eve 0.31.3 → 0.33.0

package/dist/src/compiler/normalize-subagent.js

@@ -1 +1 @@
-import{expectBoolean,expectFunction,expectObjectRecord,expectOnlyKnownKeys,expectString}from"#internal/authored-module.js";import{EVE_SESSION_ROUTE_PATH}from"#protocol/routes.js";import{DEFAULT_AGENT_MODEL_ID}from"#shared/default-agent-model.js";import{serializeOutputSchema}from"#shared/tool-schema.js";import{createCompiledSubagentNodeId}from"#compiler/manifest.js";import{normalizeAgentDefinition}from"#internal/authored-definition/core.js";import{loadModuleBackedDefinition}from"#compiler/normalize-helpers.js";import{isDynamicSentinel}from"#shared/dynamic-tool-definition.js";import{createPathDerivedSourceId}from"#discover/manifest.js";const ALLOWED_DYNAMIC_SUBAGENT_EVENTS=new Set([`session.started`,`turn.started`]);async function compileSubagentGraph(e){let t=[],n=[],r=[];for(let i of e.subagents){let a=await compileSubagentDefinition({appRoot:e.appRoot,compileAgentNodeManifest:e.compileAgentNodeManifest,context:e.context,externalDependencies:e.externalDependencies,parentNodeId:e.parentNodeId,source:i});if(a.kind===`remote`){r.push(a.node);continue}t.push(a.node,...a.descendants.nodes),n.push({childNodeId:a.node.nodeId,parentNodeId:e.parentNodeId},...a.descendants.edges)}return{edges:n,nodes:t,remoteAgents:r}}async function compileSubagentDefinition(e){let t=e.source.manifest.configModule;if(t===void 0)throw Error(`Subagent "${e.source.logicalPath}" is missing an agent config module.`);let n=createSubagentConfigModuleSourceRef(e.source,t),r=await loadModuleBackedDefinition({agentRoot:e.source.manifest.agentRoot,displayPath:n.logicalPath,externalDependencies:e.externalDependencies,kind:`subagent config`,source:t}),i=normalizeDynamicSubagentDefinition(r,`Expected the dynamic subagent config export "${t.exportName??`default`}" from "${n.logicalPath}" to match the public eve shape.`);if(i===void 0&&readAgentDefinitionKind(r)===`remote`)return{kind:`remote`,node:compileRemoteAgent({source:e.source,value:r})};let a=r;if(i!==void 0){let e={model:DEFAULT_AGENT_MODEL_ID};i.build!==void 0&&(e.build=i.build),a=e}return{kind:`local`,...await compileLocalSubagent({...e,agentConfigDefinition:a,dynamic:i?.definition})}}async function compileSubagent(e){let t=createCompiledSubagentNodeId(e.parentNodeId,e.source.sourceId),n=e.source.subagentId,r=await e.compileAgentNodeManifest({...e.source.manifest,appRoot:e.appRoot},e.context,{agentConfigDefinition:e.agentConfigDefinition,allowWorkflowConfig:!1,externalDependencies:e.externalDependencies}),i=r.config.description,a;if(e.dynamic!==void 0)a={dynamic:e.dynamic};else{if(!i)throw Error(`Local subagent "${e.source.logicalPath}" is missing a "description" field on its agent config. Add \`description\` to \`defineAgent({ ... })\` so the parent agent can decide when to delegate to this subagent.`);a={description:i}}let o=await compileSubagentGraph({appRoot:e.appRoot,compileAgentNodeManifest:e.compileAgentNodeManifest,context:e.context,externalDependencies:r.config.build?.externalDependencies,parentNodeId:t,subagents:e.source.manifest.subagents});return{descendants:o,node:{agent:{...r,remoteAgents:[...o.remoteAgents]},...a,entryPath:e.source.entryPath,logicalPath:e.source.logicalPath,name:n,nodeId:t,rootPath:e.source.rootPath,sourceId:e.source.sourceId,sourceKind:`module`}}}const compileLocalSubagent=compileSubagent;function compileRemoteAgent(e){let t=e.source.manifest.configModule;if(t===void 0)throw Error(`Remote agent "${e.source.logicalPath}" is missing a config module.`);assertRemoteAgentDefinitionHasNoLocalPackageEntries(e.source);let n=createSubagentConfigModuleSourceRef(e.source,t),r=normalizeRemoteAgentDefinition(e.value,`Expected the remote agent config export "${t.exportName??`default`}" from "${n.logicalPath}" to match the public eve shape.`),i={...n,description:r.description,entryPath:e.source.entryPath,name:e.source.subagentId,nodeId:e.source.sourceId,outputSchema:r.outputSchema,path:r.path,rootPath:e.source.rootPath};return r.url===void 0?i:{...i,url:r.url}}function normalizeDynamicSubagentDefinition(e,i){if(!isDynamicSentinel(e))return;let a=expectObjectRecord(e,i);if(Object.hasOwn(a,`fallback`))throw Error(`${i} Dynamic subagent definitions do not support "fallback". Return defineAgent(...) or defineRemoteAgent(...) from an event handler instead.`);expectOnlyKnownKeys(a,[`build`,`events`,`kind`],i);let s=a.build===void 0?void 0:normalizeAgentDefinition({build:a.build,model:DEFAULT_AGENT_MODEL_ID},i).build,c=expectObjectRecord(a.events,i),l=[];for(let[e,n]of Object.entries(c)){if(!ALLOWED_DYNAMIC_SUBAGENT_EVENTS.has(e))throw Error(`${i} Dynamic subagents support only "session.started" and "turn.started" handlers.`);expectFunction(n,i),l.push(e)}let u={definition:{eventNames:l}};return s!==void 0&&(u.build=s),u}function createSubagentConfigModuleSourceRef(e,t){let n=e.logicalPath===t.logicalPath?t.logicalPath:`${e.logicalPath}/${t.logicalPath}`,r={logicalPath:n,sourceId:createPathDerivedSourceId(n),sourceKind:`module`};return t.exportName!==void 0&&(r.exportName=t.exportName),r}function readAgentDefinitionKind(e){return typeof e!=`object`||!e?`local`:e.kind===`remote`?`remote`:`local`}function normalizeRemoteAgentDefinition(t,o){let c=expectObjectRecord(t,o);if(expectOnlyKnownKeys(c,[`auth`,`description`,`forwardPrincipal`,`headers`,`kind`,`outputSchema`,`path`,`url`],o),c.kind!==`remote`)throw Error(`${o} Expected "kind" to be "remote".`);return c.forwardPrincipal!==void 0&&expectBoolean(c.forwardPrincipal,`${o} Expected "forwardPrincipal" to be a boolean.`),{description:expectString(c.description,o),outputSchema:serializeOutputSchema(c.outputSchema),path:c.path===void 0?EVE_SESSION_ROUTE_PATH:expectString(c.path,o),url:typeof c.url==`function`?void 0:expectString(c.url,o)}}function assertRemoteAgentDefinitionHasNoLocalPackageEntries(e){let t=e.manifest,n=[t.connections.length>0?`connections/`:void 0,t.hooks.length>0?`hooks/`:void 0,t.instructions.length>0?`instructions`:void 0,t.lib.length>0?`lib/`:void 0,t.sandbox===null?void 0:`sandbox/`,t.sandboxWorkspaces.length>0?`sandbox/workspace/`:void 0,t.schedules.length>0?`schedules/`:void 0,t.skills.length>0?`skills/`:void 0,t.subagents.length>0?`subagents/`:void 0,t.tools.length>0?`tools/`:void 0].filter(e=>e!==void 0);if(n.length!==0)throw Error(`Remote subagent definition "${e.logicalPath}" cannot include local package entries. Remove unsupported entries: ${n.join(`, `)}.`)}export{compileSubagentGraph};
+import{expectBoolean,expectFunction,expectObjectRecord,expectOnlyKnownKeys,expectString}from"#internal/authored-module.js";import{EVE_SESSION_ROUTE_PATH}from"#protocol/routes.js";import{serializeOutputSchema}from"#shared/tool-schema.js";import{createCompiledSubagentNodeId}from"#compiler/manifest.js";import{loadModuleBackedDefinition}from"#compiler/normalize-helpers.js";import{isDynamicSentinel}from"#shared/dynamic-tool-definition.js";import{createPathDerivedSourceId}from"#discover/manifest.js";const ALLOWED_DYNAMIC_SUBAGENT_EVENTS=new Set([`session.started`,`turn.started`]);async function compileSubagentGraph(e){let t=[],n=[],r=[];for(let i of e.subagents){let a=await compileSubagentDefinition({appRoot:e.appRoot,compileAgentNodeManifest:e.compileAgentNodeManifest,compileAgentResources:e.compileAgentResources,context:e.context,externalDependencies:e.externalDependencies,parentNodeId:e.parentNodeId,source:i});if(a.kind===`remote`){r.push(a.node);continue}t.push(a.node,...a.descendants.nodes),n.push({childNodeId:a.node.nodeId,parentNodeId:e.parentNodeId},...a.descendants.edges)}return{edges:n,nodes:t,remoteAgents:r}}async function compileSubagentDefinition(e){let t=e.source.manifest.configModule;if(t===void 0)throw Error(`Subagent "${e.source.logicalPath}" is missing an agent config module.`);let n=createSubagentConfigModuleSourceRef(e.source,t),r=await loadModuleBackedDefinition({agentRoot:e.source.manifest.agentRoot,displayPath:n.logicalPath,externalDependencies:e.externalDependencies,kind:`subagent config`,source:t}),i=normalizeDynamicSubagentDefinition(r,`Expected the dynamic subagent config export "${t.exportName??`default`}" from "${n.logicalPath}" to match the public eve shape.`);return i===void 0&&readAgentDefinitionKind(r)===`remote`?{kind:`remote`,node:compileRemoteAgent({source:e.source,value:r})}:{kind:`local`,...await compileLocalSubagent({...e,agentConfigDefinition:i===void 0?r:void 0,configResolver:i===void 0?void 0:{...t,...i.definition,build:i.build}})}}async function compileSubagent(e){let t=createCompiledSubagentNodeId(e.parentNodeId,e.source.sourceId),n=e.source.subagentId,r={...e.source.manifest,appRoot:e.appRoot},i=mergeExternalDependencies(e.externalDependencies,e.configResolver?.build?.externalDependencies),a={entryPath:e.source.entryPath,logicalPath:e.source.logicalPath,name:n,nodeId:t,rootPath:e.source.rootPath,sourceId:e.source.sourceId,sourceKind:`module`};if(e.configResolver===void 0){let n=await e.compileAgentNodeManifest(r,e.context,{agentConfigDefinition:e.agentConfigDefinition,allowWorkflowConfig:!1,externalDependencies:i}),o=n.config.description;if(!o)throw Error(`Local subagent "${e.source.logicalPath}" is missing a "description" field on its agent config. Add \`description\` to \`defineAgent({ ... })\` so the parent agent can decide when to delegate to this subagent.`);let s=await compileSubagentGraph({appRoot:e.appRoot,compileAgentNodeManifest:e.compileAgentNodeManifest,context:e.context,compileAgentResources:e.compileAgentResources,externalDependencies:n.config.build?.externalDependencies??i,parentNodeId:t,subagents:e.source.manifest.subagents});return{descendants:s,node:{...a,agent:{...n,remoteAgents:[...s.remoteAgents]},description:o}}}let o=await e.compileAgentResources(r,e.context,{externalDependencies:i}),c=await compileSubagentGraph({appRoot:e.appRoot,compileAgentNodeManifest:e.compileAgentNodeManifest,context:e.context,compileAgentResources:e.compileAgentResources,externalDependencies:i,parentNodeId:t,subagents:e.source.manifest.subagents});return{descendants:c,node:{...a,agent:{...o,remoteAgents:[...c.remoteAgents]},configResolver:e.configResolver}}}const compileLocalSubagent=compileSubagent;function compileRemoteAgent(e){let t=e.source.manifest.configModule;if(t===void 0)throw Error(`Remote agent "${e.source.logicalPath}" is missing a config module.`);assertRemoteAgentDefinitionHasNoLocalPackageEntries(e.source);let n=createSubagentConfigModuleSourceRef(e.source,t),r=normalizeRemoteAgentDefinition(e.value,`Expected the remote agent config export "${t.exportName??`default`}" from "${n.logicalPath}" to match the public eve shape.`),i={...n,description:r.description,entryPath:e.source.entryPath,name:e.source.subagentId,nodeId:e.source.sourceId,outputSchema:r.outputSchema,path:r.path,rootPath:e.source.rootPath};return r.url===void 0?i:{...i,url:r.url}}function normalizeDynamicSubagentDefinition(e,i){if(!isDynamicSentinel(e))return;let a=expectObjectRecord(e,i);expectOnlyKnownKeys(a,[`build`,`events`,`kind`],i);let o=a.build===void 0?void 0:normalizeDynamicSubagentBuild(a.build,i),s=expectObjectRecord(a.events,i),c=[];for(let[e,n]of Object.entries(s)){if(!ALLOWED_DYNAMIC_SUBAGENT_EVENTS.has(e))throw Error(`${i} Dynamic subagents support only "session.started" and "turn.started" handlers.`);expectFunction(n,i),c.push(e)}let l={definition:{eventNames:c}};return o!==void 0&&(l.build=o),l}function normalizeDynamicSubagentBuild(e,t){let a=expectObjectRecord(e,t);if(expectOnlyKnownKeys(a,[`externalDependencies`],t),a.externalDependencies===void 0)return{};if(!Array.isArray(a.externalDependencies))throw Error(t);return{externalDependencies:a.externalDependencies.map(e=>expectString(e,t))}}function mergeExternalDependencies(...e){return[...new Set(e.flatMap(e=>e??[]))]}function createSubagentConfigModuleSourceRef(e,t){let n=e.logicalPath===t.logicalPath?t.logicalPath:`${e.logicalPath}/${t.logicalPath}`,r={logicalPath:n,sourceId:createPathDerivedSourceId(n),sourceKind:`module`};return t.exportName!==void 0&&(r.exportName=t.exportName),r}function readAgentDefinitionKind(e){return typeof e!=`object`||!e?`local`:e.kind===`remote`?`remote`:`local`}function normalizeRemoteAgentDefinition(t,s){let c=expectObjectRecord(t,s);if(expectOnlyKnownKeys(c,[`auth`,`description`,`forwardPrincipal`,`headers`,`kind`,`outputSchema`,`path`,`url`],s),c.kind!==`remote`)throw Error(`${s} Expected "kind" to be "remote".`);return c.forwardPrincipal!==void 0&&expectBoolean(c.forwardPrincipal,`${s} Expected "forwardPrincipal" to be a boolean.`),{description:expectString(c.description,s),outputSchema:serializeOutputSchema(c.outputSchema),path:c.path===void 0?EVE_SESSION_ROUTE_PATH:expectString(c.path,s),url:typeof c.url==`function`?void 0:expectString(c.url,s)}}function assertRemoteAgentDefinitionHasNoLocalPackageEntries(e){let t=e.manifest,n=[t.connections.length>0?`connections/`:void 0,t.hooks.length>0?`hooks/`:void 0,t.instructions.length>0?`instructions`:void 0,t.lib.length>0?`lib/`:void 0,t.sandbox===null?void 0:`sandbox/`,t.sandboxWorkspaces.length>0?`sandbox/workspace/`:void 0,t.schedules.length>0?`schedules/`:void 0,t.skills.length>0?`skills/`:void 0,t.subagents.length>0?`subagents/`:void 0,t.tools.length>0?`tools/`:void 0].filter(e=>e!==void 0);if(n.length!==0)throw Error(`Remote subagent definition "${e.logicalPath}" cannot include local package entries. Remove unsupported entries: ${n.join(`, `)}.`)}export{compileSubagentGraph};

package/dist/src/compiler/remote-agent-node.d.ts

@@ -2,7 +2,10 @@ import { z } from "#compiled/zod/index.js";
 import type { JsonObject } from "#shared/json.js";
 import type { Node } from "#shared/node.js";
 import type { ModuleSourceRef } from "#shared/source-ref.js";
-export interface CompiledDynamicSubagentDefinition {
+export interface CompiledDynamicSubagentDefinition extends Readonly<ModuleSourceRef> {
+    readonly build?: {
+        readonly externalDependencies?: readonly string[];
+    };
     readonly eventNames: readonly string[];
 }
 /**

package/dist/src/compiler/workspace-resources.js

@@ -1 +1 @@
-import{createHash}from"node:crypto";import{cp,mkdir,readFile,readdir,rm}from"node:fs/promises";import{join,posix}from"node:path";import{normalizeLogicalPath}from"#discover/filesystem.js";import{ROOT_COMPILED_AGENT_NODE_ID,deriveResourceRootEntries}from"#compiler/manifest.js";import{normalizeSkillPackage,writeSkillPackageDirectory}from"#shared/skill-package.js";const RESOURCES_DIRECTORY=`workspace-resources`;async function materializeWorkspaceResources(e){let t=join(e.compileDirectoryPath,RESOURCES_DIRECTORY);await rm(t,{force:!0,recursive:!0});let n=await materializeNode({nodeId:ROOT_COMPILED_AGENT_NODE_ID,resourcesRoot:t,manifest:e.manifest}),r=await Promise.all(e.manifest.subagents.map(async e=>({...e,agent:await materializeNode({nodeId:e.nodeId,resourcesRoot:t,manifest:e.agent})})));return{...n,kind:e.manifest.kind,extensionMounts:e.manifest.extensionMounts,subagentEdges:e.manifest.subagentEdges,subagents:r,version:e.manifest.version}}function createResourceRoot(e,t,n){return{contentHash:n,logicalPath:normalizeLogicalPath(join(RESOURCES_DIRECTORY,t)),rootEntries:deriveResourceRootEntries({sandboxWorkspaces:e.sandboxWorkspaces,skills:e.skills})}}async function materializeNode(e){let t=join(e.resourcesRoot,e.nodeId);await mkdir(t,{recursive:!0});let r=join(t,`workspace`);for(let t of e.manifest.sandboxWorkspaces)await copyDirectoryContents({sourcePath:t.sourcePath,targetPath:r});for(let n of e.manifest.skills)await materializeSkill({nodeRoot:t,skill:n});let i=await hashWorkspaceResourceRoot(t);return{...e.manifest,skills:e.manifest.skills.map(stripSkillPackageFiles),workspaceResourceRoot:createResourceRoot(e.manifest,e.nodeId,i)}}async function materializeSkill(e){let n=join(e.nodeRoot,`skills`,e.skill.name);if(e.skill.sourceKind===`skill-package`){await cp(e.skill.rootPath,n,{recursive:!0});return}await writeSkillPackageDirectory({rootPath:e.nodeRoot,skill:normalizeSkillPackage(e.skill)})}function stripSkillPackageFiles(e){let{files:t,...n}=e;return n}async function copyDirectoryContents(e){let r=await readdir(e.sourcePath,{withFileTypes:!0});await mkdir(e.targetPath,{recursive:!0});for(let n of r)!n.isDirectory()&&!n.isFile()||await cp(join(e.sourcePath,n.name),join(e.targetPath,n.name),{recursive:!0})}async function hashWorkspaceResourceRoot(t){let n=await listWorkspaceResourceFiles({logicalDirectoryPath:`.`,sourceDirectoryPath:t});if(n.sort((e,t)=>e.logicalPath.localeCompare(t.logicalPath)),n.length===0)return;let i=createHash(`sha256`);i.update(`eve-workspace-resource-root-v1\0`);for(let e of n){let t=await readFile(e.sourcePath);i.update(e.logicalPath),i.update(`\0`),i.update(String(t.byteLength)),i.update(`\0`),i.update(t),i.update(`\0`)}return i.digest(`hex`)}async function listWorkspaceResourceFiles(e){let t=[],n=await readdir(e.sourceDirectoryPath,{withFileTypes:!0});for(let r of n){if(!r.isDirectory()&&!r.isFile())continue;let n=join(e.sourceDirectoryPath,r.name),i=posix.join(e.logicalDirectoryPath,r.name);if(r.isDirectory()){t.push(...await listWorkspaceResourceFiles({logicalDirectoryPath:i,sourceDirectoryPath:n}));continue}t.push({logicalPath:i,sourcePath:n})}return t}export{materializeWorkspaceResources};
+import{createHash}from"node:crypto";import{cp,mkdir,readFile,readdir,rm}from"node:fs/promises";import{join,posix}from"node:path";import{normalizeLogicalPath}from"#discover/filesystem.js";import{ROOT_COMPILED_AGENT_NODE_ID,deriveResourceRootEntries}from"#compiler/manifest.js";import{normalizeSkillPackage,writeSkillPackageDirectory}from"#shared/skill-package.js";const RESOURCES_DIRECTORY=`workspace-resources`;async function materializeWorkspaceResources(e){let t=join(e.compileDirectoryPath,RESOURCES_DIRECTORY);await rm(t,{force:!0,recursive:!0});let n=await materializeNode({nodeId:ROOT_COMPILED_AGENT_NODE_ID,resourcesRoot:t,manifest:e.manifest}),r=await Promise.all(e.manifest.subagents.map(async e=>e.configResolver===void 0?{...e,agent:await materializeNode({nodeId:e.nodeId,resourcesRoot:t,manifest:e.agent})}:{...e,agent:await materializeNode({nodeId:e.nodeId,resourcesRoot:t,manifest:e.agent}),configResolver:e.configResolver}));return{...n,kind:e.manifest.kind,extensionMounts:e.manifest.extensionMounts,subagentEdges:e.manifest.subagentEdges,subagents:r,version:e.manifest.version}}function createResourceRoot(e,t,n){return{contentHash:n,logicalPath:normalizeLogicalPath(join(RESOURCES_DIRECTORY,t)),rootEntries:deriveResourceRootEntries({sandboxWorkspaces:e.sandboxWorkspaces,skills:e.skills})}}async function materializeNode(e){let t=join(e.resourcesRoot,e.nodeId);await mkdir(t,{recursive:!0});let r=join(t,`workspace`);for(let t of e.manifest.sandboxWorkspaces)await copyDirectoryContents({sourcePath:t.sourcePath,targetPath:r});for(let n of e.manifest.skills)await materializeSkill({nodeRoot:t,skill:n});let i=await hashWorkspaceResourceRoot(t);return{...e.manifest,skills:e.manifest.skills.map(stripSkillPackageFiles),workspaceResourceRoot:createResourceRoot(e.manifest,e.nodeId,i)}}async function materializeSkill(e){let n=join(e.nodeRoot,`skills`,e.skill.name);if(e.skill.sourceKind===`skill-package`){await cp(e.skill.rootPath,n,{recursive:!0});return}await writeSkillPackageDirectory({rootPath:e.nodeRoot,skill:normalizeSkillPackage(e.skill)})}function stripSkillPackageFiles(e){let{files:t,...n}=e;return n}async function copyDirectoryContents(e){let r=await readdir(e.sourcePath,{withFileTypes:!0});await mkdir(e.targetPath,{recursive:!0});for(let n of r)!n.isDirectory()&&!n.isFile()||await cp(join(e.sourcePath,n.name),join(e.targetPath,n.name),{recursive:!0})}async function hashWorkspaceResourceRoot(t){let n=await listWorkspaceResourceFiles({logicalDirectoryPath:`.`,sourceDirectoryPath:t});if(n.sort((e,t)=>e.logicalPath.localeCompare(t.logicalPath)),n.length===0)return;let i=createHash(`sha256`);i.update(`eve-workspace-resource-root-v1\0`);for(let e of n){let t=await readFile(e.sourcePath);i.update(e.logicalPath),i.update(`\0`),i.update(String(t.byteLength)),i.update(`\0`),i.update(t),i.update(`\0`)}return i.digest(`hex`)}async function listWorkspaceResourceFiles(e){let t=[],n=await readdir(e.sourceDirectoryPath,{withFileTypes:!0});for(let r of n){if(!r.isDirectory()&&!r.isFile())continue;let n=join(e.sourceDirectoryPath,r.name),i=posix.join(e.logicalDirectoryPath,r.name);if(r.isDirectory()){t.push(...await listWorkspaceResourceFiles({logicalDirectoryPath:i,sourceDirectoryPath:n}));continue}t.push({logicalPath:i,sourcePath:n})}return t}export{materializeWorkspaceResources};

package/dist/src/context/build-callback-context.js

@@ -1 +1 @@
-import{SandboxKey,SessionKey}from"#context/keys.js";import{loadContext}from"#context/container.js";import{createSandboxSkillHandle}from"#runtime/skills/sandbox-access.js";function buildCallbackContext(){let r=loadContext(),i=r.require(SessionKey);return{session:{id:i.sessionId,auth:i.auth,turn:i.turn,parent:i.parent},getSandbox(){let t=r.get(SandboxKey);if(t===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSandbox() only from authored runtime functions such as tools, hooks, and channel events.`);return t.get().then(e=>{if(e===null)throw Error(`The sandbox is not available in the current authored runtime context.`);return e})},getSkill(t){let n=r.get(SandboxKey);if(n===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSkill() only from authored runtime functions such as tools, hooks, and channel events.`);return createSandboxSkillHandle(n,t)}}}export{buildCallbackContext};
+import{SandboxKey,SessionKey}from"#context/keys.js";import{loadContext}from"#context/container.js";import{createSandboxSkillHandle}from"#runtime/skills/sandbox-access.js";function buildCallbackContext(){let r=loadContext(),i=r.require(SessionKey);return{session:{id:i.sessionId,auth:i.auth,turn:i.turn,parent:i.parent},getSandbox(){let t=r.get(SandboxKey);if(t===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSandbox() only from authored runtime functions such as tools, hooks, and channel events.`);return t.get().then(e=>{if(e===null)throw Error(`The sandbox is not available in the current authored runtime context.`);return withRuntimeSandboxStop(e,async()=>await t.stop())})},getSkill(t){let n=r.get(SandboxKey);if(n===void 0)throw Error(`eve sandbox runtime access is unavailable in the current async context. Call ctx.getSkill() only from authored runtime functions such as tools, hooks, and channel events.`);return createSandboxSkillHandle(n,t)}}}function withRuntimeSandboxStop(e,t){return{id:e.id,readBinaryFile:t=>e.readBinaryFile(t),readFile:t=>e.readFile(t),readTextFile:t=>e.readTextFile(t),removePath:t=>e.removePath(t),resolvePath:t=>e.resolvePath(t),run:t=>e.run(t),setNetworkPolicy:t=>e.setNetworkPolicy(t),spawn:t=>e.spawn(t),stop:t,writeBinaryFile:t=>e.writeBinaryFile(t),writeFile:t=>e.writeFile(t),writeTextFile:t=>e.writeTextFile(t)}}export{buildCallbackContext};

package/dist/src/context/dynamic-model-lifecycle.d.ts

@@ -3,9 +3,15 @@ import type { AlsContext } from "#context/container.js";
 import type { ContextKey } from "#context/key.js";
 import { type LiveDynamicModelSelection } from "#context/keys.js";
 import type { UnstampedMessageStreamEvent } from "#protocol/message.js";
-import type { RuntimeDynamicModelReference, RuntimeModelReference } from "#runtime/agent/bootstrap.js";
+import type { RuntimeDynamicModelReference } from "#runtime/agent/bootstrap.js";
 import { type RuntimeModelResolutionScope } from "#runtime/agent/resolve-model.js";
 export type ActiveDynamicModelSelection = LiveDynamicModelSelection;
+export declare class DynamicModelSelectionError extends Error {
+    readonly code = "EVE_DYNAMIC_MODEL_SELECTION_FAILED";
+    readonly name = "DynamicModelSelectionError";
+    constructor(error: unknown);
+}
+export declare function isDynamicModelSelectionError(error: unknown): error is DynamicModelSelectionError;
 export declare function getActiveDynamicModelSelection(ctx: {
     get<T>(key: ContextKey<T>): T | undefined;
 }): ActiveDynamicModelSelection | null;
@@ -13,7 +19,6 @@ export declare function dispatchDynamicModelEvent(input: {
     readonly ctx: AlsContext;
     readonly dynamicModel: RuntimeDynamicModelReference | undefined;
     readonly event: UnstampedMessageStreamEvent;
-    readonly fallback: RuntimeModelReference;
     readonly messages: readonly ModelMessage[];
     readonly scope: RuntimeModelResolutionScope;
 }): Promise<void>;

package/dist/src/context/dynamic-model-lifecycle.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{LiveStepDynamicModelSelectionKey,SessionDynamicModelReferenceKey,TurnDynamicModelReferenceKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{buildResolveContext}from"#context/dynamic-resolve-context.js";import{loadDynamicRuntimeModelDefinition,normalizeDynamicRuntimeModelResult,shouldMockAuthoredRuntimeModels}from"#runtime/agent/resolve-model.js";const log=createLogger(`dynamic-models`),ALLOWED_DYNAMIC_MODEL_EVENTS=new Set([`session.started`,`turn.started`,`step.started`]);function isDynamicModelEventName(e){return ALLOWED_DYNAMIC_MODEL_EVENTS.has(e)}function durableKeyForEvent(e){switch(e){case`session.started`:return SessionDynamicModelReferenceKey;case`turn.started`:return TurnDynamicModelReferenceKey;case`step.started`:return}}function getActiveDynamicModelSelection(e){let i=e.get(LiveStepDynamicModelSelectionKey);if(i!=null)return i;let a=e.get(TurnDynamicModelReferenceKey);if(a!=null)return{reference:a};let o=e.get(SessionDynamicModelReferenceKey);return o==null?null:{reference:o}}async function dispatchDynamicModelEvent(e){if(e.dynamicModel!==void 0&&isDynamicModelEventName(e.event.type)&&e.dynamicModel.eventNames.includes(e.event.type))try{let t=(await loadDynamicRuntimeModelDefinition({dynamicModel:e.dynamicModel,scope:e.scope})).events[e.event.type];if(t===void 0){setSelectionForEvent(e.ctx,e.event.type,null);return}let n=await t(e.event,buildResolveContext(e.ctx,e.messages)),r=n==null?null:normalizeDynamicRuntimeModelResult({fallback:e.fallback,result:n});if(r!==null&&e.event.type!==`step.started`&&r.model!==void 0){log.error(`Dynamic model resolver (${e.event.type}) returned a provider object, but session- and turn-scoped model selections must be serializable. Return a model id string for this scope, or use "step.started".`),setSelectionForEvent(e.ctx,e.event.type,null);return}setSelectionForEvent(e.ctx,e.event.type,r)}catch(t){log.error(`Dynamic model resolver (${e.event.type}) threw - skipping.`,{error:toErrorMessage(t)}),setSelectionForEvent(e.ctx,e.event.type,null)}}function setSelectionForEvent(e,n,r){if(n===`step.started`){let n=r!==null&&r.model!==void 0&&shouldMockAuthoredRuntimeModels()?{reference:r.reference}:r;e.setVirtualContext(LiveStepDynamicModelSelectionKey,n);return}let i=durableKeyForEvent(n);i!==void 0&&e.set(i,r?.reference??null)}export{dispatchDynamicModelEvent,getActiveDynamicModelSelection};
+import{LiveStepDynamicModelSelectionKey,SessionDynamicModelReferenceKey,TurnDynamicModelReferenceKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{buildResolveContext}from"#context/dynamic-resolve-context.js";import{loadDynamicRuntimeModelDefinition,resolveRuntimeModelSelection,shouldMockAuthoredRuntimeModels}from"#runtime/agent/resolve-model.js";const ALLOWED_DYNAMIC_MODEL_EVENTS=new Set([`session.started`,`turn.started`,`step.started`]),DYNAMIC_MODEL_SELECTION_ERROR_CODE=`EVE_DYNAMIC_MODEL_SELECTION_FAILED`;var DynamicModelSelectionError=class extends Error{code=DYNAMIC_MODEL_SELECTION_ERROR_CODE;name=`DynamicModelSelectionError`;constructor(e){super(toErrorMessage(e),{cause:e})}};function isDynamicModelSelectionError(e){return e instanceof DynamicModelSelectionError||typeof e==`object`&&!!e&&e.code===DYNAMIC_MODEL_SELECTION_ERROR_CODE}function isDynamicModelEventName(e){return ALLOWED_DYNAMIC_MODEL_EVENTS.has(e)}function durableKeyForEvent(e){switch(e){case`session.started`:return SessionDynamicModelReferenceKey;case`turn.started`:return TurnDynamicModelReferenceKey;case`step.started`:return}}function getActiveDynamicModelSelection(r){let i=r.get(LiveStepDynamicModelSelectionKey);if(i!=null)return i;let a=r.get(TurnDynamicModelReferenceKey);if(a!=null)return{reference:a};let o=r.get(SessionDynamicModelReferenceKey);return o==null?null:{reference:o}}async function dispatchDynamicModelEvent(e){if(e.dynamicModel!==void 0&&isDynamicModelEventName(e.event.type)&&e.dynamicModel.eventNames.includes(e.event.type)){setSelectionForEvent(e.ctx,e.event.type,null);try{let t=(await loadDynamicRuntimeModelDefinition({dynamicModel:e.dynamicModel,scope:e.scope})).events[e.event.type];if(t===void 0)throw Error(`Dynamic model resolver is missing its compiled "${e.event.type}" handler.`);let n=await t(e.event,buildResolveContext(e.ctx,e.messages)),r=await resolveRuntimeModelSelection({durability:e.event.type===`step.started`?`live`:`durable`,selection:n,state:e.ctx});setSelectionForEvent(e.ctx,e.event.type,r)}catch(e){throw isDynamicModelSelectionError(e)?e:new DynamicModelSelectionError(e)}}}function setSelectionForEvent(t,n,r){if(n===`step.started`){let n=r!==null&&r.model!==void 0&&shouldMockAuthoredRuntimeModels()?{reference:r.reference}:r;t.setVirtualContext(LiveStepDynamicModelSelectionKey,n);return}let i=durableKeyForEvent(n);i!==void 0&&t.set(i,r?.reference??null)}export{DynamicModelSelectionError,dispatchDynamicModelEvent,getActiveDynamicModelSelection,isDynamicModelSelectionError};

package/dist/src/context/dynamic-subagent-lifecycle.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{SessionDynamicSubagentRuntimeRevisionKey,SessionDynamicSubagentSelectionsKey,TurnDynamicSubagentSelectionsKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{buildResolveContext}from"#context/dynamic-resolve-context.js";import{createHarnessDelegationToolDefinition}from"#execution/delegation-tool.js";import{createPreparedRuntimeSubagentTool,getSubagentToolInputJsonSchema}from"#runtime/subagents/registry.js";import{normalizeDynamicSubagentAgentConfig}from"#runtime/subagents/dynamic-agent-config.js";import{normalizeDynamicRemoteAgentConfig}from"#runtime/subagents/dynamic-remote-agent-config.js";const log=createLogger(`dynamic-subagents`),ALLOWED_DYNAMIC_SUBAGENT_EVENTS=new Set([`session.started`,`turn.started`]);async function resolveSelections(e){let t=getSubagentToolInputJsonSchema(e.persistentSessions),n=await Promise.allSettled(e.resolvers.map(async n=>{let r=n.events[e.event.type];if(r===void 0)return[n.nodeId,null];let i=await r(e.event,buildResolveContext(e.ctx,e.messages));if(i==null)return[n.nodeId,null];if(isRemoteAgentDefinition(i)){let e=await normalizeDynamicRemoteAgentConfig({name:n.name,value:i}),r=createPreparedRuntimeSubagentTool({description:e.description,kind:`remote`,logicalPath:n.logicalPath,name:n.name,nodeId:n.nodeId,outputSchema:e.outputSchema,path:e.path,sourceId:n.sourceId,sourceKind:n.sourceKind,url:e.url},t);return[n.nodeId,{kind:`remote`,prepared:r,remoteAgent:e}]}let o=normalizeDynamicSubagentAgentConfig({name:n.name,value:i}),c=createPreparedRuntimeSubagentTool({description:o.description,kind:`subagent`,logicalPath:n.logicalPath,name:n.name,nodeId:n.nodeId,sourceId:n.sourceId,sourceKind:n.sourceKind},t);return[n.nodeId,{agentConfig:o,kind:`subagent`,prepared:c}]})),r={};for(let t=0;t<n.length;t+=1){let a=n[t],o=e.resolvers[t];if(a.status===`rejected`){log.error(`Dynamic subagent resolver (${e.event.type}) threw — omitting subagent.`,{error:toErrorMessage(a.reason),subagentName:o.name}),r[o.nodeId]=null;continue}r[a.value[0]]=a.value[1]}return r}function isRemoteAgentDefinition(e){return typeof e==`object`&&!!e&&e.kind===`remote`}async function dispatchDynamicSubagentEvent(e){if(!ALLOWED_DYNAMIC_SUBAGENT_EVENTS.has(e.event.type))return;let t=e.resolvers.filter(t=>t.eventNames.includes(e.event.type)),i=await resolveSelections({...e,resolvers:t});e.event.type===`session.started`?e.ctx.set(SessionDynamicSubagentSelectionsKey,i):e.ctx.set(TurnDynamicSubagentSelectionsKey,i)}async function refreshDynamicSessionSubagentsForRuntimeRevision(e){if(e.ctx.get(SessionDynamicSubagentRuntimeRevisionKey)===e.runtimeRevision)return;let r=e.resolvers.filter(e=>e.eventNames.includes(`session.started`)),i=await resolveSelections({...e,resolvers:r});e.ctx.set(SessionDynamicSubagentSelectionsKey,i),e.ctx.set(SessionDynamicSubagentRuntimeRevisionKey,e.runtimeRevision)}function buildDynamicSubagentTools(e){let t=e.get(SessionDynamicSubagentSelectionsKey)??{},i=e.get(TurnDynamicSubagentSelectionsKey)??{},a={...t,...i},s=[],c=new Set;for(let e of Object.values(a))if(e!==null){if(c.has(e.prepared.name))throw Error(`Found multiple active dynamic subagents named "${e.prepared.name}". Subagent names must be unique at runtime.`);c.add(e.prepared.name),s.push(createHarnessDelegationToolDefinition(e.prepared))}return s}function getDynamicSubagentSelection(e,t){let i=e.get(TurnDynamicSubagentSelectionsKey)??{};return Object.hasOwn(i,t)?i[t]??void 0:(e.get(SessionDynamicSubagentSelectionsKey)??{})[t]??void 0}export{buildDynamicSubagentTools,dispatchDynamicSubagentEvent,getDynamicSubagentSelection,refreshDynamicSessionSubagentsForRuntimeRevision};
+import{createLogger}from"#internal/logging.js";import{SessionDynamicSubagentRuntimeRevisionKey,SessionDynamicSubagentSelectionsKey,TurnDynamicSubagentSelectionsKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{buildResolveContext}from"#context/dynamic-resolve-context.js";import{createHarnessDelegationToolDefinition}from"#execution/delegation-tool.js";import{createPreparedRuntimeSubagentTool,getSubagentToolInputJsonSchema}from"#runtime/subagents/registry.js";import{normalizeDynamicSubagentAgentConfig}from"#runtime/subagents/dynamic-agent-config.js";import{normalizeDynamicRemoteAgentConfig}from"#runtime/subagents/dynamic-remote-agent-config.js";const log=createLogger(`dynamic-subagents`),ALLOWED_DYNAMIC_SUBAGENT_EVENTS=new Set([`session.started`,`turn.started`]);async function resolveSelections(e){let t=getSubagentToolInputJsonSchema(e.persistentSessions),n=await Promise.allSettled(e.resolvers.map(async n=>{let r=n.events[e.event.type];if(r===void 0)return[n.nodeId,null];let i=await r(e.event,buildResolveContext(e.ctx,e.messages));if(i==null)return[n.nodeId,null];if(isRemoteAgentDefinition(i)){let e=await normalizeDynamicRemoteAgentConfig({name:n.name,value:i}),r=createPreparedRuntimeSubagentTool({description:e.description,kind:`remote`,logicalPath:n.logicalPath,name:n.name,nodeId:n.nodeId,outputSchema:e.outputSchema,path:e.path,sourceId:n.sourceId,sourceKind:n.sourceKind,url:e.url},t);return[n.nodeId,{kind:`remote`,prepared:r,remoteAgent:e}]}let o=await normalizeDynamicSubagentAgentConfig({name:n.name,state:e.ctx,value:i}),c=createPreparedRuntimeSubagentTool({description:o.description,kind:`subagent`,logicalPath:n.logicalPath,name:n.name,nodeId:n.nodeId,sourceId:n.sourceId,sourceKind:n.sourceKind},t);return[n.nodeId,{agentConfig:o,kind:`subagent`,prepared:c}]})),r={};for(let t=0;t<n.length;t+=1){let a=n[t],o=e.resolvers[t];if(a.status===`rejected`){log.error(`Dynamic subagent resolver (${e.event.type}) threw — omitting subagent.`,{error:toErrorMessage(a.reason),subagentName:o.name}),r[o.nodeId]=null;continue}r[a.value[0]]=a.value[1]}return r}function isRemoteAgentDefinition(e){return typeof e==`object`&&!!e&&e.kind===`remote`}async function dispatchDynamicSubagentEvent(e){if(!ALLOWED_DYNAMIC_SUBAGENT_EVENTS.has(e.event.type))return;let t=e.resolvers.filter(t=>t.eventNames.includes(e.event.type)),i=await resolveSelections({...e,resolvers:t});e.event.type===`session.started`?e.ctx.set(SessionDynamicSubagentSelectionsKey,i):e.ctx.set(TurnDynamicSubagentSelectionsKey,i)}async function refreshDynamicSessionSubagentsForRuntimeRevision(e){if(e.ctx.get(SessionDynamicSubagentRuntimeRevisionKey)===e.runtimeRevision)return;let r=e.resolvers.filter(e=>e.eventNames.includes(`session.started`)),i=await resolveSelections({...e,resolvers:r});e.ctx.set(SessionDynamicSubagentSelectionsKey,i),e.ctx.set(SessionDynamicSubagentRuntimeRevisionKey,e.runtimeRevision)}function buildDynamicSubagentTools(e){let t=e.get(SessionDynamicSubagentSelectionsKey)??{},i=e.get(TurnDynamicSubagentSelectionsKey)??{},a={...t,...i},s=[],c=new Set;for(let e of Object.values(a))if(e!==null){if(c.has(e.prepared.name))throw Error(`Found multiple active dynamic subagents named "${e.prepared.name}". Subagent names must be unique at runtime.`);c.add(e.prepared.name),s.push(createHarnessDelegationToolDefinition(e.prepared))}return s}function getDynamicSubagentSelection(e,t){let i=e.get(TurnDynamicSubagentSelectionsKey)??{};return Object.hasOwn(i,t)?i[t]??void 0:(e.get(SessionDynamicSubagentSelectionsKey)??{})[t]??void 0}export{buildDynamicSubagentTools,dispatchDynamicSubagentEvent,getDynamicSubagentSelection,refreshDynamicSessionSubagentsForRuntimeRevision};

package/dist/src/context/hook-lifecycle.js

@@ -1 +1 @@
-import{ContinuationTokenKey}from"./keys.js";import{getAdapterKind}from"#channel/adapter.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{BundleKey,ChannelKey}from"#runtime/sessions/runtime-context-keys.js";async function dispatchStreamEventHooks(e){let t=e.registry.streamEventsByType.get(e.event.type)??[],n=e.registry.streamEventsWildcard;if(t.length===0&&n.length===0)return;let r=buildHookContext(e.ctx);for(let n of t)await n.handler(e.event,r);for(let t of n)await t.handler(e.event,r)}function buildHookContext(i){let a=i.require(BundleKey),o=i.get(ChannelKey),s=i.get(ContinuationTokenKey),c=o===void 0?void 0:getAdapterKind(o);return{...buildCallbackContext(),agent:{name:a.resolvedAgent.config.name??`agent`,nodeId:a.nodeId},channel:{kind:c,continuationToken:s}}}export{dispatchStreamEventHooks};
+import{ContinuationTokenKey}from"./keys.js";import{getAdapterKind}from"#channel/adapter.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{BundleKey,ChannelKey}from"#runtime/sessions/runtime-context-keys.js";async function dispatchStreamEventHooks(e){let t=e.registry.streamEventsByType.get(e.event.type)??[],n=e.registry.streamEventsWildcard;if(t.length===0&&n.length===0)return;let r=buildHookContext(e.ctx);for(let n of t)await n.handler(e.event,r);for(let t of n)await t.handler(e.event,r)}function buildHookContext(i){let a=i.require(BundleKey),o=i.get(ChannelKey),s=i.get(ContinuationTokenKey),c=o===void 0?void 0:getAdapterKind(o);return{...buildCallbackContext(),agent:{name:a.turnAgent.id,nodeId:a.nodeId},channel:{kind:c,continuationToken:s}}}export{dispatchStreamEventHooks};

package/dist/src/context/keys.d.ts

@@ -66,6 +66,14 @@ export declare const SandboxKey: ContextKey<SandboxAccess>;
 export declare const SessionDynamicModelReferenceKey: ContextKey<Readonly<import("../shared/agent-definition.ts").InternalAgentModelDefinition> | null>;
 /** Turn-scoped dynamic model selection (from `turn.started`). */
 export declare const TurnDynamicModelReferenceKey: ContextKey<Readonly<import("../shared/agent-definition.ts").InternalAgentModelDefinition> | null>;
+export interface CachedModelMetadata {
+    readonly contextWindowTokens: number;
+    readonly expiresAt: number;
+    readonly maxOutputTokens?: number;
+    readonly resolvedModelId: string;
+}
+/** Successful runtime catalog selections cached in durable workflow state. */
+export declare const RuntimeModelMetadataCacheKey: ContextKey<Readonly<Record<string, CachedModelMetadata>>>;
 export interface LiveDynamicModelSelection {
     /** Live provider instance; absent for string selections, which resolve through the reference. */
     readonly model?: LanguageModel;

package/dist/src/context/keys.js

@@ -1 +1 @@
-import{ContextKey}from"#context/key.js";const AuthKey=new ContextKey(`eve.auth`),InitiatorAuthKey=new ContextKey(`eve.initiatorAuth`),SessionIdKey=new ContextKey(`eve.sessionId`),ContinuationTokenKey=new ContextKey(`eve.continuationToken`),ChannelRequestIdKey=new ContextKey(`eve.channelRequestId`),ChannelInstrumentationKey=new ContextKey(`eve.channelInstrumentation`),ModeKey=new ContextKey(`eve.mode`),ParentSessionKey=new ContextKey(`eve.parentSession`),ParentTraceContextKey=new ContextKey(`eve.parentTraceContext`),SubagentDepthKey=new ContextKey(`eve.subagentDepth`),CapabilitiesKey=new ContextKey(`eve.capabilities`),SessionCallbackKey=new ContextKey(`eve.sessionCallback`),SessionKey=new ContextKey(`eve.session`),SandboxKey=new ContextKey(`eve.sandbox`),SessionDynamicModelReferenceKey=new ContextKey(`eve.sessionDynamicModelReference`),TurnDynamicModelReferenceKey=new ContextKey(`eve.turnDynamicModelReference`),LiveStepDynamicModelSelectionKey=new ContextKey(`eve.liveStepDynamicModelSelection`),SessionDynamicToolMetadataKey=new ContextKey(`eve.sessionDynamicToolMetadata`),SessionDynamicToolRuntimeRevisionKey=new ContextKey(`eve.sessionDynamicToolRuntimeRevision`),TurnDynamicToolMetadataKey=new ContextKey(`eve.turnDynamicToolMetadata`),LiveStepToolsKey=new ContextKey(`eve.liveStepTools`),SessionDynamicSubagentSelectionsKey=new ContextKey(`eve.sessionDynamicSubagentSelections`),TurnDynamicSubagentSelectionsKey=new ContextKey(`eve.turnDynamicSubagentSelections`),SessionDynamicSubagentRuntimeRevisionKey=new ContextKey(`eve.sessionDynamicSubagentRuntimeRevision`),DynamicSubagentAgentConfigKey=new ContextKey(`eve.dynamicSubagentAgentConfig`),DynamicSkillManifestKey=new ContextKey(`eve.dynamicSkillManifest`),SessionDynamicInstructionsKey=new ContextKey(`eve.sessionDynamicInstructions`),TurnDynamicInstructionsKey=new ContextKey(`eve.turnDynamicInstructions`);export{AuthKey,CapabilitiesKey,ChannelInstrumentationKey,ChannelRequestIdKey,ContinuationTokenKey,DynamicSkillManifestKey,DynamicSubagentAgentConfigKey,InitiatorAuthKey,LiveStepDynamicModelSelectionKey,LiveStepToolsKey,ModeKey,ParentSessionKey,ParentTraceContextKey,SandboxKey,SessionCallbackKey,SessionDynamicInstructionsKey,SessionDynamicModelReferenceKey,SessionDynamicSubagentRuntimeRevisionKey,SessionDynamicSubagentSelectionsKey,SessionDynamicToolMetadataKey,SessionDynamicToolRuntimeRevisionKey,SessionIdKey,SessionKey,SubagentDepthKey,TurnDynamicInstructionsKey,TurnDynamicModelReferenceKey,TurnDynamicSubagentSelectionsKey,TurnDynamicToolMetadataKey};
+import{ContextKey}from"#context/key.js";const AuthKey=new ContextKey(`eve.auth`),InitiatorAuthKey=new ContextKey(`eve.initiatorAuth`),SessionIdKey=new ContextKey(`eve.sessionId`),ContinuationTokenKey=new ContextKey(`eve.continuationToken`),ChannelRequestIdKey=new ContextKey(`eve.channelRequestId`),ChannelInstrumentationKey=new ContextKey(`eve.channelInstrumentation`),ModeKey=new ContextKey(`eve.mode`),ParentSessionKey=new ContextKey(`eve.parentSession`),ParentTraceContextKey=new ContextKey(`eve.parentTraceContext`),SubagentDepthKey=new ContextKey(`eve.subagentDepth`),CapabilitiesKey=new ContextKey(`eve.capabilities`),SessionCallbackKey=new ContextKey(`eve.sessionCallback`),SessionKey=new ContextKey(`eve.session`),SandboxKey=new ContextKey(`eve.sandbox`),SessionDynamicModelReferenceKey=new ContextKey(`eve.sessionDynamicModelReference`),TurnDynamicModelReferenceKey=new ContextKey(`eve.turnDynamicModelReference`),RuntimeModelMetadataCacheKey=new ContextKey(`eve.runtimeModelMetadataCache`),LiveStepDynamicModelSelectionKey=new ContextKey(`eve.liveStepDynamicModelSelection`),SessionDynamicToolMetadataKey=new ContextKey(`eve.sessionDynamicToolMetadata`),SessionDynamicToolRuntimeRevisionKey=new ContextKey(`eve.sessionDynamicToolRuntimeRevision`),TurnDynamicToolMetadataKey=new ContextKey(`eve.turnDynamicToolMetadata`),LiveStepToolsKey=new ContextKey(`eve.liveStepTools`),SessionDynamicSubagentSelectionsKey=new ContextKey(`eve.sessionDynamicSubagentSelections`),TurnDynamicSubagentSelectionsKey=new ContextKey(`eve.turnDynamicSubagentSelections`),SessionDynamicSubagentRuntimeRevisionKey=new ContextKey(`eve.sessionDynamicSubagentRuntimeRevision`),DynamicSubagentAgentConfigKey=new ContextKey(`eve.dynamicSubagentAgentConfig`),DynamicSkillManifestKey=new ContextKey(`eve.dynamicSkillManifest`),SessionDynamicInstructionsKey=new ContextKey(`eve.sessionDynamicInstructions`),TurnDynamicInstructionsKey=new ContextKey(`eve.turnDynamicInstructions`);export{AuthKey,CapabilitiesKey,ChannelInstrumentationKey,ChannelRequestIdKey,ContinuationTokenKey,DynamicSkillManifestKey,DynamicSubagentAgentConfigKey,InitiatorAuthKey,LiveStepDynamicModelSelectionKey,LiveStepToolsKey,ModeKey,ParentSessionKey,ParentTraceContextKey,RuntimeModelMetadataCacheKey,SandboxKey,SessionCallbackKey,SessionDynamicInstructionsKey,SessionDynamicModelReferenceKey,SessionDynamicSubagentRuntimeRevisionKey,SessionDynamicSubagentSelectionsKey,SessionDynamicToolMetadataKey,SessionDynamicToolRuntimeRevisionKey,SessionIdKey,SessionKey,SubagentDepthKey,TurnDynamicInstructionsKey,TurnDynamicModelReferenceKey,TurnDynamicSubagentSelectionsKey,TurnDynamicToolMetadataKey};

package/dist/src/evals/session.js

@@ -1 +1 @@
-import{readFile}from"node:fs/promises";import{basename,extname}from"node:path";import{isCurrentTurnBoundaryEvent,isTurnFailureEvent}from"#protocol/message.js";import{summarizeTurnEvents}from"#client/session-utils.js";import{createTextWithFileContent}from"#client/file-parts.js";import{extractCompletedResult}from"#client/output-schema.js";import{inputRequestMatches,matchesValue,toolCallMatches}from"#evals/match.js";import{AssertionCollector}from"#evals/assertions/collector.js";import{createOutputAssertions,createScopedAssertions}from"#evals/assertions/scoped.js";import{EvalRequirementFailed}from"#evals/control-flow.js";import{deriveRunFacts}from"#evals/runner/derive-run-facts.js";var EveEvalTurnFailedError=class extends Error{event;turn;constructor(e){let t=e.events.find(isTurnFailureEvent),n=t===void 0?`turn ended with status "${e.status}"`:`${t.type}: ${t.data.code} ${t.data.message}`.trim();super(`Eval turn failed: ${n}`),this.name=`EveEvalTurnFailedError`,this.event=t,this.turn=e}},EvalSessionDriver=class{#e;#t;#n;#r;#i=[];#a;#o=[];constructor(e){this.#e=e.client,this.#r=e.collector,this.#t=e.session,this.#n=e.signal,Object.assign(this,createScopedAssertions(this.#r,{timing:`snapshot`,select:()=>this.#u()}),createOutputAssertions(this.#r,{timing:`snapshot`,select:()=>this.#u()}))}get events(){return this.#i}get lastTurn(){return this.#a}get pendingInputRequests(){return this.#o}get sessionId(){return this.#t?.state.sessionId??this.#a?.sessionId}get state(){return this.#t?.state}async cancel(){if(this.#t===void 0)throw Error(`Eval session has not started.`);return await this.#t.cancel()}requireInputRequest(e={}){this.#o.length===0&&this.#d(`requireInputRequest`,`expected one pending input request, but the last turn did not park`);let t=this.#o.filter(t=>inputRequestMatches(t,e));return(this.#o.length!==1||t.length!==1)&&this.#d(`requireInputRequest`,`expected exactly one pending input request matching ${formatInputRequestFilter(e)}, found ${t.length} match(es) across ${this.#o.length} pending request(s)`),this.#r.recordOutcome({name:`requireInputRequest`,outcome:{score:1}}),t[0]}async respond(e,t={}){if(e.length===0)throw Error(`respond() requires at least one input response.`);return await(await this.#s({...t,inputResponses:e})).result()}async respondAll(e){let t=this.#o;if(t.length===0)throw Error(`respondAll() requires at least one pending input request.`);for(let n of t)assertRequestHasOption(n,e);return await this.respond(t.map(t=>({optionId:e,requestId:t.requestId})))}async send(e,t={}){return await(await this.#s({...t,message:e})).result()}async start(e,t={}){return await this.#s({...t,message:e})}async#s(e){let t=attachSignal(e,this.#n),n;if(this.#t===void 0){if(t.message===void 0)throw Error(`Eval session has not started.`);let e=await this.#e.sessions.create({...t,message:t.message});this.#t=e.session,n=e.response}else{let{inputResponses:e,message:r,...i}=t;n=e===void 0?await this.#t.send(r,i):await this.#t.respond(e,i)}return new EvalLiveTurn({events:n,record:e=>this.#l(n.sessionId,e),session:this,sessionId:n.sessionId})}async sendFile(n,r,i){let a=createTextWithFileContent({bytes:await readFile(r),filename:basename(r),mediaType:i??inferMediaType(r),text:n});return await this.send(a)}async readTurn(e){let t=this.sessionId;return await this.watchTurn(e,requireSessionId(t)).result()}watchTurn(e,t=requireSessionId(this.sessionId)){if(this.#t===void 0)throw Error(`Eval session has not started.`);return new EvalLiveTurn({events:this.#t.stream({signal:this.#n,startIndex:e?.startIndex}),record:e=>this.#l(t,e),session:this,sessionId:t})}snapshot(e){let t=this.sessionId;return{derived:deriveRunFacts(this.#i,{sessionId:t}),events:[...this.#i],primary:e,sessionId:t,state:this.#t?.state}}#c(e){this.#i.push(...e.events),this.#o=e.status===`waiting`?e.inputRequests:[];let t=deriveRunFacts(e.events,{sessionId:e.sessionId}),n=new EvalTurn({collector:this.#r,data:e.data,derived:t,events:e.events,inputRequests:e.inputRequests,message:e.message,sessionId:e.sessionId,status:e.status,toolCalls:t.toolCalls});return this.#a=n,n}#l(e,t){let n=summarizeTurnEvents(t);return this.#c({data:extractCompletedResult(t),events:t,inputRequests:n.inputRequests,message:n.message,sessionId:e,status:n.status})}#u(){let e=this.sessionId;return{derived:deriveRunFacts(this.#i,{sessionId:e}),events:[...this.#i],output:outputOf(this.#a),status:this.#a?.status??`completed`}}#d(e,t){throw this.#r.recordOutcome({name:e,outcome:{score:0,message:t}}),new EvalRequirementFailed}},EvalLiveTurn=class{session;sessionId;#e;#t=[];#n=new Set;#r;constructor(e){this.session=e.session,this.sessionId=e.sessionId,this.#e=this.#i(e.events,e.record),this.#e.catch(()=>{})}get events(){return this.#t}async cancel(){return await this.session.cancel()}async result(){return await this.#e}async waitForEvent(e,t){let matches=n=>n.type===e&&(t?.data===void 0||matchesValue(t.data,`data`in n?n.data:void 0)),n=this.#t.find(matches);if(n!==void 0)return n;if(this.#r!==void 0)throw this.#r;return await new Promise((e,t)=>{let n={matches,reject:t,resolve:t=>e(t)};this.#n.add(n)})}async#i(e,t){try{let n=!1;for await(let t of e)if(this.#t.push(t),this.#a(t),isTurnFailureEvent(t)&&this.#o(Error(`Session ${this.sessionId} failed before the expected event (${t.type}).`)),isCurrentTurnBoundaryEvent(t)){n=!0,this.#o(Error(`Session ${this.sessionId} reached ${t.type} before the expected event.`));break}if(!n)throw Error(`Stream for session "${this.sessionId}" closed before a turn boundary.`);return t(this.#t)}catch(e){let t=e instanceof Error?e:Error(String(e));throw this.#o(t),e}}#a(e){for(let t of this.#n)t.matches(e)&&(this.#n.delete(t),t.resolve(e))}#o(e){if(this.#r===void 0){this.#r=e;for(let t of this.#n)t.reject(e);this.#n.clear()}}},EvalTurn=class{data;events;inputRequests;message;sessionId;status;toolCalls;#e;#t;constructor(e){this.data=e.data,this.events=e.events,this.inputRequests=e.inputRequests,this.message=e.message,this.sessionId=e.sessionId,this.status=e.status,this.toolCalls=e.toolCalls,this.#e=e.collector,this.#t=e.derived,Object.assign(this,createScopedAssertions(e.collector,{timing:`snapshot`,select:()=>this.#n()}),createOutputAssertions(e.collector,{timing:`snapshot`,select:()=>this.#n()}))}expectOk(){if(this.status!==`failed`)return this;throw new EveEvalTurnFailedError(this)}requireToolCall(e,t={}){let n=this.toolCalls.filter(n=>n.name===e&&toolCallMatches(n,t));return n.length!==1&&inputRequirementFailed(this.#e,`requireToolCall`,`expected exactly one matching "${e}" tool call in this turn, found ${n.length}; observed [${this.toolCalls.map(e=>e.name).join(`, `)}]`),this.#e.recordOutcome({name:`requireToolCall`,outcome:{score:1}}),n[0]}#n(){return{derived:this.#t,events:this.events,output:outputOf(this),status:this.status}}},EvalSessionManager=class{#e;#t;#n;#r=[];#i;constructor(e){this.#e=e.client,this.#n=e.collector??new AssertionCollector,this.#t=e.signal}get primary(){return this.#i??=this.#a(),this.#i}newSession(){return this.#a()}async attachSession(e,t){let n=this.#o(e,t);return await n.readTurn(t),n}watchTurn(e,t){return this.#o(e,t).watchTurn(t,e)}snapshots(){return this.#r.map(e=>e.snapshot(e===this.#i))}lastTurnSession(){return this.#i?.lastTurn===void 0?this.#r.find(e=>e.lastTurn!==void 0):this.#i}hasActivity(){return this.#r.length>0}#a(){let e=new EvalSessionDriver({client:this.#e,collector:this.#n,signal:this.#t});return this.#r.push(e),e}#o(e,t){let n=new EvalSessionDriver({client:this.#e,collector:this.#n,session:this.#e.sessions.attach(e,{streamIndex:t?.startIndex??0}),signal:this.#t});return this.#r.push(n),n}};function attachSignal(e,t){return t===void 0?e:e.signal===void 0?{...e,signal:t}:e}function formatInputRequestFilter(e){return JSON.stringify(e)}function inputRequirementFailed(e,t,n){throw e.recordOutcome({name:t,outcome:{score:0,message:n}}),new EvalRequirementFailed}function outputOf(e){return e===void 0?null:e.data===void 0?e.message??null:e.data}function requireSessionId(e){if(e===void 0)throw Error(`Eval session produced a turn without a session id.`);return e}function assertRequestHasOption(e,t){if(e.options===void 0||e.options.length===0)throw Error(`Input request "${e.requestId}" has no selectable options.`);if(!e.options.some(e=>e.id===t))throw Error(`Input request "${e.requestId}" does not offer option "${t}".`)}function inferMediaType(e){switch(extname(e).toLowerCase()){case`.gif`:return`image/gif`;case`.jpg`:case`.jpeg`:return`image/jpeg`;case`.png`:return`image/png`;case`.webp`:return`image/webp`;default:return`application/octet-stream`}}export{EvalSessionDriver,EvalSessionManager,EveEvalTurnFailedError};
+import{readFile}from"node:fs/promises";import{basename,extname}from"node:path";import{isCurrentTurnBoundaryEvent,isTurnFailureEvent}from"#protocol/message.js";import{summarizeTurnEvents}from"#client/session-utils.js";import{createTextWithFileContent}from"#client/file-parts.js";import{extractCompletedResult}from"#client/output-schema.js";import{inputRequestMatches,matchesValue,toolCallMatches}from"#evals/match.js";import{AssertionCollector}from"#evals/assertions/collector.js";import{createOutputAssertions,createScopedAssertions}from"#evals/assertions/scoped.js";import{EvalRequirementFailed}from"#evals/control-flow.js";import{deriveRunFacts}from"#evals/runner/derive-run-facts.js";var EveEvalTurnFailedError=class extends Error{event;turn;constructor(e){let t=e.events.find(isTurnFailureEvent),n=t===void 0?`turn ended with status "${e.status}"`:`${t.type}: ${t.data.code} ${t.data.message}`.trim();super(`Eval turn failed: ${n}`),this.name=`EveEvalTurnFailedError`,this.event=t,this.turn=e}},EvalSessionDriver=class{#e;#t;#n;#r;#i=[];#a;#o=[];constructor(e){this.#e=e.client,this.#r=e.collector,this.#t=e.session,this.#n=e.signal,Object.assign(this,createScopedAssertions(this.#r,{timing:`snapshot`,select:()=>this.#u()}),createOutputAssertions(this.#r,{timing:`snapshot`,select:()=>this.#u()}))}get events(){return this.#i}get lastTurn(){return this.#a}get pendingInputRequests(){return this.#o}get sessionId(){return this.#t?.state.sessionId??this.#a?.sessionId}get state(){return this.#t?.state}async cancel(){if(this.#t===void 0)throw Error(`Eval session has not started.`);return await this.#t.cancel()}requireInputRequest(e={}){this.#o.length===0&&this.#d(`requireInputRequest`,`expected one pending input request, but the last turn did not park`);let t=this.#o.filter(t=>inputRequestMatches(t,e));return(this.#o.length!==1||t.length!==1)&&this.#d(`requireInputRequest`,`expected exactly one pending input request matching ${formatInputRequestFilter(e)}, found ${t.length} match(es) across ${this.#o.length} pending request(s)`),this.#r.recordOutcome({name:`requireInputRequest`,outcome:{score:1}}),t[0]}async respond(e,t={}){if(e.length===0)throw Error(`respond() requires at least one input response.`);return await(await this.#s({...t,inputResponses:e})).result()}async respondAll(e){let t=this.#o;if(t.length===0)throw Error(`respondAll() requires at least one pending input request.`);for(let n of t)assertRequestHasOption(n,e);return await this.respond(t.map(t=>({optionId:e,requestId:t.requestId})))}async send(e,t={}){return await(await this.#s({turnPolicy:`queue`,...t,message:e})).result()}async start(e,t={}){return await this.#s({turnPolicy:`queue`,...t,message:e})}async#s(e){let t=attachSignal(e,this.#n),n;if(this.#t===void 0){if(t.message===void 0)throw Error(`Eval session has not started.`);let e=await this.#e.sessions.create({...t,message:t.message});this.#t=e.session,n=e.response}else{let{inputResponses:e,message:r,...i}=t;n=e===void 0?await this.#t.send(r,i):await this.#t.respond(e,i)}return new EvalLiveTurn({events:n,record:e=>this.#l(n.sessionId,e),session:this,sessionId:n.sessionId})}async sendFile(n,r,i){let a=createTextWithFileContent({bytes:await readFile(r),filename:basename(r),mediaType:i??inferMediaType(r),text:n});return await this.send(a)}async readTurn(e){let t=this.sessionId;return await this.watchTurn(e,requireSessionId(t)).result()}watchTurn(e,t=requireSessionId(this.sessionId)){if(this.#t===void 0)throw Error(`Eval session has not started.`);return new EvalLiveTurn({events:this.#t.stream({signal:this.#n,startIndex:e?.startIndex}),record:e=>this.#l(t,e),session:this,sessionId:t})}snapshot(e){let t=this.sessionId;return{derived:deriveRunFacts(this.#i,{sessionId:t}),events:[...this.#i],primary:e,sessionId:t,state:this.#t?.state}}#c(e){this.#i.push(...e.events),this.#o=e.status===`waiting`?e.inputRequests:[];let t=deriveRunFacts(e.events,{sessionId:e.sessionId}),n=new EvalTurn({collector:this.#r,data:e.data,derived:t,events:e.events,inputRequests:e.inputRequests,message:e.message,sessionId:e.sessionId,status:e.status,toolCalls:t.toolCalls});return this.#a=n,n}#l(e,t){let n=summarizeTurnEvents(t);return this.#c({data:extractCompletedResult(t),events:t,inputRequests:n.inputRequests,message:n.message,sessionId:e,status:n.status})}#u(){let e=this.sessionId;return{derived:deriveRunFacts(this.#i,{sessionId:e}),events:[...this.#i],output:outputOf(this.#a),status:this.#a?.status??`completed`}}#d(e,t){throw this.#r.recordOutcome({name:e,outcome:{score:0,message:t}}),new EvalRequirementFailed}},EvalLiveTurn=class{session;sessionId;#e;#t=[];#n=new Set;#r;constructor(e){this.session=e.session,this.sessionId=e.sessionId,this.#e=this.#i(e.events,e.record),this.#e.catch(()=>{})}get events(){return this.#t}async cancel(){return await this.session.cancel()}async result(){return await this.#e}async waitForEvent(e,t){let matches=n=>n.type===e&&(t?.data===void 0||matchesValue(t.data,`data`in n?n.data:void 0)),n=this.#t.find(matches);if(n!==void 0)return n;if(this.#r!==void 0)throw this.#r;return await new Promise((e,t)=>{let n={matches,reject:t,resolve:t=>e(t)};this.#n.add(n)})}async#i(e,t){try{let n=!1;for await(let t of e)if(this.#t.push(t),this.#a(t),isTurnFailureEvent(t)&&this.#o(Error(`Session ${this.sessionId} failed before the expected event (${t.type}).`)),isCurrentTurnBoundaryEvent(t)){n=!0,this.#o(Error(`Session ${this.sessionId} reached ${t.type} before the expected event.`));break}if(!n)throw Error(`Stream for session "${this.sessionId}" closed before a turn boundary.`);return t(this.#t)}catch(e){let t=e instanceof Error?e:Error(String(e));throw this.#o(t),e}}#a(e){for(let t of this.#n)t.matches(e)&&(this.#n.delete(t),t.resolve(e))}#o(e){if(this.#r===void 0){this.#r=e;for(let t of this.#n)t.reject(e);this.#n.clear()}}},EvalTurn=class{data;events;inputRequests;message;sessionId;status;toolCalls;#e;#t;constructor(e){this.data=e.data,this.events=e.events,this.inputRequests=e.inputRequests,this.message=e.message,this.sessionId=e.sessionId,this.status=e.status,this.toolCalls=e.toolCalls,this.#e=e.collector,this.#t=e.derived,Object.assign(this,createScopedAssertions(e.collector,{timing:`snapshot`,select:()=>this.#n()}),createOutputAssertions(e.collector,{timing:`snapshot`,select:()=>this.#n()}))}expectOk(){if(this.status!==`failed`)return this;throw new EveEvalTurnFailedError(this)}requireToolCall(e,t={}){let n=this.toolCalls.filter(n=>n.name===e&&toolCallMatches(n,t));return n.length!==1&&inputRequirementFailed(this.#e,`requireToolCall`,`expected exactly one matching "${e}" tool call in this turn, found ${n.length}; observed [${this.toolCalls.map(e=>e.name).join(`, `)}]`),this.#e.recordOutcome({name:`requireToolCall`,outcome:{score:1}}),n[0]}#n(){return{derived:this.#t,events:this.events,output:outputOf(this),status:this.status}}},EvalSessionManager=class{#e;#t;#n;#r=[];#i;constructor(e){this.#e=e.client,this.#n=e.collector??new AssertionCollector,this.#t=e.signal}get primary(){return this.#i??=this.#a(),this.#i}newSession(){return this.#a()}async attachSession(e,t){let n=this.#o(e,t);return await n.readTurn(t),n}watchTurn(e,t){return this.#o(e,t).watchTurn(t,e)}snapshots(){return this.#r.map(e=>e.snapshot(e===this.#i))}lastTurnSession(){return this.#i?.lastTurn===void 0?this.#r.find(e=>e.lastTurn!==void 0):this.#i}hasActivity(){return this.#r.length>0}#a(){let e=new EvalSessionDriver({client:this.#e,collector:this.#n,signal:this.#t});return this.#r.push(e),e}#o(e,t){let n=new EvalSessionDriver({client:this.#e,collector:this.#n,session:this.#e.sessions.attach(e,{streamIndex:t?.startIndex??0}),signal:this.#t});return this.#r.push(n),n}};function attachSignal(e,t){return t===void 0?e:e.signal===void 0?{...e,signal:t}:e}function formatInputRequestFilter(e){return JSON.stringify(e)}function inputRequirementFailed(e,t,n){throw e.recordOutcome({name:t,outcome:{score:0,message:n}}),new EvalRequirementFailed}function outputOf(e){return e===void 0?null:e.data===void 0?e.message??null:e.data}function requireSessionId(e){if(e===void 0)throw Error(`Eval session produced a turn without a session id.`);return e}function assertRequestHasOption(e,t){if(e.options===void 0||e.options.length===0)throw Error(`Input request "${e.requestId}" has no selectable options.`);if(!e.options.some(e=>e.id===t))throw Error(`Input request "${e.requestId}" does not offer option "${t}".`)}function inferMediaType(e){switch(extname(e).toLowerCase()){case`.gif`:return`image/gif`;case`.jpg`:case`.jpeg`:return`image/jpeg`;case`.png`:return`image/png`;case`.webp`:return`image/webp`;default:return`application/octet-stream`}}export{EvalSessionDriver,EvalSessionManager,EveEvalTurnFailedError};

package/dist/src/execution/authorization-callback-match.d.ts

@@ -0,0 +1,14 @@
+import type { DeliverPayload } from "#channel/types.js";
+import type { AuthorizationResult, PendingAuthorizationState } from "#harness/authorization.js";
+import type { ConnectionAuthorizationChallenge } from "#public/connections/errors.js";
+export interface MatchedAuthorizationCallback {
+    readonly authorization: ConnectionAuthorizationChallenge;
+    readonly result: {
+        readonly name: string;
+    } & AuthorizationResult;
+}
+/** Matches current callbacks by attempt ID and legacy callbacks only to legacy state. */
+export declare function matchAuthorizationCallbacks(pending: PendingAuthorizationState, payloads: readonly DeliverPayload[]): {
+    readonly matches: readonly MatchedAuthorizationCallback[];
+    readonly remainingPayloads: readonly DeliverPayload[];
+};

package/dist/src/execution/authorization-callback-match.js

@@ -0,0 +1 @@
+function matchAuthorizationCallbacks(e,t){let n=[],r=[],i=new Set;for(let a of t){let t=a.authorizationCallback;if(t===void 0){r.push(a);continue}let o=e.challenges.find(e=>e.name===t.connectionName?t.legacy===!0?e.attemptId===void 0:e.attemptId===t.attemptId:!1),s=o?.attemptId??o?.name;o===void 0||s===void 0||o.principal===void 0&&t.legacy!==!0||i.has(s)||(i.add(s),n.push({authorization:o.challenge,result:{attemptId:o.attemptId,callback:t.callback,hookUrl:o.hookUrl,name:o.name,principal:o.principal,resume:o.resume}}))}return{matches:n,remainingPayloads:r}}export{matchAuthorizationCallbacks};

package/dist/src/execution/dispatch-runtime-actions-step.js

@@ -1 +1 @@
-import{createLogger,logError}from"#internal/logging.js";import{callAdapterEventHandler}from"#channel/adapter.js";import{AuthKey,CapabilitiesKey,ChannelInstrumentationKey,InitiatorAuthKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{createSubagentCalledEvent,encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{BundleKey,ChannelKey}from"#runtime/sessions/runtime-context-keys.js";import{resolveRemoteAgentForAction,startRemoteAgentSession}from"#execution/remote-agent-dispatch.js";import{SUBAGENT_START_FAILED}from"#harness/agent-handle-errors.js";import{confirmAgentStarted,prepareAgentStart,rejectAgentEffect}from"#harness/handles/transitions.js";import{createWorkflowRuntime,workflowEntryReference}from"#execution/workflow-runtime.js";import{deserializeContext}from"#context/serialize.js";import{createDurableSessionState,readDurableSession}from"#execution/durable-session-store.js";import{getAgentHandleStore}from"#harness/handles/store.js";import{getDynamicSubagentSelection}from"#context/dynamic-subagent-lifecycle.js";import{hydrateDurableSession}from"#execution/session.js";import{resolveEffectiveAgentRuntime}from"#execution/effective-agent-config.js";import{buildAdapterContext}from"#channel/adapter-context.js";import{dispatchToAgentHandle,isAgentHandleAction}from"#execution/agent-handle-dispatch.js";import{createAgentContinuationBundle}from"#execution/agent-continuation-bundle.js";import{getPendingRuntimeActionBatch}from"#harness/runtime-actions.js";import{createRecursiveAgentRootOnlyResult,createRemoteAgentStartFailureResult,createUnavailableDynamicSubagentResult,getSubagentName}from"#execution/dispatch-action-failures.js";import{mintStartOperation}from"#execution/dispatch-start-operation.js";import{buildSubagentRunInput}from"#execution/subagent-tool.js";import{readSessionTraceContext}from"#tracing/agent-trace-context-store.js";import{resolveSubagentDepth}from"#harness/subagent-depth.js";const log=createLogger(`execution.dispatch-runtime-actions`);async function dispatchRuntimeActionsStep(e){"use step";let s=await readDurableSession(e.sessionState),p=getPendingRuntimeActionBatch(s.state);if(p===void 0||p.actions.length===0)return{results:[],sessionState:e.sessionState};let m=await deserializeContext(e.serializedContext),h=m.require(BundleKey),g=resolveEffectiveAgentRuntime(h,m),_=hydrateDurableSession({compactionOverrides:{thresholdPercent:g.thresholdPercent},durable:s,turnAgent:g.turnAgent}),v=m.require(ChannelKey),y=m.get(AuthKey)??null,b=m.get(CapabilitiesKey),x=m.get(ChannelInstrumentationKey),S=m.get(InitiatorAuthKey)??null,C=buildAdapterContext(v,m),w=readSessionTraceContext(e.serializedContext,_.sessionId),T=h.resolvedAgent.config.experimental?.subagentPersistentSessions===!0;getAgentHandleStore(s.state);let E=planDispatch({actions:p.actions,bundle:h,ctx:m,session:_}),D=e.parentWritable.getWriter(),O=E.filter(e=>e.kind===`start`&&e.target.kind===`local`).length,k=_,A=[];try{for(let r of E){if(r.kind===`reject`){A.push(r.result);continue}let i;switch(r.kind){case`resume`:i=await dispatchToAgentHandle({action:r.action,agentId:r.agentId,bundle:createAgentContinuationBundle({action:r.action,bundle:h,dynamicRemoteAgent:r.dynamicRemoteAgent}),currentSession:k,parentToken:e.parentContinuationToken??_.continuationToken,parentTurnId:p.event.turnId});break;case`start`:i=await startSubagent({auth:y,batchEvent:p.event,bundle:h,callbackBaseUrl:e.callbackBaseUrl,capabilities:b,channelMetadata:x,currentSession:k,fanoutSize:O,initiatorAuth:S,parentContinuationToken:e.parentContinuationToken,parentTraceContext:w,persistentSessions:T,session:_,target:r.target});break}if(k=i.session,i.kind===`error`){A.push(i.result);continue}try{let e=await callAdapterEventHandler(v,createSubagentCalledEvent({callId:i.callId,childSessionId:i.address.sessionId,name:i.name,remote:i.address.kind===`agent/remote`?{url:i.address.url}:void 0,sequence:p.event.sequence,sessionId:_.sessionId,toolName:i.toolName,turnId:p.event.turnId,workflowId:workflowEntryReference.workflowId}),C);await D.write(encodeMessageStreamEvent(stampMessageStreamEvent(e)))}catch(e){logError(log,`subagent.called emission failed`,e,{callId:i.callId,childSessionId:i.address.sessionId,toolName:i.toolName})}}}finally{D.releaseLock()}return{results:A,sessionState:k===_?e.sessionState:createDurableSessionState({session:k})}}function planDispatch(e){let t=getAgentHandleStore(e.session.state)?.handles??[];return e.actions.map(n=>{let r=n.input.agentId,i=typeof r==`string`&&r.trim()!==``?r:void 0;if(i!==void 0&&isAgentHandleAction(n)){if(t.some(e=>e.identity.id===i)){let t=e.bundle.subagentRegistry.dynamicNodeIds?.has(n.nodeId)===!0?getDynamicSubagentSelection(e.ctx,n.nodeId):void 0;return{action:n,agentId:i,dynamicRemoteAgent:n.kind===`remote-agent-call`&&t?.kind===`remote`?t.remoteAgent:void 0,kind:`resume`}}log.warn(`unknown agentId on subagent call; starting a new agent`,{agentId:i,callId:n.callId})}return classifyFreshStart({action:n,bundle:e.bundle,ctx:e.ctx,session:e.session})})}function classifyFreshStart(e){let{action:t}=e,n=e.bundle.subagentRegistry.subagentsByNodeId,r=resolveSubagentDepth(e.session),i=e.session.rootSessionId!==void 0||r.currentDepth>0,a=(t.kind===`subagent-call`||t.kind===`remote-agent-call`)&&e.bundle.subagentRegistry.dynamicNodeIds?.has(t.nodeId)===!0,o=a?getDynamicSubagentSelection(e.ctx,t.nodeId):void 0;if(a&&(o===void 0||t.kind===`subagent-call`&&o.kind!==`subagent`||t.kind===`remote-agent-call`&&o.kind!==`remote`)){let e=getSubagentName(t);return log.warn(`dynamic subagent call blocked after availability changed`,{callId:t.callId,nodeId:t.nodeId,subagentName:e}),{kind:`reject`,result:createUnavailableDynamicSubagentResult(t)}}if(isRecursiveAgentAction(t,n)&&i)return log.warn(`recursive agent call blocked outside the root session`,{callId:t.callId,currentDepth:r.currentDepth,nodeId:t.nodeId,subagentName:t.subagentName}),{kind:`reject`,result:createRecursiveAgentRootOnlyResult(t)};switch(t.kind){case`subagent-call`:{let e=o?.kind===`subagent`?o.agentConfig:void 0,r=n.get(t.nodeId),i=e?.description??(r?.definition.kind===`subagent`?r.definition.description:void 0);return{kind:`start`,target:{action:t,dynamicSubagentAgentConfig:e,kind:`local`,source:i===void 0?{type:`runtime`}:{description:i,type:`local`}}}}case`remote-agent-call`:return{kind:`start`,target:{action:t,dynamicRemoteAgent:o?.kind===`remote`?o.remoteAgent:void 0,kind:`remote`}};default:throw Error(`Unsupported runtime action kind "${t.kind}" in workflow runtime.`)}}async function startSubagent(e){switch(e.target.kind){case`local`:return startLocalSubagent({action:e.target.action,auth:e.auth,batchEvent:e.batchEvent,bundle:e.bundle,capabilities:e.capabilities,channelMetadata:e.channelMetadata,currentSession:e.currentSession,dynamicSubagentAgentConfig:e.target.dynamicSubagentAgentConfig,fanoutSize:e.fanoutSize,initiatorAuth:e.initiatorAuth,parentContinuationToken:e.parentContinuationToken,parentTraceContext:e.parentTraceContext,persistentSessions:e.persistentSessions,session:e.session,source:e.target.source});case`remote`:return startRemoteSubagent({action:e.target.action,auth:e.auth,batchEvent:e.batchEvent,bundle:e.bundle,callbackBaseUrl:e.callbackBaseUrl,currentSession:e.currentSession,dynamicRemoteAgent:e.target.dynamicRemoteAgent,initiatorAuth:e.initiatorAuth,parentContinuationToken:e.parentContinuationToken,persistentSessions:e.persistentSessions,session:e.session});default:return e.target}}async function startLocalSubagent(e){let{action:n,source:r}=e,i=createWorkflowRuntime({compiledArtifactsSource:e.bundle.compiledArtifactsSource,dynamicSubagentAgentConfig:e.dynamicSubagentAgentConfig,nodeId:n.nodeId}),{childContinuationToken:a,runInput:o}=buildSubagentRunInput({action:n,auth:e.auth,batchEvent:e.batchEvent,capabilities:e.capabilities,channelMetadata:e.channelMetadata,fanoutSize:e.fanoutSize,initiatorAuth:e.initiatorAuth,parentContinuationToken:e.parentContinuationToken,parentTraceContext:e.parentTraceContext,persistentSessions:e.persistentSessions,session:e.session,source:r}),c=r.type===`runtime`?`agent/self`:`agent/local`,{identity:l,operation:u}=mintStartOperation({callId:n.callId,name:n.subagentName,nodeId:n.nodeId,parentSessionId:e.session.sessionId,parentTurnId:e.batchEvent.turnId}),d=prepareAgentStart(e.currentSession,{identity:l,operation:u,target:{continuationToken:a,kind:c}}),f;try{f=(await i.createSession(o)).sessionId}catch(e){return logError(log,`local subagent start failed`,e,{callId:n.callId,nodeId:n.nodeId,subagentName:n.subagentName}),{kind:`error`,result:{callId:n.callId,isError:!0,kind:`subagent-result`,origin:`dispatch`,output:{code:SUBAGENT_START_FAILED,message:toErrorMessage(e)},subagentName:n.subagentName},session:rejectAgentEffect(d,{disposition:`dead`,operationId:u.id})}}let p={continuationToken:a,kind:c,sessionId:f};return{address:p,callId:n.callId,kind:`called`,name:n.name,session:confirmAgentStarted(d,{address:p,operationId:u.id}),toolName:n.subagentName}}async function startRemoteSubagent(e){let{action:n}=e,r,i;try{if(e.callbackBaseUrl===void 0)throw Error(`Cannot dispatch remote agent without a callback base URL.`);r=e.callbackBaseUrl,i=resolveRemoteAgentForAction({dynamicRemoteAgent:e.dynamicRemoteAgent,nodeId:n.nodeId,remoteAgentName:n.remoteAgentName,registry:e.bundle.subagentRegistry.subagentsByNodeId})}catch(r){return logError(log,`remote agent start failed`,r,{remoteAgentName:n.remoteAgentName,nodeId:n.nodeId,callId:n.callId}),{kind:`error`,result:createRemoteAgentStartFailureResult({action:n,error:r}),session:e.currentSession}}let{identity:a,operation:o}=mintStartOperation({callId:n.callId,name:n.remoteAgentName,nodeId:n.nodeId,parentSessionId:e.session.sessionId,parentTurnId:e.batchEvent.turnId}),s=prepareAgentStart(e.currentSession,{identity:a,operation:o,target:{callbackBaseUrl:r,kind:`agent/remote`,url:i.url}});try{let t=await startRemoteAgentSession({action:n,auth:e.auth,callbackBaseUrl:r,callbackToken:e.parentContinuationToken,initiatorAuth:e.initiatorAuth,persistentSessions:e.persistentSessions,remote:i,session:e.session}),a={callbackBaseUrl:r,kind:`agent/remote`,sessionId:t.sessionId,url:i.url};return{address:a,callId:n.callId,kind:`called`,name:n.name,session:confirmAgentStarted(s,{address:a,operationId:o.id}),toolName:n.remoteAgentName}}catch(e){return logError(log,`remote agent start failed`,e,{remoteAgentName:n.remoteAgentName,nodeId:n.nodeId,callId:n.callId}),{kind:`error`,result:createRemoteAgentStartFailureResult({action:n,error:e}),session:rejectAgentEffect(s,{disposition:`dead`,operationId:o.id})}}}function isRecursiveAgentAction(e,t){return e.kind===`subagent-call`&&e.subagentName===`agent`&&!t.has(e.nodeId)}export{dispatchRuntimeActionsStep};
+import{createLogger,logError}from"#internal/logging.js";import{callAdapterEventHandler}from"#channel/adapter.js";import{AuthKey,CapabilitiesKey,ChannelInstrumentationKey,InitiatorAuthKey}from"#context/keys.js";import{toErrorMessage}from"#shared/errors.js";import{createSubagentCalledEvent,encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{BundleKey,ChannelKey}from"#runtime/sessions/runtime-context-keys.js";import{resolveRemoteAgentForAction,startRemoteAgentSession}from"#execution/remote-agent-dispatch.js";import{SUBAGENT_START_FAILED}from"#harness/agent-handle-errors.js";import{confirmAgentStarted,prepareAgentStart,rejectAgentEffect}from"#harness/handles/transitions.js";import{createWorkflowRuntime,workflowEntryReference}from"#execution/workflow-runtime.js";import{deserializeContext}from"#context/serialize.js";import{createDurableSessionState,readDurableSession}from"#execution/durable-session-store.js";import{getAgentHandleStore}from"#harness/handles/store.js";import{getDynamicSubagentSelection}from"#context/dynamic-subagent-lifecycle.js";import{hydrateDurableSession}from"#execution/session.js";import{resolveEffectiveAgentRuntime}from"#execution/effective-agent-config.js";import{buildAdapterContext}from"#channel/adapter-context.js";import{dispatchToAgentHandle,isAgentHandleAction}from"#execution/agent-handle-dispatch.js";import{createAgentContinuationBundle}from"#execution/agent-continuation-bundle.js";import{getPendingRuntimeActionBatch}from"#harness/runtime-actions.js";import{createRecursiveAgentRootOnlyResult,createRemoteAgentStartFailureResult,createUnavailableDynamicSubagentResult,getSubagentName}from"#execution/dispatch-action-failures.js";import{mintStartOperation}from"#execution/dispatch-start-operation.js";import{buildSubagentRunInput}from"#execution/subagent-tool.js";import{readSessionTraceContext}from"#tracing/agent-trace-context-store.js";import{resolveSubagentDepth}from"#harness/subagent-depth.js";const log=createLogger(`execution.dispatch-runtime-actions`);async function dispatchRuntimeActionsStep(e){"use step";let s=await readDurableSession(e.sessionState),p=getPendingRuntimeActionBatch(s.state);if(p===void 0||p.actions.length===0)return{results:[],sessionState:e.sessionState};let m=await deserializeContext(e.serializedContext),h=m.require(BundleKey),g=resolveEffectiveAgentRuntime(h,m),_=hydrateDurableSession({compactionOverrides:{thresholdPercent:g.thresholdPercent},durable:s,turnAgent:g.turnAgent}),v=m.require(ChannelKey),y=m.get(AuthKey)??null,b=m.get(CapabilitiesKey),x=m.get(ChannelInstrumentationKey),S=m.get(InitiatorAuthKey)??null,C=buildAdapterContext(v,m),w=readSessionTraceContext(e.serializedContext,_.sessionId),T=h.resolvedAgent.config?.experimental?.subagentPersistentSessions===!0;getAgentHandleStore(s.state);let E=planDispatch({actions:p.actions,bundle:h,ctx:m,session:_}),D=e.parentWritable.getWriter(),O=E.filter(e=>e.kind===`start`&&e.target.kind===`local`).length,k=_,A=[];try{for(let r of E){if(r.kind===`reject`){A.push(r.result);continue}let i;switch(r.kind){case`resume`:i=await dispatchToAgentHandle({action:r.action,agentId:r.agentId,bundle:createAgentContinuationBundle({action:r.action,bundle:h,dynamicRemoteAgent:r.dynamicRemoteAgent}),currentSession:k,parentToken:e.parentContinuationToken??_.continuationToken,parentTurnId:p.event.turnId});break;case`start`:i=await startSubagent({auth:y,batchEvent:p.event,bundle:h,callbackBaseUrl:e.callbackBaseUrl,capabilities:b,channelMetadata:x,currentSession:k,fanoutSize:O,initiatorAuth:S,parentContinuationToken:e.parentContinuationToken,parentTraceContext:w,persistentSessions:T,session:_,target:r.target});break}if(k=i.session,i.kind===`error`){A.push(i.result);continue}try{let e=await callAdapterEventHandler(v,createSubagentCalledEvent({callId:i.callId,childSessionId:i.address.sessionId,name:i.name,remote:i.address.kind===`agent/remote`?{url:i.address.url}:void 0,sequence:p.event.sequence,sessionId:_.sessionId,toolName:i.toolName,turnId:p.event.turnId,workflowId:workflowEntryReference.workflowId}),C);await D.write(encodeMessageStreamEvent(stampMessageStreamEvent(e)))}catch(e){logError(log,`subagent.called emission failed`,e,{callId:i.callId,childSessionId:i.address.sessionId,toolName:i.toolName})}}}finally{D.releaseLock()}return{results:A,sessionState:k===_?e.sessionState:createDurableSessionState({session:k})}}function planDispatch(e){let t=getAgentHandleStore(e.session.state)?.handles??[];return e.actions.map(n=>{let r=n.input.agentId,i=typeof r==`string`&&r.trim()!==``?r:void 0;if(i!==void 0&&isAgentHandleAction(n)){if(t.some(e=>e.identity.id===i)){let t=e.bundle.subagentRegistry.dynamicNodeIds?.has(n.nodeId)===!0?getDynamicSubagentSelection(e.ctx,n.nodeId):void 0;return{action:n,agentId:i,dynamicRemoteAgent:n.kind===`remote-agent-call`&&t?.kind===`remote`?t.remoteAgent:void 0,kind:`resume`}}log.warn(`unknown agentId on subagent call; starting a new agent`,{agentId:i,callId:n.callId})}return classifyFreshStart({action:n,bundle:e.bundle,ctx:e.ctx,session:e.session})})}function classifyFreshStart(e){let{action:t}=e,n=e.bundle.subagentRegistry.subagentsByNodeId,r=resolveSubagentDepth(e.session),i=e.session.rootSessionId!==void 0||r.currentDepth>0,a=(t.kind===`subagent-call`||t.kind===`remote-agent-call`)&&e.bundle.subagentRegistry.dynamicNodeIds?.has(t.nodeId)===!0,o=a?getDynamicSubagentSelection(e.ctx,t.nodeId):void 0;if(a&&(o===void 0||t.kind===`subagent-call`&&o.kind!==`subagent`||t.kind===`remote-agent-call`&&o.kind!==`remote`)){let e=getSubagentName(t);return log.warn(`dynamic subagent call blocked after availability changed`,{callId:t.callId,nodeId:t.nodeId,subagentName:e}),{kind:`reject`,result:createUnavailableDynamicSubagentResult(t)}}if(isRecursiveAgentAction(t,n)&&i)return log.warn(`recursive agent call blocked outside the root session`,{callId:t.callId,currentDepth:r.currentDepth,nodeId:t.nodeId,subagentName:t.subagentName}),{kind:`reject`,result:createRecursiveAgentRootOnlyResult(t)};switch(t.kind){case`subagent-call`:{let e=o?.kind===`subagent`?o.agentConfig:void 0,r=n.get(t.nodeId),i=e?.description??(r?.definition.kind===`subagent`?r.definition.description:void 0);return{kind:`start`,target:{action:t,dynamicSubagentAgentConfig:e,kind:`local`,source:i===void 0?{type:`runtime`}:{description:i,type:`local`}}}}case`remote-agent-call`:return{kind:`start`,target:{action:t,dynamicRemoteAgent:o?.kind===`remote`?o.remoteAgent:void 0,kind:`remote`}};default:throw Error(`Unsupported runtime action kind "${t.kind}" in workflow runtime.`)}}async function startSubagent(e){switch(e.target.kind){case`local`:return startLocalSubagent({action:e.target.action,auth:e.auth,batchEvent:e.batchEvent,bundle:e.bundle,capabilities:e.capabilities,channelMetadata:e.channelMetadata,currentSession:e.currentSession,dynamicSubagentAgentConfig:e.target.dynamicSubagentAgentConfig,fanoutSize:e.fanoutSize,initiatorAuth:e.initiatorAuth,parentContinuationToken:e.parentContinuationToken,parentTraceContext:e.parentTraceContext,persistentSessions:e.persistentSessions,session:e.session,source:e.target.source});case`remote`:return startRemoteSubagent({action:e.target.action,auth:e.auth,batchEvent:e.batchEvent,bundle:e.bundle,callbackBaseUrl:e.callbackBaseUrl,currentSession:e.currentSession,dynamicRemoteAgent:e.target.dynamicRemoteAgent,initiatorAuth:e.initiatorAuth,parentContinuationToken:e.parentContinuationToken,persistentSessions:e.persistentSessions,session:e.session});default:return e.target}}async function startLocalSubagent(e){let{action:n,source:r}=e,i=createWorkflowRuntime({compiledArtifactsSource:e.bundle.compiledArtifactsSource,dynamicSubagentAgentConfig:e.dynamicSubagentAgentConfig,nodeId:n.nodeId}),{childContinuationToken:a,runInput:o}=buildSubagentRunInput({action:n,auth:e.auth,batchEvent:e.batchEvent,capabilities:e.capabilities,channelMetadata:e.channelMetadata,fanoutSize:e.fanoutSize,initiatorAuth:e.initiatorAuth,parentContinuationToken:e.parentContinuationToken,parentTraceContext:e.parentTraceContext,persistentSessions:e.persistentSessions,session:e.session,source:r}),c=r.type===`runtime`?`agent/self`:`agent/local`,{identity:l,operation:u}=mintStartOperation({callId:n.callId,name:n.subagentName,nodeId:n.nodeId,parentSessionId:e.session.sessionId,parentTurnId:e.batchEvent.turnId}),d=prepareAgentStart(e.currentSession,{identity:l,operation:u,target:{continuationToken:a,kind:c}}),f;try{f=(await i.createSession(o)).sessionId}catch(e){return logError(log,`local subagent start failed`,e,{callId:n.callId,nodeId:n.nodeId,subagentName:n.subagentName}),{kind:`error`,result:{callId:n.callId,isError:!0,kind:`subagent-result`,origin:`dispatch`,output:{code:SUBAGENT_START_FAILED,message:toErrorMessage(e)},subagentName:n.subagentName},session:rejectAgentEffect(d,{disposition:`dead`,operationId:u.id})}}let p={continuationToken:a,kind:c,sessionId:f};return{address:p,callId:n.callId,kind:`called`,name:n.name,session:confirmAgentStarted(d,{address:p,operationId:u.id}),toolName:n.subagentName}}async function startRemoteSubagent(e){let{action:n}=e,r,i;try{if(e.callbackBaseUrl===void 0)throw Error(`Cannot dispatch remote agent without a callback base URL.`);r=e.callbackBaseUrl,i=resolveRemoteAgentForAction({dynamicRemoteAgent:e.dynamicRemoteAgent,nodeId:n.nodeId,remoteAgentName:n.remoteAgentName,registry:e.bundle.subagentRegistry.subagentsByNodeId})}catch(r){return logError(log,`remote agent start failed`,r,{remoteAgentName:n.remoteAgentName,nodeId:n.nodeId,callId:n.callId}),{kind:`error`,result:createRemoteAgentStartFailureResult({action:n,error:r}),session:e.currentSession}}let{identity:a,operation:o}=mintStartOperation({callId:n.callId,name:n.remoteAgentName,nodeId:n.nodeId,parentSessionId:e.session.sessionId,parentTurnId:e.batchEvent.turnId}),s=prepareAgentStart(e.currentSession,{identity:a,operation:o,target:{callbackBaseUrl:r,kind:`agent/remote`,url:i.url}});try{let t=await startRemoteAgentSession({action:n,auth:e.auth,callbackBaseUrl:r,callbackToken:e.parentContinuationToken,initiatorAuth:e.initiatorAuth,persistentSessions:e.persistentSessions,remote:i,session:e.session}),a={callbackBaseUrl:r,kind:`agent/remote`,sessionId:t.sessionId,url:i.url};return{address:a,callId:n.callId,kind:`called`,name:n.name,session:confirmAgentStarted(s,{address:a,operationId:o.id}),toolName:n.remoteAgentName}}catch(e){return logError(log,`remote agent start failed`,e,{remoteAgentName:n.remoteAgentName,nodeId:n.nodeId,callId:n.callId}),{kind:`error`,result:createRemoteAgentStartFailureResult({action:n,error:e}),session:rejectAgentEffect(s,{disposition:`dead`,operationId:o.id})}}}function isRecursiveAgentAction(e,t){return e.kind===`subagent-call`&&e.subagentName===`agent`&&!t.has(e.nodeId)}export{dispatchRuntimeActionsStep};

package/dist/src/execution/effective-agent-config.js

@@ -1 +1 @@
-import{DynamicSubagentAgentConfigKey}from"#context/keys.js";function resolveEffectiveAgentRuntime(t,n){return resolveEffectiveAgentRuntimeFromConfig(t,n.get(DynamicSubagentAgentConfigKey))}function resolveEffectiveAgentRuntimeFromConfig(e,t){return t===void 0?{limits:e.resolvedAgent.config.limits,thresholdPercent:e.resolvedAgent.config.compaction?.thresholdPercent,turnAgent:e.turnAgent}:{limits:t.limits,thresholdPercent:t.compaction?.thresholdPercent,turnAgent:{...e.turnAgent,compactionModel:t.compaction?.model,dynamicModel:void 0,model:t.model,outputSchema:t.outputSchema,reasoning:t.reasoning}}}export{resolveEffectiveAgentRuntime,resolveEffectiveAgentRuntimeFromConfig};
+import{DynamicSubagentAgentConfigKey}from"#context/keys.js";function resolveEffectiveAgentRuntime(t,n){return resolveEffectiveAgentRuntimeFromConfig(t,n.get(DynamicSubagentAgentConfigKey))}function resolveEffectiveAgentRuntimeFromConfig(e,t){if(t===void 0){if(e.turnAgent.configResolver===!0)throw Error(`Dynamic subagent execution requires a selected concrete agent config.`);return{limits:e.resolvedAgent.config?.limits,thresholdPercent:e.resolvedAgent.config?.compaction?.thresholdPercent,turnAgent:e.turnAgent}}let{compactionModel:n,configResolver:r,dynamicModel:i,model:a,...o}=e.turnAgent;return{limits:t.limits,thresholdPercent:t.compaction?.thresholdPercent,turnAgent:{...o,compactionModel:t.compaction?.model,model:t.model,outputSchema:t.outputSchema,reasoning:t.reasoning}}}export{resolveEffectiveAgentRuntime,resolveEffectiveAgentRuntimeFromConfig};

package/dist/src/execution/next-driver-action.d.ts

@@ -33,6 +33,7 @@ export type NextDriverAction = {
     readonly kind: "park";
     readonly sessionState: DurableSessionState;
     readonly serializedContext: Record<string, unknown>;
+    readonly authorizationAttemptIds?: readonly string[];
     readonly authorizationNames?: readonly string[];
     /**
      * Set when the parked turn was cancelled: the driver runs

package/dist/src/execution/node-step.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{UNSPECIFIED_INPUT_SCHEMA}from"#shared/tool-schema.js";import{createToolExecuteWithAuth}from"#execution/tool-auth.js";import{resolveRuntimeModelReference}from"#runtime/agent/resolve-model.js";import{createHarnessDelegationToolDefinition}from"#execution/delegation-tool.js";import{PERSISTENT_SUBAGENT_TOOL_INPUT_SCHEMA,SUBAGENT_TOOL_INPUT_SCHEMA}from"#runtime/subagents/registry.js";import{dispatchDynamicModelEvent}from"#context/dynamic-model-lifecycle.js";import{createToolLoopHarness}from"#harness/tool-loop.js";import{getInstrumentationRuntime}from"#harness/instrumentation-runtime.js";import{AGENT_TOOL_DESCRIPTION,AGENT_TOOL_NAME,isImplicitAgentToolAvailable}from"#runtime/framework-tools/agent.js";import{findRegisteredRuntimeTool}from"#runtime/tools/registry.js";import{preserveFrameworkStateOnCompaction}from"#execution/compaction.js";const log=createLogger(`execution.node-step`);function createExecutionNodeStep(e){let t=createRuntimeModelResolver(e.modelResolutionScope),n=e.node.turnAgent.dynamicModel===void 0?void 0:createRuntimeDynamicModelEventDispatcher(e.modelResolutionScope,e.node.turnAgent.dynamicModel),r=createNodeHarnessTools({node:e.node}),i=getInstrumentationRuntime(),a=createToolLoopHarness({abortSignal:e.abortSignal,capabilities:e.capabilities,clearOnly:e.clearOnly,compactOnly:e.compactOnly,workflow:e.node.agent.workflowTool!==void 0,workflowMaxSubagents:e.workflowMaxSubagents,webSearchProvider:e.node.agent.webSearchProvider,handleEvent:e.handleEvent,instrumentation:i,mode:e.mode,onCompaction:preserveFrameworkStateOnCompaction,persistentSubagentSessions:e.node.agent.config?.experimental?.subagentPersistentSessions===!0,dispatchDynamicModelEvent:n,resolveModel:t,runtimeIdentity:buildRuntimeIdentity(e.node),tools:r});return i===void 0?a:async(e,t)=>{try{return await a(e,t)}finally{await i.forceFlush()}}}function buildRuntimeIdentity(e){let n=resolveInstalledPackageInfo(),r={agentId:e.turnAgent.id,agentName:e.agent.config?.name,eveVersion:n.version,modelId:e.turnAgent.dynamicModel===void 0?e.turnAgent.model.id:`dynamic:${e.turnAgent.model.id}`},i=process.env.VERCEL_GIT_COMMIT_SHA?.trim(),a=process.env.VERCEL_GIT_COMMIT_REF?.trim(),o=process.env.VERCEL_DEPLOYMENT_CREATED_AT?.trim();return i||a||o?{...r,build:{deployedAt:o||void 0,gitBranch:a||void 0,gitSha:i||void 0}}:r}function createRuntimeModelResolver(e){return t=>resolveRuntimeModelReference(t,e)}function createRuntimeDynamicModelEventDispatcher(e,t){return n=>dispatchDynamicModelEvent({ctx:n.ctx,dynamicModel:t,event:n.event,fallback:n.fallback,messages:n.messages,scope:e})}function createNodeHarnessTools(e){let t=new Map;for(let n of e.node.turnAgent.tools){let r=resolveHarnessToolDefinition({node:e.node,tool:n});r!==null&&t.set(n.name,r)}return isImplicitAgentToolAvailable({disabledFrameworkTools:e.node.agent.disabledFrameworkTools,hasAuthoredAgentTool:t.has(AGENT_TOOL_NAME),nodeId:e.node.nodeId})&&t.set(AGENT_TOOL_NAME,{description:AGENT_TOOL_DESCRIPTION,inputSchema:e.node.agent.config?.experimental?.subagentPersistentSessions===!0?PERSISTENT_SUBAGENT_TOOL_INPUT_SCHEMA:SUBAGENT_TOOL_INPUT_SCHEMA,name:AGENT_TOOL_NAME,runtimeAction:{kind:`subagent-call`,nodeId:e.node.nodeId,subagentName:AGENT_TOOL_NAME}}),t}function resolveHarnessToolDefinition(e){if(e.tool.kind===`subagent`||e.tool.kind===`remote`)return createHarnessDelegationToolDefinition(e.tool);let t=findRegisteredRuntimeTool(e.node.toolRegistry,e.tool.name);if(t===null)return log.warn(`declared tool is not registered — omitting from toolset`,{toolName:e.tool.name,nodeId:e.node.nodeId}),null;let r=t.definition,i=r.sourceId.startsWith(`eve:`),o=r.execute;return{approvalKey:r.approvalKey,description:r.description,execute:resolveAuthoredExecute({isFrameworkTool:i,rawExecute:o,scope:r.name}),inputSchema:r.inputSchema??UNSPECIFIED_INPUT_SCHEMA,name:r.name,approval:r.approval,outputSchema:r.outputSchema,toModelOutput:r.toModelOutput}}function resolveAuthoredExecute(e){let{isFrameworkTool:t,rawExecute:n,scope:i}=e;return n===void 0?void 0:t?n:createToolExecuteWithAuth({execute:n,scope:i})}export{buildRuntimeIdentity,createExecutionNodeStep,createNodeHarnessTools};
+import{createLogger}from"#internal/logging.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{UNSPECIFIED_INPUT_SCHEMA}from"#shared/tool-schema.js";import{createToolExecuteWithAuth}from"#execution/tool-auth.js";import{resolveRuntimeModelReference}from"#runtime/agent/resolve-model.js";import{createHarnessDelegationToolDefinition}from"#execution/delegation-tool.js";import{PERSISTENT_SUBAGENT_TOOL_INPUT_SCHEMA,SUBAGENT_TOOL_INPUT_SCHEMA}from"#runtime/subagents/registry.js";import{dispatchDynamicModelEvent}from"#context/dynamic-model-lifecycle.js";import{createToolLoopHarness}from"#harness/tool-loop.js";import{getInstrumentationRuntime}from"#harness/instrumentation-runtime.js";import{AGENT_TOOL_DESCRIPTION,AGENT_TOOL_NAME,isImplicitAgentToolAvailable}from"#runtime/framework-tools/agent.js";import{findRegisteredRuntimeTool}from"#runtime/tools/registry.js";import{preserveFrameworkStateOnCompaction}from"#execution/compaction.js";const log=createLogger(`execution.node-step`);function createExecutionNodeStep(e){let t=createRuntimeModelResolver(e.modelResolutionScope),n=e.node.turnAgent.dynamicModel===void 0?void 0:createRuntimeDynamicModelEventDispatcher(e.modelResolutionScope,e.node.turnAgent.dynamicModel),r=createNodeHarnessTools({node:e.node}),i=getInstrumentationRuntime(),a=createToolLoopHarness({abortSignal:e.abortSignal,capabilities:e.capabilities,clearOnly:e.clearOnly,compactOnly:e.compactOnly,workflow:e.node.agent.workflowTool!==void 0,workflowMaxSubagents:e.workflowMaxSubagents,webSearchProvider:e.node.agent.webSearchProvider,handleEvent:e.handleEvent,instrumentation:i,mode:e.mode,onCompaction:preserveFrameworkStateOnCompaction,persistentSubagentSessions:e.node.agent.config?.experimental?.subagentPersistentSessions===!0,dispatchDynamicModelEvent:n,resolveModel:t,runtimeIdentity:buildRuntimeIdentity(e.node),tools:r});return i===void 0?a:async(e,t)=>{try{return await a(e,t)}finally{await i.forceFlush()}}}function buildRuntimeIdentity(e){let n=resolveInstalledPackageInfo(),r={agentId:e.turnAgent.id,agentName:e.agent.config?.name,eveVersion:n.version},i=process.env.VERCEL_GIT_COMMIT_SHA?.trim(),a=process.env.VERCEL_GIT_COMMIT_REF?.trim(),o=process.env.VERCEL_DEPLOYMENT_CREATED_AT?.trim();return i||a||o?{...r,build:{deployedAt:o||void 0,gitBranch:a||void 0,gitSha:i||void 0}}:r}function createRuntimeModelResolver(e){return t=>resolveRuntimeModelReference(t,e)}function createRuntimeDynamicModelEventDispatcher(e,t){return n=>dispatchDynamicModelEvent({ctx:n.ctx,dynamicModel:t,event:n.event,messages:n.messages,scope:e})}function createNodeHarnessTools(e){let t=new Map;for(let n of e.node.turnAgent.tools){let r=resolveHarnessToolDefinition({node:e.node,tool:n});r!==null&&t.set(n.name,r)}return isImplicitAgentToolAvailable({disabledFrameworkTools:e.node.agent.disabledFrameworkTools,hasAuthoredAgentTool:t.has(AGENT_TOOL_NAME),nodeId:e.node.nodeId})&&t.set(AGENT_TOOL_NAME,{description:AGENT_TOOL_DESCRIPTION,inputSchema:e.node.agent.config?.experimental?.subagentPersistentSessions===!0?PERSISTENT_SUBAGENT_TOOL_INPUT_SCHEMA:SUBAGENT_TOOL_INPUT_SCHEMA,name:AGENT_TOOL_NAME,runtimeAction:{kind:`subagent-call`,nodeId:e.node.nodeId,subagentName:AGENT_TOOL_NAME}}),t}function resolveHarnessToolDefinition(e){if(e.tool.kind===`subagent`||e.tool.kind===`remote`)return createHarnessDelegationToolDefinition(e.tool);let t=findRegisteredRuntimeTool(e.node.toolRegistry,e.tool.name);if(t===null)return log.warn(`declared tool is not registered — omitting from toolset`,{toolName:e.tool.name,nodeId:e.node.nodeId}),null;let r=t.definition,i=r.sourceId.startsWith(`eve:`),o=r.execute;return{approvalKey:r.approvalKey,description:r.description,execute:resolveAuthoredExecute({isFrameworkTool:i,rawExecute:o,scope:r.name}),inputSchema:r.inputSchema??UNSPECIFIED_INPUT_SCHEMA,name:r.name,approval:r.approval,outputSchema:r.outputSchema,toModelOutput:r.toModelOutput}}function resolveAuthoredExecute(e){let{isFrameworkTool:t,rawExecute:n,scope:i}=e;return n===void 0?void 0:t?n:createToolExecuteWithAuth({execute:n,scope:i})}export{buildRuntimeIdentity,createExecutionNodeStep,createNodeHarnessTools};

package/dist/src/execution/parked-delivery-wait.d.ts

@@ -1,6 +1,13 @@
 import type { DeliverHookPayload, DeliverPayload } from "#channel/types.js";
 import type { DurableSessionState } from "#execution/durable-session-store.js";
 import type { SessionCommandInbox } from "#execution/session-command-inbox.js";
+/** One authorization-callback read surfaced during a parked wait. */
+export interface AuthorizationCallbackInstruction {
+    readonly kind: "authorization";
+    /** True when the authorization hook closed; no further callbacks can arrive. */
+    readonly closed: boolean;
+    readonly payloads: readonly DeliverPayload[];
+}
 /** What the parked driver should do with the next session activity. */
 export type NextTurnInstruction = {
     readonly kind: "clear";
@@ -14,7 +21,7 @@ export type NextTurnInstruction = {
     readonly kind: "closed";
 } | {
     readonly kind: "cancel-turn";
-} | {
+} | AuthorizationCallbackInstruction | {
     readonly kind: "turn";
     readonly deliver: DeliverHookPayload;
     readonly remainder: DeliverPayload;
@@ -25,11 +32,19 @@ export type NextTurnInstruction = {
  * no turn to run, so this keeps waiting until a delivery produces a parent
  * turn, a cancellation, expiry, or hook closure. The wait is unbounded by
  * design: a parked session lives until something addresses it.
+ *
+ * With `awaitAuthorizationCallbacks`, the inbox's authorization window stays
+ * open for the whole wait — including iterations that consume activity
+ * without producing a parent turn (no-op cancels, fully-routed descendant
+ * deliveries) — so an open challenge's callback surfaces as an
+ * `"authorization"` instruction no matter when it arrives.
  */
 export declare function nextTurnDelivery(input: {
+    readonly awaitAuthorizationCallbacks?: boolean;
     readonly bufferedDeliveries: DeliverHookPayload[];
     readonly bufferedSessionControls: Array<"clear" | "compact" | "expired" | "reset">;
     readonly commandInbox: SessionCommandInbox;
+    readonly deferDeliveries?: boolean;
     readonly driverWritable: WritableStream<Uint8Array>;
     readonly sessionState: DurableSessionState;
 }): Promise<NextTurnInstruction>;

package/dist/src/execution/parked-delivery-wait.js

@@ -1 +1 @@
-import{coalesceDeliveries}from"#harness/messages.js";import{routeDeliverToChildren}from"#execution/route-child-delivery.js";import{sendCommandToDelivery}from"#execution/session-command-wire.js";async function nextTurnDelivery(e){for(;;){let n=await waitForNextSessionAction({bufferedDeliveries:e.bufferedDeliveries,bufferedSessionControls:e.bufferedSessionControls,commandInbox:e.commandInbox});if(n.kind!==`delivery`)return{kind:n.kind};let r=n.delivery;if(r===null)return{kind:`closed`};let i=await routeDeliverToChildren({auth:r.auth,parentWritable:e.driverWritable,payloads:r.payloads,sessionState:e.sessionState});if(i.kind===`cancel-turn`)return{kind:`cancel-turn`};if(i.remainder!==void 0)return{deliver:r,kind:`turn`,remainder:i.remainder}}}async function waitForNextSessionAction(e){let t=e.bufferedSessionControls.shift();if(t!==void 0)return{kind:t};if(e.bufferedDeliveries.length>0)return{delivery:takeBufferedTurnDelivery(e.bufferedDeliveries),kind:`delivery`};for(;;){let t=await e.commandInbox.next();if(e.commandInbox.consumeNext(),t.done)return{delivery:null,kind:`delivery`};if(t.value.kind===`session-timeout`)return{kind:`expired`};if(t.value.kind===`clear`||t.value.kind===`compact`||t.value.kind===`reset`)return{kind:t.value.kind};if(t.value.kind!==`cancel`)return t.value.kind===`deliver`?{delivery:t.value,kind:`delivery`}:{delivery:sendCommandToDelivery(t.value),kind:`delivery`}}}function takeBufferedTurnDelivery(t){let n=t.shift();if(n===void 0)throw Error(`Cannot take a turn delivery from an empty buffer.`);let r=[n],i=n.caller;for(;t.length>0;){let e=t[0];if(e===void 0||i!==void 0&&e.caller!==void 0)break;let n=t.shift();if(n===void 0)throw Error(`Buffered turn delivery disappeared while partitioning.`);r.push(n),i??=n.caller}return coalesceDeliveries(r)}export{nextTurnDelivery};
+import{coalesceDeliveries}from"#harness/messages.js";import{routeDeliverToChildren}from"#execution/route-child-delivery.js";import{sendCommandToDelivery}from"#execution/session-command-wire.js";async function nextTurnDelivery(e){if(e.awaitAuthorizationCallbacks!==!0)return await awaitNextTurnDelivery(e);e.commandInbox.setAuthorizationWindow(!0);try{return await awaitNextTurnDelivery(e)}finally{e.commandInbox.setAuthorizationWindow(!1)}}async function awaitNextTurnDelivery(e){for(;;){let n=await waitForNextSessionAction({bufferedDeliveries:e.bufferedDeliveries,bufferedSessionControls:e.bufferedSessionControls,commandInbox:e.commandInbox,deferDeliveries:e.deferDeliveries});if(n.kind===`authorization`)return n;if(n.kind!==`delivery`)return{kind:n.kind};let r=n.delivery;if(r===null)return{kind:`closed`};let i=await routeDeliverToChildren({auth:r.auth,parentWritable:e.driverWritable,payloads:r.payloads,sessionState:e.sessionState});if(i.kind===`cancel-turn`)return{kind:`cancel-turn`};if(i.remainder!==void 0)return{deliver:r,kind:`turn`,remainder:i.remainder}}}async function waitForNextSessionAction(e){let t=e.bufferedSessionControls.shift();if(t!==void 0)return{kind:t};if(e.deferDeliveries!==!0&&!e.commandInbox.hasReadyAuthorization()&&e.bufferedDeliveries.length>0)return{delivery:takeBufferedTurnDelivery(e.bufferedDeliveries),kind:`delivery`};for(;;){let{result:t,source:r}=await e.commandInbox.nextWithSource();if(e.commandInbox.consumeNext(),r===`authorization`)return t.done?{closed:!0,kind:`authorization`,payloads:[]}:{closed:!1,kind:`authorization`,payloads:t.value.kind===`deliver`?t.value.payloads:[]};if(t.done)return{delivery:null,kind:`delivery`};if(t.value.kind===`session-timeout`)return{kind:`expired`};if(t.value.kind===`clear`||t.value.kind===`compact`||t.value.kind===`reset`)return{kind:t.value.kind};if(t.value.kind===`cancel`)continue;if(t.value.kind===`deliver`){if(e.deferDeliveries===!0){e.bufferedDeliveries.push(t.value);continue}return{delivery:t.value,kind:`delivery`}}let i=sendCommandToDelivery(t.value);if(e.deferDeliveries===!0){e.bufferedDeliveries.push(i);continue}return{delivery:i,kind:`delivery`}}}function takeBufferedTurnDelivery(t){let n=t.shift();if(n===void 0)throw Error(`Cannot take a turn delivery from an empty buffer.`);let r=[n],i=n.caller;for(;t.length>0;){let e=t[0];if(e===void 0||i!==void 0&&e.caller!==void 0)break;let n=t.shift();if(n===void 0)throw Error(`Buffered turn delivery disappeared while partitioning.`);r.push(n),i??=n.caller}return coalesceDeliveries(r)}export{nextTurnDelivery};

package/dist/src/execution/sandbox/abort-bound-session.d.ts

@@ -3,4 +3,4 @@ import type { SandboxSession } from "#shared/sandbox-session.js";
  * Returns a sandbox session that applies `abortSignal` to every operation.
  * Per-call signals are composed with the bound signal.
  */
-export declare function bindSandboxAbortSignal(session: SandboxSession, abortSignal: AbortSignal): SandboxSession;
+export declare function bindSandboxAbortSignal<TSession extends SandboxSession>(session: TSession, abortSignal: AbortSignal): TSession;

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(c={}){let l=c.dockerCli??createDockerCli(),u=resolveDockerSandboxOptions(c.createOptions),d=createDockerSandboxOptionsHash(u),f;function ensureDaemon(){return f??=assertDockerDaemonAvailable(l).catch(e=>{throw f=void 0,e}),f}return{name:DOCKER_BACKEND_NAME,async prewarm(r){r.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:d,templateKey:r.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(r.runtimeContext.appRoot,i);if(r.log?.(`checking cached template image "${a}"`),await dockerImageExists(l,a))return r.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};r.log?.(`checking base image "${u.image}"`),await ensureDockerBaseImage(l,u);let s=`${r.templateKey}-build-${randomUUID().slice(0,8)}`;r.log?.(`starting template build container`),await startDockerContainer({cli:l,containerName:s,image:u.image,initialNetworkPolicy:`allow-all`,options:u,role:`template-build`});try{r.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(l,s),u.networkPolicy!==`allow-all`&&(r.log?.(`applying network policy`),await setDockerNetworkPolicy(l,s,u.networkPolicy));let e=buildSandboxSession(createDockerInternalSession({cli:l,containerName:s,id:r.templateKey}),e=>setDockerNetworkPolicy(l,s,e));r.seedFiles.length>0&&r.log?.(`writing ${r.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(e,r.seedFiles),r.bootstrap!==void 0&&(r.log?.(`running sandbox bootstrap`),await r.bootstrap({use:async()=>createLoggingSandboxSession({log:r.log,session:e})})),r.log?.(`stopping template build container`),expectDockerSuccess(await l.run([`stop`,`-t`,`0`,s]),`stop template build container "${s}"`),r.log?.(`committing template image "${a}"`),expectDockerSuccess(await l.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${r.templateKey}`,s,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await l.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon();let n=getDockerContainerName(e.existingMetadata)??e.sessionKey,r=await l.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,n]);if(r.exitCode===0)r.stdout.trim()!==`true`&&expectDockerSuccess(await l.run([`start`,n]),`restart sandbox session container "${n}"`);else{let t;if(e.templateKey===null)await ensureDockerBaseImage(l,u),t=u.image;else{let n={optionsHash:d,templateKey:e.templateKey};if(t=dockerTemplateImageReference(n),!await dockerImageExists(l,t))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),t)}try{await startDockerContainer({cli:l,containerName:n,image:t,initialNetworkPolicy:e.templateKey===null?`allow-all`:u.networkPolicy,options:u,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(l,n),u.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(l,n,u.networkPolicy))}let i=buildSandboxSession(createDockerInternalSession({cli:l,containerName:n,id:e.sessionKey}),e=>setDockerNetworkPolicy(l,n,e));return{session:i,useSessionFn:async()=>i,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:n},sessionKey:e.sessionKey}},async shutdown(){await stopDockerContainerIfRunning(l,n)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(c={}){let l=c.dockerCli??createDockerCli(),u=resolveDockerSandboxOptions(c.createOptions),d=createDockerSandboxOptionsHash(u),f;function ensureDaemon(){return f??=assertDockerDaemonAvailable(l).catch(e=>{throw f=void 0,e}),f}return{name:DOCKER_BACKEND_NAME,async prewarm(r){r.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:d,templateKey:r.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(r.runtimeContext.appRoot,i);if(r.log?.(`checking cached template image "${a}"`),await dockerImageExists(l,a))return r.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};r.log?.(`checking base image "${u.image}"`),await ensureDockerBaseImage(l,u);let s=`${r.templateKey}-build-${randomUUID().slice(0,8)}`;r.log?.(`starting template build container`),await startDockerContainer({cli:l,containerName:s,image:u.image,initialNetworkPolicy:`allow-all`,options:u,role:`template-build`});try{r.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(l,s),u.networkPolicy!==`allow-all`&&(r.log?.(`applying network policy`),await setDockerNetworkPolicy(l,s,u.networkPolicy));let e=buildSandboxSession(createDockerInternalSession({cli:l,containerName:s,id:r.templateKey}),e=>setDockerNetworkPolicy(l,s,e));r.seedFiles.length>0&&r.log?.(`writing ${r.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(e,r.seedFiles),r.bootstrap!==void 0&&(r.log?.(`running sandbox bootstrap`),await r.bootstrap({use:async()=>createLoggingSandboxSession({log:r.log,session:e})})),r.log?.(`stopping template build container`),expectDockerSuccess(await l.run([`stop`,`-t`,`0`,s]),`stop template build container "${s}"`),r.log?.(`committing template image "${a}"`),expectDockerSuccess(await l.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${r.templateKey}`,s,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await l.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon();let n=getDockerContainerName(e.existingMetadata)??e.sessionKey,r=await l.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,n]);if(r.exitCode===0)r.stdout.trim()!==`true`&&expectDockerSuccess(await l.run([`start`,n]),`restart sandbox session container "${n}"`);else{let t;if(e.templateKey===null)await ensureDockerBaseImage(l,u),t=u.image;else{let n={optionsHash:d,templateKey:e.templateKey};if(t=dockerTemplateImageReference(n),!await dockerImageExists(l,t))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),t)}try{await startDockerContainer({cli:l,containerName:n,image:t,initialNetworkPolicy:e.templateKey===null?`allow-all`:u.networkPolicy,options:u,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(l,n),u.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(l,n,u.networkPolicy))}let i=buildSandboxSession(createDockerInternalSession({cli:l,containerName:n,id:e.sessionKey}),e=>setDockerNetworkPolicy(l,n,e));return{session:i,useSessionFn:async()=>i,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:n},sessionKey:e.sessionKey}},async stop(){await stopDockerContainerIfRunning(l,n)},async shutdown(){await stopDockerContainerIfRunning(l,n)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.js

@@ -1 +1 @@
-import{mkdir,readFile,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(t){let{ReadWriteFs:n,Sandbox:r}=await loadJustBashModule({appRoot:t.appRoot,autoInstall:t.autoInstall}),i=resolveLocalSandboxFilesystemRootPath(t.rootPath),a=resolveLocalSandboxMetadataPath(t.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(t.filesystem!==void 0)try{c=await t.filesystem({appRoot:t.appRoot,defaultFilesystem:s})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,env:o?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:t.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:t.rootPath,sessionKey:t.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`;return adaptMultiplexedCommandToSandboxProcess({command:await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal}),getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let n=JSON.parse(await readFile(e,`utf8`));return n.version!==1||!isStringRecord(n.env)?null:{env:n.env,version:1}}async function writeLocalMetadata(t,r){await mkdir(dirname(t),{recursive:!0}),await writeFile(t,`${JSON.stringify(r,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};
+import{mkdir,readFile,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(t){let{ReadWriteFs:n,Sandbox:r}=await loadJustBashModule({appRoot:t.appRoot,autoInstall:t.autoInstall}),i=resolveLocalSandboxFilesystemRootPath(t.rootPath),a=resolveLocalSandboxMetadataPath(t.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(t.filesystem!==void 0)try{c=await t.filesystem({appRoot:t.appRoot,defaultFilesystem:s})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,env:o?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:t.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:t.rootPath,sessionKey:t.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`;return adaptMultiplexedCommandToSandboxProcess({command:await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal}),getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async stop(){await e.dispose()},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let n=JSON.parse(await readFile(e,`utf8`));return n.version!==1||!isStringRecord(n.env)?null:{env:n.env,version:1}}async function writeLocalMetadata(t,r){await mkdir(dirname(t),{recursive:!0}),await writeFile(t,`${JSON.stringify(r,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(a){a.prewarmInput.log?.(`loading microsandbox runtime`);let o=await loadMicrosandboxModule({appRoot:a.prewarmInput.runtimeContext.appRoot,log:a.prewarmInput.log,options:a.options}),d=resolveMicrosandboxTemplateRootPath(resolveSandboxCacheDirectory(a.prewarmInput.runtimeContext.appRoot),a.prewarmInput.templateKey),p=resolveMicrosandboxMetadataPath(d);a.prewarmInput.log?.(`checking cached snapshot`);let m=await readTemplateMetadata(p);if(m?.optionsHash===a.optionsHash&&await snapshotExists(o,m.snapshotName))return a.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(d),{reused:!0};let g=createProviderName(`eve-sbx-tpl`,a.prewarmInput.templateKey,a.optionsHash),v=`${d}.${randomUUID()}.tmp`,y=createProviderName(`eve-sbx-tpl-tmp`,`${a.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(o,g),await rm(v,{force:!0,recursive:!0}),await mkdir(v,{recursive:!0}),a.prewarmInput.log?.(`creating template VM from image "${a.options.image}"`);let b=await createPreparedMicrosandbox({log:a.prewarmInput.log,module:o,name:y,networkPolicy:a.options.networkPolicy,options:a.options,sessionKey:a.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),x=buildSandboxSession(createMicrosandboxInternalSession(b),async e=>{await b.setNetworkPolicy(e)});try{a.prewarmInput.seedFiles.length>0&&a.prewarmInput.log?.(`writing ${a.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(x,a.prewarmInput.seedFiles),a.prewarmInput.bootstrap!==void 0&&(a.prewarmInput.log?.(`running sandbox bootstrap`),await a.prewarmInput.bootstrap({use:async e=>(e?.networkPolicy!==void 0&&await b.setNetworkPolicy(e.networkPolicy),createLoggingSandboxSession({log:a.prewarmInput.log,session:x}))})),a.prewarmInput.log?.(`snapshotting template VM`),await b.stopAndSnapshot(g),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(v),{optionsHash:a.optionsHash,snapshotName:g,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(d),{recursive:!0}),await rm(d,{force:!0,recursive:!0});try{await rename(v,d)}catch(e){if(await doesPathExist(d))return{reused:!0};throw e}}finally{await b.removePersisted(),await rm(v,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(t){let n=await loadMicrosandboxModule({appRoot:t.createInput.runtimeContext.appRoot,options:t.options}),r=resolveSandboxCacheDirectory(t.createInput.runtimeContext.appRoot),i=resolveMicrosandboxSessionRootPath(r,t.createInput.sessionKey),o=createActiveMicrosandboxSessionKey(i,t.optionsHash),s=activeMicrosandboxSessionHandles.get(o);if(s!==void 0)return s;let c=resolveMicrosandboxMetadataPath(i),l=readSessionMetadataRecord(t.createInput.existingMetadata)??await readSessionMetadata(c),u=withDevelopmentSandboxMetadataPathTag(t.createInput.tags,c);if(l?.optionsHash===t.optionsHash&&(await sandboxExists(n,l.sandboxName)||l.stateSnapshotName!==void 0&&await snapshotExists(n,l.stateSnapshotName))){let e=await connectMicrosandbox({metadata:l,metadataPath:c,module:n,options:t.options,sessionKey:t.createInput.sessionKey,tags:u});if(e!==null)return cacheHandle(o,createHandle(e,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}let f=null;if(t.createInput.templateKey!==null){let e=await readTemplateMetadata(resolveMicrosandboxMetadataPath(resolveMicrosandboxTemplateRootPath(r,t.createInput.templateKey)));if(e===null||e.optionsHash!==t.optionsHash||!await snapshotExists(n,e.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey});f=e.snapshotName}let h=createProviderName(`eve-sbx-ses`,`${t.createInput.sessionKey}:${randomUUID()}`),_;try{_=await createPreparedMicrosandbox({fromSnapshot:f??void 0,module:n,name:h,networkPolicy:t.options.networkPolicy,options:t.options,sessionKey:t.createInput.sessionKey,setupBaseRuntime:f===null,tags:u})}catch(e){throw f!==null&&t.createInput.templateKey!==null&&isMicrosandboxNotFoundError(e)?new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey}):e}return await _.writeMetadata(c,t.optionsHash),cacheHandle(o,createHandle(_,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};
+import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(a){a.prewarmInput.log?.(`loading microsandbox runtime`);let o=await loadMicrosandboxModule({appRoot:a.prewarmInput.runtimeContext.appRoot,log:a.prewarmInput.log,options:a.options}),d=resolveMicrosandboxTemplateRootPath(resolveSandboxCacheDirectory(a.prewarmInput.runtimeContext.appRoot),a.prewarmInput.templateKey),p=resolveMicrosandboxMetadataPath(d);a.prewarmInput.log?.(`checking cached snapshot`);let m=await readTemplateMetadata(p);if(m?.optionsHash===a.optionsHash&&await snapshotExists(o,m.snapshotName))return a.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(d),{reused:!0};let g=createProviderName(`eve-sbx-tpl`,a.prewarmInput.templateKey,a.optionsHash),v=`${d}.${randomUUID()}.tmp`,y=createProviderName(`eve-sbx-tpl-tmp`,`${a.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(o,g),await rm(v,{force:!0,recursive:!0}),await mkdir(v,{recursive:!0}),a.prewarmInput.log?.(`creating template VM from image "${a.options.image}"`);let b=await createPreparedMicrosandbox({log:a.prewarmInput.log,module:o,name:y,networkPolicy:a.options.networkPolicy,options:a.options,sessionKey:a.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),x=buildSandboxSession(createMicrosandboxInternalSession(b),async e=>{await b.setNetworkPolicy(e)});try{a.prewarmInput.seedFiles.length>0&&a.prewarmInput.log?.(`writing ${a.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(x,a.prewarmInput.seedFiles),a.prewarmInput.bootstrap!==void 0&&(a.prewarmInput.log?.(`running sandbox bootstrap`),await a.prewarmInput.bootstrap({use:async e=>(e?.networkPolicy!==void 0&&await b.setNetworkPolicy(e.networkPolicy),createLoggingSandboxSession({log:a.prewarmInput.log,session:x}))})),a.prewarmInput.log?.(`snapshotting template VM`),await b.stopAndSnapshot(g),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(v),{optionsHash:a.optionsHash,snapshotName:g,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(d),{recursive:!0}),await rm(d,{force:!0,recursive:!0});try{await rename(v,d)}catch(e){if(await doesPathExist(d))return{reused:!0};throw e}}finally{await b.removePersisted(),await rm(v,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(t){let n=await loadMicrosandboxModule({appRoot:t.createInput.runtimeContext.appRoot,options:t.options}),r=resolveSandboxCacheDirectory(t.createInput.runtimeContext.appRoot),i=resolveMicrosandboxSessionRootPath(r,t.createInput.sessionKey),o=createActiveMicrosandboxSessionKey(i,t.optionsHash),s=activeMicrosandboxSessionHandles.get(o);if(s!==void 0)return s;let c=resolveMicrosandboxMetadataPath(i),l=readSessionMetadataRecord(t.createInput.existingMetadata)??await readSessionMetadata(c),u=withDevelopmentSandboxMetadataPathTag(t.createInput.tags,c);if(l?.optionsHash===t.optionsHash&&(await sandboxExists(n,l.sandboxName)||l.stateSnapshotName!==void 0&&await snapshotExists(n,l.stateSnapshotName))){let e=await connectMicrosandbox({metadata:l,metadataPath:c,module:n,options:t.options,sessionKey:t.createInput.sessionKey,tags:u});if(e!==null)return cacheHandle(o,createHandle(e,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}let f=null;if(t.createInput.templateKey!==null){let e=await readTemplateMetadata(resolveMicrosandboxMetadataPath(resolveMicrosandboxTemplateRootPath(r,t.createInput.templateKey)));if(e===null||e.optionsHash!==t.optionsHash||!await snapshotExists(n,e.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey});f=e.snapshotName}let h=createProviderName(`eve-sbx-ses`,`${t.createInput.sessionKey}:${randomUUID()}`),_;try{_=await createPreparedMicrosandbox({fromSnapshot:f??void 0,module:n,name:h,networkPolicy:t.options.networkPolicy,options:t.options,sessionKey:t.createInput.sessionKey,setupBaseRuntime:f===null,tags:u})}catch(e){throw f!==null&&t.createInput.templateKey!==null&&isMicrosandboxNotFoundError(e)?new SandboxTemplateNotProvisionedError({backendName:t.backendName,templateKey:t.createInput.templateKey}):e}return await _.writeMetadata(c,t.optionsHash),cacheHandle(o,createHandle(_,t.backendName,t.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(o)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async stop(){await e.stop(),r?.()},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.d.ts

@@ -23,6 +23,7 @@ export declare class MicrosandboxVm {
      * (dev) or restores from the last captured snapshot (production).
      */
     shutdown(): Promise<void>;
+    stop(): Promise<void>;
     readFileBytes(path: string): Promise<Buffer | null>;
     removePath(options: SandboxRemovePathOptions): Promise<void>;
     removePersisted(): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.js

@@ -1 +1 @@
-import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(r),this.#o=r,this.#t!==void 0&&await this.writeMetadata(this.#t,e),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:r,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a),this.#o!==void 0&&await removeSnapshotIfExists$1(this.#e.module,this.#o)}async setNetworkPolicy(e){let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),i=this.#a;await this.stopAndSnapshot(r),await removeSandboxIfExists(this.#e.module,i);let a=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:r,module:this.#e.module,name:a,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=a,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,r),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let n=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),r=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:n,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let i=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},r,n,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await i.writeMetadata(e.metadataPath,e.metadata.optionsHash),i}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:MICROSANDBOX_PACKAGE_NAME}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(t){return createHash(`sha256`).update(t).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};
+import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(r),this.#o=r,this.#t!==void 0&&await this.writeMetadata(this.#t,e),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:r,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async stop(){await this.#i.stop(),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a),this.#o!==void 0&&await removeSnapshotIfExists$1(this.#e.module,this.#o)}async setNetworkPolicy(e){let n=this.#o,r=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),i=this.#a;await this.stopAndSnapshot(r),await removeSandboxIfExists(this.#e.module,i);let a=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:r,module:this.#e.module,name:a,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=a,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,r),n!==void 0&&await removeSnapshotIfExists$1(this.#e.module,n)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let n=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),r=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:n,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let i=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},r,n,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await i.writeMetadata(e.metadataPath,e.metadata.optionsHash),i}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:MICROSANDBOX_PACKAGE_NAME}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(t){return createHash(`sha256`).update(t).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};