dev3000 0.0.185 → 0.0.187

package/dist/runtime/sandbox-sessions.d.ts

@@ -0,0 +1,31 @@
+import { type Harness } from "./harness.js";
+export interface SandboxSession {
+    version: 1;
+    id: string;
+    project: string;
+    projectName: string;
+    team: string;
+    scope?: string;
+    sandbox: string;
+    hostname: string;
+    appUrl: string;
+    workdir: string;
+    branch?: string;
+    command?: string;
+    installCommand?: string;
+    timeout: string;
+    harness?: Harness;
+    fx: boolean;
+    ownsSandbox: boolean;
+    createdAt: string;
+    lastUsedAt: string;
+    closedAt?: string;
+    launcherPid?: number;
+}
+export declare const sandboxSessionsDirectory: () => string;
+export declare function readSandboxSession(id: string, directory?: string): SandboxSession;
+export declare function listSandboxSessions(directory?: string): SandboxSession[];
+export declare function saveSandboxSession(record: SandboxSession, directory?: string): void;
+export declare function sandboxLauncherAlive(record: SandboxSession): boolean;
+export declare function formatSandboxSessions(records: SandboxSession[]): string;
+//# sourceMappingURL=sandbox-sessions.d.ts.map

package/dist/runtime/sandbox-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-sessions.d.ts","sourceRoot":"","sources":["../../src/runtime/sandbox-sessions.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAE1D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,EAAE,EAAE,OAAO,CAAA;IACX,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,eAAO,MAAM,wBAAwB,cAAoD,CAAA;AAgCzF,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,SAA6B,GAAG,cAAc,CAUrG;AAED,wBAAgB,mBAAmB,CAAC,SAAS,SAA6B,GAAG,cAAc,EAAE,CAkB5F;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,SAA6B,GAAG,IAAI,CAMvG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAQpE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAevE"}

package/dist/runtime/sandbox-sessions.js

@@ -0,0 +1,102 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { HARNESS_NAMES } from "./harness.js";
+export const sandboxSessionsDirectory = () => join(homedir(), ".d3k", "sandbox-sessions");
+const isId = (id) => /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/.test(id);
+function validSession(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    return (record.version === 1 &&
+        (record.harness === undefined || HARNESS_NAMES.includes(record.harness)) &&
+        typeof record.id === "string" &&
+        isId(record.id) &&
+        [
+            record.project,
+            record.projectName,
+            record.team,
+            record.sandbox,
+            record.hostname,
+            record.appUrl,
+            record.workdir,
+            record.timeout,
+            record.createdAt,
+            record.lastUsedAt
+        ].every((value) => typeof value === "string" && !!value) &&
+        typeof record.fx === "boolean" &&
+        typeof record.ownsSandbox === "boolean" &&
+        [record.scope, record.branch, record.command, record.installCommand, record.closedAt].every((value) => value === undefined || typeof value === "string") &&
+        (record.launcherPid === undefined || (Number.isSafeInteger(record.launcherPid) && record.launcherPid > 0)));
+}
+export function readSandboxSession(id, directory = sandboxSessionsDirectory()) {
+    if (!isId(id))
+        throw new Error("Invalid resume ID. Run d3k --resume to list saved sandbox sessions.");
+    let record;
+    try {
+        record = JSON.parse(readFileSync(join(directory, `${id}.json`), "utf8"));
+    }
+    catch {
+        throw new Error(`No saved sandbox session ${id}. Run d3k --resume to list sessions.`);
+    }
+    if (!validSession(record) || record.id !== id)
+        throw new Error(`Invalid saved sandbox session ${id}`);
+    return record;
+}
+export function listSandboxSessions(directory = sandboxSessionsDirectory()) {
+    let files;
+    try {
+        files = readdirSync(directory);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    return files
+        .flatMap((file) => {
+        if (!file.endsWith(".json") || !isId(file.slice(0, -5)))
+            return [];
+        try {
+            return [readSandboxSession(file.slice(0, -5), directory)];
+        }
+        catch {
+            return [];
+        }
+    })
+        .sort((a, b) => b.lastUsedAt.localeCompare(a.lastUsedAt));
+}
+export function saveSandboxSession(record, directory = sandboxSessionsDirectory()) {
+    if (!validSession(record))
+        throw new Error("Invalid sandbox session metadata");
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporary = join(directory, `${record.id}.${randomUUID()}.tmp`);
+    writeFileSync(temporary, JSON.stringify(record), { mode: 0o600 });
+    renameSync(temporary, join(directory, `${record.id}.json`));
+}
+export function sandboxLauncherAlive(record) {
+    if (!record.launcherPid)
+        return false;
+    try {
+        process.kill(record.launcherPid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+export function formatSandboxSessions(records) {
+    if (!records.length)
+        return "No saved sandbox sessions. Start one with d3k --project <team/project>.";
+    const clean = (text) => Array.from(text, (character) => {
+        const code = character.codePointAt(0) || 0;
+        return code < 32 || (code >= 127 && code <= 159) ? " " : character;
+    }).join("");
+    return [
+        "Saved sandbox sessions (remote availability is checked when resuming):",
+        ...records.map((record) => `${record.id}  ${clean(record.scope || record.team)}/${clean(record.projectName)}  ${clean(record.sandbox)}${record.branch ? `  branch: ${clean(record.branch)}` : ""}\n  ${clean(record.appUrl)}  last used: ${clean(record.lastUsedAt)}${sandboxLauncherAlive(record) ? "  companion running" : ""}`),
+        "Resume with: d3k --resume <id>"
+    ].join("\n");
+}
+//# sourceMappingURL=sandbox-sessions.js.map

package/dist/runtime/sandbox-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-sessions.js","sourceRoot":"","sources":["../../src/runtime/sandbox-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAA;AA0B1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAA;AACzF,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,uEAAuE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAE7G,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,MAAM,GAAG,KAAuB,CAAA;IACtC,OAAO,CACL,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACf;YACE,MAAM,CAAC,OAAO;YACd,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,OAAO;YACd,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,OAAO;YACd,MAAM,CAAC,OAAO;YACd,MAAM,CAAC,SAAS;YAChB,MAAM,CAAC,UAAU;SAClB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;QACxD,OAAO,MAAM,CAAC,EAAE,KAAK,SAAS;QAC9B,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS;QACvC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CACzF,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAC5D;QACD,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,SAAS,GAAG,wBAAwB,EAAE;IACnF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACrG,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,sCAAsC,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAA;IACrG,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAS,GAAG,wBAAwB,EAAE;IACxE,IAAI,KAAe,CAAA;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QACjE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,KAAK;SACT,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;QAClE,IAAI,CAAC;YACH,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,SAAS,GAAG,wBAAwB,EAAE;IAC/F,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAA;IACrE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAyB;IAC7D,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,yEAAyE,CAAA;IACrG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1C,OAAO,IAAI,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACpE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,OAAO;QACL,wEAAwE;QACxE,GAAG,OAAO,CAAC,GAAG,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,GAAG,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CACzS;QACD,gCAAgC;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC"}

package/dist/runtime/sandbox.d.ts

@@ -0,0 +1,21 @@
+import { type Harness } from "./harness.js";
+export interface SandboxOptions {
+    project: string;
+    resume?: string | boolean;
+    harness?: Harness;
+    scope?: string;
+    branch?: string;
+    name?: string;
+    attach?: string;
+    hostname?: string;
+    region?: string;
+    command?: string;
+    installCommand?: string;
+    shell?: boolean;
+    headless?: boolean;
+    timeout?: string;
+    fx?: boolean;
+}
+export declare function sandboxWorkdir(rootDirectory?: string | null, repositoryRoot?: string): string;
+export declare function launchSandbox(options: SandboxOptions): Promise<void>;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/runtime/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/runtime/sandbox.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,OAAO,EAAmC,MAAM,cAAc,CAAA;AAU5E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AA+DD,wBAAgB,cAAc,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,cAAc,SAAoB,GAAG,MAAM,CAKxG;AAcD,wBAAsB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqZ1E"}

package/dist/runtime/sandbox.js

@@ -0,0 +1,481 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, posix, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseEnv } from "node:util";
+import { Sandbox } from "@vercel/sandbox";
+import { CDPMonitor } from "../cdp-monitor.js";
+import { isPortlessHostnameHeld, preparePortlessRuntime, registerPortlessAlias, removePortlessAlias } from "../portless.js";
+import { connectCompanion } from "./bridge.js";
+import { portlessCertificatePin, sandboxChromePath } from "./chrome-isolation.js";
+import { harnessInvocation, harnessSkill } from "./harness.js";
+import { startLocalProxy } from "./local-proxy.js";
+import { prepareSandboxFx, SANDBOX_AGENT_BIN, SANDBOX_AGENT_DIRECTORY, SANDBOX_TOOLS } from "./sandbox-agent.js";
+import { listSandboxSessions, readSandboxSession, saveSandboxSession } from "./sandbox-sessions.js";
+const REMOTE_TOOLS = SANDBOX_TOOLS;
+const REMOTE_ENTRY = `${REMOTE_TOOLS}/node_modules/dev3000/dist/runtime/cli.js`;
+const APP_PORT = 3000;
+const BRIDGE_PORT = 9223;
+/** No shell interpolation. Bounded captured output also keeps credential-bearing CLI output out of logs. */
+async function run(binary, args, options = {}) {
+    return new Promise((resolveRun, reject) => {
+        if (options.signal?.aborted) {
+            reject(new Error("Session ended"));
+            return;
+        }
+        const child = spawn(binary, args, {
+            cwd: options.cwd,
+            env: options.env,
+            stdio: options.inherit ? "inherit" : [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"]
+        });
+        let killTimer;
+        const abort = () => {
+            child.kill("SIGTERM");
+            killTimer = setTimeout(() => child.kill("SIGKILL"), 1000);
+            killTimer.unref();
+        };
+        options.signal?.addEventListener("abort", abort, { once: true });
+        const cleanup = () => {
+            options.signal?.removeEventListener("abort", abort);
+            if (killTimer)
+                clearTimeout(killTimer);
+        };
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString();
+            if (stdout.length > 4 * 1024 * 1024)
+                child.kill();
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = (stderr + chunk.toString()).slice(-8192);
+        });
+        child.on("error", (error) => {
+            cleanup();
+            reject(error);
+        });
+        child.stdin?.on("error", () => { }); // Early CLI exits still report their bounded stderr below.
+        if (options.input !== undefined)
+            child.stdin?.end(options.input);
+        child.on("exit", (code) => {
+            cleanup();
+            if (options.signal?.aborted)
+                resolveRun(stdout);
+            else if (code === 0)
+                resolveRun(stdout);
+            else
+                reject(new Error(`${binary} ${args[0]} failed: ${stderr || `exit ${code}`}`));
+        });
+    });
+}
+export function sandboxWorkdir(rootDirectory, repositoryRoot = "/vercel/sandbox") {
+    const root = posix.resolve(repositoryRoot, rootDirectory || ".");
+    if (root !== repositoryRoot && !root.startsWith(`${repositoryRoot}/`))
+        throw new Error("Project rootDirectory escapes the repository");
+    return root;
+}
+async function freePort() {
+    const server = createServer();
+    await new Promise((resolvePort, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", resolvePort);
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("No Chrome port available");
+    await new Promise((resolveClose) => server.close(() => resolveClose()));
+    return address.port;
+}
+export async function launchSandbox(options) {
+    const isolatedBrowserPath = sandboxChromePath();
+    const scope = options.scope ? ["--scope", options.scope] : [];
+    const log = (message) => console.error(`[d3k sandbox] ${message}`);
+    const temporary = mkdtempSync(join(tmpdir(), "d3k-sandbox-"));
+    let localProxy;
+    let localRoute;
+    let aliasRegistered = false;
+    let sandbox;
+    let browser;
+    let companion;
+    let savedSession;
+    let remoteStarted = false;
+    let originalPorts;
+    let closing = false;
+    let signalReceived = false;
+    let remoteWorkdir = "/vercel/sandbox";
+    let finish = () => { };
+    const shellAbort = new AbortController();
+    const ended = new Promise((resolveEnd) => {
+        finish = () => {
+            browser?.prepareShutdown();
+            companion?.close();
+            shellAbort.abort();
+            resolveEnd();
+        };
+    });
+    const onSignal = () => {
+        signalReceived = true;
+        finish();
+    };
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+    try {
+        const routing = preparePortlessRuntime(`${options.hostname || options.project.toLowerCase().replace(/[^a-z0-9-]/g, "-")}.d3k`);
+        if (!routing.runtime)
+            throw new Error(routing.error || "Canonical Portless is required");
+        localRoute = routing.runtime;
+        if (isPortlessHostnameHeld(localRoute.name))
+            throw new Error(`${localRoute.url} is already in use; stop that session or choose another --hostname`);
+        log(`Resolving ${options.project} through Vercel CLI`);
+        const project = JSON.parse(await run("vercel", ["api", `/v9/projects/${encodeURIComponent(options.project)}`, ...scope, "--raw"], {
+            cwd: temporary
+        }));
+        if (!project.id || !project.accountId || !project.name)
+            throw new Error("Vercel returned an invalid project");
+        sandboxWorkdir(project.rootDirectory);
+        const { token } = JSON.parse(await run("vercel", ["project", "token", project.id, "--scope", project.accountId, "--format", "json"], {
+            cwd: temporary
+        }));
+        if (!token)
+            throw new Error("Vercel CLI did not return a project OIDC token; update the CLI and run vercel login");
+        const credentials = { token, projectId: project.id, teamId: project.accountId };
+        if (signalReceived)
+            return;
+        if (options.attach) {
+            // Read configured routes before resuming: resume responses may also contain reserved system ports.
+            // The first command below resumes compute automatically after user ports have been configured.
+            sandbox = await Sandbox.get({ ...credentials, name: options.attach });
+            await sandbox.update({ timeout: Number(options.timeout || 30) * 60000 });
+            const ports = sandbox.routes.map((route) => route.port);
+            if (!ports.includes(APP_PORT) || !ports.includes(BRIDGE_PORT)) {
+                originalPorts = ports;
+                await sandbox.update({ ports: [...new Set([...ports, APP_PORT, BRIDGE_PORT])] });
+            }
+        }
+        else {
+            if (project.link?.type !== "github" || !project.link.org || !project.link.repo)
+                throw new Error("This project needs a linked GitHub repository");
+            log("Creating a sandbox and cloning the linked public repository remotely");
+            sandbox = await Sandbox.create({
+                ...credentials,
+                ...(options.name ? { name: options.name } : {}),
+                ...(options.region ? { region: options.region } : {}),
+                timeout: Number(options.timeout || 30) * 60000,
+                ports: [APP_PORT, BRIDGE_PORT],
+                source: {
+                    type: "git",
+                    url: `https://github.com/${project.link.org}/${project.link.repo}.git`,
+                    ...(options.branch ? { revision: options.branch } : {})
+                }
+            }).catch((error) => {
+                throw new Error(`${error instanceof Error ? error.message : "Could not create the source sandbox"}. Automatic cloning currently requires a public GitHub repository. For a private repository, use --attach <name> with an existing sandbox that already contains the checkout.`, { cause: error });
+            });
+        }
+        log(`Sandbox ${sandbox.name} is running`);
+        // Image WORKDIR and source checkout location differ between Sandbox images.
+        let repositoryRoot;
+        const candidates = [sandbox.cwd, ...(project.link ? [posix.join(sandbox.cwd, project.link.repo)] : [])];
+        for (const cwd of candidates) {
+            const result = await sandbox
+                .runCommand({ cmd: "git", args: ["rev-parse", "--show-toplevel"], cwd })
+                .catch(() => null);
+            if (result?.exitCode === 0) {
+                repositoryRoot = (await result.stdout()).trim();
+                break;
+            }
+        }
+        if (!repositoryRoot)
+            throw new Error("Could not locate the repository in this sandbox; expected its working directory or a directory named after the linked repository");
+        const workdir = sandboxWorkdir(project.rootDirectory, repositoryRoot);
+        remoteWorkdir = workdir;
+        if (signalReceived)
+            return;
+        // Install this exact d3k distribution, including unreleased local changes. No project checkout is used locally.
+        const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+        if (!existsSync(join(packageRoot, "dist/runtime/cli.js")))
+            throw new Error("Build d3k before starting a sandbox from a source checkout");
+        const archive = join(temporary, "dev3000.tgz");
+        await run("bun", ["pm", "pack", "--filename", archive, "--quiet"], { cwd: packageRoot });
+        const mkdirResult = await sandbox.runCommand("mkdir", ["-p", REMOTE_TOOLS]);
+        if (mkdirResult.exitCode !== 0)
+            throw new Error("Could not prepare remote d3k tools directory");
+        await sandbox.writeFiles([{ path: `${REMOTE_TOOLS}/dev3000.tgz`, content: readFileSync(archive) }]);
+        log("Installing d3k in the sandbox");
+        const installTools = await sandbox.runCommand({
+            cmd: "bun",
+            args: ["add", "--cwd", REMOTE_TOOLS, `${REMOTE_TOOLS}/dev3000.tgz`],
+            timeoutMs: 180000
+        });
+        if (installTools.exitCode !== 0)
+            throw new Error(`Remote d3k install failed: ${(await installTools.stderr()).slice(-4000)}`);
+        const existing = await sandbox.runCommand({ cmd: "node", args: [REMOTE_ENTRY, "status"], cwd: workdir });
+        if (existing.exitCode === 0 && JSON.parse(await existing.stdout()).running) {
+            if (typeof options.resume !== "string")
+                throw new Error("A runtime is already active in this sandbox; stop it before pairing a different browser");
+            log("Stopping the previous remote runtime before creating a fresh browser connection");
+            const stopped = await sandbox.runCommand({
+                cmd: "node",
+                args: [REMOTE_ENTRY, "stop"],
+                cwd: workdir,
+                timeoutMs: 10000
+            });
+            if (stopped.exitCode !== 0)
+                throw new Error("Could not stop the previous remote runtime");
+            const stopDeadline = Date.now() + 15000;
+            let stoppedRuntime = false;
+            while (Date.now() < stopDeadline) {
+                const status = await sandbox.runCommand({ cmd: "node", args: [REMOTE_ENTRY, "status"], cwd: workdir });
+                if (status.exitCode === 0 && !JSON.parse(await status.stdout()).running) {
+                    stoppedRuntime = true;
+                    break;
+                }
+                await new Promise((resolveWait) => setTimeout(resolveWait, 300));
+            }
+            if (!stoppedRuntime)
+                throw new Error("Previous remote runtime did not finish stopping");
+        }
+        const previous = typeof options.resume === "string"
+            ? readSandboxSession(options.resume)
+            : listSandboxSessions().find((record) => record.project === project.id && record.team === project.accountId && record.sandbox === sandbox?.name);
+        const branchResult = await sandbox.runCommand({ cmd: "git", args: ["branch", "--show-current"], cwd: workdir });
+        const now = new Date().toISOString();
+        savedSession = {
+            version: 1,
+            id: previous?.id || randomUUID(),
+            project: project.id,
+            projectName: project.name,
+            team: project.accountId,
+            scope: previous?.scope || options.scope,
+            sandbox: sandbox.name,
+            hostname: localRoute.name.replace(/\.d3k$/, ""),
+            appUrl: localRoute.url,
+            workdir,
+            branch: branchResult.exitCode === 0 ? (await branchResult.stdout()).trim() || undefined : undefined,
+            command: options.command || project.devCommand || undefined,
+            installCommand: options.installCommand,
+            timeout: options.timeout || "30",
+            fx: options.fx !== false,
+            harness: options.harness,
+            ownsSandbox: previous?.ownsSandbox ?? !options.attach,
+            createdAt: previous?.createdAt || now,
+            lastUsedAt: now,
+            launcherPid: process.pid
+        };
+        saveSandboxSession(savedSession);
+        log("Loading Development environment through Vercel CLI");
+        const envPath = join(temporary, "development.env");
+        await run("vercel", [
+            "env",
+            "pull",
+            envPath,
+            "--project",
+            project.id,
+            "--scope",
+            project.accountId,
+            "--environment",
+            "development",
+            "--yes"
+        ], { cwd: temporary });
+        const development = readFileSync(envPath, "utf8");
+        rmSync(envPath);
+        const appEnv = Object.fromEntries(Object.entries(parseEnv(development)).filter((entry) => typeof entry[1] === "string"));
+        // A development OIDC token manages infrastructure; it does not belong in app/agent environment.
+        delete appEnv.VERCEL_OIDC_TOKEN;
+        delete appEnv.VERCEL_TOKEN;
+        delete appEnv.VERCEL_AUTH_TOKEN;
+        // Remove credentials from pre-hardening sessions before any repository code runs.
+        const legacyCleanup = await sandbox.runCommand({
+            cmd: "rm",
+            args: ["-f", `${SANDBOX_AGENT_DIRECTORY}/gateway.json`, `${SANDBOX_AGENT_BIN}/fx`]
+        });
+        if (legacyCleanup.exitCode !== 0)
+            throw new Error("Could not remove legacy sandbox harness credentials");
+        const setup = options.installCommand || project.installCommand || "bun install";
+        log(`Installing project dependencies: ${setup}`);
+        const installed = await sandbox.runCommand({
+            cmd: "sh",
+            args: ["-c", setup],
+            cwd: workdir,
+            env: appEnv,
+            timeoutMs: 300000
+        });
+        if (installed.exitCode !== 0)
+            throw new Error(`Project dependency installation failed: ${(await installed.stderr()).slice(-4000)}`);
+        if (signalReceived)
+            return;
+        if (options.fx !== false && options.shell !== false) {
+            log("Preparing fx; authenticate the harness in the sandbox before use");
+            await prepareSandboxFx(sandbox);
+        }
+        if (signalReceived)
+            return;
+        const upstreamUrl = sandbox.domain(APP_PORT);
+        const appUrl = localRoute.url;
+        const proxyToken = randomBytes(32).toString("hex");
+        localProxy = await startLocalProxy({ appUrl, upstreamUrl, token: proxyToken });
+        registerPortlessAlias(localRoute, localProxy.port);
+        aliasRegistered = true;
+        const bridgeUrl = `${sandbox.domain(BRIDGE_PORT).replace(/^https:/, "wss:")}/bridge`;
+        const pairingToken = randomBytes(32).toString("hex");
+        const config = { appUrl, serverPort: APP_PORT, bridgePort: BRIDGE_PORT, token: pairingToken, proxyToken };
+        const args = [REMOTE_ENTRY, "sandbox-serve", "--startup-timeout", "300000"];
+        const command = options.command || project.devCommand;
+        if (command)
+            args.push("--command", command);
+        log("Starting the remote dev server and browser bridge");
+        const remote = await sandbox.runCommand({
+            cmd: "node",
+            args,
+            cwd: workdir,
+            env: appEnv,
+            stdin: true,
+            detached: true
+        });
+        let remoteExit;
+        void remote
+            .wait()
+            .then((result) => {
+            remoteExit = result.exitCode;
+            finish();
+        })
+            .catch(() => {
+            remoteExit = -1;
+            finish();
+        });
+        await remote.writeStdin(JSON.stringify(config));
+        await remote.closeStdin();
+        remoteStarted = true;
+        // The profile key uses remote project identity, never the caller's local cwd.
+        const key = createHash("sha256").update(`${project.accountId}/${project.id}`).digest("hex").slice(0, 20);
+        const directory = join(homedir(), ".d3k", "sandboxes", key);
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        await writeFile(join(directory, "session.json"), JSON.stringify({ project: project.id, team: project.accountId, name: sandbox.name, appUrl }), { mode: 0o600 });
+        const chromePort = await freePort();
+        browser = new CDPMonitor(join(directory, "chrome-profile"), (_source, message) => {
+            if (message.startsWith("[CDP]"))
+                log(message);
+        }, false, isolatedBrowserPath, undefined, undefined, 60000, chromePort, options.headless);
+        browser.requireFilesystemIsolation(await portlessCertificatePin(appUrl));
+        browser.setOnWindowClosedCallback(onSignal);
+        await browser.start();
+        companion = connectCompanion({
+            url: bridgeUrl,
+            token: pairingToken,
+            chromePort,
+            onState: (connected) => {
+                if (!closing && !signalReceived)
+                    log(connected ? "Local Chrome connected" : "Browser disconnected; reconnecting");
+            }
+        });
+        const deadline = Date.now() + 300000;
+        let ready = false;
+        while (!signalReceived && Date.now() < deadline) {
+            const status = await sandbox.runCommand({ cmd: "node", args: [REMOTE_ENTRY, "status"], cwd: workdir });
+            if (status.exitCode === 0) {
+                const state = JSON.parse(await status.stdout());
+                if (state.ready && state.browserConnected) {
+                    ready = true;
+                    break;
+                }
+            }
+            if (remoteExit !== undefined) {
+                throw new Error(`Remote runtime exited during startup: ${(await remote.stderr()).slice(-4000)}`);
+            }
+            await new Promise((resolveWait) => setTimeout(resolveWait, 1500));
+        }
+        if (signalReceived)
+            return;
+        if (!ready)
+            throw new Error("Sandbox runtime did not become ready within five minutes");
+        log(`Ready: ${appUrl}`);
+        log(`Sandbox: ${sandbox.name}. Shell directory: ${workdir}`);
+        if (options.shell !== false && process.stdin.isTTY) {
+            const path = await sandbox.runCommand({ cmd: "printenv", args: ["PATH"] });
+            if (path.exitCode !== 0)
+                throw new Error("Could not resolve remote shell PATH");
+            const contextDirectory = `${REMOTE_TOOLS}/harness-context`;
+            const skillPath = `${contextDirectory}/.fx/skills/d3k/SKILL.md`;
+            if (options.harness) {
+                const prepared = await sandbox.runCommand({ cmd: "mkdir", args: ["-p", `${contextDirectory}/.fx/skills/d3k`] });
+                if (prepared.exitCode !== 0)
+                    throw new Error("Could not prepare harness skill context");
+                await sandbox.writeFiles([{ path: skillPath, content: Buffer.from(harnessSkill()) }]);
+            }
+            const invocation = options.harness ? harnessInvocation(options.harness, skillPath, contextDirectory) : undefined;
+            await run("vercel", [
+                "sandbox",
+                invocation ? "exec" : "connect",
+                sandbox.name,
+                "--project",
+                project.id,
+                "--scope",
+                project.accountId,
+                "--workdir",
+                workdir,
+                "--env",
+                `PATH=${options.fx !== false ? `${SANDBOX_AGENT_BIN}:` : ""}${REMOTE_TOOLS}/node_modules/.bin:${(await path.stdout()).trim()}`,
+                ...(invocation ? ["--interactive", "--", invocation.binary, ...invocation.args] : [])
+            ], { inherit: true, env: { ...process.env, VERCEL_OIDC_TOKEN: token }, signal: shellAbort.signal });
+        }
+        else {
+            log(options.attach
+                ? "Companion retained. Press Ctrl+C to stop this runtime; the attached sandbox stays running."
+                : "Companion retained. Press Ctrl+C to stop compute and preserve the sandbox filesystem.");
+            await ended;
+            if (!signalReceived && remoteExit !== undefined && remoteExit !== 0)
+                throw new Error(`Remote runtime exited (${remoteExit}): ${(await remote.stderr()).slice(-4000)}`);
+        }
+    }
+    finally {
+        if (!closing) {
+            closing = true;
+            companion?.close();
+            if (aliasRegistered && localRoute) {
+                try {
+                    removePortlessAlias(localRoute);
+                }
+                catch {
+                    log("Could not remove the local proxy route");
+                }
+            }
+            await localProxy?.close();
+            await browser?.shutdown().catch(() => { });
+            if (sandbox) {
+                if (options.harness)
+                    await sandbox.runCommand({ cmd: "rm", args: ["-rf", `${REMOTE_TOOLS}/harness-context`] }).catch(() => { });
+                if (remoteStarted)
+                    await sandbox
+                        .runCommand({ cmd: "node", args: [REMOTE_ENTRY, "stop"], cwd: remoteWorkdir, timeoutMs: 10000 })
+                        .catch(() => { });
+                // An attached sandbox belongs to its existing owner. Only stop sandboxes created by this invocation.
+                if (!options.attach || (typeof options.resume === "string" && savedSession?.ownsSandbox))
+                    await sandbox
+                        .stop()
+                        .catch(() => log(`Could not stop sandbox ${sandbox?.name}; stop it with vercel sandbox stop`));
+                else if (originalPorts)
+                    await sandbox.update({ ports: originalPorts }).catch(() => log("Could not restore attached sandbox ports"));
+            }
+        }
+        process.off("SIGINT", onSignal);
+        process.off("SIGTERM", onSignal);
+        rmSync(temporary, { recursive: true, force: true });
+        if (savedSession) {
+            savedSession.closedAt = new Date().toISOString();
+            delete savedSession.launcherPid;
+            try {
+                saveSandboxSession(savedSession);
+            }
+            catch {
+                log("Could not update saved session metadata");
+            }
+            console.log(`Resume this sandbox: d3k --resume ${savedSession.id}`);
+        }
+        if (remoteStarted)
+            log("Session closed");
+    }
+}
+//# sourceMappingURL=sandbox.js.map