@wix/pathgrade 1.0.0 → 1.0.1

package/dist/agents/claude/sdk-options.js

@@ -78,6 +78,12 @@ export function buildClaudeSdkOptions(inputs) {
             continue;
         env[key] = value;
     }
+    // Claude Code normally exposes claude.ai account-level MCP connectors to
+    // local OAuth sessions. Keep PathGrade trials isolated from those ambient
+    // connectors unless the caller explicitly opts in through their env.
+    if (useLocalOAuth && env.ENABLE_CLAUDEAI_MCP_SERVERS === undefined) {
+        env.ENABLE_CLAUDEAI_MCP_SERVERS = 'false';
+    }
     if (!useLocalOAuth) {
         env.CLAUDE_CONFIG_DIR = path.join(inputs.workspacePath, CLAUDE_CONFIG_SUBDIR);
     }

package/dist/providers/credentials.js

@@ -95,7 +95,7 @@ async function resolveClaude(userEnv, ports) {
             return {
                 env: { PATHGRADE_CLAUDE_LOCAL_OAUTH: '1' },
                 setupCommands: [],
-                copyFromHome: ['.claude.json'],
+                copyFromHome: [],
                 linkFromHome: ['Library/Keychains'],
             };
         }

package/dist/providers/sandbox-lifecycle.d.ts

@@ -0,0 +1,22 @@
+export declare const SANDBOX_PREFIX = "pathgrade-";
+export declare const SANDBOX_MARKER = ".pathgrade-sandbox.json";
+export declare const STALE_SANDBOX_AGE_MS: number;
+interface RemoveSandboxRootOptions {
+    remove?: (target: string) => Promise<void>;
+    sleep?: (ms: number) => Promise<void>;
+    retryDelaysMs?: readonly number[];
+}
+export declare function removeSandboxRoot(rootDir: string, opts?: RemoveSandboxRootOptions): Promise<void>;
+export interface StaleSandboxCleanupOptions extends RemoveSandboxRootOptions {
+    tempDir?: string;
+    now?: () => number;
+    isProcessAlive?: (pid: number) => boolean;
+}
+/**
+ * Removes old, crashed PathGrade sandboxes without examining anything outside
+ * the resolved operating-system temp directory. Every filesystem failure is
+ * intentionally ignored so a cleanup race never prevents a new trial.
+ */
+export declare function cleanupStaleSandboxes(opts?: StaleSandboxCleanupOptions): Promise<void>;
+export declare function createSandboxRoot(): Promise<string>;
+export {};

package/dist/providers/sandbox-lifecycle.js

@@ -0,0 +1,133 @@
+import fs from 'fs-extra';
+import * as os from 'os';
+import * as path from 'path';
+export const SANDBOX_PREFIX = 'pathgrade-';
+export const SANDBOX_MARKER = '.pathgrade-sandbox.json';
+export const STALE_SANDBOX_AGE_MS = 24 * 60 * 60 * 1_000;
+let startupCleanup;
+const SANDBOX_REMOVE_RETRY_DELAYS_MS = [
+    50,
+    100,
+    250,
+    500,
+    1_000,
+    2_000,
+    3_000,
+    5_000,
+];
+function isRetryableRemoveError(error) {
+    const code = error.code;
+    return code === 'ENOTEMPTY' || code === 'EBUSY' || code === 'EPERM';
+}
+export async function removeSandboxRoot(rootDir, opts = {}) {
+    const remove = opts.remove ?? ((target) => fs.remove(target));
+    const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const retryDelaysMs = opts.retryDelaysMs ?? SANDBOX_REMOVE_RETRY_DELAYS_MS;
+    for (let attempt = 0;; attempt++) {
+        try {
+            await remove(rootDir);
+            return;
+        }
+        catch (error) {
+            if (!isRetryableRemoveError(error) || attempt >= retryDelaysMs.length) {
+                throw error;
+            }
+            await sleep(retryDelaysMs[attempt]);
+        }
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // A process we cannot signal is still live. Unknown failures are also
+        // preserved: cleanup must fail safe rather than delete a live trial.
+        return error.code !== 'ESRCH';
+    }
+}
+async function readOwnedSandboxMarker(rootDir) {
+    const rootStat = await fs.lstat(rootDir);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        return undefined;
+    const markerPath = path.join(rootDir, SANDBOX_MARKER);
+    const markerStat = await fs.lstat(markerPath);
+    if (!markerStat.isFile() || markerStat.isSymbolicLink())
+        return undefined;
+    const marker = JSON.parse(await fs.readFile(markerPath, 'utf8'));
+    const pid = marker.pid;
+    if (marker.version !== 1 || typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0)
+        return undefined;
+    return { version: 1, pid };
+}
+async function isStaleOwnedSandbox(rootDir, now, staleAfterMs, processIsAlive) {
+    const marker = await readOwnedSandboxMarker(rootDir);
+    if (!marker)
+        return false;
+    const markerStat = await fs.lstat(path.join(rootDir, SANDBOX_MARKER));
+    if (now - markerStat.mtimeMs < staleAfterMs)
+        return false;
+    return !processIsAlive(marker.pid);
+}
+/**
+ * Removes old, crashed PathGrade sandboxes without examining anything outside
+ * the resolved operating-system temp directory. Every filesystem failure is
+ * intentionally ignored so a cleanup race never prevents a new trial.
+ */
+export async function cleanupStaleSandboxes(opts = {}) {
+    let tempDir;
+    try {
+        tempDir = await fs.realpath(opts.tempDir ?? os.tmpdir());
+    }
+    catch {
+        return;
+    }
+    const now = opts.now ?? Date.now;
+    const processIsAlive = opts.isProcessAlive ?? isProcessAlive;
+    let entries;
+    try {
+        entries = await fs.readdir(tempDir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink() || !entry.name.startsWith(SANDBOX_PREFIX))
+            continue;
+        const rootDir = path.resolve(tempDir, entry.name);
+        if (path.dirname(rootDir) !== tempDir)
+            continue;
+        try {
+            if (!await isStaleOwnedSandbox(rootDir, now(), STALE_SANDBOX_AGE_MS, processIsAlive))
+                continue;
+            // Re-check ownership and liveness immediately before removal. This
+            // narrows the window where another process can replace a candidate.
+            if (!await isStaleOwnedSandbox(rootDir, now(), STALE_SANDBOX_AGE_MS, processIsAlive))
+                continue;
+            await removeSandboxRoot(rootDir, opts);
+        }
+        catch {
+            // A disappeared directory, a permission change, or a deletion race
+            // must never make trial creation fail.
+        }
+    }
+}
+export async function createSandboxRoot() {
+    // A process may create many trial sandboxes. Scan only once at startup so
+    // repeated trials do not pay to enumerate the entire operating-system temp
+    // directory, while concurrent creators share the same best-effort sweep.
+    startupCleanup ??= cleanupStaleSandboxes();
+    await startupCleanup;
+    const tempDir = await fs.realpath(os.tmpdir());
+    const rootDir = await fs.mkdtemp(path.join(tempDir, SANDBOX_PREFIX));
+    const marker = { version: 1, pid: process.pid };
+    try {
+        await fs.writeFile(path.join(rootDir, SANDBOX_MARKER), JSON.stringify(marker), 'utf8');
+        return rootDir;
+    }
+    catch (error) {
+        await fs.remove(rootDir).catch(() => { });
+        throw error;
+    }
+}

package/dist/providers/sandbox.js

@@ -2,11 +2,12 @@ import fs from 'fs-extra';
 import * as path from 'path';
 import * as os from 'os';
 import { DEFAULT_COPY_IGNORE, createCopyFilter, isPortableCopyEntry } from './copy-filter.js';
+import { createSandboxRoot } from './sandbox-lifecycle.js';
 export const SAFE_HOST_VARS = [
     'PATH', 'SHELL', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'USER', 'LOGNAME',
 ];
 export async function createSandbox(spec) {
-    const rootDir = path.join(os.tmpdir(), `pathgrade-${Math.random().toString(36).substring(7)}`);
+    const rootDir = await createSandboxRoot();
     const workspacePath = path.join(rootDir, 'workspace');
     const homePath = path.join(rootDir, 'home');
     const tmpPath = path.join(rootDir, 'tmp');

package/dist/providers/workspace.d.ts

@@ -11,11 +11,5 @@ export interface Workspace {
     }): Promise<CommandResult>;
     dispose(): Promise<void>;
 }
-interface RemoveSandboxRootOptions {
-    remove?: (target: string) => Promise<void>;
-    sleep?: (ms: number) => Promise<void>;
-    retryDelaysMs?: readonly number[];
-}
-export declare function removeSandboxRoot(rootDir: string, opts?: RemoveSandboxRootOptions): Promise<void>;
 export declare function linkPathsFromHostHome(pathsToLink: string[], sandboxHomePath: string): Promise<void>;
 export declare function prepareWorkspace(spec: SandboxConfig): Promise<Workspace>;

package/dist/providers/workspace.js

@@ -2,41 +2,11 @@ import fs from 'fs-extra';
 import * as os from 'os';
 import * as path from 'path';
 import { createSandbox } from './sandbox.js';
+import { removeSandboxRoot } from './sandbox-lifecycle.js';
 import { stageMcpConfig } from './mcp-config.js';
 import { sandboxExec } from './sandbox-exec.js';
 import { resolveCredentials } from './credentials.js';
 import { isPortableCopyEntry } from './copy-filter.js';
-const SANDBOX_REMOVE_RETRY_DELAYS_MS = [
-    50,
-    100,
-    250,
-    500,
-    1_000,
-    2_000,
-    3_000,
-    5_000,
-];
-function isRetryableRemoveError(error) {
-    const code = error.code;
-    return code === 'ENOTEMPTY' || code === 'EBUSY' || code === 'EPERM';
-}
-export async function removeSandboxRoot(rootDir, opts = {}) {
-    const remove = opts.remove ?? ((target) => fs.remove(target));
-    const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-    const retryDelaysMs = opts.retryDelaysMs ?? SANDBOX_REMOVE_RETRY_DELAYS_MS;
-    for (let attempt = 0;; attempt++) {
-        try {
-            await remove(rootDir);
-            return;
-        }
-        catch (error) {
-            if (!isRetryableRemoveError(error) || attempt >= retryDelaysMs.length) {
-                throw error;
-            }
-            await sleep(retryDelaysMs[attempt]);
-        }
-    }
-}
 async function copyPathsFromHostHome(pathsToCopy, sandboxHomePath) {
     const realHome = os.homedir();
     for (const relPath of pathsToCopy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/pathgrade",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "packageManager": "yarn@4.12.0",
   "description": "Evaluate whether AI agents discover and use your skills correctly",
   "repository": {