@workbench-ai/workbench-core 0.0.46 → 0.0.47

package/dist/runtime-dockerfile.d.ts

@@ -0,0 +1,14 @@
+export interface WorkbenchRuntimeAdapterInstallerFile {
+    path: string;
+    content: string;
+    encoding?: "utf8" | "base64";
+    executable?: boolean;
+}
+export interface WorkbenchRuntimeAdapterInstaller {
+    id: string;
+    source: string;
+    setup: readonly string[];
+    files?: readonly WorkbenchRuntimeAdapterInstallerFile[];
+}
+export declare function composeRuntimeDockerfileWithAdapterInstallers(dockerfile: string, adapters: readonly WorkbenchRuntimeAdapterInstaller[]): string;
+//# sourceMappingURL=runtime-dockerfile.d.ts.map

package/dist/runtime-dockerfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-dockerfile.d.ts","sourceRoot":"","sources":["../src/runtime-dockerfile.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gCAAgC;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,oCAAoC,EAAE,CAAC;CACzD;AAED,wBAAgB,6CAA6C,CAC3D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,SAAS,gCAAgC,EAAE,GACpD,MAAM,CAiCR"}

package/dist/runtime-dockerfile.js

@@ -0,0 +1,65 @@
+import path from "node:path";
+export function composeRuntimeDockerfileWithAdapterInstallers(dockerfile, adapters) {
+    const installAdapters = adapters.filter((adapter) => adapter.setup.length > 0 || (adapter.files?.length ?? 0) > 0);
+    if (installAdapters.length === 0) {
+        return dockerfile;
+    }
+    const finalUser = readFinalDockerfileUser(dockerfile);
+    const lines = [
+        dockerfile.trimEnd(),
+        "",
+        "# Workbench adapter setup. The benchmark Dockerfile owns task dependencies;",
+        "# adapter manifests own adapter runtime dependencies.",
+        "USER root",
+    ];
+    for (const adapter of installAdapters) {
+        lines.push("");
+        lines.push(`# Adapter: ${adapter.id} (${adapter.source})`);
+        if ((adapter.files?.length ?? 0) > 0) {
+            lines.push(...adapterSourceDockerfileLines(adapter));
+            lines.push(`WORKDIR /opt/workbench-adapters/${adapter.id}`);
+        }
+        for (const command of adapter.setup) {
+            lines.push(`RUN ${command}`);
+        }
+    }
+    if (finalUser) {
+        lines.push("");
+        lines.push(`# Restore benchmark runtime user.`);
+        lines.push(`USER ${finalUser}`);
+    }
+    lines.push("WORKDIR /workspace", "");
+    return lines.join("\n");
+}
+function readFinalDockerfileUser(dockerfile) {
+    let finalUser = null;
+    for (const line of dockerfile.split(/\r?\n/u)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) {
+            continue;
+        }
+        const match = /^USER\s+(.+)$/iu.exec(trimmed);
+        if (match?.[1]) {
+            finalUser = match[1].trim();
+        }
+    }
+    return finalUser;
+}
+function adapterSourceDockerfileLines(adapter) {
+    const root = `/opt/workbench-adapters/${adapter.id}`;
+    const lines = [`RUN mkdir -p ${shellWord(root)}`];
+    for (const file of adapter.files ?? []) {
+        const destination = `${root}/${normalizeAdapterFilePath(file.path)}`;
+        const encoded = file.encoding === "base64"
+            ? file.content
+            : Buffer.from(file.content, "utf8").toString("base64");
+        lines.push(`RUN mkdir -p ${shellWord(path.posix.dirname(destination))} && printf '%s' ${shellWord(encoded)} | base64 -d > ${shellWord(destination)}${file.executable ? ` && chmod 755 ${shellWord(destination)}` : ""}`);
+    }
+    return lines;
+}
+function normalizeAdapterFilePath(value) {
+    return value.replace(/\\/gu, "/").replace(/^\/+/u, "").replace(/^\.?\//u, "");
+}
+function shellWord(value) {
+    return `'${value.replace(/'/gu, "'\"'\"'")}'`;
+}

package/dist/sandbox-backends/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/sandbox-backends/docker.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,8BAA8B,EAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,wBAAwB,EAE7B,KAAK,yBAAyB,EAE9B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAuC7B,wBAAgB,oCAAoC,IACjD,wBAAwB,CAY1B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,yBAAyB,GACnC,YAAY,CAmDd"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/sandbox-backends/docker.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,8BAA8B,EAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,wBAAwB,EAE7B,KAAK,yBAAyB,EAE9B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAuC7B,wBAAgB,oCAAoC,IACjD,wBAAwB,CAY1B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,yBAAyB,GACnC,YAAY,CAmDd"}

package/dist/sandbox-backends/docker.js

@@ -1,3 +1,4 @@
+import { WORKBENCH_EXECUTION_NETWORK_EGRESS_VALUES, } from "@workbench-ai/workbench-contract";
 import { createHash, } from "node:crypto";
 import { createWriteStream, existsSync, } from "node:fs";
 import path from "node:path";
@@ -23,7 +24,7 @@ export function createDockerSandboxBackendDescriptor() {
             snapshots: true,
             interactiveExec: false,
             filesystemDiff: false,
-            networkPolicy: ["none", "open"],
+            networkPolicy: WORKBENCH_EXECUTION_NETWORK_EGRESS_VALUES,
             fileCapabilities: true,
         },
     };
@@ -351,18 +352,14 @@ function runDockerSandboxProcess(spawn, args, options) {
     });
 }
 function dockerNetworkConfigForExecution(execution) {
-    if (execution.policy.network.egress === "none") {
-        return { mode: "none", egress: "none", allowlistEnforced: true };
+    switch (execution.policy.network.egress) {
+        case "none":
+            return { mode: "none", egress: "none" };
+        case "open":
+            return { mode: "bridge", egress: "open" };
+        default:
+            throw new Error(`Unsupported Docker network egress policy ${String(execution.policy.network.egress)}.`);
     }
-    if (execution.policy.network.egress === "open") {
-        return { mode: "bridge", egress: "open", allowlistEnforced: true };
-    }
-    return {
-        mode: "bridge",
-        egress: "allowlist",
-        allow: [...(execution.policy.network.allow ?? [])],
-        allowlistEnforced: false,
-    };
 }
 function dockerContainerName(sandboxId) {
     return `workbench-sandbox-${sandboxId}`.replace(/[^a-z0-9_.-]+/giu, "-").slice(0, 120);

package/dist/sandbox-backends/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox-backends/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,8BAA8B,EAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,0BAA0B,EAE1B,yBAAyB,EACzB,YAAY,EACb,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAEL,KAAK,4BAA4B,EAElC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACnC,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oCAAoC,EACpC,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,4BAA4B,CAAC;IACvC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,cAAc,EAAE,2BAA2B,EAAE,CAAC;CAC/C;AAED,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,yBAAyB,GACnC,YAAY,CAMd;AAED,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,4BAA4B,GACrC,4BAA4B,CAS9B;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,4BAA4B,GACrC,IAAI,CAeN;AAED,wBAAgB,uCAAuC,CACrD,SAAS,EAAE,4BAA4B,GACtC,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,4BAA4B,EACtC,SAAS,EAAE,iCAAiC,GAC3C,wBAAwB,CAkB1B;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,4BAA4B,GACrC,MAAM,CAER"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox-backends/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,8BAA8B,EAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,0BAA0B,EAE1B,yBAAyB,EACzB,YAAY,EACb,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAEL,KAAK,4BAA4B,EAElC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACnC,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oCAAoC,EACpC,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,4BAA4B,CAAC;IACvC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,cAAc,EAAE,2BAA2B,EAAE,CAAC;CAC/C;AAED,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,yBAAyB,GACnC,YAAY,CAMd;AAED,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,4BAA4B,GACrC,4BAA4B,CAS9B;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,4BAA4B,GACrC,IAAI,CAeN;AAED,wBAAgB,uCAAuC,CACrD,SAAS,EAAE,4BAA4B,GACtC,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,4BAA4B,EACtC,SAAS,EAAE,iCAAiC,GAC3C,wBAAwB,CAkB1B;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,4BAA4B,GACrC,MAAM,CAER"}

package/dist/sandbox-backends/index.js

@@ -1,3 +1,4 @@
+import { isWorkbenchExecutionNetworkEgress, } from "@workbench-ai/workbench-contract";
 import { createDockerSandboxBackendDescriptor, createDockerSandboxPlane, } from "./docker.js";
 import { DOCKER_SANDBOX_BACKEND, resolveWorkbenchSandboxProviderName, } from "./names.js";
 export { DOCKER_SANDBOX_BACKEND, resolveWorkbenchSandboxProviderName, } from "./names.js";
@@ -70,7 +71,7 @@ function isSandboxBackendCapabilities(value) {
         typeof record.filesystemDiff === "boolean" &&
         typeof record.fileCapabilities === "boolean" &&
         Array.isArray(record.networkPolicy) &&
-        record.networkPolicy.every((policy) => policy === "none" || policy === "open" || policy === "allowlist");
+        record.networkPolicy.every(isWorkbenchExecutionNetworkEgress);
 }
 function assertPositiveResource(value, label) {
     if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {

package/dist/sandbox-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-inputs.d.ts","sourceRoot":"","sources":["../src/sandbox-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,IAAI,EACJ,mBAAmB,EACnB,4BAA4B,EAC5B,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,8BAA8B,EAC/B,MAAM,8BAA8B,CAAC;AActC,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,sBAAsB,CAO1F;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,8BAA8B,GAAG,yBAAyB,CAoB/G;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAC9C,wBAAwB,CAW1B;AAqBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAC/C,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,wBAAwB,CAO1B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,8BAA8B,EACpC,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,MAAM,GAChB,IAAI,CAkBN;AAED,wBAAgB,uCAAuC,CACrD,GAAG,EAAE,kBAAkB,EACvB,SAAS,EAAE,sBAAsB,GAChC,kBAAkB,CAgBpB;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAgBxG;AAED,wBAAsB,sCAAsC,CAAC,IAAI,EAAE;IACjE,YAAY,EAAE,kBAAkB,CAAC;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iCAAiC,CAAC,YAAY,CAAC,CAAC;IAC5D,UAAU,EAAE,iCAAiC,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,EAAE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IACpD,SAAS,EAAE,yBAAyB,CAAC;CACtC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6CpC;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAQ9G;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,4BAA4B,EACxC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CAYxB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7D;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,iCAAiC,GAC1C,kBAAkB,CAEpB;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,OAAO,GAChB,kBAAkB,CAepB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAWlF"}
+{"version":3,"file":"sandbox-inputs.d.ts","sourceRoot":"","sources":["../src/sandbox-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,IAAI,EACJ,mBAAmB,EACnB,4BAA4B,EAC5B,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,8BAA8B,EAC/B,MAAM,8BAA8B,CAAC;AActC,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,sBAAsB,CAO1F;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,8BAA8B,GAAG,yBAAyB,CAoB/G;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAC9C,wBAAwB,CAW1B;AAqBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAC/C,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,wBAAwB,CAO1B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,8BAA8B,EACpC,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,MAAM,GAChB,IAAI,CAmBN;AAED,wBAAgB,uCAAuC,CACrD,GAAG,EAAE,kBAAkB,EACvB,SAAS,EAAE,sBAAsB,GAChC,kBAAkB,CAgBpB;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAgBxG;AAED,wBAAsB,sCAAsC,CAAC,IAAI,EAAE;IACjE,YAAY,EAAE,kBAAkB,CAAC;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iCAAiC,CAAC,YAAY,CAAC,CAAC;IAC5D,UAAU,EAAE,iCAAiC,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,EAAE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IACpD,SAAS,EAAE,yBAAyB,CAAC;CACtC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6CpC;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAQ9G;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,4BAA4B,EACxC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CAYxB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7D;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,iCAAiC,GAC1C,kBAAkB,CAEpB;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,OAAO,GAChB,kBAAkB,CAepB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAWlF"}

package/dist/sandbox-inputs.js

@@ -75,6 +75,7 @@ export function createSandboxAdapterRequest(args, request, startedAt) {
             ...(args.adapterAuthProfiles ? { adapterAuthProfiles: args.adapterAuthProfiles } : {}),
             ...(args.adapterManifests ? { adapterManifests: args.adapterManifests } : {}),
             ...(args.progress ? { progress: args.progress } : {}),
+            ...(args.runtimeControlOperation ? { runtimeControlOperation: args.runtimeControlOperation } : {}),
         },
         execution: request.execution,
         capability: request.capability,

package/dist/sandbox-plane.d.ts

@@ -72,6 +72,7 @@ export interface ValidatedSandboxExecutionResult {
     payloads: WorkbenchExecutionOutputPayloads;
 }
 export declare function executeValidatedSandboxExecution(plane: SandboxPlane, execution: WorkbenchExecutionSpec, options: SandboxExecutionOptions): Promise<ValidatedSandboxExecutionResult>;
+export declare function assertSandboxBackendSupportsNetworkPolicy(backend: SandboxBackendDescriptor, execution: Pick<WorkbenchExecutionSpec, "id" | "policy">): void;
 export declare function createWorkbenchSandboxExecutionMetadata(args: WorkbenchSandboxExecutionMetadata): WorkbenchSandboxExecutionMetadata;
 export declare function collectSandboxHandleScopeIssues(sandbox: SandboxHandle, allocation: WorkbenchSandboxAllocation, execution: WorkbenchExecutionSpec): string[];
 export declare function createWorkbenchSandboxAllocation(execution: WorkbenchExecutionSpec, options: WorkbenchSandboxAllocationOptions): WorkbenchSandboxAllocation;

package/dist/sandbox-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-plane.d.ts","sourceRoot":"","sources":["../src/sandbox-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,IAAI,EACJ,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,iCAAiC,EACjC,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAGL,KAAK,gCAAgC,EACtC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,0BAA0B,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC1F,WAAW,CAAC,UAAU,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjH,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,SAAS,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,sBAAsB,CAAC;IAClC,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,0BAA0B,CAAC;IACvC,UAAU,EAAE,4BAA4B,CAAC;IACzC,MAAM,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,0BAA0B,CAAC;IACvC,UAAU,EAAE,4BAA4B,CAAC;IACzC,MAAM,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,wBAAwB,CAAC;IAClC,kBAAkB,CAAC,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3H,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvG,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,gCAAgC,CAAC;CAC5C;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,+BAA+B,CAAC,CA4F1C;AAkDD,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,iCAAiC,GAAG,iCAAiC,CA0BlI;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,0BAA0B,EACtC,SAAS,EAAE,sBAAsB,GAChC,MAAM,EAAE,CAkBV;AAED,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,iCAAiC,GACzC,0BAA0B,CAoB5B;AAcD,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,4BAA4B,CAmB9B;AAED,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,4BAA4B,EACxC,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,MAAM,EAAE,CAsCV;AAYD,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,0BAA0B,EACtC,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,MAAM,EAAE,CAuCV"}
+{"version":3,"file":"sandbox-plane.d.ts","sourceRoot":"","sources":["../src/sandbox-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,IAAI,EACJ,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,iCAAiC,EACjC,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAGL,KAAK,gCAAgC,EACtC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,0BAA0B,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC1F,WAAW,CAAC,UAAU,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjH,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,SAAS,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,sBAAsB,CAAC;IAClC,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,0BAA0B,CAAC;IACvC,UAAU,EAAE,4BAA4B,CAAC;IACzC,MAAM,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,0BAA0B,CAAC;IACvC,UAAU,EAAE,4BAA4B,CAAC;IACzC,MAAM,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,wBAAwB,CAAC;IAClC,kBAAkB,CAAC,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3H,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvG,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,gCAAgC,CAAC;CAC5C;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,+BAA+B,CAAC,CA6F1C;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,wBAAwB,EACjC,SAAS,EAAE,IAAI,CAAC,sBAAsB,EAAE,IAAI,GAAG,QAAQ,CAAC,GACvD,IAAI,CAMN;AAkDD,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,iCAAiC,GAAG,iCAAiC,CAoBlI;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,0BAA0B,EACtC,SAAS,EAAE,sBAAsB,GAChC,MAAM,EAAE,CAkBV;AAED,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,iCAAiC,GACzC,0BAA0B,CAiB5B;AAcD,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,4BAA4B,CAgB9B;AAED,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,4BAA4B,EACxC,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,MAAM,EAAE,CAsCV;AAWD,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,0BAA0B,EACtC,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,MAAM,EAAE,CAkCV"}

package/dist/sandbox-plane.js

@@ -1,6 +1,7 @@
 import { assertWorkbenchExecutionIsolation, validateWorkbenchExecutionOutputPayloads, } from "./execution-outputs.js";
 export async function executeValidatedSandboxExecution(plane, execution, options) {
     assertWorkbenchExecutionIsolation(execution);
+    assertSandboxBackendSupportsNetworkPolicy(plane.backend, execution);
     const inputs = await options.fileStore.materializeInputs(execution);
     const now = options.now ?? new Date().toISOString();
     const timing = {};
@@ -92,6 +93,13 @@ export async function executeValidatedSandboxExecution(plane, execution, options
         payloads: validateWorkbenchExecutionOutputPayloads(execution, outputPayloads),
     };
 }
+export function assertSandboxBackendSupportsNetworkPolicy(backend, execution) {
+    const egress = execution.policy.network.egress;
+    if (!backend.capabilities.networkPolicy.includes(egress)) {
+        const supported = backend.capabilities.networkPolicy.join(", ") || "none";
+        throw new Error(`Sandbox backend ${backend.name} does not support network egress ${egress} for execution ${execution.id}. Supported egress policies: ${supported}.`);
+    }
+}
 function attachSandboxLifecycleTiming(result, timing) {
     const metadata = isJsonRecord(result.metadata) ? result.metadata : {};
     const completedJob = isJsonRecord(metadata.completedJob) ? metadata.completedJob : null;
@@ -134,19 +142,13 @@ export function createWorkbenchSandboxExecutionMetadata(args) {
         allocation: {
             ...args.allocation,
             template: { ...args.allocation.template },
-            network: {
-                ...args.allocation.network,
-                ...(args.allocation.network.allow ? { allow: [...args.allocation.network.allow] } : {}),
-            },
+            network: { ...args.allocation.network },
         },
         capability: {
             ...args.capability,
             subject: { ...args.capability.subject },
             inputs: args.capability.inputs.map((input) => ({ ...input })),
-            network: {
-                ...args.capability.network,
-                ...(args.capability.network.allow ? { allow: [...args.capability.network.allow] } : {}),
-            },
+            network: { ...args.capability.network },
         },
         handle: {
             ...args.handle,
@@ -186,10 +188,7 @@ export function createWorkbenchSandboxAllocation(execution, options) {
         backend: options.backend,
         runnerId: options.runnerId ?? "local-runner",
         template: { ...execution.sandbox },
-        network: {
-            ...execution.policy.network,
-            ...(execution.policy.network.allow ? { allow: [...execution.policy.network.allow] } : {}),
-        },
+        network: { ...execution.policy.network },
         status: "allocated",
         createdAt: new Date(nowMs).toISOString(),
         expiresAt: new Date(nowMs + ttlMs).toISOString(),
@@ -220,10 +219,7 @@ export function createWorkbenchExecutionCapability(execution, options = {}) {
         },
         inputs: execution.inputs.map((input) => ({ ...input })),
         outputPrefix: options.outputPrefix ?? `executions/${execution.id}/outputs/`,
-        network: {
-            ...execution.policy.network,
-            ...(execution.policy.network.allow ? { allow: [...execution.policy.network.allow] } : {}),
-        },
+        network: { ...execution.policy.network },
         expiresAt: new Date(nowMs + ttlMs).toISOString(),
     };
 }
@@ -273,7 +269,6 @@ function networkPolicyKey(policy) {
     }
     return JSON.stringify({
         egress: policy.egress,
-        ...(Array.isArray(policy.allow) ? { allow: [...policy.allow] } : {}),
     });
 }
 export function collectSandboxAllocationScopeIssues(allocation, execution, options = {}) {
@@ -299,11 +294,6 @@ export function collectSandboxAllocationScopeIssues(allocation, execution, optio
     if (allocation.network.egress !== execution.policy.network.egress) {
         issues.push(`Sandbox allocation network policy does not match execution ${execution.id}.`);
     }
-    const expectedAllow = execution.policy.network.allow ?? [];
-    const actualAllow = allocation.network.allow ?? [];
-    if (JSON.stringify(actualAllow) !== JSON.stringify(expectedAllow)) {
-        issues.push(`Sandbox allocation network allowlist does not match execution ${execution.id}.`);
-    }
     if (!["allocated", "running", "stopping", "stopped"].includes(allocation.status)) {
         issues.push(`Sandbox allocation status ${allocation.status} is not supported for execution ${execution.id}.`);
     }

package/dist/trace-files.d.ts

@@ -6,10 +6,10 @@ export declare function workbenchTraceRunDirectory(args: {
     sequence: number;
     runId: string;
 }): string;
-export declare function workbenchTracePhaseDirectory(args: {
+export declare function workbenchTraceExecutionDirectory(args: {
     sequence: number;
     runId: string;
-    phase: WorkbenchExecutionPurpose;
+    purpose: WorkbenchExecutionPurpose;
 }): string;
 export declare function workbenchTraceRunDirectoryName(args: {
     sequence: number;

package/dist/trace-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace-files.d.ts","sourceRoot":"","sources":["../src/trace-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAO1C,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiChH;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAK9E;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,yBAAyB,CAAC;CAClC,GAAG,MAAM,CAET;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAKT"}
+{"version":3,"file":"trace-files.d.ts","sourceRoot":"","sources":["../src/trace-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAO1C,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiChH;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAK9E;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,yBAAyB,CAAC;CACpC,GAAG,MAAM,CAET;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAKT"}

package/dist/trace-files.js

@@ -43,8 +43,8 @@ export function traceFilePaths(files) {
 export function workbenchTraceRunDirectory(args) {
     return `${WORKBENCH_TRACE_ROOT}/${workbenchTraceRunDirectoryName(args)}`;
 }
-export function workbenchTracePhaseDirectory(args) {
-    return `${workbenchTraceRunDirectory(args)}/${String(tracePhaseSequence(args.phase)).padStart(6, "0")}-${args.phase}`;
+export function workbenchTraceExecutionDirectory(args) {
+    return `${workbenchTraceRunDirectory(args)}/${String(tracePurposeSequence(args.purpose)).padStart(6, "0")}-${args.purpose}`;
 }
 export function workbenchTraceRunDirectoryName(args) {
     const sequence = Number.isSafeInteger(args.sequence) && args.sequence >= 0
@@ -83,8 +83,8 @@ function sanitizeTracePathSegment(value) {
         .replace(/^_+|_+$/gu, "");
     return sanitized || "run";
 }
-function tracePhaseSequence(phase) {
-    if (phase === "improve") {
+function tracePurposeSequence(purpose) {
+    if (purpose === "improve") {
         return 1;
     }
     return 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workbench-ai/workbench-core",
-  "version": "0.0.46",
+  "version": "0.0.47",
   "type": "module",
   "repository": {
     "type": "git",
@@ -22,8 +22,8 @@
   ],
   "dependencies": {
     "yaml": "^2.8.2",
-    "@workbench-ai/workbench-protocol": "0.0.46",
-    "@workbench-ai/workbench-contract": "0.0.46"
+    "@workbench-ai/workbench-protocol": "0.0.47",
+    "@workbench-ai/workbench-contract": "0.0.47"
   },
   "devDependencies": {
     "@types/node": "^24.3.1",

package/worker/sandbox-adapter-runner.cjs

@@ -23,22 +23,31 @@ async function main() {
     markStage("request-removed");
     const runtimeImport = process.env.WORKBENCH_RUNTIME_IMPORT || "../src/index.ts";
     const {
-      executeAdapterInCurrentSandboxRuntime,
+      executeAdapterInCurrentRuntime,
+      executeRuntimeControlOperationSequenceInCurrentRuntime,
     } = await import(runtimeImport);
     markStage("runtime-imported");
     const startedAt = typeof request.startedAt === "string" ? request.startedAt : new Date().toISOString();
-    const completedJob = await executeAdapterInCurrentSandboxRuntime(
-      {
-        ...validated.jobInput,
-        now: startedAt,
-        workspaceRoot: workspaceRootFromEnvironment(),
-        pullImages: false,
-        runtimeRegistry: "",
-      },
-      validated.execution,
-      startedAt,
-      validated.capability,
-    );
+    const runtimeInput = {
+      ...validated.jobInput,
+      now: startedAt,
+      workspaceRoot: workspaceRootFromEnvironment(),
+      pullImages: false,
+      runtimeRegistry: "",
+    };
+    const completedJob = validated.jobInput.runtimeControlOperation
+      ? await executeRuntimeControlOperationSequenceInCurrentRuntime(
+          runtimeInput,
+          validated.execution,
+          startedAt,
+          validated.capability,
+        )
+      : await executeAdapterInCurrentRuntime(
+          runtimeInput,
+          validated.execution,
+          startedAt,
+          validated.capability,
+        );
     markStage("adapter-completed");
     fs.writeFileSync(responsePath, `${JSON.stringify({ ok: true, job: completedJob }, null, 2)}\n`);
   } catch (error) {

package/dist/execution-phases.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"execution-phases.d.ts","sourceRoot":"","sources":["../src/execution-phases.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EAExB,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAI1C,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CA0D9B;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,CACX,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,2BAA2B,KAC9B,uBAAuB,CAAC;CAC9B,GAAG,mBAAmB,EAAE,CAkDxB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,kBAAkB,GACtB,sBAAsB,CAAC,SAAS,CAAC,GAAG,IAAI,CAQ1C;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAG/E;AAED,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GACzC,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,SAAS;IAAE,MAAM,EAAE,wBAAwB,CAAA;CAAE,EAAE,GACpD,wBAAwB,CAc1B"}