eve 0.31.3 → 0.32.0

package/dist/src/compiler/extension-compatibility.d.ts

@@ -11,23 +11,23 @@ declare const EXTENSION_CAPABILITY_CONTRACTS: {
         readonly dropped: {};
     };
     readonly tool: {
-        readonly current: 9;
-        readonly supported: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9];
+        readonly current: 11;
+        readonly supported: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11];
         readonly dropped: {};
     };
     readonly dynamicTool: {
-        readonly current: 10;
-        readonly supported: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+        readonly current: 12;
+        readonly supported: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
         readonly dropped: {};
     };
     readonly connection: {
-        readonly current: 3;
-        readonly supported: readonly [1, 2, 3];
+        readonly current: 4;
+        readonly supported: readonly [1, 2, 3, 4];
         readonly dropped: {};
     };
     readonly hook: {
-        readonly current: 8;
-        readonly supported: readonly [1, 2, 3, 4, 5, 6, 7, 8];
+        readonly current: 9;
+        readonly supported: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9];
         readonly dropped: {};
     };
     readonly skill: {
@@ -56,8 +56,8 @@ declare const EXTENSION_CAPABILITY_CONTRACTS: {
         readonly dropped: {};
     };
     readonly state: {
-        readonly current: 2;
-        readonly supported: readonly [1, 2];
+        readonly current: 3;
+        readonly supported: readonly [1, 2, 3];
         readonly dropped: {};
     };
 };

package/dist/src/compiler/extension-compatibility.js

@@ -1 +1 @@
-import{readFile,writeFile}from"node:fs/promises";import{z}from"#compiled/zod/index.js";import{join}from"node:path";import{formatValidationError}from"#runtime/validation.js";const EXTENSION_COMPATIBILITY_MANIFEST_KIND=`eve-extension`,EXTENSION_COMPATIBILITY_MANIFEST_FORMAT_VERSION=1,EXTENSION_COMPATIBILITY_MANIFEST_FILENAME=`_manifest.json`,EXTENSION_CAPABILITY_CONTRACTS={extension:{current:1,supported:[1],dropped:{}},tool:{current:9,supported:[1,2,3,4,5,6,7,8,9],dropped:{}},dynamicTool:{current:10,supported:[1,2,3,4,5,6,7,8,9,10],dropped:{}},connection:{current:3,supported:[1,2,3],dropped:{}},hook:{current:8,supported:[1,2,3,4,5,6,7,8],dropped:{}},skill:{current:1,supported:[1],dropped:{}},dynamicSkill:{current:7,supported:[1,2,3,4,5,6,7],dropped:{}},instructions:{current:1,supported:[1],dropped:{}},dynamicInstructions:{current:7,supported:[1,2,3,4,5,6,7],dropped:{}},config:{current:1,supported:[1],dropped:{}},state:{current:2,supported:[1,2],dropped:{}}},EXTENSION_CAPABILITY_VERSIONS=Object.fromEntries(Object.entries(EXTENSION_CAPABILITY_CONTRACTS).map(([e,t])=>[e,t.current])),EXTENSION_CAPABILITY_SUPPORT=Object.keys(EXTENSION_CAPABILITY_CONTRACTS).reduce((e,t)=>(e[t]=EXTENSION_CAPABILITY_CONTRACTS[t].supported,e),{}),extensionCompatibilityManifestSchema=z.object({kind:z.literal(EXTENSION_COMPATIBILITY_MANIFEST_KIND),formatVersion:z.literal(1),builtWithEve:z.string().min(1),requires:z.record(z.string(),z.number().int().positive())}).strict();function serializeExtensionCompatibilityManifest(e){return`${JSON.stringify(e,null,2)}\n`}function parseExtensionCompatibilityManifest(e,t){let n;try{n=JSON.parse(e)}catch(e){throw Error(`Extension compatibility manifest "${t}" is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let r=extensionCompatibilityManifestSchema.safeParse(n);if(!r.success)throw Error(`Extension compatibility manifest "${t}" is invalid. ${formatValidationError(r.error)}`);return r.data}async function readExtensionCompatibilityManifest(t){return parseExtensionCompatibilityManifest(await readFile(t,`utf8`),t)}async function writeExtensionCompatibilityManifest(e,n){await writeFile(join(e,EXTENSION_COMPATIBILITY_MANIFEST_FILENAME),serializeExtensionCompatibilityManifest(n),`utf8`)}function findUnsupportedExtensionCapabilities(e,t=EXTENSION_CAPABILITY_SUPPORT){return Object.entries(e.requires).flatMap(([e,n])=>{let r=Object.hasOwn(t,e)?t[e]??[]:[];return r.includes(n)?[]:[{capability:e,requiredVersion:n,supportedVersions:r}]}).sort((e,t)=>e.capability.localeCompare(t.capability))}export{EXTENSION_CAPABILITY_SUPPORT,EXTENSION_CAPABILITY_VERSIONS,EXTENSION_COMPATIBILITY_MANIFEST_FILENAME,EXTENSION_COMPATIBILITY_MANIFEST_FORMAT_VERSION,EXTENSION_COMPATIBILITY_MANIFEST_KIND,findUnsupportedExtensionCapabilities,parseExtensionCompatibilityManifest,readExtensionCompatibilityManifest,serializeExtensionCompatibilityManifest,writeExtensionCompatibilityManifest};
+import{readFile,writeFile}from"node:fs/promises";import{z}from"#compiled/zod/index.js";import{join}from"node:path";import{formatValidationError}from"#runtime/validation.js";const EXTENSION_COMPATIBILITY_MANIFEST_KIND=`eve-extension`,EXTENSION_COMPATIBILITY_MANIFEST_FORMAT_VERSION=1,EXTENSION_COMPATIBILITY_MANIFEST_FILENAME=`_manifest.json`,EXTENSION_CAPABILITY_CONTRACTS={extension:{current:1,supported:[1],dropped:{}},tool:{current:11,supported:[1,2,3,4,5,6,7,8,9,10,11],dropped:{}},dynamicTool:{current:12,supported:[1,2,3,4,5,6,7,8,9,10,11,12],dropped:{}},connection:{current:4,supported:[1,2,3,4],dropped:{}},hook:{current:9,supported:[1,2,3,4,5,6,7,8,9],dropped:{}},skill:{current:1,supported:[1],dropped:{}},dynamicSkill:{current:7,supported:[1,2,3,4,5,6,7],dropped:{}},instructions:{current:1,supported:[1],dropped:{}},dynamicInstructions:{current:7,supported:[1,2,3,4,5,6,7],dropped:{}},config:{current:1,supported:[1],dropped:{}},state:{current:3,supported:[1,2,3],dropped:{}}},EXTENSION_CAPABILITY_VERSIONS=Object.fromEntries(Object.entries(EXTENSION_CAPABILITY_CONTRACTS).map(([e,t])=>[e,t.current])),EXTENSION_CAPABILITY_SUPPORT=Object.keys(EXTENSION_CAPABILITY_CONTRACTS).reduce((e,t)=>(e[t]=EXTENSION_CAPABILITY_CONTRACTS[t].supported,e),{}),extensionCompatibilityManifestSchema=z.object({kind:z.literal(EXTENSION_COMPATIBILITY_MANIFEST_KIND),formatVersion:z.literal(1),builtWithEve:z.string().min(1),requires:z.record(z.string(),z.number().int().positive())}).strict();function serializeExtensionCompatibilityManifest(e){return`${JSON.stringify(e,null,2)}\n`}function parseExtensionCompatibilityManifest(e,t){let n;try{n=JSON.parse(e)}catch(e){throw Error(`Extension compatibility manifest "${t}" is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let r=extensionCompatibilityManifestSchema.safeParse(n);if(!r.success)throw Error(`Extension compatibility manifest "${t}" is invalid. ${formatValidationError(r.error)}`);return r.data}async function readExtensionCompatibilityManifest(t){return parseExtensionCompatibilityManifest(await readFile(t,`utf8`),t)}async function writeExtensionCompatibilityManifest(e,n){await writeFile(join(e,EXTENSION_COMPATIBILITY_MANIFEST_FILENAME),serializeExtensionCompatibilityManifest(n),`utf8`)}function findUnsupportedExtensionCapabilities(e,t=EXTENSION_CAPABILITY_SUPPORT){return Object.entries(e.requires).flatMap(([e,n])=>{let r=Object.hasOwn(t,e)?t[e]??[]:[];return r.includes(n)?[]:[{capability:e,requiredVersion:n,supportedVersions:r}]}).sort((e,t)=>e.capability.localeCompare(t.capability))}export{EXTENSION_CAPABILITY_SUPPORT,EXTENSION_CAPABILITY_VERSIONS,EXTENSION_COMPATIBILITY_MANIFEST_FILENAME,EXTENSION_COMPATIBILITY_MANIFEST_FORMAT_VERSION,EXTENSION_COMPATIBILITY_MANIFEST_KIND,findUnsupportedExtensionCapabilities,parseExtensionCompatibilityManifest,readExtensionCompatibilityManifest,serializeExtensionCompatibilityManifest,writeExtensionCompatibilityManifest};

package/dist/src/context/build-callback-context.js

@@ -1 +1 @@
-import{SandboxKey,SessionKey}from"#context/keys.js";import{loadContext}from"#context/container.js";import{createSandboxSkillHandle}from"#runtime/skills/sandbox-access.js";function buildCallbackContext(){let r=loadContext(),i=r.require(SessionKey);return{session:{id:i.sessionId,auth:i.auth,turn:i.turn,parent:i.parent},getSandbox(){let t=r.get(SandboxKey);if(t===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSandbox() only from authored runtime functions such as tools, hooks, and channel events.`);return t.get().then(e=>{if(e===null)throw Error(`The sandbox is not available in the current authored runtime context.`);return e})},getSkill(t){let n=r.get(SandboxKey);if(n===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSkill() only from authored runtime functions such as tools, hooks, and channel events.`);return createSandboxSkillHandle(n,t)}}}export{buildCallbackContext};
+import{SandboxKey,SessionKey}from"#context/keys.js";import{loadContext}from"#context/container.js";import{createSandboxSkillHandle}from"#runtime/skills/sandbox-access.js";function buildCallbackContext(){let r=loadContext(),i=r.require(SessionKey);return{session:{id:i.sessionId,auth:i.auth,turn:i.turn,parent:i.parent},getSandbox(){let t=r.get(SandboxKey);if(t===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSandbox() only from authored runtime functions such as tools, hooks, and channel events.`);return t.get().then(e=>{if(e===null)throw Error(`The sandbox is not available in the current authored runtime context.`);return withRuntimeSandboxStop(e,async()=>await t.stop())})},getSkill(t){let n=r.get(SandboxKey);if(n===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSkill() only from authored runtime functions such as tools, hooks, and channel events.`);return createSandboxSkillHandle(n,t)}}}function withRuntimeSandboxStop(e,t){return{id:e.id,readBinaryFile:t=>e.readBinaryFile(t),readFile:t=>e.readFile(t),readTextFile:t=>e.readTextFile(t),removePath:t=>e.removePath(t),resolvePath:t=>e.resolvePath(t),run:t=>e.run(t),setNetworkPolicy:t=>e.setNetworkPolicy(t),spawn:t=>e.spawn(t),stop:t,writeBinaryFile:t=>e.writeBinaryFile(t),writeFile:t=>e.writeFile(t),writeTextFile:t=>e.writeTextFile(t)}}export{buildCallbackContext};

package/dist/src/execution/authorization-callback-match.d.ts

@@ -0,0 +1,14 @@
+import type { DeliverPayload } from "#channel/types.js";
+import type { AuthorizationResult, PendingAuthorizationState } from "#harness/authorization.js";
+import type { ConnectionAuthorizationChallenge } from "#public/connections/errors.js";
+export interface MatchedAuthorizationCallback {
+    readonly authorization: ConnectionAuthorizationChallenge;
+    readonly result: {
+        readonly name: string;
+    } & AuthorizationResult;
+}
+/** Matches current callbacks by attempt ID and legacy callbacks only to legacy state. */
+export declare function matchAuthorizationCallbacks(pending: PendingAuthorizationState, payloads: readonly DeliverPayload[]): {
+    readonly matches: readonly MatchedAuthorizationCallback[];
+    readonly remainingPayloads: readonly DeliverPayload[];
+};

package/dist/src/execution/authorization-callback-match.js

@@ -0,0 +1 @@
+function matchAuthorizationCallbacks(e,t){let n=[],r=[],i=new Set;for(let a of t){let t=a.authorizationCallback;if(t===void 0){r.push(a);continue}let o=e.challenges.find(e=>e.name===t.connectionName?t.legacy===!0?e.attemptId===void 0:e.attemptId===t.attemptId:!1),s=o?.attemptId??o?.name;o===void 0||s===void 0||o.principal===void 0&&t.legacy!==!0||i.has(s)||(i.add(s),n.push({authorization:o.challenge,result:{attemptId:o.attemptId,callback:t.callback,hookUrl:o.hookUrl,name:o.name,principal:o.principal,resume:o.resume}}))}return{matches:n,remainingPayloads:r}}export{matchAuthorizationCallbacks};

package/dist/src/execution/next-driver-action.d.ts

@@ -33,6 +33,7 @@ export type NextDriverAction = {
     readonly kind: "park";
     readonly sessionState: DurableSessionState;
     readonly serializedContext: Record<string, unknown>;
+    readonly authorizationAttemptIds?: readonly string[];
     readonly authorizationNames?: readonly string[];
     /**
      * Set when the parked turn was cancelled: the driver runs

package/dist/src/execution/parked-delivery-wait.d.ts

@@ -1,6 +1,13 @@
 import type { DeliverHookPayload, DeliverPayload } from "#channel/types.js";
 import type { DurableSessionState } from "#execution/durable-session-store.js";
 import type { SessionCommandInbox } from "#execution/session-command-inbox.js";
+/** One authorization-callback read surfaced during a parked wait. */
+export interface AuthorizationCallbackInstruction {
+    readonly kind: "authorization";
+    /** True when the authorization hook closed; no further callbacks can arrive. */
+    readonly closed: boolean;
+    readonly payloads: readonly DeliverPayload[];
+}
 /** What the parked driver should do with the next session activity. */
 export type NextTurnInstruction = {
     readonly kind: "clear";
@@ -14,7 +21,7 @@ export type NextTurnInstruction = {
     readonly kind: "closed";
 } | {
     readonly kind: "cancel-turn";
-} | {
+} | AuthorizationCallbackInstruction | {
     readonly kind: "turn";
     readonly deliver: DeliverHookPayload;
     readonly remainder: DeliverPayload;
@@ -25,11 +32,19 @@ export type NextTurnInstruction = {
  * no turn to run, so this keeps waiting until a delivery produces a parent
  * turn, a cancellation, expiry, or hook closure. The wait is unbounded by
  * design: a parked session lives until something addresses it.
+ *
+ * With `awaitAuthorizationCallbacks`, the inbox's authorization window stays
+ * open for the whole wait — including iterations that consume activity
+ * without producing a parent turn (no-op cancels, fully-routed descendant
+ * deliveries) — so an open challenge's callback surfaces as an
+ * `"authorization"` instruction no matter when it arrives.
  */
 export declare function nextTurnDelivery(input: {
+    readonly awaitAuthorizationCallbacks?: boolean;
     readonly bufferedDeliveries: DeliverHookPayload[];
     readonly bufferedSessionControls: Array<"clear" | "compact" | "expired" | "reset">;
     readonly commandInbox: SessionCommandInbox;
+    readonly deferDeliveries?: boolean;
     readonly driverWritable: WritableStream<Uint8Array>;
     readonly sessionState: DurableSessionState;
 }): Promise<NextTurnInstruction>;

package/dist/src/execution/parked-delivery-wait.js

@@ -1 +1 @@
-import{coalesceDeliveries}from"#harness/messages.js";import{routeDeliverToChildren}from"#execution/route-child-delivery.js";import{sendCommandToDelivery}from"#execution/session-command-wire.js";async function nextTurnDelivery(e){for(;;){let n=await waitForNextSessionAction({bufferedDeliveries:e.bufferedDeliveries,bufferedSessionControls:e.bufferedSessionControls,commandInbox:e.commandInbox});if(n.kind!==`delivery`)return{kind:n.kind};let r=n.delivery;if(r===null)return{kind:`closed`};let i=await routeDeliverToChildren({auth:r.auth,parentWritable:e.driverWritable,payloads:r.payloads,sessionState:e.sessionState});if(i.kind===`cancel-turn`)return{kind:`cancel-turn`};if(i.remainder!==void 0)return{deliver:r,kind:`turn`,remainder:i.remainder}}}async function waitForNextSessionAction(e){let t=e.bufferedSessionControls.shift();if(t!==void 0)return{kind:t};if(e.bufferedDeliveries.length>0)return{delivery:takeBufferedTurnDelivery(e.bufferedDeliveries),kind:`delivery`};for(;;){let t=await e.commandInbox.next();if(e.commandInbox.consumeNext(),t.done)return{delivery:null,kind:`delivery`};if(t.value.kind===`session-timeout`)return{kind:`expired`};if(t.value.kind===`clear`||t.value.kind===`compact`||t.value.kind===`reset`)return{kind:t.value.kind};if(t.value.kind!==`cancel`)return t.value.kind===`deliver`?{delivery:t.value,kind:`delivery`}:{delivery:sendCommandToDelivery(t.value),kind:`delivery`}}}function takeBufferedTurnDelivery(t){let n=t.shift();if(n===void 0)throw Error(`Cannot take a turn delivery from an empty buffer.`);let r=[n],i=n.caller;for(;t.length>0;){let e=t[0];if(e===void 0||i!==void 0&&e.caller!==void 0)break;let n=t.shift();if(n===void 0)throw Error(`Buffered turn delivery disappeared while partitioning.`);r.push(n),i??=n.caller}return coalesceDeliveries(r)}export{nextTurnDelivery};
+import{coalesceDeliveries}from"#harness/messages.js";import{routeDeliverToChildren}from"#execution/route-child-delivery.js";import{sendCommandToDelivery}from"#execution/session-command-wire.js";async function nextTurnDelivery(e){if(e.awaitAuthorizationCallbacks!==!0)return await awaitNextTurnDelivery(e);e.commandInbox.setAuthorizationWindow(!0);try{return await awaitNextTurnDelivery(e)}finally{e.commandInbox.setAuthorizationWindow(!1)}}async function awaitNextTurnDelivery(e){for(;;){let n=await waitForNextSessionAction({bufferedDeliveries:e.bufferedDeliveries,bufferedSessionControls:e.bufferedSessionControls,commandInbox:e.commandInbox,deferDeliveries:e.deferDeliveries});if(n.kind===`authorization`)return n;if(n.kind!==`delivery`)return{kind:n.kind};let r=n.delivery;if(r===null)return{kind:`closed`};let i=await routeDeliverToChildren({auth:r.auth,parentWritable:e.driverWritable,payloads:r.payloads,sessionState:e.sessionState});if(i.kind===`cancel-turn`)return{kind:`cancel-turn`};if(i.remainder!==void 0)return{deliver:r,kind:`turn`,remainder:i.remainder}}}async function waitForNextSessionAction(e){let t=e.bufferedSessionControls.shift();if(t!==void 0)return{kind:t};if(e.deferDeliveries!==!0&&!e.commandInbox.hasReadyAuthorization()&&e.bufferedDeliveries.length>0)return{delivery:takeBufferedTurnDelivery(e.bufferedDeliveries),kind:`delivery`};for(;;){let{result:t,source:r}=await e.commandInbox.nextWithSource();if(e.commandInbox.consumeNext(),r===`authorization`)return t.done?{closed:!0,kind:`authorization`,payloads:[]}:{closed:!1,kind:`authorization`,payloads:t.value.kind===`deliver`?t.value.payloads:[]};if(t.done)return{delivery:null,kind:`delivery`};if(t.value.kind===`session-timeout`)return{kind:`expired`};if(t.value.kind===`clear`||t.value.kind===`compact`||t.value.kind===`reset`)return{kind:t.value.kind};if(t.value.kind===`cancel`)continue;if(t.value.kind===`deliver`){if(e.deferDeliveries===!0){e.bufferedDeliveries.push(t.value);continue}return{delivery:t.value,kind:`delivery`}}let i=sendCommandToDelivery(t.value);if(e.deferDeliveries===!0){e.bufferedDeliveries.push(i);continue}return{delivery:i,kind:`delivery`}}}function takeBufferedTurnDelivery(t){let n=t.shift();if(n===void 0)throw Error(`Cannot take a turn delivery from an empty buffer.`);let r=[n],i=n.caller;for(;t.length>0;){let e=t[0];if(e===void 0||i!==void 0&&e.caller!==void 0)break;let n=t.shift();if(n===void 0)throw Error(`Buffered turn delivery disappeared while partitioning.`);r.push(n),i??=n.caller}return coalesceDeliveries(r)}export{nextTurnDelivery};

package/dist/src/execution/sandbox/abort-bound-session.d.ts

@@ -3,4 +3,4 @@ import type { SandboxSession } from "#shared/sandbox-session.js";
  * Returns a sandbox session that applies `abortSignal` to every operation.
  * Per-call signals are composed with the bound signal.
  */
-export declare function bindSandboxAbortSignal(session: SandboxSession, abortSignal: AbortSignal): SandboxSession;
+export declare function bindSandboxAbortSignal<TSession extends SandboxSession>(session: TSession, abortSignal: AbortSignal): TSession;

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(c={}){let l=c.dockerCli??createDockerCli(),u=resolveDockerSandboxOptions(c.createOptions),d=createDockerSandboxOptionsHash(u),f;function ensureDaemon(){return f??=assertDockerDaemonAvailable(l).catch(e=>{throw f=void 0,e}),f}return{name:DOCKER_BACKEND_NAME,async prewarm(r){r.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:d,templateKey:r.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(r.runtimeContext.appRoot,i);if(r.log?.(`checking cached template image "${a}"`),await dockerImageExists(l,a))return r.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};r.log?.(`checking base image "${u.image}"`),await ensureDockerBaseImage(l,u);let s=`${r.templateKey}-build-${randomUUID().slice(0,8)}`;r.log?.(`starting template build container`),await startDockerContainer({cli:l,containerName:s,image:u.image,initialNetworkPolicy:`allow-all`,options:u,role:`template-build`});try{r.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(l,s),u.networkPolicy!==`allow-all`&&(r.log?.(`applying network policy`),await setDockerNetworkPolicy(l,s,u.networkPolicy));let e=buildSandboxSession(createDockerInternalSession({cli:l,containerName:s,id:r.templateKey}),e=>setDockerNetworkPolicy(l,s,e));r.seedFiles.length>0&&r.log?.(`writing ${r.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(e,r.seedFiles),r.bootstrap!==void 0&&(r.log?.(`running sandbox bootstrap`),await r.bootstrap({use:async()=>createLoggingSandboxSession({log:r.log,session:e})})),r.log?.(`stopping template build container`),expectDockerSuccess(await l.run([`stop`,`-t`,`0`,s]),`stop template build container "${s}"`),r.log?.(`committing template image "${a}"`),expectDockerSuccess(await l.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${r.templateKey}`,s,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await l.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon();let n=getDockerContainerName(e.existingMetadata)??e.sessionKey,r=await l.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,n]);if(r.exitCode===0)r.stdout.trim()!==`true`&&expectDockerSuccess(await l.run([`start`,n]),`restart sandbox session container "${n}"`);else{let t;if(e.templateKey===null)await ensureDockerBaseImage(l,u),t=u.image;else{let n={optionsHash:d,templateKey:e.templateKey};if(t=dockerTemplateImageReference(n),!await dockerImageExists(l,t))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),t)}try{await startDockerContainer({cli:l,containerName:n,image:t,initialNetworkPolicy:e.templateKey===null?`allow-all`:u.networkPolicy,options:u,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(l,n),u.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(l,n,u.networkPolicy))}let i=buildSandboxSession(createDockerInternalSession({cli:l,containerName:n,id:e.sessionKey}),e=>setDockerNetworkPolicy(l,n,e));return{session:i,useSessionFn:async()=>i,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:n},sessionKey:e.sessionKey}},async shutdown(){await stopDockerContainerIfRunning(l,n)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(c={}){let l=c.dockerCli??createDockerCli(),u=resolveDockerSandboxOptions(c.createOptions),d=createDockerSandboxOptionsHash(u),f;function ensureDaemon(){return f??=assertDockerDaemonAvailable(l).catch(e=>{throw f=void 0,e}),f}return{name:DOCKER_BACKEND_NAME,async prewarm(r){r.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:d,templateKey:r.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(r.runtimeContext.appRoot,i);if(r.log?.(`checking cached template image "${a}"`),await dockerImageExists(l,a))return r.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};r.log?.(`checking base image "${u.image}"`),await ensureDockerBaseImage(l,u);let s=`${r.templateKey}-build-${randomUUID().slice(0,8)}`;r.log?.(`starting template build container`),await startDockerContainer({cli:l,containerName:s,image:u.image,initialNetworkPolicy:`allow-all`,options:u,role:`template-build`});try{r.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(l,s),u.networkPolicy!==`allow-all`&&(r.log?.(`applying network policy`),await setDockerNetworkPolicy(l,s,u.networkPolicy));let e=buildSandboxSession(createDockerInternalSession({cli:l,containerName:s,id:r.templateKey}),e=>setDockerNetworkPolicy(l,s,e));r.seedFiles.length>0&&r.log?.(`writing ${r.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(e,r.seedFiles),r.bootstrap!==void 0&&(r.log?.(`running sandbox bootstrap`),await r.bootstrap({use:async()=>createLoggingSandboxSession({log:r.log,session:e})})),r.log?.(`stopping template build container`),expectDockerSuccess(await l.run([`stop`,`-t`,`0`,s]),`stop template build container "${s}"`),r.log?.(`committing template image "${a}"`),expectDockerSuccess(await l.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${r.templateKey}`,s,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await l.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon();let n=getDockerContainerName(e.existingMetadata)??e.sessionKey,r=await l.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,n]);if(r.exitCode===0)r.stdout.trim()!==`true`&&expectDockerSuccess(await l.run([`start`,n]),`restart sandbox session container "${n}"`);else{let t;if(e.templateKey===null)await ensureDockerBaseImage(l,u),t=u.image;else{let n={optionsHash:d,templateKey:e.templateKey};if(t=dockerTemplateImageReference(n),!await dockerImageExists(l,t))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),t)}try{await startDockerContainer({cli:l,containerName:n,image:t,initialNetworkPolicy:e.templateKey===null?`allow-all`:u.networkPolicy,options:u,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(l,n),u.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(l,n,u.networkPolicy))}let i=buildSandboxSession(createDockerInternalSession({cli:l,containerName:n,id:e.sessionKey}),e=>setDockerNetworkPolicy(l,n,e));return{session:i,useSessionFn:async()=>i,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:n},sessionKey:e.sessionKey}},async stop(){await stopDockerContainerIfRunning(l,n)},async shutdown(){await stopDockerContainerIfRunning(l,n)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.js

@@ -1 +1 @@
-import{mkdir,readFile,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(t){let{ReadWriteFs:n,Sandbox:r}=await loadJustBashModule({appRoot:t.appRoot,autoInstall:t.autoInstall}),i=resolveLocalSandboxFilesystemRootPath(t.rootPath),a=resolveLocalSandboxMetadataPath(t.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(t.filesystem!==void 0)try{c=await t.filesystem({appRoot:t.appRoot,defaultFilesystem:s})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,env:o?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:t.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:t.rootPath,sessionKey:t.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`;return adaptMultiplexedCommandToSandboxProcess({command:await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal}),getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let n=JSON.parse(await readFile(e,`utf8`));return n.version!==1||!isStringRecord(n.env)?null:{env:n.env,version:1}}async function writeLocalMetadata(t,r){await mkdir(dirname(t),{recursive:!0}),await writeFile(t,`${JSON.stringify(r,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};
+import{mkdir,readFile,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(t){let{ReadWriteFs:n,Sandbox:r}=await loadJustBashModule({appRoot:t.appRoot,autoInstall:t.autoInstall}),i=resolveLocalSandboxFilesystemRootPath(t.rootPath),a=resolveLocalSandboxMetadataPath(t.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(t.filesystem!==void 0)try{c=await t.filesystem({appRoot:t.appRoot,defaultFilesystem:s})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,env:o?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:t.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:t.rootPath,sessionKey:t.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`;return adaptMultiplexedCommandToSandboxProcess({command:await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal}),getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async stop(){await e.dispose()},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let n=JSON.parse(await readFile(e,`utf8`));return n.version!==1||!isStringRecord(n.env)?null:{env:n.env,version:1}}async function writeLocalMetadata(t,r){await mkdir(dirname(t),{recursive:!0}),await writeFile(t,`${JSON.stringify(r,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(a){a.prewarmInput.log?.(`loading microsandbox runtime`);let o=await loadMicrosandboxModule({appRoot:a.prewarmInput.runtimeContext.appRoot,log:a.prewarmInput.log,options:a.options}),d=resolveMicrosandboxTemplateRootPath(resolveSandboxCacheDirectory(a.prewarmInput.runtimeContext.appRoot),a.prewarmInput.templateKey),p=resolveMicrosandboxMetadataPath(d);a.prewarmInput.log?.(`checking cached snapshot`);let m=await readTemplateMetadata(p);if(m?.optionsHash===a.optionsHash&&await snapshotExists(o,m.snapshotName))return a.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(d),{reused:!0};let g=createProviderName(`eve-sbx-tpl`,a.prewarmInput.templateKey,a.optionsHash),v=`${d}.${randomUUID()}.tmp`,y=createProviderName(`eve-sbx-tpl-tmp`,`${a.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(o,g),await rm(v,{force:!0,recursive:!0}),await mkdir(v,{recursive:!0}),a.prewarmInput.log?.(`creating template VM from image "${a.options.image}"`);let b=await createPreparedMicrosandbox({log:a.prewarmInput.log,module:o,name:y,networkPolicy:a.options.networkPolicy,options:a.options,sessionKey:a.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),x=buildSandboxSession(createMicrosandboxInternalSession(b),async e=>{await b.setNetworkPolicy(e)});try{a.prewarmInput.seedFiles.length>0&&a.prewarmInput.log?.(`writing ${a.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(x,a.prewarmInput.seedFiles),a.prewarmInput.bootstrap!==void 0&&(a.prewarmInput.log?.(`running sandbox bootstrap`),await a.prewarmInput.bootstrap({use:async e=>(e?.networkPolicy!==void 0&&await b.setNetworkPolicy(e.networkPolicy),createLoggingSandboxSession({log:a.prewarmInput.log,session:x}))})),a.prewarmInput.log?.(`snapshotting template VM`),await b.stopAndSnapshot(g),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(v),{optionsHash:a.optionsHash,snapshotName:g,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(d),{recursive:!0}),await rm(d,{force:!0,recursive:!0});try{await rename(v,d)}catch(e){if(await doesPathExist(d))return{reused:!0};throw e}}finally{await b.removePersisted(),await rm(v,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(t){let n=await loadMicrosandboxModule({appRoot:t.createInput.runtimeContext.appRoot,options:t.options}),r=resolveSandboxCacheDirectory(t.createInput.runtimeContext.appRoot),i=resolveMicrosandboxSessionRootPath(r,t.createInput.sessionKey),o=createActiveMicrosandboxSessionKey(i,t.optionsHash),s=activeMicrosandboxSessionHandles.get(o);if(s!==void 0)return s;let c=resolveMicrosandboxMetadataPath(i),l=readSessionMetadataRecord(t.createInput.existingMetadata)??await readSessionMetadata(c),u=withDevelopmentSandboxMetadataPathTag(t.createInput.tags,c);if(l?.optionsHash===t.optionsHash&&(await sandboxExists(n,l.sandboxName)||l.stateSnapshotName!==void 0&&await snapshotExists(n,l.stateSnapshotName))){let e=await connectMicrosandbox({metadata:l,metadataPath:c,module:n,options:t.options,sessionKey:t.createInput.sessionKey,tags:u});if(e!==null)return cacheHandle(o,createHandle(e,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}let f=null;if(t.createInput.templateKey!==null){let e=await readTemplateMetadata(resolveMicrosandboxMetadataPath(resolveMicrosandboxTemplateRootPath(r,t.createInput.templateKey)));if(e===null||e.optionsHash!==t.optionsHash||!await snapshotExists(n,e.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey});f=e.snapshotName}let h=createProviderName(`eve-sbx-ses`,`${t.createInput.sessionKey}:${randomUUID()}`),_;try{_=await createPreparedMicrosandbox({fromSnapshot:f??void 0,module:n,name:h,networkPolicy:t.options.networkPolicy,options:t.options,sessionKey:t.createInput.sessionKey,setupBaseRuntime:f===null,tags:u})}catch(e){throw f!==null&&t.createInput.templateKey!==null&&isMicrosandboxNotFoundError(e)?new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey}):e}return await _.writeMetadata(c,t.optionsHash),cacheHandle(o,createHandle(_,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};
+import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(a){a.prewarmInput.log?.(`loading microsandbox runtime`);let o=await loadMicrosandboxModule({appRoot:a.prewarmInput.runtimeContext.appRoot,log:a.prewarmInput.log,options:a.options}),d=resolveMicrosandboxTemplateRootPath(resolveSandboxCacheDirectory(a.prewarmInput.runtimeContext.appRoot),a.prewarmInput.templateKey),p=resolveMicrosandboxMetadataPath(d);a.prewarmInput.log?.(`checking cached snapshot`);let m=await readTemplateMetadata(p);if(m?.optionsHash===a.optionsHash&&await snapshotExists(o,m.snapshotName))return a.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(d),{reused:!0};let g=createProviderName(`eve-sbx-tpl`,a.prewarmInput.templateKey,a.optionsHash),v=`${d}.${randomUUID()}.tmp`,y=createProviderName(`eve-sbx-tpl-tmp`,`${a.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(o,g),await rm(v,{force:!0,recursive:!0}),await mkdir(v,{recursive:!0}),a.prewarmInput.log?.(`creating template VM from image "${a.options.image}"`);let b=await createPreparedMicrosandbox({log:a.prewarmInput.log,module:o,name:y,networkPolicy:a.options.networkPolicy,options:a.options,sessionKey:a.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),x=buildSandboxSession(createMicrosandboxInternalSession(b),async e=>{await b.setNetworkPolicy(e)});try{a.prewarmInput.seedFiles.length>0&&a.prewarmInput.log?.(`writing ${a.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(x,a.prewarmInput.seedFiles),a.prewarmInput.bootstrap!==void 0&&(a.prewarmInput.log?.(`running sandbox bootstrap`),await a.prewarmInput.bootstrap({use:async e=>(e?.networkPolicy!==void 0&&await b.setNetworkPolicy(e.networkPolicy),createLoggingSandboxSession({log:a.prewarmInput.log,session:x}))})),a.prewarmInput.log?.(`snapshotting template VM`),await b.stopAndSnapshot(g),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(v),{optionsHash:a.optionsHash,snapshotName:g,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(d),{recursive:!0}),await rm(d,{force:!0,recursive:!0});try{await rename(v,d)}catch(e){if(await doesPathExist(d))return{reused:!0};throw e}}finally{await b.removePersisted(),await rm(v,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(t){let n=await loadMicrosandboxModule({appRoot:t.createInput.runtimeContext.appRoot,options:t.options}),r=resolveSandboxCacheDirectory(t.createInput.runtimeContext.appRoot),i=resolveMicrosandboxSessionRootPath(r,t.createInput.sessionKey),o=createActiveMicrosandboxSessionKey(i,t.optionsHash),s=activeMicrosandboxSessionHandles.get(o);if(s!==void 0)return s;let c=resolveMicrosandboxMetadataPath(i),l=readSessionMetadataRecord(t.createInput.existingMetadata)??await readSessionMetadata(c),u=withDevelopmentSandboxMetadataPathTag(t.createInput.tags,c);if(l?.optionsHash===t.optionsHash&&(await sandboxExists(n,l.sandboxName)||l.stateSnapshotName!==void 0&&await snapshotExists(n,l.stateSnapshotName))){let e=await connectMicrosandbox({metadata:l,metadataPath:c,module:n,options:t.options,sessionKey:t.createInput.sessionKey,tags:u});if(e!==null)return cacheHandle(o,createHandle(e,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}let f=null;if(t.createInput.templateKey!==null){let e=await readTemplateMetadata(resolveMicrosandboxMetadataPath(resolveMicrosandboxTemplateRootPath(r,t.createInput.templateKey)));if(e===null||e.optionsHash!==t.optionsHash||!await snapshotExists(n,e.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey});f=e.snapshotName}let h=createProviderName(`eve-sbx-ses`,`${t.createInput.sessionKey}:${randomUUID()}`),_;try{_=await createPreparedMicrosandbox({fromSnapshot:f??void 0,module:n,name:h,networkPolicy:t.options.networkPolicy,options:t.options,sessionKey:t.createInput.sessionKey,setupBaseRuntime:f===null,tags:u})}catch(e){throw f!==null&&t.createInput.templateKey!==null&&isMicrosandboxNotFoundError(e)?new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey}):e}return await _.writeMetadata(c,t.optionsHash),cacheHandle(o,createHandle(_,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async stop(){await e.stop(),r?.()},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.d.ts

@@ -23,6 +23,7 @@ export declare class MicrosandboxVm {
      * (dev) or restores from the last captured snapshot (production).
      */
     shutdown(): Promise<void>;
+    stop(): Promise<void>;
     readFileBytes(path: string): Promise<Buffer | null>;
     removePath(options: SandboxRemovePathOptions): Promise<void>;
     removePersisted(): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.js

@@ -1 +1 @@
-import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(r),this.#o=r,this.#t!==void 0&&await this.writeMetadata(this.#t,e),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:r,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a),this.#o!==void 0&&await removeSnapshotIfExists$1(this.#e.module,this.#o)}async setNetworkPolicy(e){let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),i=this.#a;await this.stopAndSnapshot(r),await removeSandboxIfExists(this.#e.module,i);let a=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:r,module:this.#e.module,name:a,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=a,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,r),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let n=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),r=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:n,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let i=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},r,n,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await i.writeMetadata(e.metadataPath,e.metadata.optionsHash),i}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:MICROSANDBOX_PACKAGE_NAME}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(t){return createHash(`sha256`).update(t).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};
+import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(r),this.#o=r,this.#t!==void 0&&await this.writeMetadata(this.#t,e),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:r,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async stop(){await this.#i.stop(),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a),this.#o!==void 0&&await removeSnapshotIfExists$1(this.#e.module,this.#o)}async setNetworkPolicy(e){let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),i=this.#a;await this.stopAndSnapshot(r),await removeSandboxIfExists(this.#e.module,i);let a=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:r,module:this.#e.module,name:a,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=a,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,r),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let n=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),r=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:n,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let i=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},r,n,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await i.writeMetadata(e.metadataPath,e.metadata.optionsHash),i}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:MICROSANDBOX_PACKAGE_NAME}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(t){return createHash(`sha256`).update(t).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};

package/dist/src/execution/sandbox/bindings/vercel.js

@@ -1 +1 @@
-import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{applyInitialVercelNetworkPolicy,ensureVercelSandboxBaseRuntime}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},r=e.createSandbox??createVercelEveImageSandbox,i=new Map;return{name:`vercel`,async create(e){let o=resolveVercelSandboxTags(n.tags,e.tags),s=e.templateKey===null?null:await readTemplateForCreate({createOptions:n,loadSandboxModule:t,prewarmedTemplates:i,templateKey:e.templateKey}),l=await t(),u;try{u=await ensureSession({createOptions:n,createSandbox:r,existingMetadata:e.existingMetadata,sandboxModule:l,sessionKey:e.sessionKey,snapshotId:s?.snapshotId,tags:o})}catch(t){throw s!==null&&(isVercelSnapshotUnavailableError(t)||isVercelSandboxMissingError(t))?(i.delete(s.templateKey),await(await getNamedVercelSandbox({createOptions:n,sandboxModule:l,sandboxName:s.sandboxName}))?.delete(),new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:s.templateKey})):Error(`Failed to create sandbox session "${e.sessionKey}": ${errorMessage(t)}`,{cause:t})}return s===null&&u.created&&(await ensureVercelSandboxBaseRuntime(u.sandbox),await applyInitialVercelNetworkPolicy(u.sandbox,n.networkPolicy)),createHandle(u.sandbox,e.sessionKey)},async prewarm(e){let a;try{a=await ensureTemplateWithUnavailableRetry({bootstrap:e.bootstrap,createOptions:n,createSandbox:r,loadSandboxModule:t,log:e.log,seedFiles:e.seedFiles,templateKey:e.templateKey})}catch(t){throw Error(`Failed to prewarm Vercel sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}return i.set(e.templateKey,a.template),{reused:a.reused}}}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function readTemplate(e){let t=e.prewarmedTemplates.get(e.templateKey);if(t!==void 0)return t;let n=await e.loadSandboxModule(),r=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:n,sandboxName:e.templateKey});if(r===null||typeof r.currentSnapshotId!=`string`)throw new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:e.templateKey});return{sandboxName:r.name,snapshotId:r.currentSnapshotId,templateKey:e.templateKey}}async function readTemplateForCreate(e){try{return await readTemplate(e)}catch(t){throw SandboxTemplateNotProvisionedError.is(t)?t:Error(`Failed to read sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),a=resolveVercelSandboxTags(e.createOptions.tags,e.tags),o=extractAuthorSnapshotId(e.createOptions);if(n!==null&&isUnprovisionedTerminalTemplateSandbox(n,o)&&(await n.delete(),n=null),n===null?n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!1,tags:a})}):await ensureVercelSandboxTags(n,a),typeof n.currentSnapshotId==`string`&&n.currentSnapshotId.length>0&&n.currentSnapshotId!==o)return{reused:!0,template:{sandboxName:n.name,snapshotId:n.currentSnapshotId,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let s=buildSandboxSession(createVercelInternalSandboxSession(n,e.templateKey),createVercelNetworkPolicySetter(n));await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:s}),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async t=>(t!==void 0&&await n.update(t),createLoggingSandboxSession({log:e.log,session:s}))}));let c=await n.snapshot();return{reused:!1,template:{sandboxName:n.name,snapshotId:c.snapshotId,templateKey:e.templateKey}}}async function ensureSession(e){let t=getVercelSandboxName(e.existingMetadata)??e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t);return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t){if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...e.createOptions,name:t,persistent:!0});let{image:n,runtime:r,source:i,...a}=e.createOptions;return{...a,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createHandle(e,t){return{session:buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e)),useSessionFn:async n=>(n!==void 0&&await e.update(n),buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e))),async captureState(){return{backendName:`vercel`,metadata:{sandboxName:e.name},sessionKey:t}},async shutdown(){await stopVercelSandbox(e)}}}async function stopVercelSandbox(e){if(!(e.status!==`running`&&e.status!==`pending`))try{await e.stop()}catch{}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}function createVercelInternalSandboxSession(e,r){return{id:r,resolvePath:resolveVercelSandboxPath,async spawn(n){return adaptMultiplexedCommandToSandboxProcess({command:await e.runCommand({args:[`-lc`,n.command],cmd:`bash`,cwd:n.workingDirectory??WORKSPACE_ROOT,detached:!0,env:n.env,signal:n.abortSignal}),getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let r=await streamToBuffer(t.content);await e.writeFiles([{content:r,path:t.path}])},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(t){if(t.seedFiles.length===0)return;let n=await Promise.all(t.seedFiles.map(async n=>({content:typeof n.content==`string`?Buffer.from(n.content):n.content,path:await resolveSandboxModelPath({path:n.path,sandbox:t.session})})));await t.sandbox.writeFiles(n)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}function getVercelSandboxName(e){let t=e?.sandboxName;return typeof t==`string`?t:void 0}function resolveVercelSandboxTags(e,t){let n={};if(e!==void 0)for(let[t,r]of Object.entries(e))n[t]=r;if(t!==void 0)for(let[e,r]of Object.entries(t))n[e]=r;let r=Object.keys(n).length;if(r!==0){if(r>VERCEL_SANDBOX_TAG_LIMIT)throw Error(`Vercel Sandbox supports at most ${VERCEL_SANDBOX_TAG_LIMIT} tags. eve reserves "agent", "channel", and "sessionId"; remove or consolidate custom tags passed to vercel().`);return n}}async function ensureVercelSandboxTags(e,t){t===void 0||areVercelSandboxTagsEqual(e.tags,t)||await e.update({tags:t})}function areVercelSandboxTagsEqual(e,t){let n=e??{},r=Object.entries(n),i=Object.entries(t);return r.length===i.length&&i.every(([e,t])=>n[e]===t)}function errorMessage(e){if(e instanceof Error){let t=e.json,n=e.text,r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}const DEFAULT_SANDBOX_TIMEOUT_MS=1800*1e3,VERCEL_SANDBOX_TAG_LIMIT=5;export{createVercelSandbox};
+import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{applyInitialVercelNetworkPolicy,ensureVercelSandboxBaseRuntime}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},r=e.createSandbox??createVercelEveImageSandbox,i=new Map;return{name:`vercel`,async create(e){let o=resolveVercelSandboxTags(n.tags,e.tags),s=e.templateKey===null?null:await readTemplateForCreate({createOptions:n,loadSandboxModule:t,prewarmedTemplates:i,templateKey:e.templateKey}),l=await t(),u;try{u=await ensureSession({createOptions:n,createSandbox:r,existingMetadata:e.existingMetadata,sandboxModule:l,sessionKey:e.sessionKey,snapshotId:s?.snapshotId,tags:o})}catch(t){throw s!==null&&(isVercelSnapshotUnavailableError(t)||isVercelSandboxMissingError(t))?(i.delete(s.templateKey),await(await getNamedVercelSandbox({createOptions:n,sandboxModule:l,sandboxName:s.sandboxName}))?.delete(),new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:s.templateKey})):Error(`Failed to create sandbox session "${e.sessionKey}": ${errorMessage(t)}`,{cause:t})}return s===null&&u.created&&(await ensureVercelSandboxBaseRuntime(u.sandbox),await applyInitialVercelNetworkPolicy(u.sandbox,n.networkPolicy)),createHandle(u.sandbox,e.sessionKey)},async prewarm(e){let a;try{a=await ensureTemplateWithUnavailableRetry({bootstrap:e.bootstrap,createOptions:n,createSandbox:r,loadSandboxModule:t,log:e.log,seedFiles:e.seedFiles,templateKey:e.templateKey})}catch(t){throw Error(`Failed to prewarm Vercel sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}return i.set(e.templateKey,a.template),{reused:a.reused}}}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function readTemplate(e){let t=e.prewarmedTemplates.get(e.templateKey);if(t!==void 0)return t;let n=await e.loadSandboxModule(),r=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:n,sandboxName:e.templateKey});if(r===null||typeof r.currentSnapshotId!=`string`)throw new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:e.templateKey});return{sandboxName:r.name,snapshotId:r.currentSnapshotId,templateKey:e.templateKey}}async function readTemplateForCreate(e){try{return await readTemplate(e)}catch(t){throw SandboxTemplateNotProvisionedError.is(t)?t:Error(`Failed to read sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),a=resolveVercelSandboxTags(e.createOptions.tags,e.tags),o=extractAuthorSnapshotId(e.createOptions);if(n!==null&&isUnprovisionedTerminalTemplateSandbox(n,o)&&(await n.delete(),n=null),n===null?n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!1,tags:a})}):await ensureVercelSandboxTags(n,a),typeof n.currentSnapshotId==`string`&&n.currentSnapshotId.length>0&&n.currentSnapshotId!==o)return{reused:!0,template:{sandboxName:n.name,snapshotId:n.currentSnapshotId,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let s=buildSandboxSession(createVercelInternalSandboxSession(n,e.templateKey),createVercelNetworkPolicySetter(n));await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:s}),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async t=>(t!==void 0&&await n.update(t),createLoggingSandboxSession({log:e.log,session:s}))}));let c=await n.snapshot();return{reused:!1,template:{sandboxName:n.name,snapshotId:c.snapshotId,templateKey:e.templateKey}}}async function ensureSession(e){let t=getVercelSandboxName(e.existingMetadata)??e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t);return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t){if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...e.createOptions,name:t,persistent:!0});let{image:n,runtime:r,source:i,...a}=e.createOptions;return{...a,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createHandle(e,t){return{session:buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e)),useSessionFn:async n=>(n!==void 0&&await e.update(n),buildSandboxSession(createVercelInternalSandboxSession(e,t),createVercelNetworkPolicySetter(e))),async captureState(){return{backendName:`vercel`,metadata:{sandboxName:e.name},sessionKey:t}},async stop(){await stopVercelSandbox(e)},async shutdown(){try{await stopVercelSandbox(e)}catch{}}}}async function stopVercelSandbox(e){e.status!==`running`&&e.status!==`pending`||await e.stop()}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}function createVercelInternalSandboxSession(e,r){return{id:r,resolvePath:resolveVercelSandboxPath,async spawn(n){return adaptMultiplexedCommandToSandboxProcess({command:await e.runCommand({args:[`-lc`,n.command],cmd:`bash`,cwd:n.workingDirectory??WORKSPACE_ROOT,detached:!0,env:n.env,signal:n.abortSignal}),getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let r=await streamToBuffer(t.content);await e.writeFiles([{content:r,path:t.path}])},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(t){if(t.seedFiles.length===0)return;let n=await Promise.all(t.seedFiles.map(async n=>({content:typeof n.content==`string`?Buffer.from(n.content):n.content,path:await resolveSandboxModelPath({path:n.path,sandbox:t.session})})));await t.sandbox.writeFiles(n)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}function getVercelSandboxName(e){let t=e?.sandboxName;return typeof t==`string`?t:void 0}function resolveVercelSandboxTags(e,t){let n={};if(e!==void 0)for(let[t,r]of Object.entries(e))n[t]=r;if(t!==void 0)for(let[e,r]of Object.entries(t))n[e]=r;let r=Object.keys(n).length;if(r!==0){if(r>VERCEL_SANDBOX_TAG_LIMIT)throw Error(`Vercel Sandbox supports at most ${VERCEL_SANDBOX_TAG_LIMIT} tags. eve reserves "agent", "channel", and "sessionId"; remove or consolidate custom tags passed to vercel().`);return n}}async function ensureVercelSandboxTags(e,t){t===void 0||areVercelSandboxTagsEqual(e.tags,t)||await e.update({tags:t})}function areVercelSandboxTagsEqual(e,t){let n=e??{},r=Object.entries(n),i=Object.entries(t);return r.length===i.length&&i.every(([e,t])=>n[e]===t)}function errorMessage(e){if(e instanceof Error){let t=e.json,n=e.text,r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}const DEFAULT_SANDBOX_TIMEOUT_MS=1800*1e3,VERCEL_SANDBOX_TAG_LIMIT=5;export{createVercelSandbox};

package/dist/src/execution/sandbox/ensure.js

@@ -1 +1 @@
-import{isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{waitForDevelopmentSandboxPrewarm}from"#execution/sandbox/development-prewarm.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{createRuntimeSandboxKeys}from"#runtime/sandbox/keys.js";import{createRuntimeSandboxTemplatePlan}from"#runtime/sandbox/template-plan.js";import{prewarmAppSandboxes}from"#execution/sandbox/prewarm.js";import{waitForSandboxTemplatePrewarmLock}from"#execution/sandbox/template-prewarm-lock.js";async function ensureSandboxAccess(e){let i=e.state?.initialized??!1,o=e.state?.session??null,s=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??process.cwd(),c=e.registry.sandbox,l;function getHandle(){return l===void 0&&(l=createHandle().catch(e=>{throw l=void 0,e})),l}async function createHandle(){if(c===null)return null;let a=c.definition,l=a.backend,u=createRuntimeSandboxTemplatePlan({definition:a,workspaceResourceRoot:c.workspaceResourceRoot}),d=await createRuntimeSandboxKeys({backendName:l.name,compiledArtifactsSource:e.compiledArtifactsSource,nodeId:e.nodeId,sessionId:e.sessionId,sourceId:a.sourceId,templatePlan:u});d.templateKey!==null&&(await waitForDevelopmentSandboxPrewarm({appRoot:s,compiledArtifactsSource:e.compiledArtifactsSource,log:t=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(e.nodeId)}" (${l.name}): ${t}`)}),await waitForSandboxTemplatePrewarmLock({appRoot:s,backendName:l.name,log:t=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(e.nodeId)}" (${l.name}): ${t}`),templateKey:d.templateKey}));let f=o!==null&&o.backendName===l.name&&o.sessionKey===d.sessionKey?o:null;f===null&&(i=!1);let p={existingMetadata:f?.metadata,runtimeContext:{appRoot:s},sessionKey:d.sessionKey,tags:e.tags,templateKey:d.templateKey},m=await withDevelopmentSandboxProgress(`eve: opening sandbox session "${formatNodeLabel(e.nodeId)}" on backend "${l.name}"...`,`eve: opening sandbox session "${formatNodeLabel(e.nodeId)}" on backend "${l.name}"`,async()=>await createBackendHandleWithPrewarmRetry({appRoot:s,backend:l,compiledArtifactsSource:e.compiledArtifactsSource,createInput:p}));return trackActiveSandboxHandle({backendName:l.name,handle:m,sessionKey:d.sessionKey}),i||=(await runOnSession(async()=>{await a.onSession?.({ctx:buildCallbackContext(),use:m.useSessionFn})}),!0),m}async function runOnSession(t){if(e.runOnSession!==void 0){await e.runOnSession(t);return}await t()}return{async captureState(){if(l!==void 0){let e=await l;e!==null&&(o=await e.captureState())}return{initialized:i,session:o}},async get(){return(await getHandle())?.session??null}}}async function createBackendHandleWithPrewarmRetry(e){try{return await e.backend.create(e.createInput)}catch(t){if(e.createInput.templateKey===null||e.compiledArtifactsSource.kind!==`disk`||!SandboxTemplateNotProvisionedError.is(t))throw t;return await prewarmAppSandboxes({appRoot:e.appRoot,compiledArtifactsSource:e.compiledArtifactsSource,log:e=>logDevelopmentSandbox(e)}),await waitForSandboxTemplatePrewarmLock({appRoot:e.appRoot,backendName:e.backend.name,log:e=>logDevelopmentSandbox(`eve: ${e}`),templateKey:e.createInput.templateKey}),logDevelopmentSandbox(`eve: sandbox template is ready; retrying sandbox creation...`),await e.backend.create(e.createInput)}}function logDevelopmentSandbox(t){isEveDevEnvironment()&&console.log(t)}async function withDevelopmentSandboxProgress(t,n,r){if(logDevelopmentSandbox(t),!isEveDevEnvironment())return await r();let i=Date.now(),a=setInterval(()=>{logDevelopmentSandbox(`${n} (${Math.round((Date.now()-i)/1e3)}s elapsed)...`)},5e3);a.unref?.();try{return await r()}finally{clearInterval(a)}}function formatNodeLabel(e){return e===`__root__`?`root`:e}export{ensureSandboxAccess};
+import{isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{waitForDevelopmentSandboxPrewarm}from"#execution/sandbox/development-prewarm.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{createRuntimeSandboxKeys}from"#runtime/sandbox/keys.js";import{createRuntimeSandboxTemplatePlan}from"#runtime/sandbox/template-plan.js";import{prewarmAppSandboxes}from"#execution/sandbox/prewarm.js";import{waitForSandboxTemplatePrewarmLock}from"#execution/sandbox/template-prewarm-lock.js";async function ensureSandboxAccess(e){let i=e.state?.initialized??!1,o=e.state?.session??null,s=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??process.cwd(),c=e.registry.sandbox,l;function getHandle(){return l===void 0&&(l=createHandle().catch(e=>{throw l=void 0,e})),l}async function createHandle(){if(c===null)return null;let a=c.definition,l=a.backend,u=createRuntimeSandboxTemplatePlan({definition:a,workspaceResourceRoot:c.workspaceResourceRoot}),d=await createRuntimeSandboxKeys({backendName:l.name,compiledArtifactsSource:e.compiledArtifactsSource,nodeId:e.nodeId,sessionId:e.sessionId,sourceId:a.sourceId,templatePlan:u});d.templateKey!==null&&(await waitForDevelopmentSandboxPrewarm({appRoot:s,compiledArtifactsSource:e.compiledArtifactsSource,log:t=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(e.nodeId)}" (${l.name}): ${t}`)}),await waitForSandboxTemplatePrewarmLock({appRoot:s,backendName:l.name,log:t=>logDevelopmentSandbox(`eve: sandbox template "${formatNodeLabel(e.nodeId)}" (${l.name}): ${t}`),templateKey:d.templateKey}));let f=o!==null&&o.backendName===l.name&&o.sessionKey===d.sessionKey?o:null;f===null&&(i=!1);let p={existingMetadata:f?.metadata,runtimeContext:{appRoot:s},sessionKey:d.sessionKey,tags:e.tags,templateKey:d.templateKey},m=await withDevelopmentSandboxProgress(`eve: opening sandbox session "${formatNodeLabel(e.nodeId)}" on backend "${l.name}"...`,`eve: opening sandbox session "${formatNodeLabel(e.nodeId)}" on backend "${l.name}"`,async()=>await createBackendHandleWithPrewarmRetry({appRoot:s,backend:l,compiledArtifactsSource:e.compiledArtifactsSource,createInput:p}));return trackActiveSandboxHandle({backendName:l.name,handle:m,sessionKey:d.sessionKey}),i||=(await runOnSession(async()=>{await a.onSession?.({ctx:buildCallbackContext(),use:m.useSessionFn})}),!0),m}async function runOnSession(t){if(e.runOnSession!==void 0){await e.runOnSession(t);return}await t()}return{async captureState(){if(l!==void 0){let e=await l;e!==null&&(o=await e.captureState())}return{initialized:i,session:o}},async get(){return(await getHandle())?.session??null},async stop(){let e=await getHandle();if(e===null)throw Error(`The sandbox is not available in the current authored runtime context.`);await e.stop()}}}async function createBackendHandleWithPrewarmRetry(e){try{return await e.backend.create(e.createInput)}catch(t){if(e.createInput.templateKey===null||e.compiledArtifactsSource.kind!==`disk`||!SandboxTemplateNotProvisionedError.is(t))throw t;return await prewarmAppSandboxes({appRoot:e.appRoot,compiledArtifactsSource:e.compiledArtifactsSource,log:e=>logDevelopmentSandbox(e)}),await waitForSandboxTemplatePrewarmLock({appRoot:e.appRoot,backendName:e.backend.name,log:e=>logDevelopmentSandbox(`eve: ${e}`),templateKey:e.createInput.templateKey}),logDevelopmentSandbox(`eve: sandbox template is ready; retrying sandbox creation...`),await e.backend.create(e.createInput)}}function logDevelopmentSandbox(t){isEveDevEnvironment()&&console.log(t)}async function withDevelopmentSandboxProgress(t,n,r){if(logDevelopmentSandbox(t),!isEveDevEnvironment())return await r();let i=Date.now(),a=setInterval(()=>{logDevelopmentSandbox(`${n} (${Math.round((Date.now()-i)/1e3)}s elapsed)...`)},5e3);a.unref?.();try{return await r()}finally{clearInterval(a)}}function formatNodeLabel(e){return e===`__root__`?`root`:e}export{ensureSandboxAccess};

package/dist/src/execution/session-command-inbox.d.ts

@@ -9,12 +9,37 @@ import type { DeliverHookPayload, SessionCommand, SessionTimeoutHookPayload } fr
  * dropped once runs created on those versions have aged out.
  */
 export type SessionInboxPayload = DeliverHookPayload | SessionCommand | SessionTimeoutHookPayload;
-/** Multiplexes one stable session hook and one rekeyable channel alias. */
+/** Which hook family produced an inbox read. */
+export type SessionInboxSource = "authorization" | "session";
+/**
+ * Multiplexes one stable session hook, one rekeyable channel alias, and one
+ * window-gated authorization-callback hook.
+ */
 export interface SessionCommandInbox {
+    /**
+     * Claims the session's authorization-callback hook as an inbox source.
+     * Its reads stay stashed until {@link setAuthorizationWindow} opens, so
+     * callbacks never surface as ordinary session activity.
+     */
+    claimAuthorization(token: string): Promise<void>;
     claimStable(token: string): Promise<void>;
     consumeNext(): void;
+    /** Whether an authorization read is already eligible to be consumed. */
+    hasReadyAuthorization(): boolean;
     next(): Promise<IteratorResult<SessionInboxPayload>>;
+    /**
+     * Like {@link next} but reports which hook family produced the read.
+     * Reads surface in one arrival order across every source, which keeps
+     * waits that interleave authorization callbacks with ordinary session
+     * activity deterministic under workflow replay.
+     */
+    nextWithSource(): Promise<{
+        result: IteratorResult<SessionInboxPayload>;
+        source: SessionInboxSource;
+    }>;
     rekeyContinuation(token: string): Promise<void>;
+    /** Opens or closes the surfacing window for authorization-callback reads. */
+    setAuthorizationWindow(open: boolean): void;
 }
 /** Adds workflow-entry lifecycle ownership to a session command inbox. */
 export interface SessionCommandInboxHandle extends SessionCommandInbox {

package/dist/src/execution/session-command-inbox.js

@@ -1 +1 @@
-import{createHook}from"#compiled/@workflow/core/index.js";import{claimHookOwnership,disposeHook}from"#execution/hook-ownership.js";function createSessionCommandInbox(){let r,i,a=[],o=[],s=0,c=null,l,u,enqueue=e=>{o.push(e),o.sort((e,t)=>e.order-t.order),u?.(),u=void 0},arm=e=>{e.closed||e.pending||(e.pending=!0,e.resolved=void 0,(e.retired?Promise.resolve(e.hook).then(e=>({done:!1,value:e})):e.iterator.next()).then(t=>{let n={order:s++,result:t,state:e};e.resolved=n,e.enabled&&enqueue(n)},()=>{}))},enable=e=>{e.enabled=!0,e.resolved!==void 0&&enqueue(e.resolved)},createState=t=>{let n=createHook({token:t});return{closed:!1,enabled:!1,hook:n,iterator:n[Symbol.asyncIterator](),pending:!1,retired:!1}},states=()=>[r,i,...a].filter(e=>e!==void 0);return{async claimStable(e){if(r!==void 0){if(r.hook.token===e)return;throw Error(`A session command inbox cannot change its stable token.`)}let n=createState(e);await claimHookOwnership(n.hook),enable(n),r=n},consumeNext(){if(l===void 0)throw Error(`Cannot consume a session command before it resolves.`);l.state.pending=!1,l.state.resolved=void 0,l.result.done&&(l.state.closed=!0),l=void 0,c=null},async dispose(){let e=[i,r].filter(e=>e!==void 0);i=void 0,r=void 0,await Promise.all(e.map(async e=>await disposeHook(e.hook)))},next(){if(r===void 0)throw Error(`Cannot wait for session commands before claiming the stable inbox.`);if(c!==null)return c;let e=states();for(let t of e)arm(t);return e.every(e=>e.closed)?(l={order:s++,result:{done:!0,value:void 0},state:r},c=Promise.resolve(l.result),c):(c=(async()=>{for(;o.length===0;)await new Promise(e=>{u=e});let e=o.shift();return l=e,e.result})(),c)},async rekeyContinuation(e){if(!e||i?.hook.token===e)return;let r=createState(e);if(i===void 0){await claimHookOwnership(r.hook),enable(r),i=r,c!==null&&arm(r);return}arm(r),await claimHookOwnership(r.hook),enable(r);let o=i;i=r,arm(o);try{await disposeHook(o.hook)}catch(e){i=void 0;try{await disposeHook(r.hook)}catch{}throw e}o.retired=!0,a.push(o)}}}export{createSessionCommandInbox};
+import{createHook}from"#compiled/@workflow/core/index.js";import{claimHookOwnership,disposeHook}from"#execution/hook-ownership.js";function createSessionCommandInbox(){let r,i,a,o=[],s=[],c=0,l=null,u,d,enqueue=e=>{s.push(e),s.sort((e,t)=>e.order-t.order),d?.(),d=void 0},arm=e=>{e.closed||e.pending||(e.pending=!0,e.resolved=void 0,(e.retired?Promise.resolve(e.hook).then(e=>({done:!1,value:e})):e.iterator.next()).then(t=>{let n={order:c++,result:t,state:e};e.resolved=n,e.enabled&&enqueue(n)},()=>{}))},enable=e=>{e.enabled=!0,e.resolved!==void 0&&enqueue(e.resolved)},createState=t=>{let n=createHook({token:t});return{closed:!1,enabled:!1,hook:n,iterator:n[Symbol.asyncIterator](),pending:!1,retired:!1}},states=()=>[r,i,a,...o].filter(e=>e!==void 0),nextRead=()=>{if(r===void 0)throw Error(`Cannot wait for session commands before claiming the stable inbox.`);if(l!==null)return l;let e=states();for(let t of e)arm(t);return e.every(e=>e.closed)?(u={order:c++,result:{done:!0,value:void 0},state:r},l=Promise.resolve(u.result),l):(l=(async()=>{for(;s.length===0;)await new Promise(e=>{d=e});let e=s.shift();return u=e,e.result})(),l)};return{async claimAuthorization(e){if(a!==void 0){if(a.hook.token===e)return;throw Error(`A session command inbox cannot change its authorization token.`)}let n=createState(e);await claimHookOwnership(n.hook),a=n},async claimStable(e){if(r!==void 0){if(r.hook.token===e)return;throw Error(`A session command inbox cannot change its stable token.`)}let n=createState(e);await claimHookOwnership(n.hook),enable(n),r=n},consumeNext(){if(u===void 0)throw Error(`Cannot consume a session command before it resolves.`);u.state.pending=!1,u.state.resolved=void 0,u.result.done&&(u.state.closed=!0),u=void 0,l=null},async dispose(){let e=[i,r,a].filter(e=>e!==void 0);i=void 0,r=void 0,a=void 0,await Promise.all(e.map(async e=>await disposeHook(e.hook)))},hasReadyAuthorization(){return a?.enabled!==!0||a.resolved===void 0?!1:u===void 0?s[0]?.state===a:u.state===a},next:nextRead,async nextWithSource(){return{result:await nextRead(),source:u!==void 0&&u.state===a?`authorization`:`session`}},setAuthorizationWindow(e){if(a===void 0){if(e)throw Error(`Cannot open the authorization window before claiming its hook.`);return}if(e){a.enabled||enable(a),u!==void 0&&u.state!==a&&a.resolved!==void 0&&a.resolved.order<u.order&&(enqueue(u),u=void 0,l=null),l!==null&&arm(a);return}a.enabled=!1;let t=s.findIndex(e=>e.state===a);t!==-1&&s.splice(t,1)},async rekeyContinuation(e){if(!e||i?.hook.token===e)return;let r=createState(e);if(i===void 0){await claimHookOwnership(r.hook),enable(r),i=r,l!==null&&arm(r);return}arm(r),await claimHookOwnership(r.hook),enable(r);let a=i;i=r,arm(a);try{await disposeHook(a.hook)}catch(e){i=void 0;try{await disposeHook(r.hook)}catch{}throw e}a.retired=!0,o.push(a)}}}export{createSessionCommandInbox};

package/dist/src/execution/turn-execution-cursor.d.ts

@@ -15,6 +15,7 @@ type TurnTerminalAction = {
     readonly usage?: TokenUsage;
     readonly usageDelta?: TokenUsage;
 } | {
+    readonly authorizationAttemptIds?: readonly string[];
     readonly authorizationNames?: readonly string[];
     readonly cancelled?: true;
     readonly kind: "park";

package/dist/src/execution/turn-workflow.js

@@ -1 +1 @@
-import{resolveWorkflowCallbackBaseUrl}from"#execution/workflow-callback-url.js";import{dispatchRuntimeActionsStep}from"#execution/dispatch-runtime-actions-step.js";import{routeDeliverToChildren}from"#execution/route-child-delivery.js";import{turnStep}from"#execution/workflow-steps.js";import{createHook,getWorkflowMetadata,sleep}from"#compiled/@workflow/core/index.js";import{claimHookOwnership,disposeHook,isHookConflictError}from"#execution/hook-ownership.js";import{activeTurnId}from"#harness/active-turn-id.js";import{normalizeSerializableError}from"#execution/workflow-errors.js";import{sendTurnControlStep}from"#execution/turn-control-protocol.js";import{isInboxSubagentResultFromRunningHandle}from"#harness/handles/query.js";import{cancelDescendantTurnsStep}from"#execution/cancel-descendant-turns-step.js";import{dispatchWorkflowRuntimeActionsStep}from"#execution/dispatch-workflow-runtime-actions-step.js";import{migrateTurnWorkflowInput}from"#execution/durable-session-migrations/turn-workflow.js";import{runProxySubagentEventStep}from"#execution/subagent-event-proxy-step.js";import{createTurnCancellationControl}from"#execution/turn-cancellation-control.js";import{TurnExecutionCursor}from"#execution/turn-execution-cursor.js";import{resolveRuntimeActionResultsForKeys}from"#runtime/actions/results.js";const TASK_MODE_WAIT_ERROR_MESSAGE="Task mode cannot wait for follow-up input (`next: null`).";async function turnWorkflow(e){"use workflow";let t=migrateTurnWorkflowInput(e);return t.driverCapabilities?.turnInbox===!0?runTurnOwnedWorkflow(t):runLegacyTurnWorkflow(t)}async function runTurnOwnedWorkflow(n){let o=createHook({token:`${n.completionToken}:inbox`}),c=o[Symbol.asyncIterator](),l=new TurnExecutionCursor({controlToken:n.completionToken,parentWritable:n.stepInput.parentWritable,serializedContext:n.stepInput.serializedContext,sessionState:n.stepInput.sessionState}),u=0,nextDeliveryRequestId=()=>`${o.token}:delivery:${String(u++)}`,d=[],f=n.stepInput.input,p=!1,m;try{try{await claimHookOwnership(o),p=!0}catch(e){if(isHookConflictError(e))return;throw e}for(n.driverCapabilities?.cancelledTurnSettle===!0&&(m=await createTurnCancellationControl({controlToken:n.completionToken,expectedTurnId:activeTurnId(n.stepInput.sessionState.emissionState)}));;){let i=await turnStep(l.createStepInput(f,m?.signal)),s=i.action===`dispatch-workflow-runtime-actions`||i.action===`park`?i.pendingRuntimeActionKeys:void 0;if(i.action===`cancelled`||m?.signal.aborted===!0&&s===void 0){await finishCancelledTurn({bufferedDeliveries:d,cancellation:m,cursor:l});return}if(i.sleepDurationMs!==void 0&&await waitForTurnSleep(i.sleepDurationMs,m)===`cancel`){await finishCancelledTurn({bufferedDeliveries:d,cancellation:m,cursor:l});return}if(i.action===`done`){await m?.dispose(),await l.finish(i,{kind:`done`,output:i.output??``,isError:i.isError,usage:i.usage,usageDelta:i.usageDelta},d);return}if(s!==void 0){await l.adopt(i);let n=await(i.action===`dispatch-workflow-runtime-actions`?dispatchWorkflowRuntimeActionsStep:dispatchRuntimeActionsStep)({callbackBaseUrl:resolveWorkflowCallbackBaseUrl(getWorkflowMetadata().url),parentContinuationToken:o.token,parentWritable:l.parentWritable,serializedContext:l.serializedContext,sessionState:l.sessionState});await l.adopt(n);let r=await waitForRuntimeActionResults({bufferedDeliveries:d,cancellation:m,cursor:l,inboxToken:o.token,initialResults:n.results,iterator:c,nextDeliveryRequestId,pendingActionKeys:s});if(r===`cancelled`){f=void 0;continue}if(r===`cancel-turn`){await finishCancelledTurn({bufferedDeliveries:d,cancellation:m,cursor:l});return}f={kind:`runtime-action-result`,results:r};continue}if(i.action===`park`){if(!(i.hasPendingAuthorization||i.hasPendingInputBatch&&n.capabilities?.requestInput===!0||n.mode===`conversation`))throw Error(TASK_MODE_WAIT_ERROR_MESSAGE);await m?.dispose(),await l.finish(i,{authorizationNames:i.authorizationNames,kind:`park`,settled:i.settled},d);return}await l.adopt(i),f=void 0}}catch(e){throw await l.send({error:normalizeSerializableError(e),kind:`turn-error`}),e}finally{m!==void 0&&await m.dispose(),p&&await disposeHook(o)}}async function finishCancelledTurn(e){await cancelDescendantTurnsStep({serializedContext:e.cursor.serializedContext,sessionState:e.cursor.sessionState}),await e.cancellation?.dispose(),await e.cursor.finish({sessionState:e.cursor.sessionState},{cancelled:!0,kind:`park`},e.bufferedDeliveries)}async function waitForTurnSleep(e,t){if(t?.signal.aborted===!0)return`cancel`;let n=sleep(e).then(()=>`slept`);return t===void 0?n:Promise.race([n,t.requested])}async function waitForRuntimeActionResults(e){let t,r=[...e.initialResults];for(;;){let i=resolveRuntimeActionResultsForKeys({pendingKeys:e.pendingActionKeys,results:r});if(i!==void 0)return t!==void 0&&await e.cursor.send({kind:`turn-delivery-cancelled`,requestId:t}),i;e.cursor.sessionState.hasProxyInputRequests&&t===void 0&&(t=e.nextDeliveryRequestId(),await e.cursor.send({continuationToken:e.cursor.sessionState.continuationToken,inboxToken:e.inboxToken,kind:`turn-delivery-request`,requestId:t}));let a=e.iterator.next();a.catch(()=>{});let o=await(e.cancellation===void 0?a:Promise.race([a,e.cancellation.requested]));if(o===`cancel`)return t!==void 0&&await e.cursor.send({kind:`turn-delivery-cancelled`,requestId:t}),`cancelled`;if(o.done)throw Error(`Turn inbox closed before runtime actions completed.`);let s=o.value;if(s.kind===`runtime-action-result`){let t=e.cursor.sessionState.snapshot?.session.state;r.push(...s.results.filter(e=>isInboxSubagentResultFromRunningHandle(t,e)));continue}if(s.kind===`subagent-input-request`||s.kind===`subagent-authorization-event`){let t=await runProxySubagentEventStep({hookPayload:s,parentWritable:e.cursor.parentWritable,serializedContext:e.cursor.serializedContext,sessionState:e.cursor.sessionState});await e.cursor.adopt(t);continue}if(s.kind===`driver-delivery`&&s.requestId===t){await e.cursor.send({kind:`turn-delivery-accepted`,requestId:s.requestId}),t=void 0;let r=await routeDeliverToChildren({auth:s.delivery.auth,parentWritable:e.cursor.parentWritable,payloads:s.delivery.payloads,sessionState:e.cursor.sessionState});if(r.kind===`cancel-turn`)return r.kind;r.remainder!==void 0&&e.bufferedDeliveries.push({...s.delivery,payloads:[r.remainder]})}}}async function runLegacyTurnWorkflow(e){let t=e.stepInput;try{for(;;){let n=await turnStep(t);if(n.action!==`cancelled`&&n.sleepDurationMs!==void 0&&await sleep(n.sleepDurationMs),n.action===`done`){await sendTurnControlStep({controlToken:e.completionToken,payload:{action:{kind:`done`,output:n.output??``,isError:n.isError,serializedContext:n.serializedContext,sessionState:n.sessionState,usage:n.usage,usageDelta:n.usageDelta},kind:`turn-result`}});return}if(n.action===`dispatch-workflow-runtime-actions`){await sendTurnControlStep({controlToken:e.completionToken,payload:{action:{kind:`dispatch-workflow-runtime-actions`,pendingActionKeys:n.pendingRuntimeActionKeys,serializedContext:n.serializedContext,sessionState:n.sessionState},kind:`turn-result`}});return}if(n.action===`park`){let t=n.pendingRuntimeActionKeys;if(!(t!==void 0||n.hasPendingAuthorization||n.hasPendingInputBatch&&e.capabilities?.requestInput===!0||e.mode===`conversation`))throw Error(TASK_MODE_WAIT_ERROR_MESSAGE);let r=t===void 0?{kind:`park`,serializedContext:n.serializedContext,sessionState:n.sessionState,authorizationNames:n.authorizationNames,settled:n.settled}:{kind:`dispatch-runtime-actions`,pendingActionKeys:t,serializedContext:n.serializedContext,sessionState:n.sessionState};await sendTurnControlStep({controlToken:e.completionToken,payload:{action:r,kind:`turn-result`}});return}t={input:void 0,parentWritable:t.parentWritable,serializedContext:n.serializedContext,sessionState:n.sessionState}}}catch(t){throw await sendTurnControlStep({controlToken:e.completionToken,payload:{error:normalizeSerializableError(t),kind:`turn-error`}}),t}}export{turnWorkflow};
+import{resolveWorkflowCallbackBaseUrl}from"#execution/workflow-callback-url.js";import{dispatchRuntimeActionsStep}from"#execution/dispatch-runtime-actions-step.js";import{routeDeliverToChildren}from"#execution/route-child-delivery.js";import{turnStep}from"#execution/workflow-steps.js";import{createHook,getWorkflowMetadata,sleep}from"#compiled/@workflow/core/index.js";import{claimHookOwnership,disposeHook,isHookConflictError}from"#execution/hook-ownership.js";import{activeTurnId}from"#harness/active-turn-id.js";import{normalizeSerializableError}from"#execution/workflow-errors.js";import{sendTurnControlStep}from"#execution/turn-control-protocol.js";import{isInboxSubagentResultFromRunningHandle}from"#harness/handles/query.js";import{cancelDescendantTurnsStep}from"#execution/cancel-descendant-turns-step.js";import{dispatchWorkflowRuntimeActionsStep}from"#execution/dispatch-workflow-runtime-actions-step.js";import{migrateTurnWorkflowInput}from"#execution/durable-session-migrations/turn-workflow.js";import{runProxySubagentEventStep}from"#execution/subagent-event-proxy-step.js";import{createTurnCancellationControl}from"#execution/turn-cancellation-control.js";import{TurnExecutionCursor}from"#execution/turn-execution-cursor.js";import{resolveRuntimeActionResultsForKeys}from"#runtime/actions/results.js";const TASK_MODE_WAIT_ERROR_MESSAGE="Task mode cannot wait for follow-up input (`next: null`).";async function turnWorkflow(e){"use workflow";let t=migrateTurnWorkflowInput(e);return t.driverCapabilities?.turnInbox===!0?runTurnOwnedWorkflow(t):runLegacyTurnWorkflow(t)}async function runTurnOwnedWorkflow(n){let o=createHook({token:`${n.completionToken}:inbox`}),c=o[Symbol.asyncIterator](),l=new TurnExecutionCursor({controlToken:n.completionToken,parentWritable:n.stepInput.parentWritable,serializedContext:n.stepInput.serializedContext,sessionState:n.stepInput.sessionState}),u=0,nextDeliveryRequestId=()=>`${o.token}:delivery:${String(u++)}`,d=[],f=n.stepInput.input,p=!1,m;try{try{await claimHookOwnership(o),p=!0}catch(e){if(isHookConflictError(e))return;throw e}for(n.driverCapabilities?.cancelledTurnSettle===!0&&(m=await createTurnCancellationControl({controlToken:n.completionToken,expectedTurnId:activeTurnId(n.stepInput.sessionState.emissionState)}));;){let i=await turnStep(l.createStepInput(f,m?.signal)),s=i.action===`dispatch-workflow-runtime-actions`||i.action===`park`?i.pendingRuntimeActionKeys:void 0;if(i.action===`cancelled`||m?.signal.aborted===!0&&s===void 0){await finishCancelledTurn({bufferedDeliveries:d,cancellation:m,cursor:l});return}if(i.sleepDurationMs!==void 0&&await waitForTurnSleep(i.sleepDurationMs,m)===`cancel`){await finishCancelledTurn({bufferedDeliveries:d,cancellation:m,cursor:l});return}if(i.action===`done`){await m?.dispose(),await l.finish(i,{kind:`done`,output:i.output??``,isError:i.isError,usage:i.usage,usageDelta:i.usageDelta},d);return}if(s!==void 0){await l.adopt(i);let n=await(i.action===`dispatch-workflow-runtime-actions`?dispatchWorkflowRuntimeActionsStep:dispatchRuntimeActionsStep)({callbackBaseUrl:resolveWorkflowCallbackBaseUrl(getWorkflowMetadata().url),parentContinuationToken:o.token,parentWritable:l.parentWritable,serializedContext:l.serializedContext,sessionState:l.sessionState});await l.adopt(n);let r=await waitForRuntimeActionResults({bufferedDeliveries:d,cancellation:m,cursor:l,inboxToken:o.token,initialResults:n.results,iterator:c,nextDeliveryRequestId,pendingActionKeys:s});if(r===`cancelled`){f=void 0;continue}if(r===`cancel-turn`){await finishCancelledTurn({bufferedDeliveries:d,cancellation:m,cursor:l});return}f={kind:`runtime-action-result`,results:r};continue}if(i.action===`park`){if(!(i.hasPendingAuthorization||i.hasPendingInputBatch&&n.capabilities?.requestInput===!0||n.mode===`conversation`))throw Error(TASK_MODE_WAIT_ERROR_MESSAGE);await m?.dispose(),await l.finish(i,{authorizationAttemptIds:i.authorizationAttemptIds,authorizationNames:i.authorizationNames,kind:`park`,settled:i.settled},d);return}await l.adopt(i),f=void 0}}catch(e){throw await l.send({error:normalizeSerializableError(e),kind:`turn-error`}),e}finally{m!==void 0&&await m.dispose(),p&&await disposeHook(o)}}async function finishCancelledTurn(e){await cancelDescendantTurnsStep({serializedContext:e.cursor.serializedContext,sessionState:e.cursor.sessionState}),await e.cancellation?.dispose(),await e.cursor.finish({sessionState:e.cursor.sessionState},{cancelled:!0,kind:`park`},e.bufferedDeliveries)}async function waitForTurnSleep(e,t){if(t?.signal.aborted===!0)return`cancel`;let n=sleep(e).then(()=>`slept`);return t===void 0?n:Promise.race([n,t.requested])}async function waitForRuntimeActionResults(e){let t,r=[...e.initialResults];for(;;){let i=resolveRuntimeActionResultsForKeys({pendingKeys:e.pendingActionKeys,results:r});if(i!==void 0)return t!==void 0&&await e.cursor.send({kind:`turn-delivery-cancelled`,requestId:t}),i;e.cursor.sessionState.hasProxyInputRequests&&t===void 0&&(t=e.nextDeliveryRequestId(),await e.cursor.send({continuationToken:e.cursor.sessionState.continuationToken,inboxToken:e.inboxToken,kind:`turn-delivery-request`,requestId:t}));let a=e.iterator.next();a.catch(()=>{});let o=await(e.cancellation===void 0?a:Promise.race([a,e.cancellation.requested]));if(o===`cancel`)return t!==void 0&&await e.cursor.send({kind:`turn-delivery-cancelled`,requestId:t}),`cancelled`;if(o.done)throw Error(`Turn inbox closed before runtime actions completed.`);let s=o.value;if(s.kind===`runtime-action-result`){let t=e.cursor.sessionState.snapshot?.session.state;r.push(...s.results.filter(e=>isInboxSubagentResultFromRunningHandle(t,e)));continue}if(s.kind===`subagent-input-request`||s.kind===`subagent-authorization-event`){let t=await runProxySubagentEventStep({hookPayload:s,parentWritable:e.cursor.parentWritable,serializedContext:e.cursor.serializedContext,sessionState:e.cursor.sessionState});await e.cursor.adopt(t);continue}if(s.kind===`driver-delivery`&&s.requestId===t){await e.cursor.send({kind:`turn-delivery-accepted`,requestId:s.requestId}),t=void 0;let r=await routeDeliverToChildren({auth:s.delivery.auth,parentWritable:e.cursor.parentWritable,payloads:s.delivery.payloads,sessionState:e.cursor.sessionState});if(r.kind===`cancel-turn`)return r.kind;r.remainder!==void 0&&e.bufferedDeliveries.push({...s.delivery,payloads:[r.remainder]})}}}async function runLegacyTurnWorkflow(e){let t=e.stepInput;try{for(;;){let n=await turnStep(t);if(n.action!==`cancelled`&&n.sleepDurationMs!==void 0&&await sleep(n.sleepDurationMs),n.action===`done`){await sendTurnControlStep({controlToken:e.completionToken,payload:{action:{kind:`done`,output:n.output??``,isError:n.isError,serializedContext:n.serializedContext,sessionState:n.sessionState,usage:n.usage,usageDelta:n.usageDelta},kind:`turn-result`}});return}if(n.action===`dispatch-workflow-runtime-actions`){await sendTurnControlStep({controlToken:e.completionToken,payload:{action:{kind:`dispatch-workflow-runtime-actions`,pendingActionKeys:n.pendingRuntimeActionKeys,serializedContext:n.serializedContext,sessionState:n.sessionState},kind:`turn-result`}});return}if(n.action===`park`){let t=n.pendingRuntimeActionKeys;if(!(t!==void 0||n.hasPendingAuthorization||n.hasPendingInputBatch&&e.capabilities?.requestInput===!0||e.mode===`conversation`))throw Error(TASK_MODE_WAIT_ERROR_MESSAGE);let r=t===void 0?{kind:`park`,serializedContext:n.serializedContext,sessionState:n.sessionState,authorizationAttemptIds:n.authorizationAttemptIds,authorizationNames:n.authorizationNames,settled:n.settled}:{kind:`dispatch-runtime-actions`,pendingActionKeys:t,serializedContext:n.serializedContext,sessionState:n.sessionState};await sendTurnControlStep({controlToken:e.completionToken,payload:{action:r,kind:`turn-result`}});return}t={input:void 0,parentWritable:t.parentWritable,serializedContext:n.serializedContext,sessionState:n.sessionState}}}catch(t){throw await sendTurnControlStep({controlToken:e.completionToken,payload:{error:normalizeSerializableError(t),kind:`turn-error`}}),t}}export{turnWorkflow};

package/dist/src/execution/workflow-entry.js

@@ -1 +1 @@
-import{sessionCommandHookToken}from"#execution/session-command-token.js";import{readSerializedSubagentDepth}from"#harness/subagent-depth.js";import{createHook,getWorkflowMetadata,getWritable}from"#compiled/@workflow/core/index.js";import{disposeHook}from"#execution/hook-ownership.js";import{normalizeSerializableError}from"#execution/workflow-errors.js";import{cancelDescendantTurnsStep}from"#execution/cancel-descendant-turns-step.js";import{readChannelRequestId,readRootSessionId}from"#execution/eve-workflow-attributes.js";import{notifyDelegatedParentStep,notifyTurnCallerStep,resolveInitialTurnCallerStep}from"#execution/delegated-parent-notification.js";import{createDelegatedSubagentErrorResult,createDelegatedSubagentSuccessResult}from"#execution/delegated-parent-result.js";import{nextTurnDelivery}from"#execution/parked-delivery-wait.js";import{dispatchAndAwaitTurn}from"#execution/turn-dispatch.js";import{createSessionStep}from"#execution/create-session-step.js";import{settleCancelledTurnStep}from"#execution/settle-cancelled-turn-step.js";import{emitTerminalSessionFailureStep}from"#execution/terminal-session-failure-step.js";import{fireSessionCallbackStep}from"#execution/session-callback-step.js";import{createSessionCommandInbox}from"#execution/session-command-inbox.js";import{DEFAULT_SESSION_TIMEOUT_MS}from"#execution/session-timeout.js";import{emitTerminalSessionCompletionStep}from"#execution/terminal-session-completion-step.js";import{createSessionTimeoutControl}from"#execution/session-timeout-control.js";import{terminateChildSessionsStep}from"#execution/terminate-child-sessions-step.js";async function workflowEntry(e){"use workflow";let{workflowRunId:n,workflowStartedAt:a}=getWorkflowMetadata(),s=e.serializedContext[`eve.continuationToken`]||``,m=e.serializedContext[`eve.mode`],h=e.serializedContext[`eve.capabilities`],g=e.serializedContext[`eve.bundle`];e.serializedContext[`eve.sessionId`]=n;let _=getWritable(),v={caller:void 0,callerResolved:!1,lastSessionState:void 0};try{let r=readRootSessionId(e.serializedContext),i=readSerializedSubagentDepth(e.serializedContext),o=e.serializedContext[`eve.dynamicSubagentAgentConfig`],{state:u}=await createSessionStep({compiledArtifactsSource:g.source,continuationToken:s,dynamicSubagentAgentConfig:o,inheritedLimits:e.limits,nodeId:g.nodeId,outputSchema:e.input.outputSchema,rootSessionId:r,sessionId:n,subagentDepth:i});v.lastSessionState=u,v.caller=await resolveInitialTurnCallerStep({serializedContext:e.serializedContext}),v.callerResolved=!0;let d=await runDriverLoop({capabilities:h,driverWritable:_,initialInput:{kind:`deliver`,payloads:[{message:e.input.message,context:e.input.context,outputSchema:e.input.outputSchema}],requestId:readChannelRequestId(e.serializedContext)},crashCleanupState:v,mode:m,serializedContext:e.serializedContext,sessionState:u,sessionTimeoutDeadline:e.sessionTimeoutMs===!1?void 0:new Date(a.getTime()+(e.sessionTimeoutMs??DEFAULT_SESSION_TIMEOUT_MS))});return d.kind===`result`?d.result:await finalizeExpiredSession({caller:v.caller,driverWritable:_,mode:m,serializedContext:d.serializedContext,sessionState:d.sessionState})}catch(t){throw v.lastSessionState!==void 0&&await terminateChildSessionsStep({sessionState:v.lastSessionState}),await emitTerminalSessionFailureStep({error:normalizeSerializableError(t),parentWritable:_,serializedContext:e.serializedContext}),m===`task`?(await fireSessionCallbackStep({error:normalizeSerializableError(t),serializedContext:e.serializedContext,status:`failed`}),await notifyDelegatedParentStep({result:createDelegatedSubagentErrorResult(e.serializedContext,t),serializedContext:e.serializedContext})):await notifyTurnCallerStep({caller:await resolveCallerForCrash(v,e.serializedContext),lifecycle:`terminal`,sessionId:n,settled:{isError:!0,output:t}}),createSafeOuterWorkflowError()}}async function resolveCallerForCrash(e,t){if(e.callerResolved)return e.caller;try{return await resolveInitialTurnCallerStep({serializedContext:t})}catch{return}}function createSafeOuterWorkflowError(){let e=Error(`Agent workflow failed. Inspect the private session trace for details.`);return e.name=`EveWorkflowFailure`,e}async function runDriverLoop(t){let r=createHook({token:`${t.sessionState.sessionId}:auth`}),i=r[Symbol.asyncIterator](),o=0,nextTurnControlToken=()=>`${t.sessionState.sessionId}:turn-control:${String(o++)}`,c=[],l=[],u=createSessionCommandInbox(),f=sessionCommandHookToken(t.sessionState.sessionId);await u.claimStable(f);let p=t.sessionTimeoutDeadline===void 0?void 0:createSessionTimeoutControl({deadline:t.sessionTimeoutDeadline,token:f}),m,runTurn=async e=>{let n=await dispatchAndAwaitTurn({bufferedDeliveries:c,bufferedSessionControls:l,capabilities:t.capabilities,commandInbox:u,controlToken:nextTurnControlToken(),delivery:e.delivery,mode:t.mode,parentWritable:t.driverWritable,serializedContext:e.serializedContext,sessionState:e.sessionState});return await m?.(),m=n.dispose,n.action};try{t.sessionState.continuationToken&&await u.rekeyContinuation(t.sessionState.continuationToken),await p?.start();let e=await runTurn({delivery:t.initialInput,serializedContext:t.serializedContext,sessionState:t.sessionState});for(t.crashCleanupState.lastSessionState=e.sessionState;;){if(e.kind===`done`)return{kind:`result`,result:await finalizeDone({action:e,caller:t.crashCleanupState.caller,mode:t.mode})};if(e.kind!==`park`)throw Error(`Driver received unexpected turn action "${e.kind}".`);if(e.cancelled===!0){let n=await settleCancelledTurnStep({parentWritable:t.driverWritable,serializedContext:e.serializedContext,sessionState:e.sessionState});e={...e,serializedContext:n.serializedContext,sessionState:n.sessionState},t.crashCleanupState.lastSessionState=e.sessionState}if(e.sessionState.continuationToken&&await u.rekeyContinuation(e.sessionState.continuationToken),e.authorizationNames&&e.authorizationNames.length>0){let n=e.authorizationNames.length,r=[];for(;r.length<n;){let e=await i.next();if(e.done)break;e.value.kind===`deliver`&&r.push(...e.value.payloads)}e=await runTurn({delivery:{kind:`deliver`,payloads:r},serializedContext:e.serializedContext,sessionState:e.sessionState}),t.crashCleanupState.lastSessionState=e.sessionState;continue}let n=e.settled;e.cancelled!==!0&&n!==void 0?(await notifyTurnCallerStep({caller:t.crashCleanupState.caller,lifecycle:`parked`,sessionId:e.sessionState.sessionId,settled:n}),t.crashCleanupState.caller=void 0):e.cancelled===!0&&(t.crashCleanupState.caller=void 0);let r=await nextTurnDelivery({bufferedDeliveries:c,bufferedSessionControls:l,commandInbox:u,driverWritable:t.driverWritable,sessionState:e.sessionState});if(r.kind===`expired`)return{kind:`expired`,serializedContext:e.serializedContext,sessionState:e.sessionState};if(r.kind===`reset`)return await terminateChildSessionsStep({sessionState:e.sessionState}),{kind:`result`,result:{output:``}};if(r.kind===`clear`||r.kind===`compact`){e=await runTurn({delivery:{kind:r.kind},serializedContext:e.serializedContext,sessionState:e.sessionState}),t.crashCleanupState.lastSessionState=e.sessionState;continue}if(r.kind===`closed`)return{kind:`result`,result:{output:``}};if(r.kind===`cancel-turn`){await cancelDescendantTurnsStep({serializedContext:e.serializedContext,sessionState:e.sessionState});let n=await settleCancelledTurnStep({parentWritable:t.driverWritable,serializedContext:e.serializedContext,sessionState:e.sessionState});e={...e,serializedContext:n.serializedContext,sessionState:n.sessionState,settled:void 0},t.crashCleanupState.caller=void 0,t.crashCleanupState.lastSessionState=e.sessionState;continue}r.deliver.caller!==void 0&&(t.crashCleanupState.caller=r.deliver.caller),e=await runTurn({delivery:{auth:r.deliver.auth,kind:`deliver`,payloads:[r.remainder],requestId:r.deliver.requestId},serializedContext:e.serializedContext,sessionState:e.sessionState}),t.crashCleanupState.lastSessionState=e.sessionState}}finally{await m?.(),await p?.dispose(),await u.dispose(),await disposeHook(r)}}async function finalizeExpiredSession(e){return await terminateChildSessionsStep({sessionState:e.sessionState}),await emitTerminalSessionCompletionStep({parentWritable:e.driverWritable,serializedContext:e.serializedContext}),e.mode===`task`?(await fireSessionCallbackStep({output:``,serializedContext:e.serializedContext,status:`completed`}),await notifyDelegatedParentStep({result:createDelegatedSubagentSuccessResult(e.serializedContext,``),serializedContext:e.serializedContext})):await notifyTurnCallerStep({caller:e.caller,lifecycle:`terminal`,sessionId:e.sessionState.sessionId,settled:{output:``}}),{output:``}}async function finalizeDone(e){let{output:t,serializedContext:n}=e.action,r=e.action.isError===!0;if(await terminateChildSessionsStep({sessionState:e.action.sessionState}),e.mode===`task`)await fireSessionCallbackStep({error:r?t:void 0,output:r?void 0:t,serializedContext:n,status:r?`failed`:`completed`,usage:r?void 0:e.action.usage}),await notifyDelegatedParentStep({result:r?createDelegatedSubagentErrorResult(n,t):createDelegatedSubagentSuccessResult(n,t),serializedContext:n,usage:r?void 0:e.action.usage});else{let n={output:t,usage:e.action.usageDelta};r&&(n.isError=!0),await notifyTurnCallerStep({caller:e.caller,lifecycle:`terminal`,sessionId:e.action.sessionState.sessionId,settled:n})}return{output:t}}export{workflowEntry};
+import{sessionCommandHookToken}from"#execution/session-command-token.js";import{readSerializedSubagentDepth}from"#harness/subagent-depth.js";import{getWorkflowMetadata,getWritable}from"#compiled/@workflow/core/index.js";import{normalizeSerializableError}from"#execution/workflow-errors.js";import{cancelDescendantTurnsStep}from"#execution/cancel-descendant-turns-step.js";import{readChannelRequestId,readRootSessionId}from"#execution/eve-workflow-attributes.js";import{notifyDelegatedParentStep,notifyTurnCallerStep,resolveInitialTurnCallerStep}from"#execution/delegated-parent-notification.js";import{createDelegatedSubagentErrorResult,createDelegatedSubagentSuccessResult}from"#execution/delegated-parent-result.js";import{nextTurnDelivery}from"#execution/parked-delivery-wait.js";import{dispatchAndAwaitTurn}from"#execution/turn-dispatch.js";import{createSessionStep}from"#execution/create-session-step.js";import{settleCancelledTurnStep}from"#execution/settle-cancelled-turn-step.js";import{emitTerminalSessionFailureStep}from"#execution/terminal-session-failure-step.js";import{fireSessionCallbackStep}from"#execution/session-callback-step.js";import{createSessionCommandInbox}from"#execution/session-command-inbox.js";import{DEFAULT_SESSION_TIMEOUT_MS}from"#execution/session-timeout.js";import{emitTerminalSessionCompletionStep}from"#execution/terminal-session-completion-step.js";import{createSessionTimeoutControl}from"#execution/session-timeout-control.js";import{terminateChildSessionsStep}from"#execution/terminate-child-sessions-step.js";async function workflowEntry(e){"use workflow";let{workflowRunId:a,workflowStartedAt:f}=getWorkflowMetadata(),p=e.serializedContext[`eve.continuationToken`]||``,m=e.serializedContext[`eve.mode`],h=e.serializedContext[`eve.capabilities`],g=e.serializedContext[`eve.bundle`];e.serializedContext[`eve.sessionId`]=a;let _=getWritable(),v={caller:void 0,callerResolved:!1,lastSessionState:void 0};try{let n=readRootSessionId(e.serializedContext),r=readSerializedSubagentDepth(e.serializedContext),i=e.serializedContext[`eve.dynamicSubagentAgentConfig`],{state:c}=await createSessionStep({compiledArtifactsSource:g.source,continuationToken:p,dynamicSubagentAgentConfig:i,inheritedLimits:e.limits,nodeId:g.nodeId,outputSchema:e.input.outputSchema,rootSessionId:n,sessionId:a,subagentDepth:r});v.lastSessionState=c,v.caller=await resolveInitialTurnCallerStep({serializedContext:e.serializedContext}),v.callerResolved=!0;let l=await runDriverLoop({capabilities:h,driverWritable:_,initialInput:{kind:`deliver`,payloads:[{message:e.input.message,context:e.input.context,outputSchema:e.input.outputSchema}],requestId:readChannelRequestId(e.serializedContext)},crashCleanupState:v,mode:m,serializedContext:e.serializedContext,sessionState:c,sessionTimeoutDeadline:e.sessionTimeoutMs===!1?void 0:new Date(f.getTime()+(e.sessionTimeoutMs??DEFAULT_SESSION_TIMEOUT_MS))});return l.kind===`result`?l.result:await finalizeExpiredSession({caller:v.caller,driverWritable:_,mode:m,serializedContext:l.serializedContext,sessionState:l.sessionState})}catch(t){throw v.lastSessionState!==void 0&&await terminateChildSessionsStep({sessionState:v.lastSessionState}),await emitTerminalSessionFailureStep({error:normalizeSerializableError(t),parentWritable:_,serializedContext:e.serializedContext}),m===`task`?(await fireSessionCallbackStep({error:normalizeSerializableError(t),serializedContext:e.serializedContext,status:`failed`}),await notifyDelegatedParentStep({result:createDelegatedSubagentErrorResult(e.serializedContext,t),serializedContext:e.serializedContext})):await notifyTurnCallerStep({caller:await resolveCallerForCrash(v,e.serializedContext),lifecycle:`terminal`,sessionId:a,settled:{isError:!0,output:t}}),createSafeOuterWorkflowError()}}async function resolveCallerForCrash(e,t){if(e.callerResolved)return e.caller;try{return await resolveInitialTurnCallerStep({serializedContext:t})}catch{return}}function createSafeOuterWorkflowError(){let e=Error(`Agent workflow failed. Inspect the private session trace for details.`);return e.name=`EveWorkflowFailure`,e}async function runDriverLoop(t){let n=new Map,nextParkedActivity=async e=>{let r=new Set(e.expectedAttemptIds);for(let e of n.keys())r.has(e)||n.delete(e);for(;;){if(r.size>0&&[...r].every(e=>n.has(e))){let e=[...r].map(e=>n.get(e));return n.clear(),{kind:`authorization-resume`,payloads:e}}let a=await nextTurnDelivery({awaitAuthorizationCallbacks:r.size>0,bufferedDeliveries:i,bufferedSessionControls:o,commandInbox:s,deferDeliveries:t.mode===`task`&&r.size>0,driverWritable:t.driverWritable,sessionState:e.sessionState});if(a.kind!==`authorization`)return a;for(let e of a.payloads){let t=e.authorizationCallback;typeof t?.attemptId==`string`&&r.has(t.attemptId)&&!n.has(t.attemptId)&&n.set(t.attemptId,e)}if(a.closed){let e=[...n.values()];return n.clear(),{kind:`authorization-resume`,payloads:e}}}},r=0,nextTurnControlToken=()=>`${t.sessionState.sessionId}:turn-control:${String(r++)}`,i=[],o=[],s=createSessionCommandInbox(),c=sessionCommandHookToken(t.sessionState.sessionId);await s.claimStable(c),await s.claimAuthorization(`${t.sessionState.sessionId}:auth`);let u=t.sessionTimeoutDeadline===void 0?void 0:createSessionTimeoutControl({deadline:t.sessionTimeoutDeadline,token:c}),d,runTurn=async e=>{let n=await dispatchAndAwaitTurn({bufferedDeliveries:i,bufferedSessionControls:o,capabilities:t.capabilities,commandInbox:s,controlToken:nextTurnControlToken(),delivery:e.delivery,mode:t.mode,parentWritable:t.driverWritable,serializedContext:e.serializedContext,sessionState:e.sessionState});return await d?.(),d=n.dispose,n.action};try{t.sessionState.continuationToken&&await s.rekeyContinuation(t.sessionState.continuationToken),await u?.start();let e=await runTurn({delivery:t.initialInput,serializedContext:t.serializedContext,sessionState:t.sessionState});for(t.crashCleanupState.lastSessionState=e.sessionState;;){if(e.kind===`done`)return{kind:`result`,result:await finalizeDone({action:e,caller:t.crashCleanupState.caller,mode:t.mode})};if(e.kind!==`park`)throw Error(`Driver received unexpected turn action "${e.kind}".`);if(e.cancelled===!0){let n=await settleCancelledTurnStep({parentWritable:t.driverWritable,serializedContext:e.serializedContext,sessionState:e.sessionState});e={...e,serializedContext:n.serializedContext,sessionState:n.sessionState},t.crashCleanupState.lastSessionState=e.sessionState}e.sessionState.continuationToken&&await s.rekeyContinuation(e.sessionState.continuationToken);let n=e.settled;e.cancelled!==!0&&n!==void 0?(await notifyTurnCallerStep({caller:t.crashCleanupState.caller,lifecycle:`parked`,sessionId:e.sessionState.sessionId,settled:n}),t.crashCleanupState.caller=void 0):e.cancelled===!0&&(t.crashCleanupState.caller=void 0);let r=await nextParkedActivity({expectedAttemptIds:e.authorizationAttemptIds??[],sessionState:e.sessionState});if(r.kind===`authorization-resume`){e=await runTurn({delivery:{kind:`deliver`,payloads:r.payloads},serializedContext:e.serializedContext,sessionState:e.sessionState}),t.crashCleanupState.lastSessionState=e.sessionState;continue}if(r.kind===`expired`)return{kind:`expired`,serializedContext:e.serializedContext,sessionState:e.sessionState};if(r.kind===`reset`)return await terminateChildSessionsStep({sessionState:e.sessionState}),{kind:`result`,result:{output:``}};if(r.kind===`clear`||r.kind===`compact`){e=await runTurn({delivery:{kind:r.kind},serializedContext:e.serializedContext,sessionState:e.sessionState}),t.crashCleanupState.lastSessionState=e.sessionState;continue}if(r.kind===`closed`)return{kind:`result`,result:{output:``}};if(r.kind===`cancel-turn`){await cancelDescendantTurnsStep({serializedContext:e.serializedContext,sessionState:e.sessionState});let n=await settleCancelledTurnStep({parentWritable:t.driverWritable,serializedContext:e.serializedContext,sessionState:e.sessionState});e={...e,serializedContext:n.serializedContext,sessionState:n.sessionState,settled:void 0},t.crashCleanupState.caller=void 0,t.crashCleanupState.lastSessionState=e.sessionState;continue}r.deliver.caller!==void 0&&(t.crashCleanupState.caller=r.deliver.caller),e=await runTurn({delivery:{auth:r.deliver.auth,kind:`deliver`,payloads:[r.remainder],requestId:r.deliver.requestId},serializedContext:e.serializedContext,sessionState:e.sessionState}),t.crashCleanupState.lastSessionState=e.sessionState}}finally{await d?.(),await u?.dispose(),await s.dispose()}}async function finalizeExpiredSession(e){return await terminateChildSessionsStep({sessionState:e.sessionState}),await emitTerminalSessionCompletionStep({parentWritable:e.driverWritable,serializedContext:e.serializedContext}),e.mode===`task`?(await fireSessionCallbackStep({output:``,serializedContext:e.serializedContext,status:`completed`}),await notifyDelegatedParentStep({result:createDelegatedSubagentSuccessResult(e.serializedContext,``),serializedContext:e.serializedContext})):await notifyTurnCallerStep({caller:e.caller,lifecycle:`terminal`,sessionId:e.sessionState.sessionId,settled:{output:``}}),{output:``}}async function finalizeDone(e){let{output:t,serializedContext:n}=e.action,r=e.action.isError===!0;if(await terminateChildSessionsStep({sessionState:e.action.sessionState}),e.mode===`task`)await fireSessionCallbackStep({error:r?t:void 0,output:r?void 0:t,serializedContext:n,status:r?`failed`:`completed`,usage:r?void 0:e.action.usage}),await notifyDelegatedParentStep({result:r?createDelegatedSubagentErrorResult(n,t):createDelegatedSubagentSuccessResult(n,t),serializedContext:n,usage:r?void 0:e.action.usage});else{let n={output:t,usage:e.action.usageDelta};r&&(n.isError=!0),await notifyTurnCallerStep({caller:e.caller,lifecycle:`terminal`,sessionId:e.action.sessionState.sessionId,settled:n})}return{output:t}}export{workflowEntry};

package/dist/src/execution/workflow-steps.d.ts

@@ -8,10 +8,8 @@ import { type TurnStepInput, type TurnWorkflowDispatchInput } from "#execution/d
 /**
  * Result of one durable harness step, consumed by the turn workflow.
  *
- * `park` carries `hasPendingInputBatch`, `hasPendingAuthorization`, and
- * `pendingRuntimeActionKeys` so the turn workflow can pick the right
- * {@link import("#execution/next-driver-action.js").NextDriverAction}
- * arm without re-reading the session.
+ * `park` carries the pending fields needed to choose a
+ * {@link import("#execution/next-driver-action.js").NextDriverAction} without re-reading state.
  *
  * `cancelled` converts the harness's cancellation throw into a *returned*
  * result so workflow-core never classifies the abort as a step failure or
@@ -42,6 +40,7 @@ export type DurableStepResult = {
     readonly sessionState: DurableSessionState;
 } | {
     readonly action: "park";
+    readonly authorizationAttemptIds?: readonly string[];
     readonly authorizationNames?: readonly string[];
     readonly hasPendingAuthorization: boolean;
     readonly hasPendingInputBatch: boolean;