eve 0.19.0 → 0.21.0

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{markDevelopmentSandboxBackendInitialized}from"#execution/sandbox/development-run.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(c={}){let l=c.dockerCli??createDockerCli(),u=resolveDockerSandboxOptions(c.createOptions),d=createDockerSandboxOptionsHash(u),f;function ensureDaemon(){return f??=assertDockerDaemonAvailable(l).catch(e=>{throw f=void 0,e}),f}return{name:DOCKER_BACKEND_NAME,async prewarm(n){n.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:d,templateKey:n.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(n.runtimeContext.appRoot,i);if(n.log?.(`checking cached template image "${a}"`),await dockerImageExists(l,a))return n.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};n.log?.(`checking base image "${u.image}"`),await ensureDockerBaseImage(l,u);let s=`${n.templateKey}-build-${randomUUID().slice(0,8)}`;n.log?.(`starting template build container`),await startDockerContainer({cli:l,containerName:s,image:u.image,initialNetworkPolicy:`allow-all`,options:u,role:`template-build`});try{n.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(l,s),u.networkPolicy!==`allow-all`&&(n.log?.(`applying network policy`),await setDockerNetworkPolicy(l,s,u.networkPolicy));let e=buildSandboxSession(createDockerInternalSession({cli:l,containerName:s,id:n.templateKey}),e=>setDockerNetworkPolicy(l,s,e));n.bootstrap!==void 0&&(n.log?.(`running sandbox bootstrap`),await n.bootstrap({use:async()=>createLoggingSandboxSession({log:n.log,session:e})})),n.seedFiles.length>0&&n.log?.(`writing ${n.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(e,n.seedFiles),n.log?.(`stopping template build container`),expectDockerSuccess(await l.run([`stop`,`-t`,`0`,s]),`stop template build container "${s}"`),n.log?.(`committing template image "${a}"`),expectDockerSuccess(await l.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${n.templateKey}`,s,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await l.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon(),markDevelopmentSandboxBackendInitialized(DOCKER_BACKEND_NAME);let r=getDockerContainerName(e.existingMetadata)??e.sessionKey,i=await l.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,r]);if(i.exitCode===0)i.stdout.trim()!==`true`&&expectDockerSuccess(await l.run([`start`,r]),`restart sandbox session container "${r}"`);else{let t;if(e.templateKey===null)await ensureDockerBaseImage(l,u),t=u.image;else{let n={optionsHash:d,templateKey:e.templateKey};if(t=dockerTemplateImageReference(n),!await dockerImageExists(l,t))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),t)}try{await startDockerContainer({cli:l,containerName:r,image:t,initialNetworkPolicy:e.templateKey===null?`allow-all`:u.networkPolicy,options:u,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(l,r),u.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(l,r,u.networkPolicy))}let a=buildSandboxSession(createDockerInternalSession({cli:l,containerName:r,id:e.sessionKey}),e=>setDockerNetworkPolicy(l,r,e));return{session:a,useSessionFn:async()=>a,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:r},sessionKey:e.sessionKey}},async dispose(){}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{markDevelopmentSandboxBackendInitialized}from"#execution/sandbox/development-run.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(c={}){let l=c.dockerCli??createDockerCli(),u=resolveDockerSandboxOptions(c.createOptions),d=createDockerSandboxOptionsHash(u),f;function ensureDaemon(){return f??=assertDockerDaemonAvailable(l).catch(e=>{throw f=void 0,e}),f}return{name:DOCKER_BACKEND_NAME,async prewarm(n){n.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:d,templateKey:n.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(n.runtimeContext.appRoot,i);if(n.log?.(`checking cached template image "${a}"`),await dockerImageExists(l,a))return n.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};n.log?.(`checking base image "${u.image}"`),await ensureDockerBaseImage(l,u);let s=`${n.templateKey}-build-${randomUUID().slice(0,8)}`;n.log?.(`starting template build container`),await startDockerContainer({cli:l,containerName:s,image:u.image,initialNetworkPolicy:`allow-all`,options:u,role:`template-build`});try{n.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(l,s),u.networkPolicy!==`allow-all`&&(n.log?.(`applying network policy`),await setDockerNetworkPolicy(l,s,u.networkPolicy));let e=buildSandboxSession(createDockerInternalSession({cli:l,containerName:s,id:n.templateKey}),e=>setDockerNetworkPolicy(l,s,e));n.bootstrap!==void 0&&(n.log?.(`running sandbox bootstrap`),await n.bootstrap({use:async()=>createLoggingSandboxSession({log:n.log,session:e})})),n.seedFiles.length>0&&n.log?.(`writing ${n.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(e,n.seedFiles),n.log?.(`stopping template build container`),expectDockerSuccess(await l.run([`stop`,`-t`,`0`,s]),`stop template build container "${s}"`),n.log?.(`committing template image "${a}"`),expectDockerSuccess(await l.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${n.templateKey}`,s,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await l.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon(),markDevelopmentSandboxBackendInitialized(DOCKER_BACKEND_NAME);let r=getDockerContainerName(e.existingMetadata)??e.sessionKey,i=await l.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,r]);if(i.exitCode===0)i.stdout.trim()!==`true`&&expectDockerSuccess(await l.run([`start`,r]),`restart sandbox session container "${r}"`);else{let t;if(e.templateKey===null)await ensureDockerBaseImage(l,u),t=u.image;else{let n={optionsHash:d,templateKey:e.templateKey};if(t=dockerTemplateImageReference(n),!await dockerImageExists(l,t))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),t)}try{await startDockerContainer({cli:l,containerName:r,image:t,initialNetworkPolicy:e.templateKey===null?`allow-all`:u.networkPolicy,options:u,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(l,r),u.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(l,r,u.networkPolicy))}let a=buildSandboxSession(createDockerInternalSession({cli:l,containerName:r,id:e.sessionKey}),e=>setDockerNetworkPolicy(l,r,e));return{session:a,useSessionFn:async()=>a,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:r},sessionKey:e.sessionKey}},async shutdown(){await stopDockerContainerIfRunning(l,r)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.js

@@ -1 +1 @@
-import{dirname}from"node:path";import{mkdir,readFile,writeFile}from"node:fs/promises";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(n){let{ReadWriteFs:r,Sandbox:i}=await loadJustBashModule({appRoot:n.appRoot,autoInstall:n.autoInstall}),a=resolveLocalSandboxFilesystemRootPath(n.rootPath),o=resolveLocalSandboxMetadataPath(n.rootPath),s=await readLocalMetadata(o);await mkdir(a,{recursive:!0});let c=new r({allowSymlinks:!0,maxFileReadSize:2**53-1,root:a});await ensureLocalSandboxDirectories(c);let l=await i.create({cwd:WORKSPACE_ROOT,env:s?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(o,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:n.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:n.rootPath,sessionKey:n.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`;return adaptMultiplexedCommandToSandboxProcess({command:await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal}),getOutput:e=>e.type})},async writeFiles(t){for(let n of t){let t=dirname(n.path);await c.mkdir(t,{recursive:!0}),await c.writeFile(n.path,n.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async dispose(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(n,i){await mkdir(dirname(n),{recursive:!0}),await writeFile(n,`${JSON.stringify(i,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};
+import{dirname}from"node:path";import{mkdir,readFile,writeFile}from"node:fs/promises";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(n){let{ReadWriteFs:r,Sandbox:i}=await loadJustBashModule({appRoot:n.appRoot,autoInstall:n.autoInstall}),a=resolveLocalSandboxFilesystemRootPath(n.rootPath),o=resolveLocalSandboxMetadataPath(n.rootPath),s=await readLocalMetadata(o);await mkdir(a,{recursive:!0});let c=new r({allowSymlinks:!0,maxFileReadSize:2**53-1,root:a});await ensureLocalSandboxDirectories(c);let l=await i.create({cwd:WORKSPACE_ROOT,env:s?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(o,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:n.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:n.rootPath,sessionKey:n.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`;return adaptMultiplexedCommandToSandboxProcess({command:await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal}),getOutput:e=>e.type})},async writeFiles(t){for(let n of t){let t=dirname(n.path);await c.mkdir(t,{recursive:!0}),await c.writeFile(n.path,n.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(n,i){await mkdir(dirname(n),{recursive:!0}),await writeFile(n,`${JSON.stringify(i,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};

package/dist/src/execution/sandbox/bindings/local-backend-utils.d.ts

@@ -20,4 +20,4 @@ export declare function touchDirectory(path: string): Promise<void>;
 export declare function resolveLocalBackendTemplateRootPath(cacheDirectory: string, backendCacheName: string, templateKey: string): string;
 export declare function resolveLocalBackendTemplatesDirectory(cacheDirectory: string, backendCacheName: string): string;
 export declare function resolveLocalBackendSessionRootPath(cacheDirectory: string, backendCacheName: string, sessionKey: string): string;
-export declare function writeSandboxSeedFiles(session: Pick<SandboxSession, "writeBinaryFile" | "writeTextFile">, seedFiles: ReadonlyArray<SandboxSeedFile>): Promise<void>;
+export declare function writeSandboxSeedFiles(session: SandboxSession, seedFiles: ReadonlyArray<SandboxSeedFile>): Promise<void>;

package/dist/src/execution/sandbox/bindings/local-backend-utils.js

@@ -1 +1 @@
-import{dirname,join}from"node:path";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{randomUUID}from"node:crypto";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";function createFileBackedInternalSandboxSession(e){return{id:e.id,resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(t,n){let i=`${n}.${randomUUID()}.tmp`;await rm(i,{force:!0,recursive:!0}),await mkdir(dirname(n),{recursive:!0});try{await cp(t,i,{recursive:!0}),await rename(i,n)}catch(e){if(await rm(i,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(n))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalBackendTemplateRootPath(e,n,r){return join(resolveLocalBackendTemplatesDirectory(e,n),r)}function resolveLocalBackendTemplatesDirectory(e,n){return join(e,n,`templates`)}function resolveLocalBackendSessionRootPath(e,n,r){return join(e,n,`sessions`,r)}async function writeSandboxSeedFiles(e,t){for(let n of t)typeof n.content==`string`?await e.writeTextFile({content:n.content,path:n.path}):await e.writeBinaryFile({content:n.content,path:n.path})}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalBackendSessionRootPath,resolveLocalBackendTemplateRootPath,resolveLocalBackendTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};
+import{dirname,join}from"node:path";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{randomUUID}from"node:crypto";import{resolveSandboxSeedFilePath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";function createFileBackedInternalSandboxSession(e){return{id:e.id,resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(t,n){let i=`${n}.${randomUUID()}.tmp`;await rm(i,{force:!0,recursive:!0}),await mkdir(dirname(n),{recursive:!0});try{await cp(t,i,{recursive:!0}),await rename(i,n)}catch(e){if(await rm(i,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(n))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalBackendTemplateRootPath(e,n,r){return join(resolveLocalBackendTemplatesDirectory(e,n),r)}function resolveLocalBackendTemplatesDirectory(e,n){return join(e,n,`templates`)}function resolveLocalBackendSessionRootPath(e,n,r){return join(e,n,`sessions`,r)}async function writeSandboxSeedFiles(e,t){for(let n of t){let t=await resolveSandboxSeedFilePath({path:n.path,sandbox:e});typeof n.content==`string`?await e.writeTextFile({content:n.content,path:t}):await e.writeBinaryFile({content:n.content,path:t})}}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalBackendSessionRootPath,resolveLocalBackendTemplateRootPath,resolveLocalBackendTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +1 @@
-import{dirname}from"node:path";import{mkdir,rename,rm}from"node:fs/promises";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{randomUUID}from"node:crypto";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(i){i.prewarmInput.log?.(`loading microsandbox runtime`);let a=await loadMicrosandboxModule({appRoot:i.prewarmInput.runtimeContext.appRoot,log:i.prewarmInput.log,options:i.options}),u=resolveMicrosandboxTemplateRootPath(resolveSandboxCacheDirectory(i.prewarmInput.runtimeContext.appRoot),i.prewarmInput.templateKey),f=resolveMicrosandboxMetadataPath(u);i.prewarmInput.log?.(`checking cached snapshot`);let p=await readTemplateMetadata(f);if(p?.optionsHash===i.optionsHash&&await snapshotExists(a,p.snapshotName))return i.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(u),{reused:!0};let h=createProviderName(`eve-sbx-tpl`,i.prewarmInput.templateKey,i.optionsHash),_=`${u}.${randomUUID()}.tmp`,v=createProviderName(`eve-sbx-tpl-tmp`,`${i.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(a,h),await rm(_,{force:!0,recursive:!0}),await mkdir(_,{recursive:!0}),i.prewarmInput.log?.(`creating template VM from image "${i.options.image}"`);let y=await createPreparedMicrosandbox({log:i.prewarmInput.log,module:a,name:v,networkPolicy:i.options.networkPolicy,options:i.options,sessionKey:i.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),b=buildSandboxSession(createMicrosandboxInternalSession(y),async e=>{await y.setNetworkPolicy(e)});try{i.prewarmInput.bootstrap!==void 0&&(i.prewarmInput.log?.(`running sandbox bootstrap`),await i.prewarmInput.bootstrap({use:async e=>(e?.networkPolicy!==void 0&&await y.setNetworkPolicy(e.networkPolicy),createLoggingSandboxSession({log:i.prewarmInput.log,session:b}))})),i.prewarmInput.seedFiles.length>0&&i.prewarmInput.log?.(`writing ${i.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(b,i.prewarmInput.seedFiles),i.prewarmInput.log?.(`snapshotting template VM`),await y.stopAndSnapshot(h),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(_),{optionsHash:i.optionsHash,snapshotName:h,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(u),{recursive:!0}),await rm(u,{force:!0,recursive:!0});try{await rename(_,u)}catch(e){if(await doesPathExist(u))return{reused:!0};throw e}}finally{await y.removePersisted(),await rm(_,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(e){let t=await loadMicrosandboxModule({appRoot:e.createInput.runtimeContext.appRoot,options:e.options}),n=resolveSandboxCacheDirectory(e.createInput.runtimeContext.appRoot),r=resolveMicrosandboxSessionRootPath(n,e.createInput.sessionKey),a=createActiveMicrosandboxSessionKey(r,e.optionsHash),o=activeMicrosandboxSessionHandles.get(a);if(o!==void 0)return o;let s=resolveMicrosandboxMetadataPath(r),c=readSessionMetadataRecord(e.createInput.existingMetadata)??await readSessionMetadata(s),l=withDevelopmentSandboxMetadataPathTag(e.createInput.tags,s);if(c?.optionsHash===e.optionsHash&&(await sandboxExists(t,c.sandboxName)||c.stateSnapshotName!==void 0&&await snapshotExists(t,c.stateSnapshotName))){let n=await connectMicrosandbox({metadata:c,metadataPath:s,module:t,options:e.options,sessionKey:e.createInput.sessionKey,tags:l});if(n!==null)return cacheHandle(a,createHandle(n,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(a)}))}let d=null;if(e.createInput.templateKey!==null){let r=await readTemplateMetadata(resolveMicrosandboxMetadataPath(resolveMicrosandboxTemplateRootPath(n,e.createInput.templateKey)));if(r===null||r.optionsHash!==e.optionsHash||!await snapshotExists(t,r.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey});d=r.snapshotName}let m=createProviderName(`eve-sbx-ses`,`${e.createInput.sessionKey}:${randomUUID()}`),g;try{g=await createPreparedMicrosandbox({fromSnapshot:d??void 0,module:t,name:m,networkPolicy:e.options.networkPolicy,options:e.options,sessionKey:e.createInput.sessionKey,setupBaseRuntime:d===null,tags:l})}catch(t){throw d!==null&&e.createInput.templateKey!==null&&isMicrosandboxNotFoundError(t)?new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey}):t}return await g.writeMetadata(s,e.optionsHash),cacheHandle(a,createHandle(g,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(a)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async dispose(){r?.(),await e.detach()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};
+import{dirname}from"node:path";import{mkdir,rename,rm}from"node:fs/promises";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{randomUUID}from"node:crypto";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(i){i.prewarmInput.log?.(`loading microsandbox runtime`);let a=await loadMicrosandboxModule({appRoot:i.prewarmInput.runtimeContext.appRoot,log:i.prewarmInput.log,options:i.options}),u=resolveMicrosandboxTemplateRootPath(resolveSandboxCacheDirectory(i.prewarmInput.runtimeContext.appRoot),i.prewarmInput.templateKey),f=resolveMicrosandboxMetadataPath(u);i.prewarmInput.log?.(`checking cached snapshot`);let p=await readTemplateMetadata(f);if(p?.optionsHash===i.optionsHash&&await snapshotExists(a,p.snapshotName))return i.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(u),{reused:!0};let h=createProviderName(`eve-sbx-tpl`,i.prewarmInput.templateKey,i.optionsHash),_=`${u}.${randomUUID()}.tmp`,v=createProviderName(`eve-sbx-tpl-tmp`,`${i.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(a,h),await rm(_,{force:!0,recursive:!0}),await mkdir(_,{recursive:!0}),i.prewarmInput.log?.(`creating template VM from image "${i.options.image}"`);let y=await createPreparedMicrosandbox({log:i.prewarmInput.log,module:a,name:v,networkPolicy:i.options.networkPolicy,options:i.options,sessionKey:i.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),b=buildSandboxSession(createMicrosandboxInternalSession(y),async e=>{await y.setNetworkPolicy(e)});try{i.prewarmInput.bootstrap!==void 0&&(i.prewarmInput.log?.(`running sandbox bootstrap`),await i.prewarmInput.bootstrap({use:async e=>(e?.networkPolicy!==void 0&&await y.setNetworkPolicy(e.networkPolicy),createLoggingSandboxSession({log:i.prewarmInput.log,session:b}))})),i.prewarmInput.seedFiles.length>0&&i.prewarmInput.log?.(`writing ${i.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(b,i.prewarmInput.seedFiles),i.prewarmInput.log?.(`snapshotting template VM`),await y.stopAndSnapshot(h),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(_),{optionsHash:i.optionsHash,snapshotName:h,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(u),{recursive:!0}),await rm(u,{force:!0,recursive:!0});try{await rename(_,u)}catch(e){if(await doesPathExist(u))return{reused:!0};throw e}}finally{await y.removePersisted(),await rm(_,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(e){let t=await loadMicrosandboxModule({appRoot:e.createInput.runtimeContext.appRoot,options:e.options}),n=resolveSandboxCacheDirectory(e.createInput.runtimeContext.appRoot),r=resolveMicrosandboxSessionRootPath(n,e.createInput.sessionKey),a=createActiveMicrosandboxSessionKey(r,e.optionsHash),o=activeMicrosandboxSessionHandles.get(a);if(o!==void 0)return o;let s=resolveMicrosandboxMetadataPath(r),c=readSessionMetadataRecord(e.createInput.existingMetadata)??await readSessionMetadata(s),l=withDevelopmentSandboxMetadataPathTag(e.createInput.tags,s);if(c?.optionsHash===e.optionsHash&&(await sandboxExists(t,c.sandboxName)||c.stateSnapshotName!==void 0&&await snapshotExists(t,c.stateSnapshotName))){let n=await connectMicrosandbox({metadata:c,metadataPath:s,module:t,options:e.options,sessionKey:e.createInput.sessionKey,tags:l});if(n!==null)return cacheHandle(a,createHandle(n,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(a)}))}let d=null;if(e.createInput.templateKey!==null){let r=await readTemplateMetadata(resolveMicrosandboxMetadataPath(resolveMicrosandboxTemplateRootPath(n,e.createInput.templateKey)));if(r===null||r.optionsHash!==e.optionsHash||!await snapshotExists(t,r.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey});d=r.snapshotName}let m=createProviderName(`eve-sbx-ses`,`${e.createInput.sessionKey}:${randomUUID()}`),g;try{g=await createPreparedMicrosandbox({fromSnapshot:d??void 0,module:t,name:m,networkPolicy:e.options.networkPolicy,options:e.options,sessionKey:e.createInput.sessionKey,setupBaseRuntime:d===null,tags:l})}catch(t){throw d!==null&&e.createInput.templateKey!==null&&isMicrosandboxNotFoundError(t)?new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey}):t}return await g.writeMetadata(s,e.optionsHash),cacheHandle(a,createHandle(g,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(a)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};

package/dist/src/execution/sandbox/bindings/microsandbox-provider-state.d.ts

@@ -0,0 +1,11 @@
+import type { MicrosandboxModule } from "#execution/sandbox/bindings/microsandbox-runtime.js";
+/**
+ * Classifies provider errors by message because the microsandbox SDK
+ * exposes no structured error codes for these conditions.
+ */
+export declare function isMicrosandboxNotFoundError(error: unknown): boolean;
+export declare function isMicrosandboxStillRunningError(error: unknown): boolean;
+export declare function isMicrosandboxSnapshotSourceRunningError(error: unknown): boolean;
+export declare function snapshotExists(module: MicrosandboxModule, snapshotName: string): Promise<boolean>;
+export declare function sandboxExists(module: MicrosandboxModule, sandboxName: string): Promise<boolean>;
+export declare function removeSnapshotIfExists(module: MicrosandboxModule, snapshotName: string): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-provider-state.js

@@ -0,0 +1 @@
+function isMicrosandboxNotFoundError(e){return e instanceof Error?/not found|not exist|no such/i.test(e.message):!1}function isMicrosandboxStillRunningError(e){return e instanceof Error?/still running/i.test(e.message):!1}function isMicrosandboxSnapshotSourceRunningError(e){return e instanceof Error?/snapshot source sandbox .*not stopped|SnapshotSandboxRunning/i.test(e.message):!1}async function snapshotExists(e,t){try{return await e.Snapshot.get(t),!0}catch{return!1}}async function sandboxExists(e,t){try{return await e.Sandbox.get(t),!0}catch(e){if(isMicrosandboxNotFoundError(e))return!1;throw e}}async function removeSnapshotIfExists(e,t){try{await e.Snapshot.remove(t,{force:!0})}catch(e){if(!isMicrosandboxNotFoundError(e))throw e}}export{isMicrosandboxNotFoundError,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,sandboxExists,snapshotExists};

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.d.ts

@@ -4,6 +4,7 @@ import type { SandboxBackendTags } from "#public/definitions/sandbox-backend.js"
 import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
 import type { Sandbox as MicrosandboxSandbox } from "microsandbox";
+export { isMicrosandboxNotFoundError, removeSnapshotIfExists, sandboxExists, snapshotExists, } from "#execution/sandbox/bindings/microsandbox-provider-state.js";
 export type MicrosandboxModule = typeof import("microsandbox");
 export declare class MicrosandboxVm {
     #private;
@@ -16,6 +17,12 @@ export declare class MicrosandboxVm {
     get id(): string;
     captureState(optionsHash: string): Promise<MicrosandboxSessionMetadata>;
     detach(): Promise<void>;
+    /**
+     * Stops the VM and releases the SDK client for server shutdown. The
+     * stopped sandbox persists on disk, so a later `connect` restarts it
+     * (dev) or restores from the last captured snapshot (production).
+     */
+    shutdown(): Promise<void>;
     readFileBytes(path: string): Promise<Buffer | null>;
     removePath(options: SandboxRemovePathOptions): Promise<void>;
     removePersisted(): Promise<void>;
@@ -67,10 +74,6 @@ export declare function loadMicrosandboxModule(input: {
  */
 export declare function loadMicrosandboxWithoutInstall(): Promise<MicrosandboxModule | null>;
 export declare function stopAndSnapshotMicrosandboxSandbox(module: MicrosandboxModule, sandboxName: string, snapshotName: string): Promise<void>;
-export declare function snapshotExists(module: MicrosandboxModule, snapshotName: string): Promise<boolean>;
-export declare function sandboxExists(module: MicrosandboxModule, sandboxName: string): Promise<boolean>;
-export declare function removeSnapshotIfExists(module: MicrosandboxModule, snapshotName: string): Promise<void>;
 export declare function createProviderName(prefix: string, key: string, extra?: string): string;
 export declare function createStableHash(value: string): string;
 export declare function doesPathExist(path: string): Promise<boolean>;
-export declare function isMicrosandboxNotFoundError(error: unknown): boolean;

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.js

@@ -1 +1 @@
-import{posix}from"node:path";import{access}from"node:fs/promises";import{createHash,randomUUID}from"node:crypto";import{isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";const MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(n),this.#o=n,this.#t!==void 0&&await this.writeMetadata(this.#t,e),t!==void 0&&await removeSnapshotIfExists(this.#e.module,t),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:n,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a),this.#o!==void 0&&await removeSnapshotIfExists(this.#e.module,this.#o)}async setNetworkPolicy(e){let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),i=this.#a;await this.stopAndSnapshot(n),await removeSandboxIfExists(this.#e.module,i);let a=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:n,module:this.#e.module,name:a,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=a,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists(this.#e.module,n),t!==void 0&&await removeSnapshotIfExists(this.#e.module,t)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(t){let n=this.#i.fs();for(let r of t){let t=posix.dirname(r.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(t)}`,user:MICROSANDBOX_USER}),await n.write(r.path,r.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(r.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists(e.module,e.metadata.stateSnapshotName))return null;let t=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),n=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:t,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let i=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,t,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await i.writeMetadata(e.metadataPath,e.metadata.optionsHash),i}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:`microsandbox`}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(){try{let e=await import(`microsandbox`);return e.isInstalled()?e:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}async function snapshotExists(e,t){try{return await e.Snapshot.get(t),!0}catch{return!1}}async function sandboxExists(e,t){try{return await e.Sandbox.get(t),!0}catch(e){if(isMicrosandboxNotFoundError(e))return!1;throw e}}async function removeSnapshotIfExists(e,t){try{await e.Snapshot.remove(t,{force:!0})}catch(e){if(!isMicrosandboxNotFoundError(e))throw e}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function isMicrosandboxNotFoundError(e){return e instanceof Error?/not found|not exist|no such/i.test(e.message):!1}function isMicrosandboxStillRunningError(e){return e instanceof Error?/still running/i.test(e.message):!1}function isMicrosandboxSnapshotSourceRunningError(e){return e instanceof Error?/snapshot source sandbox .*not stopped|SnapshotSandboxRunning/i.test(e.message):!1}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};
+import{posix}from"node:path";import{access}from"node:fs/promises";import{createHash,randomUUID}from"node:crypto";import{isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(n),this.#o=n,this.#t!==void 0&&await this.writeMetadata(this.#t,e),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:n,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a),this.#o!==void 0&&await removeSnapshotIfExists$1(this.#e.module,this.#o)}async setNetworkPolicy(e){let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),i=this.#a;await this.stopAndSnapshot(n),await removeSandboxIfExists(this.#e.module,i);let a=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:n,module:this.#e.module,name:a,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=a,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,n),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(t){let n=this.#i.fs();for(let r of t){let t=posix.dirname(r.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(t)}`,user:MICROSANDBOX_USER}),await n.write(r.path,r.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(r.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let t=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),n=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:t,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let i=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,t,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await i.writeMetadata(e.metadataPath,e.metadata.optionsHash),i}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:`microsandbox`}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(){try{let e=await import(`microsandbox`);return e.isInstalled()?e:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};

package/dist/src/execution/sandbox/bindings/vercel.js

@@ -1 +1 @@
-import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{applyInitialVercelNetworkPolicy,ensureVercelSandboxBaseRuntime}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},r=e.createSandbox??createVercelEveImageSandbox,a=new Map;return{name:`vercel`,async create(e){let o=resolveVercelSandboxTags(n.tags,e.tags),l=e.templateKey===null?null:await readTemplateForCreate({createOptions:n,loadSandboxModule:t,prewarmedTemplates:a,templateKey:e.templateKey}),u=await t(),d;try{d=await ensureSession({createOptions:n,createSandbox:r,existingMetadata:e.existingMetadata,sandboxModule:u,sessionKey:e.sessionKey,snapshotId:l?.snapshotId,tags:o})}catch(t){throw l!==null&&(isVercelSnapshotUnavailableError(t)||isVercelSandboxMissingError(t))?(a.delete(l.templateKey),await(await getNamedVercelSandbox({createOptions:n,sandboxModule:u,sandboxName:l.sandboxName}))?.delete(),new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:l.templateKey})):Error(`Failed to create sandbox session "${e.sessionKey}": ${errorMessage(t)}`,{cause:t})}return l===null&&d.created&&(await ensureVercelSandboxBaseRuntime(d.sandbox),await applyInitialVercelNetworkPolicy(d.sandbox,n.networkPolicy)),createHandle(d.sandbox,e.sessionKey)},async prewarm(e){let i;try{i=await ensureTemplateWithUnavailableRetry({bootstrap:e.bootstrap,createOptions:n,createSandbox:r,loadSandboxModule:t,log:e.log,seedFiles:e.seedFiles,templateKey:e.templateKey})}catch(t){throw Error(`Failed to prewarm Vercel sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}return a.set(e.templateKey,i.template),{reused:i.reused}}}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function readTemplate(e){let t=e.prewarmedTemplates.get(e.templateKey);if(t!==void 0)return t;let n=await e.loadSandboxModule(),r=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:n,sandboxName:e.templateKey});if(r===null||typeof r.currentSnapshotId!=`string`)throw new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:e.templateKey});return{sandboxName:r.name,snapshotId:r.currentSnapshotId,templateKey:e.templateKey}}async function readTemplateForCreate(e){try{return await readTemplate(e)}catch(t){throw SandboxTemplateNotProvisionedError.is(t)?t:Error(`Failed to read sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),i=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),a=resolveVercelSandboxTags(e.createOptions.tags,e.tags),o=extractAuthorSnapshotId(e.createOptions);if(i!==null&&isUnprovisionedTerminalTemplateSandbox(i,o)&&(await i.delete(),i=null),i===null?i=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!1,tags:a})}):await ensureVercelSandboxTags(i,a),typeof i.currentSnapshotId==`string`&&i.currentSnapshotId.length>0&&i.currentSnapshotId!==o)return{reused:!0,template:{sandboxName:i.name,snapshotId:i.currentSnapshotId,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(i),await applyInitialVercelNetworkPolicy(i,e.createOptions.networkPolicy);let s=buildSandboxSession(createVercelInternalSandboxSession(i,e.templateKey),createVercelNetworkPolicySetter(i));e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async t=>(t!==void 0&&await i.update(t),createLoggingSandboxSession({log:e.log,session:s}))}));for(let t of e.seedFiles)typeof t.content==`string`?await s.writeTextFile({content:t.content,path:t.path}):await s.writeBinaryFile({content:t.content,path:t.path});let c=await i.snapshot();return{reused:!1,template:{sandboxName:i.name,snapshotId:c.snapshotId,templateKey:e.templateKey}}}async function ensureSession(e){let t=getVercelSandboxName(e.existingMetadata)??e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t);return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t){if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...e.createOptions,name:t,persistent:!0});let{image:n,runtime:r,source:i,...a}=e.createOptions;return{...a,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createHandle(e,t){return{session:buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e)),useSessionFn:async n=>(n!==void 0&&await e.update(n),buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e))),async captureState(){return{backendName:`vercel`,metadata:{sandboxName:e.name},sessionKey:t}},async dispose(){}}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}function createVercelInternalSandboxSession(n,r){return{id:r,resolvePath:resolveVercelSandboxPath,async spawn(t){return adaptMultiplexedCommandToSandboxProcess({command:await n.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:t.env,signal:t.abortSignal}),getOutput:e=>e.stream})},async readFile(e){return normalizeVercelReadStream(await n.readFile({path:e.path}))},async writeFile(e){let r=await streamToBuffer(e.content);await n.writeFiles([{content:r,path:e.path}])},async removePath(e){await n.fs.rm(e.path,{force:e.force,recursive:e.recursive,signal:e.abortSignal})}}}function resolveVercelSandboxPath(t){return t.startsWith(`/`)?t:`${WORKSPACE_ROOT}/${t}`}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}function getVercelSandboxName(e){let t=e?.sandboxName;return typeof t==`string`?t:void 0}function resolveVercelSandboxTags(e,t){let n={};if(e!==void 0)for(let[t,r]of Object.entries(e))n[t]=r;if(t!==void 0)for(let[e,r]of Object.entries(t))n[e]=r;let r=Object.keys(n).length;if(r!==0){if(r>VERCEL_SANDBOX_TAG_LIMIT)throw Error(`Vercel Sandbox supports at most ${VERCEL_SANDBOX_TAG_LIMIT} tags. eve reserves "agent", "channel", and "sessionId"; remove or consolidate custom tags passed to vercel().`);return n}}async function ensureVercelSandboxTags(e,t){t===void 0||areVercelSandboxTagsEqual(e.tags,t)||await e.update({tags:t})}function areVercelSandboxTagsEqual(e,t){let n=e??{},r=Object.entries(n),i=Object.entries(t);return r.length===i.length?i.every(([e,t])=>n[e]===t):!1}function errorMessage(e){if(e instanceof Error){let t=e.json,n=e.text,r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}const DEFAULT_SANDBOX_TIMEOUT_MS=1800*1e3,VERCEL_SANDBOX_TAG_LIMIT=5;export{createVercelSandbox};
+import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{applyInitialVercelNetworkPolicy,ensureVercelSandboxBaseRuntime}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},r=e.createSandbox??createVercelEveImageSandbox,i=new Map;return{name:`vercel`,async create(e){let o=resolveVercelSandboxTags(n.tags,e.tags),s=e.templateKey===null?null:await readTemplateForCreate({createOptions:n,loadSandboxModule:t,prewarmedTemplates:i,templateKey:e.templateKey}),u=await t(),d;try{d=await ensureSession({createOptions:n,createSandbox:r,existingMetadata:e.existingMetadata,sandboxModule:u,sessionKey:e.sessionKey,snapshotId:s?.snapshotId,tags:o})}catch(t){throw s!==null&&(isVercelSnapshotUnavailableError(t)||isVercelSandboxMissingError(t))?(i.delete(s.templateKey),await(await getNamedVercelSandbox({createOptions:n,sandboxModule:u,sandboxName:s.sandboxName}))?.delete(),new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:s.templateKey})):Error(`Failed to create sandbox session "${e.sessionKey}": ${errorMessage(t)}`,{cause:t})}return s===null&&d.created&&(await ensureVercelSandboxBaseRuntime(d.sandbox),await applyInitialVercelNetworkPolicy(d.sandbox,n.networkPolicy)),createHandle(d.sandbox,e.sessionKey)},async prewarm(e){let a;try{a=await ensureTemplateWithUnavailableRetry({bootstrap:e.bootstrap,createOptions:n,createSandbox:r,loadSandboxModule:t,log:e.log,seedFiles:e.seedFiles,templateKey:e.templateKey})}catch(t){throw Error(`Failed to prewarm Vercel sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}return i.set(e.templateKey,a.template),{reused:a.reused}}}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function readTemplate(e){let t=e.prewarmedTemplates.get(e.templateKey);if(t!==void 0)return t;let n=await e.loadSandboxModule(),r=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:n,sandboxName:e.templateKey});if(r===null||typeof r.currentSnapshotId!=`string`)throw new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:e.templateKey});return{sandboxName:r.name,snapshotId:r.currentSnapshotId,templateKey:e.templateKey}}async function readTemplateForCreate(e){try{return await readTemplate(e)}catch(t){throw SandboxTemplateNotProvisionedError.is(t)?t:Error(`Failed to read sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}}async function ensureTemplate(e){let n=await e.loadSandboxModule(),a=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:n,sandboxName:e.templateKey}),o=resolveVercelSandboxTags(e.createOptions.tags,e.tags),s=extractAuthorSnapshotId(e.createOptions);if(a!==null&&isUnprovisionedTerminalTemplateSandbox(a,s)&&(await a.delete(),a=null),a===null?a=await e.createSandbox({sandboxModule:n,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!1,tags:o})}):await ensureVercelSandboxTags(a,o),typeof a.currentSnapshotId==`string`&&a.currentSnapshotId.length>0&&a.currentSnapshotId!==s)return{reused:!0,template:{sandboxName:a.name,snapshotId:a.currentSnapshotId,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(a),await applyInitialVercelNetworkPolicy(a,e.createOptions.networkPolicy);let c=buildSandboxSession(createVercelInternalSandboxSession(a,e.templateKey),createVercelNetworkPolicySetter(a));e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async t=>(t!==void 0&&await a.update(t),createLoggingSandboxSession({log:e.log,session:c}))})),await writeSandboxSeedFiles(c,e.seedFiles);let l=await a.snapshot();return{reused:!1,template:{sandboxName:a.name,snapshotId:l.snapshotId,templateKey:e.templateKey}}}async function ensureSession(e){let t=getVercelSandboxName(e.existingMetadata)??e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t);return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t){if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...e.createOptions,name:t,persistent:!0});let{image:n,runtime:r,source:i,...a}=e.createOptions;return{...a,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createHandle(e,t){return{session:buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e)),useSessionFn:async n=>(n!==void 0&&await e.update(n),buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e))),async captureState(){return{backendName:`vercel`,metadata:{sandboxName:e.name},sessionKey:t}},async shutdown(){await stopVercelSandbox(e)}}}async function stopVercelSandbox(e){if(!(e.status!==`running`&&e.status!==`pending`))try{await e.stop()}catch{}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}function createVercelInternalSandboxSession(t,r){return{id:r,resolvePath:resolveVercelSandboxPath,async spawn(n){return adaptMultiplexedCommandToSandboxProcess({command:await t.runCommand({args:[`-lc`,n.command],cmd:`bash`,cwd:n.workingDirectory??WORKSPACE_ROOT,detached:!0,env:n.env,signal:n.abortSignal}),getOutput:e=>e.stream})},async readFile(e){return normalizeVercelReadStream(await t.readFile({path:e.path}))},async writeFile(e){let r=await streamToBuffer(e.content);await t.writeFiles([{content:r,path:e.path}])},async removePath(e){await t.fs.rm(e.path,{force:e.force,recursive:e.recursive,signal:e.abortSignal})}}}function resolveVercelSandboxPath(t){return t.startsWith(`/`)?t:`${WORKSPACE_ROOT}/${t}`}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}function getVercelSandboxName(e){let t=e?.sandboxName;return typeof t==`string`?t:void 0}function resolveVercelSandboxTags(e,t){let n={};if(e!==void 0)for(let[t,r]of Object.entries(e))n[t]=r;if(t!==void 0)for(let[e,r]of Object.entries(t))n[e]=r;let r=Object.keys(n).length;if(r!==0){if(r>VERCEL_SANDBOX_TAG_LIMIT)throw Error(`Vercel Sandbox supports at most ${VERCEL_SANDBOX_TAG_LIMIT} tags. eve reserves "agent", "channel", and "sessionId"; remove or consolidate custom tags passed to vercel().`);return n}}async function ensureVercelSandboxTags(e,t){t===void 0||areVercelSandboxTagsEqual(e.tags,t)||await e.update({tags:t})}function areVercelSandboxTagsEqual(e,t){let n=e??{},r=Object.entries(n),i=Object.entries(t);return r.length===i.length?i.every(([e,t])=>n[e]===t):!1}function errorMessage(e){if(e instanceof Error){let t=e.json,n=e.text,r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}const DEFAULT_SANDBOX_TIMEOUT_MS=1800*1e3,VERCEL_SANDBOX_TAG_LIMIT=5;export{createVercelSandbox};

package/dist/src/execution/sandbox/ensure.js

@@ -1 +1 @@
-import{waitForDevelopmentSandboxPrewarm}from"#execution/sandbox/development-prewarm.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{markDevelopmentSandboxBackendInitialized}from"#execution/sandbox/development-run.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{createRuntimeSandboxKeys}from"#runtime/sandbox/keys.js";import{createRuntimeSandboxTemplatePlan}from"#runtime/sandbox/template-plan.js";import{prewarmAppSandboxes}from"#execution/sandbox/prewarm.js";import{waitForSandboxTemplatePrewarmLock}from"#execution/sandbox/template-prewarm-lock.js";async function ensureSandboxAccess(n){let i=n.state?.initialized??!1,o=n.state?.session??null,s=getRuntimeCompiledArtifactsSandboxAppRoot(n.compiledArtifactsSource)??process.cwd(),c=n.registry.sandbox,l;function getHandle(){return l===void 0&&(l=createHandle().catch(e=>{throw l=void 0,e})),l}async function createHandle(){if(c===null)return null;let a=c.definition,l=a.backend,u=createRuntimeSandboxTemplatePlan({definition:a,workspaceResourceRoot:c.workspaceResourceRoot}),d=await createRuntimeSandboxKeys({backendName:l.name,compiledArtifactsSource:n.compiledArtifactsSource,nodeId:n.nodeId,sessionId:n.sessionId,sourceId:a.sourceId,templatePlan:u});d.templateKey!==null&&(await waitForDevelopmentSandboxPrewarm({appRoot:s,compiledArtifactsSource:n.compiledArtifactsSource,log:e=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(n.nodeId)}" (${l.name}): ${e}`)}),await waitForSandboxTemplatePrewarmLock({appRoot:s,backendName:l.name,log:e=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(n.nodeId)}" (${l.name}): ${e}`),templateKey:d.templateKey}));let f={existingMetadata:o?.backendName===l.name&&o.sessionKey===d.sessionKey?o.metadata:void 0,runtimeContext:{appRoot:s},sessionKey:d.sessionKey,tags:n.tags,templateKey:d.templateKey},p=await withDevelopmentSandboxProgress(`eve: opening sandbox session "${formatNodeLabel(n.nodeId)}" on backend "${l.name}"...`,`eve: opening sandbox session "${formatNodeLabel(n.nodeId)}" on backend "${l.name}"`,async()=>await createBackendHandleWithPrewarmRetry({appRoot:s,backend:l,compiledArtifactsSource:n.compiledArtifactsSource,createInput:f}));return markDevelopmentSandboxBackendInitialized(l.name),i||=(await runOnSession(async()=>{await a.onSession?.({ctx:buildCallbackContext(),use:p.useSessionFn})}),!0),p}async function runOnSession(e){if(n.runOnSession!==void 0){await n.runOnSession(e);return}await e()}return{async captureState(){if(l!==void 0){let e=await l;e!==null&&(o=await e.captureState())}return{initialized:i,session:o}},async dispose(){l!==void 0&&await(await l)?.dispose()},async get(){return(await getHandle())?.session??null}}}async function createBackendHandleWithPrewarmRetry(e){try{return await e.backend.create(e.createInput)}catch(t){if(e.createInput.templateKey===null||e.compiledArtifactsSource.kind!==`disk`||!SandboxTemplateNotProvisionedError.is(t))throw t;return await prewarmAppSandboxes({appRoot:e.appRoot,compiledArtifactsSource:e.compiledArtifactsSource,log:e=>logDevelopmentSandbox(e)}),await waitForSandboxTemplatePrewarmLock({appRoot:e.appRoot,backendName:e.backend.name,log:e=>logDevelopmentSandbox(`eve: ${e}`),templateKey:e.createInput.templateKey}),logDevelopmentSandbox(`eve: sandbox template is ready; retrying sandbox creation...`),await e.backend.create(e.createInput)}}function logDevelopmentSandbox(e){isEveDevEnvironment()&&console.log(e)}async function withDevelopmentSandboxProgress(e,t,r){if(logDevelopmentSandbox(e),!isEveDevEnvironment())return await r();let i=Date.now(),a=setInterval(()=>{logDevelopmentSandbox(`${t} (${Math.round((Date.now()-i)/1e3)}s elapsed)...`)},5e3);a.unref?.();try{return await r()}finally{clearInterval(a)}}function formatNodeLabel(e){return e===`__root__`?`root`:e}export{ensureSandboxAccess};
+import{waitForDevelopmentSandboxPrewarm}from"#execution/sandbox/development-prewarm.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{markDevelopmentSandboxBackendInitialized}from"#execution/sandbox/development-run.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{createRuntimeSandboxKeys}from"#runtime/sandbox/keys.js";import{createRuntimeSandboxTemplatePlan}from"#runtime/sandbox/template-plan.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{prewarmAppSandboxes}from"#execution/sandbox/prewarm.js";import{waitForSandboxTemplatePrewarmLock}from"#execution/sandbox/template-prewarm-lock.js";async function ensureSandboxAccess(n){let i=n.state?.initialized??!1,o=n.state?.session??null,s=getRuntimeCompiledArtifactsSandboxAppRoot(n.compiledArtifactsSource)??process.cwd(),c=n.registry.sandbox,l;function getHandle(){return l===void 0&&(l=createHandle().catch(e=>{throw l=void 0,e})),l}async function createHandle(){if(c===null)return null;let a=c.definition,l=a.backend,u=createRuntimeSandboxTemplatePlan({definition:a,workspaceResourceRoot:c.workspaceResourceRoot}),d=await createRuntimeSandboxKeys({backendName:l.name,compiledArtifactsSource:n.compiledArtifactsSource,nodeId:n.nodeId,sessionId:n.sessionId,sourceId:a.sourceId,templatePlan:u});d.templateKey!==null&&(await waitForDevelopmentSandboxPrewarm({appRoot:s,compiledArtifactsSource:n.compiledArtifactsSource,log:e=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(n.nodeId)}" (${l.name}): ${e}`)}),await waitForSandboxTemplatePrewarmLock({appRoot:s,backendName:l.name,log:e=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(n.nodeId)}" (${l.name}): ${e}`),templateKey:d.templateKey}));let f={existingMetadata:o?.backendName===l.name&&o.sessionKey===d.sessionKey?o.metadata:void 0,runtimeContext:{appRoot:s},sessionKey:d.sessionKey,tags:n.tags,templateKey:d.templateKey},p=await withDevelopmentSandboxProgress(`eve: opening sandbox session "${formatNodeLabel(n.nodeId)}" on backend "${l.name}"...`,`eve: opening sandbox session "${formatNodeLabel(n.nodeId)}" on backend "${l.name}"`,async()=>await createBackendHandleWithPrewarmRetry({appRoot:s,backend:l,compiledArtifactsSource:n.compiledArtifactsSource,createInput:f}));return markDevelopmentSandboxBackendInitialized(l.name),trackActiveSandboxHandle({backendName:l.name,handle:p,sessionKey:d.sessionKey}),i||=(await runOnSession(async()=>{await a.onSession?.({ctx:buildCallbackContext(),use:p.useSessionFn})}),!0),p}async function runOnSession(e){if(n.runOnSession!==void 0){await n.runOnSession(e);return}await e()}return{async captureState(){if(l!==void 0){let e=await l;e!==null&&(o=await e.captureState())}return{initialized:i,session:o}},async get(){return(await getHandle())?.session??null}}}async function createBackendHandleWithPrewarmRetry(e){try{return await e.backend.create(e.createInput)}catch(t){if(e.createInput.templateKey===null||e.compiledArtifactsSource.kind!==`disk`||!SandboxTemplateNotProvisionedError.is(t))throw t;return await prewarmAppSandboxes({appRoot:e.appRoot,compiledArtifactsSource:e.compiledArtifactsSource,log:e=>logDevelopmentSandbox(e)}),await waitForSandboxTemplatePrewarmLock({appRoot:e.appRoot,backendName:e.backend.name,log:e=>logDevelopmentSandbox(`eve: ${e}`),templateKey:e.createInput.templateKey}),logDevelopmentSandbox(`eve: sandbox template is ready; retrying sandbox creation...`),await e.backend.create(e.createInput)}}function logDevelopmentSandbox(e){isEveDevEnvironment()&&console.log(e)}async function withDevelopmentSandboxProgress(e,t,r){if(logDevelopmentSandbox(e),!isEveDevEnvironment())return await r();let i=Date.now(),a=setInterval(()=>{logDevelopmentSandbox(`${t} (${Math.round((Date.now()-i)/1e3)}s elapsed)...`)},5e3);a.unref?.();try{return await r()}finally{clearInterval(a)}}function formatNodeLabel(e){return e===`__root__`?`root`:e}export{ensureSandboxAccess};

package/dist/src/execution/sandbox/prewarm.js

@@ -1,2 +1,2 @@
-import{withSandboxTemplatePrewarmLock}from"./template-prewarm-lock.js";import{toErrorMessage}from"#shared/errors.js";import{createBundledRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{loadCompiledModuleMapFromAuthoredSource}from"#internal/authored-module-map-loader.js";import{createAuthoredSourceRuntimeCompiledArtifactsSource}from"#internal/application/runtime-compiled-artifacts-source.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{loadCompileMetadata}from"#runtime/loaders/compile-metadata.js";import{withBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{loadCompiledManifest}from"#runtime/loaders/manifest.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{resolveRuntimeAgentGraph}from"#runtime/resolve-agent-graph.js";import{createRuntimeSandboxTemplateKey}from"#runtime/sandbox/keys.js";import{createRuntimeSandboxTemplatePlan}from"#runtime/sandbox/template-plan.js";import{materializeWorkspaceDirectory}from"#runtime/workspace/seed-files.js";async function prewarmSandboxes(n){let r=await collectPrewarmTargets(n);if(r.length===0)return;let i=createPrewarmSignature(r);if(n.shouldPrewarmSignature?.(i)===!1)return;let a=n.dispatch??(async({backend:e,input:t})=>await e.prewarm(t));n.log?.(`eve: initializing ${formatSandboxTemplateCount(r.length)}...`);let o=(await Promise.all(r.map(async({backend:r,label:i,input:o})=>{let logBackendProgress=e=>{shouldLogSandboxPrewarmProgress(e)&&n.log?.(`eve: sandbox template "${i}" (${r.name}): ${e}`)},s;try{s=await withSandboxTemplatePrewarmLock({appRoot:o.runtimeContext.appRoot,backendName:r.name,templateKey:o.templateKey},async()=>await a({backend:r,input:{...o,log:n.log===void 0?void 0:logBackendProgress}}))}catch(e){let a=formatPrewarmFailureForEnvironment({backendName:r.name,error:e});throw n.log?.(`eve: failed to initialize sandbox template "${i}" on backend "${r.name}": ${toErrorMessage(a)}`),a}return s}))).filter(e=>e.reused).length;n.log?.(`eve: initialized ${formatSandboxTemplateCount(r.length)} (${o} reused, ${r.length-o} built).`),n.onPrewarmSignature?.(i)}async function prewarmAppSandboxes(e){let t=e.compiledArtifactsSource??createAuthoredSourceRuntimeCompiledArtifactsSource(e.appRoot);if(t.kind!==`disk`)throw Error(`prewarmAppSandboxes requires disk-backed compiled artifacts.`);let n=await(e.loadAgentGraph??loadGraphFromArtifacts)({compiledArtifactsSource:t});await prewarmSandboxes({appRoot:getRuntimeCompiledArtifactsSandboxAppRoot(t)??e.appRoot,compiledArtifactsSource:t,dispatch:e.dispatch,graph:n,log:e.log,onPrewarmSignature:e.onPrewarmSignature,shouldPrewarmSignature:e.shouldPrewarmSignature})}async function prewarmBuiltAppSandboxes(e){let t=createAuthoredSourceRuntimeCompiledArtifactsSource(e.appRoot),[r,o,l]=await Promise.all([loadCompileMetadata({compiledArtifactsSource:t}),loadCompiledManifest({compiledArtifactsSource:t}),loadCompiledModuleMapFromAuthoredSource({compiledArtifactsSource:t})]);await withBundledCompiledArtifacts({manifest:o,metadata:r??void 0,moduleMap:l,sessionId:`built-app-prewarm`},async()=>{let t=createBundledRuntimeCompiledArtifactsSource(),r=await resolveRuntimeAgentGraph({manifest:o,moduleMap:l});await prewarmSandboxes({appRoot:e.appRoot,compiledArtifactsSource:t,dispatch:e.dispatch,graph:r,log:e.log})})}async function collectPrewarmTargets(e){let t=resolveRuntimeCompilerArtifactPaths(e.appRoot).compileDirectoryPath,n={appRoot:e.appRoot},r=[];return await Promise.all(collectNodeSandboxes(e.graph).map(async({definition:i,nodeId:a,workspaceResourceRoot:o})=>{let s=createRuntimeSandboxTemplatePlan({definition:i,workspaceResourceRoot:o}),c=await createRuntimeSandboxTemplateKey({backendName:i.backend.name,compiledArtifactsSource:e.compiledArtifactsSource,nodeId:a,sourceId:i.sourceId,templatePlan:s});c!==null&&r.push({backend:i.backend,label:formatLabel(a),input:{bootstrap:i.bootstrap,seedFiles:await loadResourceRootSeedFiles({compileDirectoryPath:t,workspaceResourceRoot:o}),runtimeContext:n,templateKey:c},signature:`${i.backend.name}:${a}:${c}`})})),r.sort((e,t)=>e.label.localeCompare(t.label))}async function loadResourceRootSeedFiles(e){return e.workspaceResourceRoot.rootEntries.length===0?[]:(await materializeWorkspaceDirectory(`${e.compileDirectoryPath}/${e.workspaceResourceRoot.logicalPath}`)).map(e=>({content:e.content,path:e.path}))}async function loadGraphFromArtifacts(e){let[t,n]=await Promise.all([loadCompiledManifest({compiledArtifactsSource:e.compiledArtifactsSource}),loadCompiledModuleMapFromAuthoredSource({compiledArtifactsSource:e.compiledArtifactsSource})]);return await resolveRuntimeAgentGraph({manifest:t,moduleMap:n})}function collectNodeSandboxes(e){return[...e.nodesByNodeId.entries()].flatMap(([e,t])=>{let n=t.sandboxRegistry.sandbox;return n===null?[]:[{...n,nodeId:e}]})}function formatLabel(e){return e===ROOT_RUNTIME_AGENT_NODE_ID?`root`:e}function createPrewarmSignature(e){return e.map(e=>e.signature).sort().join(`
+import{withSandboxTemplatePrewarmLock}from"./template-prewarm-lock.js";import{toErrorMessage}from"#shared/errors.js";import{createBundledRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{loadCompiledModuleMapFromAuthoredSource}from"#internal/authored-module-map-loader.js";import{createAuthoredSourceRuntimeCompiledArtifactsSource}from"#internal/application/runtime-compiled-artifacts-source.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{loadCompileMetadata}from"#runtime/loaders/compile-metadata.js";import{withBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{loadCompiledManifest}from"#runtime/loaders/manifest.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{resolveRuntimeAgentGraph}from"#runtime/resolve-agent-graph.js";import{createRuntimeSandboxTemplateKey}from"#runtime/sandbox/keys.js";import{createRuntimeSandboxTemplatePlan}from"#runtime/sandbox/template-plan.js";import{materializeWorkspaceDirectory}from"#runtime/workspace/seed-files.js";async function prewarmSandboxes(n){let r=await collectPrewarmTargets(n);if(r.length===0)return;let i=createPrewarmSignature(r);if(n.shouldPrewarmSignature?.(i)===!1)return;let a=n.dispatch??(async({backend:e,input:t})=>await e.prewarm(t));n.log?.(`eve: initializing ${formatSandboxTemplateCount(r.length)}...`);let o=(await Promise.all(r.map(async({backend:r,label:i,input:o})=>{let logBackendProgress=e=>{shouldLogSandboxPrewarmProgress(e)&&n.log?.(`eve: sandbox template "${i}" (${r.name}): ${e}`)},s;try{s=await withSandboxTemplatePrewarmLock({appRoot:o.runtimeContext.appRoot,backendName:r.name,templateKey:o.templateKey},async()=>await a({backend:r,input:{...o,log:n.log===void 0?void 0:logBackendProgress}}))}catch(e){let a=formatPrewarmFailureForEnvironment({backendName:r.name,error:e});throw n.log?.(`eve: failed to initialize sandbox template "${i}" on backend "${r.name}": ${toErrorMessage(a)}`),a}return s}))).filter(e=>e.reused).length;n.log?.(`eve: initialized ${formatSandboxTemplateCount(r.length)} (${o} reused, ${r.length-o} built).`),n.onPrewarmSignature?.(i)}async function prewarmAppSandboxes(e){let t=e.compiledArtifactsSource??createAuthoredSourceRuntimeCompiledArtifactsSource(e.appRoot);if(t.kind!==`disk`)throw Error(`prewarmAppSandboxes requires disk-backed compiled artifacts.`);let n=await(e.loadAgentGraph??loadGraphFromArtifacts)({compiledArtifactsSource:t});await prewarmSandboxes({appRoot:getRuntimeCompiledArtifactsSandboxAppRoot(t)??e.appRoot,compiledArtifactsSource:t,dispatch:e.dispatch,graph:n,log:e.log,onPrewarmSignature:e.onPrewarmSignature,shouldPrewarmSignature:e.shouldPrewarmSignature})}async function prewarmBuiltAppSandboxes(e){let t=createAuthoredSourceRuntimeCompiledArtifactsSource(e.appRoot),[r,o,l]=await Promise.all([loadCompileMetadata({compiledArtifactsSource:t}),loadCompiledManifest({compiledArtifactsSource:t}),loadCompiledModuleMapFromAuthoredSource({compiledArtifactsSource:t})]);await withBundledCompiledArtifacts({manifest:o,metadata:r??void 0,moduleMap:l,sessionId:`built-app-prewarm`},async()=>{let t=createBundledRuntimeCompiledArtifactsSource(),r=await resolveRuntimeAgentGraph({manifest:o,moduleMap:l});await prewarmSandboxes({appRoot:e.appRoot,compiledArtifactsSource:t,dispatch:e.dispatch,graph:r,log:e.log})})}async function collectPrewarmTargets(e){let t=resolveRuntimeCompilerArtifactPaths(e.appRoot).compileDirectoryPath,n={appRoot:e.appRoot},r=[];return await Promise.all(collectNodeSandboxes(e.graph).map(async({definition:i,nodeId:a,workspaceResourceRoot:o})=>{let s=createRuntimeSandboxTemplatePlan({definition:i,workspaceResourceRoot:o}),c=await createRuntimeSandboxTemplateKey({backendName:i.backend.name,compiledArtifactsSource:e.compiledArtifactsSource,nodeId:a,sourceId:i.sourceId,templatePlan:s});c!==null&&r.push({backend:i.backend,label:formatLabel(a),input:{bootstrap:i.bootstrap,seedFiles:await loadResourceRootSeedFiles({compileDirectoryPath:t,workspaceResourceRoot:o}),runtimeContext:n,templateKey:c},signature:`${i.backend.name}:${a}:${c}`})})),r.sort((e,t)=>e.label.localeCompare(t.label))}async function loadResourceRootSeedFiles(e){return e.workspaceResourceRoot.contentHash===void 0&&e.workspaceResourceRoot.rootEntries.length===0?[]:(await materializeWorkspaceDirectory(`${e.compileDirectoryPath}/${e.workspaceResourceRoot.logicalPath}`)).map(e=>({content:e.content,path:e.path}))}async function loadGraphFromArtifacts(e){let[t,n]=await Promise.all([loadCompiledManifest({compiledArtifactsSource:e.compiledArtifactsSource}),loadCompiledModuleMapFromAuthoredSource({compiledArtifactsSource:e.compiledArtifactsSource})]);return await resolveRuntimeAgentGraph({manifest:t,moduleMap:n})}function collectNodeSandboxes(e){return[...e.nodesByNodeId.entries()].flatMap(([e,t])=>{let n=t.sandboxRegistry.sandbox;return n===null?[]:[{...n,nodeId:e}]})}function formatLabel(e){return e===ROOT_RUNTIME_AGENT_NODE_ID?`root`:e}function createPrewarmSignature(e){return e.map(e=>e.signature).sort().join(`
 `)}function formatSandboxTemplateCount(e){return`${e} sandbox ${e===1?`template`:`templates`}`}function shouldLogSandboxPrewarmProgress(e){return!e.startsWith(`checking `)&&!e.startsWith(`reusing `)&&e!==`loading microsandbox runtime`&&e!==`microsandbox runtime ready`}function formatPrewarmFailureForEnvironment(e){return!isVercelEnvironment()||!isLocalSandboxBackend(e.backendName)?e.error:Error(`The ${e.backendName} sandbox backend is not available when deploying on Vercel. Vercel build containers cannot run local Docker containers or microsandbox VMs. Use defaultBackend() so eve selects Vercel Sandbox on Vercel, or configure a Vercel-compatible backend explicitly, such as vercel(). Original ${e.backendName} error: ${toErrorMessage(e.error)}`,{cause:e.error})}function isVercelEnvironment(){return!!process.env.VERCEL?.trim()}function isLocalSandboxBackend(e){return e===`docker`||e===`microsandbox`}export{prewarmAppSandboxes,prewarmBuiltAppSandboxes,prewarmSandboxes};

package/dist/src/execution/sandbox/require-sandbox.d.ts

@@ -6,8 +6,10 @@ import type { SandboxSession } from "#public/definitions/sandbox.js";
  * `read_file`, `write_file`, `glob`, `grep`). Centralizes the context
  * lookup, null checks, and error messages so each executor does not
  * duplicate them.
+ *
+ * Binds the returned session to `abortSignal` when provided.
  */
-export declare function requireSandboxSession(): Promise<SandboxSession>;
+export declare function requireSandboxSession(abortSignal?: AbortSignal): Promise<SandboxSession>;
 /**
  * Validates that a model-supplied file path is absolute. Throws a
  * descriptive error when the path does not start with `/`.

package/dist/src/execution/sandbox/require-sandbox.js

@@ -1 +1 @@
-import{SandboxKey}from"#context/keys.js";import{loadContext}from"#context/container.js";async function requireSandboxSession(){let t=loadContext().get(SandboxKey);if(t===void 0)throw Error(`This tool requires sandbox access on the runtime context. Ensure the step is running inside a managed runtime context with sandbox support.`);let n=await t.get();if(n===null)throw Error(`The sandbox is not available in the current runtime context.`);return n}function validateAbsoluteFilePath(e){if(!e.startsWith(`/`))throw Error(`filePath must be an absolute path. Received: "${e}". Use an absolute path such as /workspace/foo.ts.`)}export{requireSandboxSession,validateAbsoluteFilePath};
+import{SandboxKey}from"#context/keys.js";import{loadContext}from"#context/container.js";import{bindSandboxAbortSignal}from"#execution/sandbox/abort-bound-session.js";async function requireSandboxSession(t){let n=loadContext().get(SandboxKey);if(n===void 0)throw Error(`This tool requires sandbox access on the runtime context. Ensure the step is running inside a managed runtime context with sandbox support.`);let r=await n.get();if(r===null)throw Error(`The sandbox is not available in the current runtime context.`);return t===void 0?r:bindSandboxAbortSignal(r,t)}function validateAbsoluteFilePath(e){if(!e.startsWith(`/`))throw Error(`filePath must be an absolute path. Received: "${e}". Use an absolute path such as /workspace/foo.ts.`)}export{requireSandboxSession,validateAbsoluteFilePath};

package/dist/src/execution/session-callback-step.d.ts

@@ -1,3 +1,4 @@
+import type { TokenUsage } from "#shared/token-usage.js";
 /**
  * Sends the configured session terminal callback.
  *
@@ -7,10 +8,15 @@
  * intentional: this function runs as a durable Workflow step, so rejection
  * hands retry/failure policy back to the Workflow orchestrator rather than
  * letting eve falsely mark the callback delivery as complete.
+ *
+ * `usage` — the session's token totals — rides along on completed
+ * callbacks so the caller can attribute this agent's spend. Failed
+ * callbacks never carry usage.
  */
 export declare function fireSessionCallbackStep(input: {
     readonly error?: unknown;
     readonly output?: unknown;
     readonly serializedContext: Record<string, unknown>;
     readonly status: "completed" | "failed";
+    readonly usage?: TokenUsage;
 }): Promise<void>;

package/dist/src/execution/session-callback-step.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{SessionCallbackKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{parseSessionCallback}from"#channel/session-callback.js";const log=createLogger(`execution.session-callback`);async function fireSessionCallbackStep(e){"use step";let n=e.serializedContext[`eve.sessionId`]??``,i=e.serializedContext[SessionCallbackKey.name];if(i!==void 0)try{let t=parseSerializedSessionCallback(i),r=e.status===`completed`?{callId:t.callId,kind:`session.completed`,output:e.output??``,sessionId:n,subagentName:t.subagentName}:{callId:t.callId,error:{code:`SESSION_FAILED`,message:toErrorMessage(e.error)},kind:`session.failed`,sessionId:n,subagentName:t.subagentName},a=await fetch(t.url,{body:JSON.stringify(r),headers:{"content-type":`application/json`},method:`POST`,redirect:`error`,signal:AbortSignal.timeout(3e4)});if(!a.ok)throw Error(`Session callback failed with HTTP ${a.status}.`)}catch(e){throw log.error(`failed to post session callback`,{error:e,sessionId:n}),e}}function parseSerializedSessionCallback(e){let t=parseSessionCallback(e);if(!t.ok)throw Error(`Serialized session callback is invalid.`,{cause:t.cause});return t.callback}export{fireSessionCallbackStep};
+import{createLogger}from"#internal/logging.js";import{SessionCallbackKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{parseSessionCallback}from"#channel/session-callback.js";const log=createLogger(`execution.session-callback`);async function fireSessionCallbackStep(e){"use step";let n=e.serializedContext[`eve.sessionId`]??``,i=e.serializedContext[SessionCallbackKey.name];if(i!==void 0)try{let t=parseSerializedSessionCallback(i),r=e.status===`completed`?buildCompletedCallbackBody({callback:t,output:e.output,sessionId:n,usage:e.usage}):{callId:t.callId,error:{code:`SESSION_FAILED`,message:toErrorMessage(e.error)},kind:`session.failed`,sessionId:n,subagentName:t.subagentName},a=await fetch(t.url,{body:JSON.stringify(r),headers:{"content-type":`application/json`},method:`POST`,redirect:`error`,signal:AbortSignal.timeout(3e4)});if(!a.ok)throw Error(`Session callback failed with HTTP ${a.status}.`)}catch(e){throw log.error(`failed to post session callback`,{error:e,sessionId:n}),e}}function buildCompletedCallbackBody(e){let t={callId:e.callback.callId,kind:`session.completed`,output:e.output??``,sessionId:e.sessionId,subagentName:e.callback.subagentName};return e.usage===void 0?t:{...t,usage:e.usage}}function parseSerializedSessionCallback(e){let t=parseSessionCallback(e);if(!t.ok)throw Error(`Serialized session callback is invalid.`,{cause:t.cause});return t.callback}export{fireSessionCallbackStep};

package/dist/src/execution/session.d.ts

@@ -1,8 +1,16 @@
 import type { DurableSession } from "#execution/durable-session-store.js";
-import type { HarnessSession, SessionLimits } from "#harness/types.js";
+import type { HarnessSession } from "#harness/types.js";
 import type { RuntimeTurnAgent } from "#runtime/agent/bootstrap.js";
 export declare const DEFAULT_ROOT_MAX_INPUT_TOKENS_PER_SESSION = 40000000;
-export declare const DEFAULT_SUBAGENT_MAX_INPUT_TOKENS_PER_SESSION = 5000000;
+/**
+ * Authored session token limits before resolution. `false` means the author
+ * explicitly uncapped the axis (skipping the root default). Resolution maps
+ * this shape onto the numeric {@link SessionLimits} the harness checks.
+ */
+export interface AuthoredSessionLimits {
+    readonly maxInputTokensPerSession?: number | false;
+    readonly maxOutputTokensPerSession?: number | false;
+}
 /**
  * Creates the durable compaction configuration used by one harness session.
  */
@@ -33,10 +41,12 @@ export interface CreateSessionInput {
     readonly rootSessionId?: string;
     readonly sessionId: string;
     readonly turnAgent: RuntimeTurnAgent;
-    readonly limits?: SessionLimits;
+    readonly limits?: AuthoredSessionLimits;
     readonly outputSchema?: HarnessSession["outputSchema"];
+    readonly skillRoot?: string;
     readonly subagentDepth?: number;
     readonly subagentMaxDepth?: number;
+    readonly workflowMaxSubagents?: number;
 }
 /** Creates a fresh {@link HarnessSession} from the current `turnAgent`. */
 export declare function createSession(input: CreateSessionInput): HarnessSession;
@@ -51,6 +61,7 @@ export declare function refreshSessionFromTurnAgent(input: {
     readonly compactionOverrides?: {
         readonly thresholdPercent?: number;
     };
+    readonly skillRoot?: string;
 }): HarnessSession;
 /**
  * Mints a continuation token for a delegated subagent session.

package/dist/src/execution/session.js

@@ -1,5 +1,3 @@
-const DEFAULT_ROOT_MAX_INPUT_TOKENS_PER_SESSION=4e7,DEFAULT_SUBAGENT_MAX_INPUT_TOKENS_PER_SESSION=5e6;function createCompactionConfig(e={}){let t=e.thresholdPercent??.9,n={recentWindowSize:10,threshold:e.contextWindowTokens===void 0?1e5:Math.max(1,Math.floor(e.contextWindowTokens*t))};return e.lastKnownInputTokens===void 0?n:{...n,lastKnownInputTokens:e.lastKnownInputTokens,lastKnownPromptMessageCount:e.lastKnownPromptMessageCount}}function createSession(e){let{turnAgent:t}=e,n=createSessionToolDefinitions(t),r={agent:{compactionModelReference:t.compactionModel,modelReference:t.model,reasoning:t.reasoning,system:t.instructions.join(`
+import{formatAvailableSkillsSection}from"#execution/skills/instructions.js";const DEFAULT_ROOT_MAX_INPUT_TOKENS_PER_SESSION=4e7;function createCompactionConfig(e={}){let t=e.thresholdPercent??.9,n={recentWindowSize:10,threshold:e.contextWindowTokens===void 0?1e5:Math.max(1,Math.floor(e.contextWindowTokens*t))};return e.lastKnownInputTokens===void 0?n:{...n,lastKnownInputTokens:e.lastKnownInputTokens,lastKnownPromptMessageCount:e.lastKnownPromptMessageCount}}function createSession(e){let{turnAgent:t}=e,n=createSessionToolDefinitions(t),r={agent:{compactionModelReference:t.compactionModel,modelReference:t.model,reasoning:t.reasoning,system:createSessionSystemPrompt({skillRoot:e.skillRoot,turnAgent:t}),tools:n},compaction:createCompactionConfig({contextWindowTokens:t.model.contextWindowTokens,thresholdPercent:e.compactionOverrides?.thresholdPercent}),continuationToken:e.continuationToken,history:[],sessionId:e.sessionId};return e.rootSessionId!==void 0&&(r.rootSessionId=e.rootSessionId),r.limits=resolveSessionLimits(e),e.outputSchema!==void 0&&(r.outputSchema=e.outputSchema),e.subagentDepth!==void 0&&(r.subagentDepth=e.subagentDepth),e.subagentMaxDepth!==void 0&&(r.subagentMaxDepth=e.subagentMaxDepth),e.workflowMaxSubagents!==void 0&&(r.workflowMaxSubagents=e.workflowMaxSubagents),r}function refreshSessionFromTurnAgent(e){return{...e.session,agent:{compactionModelReference:e.turnAgent.compactionModel,modelReference:e.turnAgent.model,reasoning:e.turnAgent.reasoning,system:createSessionSystemPrompt({skillRoot:e.skillRoot,turnAgent:e.turnAgent}),tools:createSessionToolDefinitions(e.turnAgent)},compaction:createCompactionConfig({contextWindowTokens:e.turnAgent.model.contextWindowTokens,lastKnownInputTokens:e.session.compaction.lastKnownInputTokens,lastKnownPromptMessageCount:e.session.compaction.lastKnownPromptMessageCount,thresholdPercent:e.compactionOverrides?.thresholdPercent})}}function createSessionSystemPrompt(t){let n=formatAvailableSkillsSection(t.turnAgent.availableSkills??[],{skillRoot:t.skillRoot});return(n===null?t.turnAgent.instructions:[...t.turnAgent.instructions,n]).join(`
 
-`),tools:n},compaction:createCompactionConfig({contextWindowTokens:t.model.contextWindowTokens,thresholdPercent:e.compactionOverrides?.thresholdPercent}),continuationToken:e.continuationToken,history:[],sessionId:e.sessionId};return e.rootSessionId!==void 0&&(r.rootSessionId=e.rootSessionId),r.limits=resolveSessionLimits(e),e.outputSchema!==void 0&&(r.outputSchema=e.outputSchema),e.subagentDepth!==void 0&&(r.subagentDepth=e.subagentDepth),e.subagentMaxDepth!==void 0&&(r.subagentMaxDepth=e.subagentMaxDepth),r}function refreshSessionFromTurnAgent(e){return{...e.session,agent:{compactionModelReference:e.turnAgent.compactionModel,modelReference:e.turnAgent.model,reasoning:e.turnAgent.reasoning,system:e.turnAgent.instructions.join(`
-
-`),tools:createSessionToolDefinitions(e.turnAgent)},compaction:createCompactionConfig({contextWindowTokens:e.turnAgent.model.contextWindowTokens,lastKnownInputTokens:e.session.compaction.lastKnownInputTokens,lastKnownPromptMessageCount:e.session.compaction.lastKnownPromptMessageCount,thresholdPercent:e.compactionOverrides?.thresholdPercent})}}function mintSubagentContinuationToken(e){return`subagent:${e??crypto.randomUUID()}`}function projectToDurableSession(e){let t={agent:{system:e.agent.system},continuationToken:e.continuationToken,history:e.history,sessionId:e.sessionId};return(e.compaction.lastKnownInputTokens!==void 0||e.compaction.lastKnownPromptMessageCount!==void 0)&&(t.compaction={lastKnownInputTokens:e.compaction.lastKnownInputTokens,lastKnownPromptMessageCount:e.compaction.lastKnownPromptMessageCount}),e.rootSessionId!==void 0&&(t.rootSessionId=e.rootSessionId),e.limits!==void 0&&(t.limits=e.limits),e.outputSchema!==void 0&&(t.outputSchema=e.outputSchema),e.sandboxState!==void 0&&(t.sandboxState=e.sandboxState),e.state!==void 0&&(t.state=e.state),e.subagentDepth!==void 0&&(t.subagentDepth=e.subagentDepth),e.subagentMaxDepth!==void 0&&(t.subagentMaxDepth=e.subagentMaxDepth),t}function hydrateDurableSession(e){let{durable:t,turnAgent:n}=e,r=createSessionToolDefinitions(n),i={agent:{compactionModelReference:n.compactionModel,modelReference:n.model,reasoning:n.reasoning,system:t.agent.system,tools:r},compaction:createCompactionConfig({contextWindowTokens:n.model.contextWindowTokens,lastKnownInputTokens:t.compaction?.lastKnownInputTokens,lastKnownPromptMessageCount:t.compaction?.lastKnownPromptMessageCount,thresholdPercent:e.compactionOverrides?.thresholdPercent}),continuationToken:t.continuationToken,history:t.history,sessionId:t.sessionId};return t.rootSessionId!==void 0&&(i.rootSessionId=t.rootSessionId),i.limits=resolveSessionLimits(t),t.outputSchema!==void 0&&(i.outputSchema=t.outputSchema),t.sandboxState!==void 0&&(i.sandboxState=t.sandboxState),t.state!==void 0&&(i.state=t.state),t.subagentDepth!==void 0&&(i.subagentDepth=t.subagentDepth),t.subagentMaxDepth!==void 0&&(i.subagentMaxDepth=t.subagentMaxDepth),i}function createSessionToolDefinitions(e){return e.tools.map(e=>({description:e.description??``,inputSchema:e.inputSchema,name:e.name,outputSchema:e.outputSchema}))}function resolveSessionLimits(e){let t=e.limits?.maxInputTokensPerSession??(e.subagentDepth!==void 0&&e.subagentDepth>0?5e6:4e7);return e.limits?.maxOutputTokensPerSession===void 0?{maxInputTokensPerSession:t}:{maxInputTokensPerSession:t,maxOutputTokensPerSession:e.limits.maxOutputTokensPerSession}}export{DEFAULT_ROOT_MAX_INPUT_TOKENS_PER_SESSION,DEFAULT_SUBAGENT_MAX_INPUT_TOKENS_PER_SESSION,createCompactionConfig,createSession,hydrateDurableSession,mintSubagentContinuationToken,projectToDurableSession,refreshSessionFromTurnAgent};
+`)}function mintSubagentContinuationToken(e){return`subagent:${e??crypto.randomUUID()}`}function projectToDurableSession(e){let t={agent:{system:e.agent.system},continuationToken:e.continuationToken,history:e.history,sessionId:e.sessionId};return(e.compaction.lastKnownInputTokens!==void 0||e.compaction.lastKnownPromptMessageCount!==void 0)&&(t.compaction={lastKnownInputTokens:e.compaction.lastKnownInputTokens,lastKnownPromptMessageCount:e.compaction.lastKnownPromptMessageCount}),e.rootSessionId!==void 0&&(t.rootSessionId=e.rootSessionId),e.limits!==void 0&&(t.limits=e.limits),e.outputSchema!==void 0&&(t.outputSchema=e.outputSchema),e.sandboxState!==void 0&&(t.sandboxState=e.sandboxState),e.state!==void 0&&(t.state=e.state),e.subagentDepth!==void 0&&(t.subagentDepth=e.subagentDepth),e.subagentMaxDepth!==void 0&&(t.subagentMaxDepth=e.subagentMaxDepth),e.workflowMaxSubagents!==void 0&&(t.workflowMaxSubagents=e.workflowMaxSubagents),t}function hydrateDurableSession(e){let{durable:t,turnAgent:n}=e,r=createSessionToolDefinitions(n),i={agent:{compactionModelReference:n.compactionModel,modelReference:n.model,reasoning:n.reasoning,system:t.agent.system,tools:r},compaction:createCompactionConfig({contextWindowTokens:n.model.contextWindowTokens,lastKnownInputTokens:t.compaction?.lastKnownInputTokens,lastKnownPromptMessageCount:t.compaction?.lastKnownPromptMessageCount,thresholdPercent:e.compactionOverrides?.thresholdPercent}),continuationToken:t.continuationToken,history:t.history,sessionId:t.sessionId};return t.rootSessionId!==void 0&&(i.rootSessionId=t.rootSessionId),t.limits!==void 0&&(i.limits=t.limits),t.outputSchema!==void 0&&(i.outputSchema=t.outputSchema),t.sandboxState!==void 0&&(i.sandboxState=t.sandboxState),t.state!==void 0&&(i.state=t.state),t.subagentDepth!==void 0&&(i.subagentDepth=t.subagentDepth),t.subagentMaxDepth!==void 0&&(i.subagentMaxDepth=t.subagentMaxDepth),t.workflowMaxSubagents!==void 0&&(i.workflowMaxSubagents=t.workflowMaxSubagents),i}function createSessionToolDefinitions(e){return e.tools.map(e=>({description:e.description??``,inputSchema:e.inputSchema,name:e.name,outputSchema:e.outputSchema}))}function resolveSessionLimits(e){let n=e.subagentDepth!==void 0&&e.subagentDepth>0,r=resolveSessionTokenLimit({authored:e.limits?.maxInputTokensPerSession,fallback:n?void 0:DEFAULT_ROOT_MAX_INPUT_TOKENS_PER_SESSION}),i=resolveSessionTokenLimit({authored:e.limits?.maxOutputTokensPerSession,fallback:void 0}),a={};return r!==void 0&&(a.maxInputTokensPerSession=r),i!==void 0&&(a.maxOutputTokensPerSession=i),a}function resolveSessionTokenLimit(e){return e.authored===!1?void 0:e.authored??e.fallback}export{DEFAULT_ROOT_MAX_INPUT_TOKENS_PER_SESSION,createCompactionConfig,createSession,hydrateDurableSession,mintSubagentContinuationToken,projectToDurableSession,refreshSessionFromTurnAgent};

package/dist/src/execution/skills/instructions.d.ts

@@ -1,19 +1,23 @@
-interface AvailableSkillDescription {
+export interface AvailableSkillDescription {
     readonly description: string;
     readonly name: string;
 }
+interface FormatAvailableSkillsSectionOptions {
+    readonly skillRoot?: string;
+}
 /**
  * Formats the "Available skills" system prompt section.
  *
  * All skills are always listed regardless of activation state. Active skill
  * instructions are never injected into the system prompt — the model already
- * has them from the `load_skill` tool result. This keeps the system
- * prompt identical across the entire session, preserving prompt caching.
+ * has them from the `load_skill` tool result. The caller may pass the active
+ * sandbox skill root so the model sees only the location that eve selected
+ * for this run.
  *
  * Authored skills call this at graph resolution time so the section is
  * part of the turn agent's static instructions. Dynamic skills
  * (`defineDynamic` in `agent/skills/`) reuse the same formatter for
  * durable context announcements.
  */
-export declare function formatAvailableSkillsSection(skills: readonly AvailableSkillDescription[]): string | null;
+export declare function formatAvailableSkillsSection(skills: readonly AvailableSkillDescription[], options?: FormatAvailableSkillsSectionOptions): string | null;
 export {};

package/dist/src/execution/skills/instructions.js

@@ -1,2 +1,2 @@
-import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";function formatAvailableSkillsSection(e){return e.length===0?null:[`Available skills`,`Listed skills are available in this run. Do not claim a listed skill is inaccessible unless activation or workspace inspection actually fails.`,`If the user names a skill or the request clearly matches one of the descriptions below, call load_skill before proceeding.`,`If multiple skills match, activate the minimal set that covers the task. After activation, follow the returned instructions instead of improvising around them.`,`If activation fails, say so briefly and continue with the best fallback. Packaged sibling files under a skill path can be inspected with bash or read_file when needed.`,...e.map(e=>formatAvailableSkillLine(e))].join(`
-`)}function formatAvailableSkillLine(t){return`- ${t.name}: ${t.description} (path: ${WORKSPACE_ROOT}/skills/${t.name}/SKILL.md)`}export{formatAvailableSkillsSection};
+function formatAvailableSkillsSection(e,t={}){return e.length===0?null:[`Available skills`,`Listed skills are available in this run. Do not claim a listed skill is inaccessible unless activation or workspace inspection actually fails.`,`If the user names a skill or the request clearly matches one of the descriptions below, call load_skill before proceeding.`,`If multiple skills match, activate the minimal set that covers the task. After activation, follow the returned instructions instead of improvising around them.`,`If activation fails, say so briefly and continue with the best available alternative.`,formatSkillLocationLine(t),"When a loaded SKILL.md mentions sibling files such as `references/foo.md`, resolve them relative to the directory containing that specific SKILL.md.",...e.map(e=>formatAvailableSkillLine({skill:e,skillRoot:t.skillRoot}))].join(`
+`)}function formatSkillLocationLine(e){return e.skillRoot===void 0?`Skill files are available after load_skill resolves the active sandbox skill location.`:`Skill files live under \`${e.skillRoot}/<skill>/\`.`}function formatAvailableSkillLine(e){let t=`- ${e.skill.name}: ${e.skill.description}`;return e.skillRoot===void 0?t:`${t} (path: ${e.skillRoot}/${e.skill.name}/SKILL.md)`}export{formatAvailableSkillsSection};

package/dist/src/execution/subagent-tool.d.ts

@@ -39,6 +39,13 @@ export declare function buildSubagentRunInput(input: {
      */
     readonly capabilities?: SessionCapabilities;
     readonly channelMetadata?: ChannelInstrumentationProjection;
+    /**
+     * Number of local subagent calls dispatched in this batch. The parent's
+     * remaining token quota is split evenly across them so parallel children
+     * are collectively, not individually, bounded by it. Remote agents run
+     * under their own deployment's limits and are not counted.
+     */
+    readonly fanoutSize?: number;
     readonly initiatorAuth: SessionAuthContext | null;
     /** Hook token owned by the workflow currently waiting for this child. */
     readonly parentContinuationToken?: string;

package/dist/src/execution/subagent-tool.js

@@ -1 +1 @@
-import{mintSubagentContinuationToken}from"#execution/session.js";import{SUBAGENT_ADAPTER_KIND}from"#execution/subagent-adapter.js";import{resolveSubagentDelegationLimit}from"#harness/subagent-depth.js";import{formatSubagentInput}from"#execution/subagent-invocation.js";function buildSubagentRunInput(n){let{action:r,auth:i,batchEvent:a,capabilities:o,channelMetadata:s,initiatorAuth:c,session:l,source:u}=n,d=mintSubagentContinuationToken(`${l.sessionId}:${r.callId}`),f=l.rootSessionId??l.sessionId,p=resolveSubagentDelegationLimit(l);return{childContinuationToken:d,runInput:{adapter:{kind:SUBAGENT_ADAPTER_KIND,state:{callId:r.callId,parentContinuationToken:n.parentContinuationToken??l.continuationToken,parentSessionId:l.sessionId,subagentName:r.subagentName,...r.subagentName===`agent`&&l.sandboxState?{parentSandboxState:l.sandboxState,sandboxSessionId:l.sessionId}:{}}},auth:i,capabilities:o,channelMetadata:s,continuationToken:d,initiatorAuth:c,input:{message:formatSubagentCallInputMessage({action:r,source:u}),outputSchema:r.input.outputSchema},mode:`task`,parent:{callId:r.callId,rootSessionId:f,sessionId:l.sessionId,turn:{id:a.turnId,sequence:a.sequence}},subagentDepth:p.nextChildDepth,subagentMaxDepth:l.subagentMaxDepth}}}function formatSubagentCallInputMessage(e){let{message:t}=e.action.input;switch(e.source.type){case`local`:return formatSubagentInput({description:e.source.description,message:t,name:e.action.subagentName,type:`local`}).message;case`runtime`:return formatSubagentInput({message:t,name:e.action.subagentName,type:`runtime`}).message;default:return e.source}}export{buildSubagentRunInput};
+import{mintSubagentContinuationToken}from"#execution/session.js";import{SUBAGENT_ADAPTER_KIND}from"#execution/subagent-adapter.js";import{resolveSubagentDelegationLimit}from"#harness/subagent-depth.js";import{formatSubagentInput}from"#execution/subagent-invocation.js";import{resolveRemainingSessionTokenLimits}from"#harness/subagent-token-budget.js";function buildSubagentRunInput(n){let{action:r,auth:i,batchEvent:a,capabilities:o,channelMetadata:s,initiatorAuth:c,session:l,source:u}=n,d=mintSubagentContinuationToken(`${l.sessionId}:${r.callId}`),f=l.rootSessionId??l.sessionId,p=resolveSubagentDelegationLimit(l),m=resolveRemainingSessionTokenLimits(l,n.fanoutSize);return l.subagentMaxDepth!==void 0&&(m.maxSubagentDepth=l.subagentMaxDepth),l.workflowMaxSubagents!==void 0&&(m.maxSubagents=l.workflowMaxSubagents),{childContinuationToken:d,runInput:{adapter:{kind:SUBAGENT_ADAPTER_KIND,state:{callId:r.callId,parentContinuationToken:n.parentContinuationToken??l.continuationToken,parentSessionId:l.sessionId,subagentName:r.subagentName,...r.subagentName===`agent`&&l.sandboxState?{parentSandboxState:l.sandboxState,sandboxSessionId:l.sessionId}:{}}},auth:i,capabilities:o,channelMetadata:s,continuationToken:d,initiatorAuth:c,input:{message:formatSubagentCallInputMessage({action:r,source:u}),outputSchema:r.input.outputSchema},limits:m,mode:`task`,parent:{callId:r.callId,rootSessionId:f,sessionId:l.sessionId,turn:{id:a.turnId,sequence:a.sequence}},subagentDepth:p.nextChildDepth}}}function formatSubagentCallInputMessage(e){let{message:t}=e.action.input;switch(e.source.type){case`local`:return formatSubagentInput({description:e.source.description,message:t,name:e.action.subagentName,type:`local`}).message;case`runtime`:return formatSubagentInput({message:t,name:e.action.subagentName,type:`runtime`}).message;default:return e.source}}export{buildSubagentRunInput};

package/dist/src/execution/subagent-usage-span.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeActionResult } from "#runtime/actions/types.js";
+/**
+ * Emits one caller-side `invoke_agent` span per successful delegated
+ * subagent result that reports token usage, so the parent session's
+ * observability can attribute a child agent's tokens. Runs in the
+ * parent's turn step, so the span lands in the caller's trace.
+ * Best-effort: a tracer failure never blocks the turn.
+ */
+export declare function recordSubagentUsageSpans(results: readonly RuntimeActionResult[]): void;

package/dist/src/execution/subagent-usage-span.js

@@ -0,0 +1 @@
+import{createLogger}from"#internal/logging.js";import{trace}from"#compiled/@opentelemetry/api/index.js";const log=createLogger(`execution.subagent-usage-span`);function recordSubagentUsageSpans(e){for(let t of e){if(t.kind!==`subagent-result`||t.isError===!0)continue;let e=t.usage;if(e!==void 0)try{trace.getTracer(`eve`).startSpan(`invoke_agent ${t.subagentName}`,{attributes:{"gen_ai.operation.name":`invoke_agent`,"gen_ai.agent.name":t.subagentName,"gen_ai.usage.input_tokens":e.inputTokens,"gen_ai.usage.output_tokens":e.outputTokens,"gen_ai.usage.cache_read.input_tokens":e.cacheReadTokens,"gen_ai.usage.cache_creation.input_tokens":e.cacheWriteTokens}}).end()}catch(e){log.warn(`failed to emit subagent usage span`,{error:e})}}}export{recordSubagentUsageSpans};

package/dist/src/execution/tool-auth.d.ts

@@ -12,6 +12,7 @@
  * `runtime/connections/scoped-authorization.ts`; this module is the thin
  * execution-layer adapter that wraps one tool's `execute`.
  */
+import type { ToolExecuteOptions } from "#shared/tool-definition.js";
 /**
  * Wraps one authored tool's `execute` with a context that supports inline
  * provider auth (`ctx.getToken(connect("..."))`).
@@ -30,4 +31,4 @@
 export declare function createToolExecuteWithAuth(input: {
     readonly scope: string;
     readonly execute: (toolInput: unknown, ctx: unknown) => unknown;
-}): (toolInput: unknown) => Promise<unknown>;
+}): (toolInput: unknown, options: ToolExecuteOptions) => Promise<unknown>;

package/dist/src/execution/tool-auth.js

@@ -1 +1 @@
-import{buildCallbackContext}from"#context/build-callback-context.js";import{ConnectionAuthorizationFailedError,ConnectionAuthorizationRequiredError,isConnectionAuthorizationRequiredError}from"#public/connections/errors.js";import{requestAuthorization}from"#harness/authorization.js";import{supportsInteractiveAuthorization}from"#runtime/connections/types.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";import{completeScopedAuthorization,evictScopedToken,resolveScopedToken,startScopedAuthorization}from"#runtime/connections/scoped-authorization.js";function createToolExecuteWithAuth(e){let{scope:t,execute:n}=e;return async e=>{let r=new Set;try{return await n(e,buildToolContext({inlineAuthState:{},justAuthorizedScopes:r,scope:t}))}catch(e){if(isToolAuthorizationRequiredError(e))return await handleAuthorizationRequests(e.requests);throw e}}}function buildToolContext(t){let{scope:n,justAuthorizedScopes:r,inlineAuthState:i}=t;return{...buildCallbackContext(),async getToken(e,t){if(e===void 0)throw missingProviderError(`ctx.getToken`);return await resolveInlineToken({inlineAuthState:i,justAuthorizedScopes:r,options:t,provider:e,toolScope:n})},requireAuth(e,t){if(e===void 0)throw missingProviderError(`ctx.requireAuth`);let a=buildInlineScopedAuthorization({inlineAuthState:i,options:t,provider:e,toolScope:n});throw new ToolAuthorizationRequiredError([{justAuthorized:r.has(a.scope),scoped:a}])}}}async function resolveInlineToken(e){let{justAuthorizedScopes:t}=e,n=buildInlineScopedAuthorization(e);!t.has(n.scope)&&await completeScopedAuthorization(n)&&t.add(n.scope);try{return await resolveScopedToken(n)}catch(e){throw isConnectionAuthorizationRequiredError(e)?new ToolAuthorizationRequiredError([{cause:e,justAuthorized:t.has(n.scope),scoped:n}]):e}}async function handleAuthorizationRequests(e){let r=[],o;for(let i of e){let{scoped:e}=i;if(i.justAuthorized)throw new ConnectionAuthorizationFailedError(e.scope,{message:`Tool "${e.scope}" rejected the token immediately after authorization.`,reason:`token_rejected_after_authorization`,retryable:!1});await evictScopedToken(e);let s=await startScopedAuthorization(e);if(s!==void 0){r.push(...s.challenges);continue}if(supportsInteractiveAuthorization(e.authorization))throw new ConnectionAuthorizationFailedError(e.scope,{message:`Tool "${e.scope}" requires sign-in, but no authorization callback URL could be minted for this run (missing session context).`,reason:`authorization_callback_unavailable`,retryable:!1});o??=i.cause instanceof Error?i.cause:new ConnectionAuthorizationRequiredError(e.scope)}if(r.length>0)return requestAuthorization(r);throw o??Error(`Tool authorization is required.`)}function buildInlineScopedAuthorization(e){let t=normalizeInlineProvider(e.provider,e.options);return{authorization:t,connection:e.options?.connection??{url:``},scope:e.options?.authKey===void 0?deriveInlineScope({authorization:t,inlineAuthState:e.inlineAuthState,provider:e.provider,toolScope:e.toolScope}):validateInlineAuthKey(e.options.authKey)}}function normalizeInlineProvider(e,t){let n=normalizeAuthorizationSpec(e,`ctx.getToken:`,`provider`);if(t?.displayName===void 0)return n;if(t.displayName.length===0)throw Error(`ctx.getToken: The "options.displayName" field must be a non-empty string.`);return{...n,displayName:t.displayName}}function deriveInlineScope(e){let t=e.authorization.vercelConnect?.connector;if(t!==void 0)return`${e.toolScope}__${sanitizeScopeSegment(t)}`;if(e.inlineAuthState.anonymousProvider===void 0)e.inlineAuthState.anonymousProvider=e.provider;else if(e.inlineAuthState.anonymousProvider!==e.provider)throw Error(`ctx.getToken: Multiple inline auth providers without provider metadata need explicit auth keys. Pass options.authKey for each provider, for example ctx.getToken(auth, { authKey: "github" }).`);return`${e.toolScope}__inline_auth`}function validateInlineAuthKey(e){if(!/^[A-Za-z0-9_.:-]+$/u.test(e))throw Error(`ctx.getToken: The "options.authKey" field must contain only letters, digits, "_", "-", ".", or ":".`);return e}function sanitizeScopeSegment(e){let t=e.replace(/[^A-Za-z0-9_.:-]+/gu,`_`).replace(/^_+|_+$/gu,``);return t.length>0?t:`provider`}var ToolAuthorizationRequiredError=class extends Error{requests;constructor(e){super(`Tool authorization required.`),this.name=`ToolAuthorizationRequiredError`,this.requests=e}};function isToolAuthorizationRequiredError(e){return e instanceof Error&&e.name===`ToolAuthorizationRequiredError`}function missingProviderError(e){return Error(`${e}: Pass an auth provider, for example ${e}(connect("github/myagent")).`)}export{createToolExecuteWithAuth};
+import{buildBaseToolContext}from"#context/build-base-tool-context.js";import{ConnectionAuthorizationFailedError,ConnectionAuthorizationRequiredError,isConnectionAuthorizationRequiredError}from"#public/connections/errors.js";import{requestAuthorization}from"#harness/authorization.js";import{supportsInteractiveAuthorization}from"#runtime/connections/types.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";import{completeScopedAuthorization,evictScopedToken,resolveScopedToken,startScopedAuthorization}from"#runtime/connections/scoped-authorization.js";function createToolExecuteWithAuth(e){let{scope:t,execute:n}=e;return async(e,r)=>{let i=new Set;try{return await n(e,buildToolContext({inlineAuthState:{},justAuthorizedScopes:i,options:r,scope:t}))}catch(e){if(isToolAuthorizationRequiredError(e))return await handleAuthorizationRequests(e.requests);throw e}}}function buildToolContext(t){let{scope:n,justAuthorizedScopes:r,inlineAuthState:i}=t;return{...buildBaseToolContext(t.options),async getToken(e,t){if(e===void 0)throw missingProviderError(`ctx.getToken`);return await resolveInlineToken({inlineAuthState:i,justAuthorizedScopes:r,options:t,provider:e,toolScope:n})},requireAuth(e,t){if(e===void 0)throw missingProviderError(`ctx.requireAuth`);let a=buildInlineScopedAuthorization({inlineAuthState:i,options:t,provider:e,toolScope:n});throw new ToolAuthorizationRequiredError([{justAuthorized:r.has(a.scope),scoped:a}])}}}async function resolveInlineToken(e){let{justAuthorizedScopes:t}=e,n=buildInlineScopedAuthorization(e);!t.has(n.scope)&&await completeScopedAuthorization(n)&&t.add(n.scope);try{return await resolveScopedToken(n)}catch(e){throw isConnectionAuthorizationRequiredError(e)?new ToolAuthorizationRequiredError([{cause:e,justAuthorized:t.has(n.scope),scoped:n}]):e}}async function handleAuthorizationRequests(e){let r=[],o;for(let i of e){let{scoped:e}=i;if(i.justAuthorized)throw new ConnectionAuthorizationFailedError(e.scope,{message:`Tool "${e.scope}" rejected the token immediately after authorization.`,reason:`token_rejected_after_authorization`,retryable:!1});await evictScopedToken(e);let s=await startScopedAuthorization(e);if(s!==void 0){r.push(...s.challenges);continue}if(supportsInteractiveAuthorization(e.authorization))throw new ConnectionAuthorizationFailedError(e.scope,{message:`Tool "${e.scope}" requires sign-in, but no authorization callback URL could be minted for this run (missing session context).`,reason:`authorization_callback_unavailable`,retryable:!1});o??=i.cause instanceof Error?i.cause:new ConnectionAuthorizationRequiredError(e.scope)}if(r.length>0)return requestAuthorization(r);throw o??Error(`Tool authorization is required.`)}function buildInlineScopedAuthorization(e){let t=normalizeInlineProvider(e.provider,e.options);return{authorization:t,connection:e.options?.connection??{url:``},scope:e.options?.authKey===void 0?deriveInlineScope({authorization:t,inlineAuthState:e.inlineAuthState,provider:e.provider,toolScope:e.toolScope}):validateInlineAuthKey(e.options.authKey)}}function normalizeInlineProvider(e,t){let n=normalizeAuthorizationSpec(e,`ctx.getToken:`,`provider`);if(t?.displayName===void 0)return n;if(t.displayName.length===0)throw Error(`ctx.getToken: The "options.displayName" field must be a non-empty string.`);return{...n,displayName:t.displayName}}function deriveInlineScope(e){let t=e.authorization.vercelConnect?.connector;if(t!==void 0)return`${e.toolScope}__${sanitizeScopeSegment(t)}`;if(e.inlineAuthState.anonymousProvider===void 0)e.inlineAuthState.anonymousProvider=e.provider;else if(e.inlineAuthState.anonymousProvider!==e.provider)throw Error(`ctx.getToken: Multiple inline auth providers without provider metadata need explicit auth keys. Pass options.authKey for each provider, for example ctx.getToken(auth, { authKey: "github" }).`);return`${e.toolScope}__inline_auth`}function validateInlineAuthKey(e){if(!/^[A-Za-z0-9_.:-]+$/u.test(e))throw Error(`ctx.getToken: The "options.authKey" field must contain only letters, digits, "_", "-", ".", or ":".`);return e}function sanitizeScopeSegment(e){let t=e.replace(/[^A-Za-z0-9_.:-]+/gu,`_`).replace(/^_+|_+$/gu,``);return t.length>0?t:`provider`}var ToolAuthorizationRequiredError=class extends Error{requests;constructor(e){super(`Tool authorization required.`),this.name=`ToolAuthorizationRequiredError`,this.requests=e}};function isToolAuthorizationRequiredError(e){return e instanceof Error&&e.name===`ToolAuthorizationRequiredError`}function missingProviderError(e){return Error(`${e}: Pass an auth provider, for example ${e}(connect("github/myagent")).`)}export{createToolExecuteWithAuth};

package/dist/src/execution/turn-execution-cursor.d.ts

@@ -2,6 +2,7 @@ import type { DeliverHookPayload, HookPayload } from "#channel/types.js";
 import type { TurnControlPayload } from "#execution/turn-control-protocol.js";
 import type { DurableSessionState } from "#execution/durable-session-store.js";
 import type { TurnStepInput } from "#execution/durable-session-migrations/turn-workflow.js";
+import type { TokenUsage } from "#shared/token-usage.js";
 interface TurnTransition {
     readonly serializedContext?: Record<string, unknown>;
     readonly sessionState: DurableSessionState;
@@ -10,6 +11,7 @@ type TurnTerminalAction = {
     readonly isError?: boolean;
     readonly kind: "done";
     readonly output: unknown;
+    readonly usage?: TokenUsage;
 } | {
     readonly authorizationNames?: readonly string[];
     readonly kind: "park";