eve 0.62.0 → 0.64.0

package/dist/src/execution/sandbox/bindings/docker.d.ts

@@ -1,33 +1,31 @@
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
 import { type DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
-import type { DockerSandboxCreateOptions } from "#public/sandbox/docker-sandbox.js";
+import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+import type { DockerSandboxEnvironmentOptions, DockerSandboxRuntimeOptions } from "#public/sandbox/docker-sandbox.js";
 export { DOCKER_TEMPLATE_IMAGE_REPOSITORY, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker-templates.js";
 /**
- * Stable backend name. Participates in template/session key derivation
- * and persisted reconnect state.
+ * Stable provider name used for prepared-artifact storage and provider identity.
  */
-export declare const DOCKER_BACKEND_NAME = "docker";
+export declare const DOCKER_PROVIDER_NAME = "docker";
+type DockerSandboxPreparedArtifact = {
+    readonly imageReference: string;
+};
+type DockerSandboxSessionState = {
+    readonly containerName: string;
+    readonly generation: string;
+    readonly version: 2;
+};
 /**
- * Construction input for {@link createDockerSandboxBackend}. Internal —
- * the public surface is the `docker()` factory under
- * `eve/sandbox`.
- */
-export interface CreateDockerSandboxBackendInput {
-    readonly createOptions?: DockerSandboxCreateOptions;
-    /** Injectable Docker driver so backend logic is testable without a daemon. */
-    readonly dockerCli?: DockerCli;
-}
-/**
- * Creates the Docker sandbox backend.
+ * Creates the Docker sandbox provider.
  *
  * Two-phase lifecycle mapped onto Docker primitives:
  *
  * - `prewarm` runs the base image, applies base setup, runs the
- *   authored `bootstrap`, writes seed files, then `docker commit`s the
+ *   authored preparation, writes seed files, then `docker commit`s the
  *   container into a reusable template image.
  * - `create` starts (or restarts) one long-lived container per session
  *   key from the template image. The container's filesystem carries
  *   session state across reconnects, so `shutdown` only stops the
  *   container and the next `create` restarts it with state intact.
  */
-export declare function createDockerSandboxBackend(input?: CreateDockerSandboxBackendInput): SandboxBackend;
+export declare function createDockerSandboxProvider(createOptions?: DockerSandboxEnvironmentOptions, dockerCli?: DockerCli): SandboxProviderImplementation<DockerSandboxRuntimeOptions, DockerSandboxPreparedArtifact, DockerSandboxSessionState, MutableNetworkSandboxSession>;

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(e={}){let t=e.dockerCli??createDockerCli(),n=resolveDockerSandboxOptions(e.createOptions),r=createDockerSandboxOptionsHash(n),i;function ensureDaemon(){return i??=assertDockerDaemonAvailable(t).catch(e=>{throw i=void 0,e}),i}return{name:DOCKER_BACKEND_NAME,async prewarm(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:r,templateKey:e.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,i);if(e.log?.(`checking cached template image "${a}"`),await dockerImageExists(t,a))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};e.log?.(`checking base image "${n.image}"`),await ensureDockerBaseImage(t,n);let s=`${e.templateKey}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:t,containerName:s,image:n.image,initialNetworkPolicy:`allow-all`,options:n,role:`template-build`});try{let r=await resolveDockerHandleIdentity(t,s);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(t,r),n.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await setDockerNetworkPolicy(t,r,n.networkPolicy));let i=buildSandboxSession(createDockerInternalSession({cli:t,containerIdentity:r,id:e.templateKey}),e=>setDockerNetworkPolicy(t,r,e));e.seedFiles.length>0&&e.log?.(`writing ${e.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(i,e.seedFiles),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async()=>createLoggingSandboxSession({log:e.log,session:i})})),e.log?.(`stopping template build container`),expectDockerSuccess(await t.run([`stop`,`-t`,`0`,r]),`stop template build container "${s}"`),e.log?.(`committing template image "${a}"`),expectDockerSuccess(await t.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${e.templateKey}`,r,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await t.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon();let i=getDockerContainerName(e.existingMetadata)??e.sessionKey,a=await t.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,i]);if(a.exitCode===0)a.stdout.trim()!==`true`&&expectDockerSuccess(await t.run([`start`,i]),`restart sandbox session container "${i}"`);else{let a;if(e.templateKey===null)await ensureDockerBaseImage(t,n),a=n.image;else{let n={optionsHash:r,templateKey:e.templateKey};if(a=dockerTemplateImageReference(n),!await dockerImageExists(t,a))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),a)}try{await startDockerContainer({cli:t,containerName:i,image:a,initialNetworkPolicy:e.templateKey===null?`allow-all`:n.networkPolicy,options:n,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(t,i),n.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(t,i,n.networkPolicy))}let o=await resolveDockerHandleIdentity(t,i),s=buildSandboxSession(createDockerInternalSession({cli:t,containerIdentity:o,id:e.sessionKey}),e=>setDockerNetworkPolicy(t,o,e));return{session:s,useSessionFn:async()=>s,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:i},sessionKey:e.sessionKey}},async delete(){await stopDockerContainerIfRunning(t,o),expectDockerSuccess(await t.run([`rm`,`-f`,o]),`delete sandbox session container "${i}"`)},async stop(){await stopDockerContainerIfRunning(t,o)},async shutdown(){await stopDockerContainerIfRunning(t,o)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,a]);if(c.exitCode===0)c.stdout.trim()!==`true`&&expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);else{if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}})}let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSessionDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSessionStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),expectDockerSuccess(await n.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${o}`,t,c]),`commit sandbox template image "${c}"`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/immutable-resources.d.ts

@@ -0,0 +1,21 @@
+import { type SandboxProviderResources } from "#shared/sandbox-provider.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+export declare const SANDBOX_RESOURCES_ROOT = "/eve/resources";
+export declare function resolveImmutableResourcesPath(input: {
+    readonly storagePath: string;
+    readonly provider: string;
+    readonly resourcesKey: string;
+}): string;
+export declare function prepareImmutableResources(input: {
+    readonly storagePath: string;
+    readonly provider: string;
+    readonly resourcesKey: string;
+    readonly sourcePath: string;
+}): Promise<string>;
+export declare function hydrateSandboxProviderResources(input: {
+    readonly copySkills?: boolean;
+    readonly log?: (message: string) => void;
+    readonly resources: SandboxProviderResources;
+    readonly session: SandboxSession;
+}): Promise<void>;
+export declare function hydrateSandboxFromImmutableResources(session: SandboxSession, copySkills?: boolean): Promise<void>;

package/dist/src/execution/sandbox/bindings/immutable-resources.js

@@ -0,0 +1,2 @@
+import{join}from"node:path";import{copyDirectoryAtomically,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-provider-utils.js";import{providerResourceTargetFiles}from"#shared/sandbox-provider.js";const SANDBOX_RESOURCES_ROOT=`/eve/resources`;function resolveImmutableResourcesPath(e){return join(e.storagePath,e.provider,`resources`,e.resourcesKey)}async function prepareImmutableResources(e){let t=resolveImmutableResourcesPath(e);return await copyDirectoryAtomically(e.sourcePath,t),t}async function hydrateSandboxProviderResources(e){switch(e.resources.source.kind){case`none`:case`inline`:await writeSandboxSeedFiles(e.session,providerResourceTargetFiles(e.resources));return;case`materialized`:e.log?.(`hydrating workspace and skills from read-only resources`),await hydrateSandboxFromImmutableResources(e.session,e.copySkills);return}}async function hydrateSandboxFromImmutableResources(e,t=!1){let n=t?[`  mkdir -p "$HOME/.agents/skills"`,`  cp -a ${SANDBOX_RESOURCES_ROOT}/skills/. "$HOME/.agents/skills/"`]:[`  ln -s ${SANDBOX_RESOURCES_ROOT}/skills "$HOME/.agents/skills"`],r=await e.run({command:[`set -e`,`if [ -d ${SANDBOX_RESOURCES_ROOT}/workspace ]; then cp -a ${SANDBOX_RESOURCES_ROOT}/workspace/. /workspace/; fi`,`if [ -d ${SANDBOX_RESOURCES_ROOT}/skills ]; then`,`  mkdir -p "$HOME/.agents"`,`  rm -rf "$HOME/.agents/skills"`,...n,`fi`].join(`
+`)});if(r.exitCode!==0)throw Error(`Failed to hydrate sandbox resources: ${r.stderr||r.stdout}`)}export{SANDBOX_RESOURCES_ROOT,hydrateSandboxFromImmutableResources,hydrateSandboxProviderResources,prepareImmutableResources,resolveImmutableResourcesPath};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.d.ts

@@ -1,8 +1,12 @@
-import type { SandboxBackendHandle } from "#public/definitions/sandbox-backend.js";
+import type { SandboxProviderHandle, SandboxProviderHost } from "#shared/sandbox-provider.js";
+import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
 import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
+export interface JustBashSessionMetadata {
+    readonly rootPath: string;
+}
 export interface BashSandbox {
-    captureState(): Promise<Record<string, unknown> | null>;
+    captureState(): Promise<JustBashSessionMetadata>;
     dispose(): Promise<void>;
     readFileBytes(path: string): Promise<Buffer | null>;
     removePath(options: SandboxRemovePathOptions): Promise<void>;
@@ -15,12 +19,13 @@ export interface BashSandbox {
     }>): Promise<void>;
 }
 export declare function createBashSandbox(input: {
-    readonly appRoot: string;
     readonly autoInstall: boolean;
+    readonly host: SandboxProviderHost;
     readonly customCommands?: JustBashSandboxCreateOptions["customCommands"];
     readonly filesystem?: JustBashSandboxCreateOptions["filesystem"];
     readonly rootPath: string;
     readonly sessionKey: string;
+    readonly storagePath: string;
 }): Promise<BashSandbox>;
 /**
  * The just-bash engine cannot honor a run-time network policy: just-bash takes
@@ -29,5 +34,4 @@ export declare function createBashSandbox(input: {
  * Throw rather than silently no-op so brokering code surfaces the gap instead
  * of leaking.
  */
-export declare function justBashSetNetworkPolicyUnsupported(): Promise<never>;
-export declare function createJustBashHandle(sandbox: BashSandbox, backendName: string): SandboxBackendHandle;
+export declare function createJustBashHandle(sandbox: BashSandbox): SandboxProviderHandle<FixedNetworkSandboxSession>;

package/dist/src/execution/sandbox/bindings/just-bash-runtime.js

@@ -1 +1 @@
-import{mkdir,readFile,rm,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(e){let t=await loadJustBashModule({appRoot:e.appRoot,autoInstall:e.autoInstall}),{ReadWriteFs:n,Sandbox:r}=t,i=resolveLocalSandboxFilesystemRootPath(e.rootPath),a=resolveLocalSandboxMetadataPath(e.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(e.filesystem!==void 0)try{c=await e.filesystem({appRoot:e.appRoot,defaultFilesystem:s,justBash:t})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,customCommands:e.customCommands===void 0?void 0:[...e.customCommands],env:o?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:e.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:e.rootPath,sessionKey:e.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`,n=await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async delete(){await e.dispose(),await rm(e.rootPath,{force:!0,recursive:!0})},async stop(){await e.dispose()},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(e,t){await mkdir(dirname(e),{recursive:!0}),await writeFile(e,`${JSON.stringify(t,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};
+import{mkdir,readFile,rm,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-provider-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=e.host.loadOptionalPackage({autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox provider requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use DockerSandbox or DefaultSandbox instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(e){let t=await loadJustBashModule({autoInstall:e.autoInstall,host:e.host}),{ReadWriteFs:n,Sandbox:r}=t,i=resolveLocalSandboxFilesystemRootPath(e.rootPath),a=resolveLocalSandboxMetadataPath(e.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(e.filesystem!==void 0)try{c=await e.filesystem({defaultFilesystem:s,resolveProjectPath:e.host.resolveProjectPath,storagePath:e.storagePath,justBash:t})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,customCommands:e.customCommands===void 0?void 0:[...e.customCommands],env:o===null?void 0:{...o.env},fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:e.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:e.rootPath,sessionKey:e.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`,n=await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}function createJustBashHandle(e){return{sandbox:buildSandboxSession(createFileBackedInternalSandboxSession({sandbox:e})),async onSessionDelete(){await e.dispose(),await rm(e.rootPath,{force:!0,recursive:!0})},async onSessionStop(){await e.dispose()},async onRuntimeShutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return!isRecord(t)||t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(e,t){await mkdir(dirname(e),{recursive:!0}),await writeFile(e,`${JSON.stringify(t,null,2)}\n`)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle};

package/dist/src/execution/sandbox/bindings/just-bash.d.ts

@@ -1,33 +1,20 @@
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
-/**
- * Stable backend name. Participates in template/session key derivation
- * and persisted reconnect state.
- */
-export declare const JUST_BASH_BACKEND_NAME = "just-bash";
-/**
- * Construction input for {@link createJustBashSandboxBackend}. Internal —
- * the public surface is the `justbash()` factory under
- * `eve/sandbox`.
- */
-export interface CreateJustBashSandboxBackendInput {
-    readonly createOptions?: JustBashSandboxCreateOptions;
-}
-/**
- * Creates the just-bash sandbox backend.
- *
- * The cache directory is derived from the runtime context's `appRoot`
- * on every `create` call so the backend stays stateless and matches
- * the framework's per-call dispatch contract.
- */
-export declare function createJustBashSandboxBackend(input?: CreateJustBashSandboxBackendInput): SandboxBackend;
-/**
- * Removes stale just-bash sandbox template directories for one
- * application's cache.
- */
+import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
+import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+export declare const JUST_BASH_PROVIDER_NAME = "just-bash";
+type JustBashPreparedArtifact = {
+    readonly templateRootPath: string;
+};
+type JustBashSessionState = {
+    readonly generation: string;
+    readonly rootPath: string;
+    readonly version: 2;
+};
+export declare function createJustBashSandboxProvider(authoredOptions?: JustBashSandboxCreateOptions | undefined): SandboxProviderImplementation<undefined, JustBashPreparedArtifact, JustBashSessionState, FixedNetworkSandboxSession>;
 export declare function pruneJustBashSandboxTemplates(input: {
     readonly appRoot: string;
     readonly now?: number;
     readonly recentWindowMs?: number;
     readonly retainCount?: number;
 }): Promise<void>;
+export {};

package/dist/src/execution/sandbox/bindings/just-bash.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,readdir,rename,rm,stat}from"node:fs/promises";import{dirname,join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalBackendSessionRootPath,resolveLocalBackendTemplateRootPath,resolveLocalBackendTemplatesDirectory,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported}from"#execution/sandbox/bindings/just-bash-runtime.js";const JUST_BASH_CACHE_DIRECTORY_NAME=`just-bash`,JUST_BASH_BACKEND_NAME=`just-bash`;function createJustBashSandboxBackend(e={}){let t=e.createOptions?.autoInstall??!0,n=e.createOptions?.customCommands,r=e.createOptions?.filesystem;return{name:JUST_BASH_BACKEND_NAME,async prewarm(e){let n=resolveTemplateRootPath(resolveSandboxCacheDirectory(e.runtimeContext.appRoot),e.templateKey);if(await pathExists(n))return await touchDirectory(n),{reused:!0};let r=`${n}.${randomUUID()}.tmp`,i=!1,a=await createBashSandbox({appRoot:e.runtimeContext.appRoot,autoInstall:t,rootPath:r,sessionKey:e.templateKey}),o=buildSandboxSession(createFileBackedInternalSandboxSession({id:a.sessionKey,sandbox:a}),justBashSetNetworkPolicyUnsupported);try{if(await writeSandboxSeedFiles(o,e.seedFiles),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async()=>createLoggingSandboxSession({log:e.log,session:o})})),await a.captureState()===null)throw Error(`Failed to capture local sandbox template state for "${e.templateKey}".`);await mkdir(dirname(n),{recursive:!0});try{await rename(r,n),i=!0}catch(e){if(await pathExists(n))return{reused:!0};throw e}}finally{await a.dispose(),i||await rm(r,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}},async create(e){let i=resolveSandboxCacheDirectory(e.runtimeContext.appRoot),a=getLocalRootPath(e.existingMetadata)??resolveSessionRootPath(i,e.sessionKey);if(!await pathExists(a)){if(e.templateKey===null)await mkdir(a,{recursive:!0});else{let t=resolveTemplateRootPath(i,e.templateKey);if(!await pathExists(t))throw new SandboxTemplateNotProvisionedError({backendName:JUST_BASH_BACKEND_NAME,templateKey:e.templateKey});await copyDirectoryAtomically(t,a)}}let o=await createBashSandbox({appRoot:e.runtimeContext.appRoot,autoInstall:t,customCommands:n,filesystem:r,rootPath:a,sessionKey:e.sessionKey});return createJustBashHandle(o,JUST_BASH_BACKEND_NAME)}}}async function pruneJustBashSandboxTemplates(e){let t=resolveLocalBackendTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot),JUST_BASH_CACHE_DIRECTORY_NAME),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a;try{a=await readdir(t,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let o=await Promise.all(a.filter(e=>e.isDirectory()).map(async e=>{let n=join(t,e.name);return{isTemporary:e.name.endsWith(`.tmp`),mtimeMs:(await stat(n)).mtimeMs,path:n}})),s=selectStaleTemplateEntries(o.filter(e=>!e.isTemporary),{now:n,recentWindowMs:r,retainCount:i}),c=selectStaleTemplateEntries(o.filter(e=>e.isTemporary),{now:n,recentWindowMs:r,retainCount:0});await Promise.all([...s,...c].map(async e=>await rm(e.path,{force:!0,recursive:!0})))}function resolveTemplateRootPath(e,t){return resolveLocalBackendTemplateRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function resolveSessionRootPath(e,t){return resolveLocalBackendSessionRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function getLocalRootPath(e){let t=e?.rootPath;return typeof t==`string`?t:void 0}export{JUST_BASH_BACKEND_NAME,createJustBashSandboxBackend,pruneJustBashSandboxTemplates};
+import{randomUUID}from"node:crypto";import{mkdir,readdir,rename,rm,stat}from"node:fs/promises";import{dirname,join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{createBashSandbox,createJustBashHandle}from"#execution/sandbox/bindings/just-bash-runtime.js";const JUST_BASH_CACHE_DIRECTORY_NAME=`just-bash`,JUST_BASH_PROVIDER_NAME=`just-bash`;function createJustBashSandboxProvider(e=void 0){let t=e??{},n=t.autoInstall??!0,r={autoInstall:n,customCommands:t.customCommands,filesystem:t.filesystem,version:2};return{async prepare(e){let i=createSandboxProviderIdentity({...r,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision}).slice(0,24),a=resolveTemplateRootPath(e.storagePath,i);if(await pathExists(a))return await touchDirectory(a),e.log?.(`reusing cached template filesystem`),{templateRootPath:a};let o=`${a}.${randomUUID()}.tmp`,s=!1,c=await createBashSandbox({autoInstall:n,host:e.host,rootPath:o,sessionKey:`prepare-${i}`,storagePath:e.storagePath}),l=buildSandboxSession(createFileBackedInternalSandboxSession({sandbox:c}));try{await writeSandboxSeedFiles(l,providerResourceTargetFiles(e.resources)),t.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await t.prepare(createLoggingSandboxSession({log:e.log,session:l}))),await c.captureState(),await mkdir(dirname(a),{recursive:!0});try{await rename(o,a),s=!0}catch(e){if(await pathExists(a))return{templateRootPath:a};throw e}}finally{await c.dispose(),s||await rm(o,{force:!0,recursive:!0})}return{templateRootPath:a}},async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root "${a.rootPath}" no longer exists.`);return await openHandle(e,a.rootPath,t)},async start(e,n,r){let i=requirePreparedJustBashArtifact(r),a=sessionRootPath(e,i);return await ensureSessionRoot(i,a),{handle:await openHandle(e,a,t),state:{generation:createSandboxProviderIdentity({artifact:i,version:1}),rootPath:a,version:2}}}}}function sessionRootPath(e,t){return resolveSessionRootPath(e.storagePath,createSandboxProviderIdentity({artifact:t,sessionId:e.session.id,version:1}).slice(0,24))}async function ensureSessionRoot(e,t){if(!await pathExists(t)){if(!await pathExists(e.templateRootPath))throw new SandboxTemplateNotProvisionedError({providerName:JUST_BASH_PROVIDER_NAME,templateKey:e.templateRootPath});await copyDirectoryAtomically(e.templateRootPath,t)}}async function openHandle(e,t,n){let r=await createBashSandbox({autoInstall:n.autoInstall??!0,customCommands:n.customCommands,filesystem:n.filesystem,host:e.host,rootPath:t,sessionKey:e.session.id,storagePath:e.storagePath});return createJustBashHandle(r)}async function pruneJustBashSandboxTemplates(e){let t=resolveLocalProviderTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot),JUST_BASH_CACHE_DIRECTORY_NAME),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a;try{a=await readdir(t,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let o=await Promise.all(a.filter(e=>e.isDirectory()).map(async e=>{let n=join(t,e.name);return{isTemporary:e.name.endsWith(`.tmp`),mtimeMs:(await stat(n)).mtimeMs,path:n}})),s=selectStaleTemplateEntries(o.filter(e=>!e.isTemporary),{now:n,recentWindowMs:r,retainCount:i}),c=selectStaleTemplateEntries(o.filter(e=>e.isTemporary),{now:n,recentWindowMs:r,retainCount:0});await Promise.all([...s,...c].map(async e=>await rm(e.path,{force:!0,recursive:!0})))}function requirePreparedJustBashArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.templateRootPath!=`string`)throw Error(`Invalid prepared just-bash artifact.`);return{templateRootPath:e.templateRootPath}}function requireJustBashSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.generation!=`string`||typeof e.rootPath!=`string`)throw Error(`Invalid just-bash session state.`);return{generation:e.generation,rootPath:e.rootPath,version:2}}function resolveTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function resolveSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}export{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates};

package/dist/src/execution/sandbox/bindings/{local-backend-utils.d.ts → local-provider-utils.d.ts}

@@ -1,4 +1,7 @@
-import type { SandboxSeedFile } from "#shared/sandbox-backend.js";
+export interface SandboxSeedFile {
+    readonly content: string | Uint8Array;
+    readonly path: string;
+}
 import type { InternalSandboxSession, SandboxProcess, SandboxRemovePathOptions, SandboxSession, SandboxSpawnOptions } from "#shared/sandbox-session.js";
 export interface FileBackedSandbox {
     readFileBytes(path: string): Promise<Buffer | null>;
@@ -10,14 +13,13 @@ export interface FileBackedSandbox {
     }>): Promise<void>;
 }
 export declare function createFileBackedInternalSandboxSession(input: {
-    readonly id: string;
     readonly sandbox: FileBackedSandbox;
 }): InternalSandboxSession;
 export declare function resolveWorkspacePath(path: string): string;
 export declare function pathExists(path: string): Promise<boolean>;
 export declare function copyDirectoryAtomically(sourcePath: string, targetPath: string): Promise<void>;
 export declare function touchDirectory(path: string): Promise<void>;
-export declare function resolveLocalBackendTemplateRootPath(cacheDirectory: string, backendCacheName: string, templateKey: string): string;
-export declare function resolveLocalBackendTemplatesDirectory(cacheDirectory: string, backendCacheName: string): string;
-export declare function resolveLocalBackendSessionRootPath(cacheDirectory: string, backendCacheName: string, sessionKey: string): string;
+export declare function resolveLocalProviderTemplateRootPath(cacheDirectory: string, providerCacheName: string, templateKey: string): string;
+export declare function resolveLocalProviderTemplatesDirectory(cacheDirectory: string, providerCacheName: string): string;
+export declare function resolveLocalProviderSessionRootPath(cacheDirectory: string, providerCacheName: string, sessionKey: string): string;
 export declare function writeSandboxSeedFiles(session: SandboxSession, seedFiles: ReadonlyArray<SandboxSeedFile>): Promise<void>;

package/dist/src/execution/sandbox/bindings/local-provider-utils.js

@@ -0,0 +1 @@
+import{randomUUID}from"node:crypto";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{dirname,join}from"node:path";import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";function createFileBackedInternalSandboxSession(e){return{resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(e,t){let n=`${t}.${randomUUID()}.tmp`;await rm(n,{force:!0,recursive:!0}),await mkdir(dirname(t),{recursive:!0});try{await cp(e,n,{recursive:!0}),await rename(n,t)}catch(e){if(await rm(n,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(t))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalProviderTemplateRootPath(e,t,n){return join(resolveLocalProviderTemplatesDirectory(e,t),n)}function resolveLocalProviderTemplatesDirectory(e,t){return join(e,t,`templates`)}function resolveLocalProviderSessionRootPath(e,t,n){return join(e,t,`sessions`,n)}async function writeSandboxSeedFiles(e,t){for(let n of t){let t=await resolveSandboxModelPath({path:n.path,sandbox:e});typeof n.content==`string`?await e.writeTextFile({content:n.content,path:t}):await e.writeBinaryFile({content:n.content,path:t})}}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};

package/dist/src/execution/sandbox/bindings/local.d.ts

@@ -1,7 +1,7 @@
-export { createDockerSandboxBackend, DOCKER_BACKEND_NAME, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker.js";
+export { createDockerSandboxProvider, DOCKER_PROVIDER_NAME, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker.js";
 export { isLinuxDockerDaemonAvailableSync } from "#execution/sandbox/bindings/docker-cli.js";
-export { createJustBashSandboxBackend, JUST_BASH_BACKEND_NAME, pruneJustBashSandboxTemplates, } from "#execution/sandbox/bindings/just-bash.js";
-export { createMicrosandboxSandboxBackend, MICROSANDBOX_BACKEND_NAME, pruneMicrosandboxTemplates, } from "#execution/sandbox/bindings/microsandbox.js";
+export { createJustBashSandboxProvider, JUST_BASH_PROVIDER_NAME, pruneJustBashSandboxTemplates, } from "#execution/sandbox/bindings/just-bash.js";
+export { createMicrosandboxSandboxProvider, MICROSANDBOX_PROVIDER_NAME, pruneMicrosandboxTemplates, } from "#execution/sandbox/bindings/microsandbox.js";
 export { isMicrosandboxPlatformSupported } from "#execution/sandbox/bindings/microsandbox-platform.js";
 export { stopDevelopmentSandboxResources } from "#execution/sandbox/development-cleanup.js";
 /**

package/dist/src/execution/sandbox/bindings/local.js

@@ -1 +1 @@
-import{DockerDaemonUnavailableError,DockerUnavailableError,isLinuxDockerDaemonAvailableSync}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_BACKEND_NAME,createDockerSandboxBackend,pruneDockerSandboxTemplates,pruneDockerSandboxTemplates as pruneDockerSandboxTemplates$1}from"#execution/sandbox/bindings/docker.js";import{JUST_BASH_BACKEND_NAME,createJustBashSandboxBackend,pruneJustBashSandboxTemplates,pruneJustBashSandboxTemplates as pruneJustBashSandboxTemplates$1}from"#execution/sandbox/bindings/just-bash.js";import{MICROSANDBOX_BACKEND_NAME,createMicrosandboxSandboxBackend,pruneMicrosandboxTemplates,pruneMicrosandboxTemplates as pruneMicrosandboxTemplates$1}from"#execution/sandbox/bindings/microsandbox.js";import{isMicrosandboxPlatformSupported}from"#execution/sandbox/bindings/microsandbox-platform.js";import{stopDevelopmentSandboxResources}from"#execution/sandbox/development-cleanup.js";async function pruneLocalSandboxTemplates(e){await Promise.all([pruneJustBashSandboxTemplates$1(e),pruneMicrosandboxTemplates$1(e),pruneDockerSandboxTemplates$1(e).catch(e=>{if(!(e instanceof DockerUnavailableError||e instanceof DockerDaemonUnavailableError))throw e})])}function pruneLocalSandboxTemplatesInBackground(e){pruneLocalSandboxTemplates({appRoot:e}).catch(e=>{console.warn(`[eve:dev] failed to prune stale local sandbox templates: ${errorMessage(e)}`)})}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{DOCKER_BACKEND_NAME,JUST_BASH_BACKEND_NAME,MICROSANDBOX_BACKEND_NAME,createDockerSandboxBackend,createJustBashSandboxBackend,createMicrosandboxSandboxBackend,isLinuxDockerDaemonAvailableSync,isMicrosandboxPlatformSupported,pruneDockerSandboxTemplates,pruneJustBashSandboxTemplates,pruneLocalSandboxTemplates,pruneLocalSandboxTemplatesInBackground,pruneMicrosandboxTemplates,stopDevelopmentSandboxResources};
+import{DockerDaemonUnavailableError,DockerUnavailableError,isLinuxDockerDaemonAvailableSync}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_PROVIDER_NAME,createDockerSandboxProvider,pruneDockerSandboxTemplates,pruneDockerSandboxTemplates as pruneDockerSandboxTemplates$1}from"#execution/sandbox/bindings/docker.js";import{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates,pruneJustBashSandboxTemplates as pruneJustBashSandboxTemplates$1}from"#execution/sandbox/bindings/just-bash.js";import{MICROSANDBOX_PROVIDER_NAME,createMicrosandboxSandboxProvider,pruneMicrosandboxTemplates,pruneMicrosandboxTemplates as pruneMicrosandboxTemplates$1}from"#execution/sandbox/bindings/microsandbox.js";import{isMicrosandboxPlatformSupported}from"#execution/sandbox/bindings/microsandbox-platform.js";import{stopDevelopmentSandboxResources}from"#execution/sandbox/development-cleanup.js";async function pruneLocalSandboxTemplates(e){await Promise.all([pruneJustBashSandboxTemplates$1(e),pruneMicrosandboxTemplates$1(e),pruneDockerSandboxTemplates$1(e).catch(e=>{if(!(e instanceof DockerUnavailableError||e instanceof DockerDaemonUnavailableError))throw e})])}function pruneLocalSandboxTemplatesInBackground(e){pruneLocalSandboxTemplates({appRoot:e}).catch(e=>{console.warn(`[eve:sandbox] failed to prune stale local templates: ${errorMessage(e)}`)})}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{DOCKER_PROVIDER_NAME,JUST_BASH_PROVIDER_NAME,MICROSANDBOX_PROVIDER_NAME,createDockerSandboxProvider,createJustBashSandboxProvider,createMicrosandboxSandboxProvider,isLinuxDockerDaemonAvailableSync,isMicrosandboxPlatformSupported,pruneDockerSandboxTemplates,pruneJustBashSandboxTemplates,pruneLocalSandboxTemplates,pruneLocalSandboxTemplatesInBackground,pruneMicrosandboxTemplates,stopDevelopmentSandboxResources};

package/dist/src/execution/sandbox/bindings/microsandbox-create.js

@@ -1 +1 @@
-import{toErrorMessage}from"#shared/errors.js";async function createMicrosandboxWithProgress(e){let t={phase:`resolving the image`};try{let n=await e.builder.createWithPullProgress(),r=reportMicrosandboxCreateProgress(n,t,e.log);try{return await withHeartbeat(t,e.log,async()=>await n.awaitSandbox())}finally{await r.catch(()=>{})}}catch(n){throw enrichMicrosandboxError({context:`Failed to create microsandbox VM from ${e.source} while ${t.phase}`,error:n,errorType:e.errorType})}}function enrichMicrosandboxError(e){if(e.error instanceof MicrosandboxDiagnosticError)return e.error;let t=readMicrosandboxErrorCode(e.error,e.errorType),n=t===void 0?``:` [${t}]`,r=toErrorMessage(e.error),i=/[.!?]$/u.test(r)?r:`${r}.`;return new MicrosandboxDiagnosticError(`${e.context}${n}: ${i}`,{cause:e.error,hint:microsandboxErrorHint(t)})}var MicrosandboxDiagnosticError=class extends Error{hint;constructor(e,t){super(e,t),this.name=`MicrosandboxDiagnosticError`,t?.hint!==void 0&&(this.hint=t.hint)}};async function reportMicrosandboxCreateProgress(e,t,n){for await(let r of e){let e=microsandboxCreatePhase(r,t.phase);e!==t.phase&&(t.phase=e,n?.(e))}}function microsandboxCreatePhase(e,t){switch(e.kind){case`resolving`:case`resolved`:return`resolving the image`;case`layerDownloadProgress`:case`layerDownloadComplete`:case`layerDownloadVerifying`:case`layerMaterializeStarted`:case`layerMaterializeProgress`:case`layerMaterializeWriting`:case`layerMaterializeComplete`:return`downloading and materializing image layers`;case`stitchMergingTrees`:case`stitchWritingFsmeta`:case`stitchWritingVmdk`:case`stitchComplete`:return`assembling the image filesystem`;case`complete`:return`image ready; booting microsandbox VM`;default:return t}}async function withHeartbeat(e,t,n){if(t?.(e.phase),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{let n=Math.round((Date.now()-r)/1e3);t(`${e.phase} (${n}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}const MICROSANDBOX_ERROR_HINTS={database:`Check that the microsandbox npm package and installed VM runtime use the same version. If versions changed, use a clean MSB_HOME or migrate the existing database.`,imageNotFound:`Check that the image exists and that the registry credentials can pull it.`,libkrunfwNotFound:"Run `npx microsandbox install` and verify that MSB_PATH points to the installed runtime."};function readMicrosandboxErrorCode(e,t){if(t!==void 0&&e instanceof t||e instanceof Error&&`code`in e&&typeof e.code==`string`&&Object.hasOwn(MICROSANDBOX_ERROR_HINTS,e.code))return e.code}function microsandboxErrorHint(e){return e===void 0?void 0:MICROSANDBOX_ERROR_HINTS[e]}export{createMicrosandboxWithProgress,enrichMicrosandboxError};
+import{toErrorMessage}from"#shared/errors.js";async function createMicrosandboxWithProgress(e){let t={phase:`resolving the image`};try{let n=await e.builder.createWithPullProgress(),r=reportMicrosandboxCreateProgress(n,t,e.log);try{return await withHeartbeat(t,e.log,async()=>await n.awaitSandbox())}finally{await r.catch(()=>{})}}catch(n){throw enrichMicrosandboxError({context:`Failed to create microsandbox VM from ${e.source} while ${t.phase}`,error:n,errorType:e.errorType})}}function enrichMicrosandboxError(e){if(e.error instanceof MicrosandboxDiagnosticError)return e.error;let t=readMicrosandboxErrorCode(e.error,e.errorType),n=t===void 0?``:` [${t}]`,r=toErrorMessage(e.error),i=/[.!?]$/u.test(r)?r:`${r}.`;return new MicrosandboxDiagnosticError(`${e.context}${n}: ${i}`,{cause:e.error,hint:microsandboxErrorHint(t)})}var MicrosandboxDiagnosticError=class extends Error{hint;constructor(e,t){super(e,t),this.name=`MicrosandboxDiagnosticError`,t?.hint!==void 0&&(this.hint=t.hint)}};async function reportMicrosandboxCreateProgress(e,t,n){for await(let r of e){let e=microsandboxCreatePhase(r,t.phase);e!==t.phase&&(t.phase=e,n?.(e))}}function microsandboxCreatePhase(e,t){switch(e.kind){case`resolving`:case`resolved`:return`resolving the image`;case`layerDownloadProgress`:case`layerDownloadComplete`:case`layerDownloadVerifying`:case`layerMaterializeStarted`:case`layerMaterializeProgress`:case`layerMaterializeWriting`:case`layerMaterializeComplete`:return`downloading and materializing image layers`;case`stitchMergingTrees`:case`stitchWritingFsmeta`:case`stitchWritingVmdk`:case`stitchComplete`:return`assembling the image filesystem`;case`complete`:return`image ready; booting microsandbox VM`;default:return t}}async function withHeartbeat(e,t,n){if(t?.(e.phase),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{let n=Math.round((Date.now()-r)/1e3);t(`${e.phase} (${n}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}const MICROSANDBOX_ERROR_HINTS={database:`Check that the microsandbox npm package and installed VM runtime use the same version. If versions changed, use a clean MSB_HOME or migrate the existing database.`,imageNotFound:`Check that the image exists and that the registry credentials can pull it.`,libkrunfwNotFound:"Run `npx microsandbox install` and verify that MSB_PATH points to the installed runtime."};function readMicrosandboxErrorCode(e,t){if(t!==void 0&&e instanceof t||e instanceof Error&&`code`in e&&typeof e.code==`string`&&isMicrosandboxErrorCodeWithHint(e.code))return e.code}function isMicrosandboxErrorCodeWithHint(e){return e===`database`||e===`imageNotFound`||e===`libkrunfwNotFound`}function microsandboxErrorHint(e){return e===void 0?void 0:MICROSANDBOX_ERROR_HINTS[e]}export{createMicrosandboxWithProgress,enrichMicrosandboxError};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.d.ts

@@ -1,16 +1,38 @@
+import { MICROSANDBOX_METADATA_VERSION } from "#execution/sandbox/bindings/microsandbox-metadata.js";
 import type { ResolvedMicrosandboxOptions } from "#execution/sandbox/bindings/microsandbox-options.js";
-import type { SandboxBackendCreateInput, SandboxBackendHandle, SandboxBackendPrewarmInput, SandboxBackendPrewarmResult } from "#public/definitions/sandbox-backend.js";
-import type { MicrosandboxBootstrapUseOptions, MicrosandboxSessionUseOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import type { MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import { type SandboxProviderSessionContext, type SandboxProviderHandle, type SandboxProviderPrepareContext } from "#shared/sandbox-provider.js";
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+export type MicrosandboxPreparedArtifact = {
+    readonly image: string | null;
+    readonly optionsHash: string;
+    readonly snapshotName: string;
+    readonly version: typeof MICROSANDBOX_METADATA_VERSION;
+};
 export declare function prewarmMicrosandboxTemplate(input: {
-    readonly backendName: string;
+    readonly providerName: string;
     readonly options: ResolvedMicrosandboxOptions;
     readonly optionsHash: string;
-    readonly prewarmInput: SandboxBackendPrewarmInput<MicrosandboxBootstrapUseOptions>;
-}): Promise<SandboxBackendPrewarmResult>;
+    readonly context: SandboxProviderPrepareContext;
+    readonly dockerfile?: import("#execution/sandbox/dockerfile.js").SandboxDockerfile;
+    readonly prepare?: (sandbox: import("#shared/sandbox-session.js").SandboxSession) => Promise<void> | void;
+    readonly templateKey: string;
+}): Promise<MicrosandboxPreparedArtifact>;
 export declare function createMicrosandboxHandle(input: {
-    readonly backendName: string;
-    readonly createInput: SandboxBackendCreateInput;
+    readonly artifact: MicrosandboxPreparedArtifact;
+    readonly context: SandboxProviderSessionContext;
+    readonly createIfMissing?: boolean;
     readonly options: ResolvedMicrosandboxOptions;
     readonly optionsHash: string;
-}): Promise<SandboxBackendHandle<MicrosandboxSessionUseOptions>>;
+    readonly providerName: string;
+    readonly runtimeOptions?: MicrosandboxSandboxRuntimeOptions;
+    readonly sessionIdentity?: string;
+}): Promise<{
+    readonly handle: SandboxProviderHandle<MutableNetworkSandboxSession>;
+    readonly state: {
+        readonly optionsHash: string;
+        readonly sessionIdentity: string;
+        readonly version: 3;
+    };
+}>;
 export declare function clearActiveMicrosandboxSessionHandlesForTest(): void;

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.prewarmInput.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({appRoot:e.prewarmInput.runtimeContext.appRoot,log:e.prewarmInput.log,options:e.options}),n=resolveSandboxCacheDirectory(e.prewarmInput.runtimeContext.appRoot),r=resolveMicrosandboxTemplateRootPath(n,e.prewarmInput.templateKey),i=resolveMicrosandboxMetadataPath(r);e.prewarmInput.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(r),{reused:!0};let o=createProviderName(`eve-sbx-tpl`,e.prewarmInput.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0}),e.prewarmInput.log?.(`creating template VM from image "${e.options.image}"`);let l=await createPreparedMicrosandbox({log:e.prewarmInput.log,module:t,name:c,networkPolicy:e.options.networkPolicy,options:e.options,sessionKey:e.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),u=buildSandboxSession(createMicrosandboxInternalSession(l),async e=>{await l.setNetworkPolicy(e)});try{e.prewarmInput.seedFiles.length>0&&e.prewarmInput.log?.(`writing ${e.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(u,e.prewarmInput.seedFiles),e.prewarmInput.bootstrap!==void 0&&(e.prewarmInput.log?.(`running sandbox bootstrap`),await e.prewarmInput.bootstrap({use:async t=>(t?.networkPolicy!==void 0&&await l.setNetworkPolicy(t.networkPolicy),createLoggingSandboxSession({log:e.prewarmInput.log,session:u}))})),e.prewarmInput.log?.(`snapshotting template VM`),await l.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r))return{reused:!0};throw e}}finally{await l.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(e){let t=await loadMicrosandboxModule({appRoot:e.createInput.runtimeContext.appRoot,options:e.options}),n=resolveSandboxCacheDirectory(e.createInput.runtimeContext.appRoot),r=resolveMicrosandboxSessionRootPath(n,e.createInput.sessionKey),i=createActiveMicrosandboxSessionKey(r,e.optionsHash),a=activeMicrosandboxSessionHandles.get(i);if(a!==void 0)return a;let o=resolveMicrosandboxMetadataPath(r),s=readSessionMetadataRecord(e.createInput.existingMetadata)??await readSessionMetadata(o),c=withDevelopmentSandboxMetadataPathTag(e.createInput.tags,o);if(s?.optionsHash===e.optionsHash&&(await sandboxExists(t,s.sandboxName)||s.stateSnapshotName!==void 0&&await snapshotExists(t,s.stateSnapshotName))){let n=await connectMicrosandbox({metadata:s,metadataPath:o,module:t,options:e.options,sessionKey:e.createInput.sessionKey,tags:c});if(n!==null)return cacheHandle(i,createHandle(n,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(i)}))}let l=null;if(e.createInput.templateKey!==null){let r=resolveMicrosandboxTemplateRootPath(n,e.createInput.templateKey),i=await readTemplateMetadata(resolveMicrosandboxMetadataPath(r));if(i===null||i.optionsHash!==e.optionsHash||!await snapshotExists(t,i.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey});l=i.snapshotName}let u=createProviderName(`eve-sbx-ses`,`${e.createInput.sessionKey}:${randomUUID()}`),d;try{d=await createPreparedMicrosandbox({fromSnapshot:l??void 0,module:t,name:u,networkPolicy:e.options.networkPolicy,options:e.options,sessionKey:e.createInput.sessionKey,setupBaseRuntime:l===null,tags:c})}catch(t){throw l!==null&&e.createInput.templateKey!==null&&isMicrosandboxNotFoundError(t)?new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey}):t}return await d.writeMetadata(o,e.optionsHash),cacheHandle(i,createHandle(d,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(i)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async delete(){await e.shutdown(),await e.removePersisted(),r?.()},async stop(){await e.stop(),r?.()},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};
+import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{createFileBackedInternalSandboxSession,touchDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{buildSandboxDockerfile,dockerfileImageReference,publishDockerImageForMicrosandbox}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{isSandboxPreparedArtifactRecord}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.context.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({host:e.context.host,log:e.context.log,options:e.options}),n=e.context.storagePath,r=resolveMicrosandboxTemplateRootPath(n,e.templateKey),i=resolveMicrosandboxMetadataPath(r);e.context.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.context.log?.(`reusing cached snapshot`),await touchDirectory(r),microsandboxTemplateArtifact(a);let o=createProviderName(`eve-sbx-tpl`,e.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0});let l=e.options;if(e.dockerfile!==void 0){let t=createDockerCli();await assertDockerDaemonAvailable(t);let n=dockerfileImageReference({dockerfile:e.dockerfile,templateKey:e.templateKey});e.context.log?.(`building sandbox Dockerfile "${e.dockerfile.path}"`),await buildSandboxDockerfile({cli:t,dockerfile:e.dockerfile,imageReference:n}),e.context.log?.(`publishing Dockerfile image for microsandbox`);let r=await publishDockerImageForMicrosandbox({cli:t,imageReference:n});l={...e.options,image:r,pullPolicy:`always`}}let u=e.context.resources.source,d=u.kind===`materialized`?await prepareImmutableResources({storagePath:e.context.storagePath,provider:e.providerName,resourcesKey:u.key,sourcePath:u.path}):void 0;e.context.log?.(`creating template VM from image "${l.image}"`);let f=await createPreparedMicrosandbox({log:e.context.log,module:t,name:c,networkPolicy:`allow-all`,options:l,resourcesPath:d,sessionKey:e.templateKey,setupBaseRuntime:!0,tags:void 0}),p=buildSandboxSession(createMicrosandboxInternalSession(f),async e=>{await f.setNetworkPolicy(e)});try{await hydrateSandboxProviderResources({copySkills:!0,log:e.context.log,resources:e.context.resources,session:p}),e.prepare!==void 0&&(e.context.log?.(`running sandbox preparation`),await e.prepare(createLoggingSandboxSession({log:e.context.log,session:p}))),e.context.log?.(`snapshotting template VM`),await f.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r)){let e=await readTemplateMetadata(i);if(e!==null)return microsandboxTemplateArtifact(e)}throw e}}finally{await f.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return microsandboxTemplateArtifact({image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION})}async function createMicrosandboxHandle(e){let t=requirePreparedMicrosandboxTemplate(e.artifact,e.providerName),n=e.sessionIdentity??createStableHash(`${e.context.session.id}:${t.snapshotName}:${e.optionsHash}`).slice(0,32),r=resolveMicrosandboxSessionRootPath(e.context.storagePath,n),i=resolveMicrosandboxMetadataPath(r),a=await readSessionMetadata(i),o=resolveMicrosandboxImage(a,t,e.options),s={...e.options,...o,networkPolicy:e.runtimeOptions?.networkPolicy},c=await loadMicrosandboxModule({host:e.context.host,options:s}),l=createActiveMicrosandboxSessionKey(r,e.optionsHash),u=activeMicrosandboxSessionHandles.get(l),d={optionsHash:e.optionsHash,sessionIdentity:n,version:3};if(u!==void 0)return{handle:u,state:d};let f=withDevelopmentSandboxMetadataPathTag({sessionId:e.context.session.id},i);if(a?.optionsHash===e.optionsHash&&(await sandboxExists(c,a.sandboxName)||a.stateSnapshotName!==void 0&&await snapshotExists(c,a.stateSnapshotName))){let t=await connectMicrosandbox({metadata:a,metadataPath:i,module:c,options:s,sessionKey:e.context.session.id,tags:f});if(t!==null)return{handle:cacheHandle(l,createHandle(t,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}if(e.sessionIdentity!==void 0&&e.createIfMissing===!1)throw Error(`microsandbox session "${e.sessionIdentity}" is no longer available to resume.`);if(t.optionsHash!==e.optionsHash||!await snapshotExists(c,t.snapshotName))throw new SandboxTemplateNotProvisionedError({providerName:e.providerName,templateKey:t.snapshotName});let p=createProviderName(`eve-sbx-ses`,n),m=await createPreparedMicrosandbox({fromSnapshot:t.snapshotName,module:c,name:p,networkPolicy:s.networkPolicy,options:s,sessionKey:e.context.session.id,setupBaseRuntime:!1,tags:f});return await m.writeMetadata(i,e.optionsHash),{handle:cacheHandle(l,createHandle(m,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}function resolveMicrosandboxImage(e,t,n){return e?.image===void 0?t?.image===void 0?{image:n.image,pullPolicy:n.pullPolicy}:{image:t.image,pullPolicy:`always`}:{image:e.image,pullPolicy:`always`}}function microsandboxTemplateArtifact(e){return{image:e.image??null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:e.version}}function requirePreparedMicrosandboxTemplate(e,t){if(!isSandboxPreparedArtifactRecord(e)||e.version!==MICROSANDBOX_METADATA_VERSION||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw new SandboxTemplateNotProvisionedError({providerName:t,templateKey:`invalid-artifact`});return{image:typeof e.image==`string`?e.image:void 0,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:MICROSANDBOX_METADATA_VERSION}}function createHandle(e,t,n){return{sandbox:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),async onSessionDelete(){await e.shutdown(),await e.removePersisted(),n?.()},async onSessionStop(){await e.stop(),n?.()},async onRuntimeShutdown(){n?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};

package/dist/src/execution/sandbox/bindings/microsandbox-metadata.d.ts

@@ -1,18 +1,26 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import { type SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 export declare const MICROSANDBOX_METADATA_VERSION = 2;
 export declare const MICROSANDBOX_METADATA_FILE_NAME = "metadata.json";
 export interface MicrosandboxTemplateMetadata {
+    readonly image?: string;
     readonly optionsHash: string;
     readonly snapshotName: string;
     readonly version: typeof MICROSANDBOX_METADATA_VERSION;
 }
 export interface MicrosandboxSessionMetadata {
+    readonly image?: string;
     readonly networkPolicy?: SandboxNetworkPolicy;
     readonly optionsHash: string;
     readonly sandboxName: string;
     readonly stateSnapshotName?: string;
     readonly version: typeof MICROSANDBOX_METADATA_VERSION;
 }
+export declare function createMicrosandboxSessionMetadata(input: {
+    readonly networkPolicy: SandboxNetworkPolicy | undefined;
+    readonly optionsHash: string;
+    readonly sandboxName: string;
+    readonly stateSnapshotName: string | undefined;
+}): MicrosandboxSessionMetadata;
 export declare function resolveMicrosandboxMetadataPath(rootPath: string): string;
 export declare function readTemplateMetadata(path: string): Promise<MicrosandboxTemplateMetadata | null>;
 export declare function writeTemplateMetadata(path: string, metadata: MicrosandboxTemplateMetadata): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-metadata.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,readFile,rename,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";const MICROSANDBOX_METADATA_VERSION=2,MICROSANDBOX_METADATA_FILE_NAME=`metadata.json`;function resolveMicrosandboxMetadataPath(e){return join(e,MICROSANDBOX_METADATA_FILE_NAME)}async function readTemplateMetadata(e){let t=await readJsonFile(e);return t?.version!==2||typeof t.optionsHash!=`string`||typeof t.snapshotName!=`string`?null:{optionsHash:t.optionsHash,snapshotName:t.snapshotName,version:2}}async function writeTemplateMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readSessionMetadata(e){return readSessionMetadataRecord(await readJsonFile(e))}function readSessionMetadataRecord(e){return!isRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.sandboxName!=`string`?null:{networkPolicy:e.networkPolicy,optionsHash:e.optionsHash,sandboxName:e.sandboxName,stateSnapshotName:typeof e.stateSnapshotName==`string`?e.stateSnapshotName:void 0,version:2}}async function writeSessionMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readJsonFile(e){try{let t=JSON.parse(await readFile(e,`utf8`));return isRecord(t)?t:null}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}async function writeJsonFileAtomically(e,t){let n=`${e}.${randomUUID()}.tmp`;await mkdir(dirname(e),{recursive:!0}),await writeFile(n,`${JSON.stringify(t,null,2)}\n`),await rename(n,e)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{MICROSANDBOX_METADATA_FILE_NAME,MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeSessionMetadata,writeTemplateMetadata};
+import{randomUUID}from"node:crypto";import{mkdir,readFile,rename,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";import{isSandboxNetworkPolicy}from"#shared/sandbox-network-policy.js";const MICROSANDBOX_METADATA_VERSION=2,MICROSANDBOX_METADATA_FILE_NAME=`metadata.json`;function createMicrosandboxSessionMetadata(e){let t={optionsHash:e.optionsHash,sandboxName:e.sandboxName,version:2};return e.networkPolicy!==void 0&&(t.networkPolicy=e.networkPolicy),e.stateSnapshotName!==void 0&&(t.stateSnapshotName=e.stateSnapshotName),t}function resolveMicrosandboxMetadataPath(e){return join(e,MICROSANDBOX_METADATA_FILE_NAME)}async function readTemplateMetadata(e){let t=await readJsonFile(e);return t?.version!==2||typeof t.optionsHash!=`string`||typeof t.snapshotName!=`string`?null:{image:typeof t.image==`string`?t.image:void 0,optionsHash:t.optionsHash,snapshotName:t.snapshotName,version:2}}async function writeTemplateMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readSessionMetadata(e){return readSessionMetadataRecord(await readJsonFile(e))}function readSessionMetadataRecord(e){return!isRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.sandboxName!=`string`||e.networkPolicy!==void 0&&!isSandboxNetworkPolicy(e.networkPolicy)?null:{image:typeof e.image==`string`?e.image:void 0,networkPolicy:e.networkPolicy,optionsHash:e.optionsHash,sandboxName:e.sandboxName,stateSnapshotName:typeof e.stateSnapshotName==`string`?e.stateSnapshotName:void 0,version:2}}async function writeSessionMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readJsonFile(e){try{let t=JSON.parse(await readFile(e,`utf8`));return isRecord(t)?t:null}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}async function writeJsonFileAtomically(e,t){let n=`${e}.${randomUUID()}.tmp`;await mkdir(dirname(e),{recursive:!0}),await writeFile(n,`${JSON.stringify(t,null,2)}\n`),await rename(n,e)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{MICROSANDBOX_METADATA_FILE_NAME,MICROSANDBOX_METADATA_VERSION,createMicrosandboxSessionMetadata,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeSessionMetadata,writeTemplateMetadata};

package/dist/src/execution/sandbox/bindings/microsandbox-network.js

@@ -1 +1 @@
-import{createHash}from"node:crypto";function applyMicrosandboxNetwork(e,t){let n=createMicrosandboxNetworkPlan(t);return n.disabled?e.disableNetwork():n.policy===null&&n.transformHeaderRules.length===0?e:e.network(e=>{let t=e.enabled(!0);if(n.policy!==null&&(t=t.policyJson(serializeMicrosandboxNetworkPolicyJson(n.policy))),n.transformHeaderRules.length===0)return t;t=t.trustHostCAs(!0);for(let e of n.transformHeaderRules)for(let[n,r]of Object.entries(e.headers)){let i=e.placeholderHeaders[n];if(i===void 0)continue;let a=createSecretEnvName(e.domain,n,r);t=t.secret(t=>{let n=t.env(a).value(r).placeholder(i).injectHeaders(!0).injectBasicAuth(!0).injectQuery(!1).injectBody(!1).requireTlsIdentity(!0);return n=e.domain===`*`?n.allowAnyHostDangerous(!0):e.domain.startsWith(`*.`)?n.allowHostPattern(e.domain):n.allowHost(e.domain),n})}return t})}function serializeMicrosandboxNetworkPolicyJson(e){let t={default_egress:e.defaultEgress,default_ingress:e.defaultIngress,rules:e.rules.map(e=>({action:e.action,destination:serializeMicrosandboxNetworkDestination(e.destination),direction:e.direction,ports:e.ports,protocols:e.protocols}))};return JSON.stringify(t)}function createMicrosandboxNetworkPlan(e){if(e===void 0||e===`allow-all`)return{disabled:!1,policy:{defaultEgress:`allow`,defaultIngress:`deny`,rules:[]},transformHeaderRules:[]};if(e===`deny-all`)return{disabled:!0,policy:null,transformHeaderRules:[]};let t=[],n=[],r=normalizeAllowEntries(e.allow),i=r.some(e=>e.domain===`*`),a=i?`allow`:`deny`;for(let n of e.subnets?.deny??[])t.push({action:`deny`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});for(let n of e.subnets?.allow??[])t.push({action:`allow`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});i||t.push({action:`allow`,destination:{kind:`any`},direction:`egress`,ports:[{start:53,end:53}],protocols:[`udp`,`tcp`]});for(let e of r)if(e.domain!==`*`){t.push({action:`allow`,destination:domainToDestination(e.domain),direction:`egress`,ports:[],protocols:[]});for(let t of e.rules)for(let r of normalizeTransforms(t.transform))Object.keys(r.headers).length!==0&&n.push({domain:e.domain,headers:r.headers,match:t.match,placeholderHeaders:createPlaceholderHeaders(e.domain,r.headers)})}return{disabled:!1,policy:{defaultEgress:a,defaultIngress:`deny`,rules:t},transformHeaderRules:n}}function createTransformBrokerEnvironment(e){if(e.transformHeaderRules.length===0)return{};let t=e.transformHeaderRules.flatMap(e=>Object.entries(e.placeholderHeaders).filter(([e])=>e.toLowerCase()===`authorization`).flatMap(([t,n])=>e.domain===`*`||e.domain.startsWith(`*.`)?[]:[{key:`http.https://${e.domain}/.extraheader`,value:`${t}: ${n}`}])),n={};return t.length>0&&(n.GIT_CONFIG_COUNT=String(t.length),t.forEach((e,t)=>{n[`GIT_CONFIG_KEY_${t}`]=e.key,n[`GIT_CONFIG_VALUE_${t}`]=e.value})),n}function normalizeAllowEntries(e){return e===void 0?[]:Array.isArray(e)?e.map(e=>({domain:e,rules:[]})):Object.entries(e).map(([e,t])=>({domain:e,rules:Array.isArray(t)?t:[]}))}function normalizeTransforms(e){return e===void 0?[]:e.map(e=>({headers:e.headers??{}}))}function domainToDestination(e){return e.startsWith(`*.`)?{kind:`domainSuffix`,suffix:e.slice(2)}:{domain:e,kind:`domain`}}function serializeMicrosandboxNetworkDestination(e){switch(e.kind){case`any`:return`any`;case`cidr`:return{cidr:e.cidr??``};case`domain`:return{domain:e.domain??``};case`domainSuffix`:return{domain_suffix:e.suffix??``};case`group`:return{group:e.group??``};default:throw Error(`Unsupported microsandbox network destination kind.`)}}function createPlaceholderHeaders(e,t){let n={};for(let[r,i]of Object.entries(t))n[r]=`__EVE_MSB_SECRET_${createStableHash(`${e}:${r}:${i}`).slice(0,24)}__`;return n}function createSecretEnvName(e,t,n){return`EVE_MSB_SECRET_${createStableHash(`${e}:${t}:${n}`).slice(0,24).toUpperCase()}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}export{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment,serializeMicrosandboxNetworkPolicyJson};
+import{createHash}from"node:crypto";function applyMicrosandboxNetwork(e,t){let n=createMicrosandboxNetworkPlan(t);return n.disabled?e.disableNetwork():n.policy===null&&n.transformHeaderRules.length===0?e:e.network(e=>{let t=e.enabled(!0);if(n.policy!==null&&(t=t.policyJson(serializeMicrosandboxNetworkPolicyJson(n.policy))),n.transformHeaderRules.length===0)return t;t=t.trustHostCAs(!0);for(let e of n.transformHeaderRules)for(let[n,r]of Object.entries(e.headers)){let i=e.placeholderHeaders[n];if(i===void 0)continue;let a=createSecretEnvName(e.domain,n,r);t=t.secret(t=>{let n=t.env(a).value(r).placeholder(i).injectHeaders(!0).injectBasicAuth(!0).injectQuery(!1).injectBody(!1).requireTlsIdentity(!0);return n=e.domain===`*`?n.allowAnyHostDangerous(!0):e.domain.startsWith(`*.`)?n.allowHostPattern(e.domain):n.allowHost(e.domain),n})}return t})}function serializeMicrosandboxNetworkPolicyJson(e){let t={default_egress:e.defaultEgress,default_ingress:e.defaultIngress,rules:e.rules.map(e=>({action:e.action,destination:serializeMicrosandboxNetworkDestination(e.destination),direction:e.direction,ports:e.ports,protocols:e.protocols}))};return JSON.stringify(t)}function createMicrosandboxNetworkPlan(e){if(e===void 0||e===`allow-all`)return{disabled:!1,policy:{defaultEgress:`allow`,defaultIngress:`deny`,rules:[]},transformHeaderRules:[]};if(e===`deny-all`)return{disabled:!0,policy:null,transformHeaderRules:[]};let t=[],n=[],r=normalizeAllowEntries(e.allow),i=r.some(e=>e.domain===`*`),a=i?`allow`:`deny`;for(let n of e.subnets?.deny??[])t.push({action:`deny`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});for(let n of e.subnets?.allow??[])t.push({action:`allow`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});i||t.push({action:`allow`,destination:{kind:`any`},direction:`egress`,ports:[{start:53,end:53}],protocols:[`udp`,`tcp`]});for(let e of r)if(e.domain!==`*`){t.push({action:`allow`,destination:domainToDestination(e.domain),direction:`egress`,ports:[],protocols:[]});for(let t of e.rules)for(let r of normalizeTransforms(t.transform))Object.keys(r.headers).length!==0&&n.push({domain:e.domain,headers:r.headers,match:t.match,placeholderHeaders:createPlaceholderHeaders(e.domain,r.headers)})}return{disabled:!1,policy:{defaultEgress:a,defaultIngress:`deny`,rules:t},transformHeaderRules:n}}function createTransformBrokerEnvironment(e){if(e.transformHeaderRules.length===0)return{};let t=e.transformHeaderRules.flatMap(e=>Object.entries(e.placeholderHeaders).filter(([e])=>e.toLowerCase()===`authorization`).flatMap(([t,n])=>e.domain===`*`||e.domain.startsWith(`*.`)?[]:[{key:`http.https://${e.domain}/.extraheader`,value:`${t}: ${n}`}])),n={};return t.length>0&&(n.GIT_CONFIG_COUNT=String(t.length),t.forEach((e,t)=>{n[`GIT_CONFIG_KEY_${t}`]=e.key,n[`GIT_CONFIG_VALUE_${t}`]=e.value})),n}function normalizeAllowEntries(e){return e===void 0?[]:Array.isArray(e)?e.map(e=>({domain:e,rules:[]})):Object.entries(e).map(([e,t])=>({domain:e,rules:t}))}function normalizeTransforms(e){return e===void 0?[]:e.map(e=>({headers:e.headers??{}}))}function domainToDestination(e){return e.startsWith(`*.`)?{kind:`domainSuffix`,suffix:e.slice(2)}:{domain:e,kind:`domain`}}function serializeMicrosandboxNetworkDestination(e){switch(e.kind){case`any`:return`any`;case`cidr`:return{cidr:requireDestinationValue(e.cidr,`CIDR`)};case`domain`:return{domain:requireDestinationValue(e.domain,`domain`)};case`domainSuffix`:return{domain_suffix:requireDestinationValue(e.suffix,`domain suffix`)};case`group`:return{group:requireDestinationValue(e.group,`group`)};default:throw Error(`Unsupported microsandbox network destination kind.`)}}function requireDestinationValue(e,t){if(e===void 0||e.length===0)throw Error(`Microsandbox network destination is missing its ${t}.`);return e}function createPlaceholderHeaders(e,t){let n={};for(let[r,i]of Object.entries(t))n[r]=`__EVE_MSB_SECRET_${createStableHash(`${e}:${r}:${i}`).slice(0,24)}__`;return n}function createSecretEnvName(e,t,n){return`EVE_MSB_SECRET_${createStableHash(`${e}:${t}:${n}`).slice(0,24).toUpperCase()}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}export{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment,serializeMicrosandboxNetworkPolicyJson};

package/dist/src/execution/sandbox/bindings/microsandbox-options.d.ts

@@ -1,5 +1,4 @@
 import type { MicrosandboxSandboxCreateOptions } from "#public/sandbox/microsandbox-sandbox.js";
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 export declare const MICROSANDBOX_DEFAULT_IMAGE: string;
 export declare const MICROSANDBOX_DEFAULT_CPUS = 1;
 export declare const MICROSANDBOX_DEFAULT_MEMORY_MIB = 1024;
@@ -7,7 +6,7 @@ export declare const MICROSANDBOX_DEFAULT_PULL_POLICY = "if-missing";
 /** User every sandbox command runs as, mirroring hosted Vercel Sandbox. */
 export declare const MICROSANDBOX_USER = "vercel-sandbox";
 /**
- * Fully-defaulted microsandbox backend options consumed by the backend
+ * Fully-defaulted microsandbox options consumed by the provider
  * implementation.
  */
 export interface ResolvedMicrosandboxOptions {
@@ -15,7 +14,6 @@ export interface ResolvedMicrosandboxOptions {
     readonly env: Readonly<Record<string, string>>;
     readonly image: string;
     readonly memoryMiB: number;
-    readonly networkPolicy?: SandboxNetworkPolicy;
     readonly pullPolicy: "always" | "if-missing" | "never";
     readonly setup: {
         readonly autoInstall: boolean;
@@ -31,4 +29,12 @@ export declare function resolveMicrosandboxOptions(options: MicrosandboxSandboxC
  * compatibility hashing. Setup behavior intentionally stays out: how
  * the runtime got installed must not invalidate captured templates.
  */
-export declare function microsandboxOptionsForHash(options: ResolvedMicrosandboxOptions): Record<string, unknown>;
+interface MicrosandboxTemplateOptions {
+    readonly cpus: number;
+    readonly env: Readonly<Record<string, string>>;
+    readonly image: string;
+    readonly memoryMiB: number;
+    readonly pullPolicy: ResolvedMicrosandboxOptions["pullPolicy"];
+}
+export declare function microsandboxOptionsForHash(options: ResolvedMicrosandboxOptions): MicrosandboxTemplateOptions;
+export {};

package/dist/src/execution/sandbox/bindings/microsandbox-options.js

@@ -1 +1 @@
-import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_DEFAULT_CPUS=1,MICROSANDBOX_DEFAULT_MEMORY_MIB=1024,MICROSANDBOX_DEFAULT_PULL_POLICY=`if-missing`,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,networkPolicy:e?.networkPolicy,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_CPUS,MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_DEFAULT_MEMORY_MIB,MICROSANDBOX_DEFAULT_PULL_POLICY,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};
+import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_DEFAULT_CPUS=1,MICROSANDBOX_DEFAULT_MEMORY_MIB=1024,MICROSANDBOX_DEFAULT_PULL_POLICY=`if-missing`,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_CPUS,MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_DEFAULT_MEMORY_MIB,MICROSANDBOX_DEFAULT_PULL_POLICY,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};

package/dist/src/execution/sandbox/bindings/microsandbox-platform.js

@@ -1,4 +1,4 @@
-import{access}from"node:fs/promises";import{existsSync}from"node:fs";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";function isMicrosandboxPlatformSupported(){return process.platform===`darwin`&&process.arch===`arm64`?!0:process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)&&isGlibcLinux()?process.env.MSB_PATH!==void 0||existsSync(`/dev/kvm`):!1}function isGlibcLinux(){try{return typeof(process.report?.getReport())?.header?.glibcVersionRuntime==`string`}catch{return!1}}async function assertMicrosandboxPlatformCandidate(){if(process.platform!==`darwin`||process.arch!==`arm64`){if(process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)){if(!isGlibcLinux())throw Error(`The microsandbox sandbox backend requires a glibc-based Linux distribution; musl hosts are not supported. Use docker() or vercel() instead.`);if(process.env.MSB_PATH!==void 0||await doesPathExist(`/dev/kvm`))return;throw Error("The microsandbox sandbox backend requires Linux with KVM enabled. `/dev/kvm` is not available on this host. Enable KVM, set MSB_PATH for a custom runtime, or use docker() / vercel().")}throw Error(`The microsandbox sandbox backend supports Linux with KVM or macOS on Apple Silicon. Current host is ${process.platform}/${process.arch}. Use docker() or vercel() on this host.`)}}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function ensureMicrosandboxBaseRuntime(e,t={}){let n=await collectMicrosandboxBaseRuntimeOutput(await e.execStreamWith(`bash`,e=>e.args([`-lc`,MICROSANDBOX_BASE_SETUP_SCRIPT]).cwd(`/`).user(`root`)),t.log);if(n.exitCode!==0)throw Error(`Failed to initialize the microsandbox base runtime. ${n.stderr||n.stdout}`.trim())}async function collectMicrosandboxBaseRuntimeOutput(e,t){let n=new TextDecoder,r=new TextDecoder,i=``,a=``,o=``,s=``,c;for await(let l of e)if(l.kind===`stdout`){let e=n.decode(l.data,{stream:!0});i=appendOutput(i,e),o=emitMicrosandboxBaseRuntimeLogs(o+e,t)}else if(l.kind===`stderr`){let e=r.decode(l.data,{stream:!0});a=appendOutput(a,e),s=emitMicrosandboxBaseRuntimeLogs(s+e,t)}else if(l.kind===`exited`){c=l.code;break}let l=n.decode(),u=r.decode();if(l.length>0&&(i=appendOutput(i,l),o=emitMicrosandboxBaseRuntimeLogs(o+l,t)),u.length>0&&(a=appendOutput(a,u),s=emitMicrosandboxBaseRuntimeLogs(s+u,t)),emitMicrosandboxBaseRuntimeLogLine(o,t),emitMicrosandboxBaseRuntimeLogLine(s,t),c===void 0)throw Error(`Microsandbox base runtime setup ended without an exit event.`);return{exitCode:c,stderr:a,stdout:i}}function emitMicrosandboxBaseRuntimeLogs(e,t){let n=e.split(/\r?\n/u),r=n.pop()??``;for(let e of n)emitMicrosandboxBaseRuntimeLogLine(e,t);return r}function emitMicrosandboxBaseRuntimeLogLine(e,t){let n=e.match(/^eve-base-runtime: ?(.*)$/u)?.[1];n!==void 0&&n.length>0&&t?.(n)}function appendOutput(e,t){let n=e+t;return n.length>2e4?n.slice(-2e4):n}const MICROSANDBOX_BASE_SETUP_SCRIPT=`
+import{access}from"node:fs/promises";import{existsSync}from"node:fs";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";function isMicrosandboxPlatformSupported(){return process.platform===`darwin`&&process.arch===`arm64`?!0:process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)&&isGlibcLinux()?process.env.MSB_PATH!==void 0||existsSync(`/dev/kvm`):!1}function isGlibcLinux(){try{return typeof(process.report?.getReport())?.header?.glibcVersionRuntime==`string`}catch{return!1}}async function assertMicrosandboxPlatformCandidate(){if(process.platform!==`darwin`||process.arch!==`arm64`){if(process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)){if(!isGlibcLinux())throw Error(`The microsandbox sandbox provider requires a glibc-based Linux distribution; musl hosts are not supported. Use DockerSandbox or VercelSandbox instead.`);if(process.env.MSB_PATH!==void 0||await doesPathExist(`/dev/kvm`))return;throw Error("The microsandbox sandbox provider requires Linux with KVM enabled. `/dev/kvm` is not available on this host. Enable KVM, set MSB_PATH for a custom runtime, or use DockerSandbox or VercelSandbox.")}throw Error(`The microsandbox sandbox provider supports Linux with KVM or macOS on Apple Silicon. Current host is ${process.platform}/${process.arch}. Use DockerSandbox or VercelSandbox on this host.`)}}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function ensureMicrosandboxBaseRuntime(e,t={}){let n=await collectMicrosandboxBaseRuntimeOutput(await e.execStreamWith(`bash`,e=>e.args([`-lc`,MICROSANDBOX_BASE_SETUP_SCRIPT]).cwd(`/`).user(`root`)),t.log);if(n.exitCode!==0)throw Error(`Failed to initialize the microsandbox base runtime. ${n.stderr||n.stdout}`.trim())}async function collectMicrosandboxBaseRuntimeOutput(e,t){let n=new TextDecoder,r=new TextDecoder,i=``,a=``,o=``,s=``,c;for await(let l of e)if(l.kind===`stdout`){let e=n.decode(l.data,{stream:!0});i=appendOutput(i,e),o=emitMicrosandboxBaseRuntimeLogs(o+e,t)}else if(l.kind===`stderr`){let e=r.decode(l.data,{stream:!0});a=appendOutput(a,e),s=emitMicrosandboxBaseRuntimeLogs(s+e,t)}else if(l.kind===`exited`){c=l.code;break}let l=n.decode(),u=r.decode();if(l.length>0&&(i=appendOutput(i,l),o=emitMicrosandboxBaseRuntimeLogs(o+l,t)),u.length>0&&(a=appendOutput(a,u),s=emitMicrosandboxBaseRuntimeLogs(s+u,t)),emitMicrosandboxBaseRuntimeLogLine(o,t),emitMicrosandboxBaseRuntimeLogLine(s,t),c===void 0)throw Error(`Microsandbox base runtime setup ended without an exit event.`);return{exitCode:c,stderr:a,stdout:i}}function emitMicrosandboxBaseRuntimeLogs(e,t){let n=e.split(/\r?\n/u),r=n.pop()??``;for(let e of n)emitMicrosandboxBaseRuntimeLogLine(e,t);return r}function emitMicrosandboxBaseRuntimeLogLine(e,t){let n=e.match(/^eve-base-runtime: ?(.*)$/u)?.[1];n!==void 0&&n.length>0&&t?.(n)}function appendOutput(e,t){let n=e+t;return n.length>2e4?n.slice(-2e4):n}const MICROSANDBOX_BASE_SETUP_SCRIPT=`
 set -euo pipefail
 
 log_step() {