SandboxPathIsDirectoryError,\n validateSandboxOwnedByTenant,\n} from '../SandboxErrors';\nimport { absolutizeRelativeExecEnv } from './execEnv';\nimport {\n shellEscape,\n type ExecResult,\n type SandboxBuild,\n type SandboxExecParams,\n type SandboxFileInfo,\n type SandboxProvider,\n} from './Provider';\n\nconst DEFAULT_TIMEOUT_SECONDS = 60;\n// Buffer for network latency + response processing on top of the server-side timeout.\nconst CLIENT_TIMEOUT_BUFFER_SECONDS = 5;\n\n// TFY sandbox file upload timeout (same as Daytona SDK uploadFile default timeout).\nconst FILE_UPLOAD_TIMEOUT_MS = 30 * 60 * 1000;\n\nconst TFY_MCP_CLIENT_BIN = 'mcp-client/bin';\n\n/** Put the layout CLI first on PATH (cwd-relative; {@link absolutizeRelativeExecEnv} makes it absolute). /\nexport function withMcpClientOnPath(path: string): string {\n const rest = path.split(':').filter(part => part.length > 0 && part !== TFY_MCP_CLIENT_BIN);\n return rest.length === 0 ? TFY_MCP_CLIENT_BIN : `${TFY_MCP_CLIENT_BIN}:${rest.join(':')}`;\n}\n\nfunction parsePwdAndPath(text: string): { root: string; inheritedPath: string } \| undefined {\n const lines = text.replace(/\\r\\n/g, '\\n').split('\\n');\n const root = lines[0];\n if (!root?.startsWith('/')) {\n return undefined;\n }\n return { root, inheritedPath: lines[1] ?? '' };\n}\n\nexport interface TFYSandboxProviderOptions {\n serverUrl: string;\n natsBridgeUrl: string;\n tenantName: string;\n fileMaxBytesForDownload: number;\n defaultExecTimeoutMs?: number \| undefined;\n logger: Logger;\n}\n\ninterface StatResult {\n size: number;\n type: string;\n}\n\nexport class TFYSandboxProvider implements SandboxProvider {\n readonly type = 'truefoundry';\n private readonly serverUrl: string;\n private readonly natsBridgeUrl: string;\n private readonly tenantName: string;\n private readonly fileMaxBytesForDownload: number;\n private readonly defaultExecTimeoutSeconds: number;\n private readonly logger: Logger;\n /* Discovered via `pwd` + `$PATH` — never a hardcoded host layout. /\n private readonly sandboxLayouts = new Map<string, { root: string; inheritedPath: string }>();\n\n constructor(options: TFYSandboxProviderOptions) {\n this.serverUrl = options.serverUrl.replace(/\\/+$/, '');\n this.natsBridgeUrl = options.natsBridgeUrl;\n this.tenantName = options.tenantName;\n this.fileMaxBytesForDownload = options.fileMaxBytesForDownload;\n this.defaultExecTimeoutSeconds = Math.ceil((options.defaultExecTimeoutMs ?? DEFAULT_TIMEOUT_SECONDS 1000) / 1000);\n this.logger = options.logger.child({ module: 'TFYSandboxProvider' });\n }\n\n // TFY sandboxes run a prebuilt server image with no per-image build step, so the image is always ready.\n private static readonly readyBuild: SandboxBuild = {\n status: 'ready',\n reason: null,\n metadata: null,\n };\n\n buildImage(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n getImageBuildStatus(): Promise<SandboxBuild> {\n return Promise.resolve(TFYSandboxProvider.readyBuild);\n }\n\n createSandbox(): Promise<{ sandboxId: string }> {\n const sandboxId = `${this.tenantName}.${randomUUID()}`;\n this.logger.debug(`Sandbox created: id=${sandboxId}`);\n return Promise.resolve({ sandboxId });\n }\n\n /*\n No extra FS jail: exec cwd is the logical sandbox root. Layout getters are cwd-relative\n * so writes cannot escape it. `GIT_CONFIG` / PATH / PYTHONPATH must still be absolute so\n * git and `mcp-client` work after `cd` — resolved from `pwd` / `$PATH`, not a hardcoded prefix.\n /\n async exec(params: SandboxExecParams): Promise<ExecResult> {\n validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n const { root, inheritedPath } = await this.sandboxLayout(params.sandboxId);\n const incoming = params.env ?? {};\n const env = absolutizeRelativeExecEnv({\n root,\n env: { ...incoming, PATH: withMcpClientOnPath(incoming['PATH'] ?? inheritedPath) },\n });\n return this.postExec({ ...params, env });\n }\n\n private async sandboxLayout(sandboxId: string): Promise<{ root: string; inheritedPath: string }> {\n const cached = this.sandboxLayouts.get(sandboxId);\n if (cached !== undefined) {\n return cached;\n }\n const result = await this.postExec({\n sandboxId,\n command: 'printf \\'%s\\\\n%s\\\\n\\' \"$(pwd)\" \"$PATH\"',\n });\n if (!result.success) {\n throw new Error(`Failed to resolve sandbox working directory: ${result.error}`);\n }\n const parsed = parsePwdAndPath(result.response.result);\n if (parsed === undefined) {\n throw new Error(`sandbox pwd did not return an absolute path: ${result.response.result}`);\n }\n this.sandboxLayouts.set(sandboxId, parsed);\n return parsed;\n }\n\n private async postExec(params: SandboxExecParams): Promise<ExecResult> {\n return context.with(suppressTracing(context.active()), async (): Promise<ExecResult> => {\n // Honor the per-call timeout (e.g. the longer skill-download timeout) for both the server-side\n // request timeout and the client abort timer; fall back to the provider default otherwise.\n const timeoutSeconds = params.timeoutSeconds ?? this.defaultExecTimeoutSeconds;\n const body = {\n sandbox_id: params.sandboxId,\n command: params.command,\n cwd: params.cwd,\n env: params.env,\n timeout: timeoutSeconds,\n };\n\n const controller = new AbortController();\n const clientTimeoutMs = (timeoutSeconds + CLIENT_TIMEOUT_BUFFER_SECONDS) 1000;\n const timer = setTimeout(() => {\n controller.abort();\n }, clientTimeoutMs);\n\n try {\n const response = await fetch(`${this.serverUrl}/exec`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(body),\n signal: controller.signal,\n });\n\n if (!response.ok) {\n const text = await response.text();\n this.logger.error(`Sandbox server returned ${String(response.status)}: ${text}`);\n return { success: false, error: `Sandbox server returned ${String(response.status)}: ${text}` };\n }\n\n const result = (await response.json()) as ExecResult;\n return result;\n } catch (e: unknown) {\n if (e instanceof Error && e.name === 'AbortError') {\n this.logger.error(`Sandbox exec timed out after ${String(timeoutSeconds)}s`, extractErrorLogFields(e));\n return { success: false, error: `Sandbox exec timed out after ${String(timeoutSeconds)}s` };\n }\n this.logger.error('Sandbox exec failed', extractErrorLogFields(e));\n const message = e instanceof Error ? e.message : 'Unknown error';\n return { success: false, error: message };\n } finally {\n clearTimeout(timer);\n }\n });\n }\n\n private async getFileInfo(params: { sandboxId: string; path: string }): Promise<SandboxFileInfo> {\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `stat -L --printf='{\"size\":%s,\"type\":\"%F\"}' ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to stat file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n const parsed = JSON.parse(result.response.result) as StatResult;\n return { size: parsed.size, isDir: parsed.type === 'directory' };\n }\n\n async downloadFile(params: { sandboxId: string; path: string }): Promise<Buffer> {\n const info = await this.getFileInfo(params);\n if (info.isDir) {\n throw new SandboxPathIsDirectoryError(params.path);\n }\n if (info.size > this.fileMaxBytesForDownload) {\n throw new SandboxFileTooLargeError(params.path, info.size, this.fileMaxBytesForDownload);\n }\n\n const result = await this.exec({\n sandboxId: params.sandboxId,\n command: `base64 -w0 ${shellEscape(params.path)}`,\n });\n\n if (!result.success) {\n throw new Error(`Failed to download file: ${result.error}`);\n }\n if (result.response.exitCode !== 0) {\n throw new SandboxFileNotFoundError(params.path);\n }\n\n return Buffer.from(result.response.result.trim(), 'base64');\n }\n\n async uploadFile(params: { sandboxId: string; remotePath: string; content: Buffer }): Promise<void> {\n validateSandboxOwnedByTenant({ sandboxId: params.sandboxId, tenantName: this.tenantName });\n\n return context.with(suppressTracing(context.active()), async () => {\n const query = new URLSearchParams({ sandbox_id: params.sandboxId, path: params.remotePath });\n const response = await fetch(`${this.serverUrl}/files/upload?${query.toString()}`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/octet-stream' },\n body: params.content,\n signal: AbortSignal.timeout(FILE_UPLOAD_TIMEOUT_MS),\n });\n if (!response.ok) {\n throw new Error(\n `File upload to sandbox failed: Sandbox server returned ${String(response.status)}: ${await response.text()}`,\n );\n }\n\n const result = (await response.json()) as { success: true } \| { success: false; error: string };\n if (!result.success) {\n throw new Error(`File upload to sandbox failed: ${result.error}`);\n }\n });\n }\n\n // The TFY sandbox exposes a static, cluster-internal NATS WebSocket URL (no signed URLs).\n createCodeModeTransport(): CodeModeTransport {\n return new CodeModeNatsTransport({\n resolveHostUrl: () => Promise.resolve(this.natsBridgeUrl),\n sandboxClientNatsUrl: `ws://localhost:${String(DEFAULT_SANDBOX_NATS_WS_PORT)}`,\n logger: this.logger,\n mcpClientInstall: { remotePath: join('mcp-client', 'mcp_client.py') },\n });\n }\n\n getAdditionalInstructions(): string {\n return dedent`\n SANDBOX RULES:\n - The Agent's first sandbox command should be \\`pwd\\` to discover the working directory.\n - uploads, skills, and tool-results live in that working directory (not /tmp or /opt).\n - ALL file creation and writes MUST stay within that working directory.\n - The Agent must NOT write to /tmp/, ~/, or any absolute path outside the working directory.\n `;\n }\n\n // Cwd-relative (no FS jail). exec() pwd-joins GIT_CONFIG / PATH / PYTHONPATH.\n // uploads, skills, tool-results, skill_downloader.py, .git-credentials\n // mcp-client/mcp_client.py (no /usr/local/bin symlink)\n getToolResultDumpDir(): string {\n return 'tool-results';\n }\n\n getGitCredentialsPath(): string {\n return '.git-credentials';\n }\n\n getFileUploadsDir(): string {\n return 'uploads';\n }\n\n getSkillsDir(): string {\n return 'skills';\n }\n\n getSkillDownloaderPath(): string {\n return 'skill_downloader.py';\n }\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,OAAO,YAAY;AACnB,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AAErB,SAAS,6BAA6B;AAEtC,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,OAMK;AAEP,IAAM,0BAA0B;AAEhC,IAAM,gCAAgC;AAGtC,IAAM,yBAAyB,KAAK,KAAK;AAEzC,IAAM,qBAAqB;AAGpB,SAAS,oBAAoB,MAAsB;AACxD,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,UAAQ,KAAK,SAAS,KAAK,SAAS,kBAAkB;AAC1F,SAAO,KAAK,WAAW,IAAI,qBAAqB,GAAG,kBAAkB,IAAI,KAAK,KAAK,GAAG,CAAC;AACzF;AAEA,SAAS,gBAAgB,MAAmE;AAC1F,QAAM,QAAQ,KAAK,QAAQ,SAAS,IAAI,EAAE,MAAM,IAAI;AACpD,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM,WAAW,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,eAAe,MAAM,CAAC,KAAK,GAAG;AAC/C;AAgBO,IAAM,qBAAN,MAAM,oBAA8C;AAAA,EAChD,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,iBAAiB,oBAAI,IAAqD;AAAA,EAE3F,YAAY,SAAoC;AAC9C,SAAK,YAAY,QAAQ,UAAU,QAAQ,QAAQ,EAAE;AACrD,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,aAAa,QAAQ;AAC1B,SAAK,0BAA0B,QAAQ;AACvC,SAAK,4BAA4B,KAAK,MAAM,QAAQ,wBAAwB,0BAA0B,OAAQ,GAAI;AAClH,SAAK,SAAS,QAAQ,OAAO,MAAM,EAAE,QAAQ,qBAAqB,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,OAAwB,aAA2B;AAAA,IACjD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA,EAEA,aAAoC;AAClC,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,sBAA6C;AAC3C,WAAO,QAAQ,QAAQ,oBAAmB,UAAU;AAAA,EACtD;AAAA,EAEA,gBAAgD;AAC9C,UAAM,YAAY,GAAG,KAAK,UAAU,IAAI,WAAW,CAAC;AACpD,SAAK,OAAO,MAAM,uBAAuB,SAAS,EAAE;AACpD,WAAO,QAAQ,QAAQ,EAAE,UAAU,CAAC;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAAgD;AACzD,iCAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AACzF,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,KAAK,cAAc,OAAO,SAAS;AACzE,UAAM,WAAW,OAAO,OAAO,CAAC;AAChC,UAAM,MAAM,0BAA0B;AAAA,MACpC;AAAA,MACA,KAAK,EAAE,GAAG,UAAU,MAAM,oBAAoB,SAAS,MAAM,KAAK,aAAa,EAAE;AAAA,IACnF,CAAC;AACD,WAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,cAAc,WAAqE;AAC/F,UAAM,SAAS,KAAK,eAAe,IAAI,SAAS;AAChD,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,SAAS;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,gDAAgD,OAAO,KAAK,EAAE;AAAA,IAChF;AACA,UAAM,SAAS,gBAAgB,OAAO,SAAS,MAAM;AACrD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,MAAM,EAAE;AAAA,IAC1F;AACA,SAAK,eAAe,IAAI,WAAW,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,QAAgD;AACrE,WAAO,QAAQ,KAAK,gBAAgB,QAAQ,OAAO,CAAC,GAAG,YAAiC;AAGtF,YAAM,iBAAiB,OAAO,kBAAkB,KAAK;AACrD,YAAM,OAAO;AAAA,QACX,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,SAAS;AAAA,MACX;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,mBAAmB,iBAAiB,iCAAiC;AAC3E,YAAM,QAAQ,WAAW,MAAM;AAC7B,mBAAW,MAAM;AAAA,MACnB,GAAG,eAAe;AAElB,UAAI;AACF,cAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,SAAS;AAAA,UACrD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,eAAK,OAAO,MAAM,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,EAAE;AAC/E,iBAAO,EAAE,SAAS,OAAO,OAAO,2BAA2B,OAAO,SAAS,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA,QAChG;AAEA,cAAM,SAAU,MAAM,SAAS,KAAK;AACpC,eAAO;AAAA,MACT,SAAS,GAAY;AACnB,YAAI,aAAa,SAAS,EAAE,SAAS,cAAc;AACjD,eAAK,OAAO,MAAM,gCAAgC,OAAO,cAAc,CAAC,KAAK,sBAAsB,CAAC,CAAC;AACrG,iBAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC,OAAO,cAAc,CAAC,IAAI;AAAA,QAC5F;AACA,aAAK,OAAO,MAAM,uBAAuB,sBAAsB,CAAC,CAAC;AACjE,cAAM,UAAU,aAAa,QAAQ,EAAE,UAAU;AACjD,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,YAAY,QAAuE;AAC/F,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,8CAA8C,YAAY,OAAO,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,IACxD;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,UAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM;AAChD,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,YAAY;AAAA,EACjE;AAAA,EAEA,MAAM,aAAa,QAA8D;AAC/E,UAAM,OAAO,MAAM,KAAK,YAAY,MAAM;AAC1C,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,4BAA4B,OAAO,IAAI;AAAA,IACnD;AACA,QAAI,KAAK,OAAO,KAAK,yBAAyB;AAC5C,YAAM,IAAI,yBAAyB,OAAO,MAAM,KAAK,MAAM,KAAK,uBAAuB;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,WAAW,OAAO;AAAA,MAClB,SAAS,cAAc,YAAY,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,MAAM,4BAA4B,OAAO,KAAK,EAAE;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,aAAa,GAAG;AAClC,YAAM,IAAI,yBAAyB,OAAO,IAAI;AAAA,IAChD;AAEA,WAAO,OAAO,KAAK,OAAO,SAAS,OAAO,KAAK,GAAG,QAAQ;AAAA,EAC5D;AAAA,EAEA,MAAM,WAAW,QAAmF;AAClG,iCAA6B,EAAE,WAAW,OAAO,WAAW,YAAY,KAAK,WAAW,CAAC;AAEzF,WAAO,QAAQ,KAAK,gBAAgB,QAAQ,OAAO,CAAC,GAAG,YAAY;AACjE,YAAM,QAAQ,IAAI,gBAAgB,EAAE,YAAY,OAAO,WAAW,MAAM,OAAO,WAAW,CAAC;AAC3F,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,SAAS,iBAAiB,MAAM,SAAS,CAAC,IAAI;AAAA,QACjF,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,2BAA2B;AAAA,QACtD,MAAM,OAAO;AAAA,QACb,QAAQ,YAAY,QAAQ,sBAAsB;AAAA,MACpD,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI;AAAA,UACR,0DAA0D,OAAO,SAAS,MAAM,CAAC,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,QAC7G;AAAA,MACF;AAEA,YAAM,SAAU,MAAM,SAAS,KAAK;AACpC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,MAAM,kCAAkC,OAAO,KAAK,EAAE;AAAA,MAClE;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,0BAA6C;AAC3C,WAAO,IAAI,sBAAsB;AAAA,MAC/B,gBAAgB,MAAM,QAAQ,QAAQ,KAAK,aAAa;AAAA,MACxD,sBAAsB,kBAAkB,OAAO,4BAA4B,CAAC;AAAA,MAC5E,QAAQ,KAAK;AAAA,MACb,kBAAkB,EAAE,YAAY,KAAK,cAAc,eAAe,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,4BAAoC;AAClC,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT;AAAA;AAAA;AAAA;AAAA,EAKA,uBAA+B;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,wBAAgC;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,oBAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,eAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAiC;AAC/B,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/core/util/ssrfGuard.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+export declare function configureOutboundUrlGuard(config: {
+    enabled?: boolean;
+    allowedHosts: readonly string[];
+    blockedHosts: readonly string[];
+}): void;
+export declare function assertSafeOutboundUrl(input: string | URL | Request): Promise<void>;
+export declare function ssrfFetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+/** Same as `ssrfFetch` with a 30m bodyTimeout for idle MCP SSE / streamable-HTTP. */
+export declare function mcpSsrfFetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=ssrfGuard.d.ts.map

package/dist/core/util/ssrfGuard.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ssrfGuard.d.ts","sourceRoot":"","sources":["../../../src/core/util/ssrfGuard.ts"],"names":[],"mappings":"AA2EA,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,IAAI,CAIP;AAyGD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBxF;AAmGD,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpG;AAED,qFAAqF;AACrF,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEvG"}

package/dist/core/util/ssrfGuard.js ADDED Viewed

@@ -0,0 +1,333 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+// src/core/util/ssrfGuard.ts
+var ssrfGuard_exports = {};
+__export(ssrfGuard_exports, {
+  assertSafeOutboundUrl: () => assertSafeOutboundUrl,
+  configureOutboundUrlGuard: () => configureOutboundUrlGuard,
+  mcpSsrfFetch: () => mcpSsrfFetch,
+  ssrfFetch: () => ssrfFetch
+});
+module.exports = __toCommonJS(ssrfGuard_exports);
+var import_node_dns = require("dns");
+var import_promises = require("dns/promises");
+var import_node_net = require("net");
+var import_undici = require("undici");
+var allowedHosts = [];
+var blockedHosts = [];
+var guardEnabled = true;
+var URL_VERIFY = {
+  allowedProtocols: ["http:", "https:"],
+  denyCidrsV4: [
+    "0.0.0.0/8",
+    // this host
+    "10.0.0.0/8",
+    // private
+    "100.64.0.0/10",
+    // CGNAT (EKS secondary pod CIDRs)
+    "127.0.0.0/8",
+    // loopback
+    "169.254.0.0/16",
+    // link-local + metadata
+    "172.16.0.0/12",
+    // private (docker, k8s service CIDRs)
+    "192.0.0.0/24",
+    // IETF protocol assignments
+    "192.0.2.0/24",
+    // TEST-NET-1
+    "192.88.99.0/24",
+    // 6to4 relay anycast
+    "192.168.0.0/16",
+    // private
+    "198.18.0.0/15",
+    // benchmarking
+    "198.51.100.0/24",
+    // TEST-NET-2
+    "203.0.113.0/24",
+    // TEST-NET-3
+    "224.0.0.0/4",
+    // multicast
+    "240.0.0.0/4"
+    // reserved + broadcast
+  ],
+  denyCidrsV6: [
+    "::/96",
+    // unspecified, ::1, IPv4-compatible
+    "64:ff9b::/96",
+    // NAT64 well-known
+    "64:ff9b:1::/48",
+    // NAT64 local-use
+    "100::/64",
+    // discard-only
+    "2001::/32",
+    // Teredo
+    "2001:10::/28",
+    // ORCHID
+    "2001:20::/28",
+    // ORCHIDv2
+    "2001:db8::/32",
+    // documentation
+    "2002::/16",
+    // 6to4
+    "fc00::/7",
+    // unique-local (IPv6 k8s service CIDRs)
+    "fe80::/10",
+    // link-local
+    "ff00::/8"
+    // multicast
+  ],
+  denyHostSuffixes: [
+    ".local",
+    ".localhost",
+    ".localdomain",
+    ".internal",
+    ".svc",
+    ".cluster",
+    ".arpa",
+    ".lan",
+    ".intranet",
+    ".corp",
+    ".home",
+    ".test",
+    ".invalid",
+    ".example"
+  ]
+};
+var privateNets = new import_node_net.BlockList();
+function addDenyCidrs(cidrs, family) {
+  for (const cidr of cidrs) {
+    const slash = cidr.lastIndexOf("/");
+    privateNets.addSubnet(cidr.slice(0, slash), Number(cidr.slice(slash + 1)), family);
+  }
+}
+addDenyCidrs(URL_VERIFY.denyCidrsV4, "ipv4");
+addDenyCidrs(URL_VERIFY.denyCidrsV6, "ipv6");
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_STRIPPED_HEADERS = ["authorization", "proxy-authorization", "cookie", "host"];
+function configureOutboundUrlGuard(config) {
+  guardEnabled = config.enabled ?? true;
+  allowedHosts = config.allowedHosts.map(normalizeHost);
+  blockedHosts = config.blockedHosts.map(normalizeHost);
+}
+function normalizeHost(hostname) {
+  const host = hostname.replace(/\.$/, "").toLowerCase();
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isPrivateIp(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  if ((0, import_node_net.isIP)(ip) === 4) {
+    return privateNets.check(ip, "ipv4");
+  }
+  if ((0, import_node_net.isIP)(ip) === 6) {
+    return privateNets.check(ip, "ipv6");
+  }
+  return true;
+}
+function blockedError(host, cause) {
+  return new Error(`Outbound URL blocked for host "${host}"`, { cause });
+}
+function deny(host, cause) {
+  throw blockedError(host, cause);
+}
+function assertHost(host) {
+  if (host === "" || blockedHosts.includes(host)) {
+    deny(host);
+  }
+  if (allowedHosts.includes(host)) {
+    return;
+  }
+  if ((0, import_node_net.isIP)(host) === 0) {
+    if (!host.includes(".") || URL_VERIFY.denyHostSuffixes.some((suffix) => host.endsWith(suffix))) {
+      deny(host);
+    }
+    return;
+  }
+  if (isPrivateIp(host)) {
+    deny(host);
+  }
+}
+function parseOutboundUrl(input) {
+  let url;
+  try {
+    url = new URL(input instanceof Request ? input.url : input);
+  } catch (error) {
+    throw new Error("Outbound URL blocked", { cause: error });
+  }
+  if (!URL_VERIFY.allowedProtocols.includes(url.protocol)) {
+    throw new Error("Outbound URL blocked: only http and https are allowed");
+  }
+  return url;
+}
+var guardedLookup = (hostname, options, callback) => {
+  if (!guardEnabled) {
+    (0, import_node_dns.lookup)(hostname, options, callback);
+    return;
+  }
+  const host = normalizeHost(hostname);
+  try {
+    assertHost(host);
+  } catch (error) {
+    callback(error instanceof Error ? error : blockedError(host, error), "");
+    return;
+  }
+  if (allowedHosts.includes(host) || (0, import_node_net.isIP)(host) !== 0) {
+    (0, import_node_dns.lookup)(hostname, options, callback);
+    return;
+  }
+  const allOptions = { ...options, all: true };
+  (0, import_node_dns.lookup)(hostname, allOptions, (err, addresses) => {
+    if (err) {
+      callback(err, "");
+      return;
+    }
+    const first = addresses[0];
+    if (first === void 0 || addresses.some((record) => isPrivateIp(record.address))) {
+      callback(blockedError(host), "");
+      return;
+    }
+    if (options.all) {
+      callback(null, addresses);
+      return;
+    }
+    callback(null, first.address, first.family);
+  });
+};
+var MCP_BODY_TIMEOUT_MS = 30 * 60 * 1e3;
+var outboundAgent = new import_undici.Agent({
+  connect: { lookup: guardedLookup }
+});
+var mcpOutboundAgent = new import_undici.Agent({
+  // MCP SSE/streamable-HTTP stays idle between tool calls; undici's 300s bodyTimeout kills it.
+  bodyTimeout: MCP_BODY_TIMEOUT_MS,
+  connect: { lookup: guardedLookup }
+});
+async function assertSafeOutboundUrl(input) {
+  const url = parseOutboundUrl(input);
+  if (!guardEnabled) {
+    return;
+  }
+  const host = normalizeHost(url.hostname);
+  assertHost(host);
+  if (allowedHosts.includes(host) || (0, import_node_net.isIP)(host) !== 0) {
+    return;
+  }
+  let addresses;
+  try {
+    addresses = (await (0, import_promises.lookup)(host, { all: true })).map((record) => record.address);
+  } catch (error) {
+    deny(host, error);
+  }
+  if (addresses.some(isPrivateIp)) {
+    deny(host);
+  }
+}
+function nextHop(response, location, current, init) {
+  let nextUrl;
+  try {
+    nextUrl = new URL(location, current);
+  } catch (error) {
+    throw new Error("Outbound URL blocked", { cause: error });
+  }
+  if (!URL_VERIFY.allowedProtocols.includes(nextUrl.protocol)) {
+    throw new Error("Outbound URL blocked: only http and https are allowed");
+  }
+  const headers = new Headers(init.headers);
+  let method = (init.method ?? "GET").toUpperCase();
+  let body = init.body ?? null;
+  const downgradesToGet = (response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD";
+  if (downgradesToGet) {
+    method = "GET";
+    body = null;
+    headers.delete("content-encoding");
+    headers.delete("content-language");
+    headers.delete("content-location");
+    headers.delete("content-type");
+    headers.delete("content-length");
+  }
+  if (nextUrl.origin !== current.origin) {
+    for (const header of CROSS_ORIGIN_STRIPPED_HEADERS) {
+      headers.delete(header);
+    }
+  }
+  return { url: nextUrl, init: { ...init, method, headers, body } };
+}
+function mergeRequestInit(input, init) {
+  if (!(input instanceof Request)) {
+    return init;
+  }
+  return {
+    method: input.method,
+    headers: input.headers,
+    body: input.body,
+    signal: input.signal,
+    redirect: input.redirect,
+    ...init
+  };
+}
+async function guardedFetch(input, init, hopsLeft, agent) {
+  const url = parseOutboundUrl(input);
+  if (guardEnabled) {
+    assertHost(normalizeHost(url.hostname));
+  }
+  const merged = mergeRequestInit(input, init);
+  const redirect = merged.redirect ?? "follow";
+  const followsRedirects = guardEnabled && redirect === "follow";
+  const requestInit = {
+    redirect: followsRedirects ? "manual" : redirect,
+    dispatcher: agent
+  };
+  Object.assign(requestInit, merged, {
+    redirect: followsRedirects ? "manual" : redirect,
+    dispatcher: agent,
+    ...merged.body != null && typeof merged.body === "object" && "getReader" in merged.body ? { duplex: "half" } : {}
+  });
+  const response = await (0, import_undici.fetch)(url.href, requestInit);
+  if (!followsRedirects) {
+    return response;
+  }
+  if (!REDIRECT_STATUSES.has(response.status)) {
+    return response;
+  }
+  const location = response.headers.get("location");
+  if (location === null) {
+    return response;
+  }
+  void response.body?.cancel().catch(() => void 0);
+  if (hopsLeft === 0) {
+    throw new Error("Outbound URL blocked: too many redirects");
+  }
+  const hop = nextHop(response, location, url, merged);
+  return guardedFetch(hop.url, hop.init, hopsLeft - 1, agent);
+}
+async function ssrfFetch(input, init) {
+  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, outboundAgent);
+}
+async function mcpSsrfFetch(input, init) {
+  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, mcpOutboundAgent);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertSafeOutboundUrl,
+  configureOutboundUrlGuard,
+  mcpSsrfFetch,
+  ssrfFetch
+});
+//# sourceMappingURL=ssrfGuard.js.map

package/dist/core/util/ssrfGuard.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../src/core/util/ssrfGuard.ts"],"sourcesContent":["import type { LookupAllOptions, LookupOptions } from 'node:dns';\nimport { lookup as dnsLookup } from 'node:dns';\nimport { lookup as dnsLookupAsync } from 'node:dns/promises';\nimport { BlockList, isIP, type LookupFunction } from 'node:net';\nimport { Agent, fetch as undiciFetch } from 'undici';\n\nlet allowedHosts: string[] = [];\nlet blockedHosts: string[] = [];\nlet guardEnabled = true;\n\nconst URL_VERIFY = {\n allowedProtocols: ['http:', 'https:'],\n denyCidrsV4: [\n '0.0.0.0/8', // this host\n '10.0.0.0/8', // private\n '100.64.0.0/10', // CGNAT (EKS secondary pod CIDRs)\n '127.0.0.0/8', // loopback\n '169.254.0.0/16', // link-local + metadata\n '172.16.0.0/12', // private (docker, k8s service CIDRs)\n '192.0.0.0/24', // IETF protocol assignments\n '192.0.2.0/24', // TEST-NET-1\n '192.88.99.0/24', // 6to4 relay anycast\n '192.168.0.0/16', // private\n '198.18.0.0/15', // benchmarking\n '198.51.100.0/24', // TEST-NET-2\n '203.0.113.0/24', // TEST-NET-3\n '224.0.0.0/4', // multicast\n '240.0.0.0/4', // reserved + broadcast\n ],\n denyCidrsV6: [\n '::/96', // unspecified, ::1, IPv4-compatible\n '64:ff9b::/96', // NAT64 well-known\n '64:ff9b:1::/48', // NAT64 local-use\n '100::/64', // discard-only\n '2001::/32', // Teredo\n '2001:10::/28', // ORCHID\n '2001:20::/28', // ORCHIDv2\n '2001:db8::/32', // documentation\n '2002::/16', // 6to4\n 'fc00::/7', // unique-local (IPv6 k8s service CIDRs)\n 'fe80::/10', // link-local\n 'ff00::/8', // multicast\n ],\n denyHostSuffixes: [\n '.local',\n '.localhost',\n '.localdomain',\n '.internal',\n '.svc',\n '.cluster',\n '.arpa',\n '.lan',\n '.intranet',\n '.corp',\n '.home',\n '.test',\n '.invalid',\n '.example',\n ],\n};\n\nconst privateNets = new BlockList();\nfunction addDenyCidrs(cidrs: readonly string[], family: 'ipv4' | 'ipv6'): void {\n for (const cidr of cidrs) {\n const slash = cidr.lastIndexOf('/');\n privateNets.addSubnet(cidr.slice(0, slash), Number(cidr.slice(slash + 1)), family);\n }\n}\naddDenyCidrs(URL_VERIFY.denyCidrsV4, 'ipv4');\naddDenyCidrs(URL_VERIFY.denyCidrsV6, 'ipv6');\n\nconst MAX_REDIRECTS = 20;\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\nconst CROSS_ORIGIN_STRIPPED_HEADERS = ['authorization', 'proxy-authorization', 'cookie', 'host'];\n\nexport function configureOutboundUrlGuard(config: {\n enabled?: boolean;\n allowedHosts: readonly string[];\n blockedHosts: readonly string[];\n}): void {\n guardEnabled = config.enabled ?? true;\n allowedHosts = config.allowedHosts.map(normalizeHost);\n blockedHosts = config.blockedHosts.map(normalizeHost);\n}\n\nfunction normalizeHost(hostname: string): string {\n const host = hostname.replace(/\\.$/, '').toLowerCase();\n return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;\n}\n\nfunction isPrivateIp(address: string): boolean {\n const ip = address.replace(/^::ffff:/i, '');\n if (isIP(ip) === 4) {\n return privateNets.check(ip, 'ipv4');\n }\n if (isIP(ip) === 6) {\n return privateNets.check(ip, 'ipv6');\n }\n return true;\n}\n\nfunction blockedError(host: string, cause?: unknown): Error {\n return new Error(`Outbound URL blocked for host \"${host}\"`, { cause });\n}\n\nfunction deny(host: string, cause?: unknown): never {\n throw blockedError(host, cause);\n}\n\nfunction assertHost(host: string): void {\n if (host === '' || blockedHosts.includes(host)) {\n deny(host);\n }\n if (allowedHosts.includes(host)) {\n return;\n }\n if (isIP(host) === 0) {\n if (!host.includes('.') || URL_VERIFY.denyHostSuffixes.some(suffix => host.endsWith(suffix))) {\n deny(host);\n }\n return;\n }\n if (isPrivateIp(host)) {\n deny(host);\n }\n}\n\nfunction parseOutboundUrl(input: string | URL | Request): URL {\n let url: URL;\n try {\n url = new URL(input instanceof Request ? input.url : input);\n } catch (error) {\n throw new Error('Outbound URL blocked', { cause: error });\n }\n if (!URL_VERIFY.allowedProtocols.includes(url.protocol)) {\n throw new Error('Outbound URL blocked: only http and https are allowed');\n }\n return url;\n}\n\n/** undici runs this as the socket lookup, so the addresses we allow are the ones connected to. */\nconst guardedLookup: LookupFunction = (hostname, options: LookupOptions, callback) => {\n if (!guardEnabled) {\n dnsLookup(hostname, options, callback);\n return;\n }\n const host = normalizeHost(hostname);\n try {\n assertHost(host);\n } catch (error) {\n callback(error instanceof Error ? error : blockedError(host, error), '');\n return;\n }\n if (allowedHosts.includes(host) || isIP(host) !== 0) {\n dnsLookup(hostname, options, callback);\n return;\n }\n const allOptions: LookupAllOptions = { ...options, all: true };\n dnsLookup(hostname, allOptions, (err, addresses) => {\n if (err) {\n callback(err, '');\n return;\n }\n const first = addresses[0];\n if (first === undefined || addresses.some(record => isPrivateIp(record.address))) {\n callback(blockedError(host), '');\n return;\n }\n if (options.all) {\n callback(null, addresses);\n return;\n }\n callback(null, first.address, first.family);\n });\n};\n\nconst MCP_BODY_TIMEOUT_MS = 30 * 60 * 1000;\n\nconst outboundAgent = new Agent({\n connect: { lookup: guardedLookup },\n});\n\nconst mcpOutboundAgent = new Agent({\n // MCP SSE/streamable-HTTP stays idle between tool calls; undici's 300s bodyTimeout kills it.\n bodyTimeout: MCP_BODY_TIMEOUT_MS,\n connect: { lookup: guardedLookup },\n});\n\nexport async function assertSafeOutboundUrl(input: string | URL | Request): Promise<void> {\n const url = parseOutboundUrl(input);\n if (!guardEnabled) {\n return;\n }\n const host = normalizeHost(url.hostname);\n assertHost(host);\n if (allowedHosts.includes(host) || isIP(host) !== 0) {\n return;\n }\n let addresses: string[];\n try {\n addresses = (await dnsLookupAsync(host, { all: true })).map(record => record.address);\n } catch (error) {\n deny(host, error);\n }\n if (addresses.some(isPrivateIp)) {\n deny(host);\n }\n}\n\nfunction nextHop(\n response: Response,\n location: string,\n current: URL,\n init: RequestInit,\n): { url: URL; init: RequestInit } {\n let nextUrl: URL;\n try {\n nextUrl = new URL(location, current);\n } catch (error) {\n throw new Error('Outbound URL blocked', { cause: error });\n }\n if (!URL_VERIFY.allowedProtocols.includes(nextUrl.protocol)) {\n throw new Error('Outbound URL blocked: only http and https are allowed');\n }\n\n const headers = new Headers(init.headers);\n let method = (init.method ?? 'GET').toUpperCase();\n let body = init.body ?? null;\n const downgradesToGet =\n ((response.status === 301 || response.status === 302) && method === 'POST') ||\n (response.status === 303 && method !== 'GET' && method !== 'HEAD');\n if (downgradesToGet) {\n method = 'GET';\n body = null;\n headers.delete('content-encoding');\n headers.delete('content-language');\n headers.delete('content-location');\n headers.delete('content-type');\n headers.delete('content-length');\n }\n if (nextUrl.origin !== current.origin) {\n for (const header of CROSS_ORIGIN_STRIPPED_HEADERS) {\n headers.delete(header);\n }\n }\n return { url: nextUrl, init: { ...init, method, headers, body } };\n}\n\nfunction mergeRequestInit(input: string | URL | Request, init: RequestInit): RequestInit {\n if (!(input instanceof Request)) {\n return init;\n }\n return {\n method: input.method,\n headers: input.headers,\n body: input.body,\n signal: input.signal,\n redirect: input.redirect,\n ...init,\n };\n}\n\nasync function guardedFetch(\n input: string | URL | Request,\n init: RequestInit,\n hopsLeft: number,\n agent: Agent,\n): Promise<Response> {\n const url = parseOutboundUrl(input);\n if (guardEnabled) {\n assertHost(normalizeHost(url.hostname));\n }\n const merged = mergeRequestInit(input, init);\n const redirect = merged.redirect ?? 'follow';\n const followsRedirects = guardEnabled && redirect === 'follow';\n const requestInit = {\n redirect: followsRedirects ? 'manual' : redirect,\n dispatcher: agent,\n };\n // npm undici vs @types/node undici-types: FormData/Headers do not line up under exactOptionalPropertyTypes.\n Object.assign(requestInit, merged, {\n redirect: followsRedirects ? 'manual' : redirect,\n dispatcher: agent,\n ...(merged.body != null && typeof merged.body === 'object' && 'getReader' in merged.body\n ? { duplex: 'half' as const }\n : {}),\n });\n const response = await undiciFetch(url.href, requestInit);\n if (!followsRedirects) {\n return response;\n }\n if (!REDIRECT_STATUSES.has(response.status)) {\n return response;\n }\n const location = response.headers.get('location');\n if (location === null) {\n return response;\n }\n void response.body?.cancel().catch(() => undefined);\n if (hopsLeft === 0) {\n throw new Error('Outbound URL blocked: too many redirects');\n }\n const hop = nextHop(response, location, url, merged);\n return guardedFetch(hop.url, hop.init, hopsLeft - 1, agent);\n}\n\nexport async function ssrfFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {\n return guardedFetch(input, init ?? {}, MAX_REDIRECTS, outboundAgent);\n}\n\n/** Same as `ssrfFetch` with a 30m bodyTimeout for idle MCP SSE / streamable-HTTP. */\nexport async function mcpSsrfFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {\n return guardedFetch(input, init ?? {}, MAX_REDIRECTS, mcpOutboundAgent);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,sBAAoC;AACpC,sBAAyC;AACzC,sBAAqD;AACrD,oBAA4C;AAE5C,IAAI,eAAyB,CAAC;AAC9B,IAAI,eAAyB,CAAC;AAC9B,IAAI,eAAe;AAEnB,IAAM,aAAa;AAAA,EACjB,kBAAkB,CAAC,SAAS,QAAQ;AAAA,EACpC,aAAa;AAAA,IACX;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,IAAM,cAAc,IAAI,0BAAU;AAClC,SAAS,aAAa,OAA0B,QAA+B;AAC7E,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,gBAAY,UAAU,KAAK,MAAM,GAAG,KAAK,GAAG,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,GAAG,MAAM;AAAA,EACnF;AACF;AACA,aAAa,WAAW,aAAa,MAAM;AAC3C,aAAa,WAAW,aAAa,MAAM;AAE3C,IAAM,gBAAgB;AACtB,IAAM,oBAAoB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAC3D,IAAM,gCAAgC,CAAC,iBAAiB,uBAAuB,UAAU,MAAM;AAExF,SAAS,0BAA0B,QAIjC;AACP,iBAAe,OAAO,WAAW;AACjC,iBAAe,OAAO,aAAa,IAAI,aAAa;AACpD,iBAAe,OAAO,aAAa,IAAI,aAAa;AACtD;AAEA,SAAS,cAAc,UAA0B;AAC/C,QAAM,OAAO,SAAS,QAAQ,OAAO,EAAE,EAAE,YAAY;AACrD,SAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAC1E;AAEA,SAAS,YAAY,SAA0B;AAC7C,QAAM,KAAK,QAAQ,QAAQ,aAAa,EAAE;AAC1C,UAAI,sBAAK,EAAE,MAAM,GAAG;AAClB,WAAO,YAAY,MAAM,IAAI,MAAM;AAAA,EACrC;AACA,UAAI,sBAAK,EAAE,MAAM,GAAG;AAClB,WAAO,YAAY,MAAM,IAAI,MAAM;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAc,OAAwB;AAC1D,SAAO,IAAI,MAAM,kCAAkC,IAAI,KAAK,EAAE,MAAM,CAAC;AACvE;AAEA,SAAS,KAAK,MAAc,OAAwB;AAClD,QAAM,aAAa,MAAM,KAAK;AAChC;AAEA,SAAS,WAAW,MAAoB;AACtC,MAAI,SAAS,MAAM,aAAa,SAAS,IAAI,GAAG;AAC9C,SAAK,IAAI;AAAA,EACX;AACA,MAAI,aAAa,SAAS,IAAI,GAAG;AAC/B;AAAA,EACF;AACA,UAAI,sBAAK,IAAI,MAAM,GAAG;AACpB,QAAI,CAAC,KAAK,SAAS,GAAG,KAAK,WAAW,iBAAiB,KAAK,YAAU,KAAK,SAAS,MAAM,CAAC,GAAG;AAC5F,WAAK,IAAI;AAAA,IACX;AACA;AAAA,EACF;AACA,MAAI,YAAY,IAAI,GAAG;AACrB,SAAK,IAAI;AAAA,EACX;AACF;AAEA,SAAS,iBAAiB,OAAoC;AAC5D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,iBAAiB,UAAU,MAAM,MAAM,KAAK;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AAAA,EAC1D;AACA,MAAI,CAAC,WAAW,iBAAiB,SAAS,IAAI,QAAQ,GAAG;AACvD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO;AACT;AAGA,IAAM,gBAAgC,CAAC,UAAU,SAAwB,aAAa;AACpF,MAAI,CAAC,cAAc;AACjB,wBAAAA,QAAU,UAAU,SAAS,QAAQ;AACrC;AAAA,EACF;AACA,QAAM,OAAO,cAAc,QAAQ;AACnC,MAAI;AACF,eAAW,IAAI;AAAA,EACjB,SAAS,OAAO;AACd,aAAS,iBAAiB,QAAQ,QAAQ,aAAa,MAAM,KAAK,GAAG,EAAE;AACvE;AAAA,EACF;AACA,MAAI,aAAa,SAAS,IAAI,SAAK,sBAAK,IAAI,MAAM,GAAG;AACnD,wBAAAA,QAAU,UAAU,SAAS,QAAQ;AACrC;AAAA,EACF;AACA,QAAM,aAA+B,EAAE,GAAG,SAAS,KAAK,KAAK;AAC7D,sBAAAA,QAAU,UAAU,YAAY,CAAC,KAAK,cAAc;AAClD,QAAI,KAAK;AACP,eAAS,KAAK,EAAE;AAChB;AAAA,IACF;AACA,UAAM,QAAQ,UAAU,CAAC;AACzB,QAAI,UAAU,UAAa,UAAU,KAAK,YAAU,YAAY,OAAO,OAAO,CAAC,GAAG;AAChF,eAAS,aAAa,IAAI,GAAG,EAAE;AAC/B;AAAA,IACF;AACA,QAAI,QAAQ,KAAK;AACf,eAAS,MAAM,SAAS;AACxB;AAAA,IACF;AACA,aAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,EAC5C,CAAC;AACH;AAEA,IAAM,sBAAsB,KAAK,KAAK;AAEtC,IAAM,gBAAgB,IAAI,oBAAM;AAAA,EAC9B,SAAS,EAAE,QAAQ,cAAc;AACnC,CAAC;AAED,IAAM,mBAAmB,IAAI,oBAAM;AAAA;AAAA,EAEjC,aAAa;AAAA,EACb,SAAS,EAAE,QAAQ,cAAc;AACnC,CAAC;AAED,eAAsB,sBAAsB,OAA8C;AACxF,QAAM,MAAM,iBAAiB,KAAK;AAClC,MAAI,CAAC,cAAc;AACjB;AAAA,EACF;AACA,QAAM,OAAO,cAAc,IAAI,QAAQ;AACvC,aAAW,IAAI;AACf,MAAI,aAAa,SAAS,IAAI,SAAK,sBAAK,IAAI,MAAM,GAAG;AACnD;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,UAAM,gBAAAC,QAAe,MAAM,EAAE,KAAK,KAAK,CAAC,GAAG,IAAI,YAAU,OAAO,OAAO;AAAA,EACtF,SAAS,OAAO;AACd,SAAK,MAAM,KAAK;AAAA,EAClB;AACA,MAAI,UAAU,KAAK,WAAW,GAAG;AAC/B,SAAK,IAAI;AAAA,EACX;AACF;AAEA,SAAS,QACP,UACA,UACA,SACA,MACiC;AACjC,MAAI;AACJ,MAAI;AACF,cAAU,IAAI,IAAI,UAAU,OAAO;AAAA,EACrC,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AAAA,EAC1D;AACA,MAAI,CAAC,WAAW,iBAAiB,SAAS,QAAQ,QAAQ,GAAG;AAC3D,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,UAAU,KAAK,UAAU,OAAO,YAAY;AAChD,MAAI,OAAO,KAAK,QAAQ;AACxB,QAAM,mBACF,SAAS,WAAW,OAAO,SAAS,WAAW,QAAQ,WAAW,UACnE,SAAS,WAAW,OAAO,WAAW,SAAS,WAAW;AAC7D,MAAI,iBAAiB;AACnB,aAAS;AACT,WAAO;AACP,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,OAAO,cAAc;AAC7B,YAAQ,OAAO,gBAAgB;AAAA,EACjC;AACA,MAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,eAAW,UAAU,+BAA+B;AAClD,cAAQ,OAAO,MAAM;AAAA,IACvB;AAAA,EACF;AACA,SAAO,EAAE,KAAK,SAAS,MAAM,EAAE,GAAG,MAAM,QAAQ,SAAS,KAAK,EAAE;AAClE;AAEA,SAAS,iBAAiB,OAA+B,MAAgC;AACvF,MAAI,EAAE,iBAAiB,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,GAAG;AAAA,EACL;AACF;AAEA,eAAe,aACb,OACA,MACA,UACA,OACmB;AACnB,QAAM,MAAM,iBAAiB,KAAK;AAClC,MAAI,cAAc;AAChB,eAAW,cAAc,IAAI,QAAQ,CAAC;AAAA,EACxC;AACA,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,mBAAmB,gBAAgB,aAAa;AACtD,QAAM,cAAc;AAAA,IAClB,UAAU,mBAAmB,WAAW;AAAA,IACxC,YAAY;AAAA,EACd;AAEA,SAAO,OAAO,aAAa,QAAQ;AAAA,IACjC,UAAU,mBAAmB,WAAW;AAAA,IACxC,YAAY;AAAA,IACZ,GAAI,OAAO,QAAQ,QAAQ,OAAO,OAAO,SAAS,YAAY,eAAe,OAAO,OAChF,EAAE,QAAQ,OAAgB,IAC1B,CAAC;AAAA,EACP,CAAC;AACD,QAAM,WAAW,UAAM,cAAAC,OAAY,IAAI,MAAM,WAAW;AACxD,MAAI,CAAC,kBAAkB;AACrB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,kBAAkB,IAAI,SAAS,MAAM,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,EACT;AACA,OAAK,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,MAAM,QAAQ,UAAU,UAAU,KAAK,MAAM;AACnD,SAAO,aAAa,IAAI,KAAK,IAAI,MAAM,WAAW,GAAG,KAAK;AAC5D;AAEA,eAAsB,UAAU,OAA+B,MAAuC;AACpG,SAAO,aAAa,OAAO,QAAQ,CAAC,GAAG,eAAe,aAAa;AACrE;AAGA,eAAsB,aAAa,OAA+B,MAAuC;AACvG,SAAO,aAAa,OAAO,QAAQ,CAAC,GAAG,eAAe,gBAAgB;AACxE;","names":["dnsLookup","dnsLookupAsync","undiciFetch"]}