eve 0.63.0 → 0.64.0

package/dist/src/execution/sandbox/bindings/microsandbox-metadata.d.ts

@@ -1,18 +1,26 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import { type SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 export declare const MICROSANDBOX_METADATA_VERSION = 2;
 export declare const MICROSANDBOX_METADATA_FILE_NAME = "metadata.json";
 export interface MicrosandboxTemplateMetadata {
+    readonly image?: string;
     readonly optionsHash: string;
     readonly snapshotName: string;
     readonly version: typeof MICROSANDBOX_METADATA_VERSION;
 }
 export interface MicrosandboxSessionMetadata {
+    readonly image?: string;
     readonly networkPolicy?: SandboxNetworkPolicy;
     readonly optionsHash: string;
     readonly sandboxName: string;
     readonly stateSnapshotName?: string;
     readonly version: typeof MICROSANDBOX_METADATA_VERSION;
 }
+export declare function createMicrosandboxSessionMetadata(input: {
+    readonly networkPolicy: SandboxNetworkPolicy | undefined;
+    readonly optionsHash: string;
+    readonly sandboxName: string;
+    readonly stateSnapshotName: string | undefined;
+}): MicrosandboxSessionMetadata;
 export declare function resolveMicrosandboxMetadataPath(rootPath: string): string;
 export declare function readTemplateMetadata(path: string): Promise<MicrosandboxTemplateMetadata | null>;
 export declare function writeTemplateMetadata(path: string, metadata: MicrosandboxTemplateMetadata): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-metadata.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,readFile,rename,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";const MICROSANDBOX_METADATA_VERSION=2,MICROSANDBOX_METADATA_FILE_NAME=`metadata.json`;function resolveMicrosandboxMetadataPath(e){return join(e,MICROSANDBOX_METADATA_FILE_NAME)}async function readTemplateMetadata(e){let t=await readJsonFile(e);return t?.version!==2||typeof t.optionsHash!=`string`||typeof t.snapshotName!=`string`?null:{optionsHash:t.optionsHash,snapshotName:t.snapshotName,version:2}}async function writeTemplateMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readSessionMetadata(e){return readSessionMetadataRecord(await readJsonFile(e))}function readSessionMetadataRecord(e){return!isRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.sandboxName!=`string`?null:{networkPolicy:e.networkPolicy,optionsHash:e.optionsHash,sandboxName:e.sandboxName,stateSnapshotName:typeof e.stateSnapshotName==`string`?e.stateSnapshotName:void 0,version:2}}async function writeSessionMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readJsonFile(e){try{let t=JSON.parse(await readFile(e,`utf8`));return isRecord(t)?t:null}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}async function writeJsonFileAtomically(e,t){let n=`${e}.${randomUUID()}.tmp`;await mkdir(dirname(e),{recursive:!0}),await writeFile(n,`${JSON.stringify(t,null,2)}\n`),await rename(n,e)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{MICROSANDBOX_METADATA_FILE_NAME,MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeSessionMetadata,writeTemplateMetadata};
+import{randomUUID}from"node:crypto";import{mkdir,readFile,rename,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";import{isSandboxNetworkPolicy}from"#shared/sandbox-network-policy.js";const MICROSANDBOX_METADATA_VERSION=2,MICROSANDBOX_METADATA_FILE_NAME=`metadata.json`;function createMicrosandboxSessionMetadata(e){let t={optionsHash:e.optionsHash,sandboxName:e.sandboxName,version:2};return e.networkPolicy!==void 0&&(t.networkPolicy=e.networkPolicy),e.stateSnapshotName!==void 0&&(t.stateSnapshotName=e.stateSnapshotName),t}function resolveMicrosandboxMetadataPath(e){return join(e,MICROSANDBOX_METADATA_FILE_NAME)}async function readTemplateMetadata(e){let t=await readJsonFile(e);return t?.version!==2||typeof t.optionsHash!=`string`||typeof t.snapshotName!=`string`?null:{image:typeof t.image==`string`?t.image:void 0,optionsHash:t.optionsHash,snapshotName:t.snapshotName,version:2}}async function writeTemplateMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readSessionMetadata(e){return readSessionMetadataRecord(await readJsonFile(e))}function readSessionMetadataRecord(e){return!isRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.sandboxName!=`string`||e.networkPolicy!==void 0&&!isSandboxNetworkPolicy(e.networkPolicy)?null:{image:typeof e.image==`string`?e.image:void 0,networkPolicy:e.networkPolicy,optionsHash:e.optionsHash,sandboxName:e.sandboxName,stateSnapshotName:typeof e.stateSnapshotName==`string`?e.stateSnapshotName:void 0,version:2}}async function writeSessionMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readJsonFile(e){try{let t=JSON.parse(await readFile(e,`utf8`));return isRecord(t)?t:null}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}async function writeJsonFileAtomically(e,t){let n=`${e}.${randomUUID()}.tmp`;await mkdir(dirname(e),{recursive:!0}),await writeFile(n,`${JSON.stringify(t,null,2)}\n`),await rename(n,e)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{MICROSANDBOX_METADATA_FILE_NAME,MICROSANDBOX_METADATA_VERSION,createMicrosandboxSessionMetadata,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeSessionMetadata,writeTemplateMetadata};

package/dist/src/execution/sandbox/bindings/microsandbox-network.js

@@ -1 +1 @@
-import{createHash}from"node:crypto";function applyMicrosandboxNetwork(e,t){let n=createMicrosandboxNetworkPlan(t);return n.disabled?e.disableNetwork():n.policy===null&&n.transformHeaderRules.length===0?e:e.network(e=>{let t=e.enabled(!0);if(n.policy!==null&&(t=t.policyJson(serializeMicrosandboxNetworkPolicyJson(n.policy))),n.transformHeaderRules.length===0)return t;t=t.trustHostCAs(!0);for(let e of n.transformHeaderRules)for(let[n,r]of Object.entries(e.headers)){let i=e.placeholderHeaders[n];if(i===void 0)continue;let a=createSecretEnvName(e.domain,n,r);t=t.secret(t=>{let n=t.env(a).value(r).placeholder(i).injectHeaders(!0).injectBasicAuth(!0).injectQuery(!1).injectBody(!1).requireTlsIdentity(!0);return n=e.domain===`*`?n.allowAnyHostDangerous(!0):e.domain.startsWith(`*.`)?n.allowHostPattern(e.domain):n.allowHost(e.domain),n})}return t})}function serializeMicrosandboxNetworkPolicyJson(e){let t={default_egress:e.defaultEgress,default_ingress:e.defaultIngress,rules:e.rules.map(e=>({action:e.action,destination:serializeMicrosandboxNetworkDestination(e.destination),direction:e.direction,ports:e.ports,protocols:e.protocols}))};return JSON.stringify(t)}function createMicrosandboxNetworkPlan(e){if(e===void 0||e===`allow-all`)return{disabled:!1,policy:{defaultEgress:`allow`,defaultIngress:`deny`,rules:[]},transformHeaderRules:[]};if(e===`deny-all`)return{disabled:!0,policy:null,transformHeaderRules:[]};let t=[],n=[],r=normalizeAllowEntries(e.allow),i=r.some(e=>e.domain===`*`),a=i?`allow`:`deny`;for(let n of e.subnets?.deny??[])t.push({action:`deny`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});for(let n of e.subnets?.allow??[])t.push({action:`allow`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});i||t.push({action:`allow`,destination:{kind:`any`},direction:`egress`,ports:[{start:53,end:53}],protocols:[`udp`,`tcp`]});for(let e of r)if(e.domain!==`*`){t.push({action:`allow`,destination:domainToDestination(e.domain),direction:`egress`,ports:[],protocols:[]});for(let t of e.rules)for(let r of normalizeTransforms(t.transform))Object.keys(r.headers).length!==0&&n.push({domain:e.domain,headers:r.headers,match:t.match,placeholderHeaders:createPlaceholderHeaders(e.domain,r.headers)})}return{disabled:!1,policy:{defaultEgress:a,defaultIngress:`deny`,rules:t},transformHeaderRules:n}}function createTransformBrokerEnvironment(e){if(e.transformHeaderRules.length===0)return{};let t=e.transformHeaderRules.flatMap(e=>Object.entries(e.placeholderHeaders).filter(([e])=>e.toLowerCase()===`authorization`).flatMap(([t,n])=>e.domain===`*`||e.domain.startsWith(`*.`)?[]:[{key:`http.https://${e.domain}/.extraheader`,value:`${t}: ${n}`}])),n={};return t.length>0&&(n.GIT_CONFIG_COUNT=String(t.length),t.forEach((e,t)=>{n[`GIT_CONFIG_KEY_${t}`]=e.key,n[`GIT_CONFIG_VALUE_${t}`]=e.value})),n}function normalizeAllowEntries(e){return e===void 0?[]:Array.isArray(e)?e.map(e=>({domain:e,rules:[]})):Object.entries(e).map(([e,t])=>({domain:e,rules:Array.isArray(t)?t:[]}))}function normalizeTransforms(e){return e===void 0?[]:e.map(e=>({headers:e.headers??{}}))}function domainToDestination(e){return e.startsWith(`*.`)?{kind:`domainSuffix`,suffix:e.slice(2)}:{domain:e,kind:`domain`}}function serializeMicrosandboxNetworkDestination(e){switch(e.kind){case`any`:return`any`;case`cidr`:return{cidr:e.cidr??``};case`domain`:return{domain:e.domain??``};case`domainSuffix`:return{domain_suffix:e.suffix??``};case`group`:return{group:e.group??``};default:throw Error(`Unsupported microsandbox network destination kind.`)}}function createPlaceholderHeaders(e,t){let n={};for(let[r,i]of Object.entries(t))n[r]=`__EVE_MSB_SECRET_${createStableHash(`${e}:${r}:${i}`).slice(0,24)}__`;return n}function createSecretEnvName(e,t,n){return`EVE_MSB_SECRET_${createStableHash(`${e}:${t}:${n}`).slice(0,24).toUpperCase()}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}export{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment,serializeMicrosandboxNetworkPolicyJson};
+import{createHash}from"node:crypto";function applyMicrosandboxNetwork(e,t){let n=createMicrosandboxNetworkPlan(t);return n.disabled?e.disableNetwork():n.policy===null&&n.transformHeaderRules.length===0?e:e.network(e=>{let t=e.enabled(!0);if(n.policy!==null&&(t=t.policyJson(serializeMicrosandboxNetworkPolicyJson(n.policy))),n.transformHeaderRules.length===0)return t;t=t.trustHostCAs(!0);for(let e of n.transformHeaderRules)for(let[n,r]of Object.entries(e.headers)){let i=e.placeholderHeaders[n];if(i===void 0)continue;let a=createSecretEnvName(e.domain,n,r);t=t.secret(t=>{let n=t.env(a).value(r).placeholder(i).injectHeaders(!0).injectBasicAuth(!0).injectQuery(!1).injectBody(!1).requireTlsIdentity(!0);return n=e.domain===`*`?n.allowAnyHostDangerous(!0):e.domain.startsWith(`*.`)?n.allowHostPattern(e.domain):n.allowHost(e.domain),n})}return t})}function serializeMicrosandboxNetworkPolicyJson(e){let t={default_egress:e.defaultEgress,default_ingress:e.defaultIngress,rules:e.rules.map(e=>({action:e.action,destination:serializeMicrosandboxNetworkDestination(e.destination),direction:e.direction,ports:e.ports,protocols:e.protocols}))};return JSON.stringify(t)}function createMicrosandboxNetworkPlan(e){if(e===void 0||e===`allow-all`)return{disabled:!1,policy:{defaultEgress:`allow`,defaultIngress:`deny`,rules:[]},transformHeaderRules:[]};if(e===`deny-all`)return{disabled:!0,policy:null,transformHeaderRules:[]};let t=[],n=[],r=normalizeAllowEntries(e.allow),i=r.some(e=>e.domain===`*`),a=i?`allow`:`deny`;for(let n of e.subnets?.deny??[])t.push({action:`deny`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});for(let n of e.subnets?.allow??[])t.push({action:`allow`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});i||t.push({action:`allow`,destination:{kind:`any`},direction:`egress`,ports:[{start:53,end:53}],protocols:[`udp`,`tcp`]});for(let e of r)if(e.domain!==`*`){t.push({action:`allow`,destination:domainToDestination(e.domain),direction:`egress`,ports:[],protocols:[]});for(let t of e.rules)for(let r of normalizeTransforms(t.transform))Object.keys(r.headers).length!==0&&n.push({domain:e.domain,headers:r.headers,match:t.match,placeholderHeaders:createPlaceholderHeaders(e.domain,r.headers)})}return{disabled:!1,policy:{defaultEgress:a,defaultIngress:`deny`,rules:t},transformHeaderRules:n}}function createTransformBrokerEnvironment(e){if(e.transformHeaderRules.length===0)return{};let t=e.transformHeaderRules.flatMap(e=>Object.entries(e.placeholderHeaders).filter(([e])=>e.toLowerCase()===`authorization`).flatMap(([t,n])=>e.domain===`*`||e.domain.startsWith(`*.`)?[]:[{key:`http.https://${e.domain}/.extraheader`,value:`${t}: ${n}`}])),n={};return t.length>0&&(n.GIT_CONFIG_COUNT=String(t.length),t.forEach((e,t)=>{n[`GIT_CONFIG_KEY_${t}`]=e.key,n[`GIT_CONFIG_VALUE_${t}`]=e.value})),n}function normalizeAllowEntries(e){return e===void 0?[]:Array.isArray(e)?e.map(e=>({domain:e,rules:[]})):Object.entries(e).map(([e,t])=>({domain:e,rules:t}))}function normalizeTransforms(e){return e===void 0?[]:e.map(e=>({headers:e.headers??{}}))}function domainToDestination(e){return e.startsWith(`*.`)?{kind:`domainSuffix`,suffix:e.slice(2)}:{domain:e,kind:`domain`}}function serializeMicrosandboxNetworkDestination(e){switch(e.kind){case`any`:return`any`;case`cidr`:return{cidr:requireDestinationValue(e.cidr,`CIDR`)};case`domain`:return{domain:requireDestinationValue(e.domain,`domain`)};case`domainSuffix`:return{domain_suffix:requireDestinationValue(e.suffix,`domain suffix`)};case`group`:return{group:requireDestinationValue(e.group,`group`)};default:throw Error(`Unsupported microsandbox network destination kind.`)}}function requireDestinationValue(e,t){if(e===void 0||e.length===0)throw Error(`Microsandbox network destination is missing its ${t}.`);return e}function createPlaceholderHeaders(e,t){let n={};for(let[r,i]of Object.entries(t))n[r]=`__EVE_MSB_SECRET_${createStableHash(`${e}:${r}:${i}`).slice(0,24)}__`;return n}function createSecretEnvName(e,t,n){return`EVE_MSB_SECRET_${createStableHash(`${e}:${t}:${n}`).slice(0,24).toUpperCase()}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}export{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment,serializeMicrosandboxNetworkPolicyJson};

package/dist/src/execution/sandbox/bindings/microsandbox-options.d.ts

@@ -1,5 +1,4 @@
 import type { MicrosandboxSandboxCreateOptions } from "#public/sandbox/microsandbox-sandbox.js";
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 export declare const MICROSANDBOX_DEFAULT_IMAGE: string;
 export declare const MICROSANDBOX_DEFAULT_CPUS = 1;
 export declare const MICROSANDBOX_DEFAULT_MEMORY_MIB = 1024;
@@ -7,7 +6,7 @@ export declare const MICROSANDBOX_DEFAULT_PULL_POLICY = "if-missing";
 /** User every sandbox command runs as, mirroring hosted Vercel Sandbox. */
 export declare const MICROSANDBOX_USER = "vercel-sandbox";
 /**
- * Fully-defaulted microsandbox backend options consumed by the backend
+ * Fully-defaulted microsandbox options consumed by the provider
  * implementation.
  */
 export interface ResolvedMicrosandboxOptions {
@@ -15,7 +14,6 @@ export interface ResolvedMicrosandboxOptions {
     readonly env: Readonly<Record<string, string>>;
     readonly image: string;
     readonly memoryMiB: number;
-    readonly networkPolicy?: SandboxNetworkPolicy;
     readonly pullPolicy: "always" | "if-missing" | "never";
     readonly setup: {
         readonly autoInstall: boolean;
@@ -31,4 +29,12 @@ export declare function resolveMicrosandboxOptions(options: MicrosandboxSandboxC
  * compatibility hashing. Setup behavior intentionally stays out: how
  * the runtime got installed must not invalidate captured templates.
  */
-export declare function microsandboxOptionsForHash(options: ResolvedMicrosandboxOptions): Record<string, unknown>;
+interface MicrosandboxTemplateOptions {
+    readonly cpus: number;
+    readonly env: Readonly<Record<string, string>>;
+    readonly image: string;
+    readonly memoryMiB: number;
+    readonly pullPolicy: ResolvedMicrosandboxOptions["pullPolicy"];
+}
+export declare function microsandboxOptionsForHash(options: ResolvedMicrosandboxOptions): MicrosandboxTemplateOptions;
+export {};

package/dist/src/execution/sandbox/bindings/microsandbox-options.js

@@ -1 +1 @@
-import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_DEFAULT_CPUS=1,MICROSANDBOX_DEFAULT_MEMORY_MIB=1024,MICROSANDBOX_DEFAULT_PULL_POLICY=`if-missing`,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,networkPolicy:e?.networkPolicy,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_CPUS,MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_DEFAULT_MEMORY_MIB,MICROSANDBOX_DEFAULT_PULL_POLICY,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};
+import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_DEFAULT_CPUS=1,MICROSANDBOX_DEFAULT_MEMORY_MIB=1024,MICROSANDBOX_DEFAULT_PULL_POLICY=`if-missing`,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_CPUS,MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_DEFAULT_MEMORY_MIB,MICROSANDBOX_DEFAULT_PULL_POLICY,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};

package/dist/src/execution/sandbox/bindings/microsandbox-platform.js

@@ -1,4 +1,4 @@
-import{access}from"node:fs/promises";import{existsSync}from"node:fs";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";function isMicrosandboxPlatformSupported(){return process.platform===`darwin`&&process.arch===`arm64`?!0:process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)&&isGlibcLinux()?process.env.MSB_PATH!==void 0||existsSync(`/dev/kvm`):!1}function isGlibcLinux(){try{return typeof(process.report?.getReport())?.header?.glibcVersionRuntime==`string`}catch{return!1}}async function assertMicrosandboxPlatformCandidate(){if(process.platform!==`darwin`||process.arch!==`arm64`){if(process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)){if(!isGlibcLinux())throw Error(`The microsandbox sandbox backend requires a glibc-based Linux distribution; musl hosts are not supported. Use docker() or vercel() instead.`);if(process.env.MSB_PATH!==void 0||await doesPathExist(`/dev/kvm`))return;throw Error("The microsandbox sandbox backend requires Linux with KVM enabled. `/dev/kvm` is not available on this host. Enable KVM, set MSB_PATH for a custom runtime, or use docker() / vercel().")}throw Error(`The microsandbox sandbox backend supports Linux with KVM or macOS on Apple Silicon. Current host is ${process.platform}/${process.arch}. Use docker() or vercel() on this host.`)}}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function ensureMicrosandboxBaseRuntime(e,t={}){let n=await collectMicrosandboxBaseRuntimeOutput(await e.execStreamWith(`bash`,e=>e.args([`-lc`,MICROSANDBOX_BASE_SETUP_SCRIPT]).cwd(`/`).user(`root`)),t.log);if(n.exitCode!==0)throw Error(`Failed to initialize the microsandbox base runtime. ${n.stderr||n.stdout}`.trim())}async function collectMicrosandboxBaseRuntimeOutput(e,t){let n=new TextDecoder,r=new TextDecoder,i=``,a=``,o=``,s=``,c;for await(let l of e)if(l.kind===`stdout`){let e=n.decode(l.data,{stream:!0});i=appendOutput(i,e),o=emitMicrosandboxBaseRuntimeLogs(o+e,t)}else if(l.kind===`stderr`){let e=r.decode(l.data,{stream:!0});a=appendOutput(a,e),s=emitMicrosandboxBaseRuntimeLogs(s+e,t)}else if(l.kind===`exited`){c=l.code;break}let l=n.decode(),u=r.decode();if(l.length>0&&(i=appendOutput(i,l),o=emitMicrosandboxBaseRuntimeLogs(o+l,t)),u.length>0&&(a=appendOutput(a,u),s=emitMicrosandboxBaseRuntimeLogs(s+u,t)),emitMicrosandboxBaseRuntimeLogLine(o,t),emitMicrosandboxBaseRuntimeLogLine(s,t),c===void 0)throw Error(`Microsandbox base runtime setup ended without an exit event.`);return{exitCode:c,stderr:a,stdout:i}}function emitMicrosandboxBaseRuntimeLogs(e,t){let n=e.split(/\r?\n/u),r=n.pop()??``;for(let e of n)emitMicrosandboxBaseRuntimeLogLine(e,t);return r}function emitMicrosandboxBaseRuntimeLogLine(e,t){let n=e.match(/^eve-base-runtime: ?(.*)$/u)?.[1];n!==void 0&&n.length>0&&t?.(n)}function appendOutput(e,t){let n=e+t;return n.length>2e4?n.slice(-2e4):n}const MICROSANDBOX_BASE_SETUP_SCRIPT=`
+import{access}from"node:fs/promises";import{existsSync}from"node:fs";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";function isMicrosandboxPlatformSupported(){return process.platform===`darwin`&&process.arch===`arm64`?!0:process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)&&isGlibcLinux()?process.env.MSB_PATH!==void 0||existsSync(`/dev/kvm`):!1}function isGlibcLinux(){try{return typeof(process.report?.getReport())?.header?.glibcVersionRuntime==`string`}catch{return!1}}async function assertMicrosandboxPlatformCandidate(){if(process.platform!==`darwin`||process.arch!==`arm64`){if(process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)){if(!isGlibcLinux())throw Error(`The microsandbox sandbox provider requires a glibc-based Linux distribution; musl hosts are not supported. Use DockerSandbox or VercelSandbox instead.`);if(process.env.MSB_PATH!==void 0||await doesPathExist(`/dev/kvm`))return;throw Error("The microsandbox sandbox provider requires Linux with KVM enabled. `/dev/kvm` is not available on this host. Enable KVM, set MSB_PATH for a custom runtime, or use DockerSandbox or VercelSandbox.")}throw Error(`The microsandbox sandbox provider supports Linux with KVM or macOS on Apple Silicon. Current host is ${process.platform}/${process.arch}. Use DockerSandbox or VercelSandbox on this host.`)}}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function ensureMicrosandboxBaseRuntime(e,t={}){let n=await collectMicrosandboxBaseRuntimeOutput(await e.execStreamWith(`bash`,e=>e.args([`-lc`,MICROSANDBOX_BASE_SETUP_SCRIPT]).cwd(`/`).user(`root`)),t.log);if(n.exitCode!==0)throw Error(`Failed to initialize the microsandbox base runtime. ${n.stderr||n.stdout}`.trim())}async function collectMicrosandboxBaseRuntimeOutput(e,t){let n=new TextDecoder,r=new TextDecoder,i=``,a=``,o=``,s=``,c;for await(let l of e)if(l.kind===`stdout`){let e=n.decode(l.data,{stream:!0});i=appendOutput(i,e),o=emitMicrosandboxBaseRuntimeLogs(o+e,t)}else if(l.kind===`stderr`){let e=r.decode(l.data,{stream:!0});a=appendOutput(a,e),s=emitMicrosandboxBaseRuntimeLogs(s+e,t)}else if(l.kind===`exited`){c=l.code;break}let l=n.decode(),u=r.decode();if(l.length>0&&(i=appendOutput(i,l),o=emitMicrosandboxBaseRuntimeLogs(o+l,t)),u.length>0&&(a=appendOutput(a,u),s=emitMicrosandboxBaseRuntimeLogs(s+u,t)),emitMicrosandboxBaseRuntimeLogLine(o,t),emitMicrosandboxBaseRuntimeLogLine(s,t),c===void 0)throw Error(`Microsandbox base runtime setup ended without an exit event.`);return{exitCode:c,stderr:a,stdout:i}}function emitMicrosandboxBaseRuntimeLogs(e,t){let n=e.split(/\r?\n/u),r=n.pop()??``;for(let e of n)emitMicrosandboxBaseRuntimeLogLine(e,t);return r}function emitMicrosandboxBaseRuntimeLogLine(e,t){let n=e.match(/^eve-base-runtime: ?(.*)$/u)?.[1];n!==void 0&&n.length>0&&t?.(n)}function appendOutput(e,t){let n=e+t;return n.length>2e4?n.slice(-2e4):n}const MICROSANDBOX_BASE_SETUP_SCRIPT=`
 set -euo pipefail
 
 log_step() {

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.d.ts

@@ -1,7 +1,7 @@
 import { type ResolvedMicrosandboxOptions } from "#execution/sandbox/bindings/microsandbox-options.js";
 import { type MicrosandboxSessionMetadata } from "#execution/sandbox/bindings/microsandbox-metadata.js";
-import type { SandboxBackendTags } from "#public/definitions/sandbox-backend.js";
 import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import type { SandboxProviderHost } from "#shared/sandbox-provider.js";
 import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
 import type { Sandbox as MicrosandboxSandbox } from "microsandbox";
 export { isMicrosandboxNotFoundError, removeSnapshotIfExists, sandboxExists, snapshotExists, } from "#execution/sandbox/bindings/microsandbox-provider-state.js";
@@ -12,9 +12,10 @@ export declare class MicrosandboxVm {
         readonly module: MicrosandboxModule;
         readonly options: ResolvedMicrosandboxOptions;
         readonly sessionKey: string;
-        readonly tags?: SandboxBackendTags;
+        readonly tags?: Readonly<Record<string, string>>;
     }, sandbox: MicrosandboxSandbox, sandboxName: string, networkPolicy: SandboxNetworkPolicy | undefined, metadataPath?: string, optionsHash?: string, stateSnapshotName?: string);
     get id(): string;
+    get name(): string;
     captureState(optionsHash: string): Promise<MicrosandboxSessionMetadata>;
     detach(): Promise<void>;
     /**
@@ -44,9 +45,10 @@ export declare function createPreparedMicrosandbox(input: {
     readonly name: string;
     readonly networkPolicy?: SandboxNetworkPolicy;
     readonly options: ResolvedMicrosandboxOptions;
+    readonly resourcesPath?: string;
     readonly sessionKey: string;
     readonly setupBaseRuntime: boolean;
-    readonly tags?: SandboxBackendTags;
+    readonly tags?: Readonly<Record<string, string>>;
 }): Promise<MicrosandboxVm>;
 export declare function connectMicrosandbox(input: {
     readonly metadata: MicrosandboxSessionMetadata;
@@ -54,7 +56,7 @@ export declare function connectMicrosandbox(input: {
     readonly module: MicrosandboxModule;
     readonly options: ResolvedMicrosandboxOptions;
     readonly sessionKey: string;
-    readonly tags?: SandboxBackendTags;
+    readonly tags?: Readonly<Record<string, string>>;
 }): Promise<MicrosandboxVm | null>;
 /**
  * Loads the microsandbox npm package and ensures its VM runtime is
@@ -65,7 +67,7 @@ export declare function connectMicrosandbox(input: {
  * errors instead.
  */
 export declare function loadMicrosandboxModule(input: {
-    readonly appRoot: string;
+    readonly host: SandboxProviderHost;
     readonly log?: (message: string) => void;
     readonly options: ResolvedMicrosandboxOptions;
 }): Promise<MicrosandboxModule>;

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.js

@@ -1 +1 @@
-import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment,loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION};let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(n),this.#o=n,this.#t!==void 0&&await this.writeMetadata(this.#t,e),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t),{networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:n,version:MICROSANDBOX_METADATA_VERSION}}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async stop(){await this.#i.stop(),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a);let e=this.#o;e!==void 0&&(await removeSnapshotIfExists$1(this.#e.module,e),this.#o=void 0)}async setNetworkPolicy(e){let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),r=this.#a;await this.stopAndSnapshot(n),await removeSandboxIfExists(this.#e.module,r);let i=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:n,module:this.#e.module,name:i,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=i,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,n),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let t=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),n=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:t,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,t,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await r.writeMetadata(e.metadataPath,e.metadata.optionsHash),r}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox backend requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use docker() / vercel() instead.",packageName:MICROSANDBOX_PACKAGE_NAME}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs(e.options.env).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.backend":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};
+import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,createMicrosandboxSessionMetadata,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4,MICROSANDBOX_HOME=`/home/${MICROSANDBOX_USER}`;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}get name(){return this.#a}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),createMicrosandboxSessionMetadata({networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o});let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(n),this.#o=n,this.#t!==void 0&&await this.writeMetadata(this.#t,e),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t),createMicrosandboxSessionMetadata({networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:n})}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async stop(){await this.#i.stop(),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a);let e=this.#o;e!==void 0&&(await removeSnapshotIfExists$1(this.#e.module,e),this.#o=void 0)}async setNetworkPolicy(e){let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),r=this.#a;await this.stopAndSnapshot(n),await removeSandboxIfExists(this.#e.module,r);let i=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:n,module:this.#e.module,name:i,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=i,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,n),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,HOME:MICROSANDBOX_HOME,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{image:this.#e.options.image,networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,resourcesPath:e.resourcesPath,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let t=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),n=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:t,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,t,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await r.writeMetadata(e.metadataPath,e.metadata.optionsHash),r}async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>e.host.loadOptionalPackage({autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),missingMessage:"The microsandbox sandbox provider requires the `microsandbox` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D microsandbox`), or use DockerSandbox or VercelSandbox instead.",packageName:MICROSANDBOX_PACKAGE_NAME}));if(e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs({...e.options.env,HOME:MICROSANDBOX_HOME}).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.options.image.startsWith(`127.0.0.1:`)&&(t=t.registry(e=>e.insecure())),e.resourcesPath!==void 0&&(t=t.volume(`/eve/resources`,t=>t.bind(e.resourcesPath).readonly())),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.provider":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};

package/dist/src/execution/sandbox/bindings/microsandbox-templates.js

@@ -1 +1 @@
-import{readdir,rm,stat}from"node:fs/promises";import{join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{resolveLocalBackendSessionRootPath,resolveLocalBackendTemplateRootPath,resolveLocalBackendTemplatesDirectory}from"#execution/sandbox/bindings/local-backend-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT}from"#execution/sandbox/bindings/local-template-prune.js";import{readTemplateMetadata,resolveMicrosandboxMetadataPath}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{loadMicrosandboxWithoutInstall,removeSnapshotIfExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";const MICROSANDBOX_CACHE_DIRECTORY_NAME=`microsandbox`;async function pruneMicrosandboxTemplates(e){let t=resolveMicrosandboxTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot)),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a=await readMicrosandboxTemplateDirectories(t),o=a.filter(e=>!e.isTemporary);await Promise.all([...o.map(async(t,a)=>{a<i||n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)}),...a.filter(e=>e.isTemporary).map(async t=>{n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)})])}function resolveMicrosandboxTemplateRootPath(e,t){return resolveLocalBackendTemplateRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}function resolveMicrosandboxTemplatesDirectory(e){return resolveLocalBackendTemplatesDirectory(e,MICROSANDBOX_CACHE_DIRECTORY_NAME)}function resolveMicrosandboxSessionRootPath(e,t){return resolveLocalBackendSessionRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}async function readMicrosandboxTemplateDirectories(e){let t;try{t=await readdir(e,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return[];throw e}return(await Promise.all(t.filter(e=>e.isDirectory()).map(async t=>{let n=join(e,t.name);return{isTemporary:t.name.endsWith(`.tmp`),metadata:await readTemplateMetadata(resolveMicrosandboxMetadataPath(n)),mtimeMs:(await stat(n)).mtimeMs,path:n}}))).sort((e,t)=>t.mtimeMs-e.mtimeMs)}async function removeTemplateDirectory(e,t,n){if(await rm(t,{force:!0,recursive:!0}),n===null)return;let r=await loadMicrosandboxWithoutInstall(e);r!==null&&await removeSnapshotIfExists(r,n.snapshotName)}export{pruneMicrosandboxTemplates,resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath,resolveMicrosandboxTemplatesDirectory};
+import{readdir,rm,stat}from"node:fs/promises";import{join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT}from"#execution/sandbox/bindings/local-template-prune.js";import{readTemplateMetadata,resolveMicrosandboxMetadataPath}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{loadMicrosandboxWithoutInstall,removeSnapshotIfExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";const MICROSANDBOX_CACHE_DIRECTORY_NAME=`microsandbox`;async function pruneMicrosandboxTemplates(e){let t=resolveMicrosandboxTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot)),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a=await readMicrosandboxTemplateDirectories(t),o=a.filter(e=>!e.isTemporary);await Promise.all([...o.map(async(t,a)=>{a<i||n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)}),...a.filter(e=>e.isTemporary).map(async t=>{n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)})])}function resolveMicrosandboxTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}function resolveMicrosandboxTemplatesDirectory(e){return resolveLocalProviderTemplatesDirectory(e,MICROSANDBOX_CACHE_DIRECTORY_NAME)}function resolveMicrosandboxSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}async function readMicrosandboxTemplateDirectories(e){let t;try{t=await readdir(e,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return[];throw e}return(await Promise.all(t.filter(e=>e.isDirectory()).map(async t=>{let n=join(e,t.name);return{isTemporary:t.name.endsWith(`.tmp`),metadata:await readTemplateMetadata(resolveMicrosandboxMetadataPath(n)),mtimeMs:(await stat(n)).mtimeMs,path:n}}))).sort((e,t)=>t.mtimeMs-e.mtimeMs)}async function removeTemplateDirectory(e,t,n){if(await rm(t,{force:!0,recursive:!0}),n===null)return;let r=await loadMicrosandboxWithoutInstall(e);r!==null&&await removeSnapshotIfExists(r,n.snapshotName)}export{pruneMicrosandboxTemplates,resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath,resolveMicrosandboxTemplatesDirectory};

package/dist/src/execution/sandbox/bindings/microsandbox.d.ts

@@ -1,22 +1,12 @@
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
-import type { MicrosandboxBootstrapUseOptions, MicrosandboxSandboxCreateOptions, MicrosandboxSessionUseOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+import { type MicrosandboxPreparedArtifact } from "#execution/sandbox/bindings/microsandbox-lifecycle.js";
+import type { MicrosandboxSandboxCreateOptions, MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
 export { pruneMicrosandboxTemplates } from "#execution/sandbox/bindings/microsandbox-templates.js";
-/**
- * Stable backend name. Participates in template/session key derivation
- * and persisted reconnect state.
- */
-export declare const MICROSANDBOX_BACKEND_NAME = "microsandbox";
-/**
- * Construction input for {@link createMicrosandboxSandboxBackend}.
- * Internal — the public surface is the `microsandbox()` factory
- * under `eve/sandbox`.
- */
-export interface CreateMicrosandboxSandboxBackendInput {
-    readonly createOptions?: MicrosandboxSandboxCreateOptions;
-}
-/**
- * Creates the microsandbox sandbox backend: lightweight local VMs with
- * snapshot-backed templates, running each command as the
- * `vercel-sandbox` user for parity with hosted Vercel Sandbox.
- */
-export declare function createMicrosandboxSandboxBackend(input?: CreateMicrosandboxSandboxBackendInput): SandboxBackend<MicrosandboxBootstrapUseOptions, MicrosandboxSessionUseOptions>;
+export declare const MICROSANDBOX_PROVIDER_NAME = "microsandbox";
+export type MicrosandboxProviderSessionState = {
+    readonly optionsHash: string;
+    readonly sessionIdentity: string;
+    readonly version: 3;
+};
+export declare function createMicrosandboxSandboxProvider(authoredOptions?: MicrosandboxSandboxCreateOptions | undefined): SandboxProviderImplementation<MicrosandboxSandboxRuntimeOptions, MicrosandboxPreparedArtifact, MicrosandboxProviderSessionState, MutableNetworkSandboxSession>;

package/dist/src/execution/sandbox/bindings/microsandbox.js

@@ -1 +1 @@
-import{createStableHash}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{pruneMicrosandboxTemplates}from"#execution/sandbox/bindings/microsandbox-templates.js";import{microsandboxOptionsForHash,resolveMicrosandboxOptions}from"#execution/sandbox/bindings/microsandbox-options.js";import{enrichMicrosandboxError}from"#execution/sandbox/bindings/microsandbox-create.js";import{createMicrosandboxHandle,prewarmMicrosandboxTemplate}from"#execution/sandbox/bindings/microsandbox-lifecycle.js";const MICROSANDBOX_BACKEND_NAME=`microsandbox`;function createMicrosandboxSandboxBackend(e={}){let t=resolveMicrosandboxOptions(e.createOptions),n=createStableHash(JSON.stringify(microsandboxOptionsForHash(t))).slice(0,20);return{name:MICROSANDBOX_BACKEND_NAME,async prewarm(e){try{return await prewarmMicrosandboxTemplate({backendName:MICROSANDBOX_BACKEND_NAME,options:t,optionsHash:n,prewarmInput:e})}catch(t){throw enrichMicrosandboxError({context:`Failed to prewarm microsandbox template "${e.templateKey}"`,error:t})}},async create(e){return await createMicrosandboxHandle({backendName:MICROSANDBOX_BACKEND_NAME,createInput:e,options:t,optionsHash:n})}}}export{MICROSANDBOX_BACKEND_NAME,createMicrosandboxSandboxBackend,pruneMicrosandboxTemplates};
+import{materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{createStableHash}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{pruneMicrosandboxTemplates}from"#execution/sandbox/bindings/microsandbox-templates.js";import{microsandboxOptionsForHash,resolveMicrosandboxOptions}from"#execution/sandbox/bindings/microsandbox-options.js";import{enrichMicrosandboxError}from"#execution/sandbox/bindings/microsandbox-create.js";import{createMicrosandboxHandle,prewarmMicrosandboxTemplate}from"#execution/sandbox/bindings/microsandbox-lifecycle.js";const MICROSANDBOX_PROVIDER_NAME=`microsandbox`;function createMicrosandboxSandboxProvider(e=void 0){let t=e??{},n=resolveMicrosandboxOptions(t),r=createStableHash(JSON.stringify(microsandboxOptionsForHash(n))).slice(0,20);return{async prepare(e){let i=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),a=createSandboxProviderIdentity({dockerfile:i?.contentHash,optionsHash:r,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24);try{return await prewarmMicrosandboxTemplate({context:e,dockerfile:i,options:n,optionsHash:r,prepare:t.prepare,providerName:MICROSANDBOX_PROVIDER_NAME,templateKey:a})}catch(e){throw enrichMicrosandboxError({context:`Failed to prepare microsandbox`,error:e})}},async resume(e,t,i){let a=requireArtifact(t),o=requireState(i);if(o.optionsHash!==r||a.optionsHash!==r||o.sessionIdentity!==microsandboxSessionIdentity(e.session.id,a,r))throw Error(`microsandbox session state is incompatible with this environment.`);return(await createMicrosandboxHandle({artifact:a,context:e,createIfMissing:!1,sessionIdentity:o.sessionIdentity,options:n,optionsHash:r,providerName:MICROSANDBOX_PROVIDER_NAME})).handle},async start(e,t,i){let a=requireArtifact(i);return await createMicrosandboxHandle({artifact:a,context:e,options:n,optionsHash:r,providerName:MICROSANDBOX_PROVIDER_NAME,runtimeOptions:t})}}}function microsandboxSessionIdentity(e,t,n){return createStableHash(`${e}:${t.snapshotName}:${n}`).slice(0,32)}function requireArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw Error(`Invalid prepared microsandbox artifact.`);return{image:typeof e.image==`string`?e.image:null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:2}}function requireState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==3||typeof e.optionsHash!=`string`||typeof e.sessionIdentity!=`string`)throw Error(`Invalid microsandbox session state.`);return{optionsHash:e.optionsHash,sessionIdentity:e.sessionIdentity,version:3}}export{MICROSANDBOX_PROVIDER_NAME,createMicrosandboxSandboxProvider,pruneMicrosandboxTemplates};

package/dist/src/execution/sandbox/bindings/vercel-base-runtime.js

@@ -1,3 +1,3 @@
-import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";async function ensureVercelSandboxBaseRuntime(e){await runSandboxBootstrapStep(e,{failureMessage:`Failed to initialize Vercel sandbox base runtime.`,script:buildDockerBaseSetupScript()})}async function applyInitialVercelNetworkPolicy(e,t){t!==void 0&&await e.update({networkPolicy:t})}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}async function runSandboxBootstrapStep(e,t){let n=await runBootstrapCommand(e,t.script);if(n===null)return;let r=await runBootstrapCommandWithSudo(e,t.script);if(r===null)return;let i=[n,r].filter(Boolean).join(`
-`);throw Error(`${t.failureMessage}${i?`\n${i}`:``}`)}async function runBootstrapCommand(e,t){return await readBootstrapFailure(await e.runCommand({args:[`-lc`,t],cmd:`bash`}))}async function runBootstrapCommandWithSudo(e,t){return await readBootstrapFailure(await e.runCommand({args:[`-n`,`bash`,`-lc`,t],cmd:`sudo`}))}async function readBootstrapFailure(e){if(e.exitCode===0)return null;let t=await e.stdout(),n=await e.stderr();return[t.trim(),n.trim()].filter(Boolean).join(`
+import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";async function ensureVercelSandboxBaseRuntime(e){await runSandboxInitializationStep(e,{failureMessage:`Failed to initialize Vercel sandbox base runtime.`,script:buildDockerBaseSetupScript()})}async function applyInitialVercelNetworkPolicy(e,t){t!==void 0&&await e.update({networkPolicy:t})}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}async function runSandboxInitializationStep(e,t){let n=await runInitializationCommand(e,t.script);if(n===null)return;let r=await runInitializationCommandWithSudo(e,t.script);if(r===null)return;let i=[n,r].filter(Boolean).join(`
+`);throw Error(`${t.failureMessage}${i?`\n${i}`:``}`)}async function runInitializationCommand(e,t){return await readInitializationFailure(await e.runCommand({args:[`-lc`,t],cmd:`bash`}))}async function runInitializationCommandWithSudo(e,t){return await readInitializationFailure(await e.runCommand({args:[`-n`,`bash`,`-lc`,t],cmd:`sudo`}))}async function readInitializationFailure(e){if(e.exitCode===0)return null;let t=await e.stdout(),n=await e.stderr();return[t.trim(),n.trim()].filter(Boolean).join(`
 `)}export{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy};

package/dist/src/execution/sandbox/bindings/vercel-credentials.js

@@ -1 +1 @@
-import{decodeVercelOidcTokenClaims}from"#shared/vercel-project.js";import{withPackageUserAgent}from"#internal/user-agent.js";import{getVercelOidcToken}from"#compiled/@vercel/oidc/index.js";function getVercelSandboxFetch(e){let t=e.fetch;return withPackageUserAgent(t)}async function getVercelSandboxCredentials(e){let t=readNonEmptyString(e,`teamId`)??readNonEmptyEnvironmentVariable(`VERCEL_TEAM_ID`)??readNonEmptyEnvironmentVariable(`VERCEL_ORG_ID`),n=readNonEmptyString(e,`projectId`)??readNonEmptyEnvironmentVariable(`VERCEL_PROJECT_ID`),r=readNonEmptyString(e,`token`)??readNonEmptyEnvironmentVariable(`VERCEL_OIDC_TOKEN`)??readNonEmptyEnvironmentVariable(`VERCEL_TOKEN`);return r&&t&&n?{projectId:n,teamId:t,token:r}:getVercelSandboxCredentialsFromOidcToken(await getVercelOidcToken({project:n,team:t}))}function readNonEmptyString(e,t){let n=e[t];return typeof n==`string`&&n.trim().length>0?n.trim():void 0}function readNonEmptyEnvironmentVariable(e){let t=process.env[e];return typeof t==`string`&&t.trim().length>0?t.trim():void 0}function getVercelSandboxCredentialsFromOidcToken(e){let t=decodeVercelOidcTokenClaims(e);if(t.ownerId===void 0||t.projectId===void 0)throw Error(`Invalid Vercel OIDC token: missing owner_id or project_id.`);return{projectId:t.projectId,teamId:t.ownerId,token:e}}export{getVercelSandboxCredentials,getVercelSandboxFetch};
+import{decodeVercelOidcTokenClaims}from"#shared/vercel-project.js";import{withPackageUserAgent}from"#internal/user-agent.js";import{getVercelOidcToken}from"#compiled/@vercel/oidc/index.js";function getVercelSandboxFetch(e){let t=Reflect.get(e,`fetch`);return withPackageUserAgent(typeof t==`function`?t:void 0)}async function getVercelSandboxCredentials(e){let t=readNonEmptyString(e,`teamId`)??readNonEmptyEnvironmentVariable(`VERCEL_TEAM_ID`)??readNonEmptyEnvironmentVariable(`VERCEL_ORG_ID`),n=readNonEmptyString(e,`projectId`)??readNonEmptyEnvironmentVariable(`VERCEL_PROJECT_ID`),r=readNonEmptyString(e,`token`)??readNonEmptyEnvironmentVariable(`VERCEL_OIDC_TOKEN`)??readNonEmptyEnvironmentVariable(`VERCEL_TOKEN`);return r&&t&&n?{projectId:n,teamId:t,token:r}:getVercelSandboxCredentialsFromOidcToken(await getVercelOidcToken({project:n,team:t}))}function readNonEmptyString(e,t){let n=Reflect.get(e,t);return typeof n==`string`&&n.trim().length>0?n.trim():void 0}function readNonEmptyEnvironmentVariable(e){let t=process.env[e];return typeof t==`string`&&t.trim().length>0?t.trim():void 0}function getVercelSandboxCredentialsFromOidcToken(e){let t=decodeVercelOidcTokenClaims(e);if(t.ownerId===void 0||t.projectId===void 0)throw Error(`Invalid Vercel OIDC token: missing owner_id or project_id.`);return{projectId:t.projectId,teamId:t.ownerId,token:e}}export{getVercelSandboxCredentials,getVercelSandboxFetch};

package/dist/src/execution/sandbox/bindings/vercel-errors.js

@@ -1 +1 @@
-function isVercelSnapshotUnavailableError(e){for(let t of walkErrorChain(e))if((t.response?.status??t.status??t.statusCode)===410)return!0;return!1}function isVercelSandboxMissingError(e){for(let t of walkErrorChain(e))if((t.response?.status??t.status??t.statusCode)===404)return!0;return!1}function*walkErrorChain(e){let t=e,n=new Set;for(;t!=null&&!n.has(t);)n.add(t),yield t,t=t.cause}export{isVercelSandboxMissingError,isVercelSnapshotUnavailableError};
+function isVercelSnapshotUnavailableError(e){return errorChainContainsStatus(e,410)}function isVercelSandboxMissingError(e){return errorChainContainsStatus(e,404)}function errorChainContainsStatus(e,t){for(let n of walkErrorChain(e))if(readErrorStatus(n)===t)return!0;return!1}function readErrorStatus(e){if(isRecord(e))return typeof e.status==`number`?e.status:typeof e.statusCode==`number`?e.statusCode:isRecord(e.response)&&typeof e.response.status==`number`?e.response.status:void 0}function*walkErrorChain(e){let t=e,n=new Set;for(;t!=null&&!n.has(t);)n.add(t),yield t,t=isRecord(t)?t.cause:void 0}function isRecord(e){return typeof e==`object`&&!!e}export{isVercelSandboxMissingError,isVercelSnapshotUnavailableError};

package/dist/src/execution/sandbox/bindings/vercel-lifecycle.d.ts

@@ -1,13 +1,13 @@
 import type { VercelCreateOptions, VercelModule, VercelSandbox } from "#execution/sandbox/bindings/vercel-sdk-types.js";
 export declare function deleteVercelSandbox(input: {
     readonly createOptions: VercelCreateOptions;
+    readonly loadDeleteSandboxModule: () => Promise<VercelModule>;
     readonly sandbox: VercelSandbox;
-    readonly sandboxModule: VercelModule;
     readonly signal?: AbortSignal;
 }): Promise<void>;
 export declare function deleteUnusableVercelSandbox(input: {
     readonly createOptions: VercelCreateOptions;
+    readonly loadDeleteSandboxModule: () => Promise<VercelModule>;
     readonly sandbox: VercelSandbox;
-    readonly sandboxModule: VercelModule;
 }): Promise<void>;
 export declare function stopVercelSandbox(sandbox: VercelSandbox): Promise<void>;

package/dist/src/execution/sandbox/bindings/vercel-lifecycle.js

@@ -1 +1 @@
-import{getVercelSandboxCredentials,getVercelSandboxFetch}from"#execution/sandbox/bindings/vercel-credentials.js";async function deleteVercelSandbox(e){await stopVercelSandbox(e.sandbox),await deleteVercelSandboxRecord(e)}async function deleteUnusableVercelSandbox(e){await deleteVercelSandboxRecord(e)}async function deleteVercelSandboxRecord(e){let t=await resolveVercelSandboxCredentials(e.createOptions);await(await e.sandboxModule.Sandbox.get({...t,fetch:getVercelSandboxFetch(e.createOptions),name:e.sandbox.name,resume:!1,signal:e.signal})).delete({deleteOrphanSnapshots:!0,signal:e.signal})}async function stopVercelSandbox(e){(e.status===`running`||e.status===`pending`)&&await e.stop()}async function resolveVercelSandboxCredentials(e){try{return await getVercelSandboxCredentials(e)}catch{return{}}}export{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox};
+import{getVercelSandboxCredentials,getVercelSandboxFetch}from"#execution/sandbox/bindings/vercel-credentials.js";async function deleteVercelSandbox(e){await stopVercelSandbox(e.sandbox),await deleteVercelSandboxRecord(e)}async function deleteUnusableVercelSandbox(e){await deleteVercelSandboxRecord(e)}async function deleteVercelSandboxRecord(e){let t=await resolveVercelSandboxCredentials(e.createOptions);await(await(await e.loadDeleteSandboxModule()).Sandbox.get({...t,fetch:getVercelSandboxFetch(e.createOptions),name:e.sandbox.name,resume:!1,signal:e.signal})).delete({deleteOrphanSnapshots:!0,signal:e.signal})}async function stopVercelSandbox(e){(e.status===`running`||e.status===`pending`)&&await e.stop()}async function resolveVercelSandboxCredentials(e){try{return await getVercelSandboxCredentials(e)}catch{return{}}}export{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox};

package/dist/src/execution/sandbox/bindings/vercel-lookup.js

@@ -1 +1 @@
-import{getVercelSandboxCredentials,getVercelSandboxFetch}from"#execution/sandbox/bindings/vercel-credentials.js";async function getNamedVercelSandbox(e){try{return await e.sandboxModule.Sandbox.get(await getVercelSandboxGetOptions(e))}catch(t){if(isSandboxMissingError(t))return null;throw Error(`Failed to look up Vercel sandbox "${e.sandboxName}": ${errorMessage(t)}`,{cause:t})}}async function getVercelSandboxGetOptions(e){let t={fetch:getVercelSandboxFetch(e.createOptions),name:e.sandboxName,resume:!1};try{let n=await getVercelSandboxCredentials(e.createOptions);return{...t,...n,signal:e.createOptions.signal}}catch{return t}}function isSandboxMissingError(e){return e instanceof Error&&(e.response?.status??e.cause?.response?.status)===404}function errorMessage(e){if(e instanceof Error){let t=e.json,n=e.text,r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}export{getNamedVercelSandbox};
+import{getVercelSandboxCredentials,getVercelSandboxFetch}from"#execution/sandbox/bindings/vercel-credentials.js";import{isVercelSandboxMissingError}from"#execution/sandbox/bindings/vercel-errors.js";import{errorMessage}from"#execution/sandbox/bindings/vercel-options.js";async function getNamedVercelSandbox(e){try{return await e.sandboxModule.Sandbox.get(await getVercelSandboxGetOptions(e))}catch(t){if(isVercelSandboxMissingError(t))return null;throw Error(`Failed to look up Vercel sandbox "${e.sandboxName}": ${errorMessage(t)}`,{cause:t})}}async function getVercelSandboxGetOptions(e){let t={fetch:getVercelSandboxFetch(e.createOptions),name:e.sandboxName,resume:!1};try{let n=await getVercelSandboxCredentials(e.createOptions);return{...t,...n,signal:e.createOptions.signal}}catch{return t}}export{getNamedVercelSandbox};

package/dist/src/execution/sandbox/bindings/vercel-options.d.ts

@@ -1,6 +1,5 @@
 import type { VercelCreateOptions } from "#execution/sandbox/bindings/vercel-sdk-types.js";
-import type { SandboxBackendTags } from "#public/definitions/sandbox-backend.js";
-export declare function resolveVercelSandboxTags(userTags: VercelCreateOptions["tags"], eveTags: SandboxBackendTags | undefined): Record<string, string> | undefined;
+export declare function resolveVercelSandboxTags(userTags: VercelCreateOptions["tags"], eveTags: Readonly<Record<string, string>> | undefined): Record<string, string> | undefined;
 export declare function ensureVercelSandboxTags(sandbox: {
     readonly tags?: Record<string, string>;
     update(options: {

package/dist/src/execution/sandbox/bindings/vercel-options.js

@@ -1 +1 @@
-function resolveVercelSandboxTags(e,t){let n={};if(e!==void 0)for(let[t,r]of Object.entries(e))n[t]=r;if(t!==void 0)for(let[e,r]of Object.entries(t))n[e]=r;let r=Object.keys(n).length;if(r!==0){if(r>5)throw Error(`Vercel Sandbox supports at most 5 tags. eve reserves "agent", "channel", and "sessionId"; remove or consolidate custom tags passed to vercel().`);return n}}async function ensureVercelSandboxTags(e,t){t===void 0||areVercelSandboxTagsEqual(e.tags,t)||await e.update({tags:t})}function areVercelSandboxTagsEqual(e,t){let n=e??{},r=Object.entries(n),i=Object.entries(t);return r.length===i.length&&i.every(([e,t])=>n[e]===t)}function errorMessage(e){if(e instanceof Error){let t=e.json,n=e.text,r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}export{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags};
+function resolveVercelSandboxTags(e,t){let n={};if(e!==void 0)for(let[t,r]of Object.entries(e))n[t]=r;if(t!==void 0)for(let[e,r]of Object.entries(t))n[e]=r;let r=Object.keys(n).length;if(r!==0){if(r>5)throw Error(`Vercel Sandbox supports at most 5 tags. eve reserves "agent", "channel", and "sessionId"; remove or consolidate custom tags.`);return n}}async function ensureVercelSandboxTags(e,t){t===void 0||areVercelSandboxTagsEqual(e.tags,t)||await e.update({tags:t})}function areVercelSandboxTagsEqual(e,t){let n=e??{},r=Object.entries(n),i=Object.entries(t);return r.length===i.length&&i.every(([e,t])=>n[e]===t)}function errorMessage(e){if(e instanceof Error){let t=Reflect.get(e,`json`),n=Reflect.get(e,`text`),r=typeof n==`string`&&n.length>0?n:t===void 0?void 0:JSON.stringify(t);return r===void 0?e.message:`${e.message}: ${r}`}return String(e)}export{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags};

package/dist/src/execution/sandbox/bindings/vercel.d.ts

@@ -1,19 +1,27 @@
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
-import type { VercelSandboxBootstrapUseOptions, VercelSandboxSessionCreateContext, VercelSandboxSessionCreateOptions, VercelSandboxSessionUseOptions } from "#public/sandbox/vercel-sandbox.js";
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+import type { VercelSandboxRuntimeOptions } from "#public/sandbox/vercel-sandbox.js";
 import { type CreateVercelSandbox } from "#execution/sandbox/bindings/vercel-create-sdk.js";
 import type { VercelCreateOptions, VercelModule } from "#execution/sandbox/bindings/vercel-sdk-types.js";
+export type VercelSandboxPreparedArtifact = {
+    readonly snapshotId?: string;
+};
+export type VercelSandboxSessionState = {
+    readonly sandboxName: string;
+    readonly version: 3;
+};
+type VercelEnvironmentOptions = VercelCreateOptions & {
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
+};
+export declare function createVercelSandboxProvider(environmentOptions: Readonly<VercelEnvironmentOptions> | undefined): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, MutableNetworkSandboxSession>;
 export interface CreateVercelSandboxInput {
     readonly createSandbox?: CreateVercelSandbox;
     readonly createOptions?: VercelCreateOptions;
+    readonly loadDeleteSandboxModule?: () => Promise<VercelModule>;
     readonly loadSandboxModule?: () => Promise<VercelModule>;
-    readonly resolveSessionCreateOptions?: (context: VercelSandboxSessionCreateContext) => Promise<VercelSandboxSessionCreateOptions> | VercelSandboxSessionCreateOptions;
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
+    readonly skipEmptyPreparation?: boolean;
 }
-/**
- * Creates the Vercel-backed sandbox backend.
- *
- * Any author-supplied `createOptions` are forwarded to Vercel's sandbox
- * create API for every fresh sandbox the framework creates (template at
- * prewarm time, session at first-time session-create). On resume
- * (`Sandbox.get`) no create happens, so they are not re-applied.
- */
-export declare function createVercelSandbox(input?: CreateVercelSandboxInput): SandboxBackend<VercelSandboxBootstrapUseOptions, VercelSandboxSessionUseOptions>;
+export declare function createVercelSandbox(input?: CreateVercelSandboxInput): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, MutableNetworkSandboxSession>;
+export {};

package/dist/src/execution/sandbox/bindings/vercel.js

@@ -1,2 +1,2 @@
-import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags}from"#execution/sandbox/bindings/vercel-options.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox}from"#execution/sandbox/bindings/vercel-lifecycle.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},r=e.createSandbox??createVercelEveImageSandbox,i=new Map;return{name:`vercel`,async create(a){let o=resolveVercelSandboxTags(n.tags,a.tags),s=a.templateKey===null?null:await readTemplateForCreate({createOptions:n,loadSandboxModule:t,prewarmedTemplates:i,templateKey:a.templateKey}),c=await t(),l={createOptions:n,createSandbox:r,existingMetadata:a.existingMetadata,resolveSessionCreateOptions:e.resolveSessionCreateOptions,sandboxModule:c,sessionId:a.tags?.sessionId??a.sessionKey,sessionKey:a.sessionKey,snapshotId:s?.snapshotId,tags:o},u;try{u=await ensureSession(l)}catch(e){throw s!==null&&isVercelSnapshotUnavailableError(e)?(i.delete(s.templateKey),await(await getNamedVercelSandbox({createOptions:n,sandboxModule:c,sandboxName:s.sandboxName}))?.delete(),new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:s.templateKey})):Error(`Failed to create sandbox session "${a.sessionKey}": ${errorMessage(e)}`,{cause:e})}try{u=await ensureUsableSession({input:l,session:u}),s===null&&u.created&&await applyInitialVercelNetworkPolicy(u.sandbox,n.networkPolicy)}catch(e){throw Error(`Failed to initialize sandbox session "${a.sessionKey}": ${errorMessage(e)}`,{cause:e})}return createHandle({createOptions:n,sandbox:u.sandbox,sandboxModule:c,sessionKey:a.sessionKey})},async prewarm(e){let a;try{a=await ensureTemplateWithUnavailableRetry({bootstrap:e.bootstrap,createOptions:n,createSandbox:r,loadSandboxModule:t,log:e.log,seedFiles:e.seedFiles,templateKey:e.templateKey})}catch(t){throw Error(`Failed to prewarm Vercel sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}return i.set(e.templateKey,a.template),{reused:a.reused}}}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function readTemplate(e){let t=e.prewarmedTemplates.get(e.templateKey);if(t!==void 0)return t;let n=await e.loadSandboxModule(),r=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:n,sandboxName:e.templateKey});if(r===null||typeof r.currentSnapshotId!=`string`)throw new SandboxTemplateNotProvisionedError({backendName:`vercel`,templateKey:e.templateKey});return{sandboxName:r.name,snapshotId:r.currentSnapshotId,templateKey:e.templateKey}}async function readTemplateForCreate(e){try{return await readTemplate(e)}catch(t){throw SandboxTemplateNotProvisionedError.is(t)?t:Error(`Failed to read sandbox template "${e.templateKey}": ${errorMessage(t)}`,{cause:t})}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),r=resolveVercelSandboxTags(e.createOptions.tags,e.tags),i=extractAuthorSnapshotId(e.createOptions);if(n!==null&&isUnprovisionedTerminalTemplateSandbox(n,i)&&(await n.delete(),n=null),n===null?n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!0,tags:r})}):await ensureVercelSandboxTags(n,r),typeof n.currentSnapshotId==`string`&&n.currentSnapshotId.length>0&&n.currentSnapshotId!==i)return{reused:!0,template:{sandboxName:n.name,snapshotId:n.currentSnapshotId,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let a=buildSandboxSession(createVercelInternalSandboxSession(n,e.templateKey),createVercelNetworkPolicySetter(n));await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:a}),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async t=>(t!==void 0&&await n.update(t),createLoggingSandboxSession({log:e.log,session:a}))}));let o=await n.snapshot();return{reused:!1,template:{sandboxName:n.name,snapshotId:o.snapshotId,templateKey:e.templateKey}}}async function ensureUsableSession(e){try{return await ensureVercelSandboxBaseRuntime(e.session.sandbox),e.session}catch(t){if(e.session.created||!isVercelSnapshotUnavailableError(t))throw t}await deleteUnusableVercelSandbox({createOptions:e.input.createOptions,sandbox:e.session.sandbox,sandboxModule:e.input.sandboxModule});let t=await ensureSession({...e.input,existingMetadata:void 0});return await ensureVercelSandboxBaseRuntime(t.sandbox),t}async function ensureSession(e){let t=getVercelSandboxName(e.existingMetadata)??e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t,await e.resolveSessionCreateOptions?.({session:{id:e.sessionId}}));return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t,n={}){let r={...e.createOptions,...n};if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...r,name:t,persistent:!0});let{image:i,runtime:a,source:o,...s}=r;return{...s,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function createHandle(e){let{sandbox:t,sessionKey:n}=e;return{session:buildSandboxSession(createVercelInternalSandboxSession(t,n),createVercelNetworkPolicySetter(t)),useSessionFn:async e=>(e!==void 0&&await t.update(e),buildSandboxSession(createVercelInternalSandboxSession(t,n),createVercelNetworkPolicySetter(t))),async captureState(){return{backendName:`vercel`,metadata:{sandboxName:t.name},sessionKey:n}},async delete(n){await deleteVercelSandbox({createOptions:e.createOptions,sandbox:t,sandboxModule:e.sandboxModule,signal:n?.abortSignal})},async stop(){await stopVercelSandbox(t)},async shutdown(){try{await stopVercelSandbox(t)}catch{}}}}function createVercelInternalSandboxSession(e,t){return{id:t,resolvePath:resolveVercelSandboxPath,async spawn(t){let n=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:t.env,signal:t.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let n=await streamToBuffer(t.content),r=await resolveVercelWritePath(e,t.path,t.abortSignal);await e.writeFiles([{content:n,path:r}],{signal:t.abortSignal})},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(e){if(e.seedFiles.length===0)return;let t=await Promise.all(e.seedFiles.map(async t=>({content:typeof t.content==`string`?Buffer.from(t.content):t.content,path:await resolveSandboxModelPath({path:t.path,sandbox:e.session})})));await e.sandbox.writeFiles(t)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function resolveVercelWritePath(e,t,n){let r=await e.runCommand({args:[`-m`,`--`,t],cmd:`realpath`,signal:n}),i=(await r.stdout()).trim();if(r.exitCode!==0||!i.startsWith(`/`)||i.includes(`
-`))throw Error(`Failed to resolve Vercel Sandbox write path: ${t}`);return i}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}function getVercelSandboxName(e){let t=e?.sandboxName;return typeof t==`string`?t:void 0}const DEFAULT_SANDBOX_TIMEOUT_MS=18e5;export{createVercelSandbox};
+import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{VERCEL_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags}from"#execution/sandbox/bindings/vercel-options.js";import{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox}from"#execution/sandbox/bindings/vercel-lifecycle.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandboxProvider(e){let{prepare:t,...n}=e??{};return createVercelSandbox({createOptions:n,prepare:t})}function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n=e.loadDeleteSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),r={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},i=e.createSandbox??createVercelEveImageSandbox;async function openSession(e,a,o,s){let c=requirePreparedVercelTemplate(o),{mounts:l,...u}=a??{},d={...r,...u},f=resolveVercelSandboxTags(d.tags,{sessionId:e.session.id}),p=await t(),m={createOptions:d,createSandbox:i,resolveSessionCreateOptions:l===void 0?void 0:async()=>({mounts:l}),sandboxModule:p,sessionKey:s,snapshotId:c.snapshotId,tags:f},h;try{if(h=await ensureSession(m),h=await ensureUsableSession({input:m,loadDeleteSandboxModule:n,session:h}),h.created&&c.snapshotId===void 0&&u.networkPolicy!==void 0)try{await applyInitialVercelNetworkPolicy(h.sandbox,u.networkPolicy)}catch(t){try{await deleteVercelSandbox({createOptions:d,loadDeleteSandboxModule:n,sandbox:h.sandbox})}catch(n){throw AggregateError([t,n],`Failed to apply network policy and discard Vercel sandbox session "${e.session.id}".`,{cause:t})}throw t}}catch(t){throw isVercelSnapshotUnavailableError(t)&&c.snapshotId!==void 0?new SandboxTemplateNotProvisionedError({providerName:`vercel`,templateKey:c.snapshotId}):Error(`Failed to open Vercel sandbox session "${e.session.id}": ${errorMessage(t)}`,{cause:t})}return createHandle({createOptions:d,loadDeleteSandboxModule:n,sandbox:h.sandbox})}return{async prepare(n){let a=providerResourceTargetFiles(n.resources);if(e.skipEmptyPreparation===!0&&e.prepare===void 0&&a.length===0)return{};let o=`eve-sbx-tpl-vercel-${createSandboxProviderIdentity({createOptions:vercelIdentityOptions(r),resolvedImage:r.source===void 0?r.image??VERCEL_EVE_SANDBOX_IMAGE:void 0,resources:sandboxProviderResourceIdentity(n.resources),sourceRevision:n.sourceRevision,version:2}).slice(0,32)}`;try{return{snapshotId:(await ensureTemplateWithUnavailableRetry({createOptions:r,createSandbox:i,loadSandboxModule:t,log:n.log,prepareSandbox:e.prepare,seedFiles:a,templateKey:o})).template.snapshotId}}catch(e){throw Error(`Failed to prepare Vercel sandbox snapshot: ${errorMessage(e)}`,{cause:e})}},async resume(e,i,a){requirePreparedVercelTemplate(i);let o=requireVercelSessionState(a),s=await t(),c=await getNamedVercelSandbox({createOptions:r,sandboxModule:s,sandboxName:o.sandboxName});if(c===null)throw Error(`Vercel sandbox session "${o.sandboxName}" no longer exists.`);return await ensureVercelSandboxBaseRuntime(c),createHandle({createOptions:r,loadDeleteSandboxModule:n,sandbox:c})},async start(e,t,n){let i=vercelSessionName(e.session.id,t,n,r);return{handle:await openSession(e,t,n,i),state:{sandboxName:i,version:3}}}}}function vercelSessionName(e,t,n,r){let i=requirePreparedVercelTemplate(n);return`eve-sbx-vercel-${createSandboxProviderIdentity({artifact:i,createOptions:vercelIdentityOptions(r),options:vercelIdentityOptions(t),sessionId:e,version:1}).slice(0,32)}`}function vercelIdentityOptions(e){if(e===void 0)return;let t=new Set([`fetch`,`projectId`,`signal`,`teamId`,`token`]);return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function requireVercelSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==3||typeof e.sandboxName!=`string`)throw Error(`Invalid Vercel sandbox session state.`);return{sandboxName:e.sandboxName,version:3}}function requirePreparedVercelTemplate(e){if(!isSandboxPreparedArtifactRecord(e)||e.snapshotId!==void 0&&typeof e.snapshotId!=`string`)throw Error(`Invalid prepared Vercel sandbox artifact.`);return e.snapshotId===void 0?{}:{snapshotId:e.snapshotId}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),r=resolveVercelSandboxTags(e.createOptions.tags,e.tags),i=extractAuthorSnapshotId(e.createOptions);n!==null&&isUnprovisionedTerminalTemplateSandbox(n,i)&&(await n.delete(),n=null),n===null?n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!0,tags:r})}):await ensureVercelSandboxTags(n,r);let a=typeof n.currentSnapshotId==`string`&&n.currentSnapshotId.length>0&&n.currentSnapshotId!==i?n.currentSnapshotId:null;if(a!==null)return{template:{sandboxName:n.name,snapshotId:a,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let o=buildSandboxSession(createVercelInternalSandboxSession(n),createVercelNetworkPolicySetter(n));await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:o}),e.log?.(`running sandbox preparation`),await e.prepareSandbox?.(createLoggingSandboxSession({log:e.log,session:o}));let s=await n.snapshot();return{template:{sandboxName:n.name,snapshotId:s.snapshotId,templateKey:e.templateKey}}}async function ensureUsableSession(e){try{return await ensureVercelSandboxBaseRuntime(e.session.sandbox),e.session}catch(t){if(e.session.created||!isVercelSnapshotUnavailableError(t))throw t}await deleteUnusableVercelSandbox({createOptions:e.input.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:e.session.sandbox});let t=await ensureSession(e.input);return await ensureVercelSandboxBaseRuntime(t.sandbox),t}async function ensureSession(e){let t=e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t,await e.resolveSessionCreateOptions?.());return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t,n={}){let r={...e.createOptions,...n};if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...r,name:t,persistent:!0});let{image:i,runtime:a,source:o,...s}=r;return{...s,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function createHandle(e){let{sandbox:t}=e;return{sandbox:buildSandboxSession(createVercelInternalSandboxSession(t),createVercelNetworkPolicySetter(t)),async onSessionDelete(n){await deleteVercelSandbox({createOptions:e.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:t,signal:n?.abortSignal})},async onSessionStop(){await stopVercelSandbox(t)},async onRuntimeShutdown(){try{await stopVercelSandbox(t)}catch{}}}}function createVercelInternalSandboxSession(e){return{resolvePath:resolveVercelSandboxPath,async spawn(t){let n=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:t.env,signal:t.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let n=await streamToBuffer(t.content),r=await resolveVercelWritePath(e,t.path,t.abortSignal);await e.writeFiles([{content:n,path:r}],{signal:t.abortSignal})},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(e){if(e.seedFiles.length===0)return;let t=await Promise.all(e.seedFiles.map(async t=>({content:typeof t.content==`string`?Buffer.from(t.content):t.content,path:await resolveSandboxModelPath({path:t.path,sandbox:e.session})})));await e.sandbox.writeFiles(t)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function resolveVercelWritePath(e,t,n){let r=await e.runCommand({args:[`-m`,`--`,t],cmd:`realpath`,signal:n}),i=(await r.stdout()).trim();if(r.exitCode!==0||!i.startsWith(`/`)||i.includes(`
+`))throw Error(`Failed to resolve Vercel Sandbox write path: ${t}`);return i}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}const DEFAULT_SANDBOX_TIMEOUT_MS=18e5;export{createVercelSandbox,createVercelSandboxProvider};

package/dist/src/execution/sandbox/development-cleanup.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}from"#execution/sandbox/development-run.js";import{toErrorMessage}from"#shared/errors.js";import{DockerUnavailableError,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{createProviderName,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,stopAndSnapshotMicrosandboxSandbox}from"#execution/sandbox/bindings/microsandbox-runtime.js";async function stopDevelopmentSandboxResources(e){let t=await Promise.allSettled([stopDevelopmentDockerResources(e.devRunId),stopDevelopmentMicrosandboxResources(e.appRoot,e.devRunId,e.log)]);for(let n of t)n.status===`rejected`&&e.log?.(`failed to stop development sandbox resources: ${toErrorMessage(n.reason)}`)}async function stopDevelopmentDockerResources(e){let t=createDockerCli(),n=[`label=${DOCKER_SANDBOX_LABEL}=1`,`label=${DOCKER_SANDBOX_LABEL}.tag.${EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}=${e}`],r;try{r=await t.run([`ps`,`-q`,...n.flatMap(e=>[`--filter`,e])])}catch(e){if(e instanceof DockerUnavailableError)return;throw e}if(r.exitCode!==0)return;let i=r.stdout.trim().split(/\s+/u).filter(Boolean);await Promise.all(i.map(e=>stopDockerContainerIfRunning(t,e)))}async function stopDevelopmentMicrosandboxResources(e,t,n){let r=await loadMicrosandboxWithoutInstall(e);if(r===null)return;let i=await r.Sandbox.listWith({labels:{"eve.backend":`microsandbox`,[EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG]:t}});await Promise.all(i.filter(e=>e.status===`running`||e.status===`draining`).map(async e=>{let t=getMicrosandboxLabel(e.configJson,EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG);if(t===void 0){await(await r.Sandbox.get(e.name)).stopWithTimeout(1e4).catch(()=>{});return}let i=await readSessionMetadata(t);if(i===null||i.sandboxName!==e.name){await(await r.Sandbox.get(e.name)).stopWithTimeout(1e4).catch(()=>{});return}n?.(`snapshotting development microsandbox session "${e.name}" before shutdown`);let a=i.stateSnapshotName,o=createProviderName(`eve-sbx-state`,`${i.sandboxName}:${randomUUID()}`);await stopAndSnapshotMicrosandboxSandbox(r,e.name,o),await writeSessionMetadata(t,{networkPolicy:i.networkPolicy,optionsHash:i.optionsHash,sandboxName:i.sandboxName,stateSnapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),a!==void 0&&await removeSnapshotIfExists(r,a)}))}function getMicrosandboxLabel(e,t){let n;try{n=JSON.parse(e)}catch{return}return findLabel(n,t)}function findLabel(e,t){if(!isRecord(e))return;let n=e[t];if(typeof n==`string`)return n;let r=e.labels;if(isRecord(r)&&typeof r[t]==`string`)return r[t];if(typeof e.labelsJson==`string`){let n=parseJsonRecord(e.labelsJson);if(n!==null&&typeof n[t]==`string`)return n[t]}for(let n of Object.values(e)){let e=findLabel(n,t);if(e!==void 0)return e}}function parseJsonRecord(e){try{let t=JSON.parse(e);return isRecord(t)?t:null}catch{return null}}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{stopDevelopmentSandboxResources};
+import{randomUUID}from"node:crypto";import{EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}from"#execution/sandbox/development-run.js";import{toErrorMessage}from"#shared/errors.js";import{DockerUnavailableError,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{createProviderName,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,stopAndSnapshotMicrosandboxSandbox}from"#execution/sandbox/bindings/microsandbox-runtime.js";async function stopDevelopmentSandboxResources(e){let t=await Promise.allSettled([stopDevelopmentDockerResources(e.devRunId),stopDevelopmentMicrosandboxResources(e.appRoot,e.devRunId,e.log)]);for(let n of t)n.status===`rejected`&&e.log?.(`failed to stop development sandbox resources: ${toErrorMessage(n.reason)}`)}async function stopDevelopmentDockerResources(e){let t=createDockerCli(),n=[`label=${DOCKER_SANDBOX_LABEL}=1`,`label=${DOCKER_SANDBOX_LABEL}.tag.${EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}=${e}`],r;try{r=await t.run([`ps`,`-q`,...n.flatMap(e=>[`--filter`,e])])}catch(e){if(e instanceof DockerUnavailableError)return;throw e}if(r.exitCode!==0)return;let i=r.stdout.trim().split(/\s+/u).filter(Boolean);await Promise.all(i.map(e=>stopDockerContainerIfRunning(t,e)))}async function stopDevelopmentMicrosandboxResources(e,t,n){let r=await loadMicrosandboxWithoutInstall(e);if(r===null)return;let i=await r.Sandbox.listWith({labels:{"eve.provider":`microsandbox`,[EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG]:t}});await Promise.all(i.filter(e=>e.status===`running`||e.status===`draining`).map(async e=>{let t=getMicrosandboxLabel(e.configJson,EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG);if(t===void 0){await(await r.Sandbox.get(e.name)).stopWithTimeout(1e4).catch(()=>{});return}let i=await readSessionMetadata(t);if(i===null||i.sandboxName!==e.name){await(await r.Sandbox.get(e.name)).stopWithTimeout(1e4).catch(()=>{});return}n?.(`snapshotting development microsandbox session "${e.name}" before shutdown`);let a=i.stateSnapshotName,o=createProviderName(`eve-sbx-state`,`${i.sandboxName}:${randomUUID()}`);await stopAndSnapshotMicrosandboxSandbox(r,e.name,o),await writeSessionMetadata(t,{networkPolicy:i.networkPolicy,optionsHash:i.optionsHash,sandboxName:i.sandboxName,stateSnapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),a!==void 0&&await removeSnapshotIfExists(r,a)}))}function getMicrosandboxLabel(e,t){let n;try{n=JSON.parse(e)}catch{return}return findLabel(n,t)}function findLabel(e,t){if(!isRecord(e))return;let n=e[t];if(typeof n==`string`)return n;let r=e.labels;if(isRecord(r)&&typeof r[t]==`string`)return r[t];if(typeof e.labelsJson==`string`){let n=parseJsonRecord(e.labelsJson);if(n!==null&&typeof n[t]==`string`)return n[t]}for(let n of Object.values(e)){let e=findLabel(n,t);if(e!==void 0)return e}}function parseJsonRecord(e){try{let t=JSON.parse(e);return isRecord(t)?t:null}catch{return null}}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{stopDevelopmentSandboxResources};

package/dist/src/execution/sandbox/development-prewarm.d.ts

@@ -1,4 +1,9 @@
 import { type RuntimeCompiledArtifactsSource } from "#runtime/compiled-artifacts-source.js";
+export declare function prewarmDevelopmentSandboxes(input: {
+    readonly appRoot: string;
+    readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;
+    readonly log?: (message: string) => void;
+}): Promise<void>;
 export declare function startDevelopmentSandboxPrewarmInBackground(input: {
     readonly appRoot: string;
     readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;

package/dist/src/execution/sandbox/development-prewarm.js

@@ -1 +1 @@
-import{prewarmAppSandboxes}from"./prewarm.js";import{toErrorMessage}from"#shared/errors.js";import{getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";const pendingDevelopmentPrewarms=new Map,retainedDevelopmentPrewarmLogs=new Map,completedDevelopmentPrewarmSignatures=new Map;function startDevelopmentSandboxPrewarmInBackground(e){let t=resolvePrewarmKeys(e),n=findPendingPrewarm(t);if(n!==void 0){registerPrewarmAliases(t,n);return}let r={logs:[],promise:Promise.resolve(),subscribers:new Set};for(let e of t)retainedDevelopmentPrewarmLogs.delete(e);let i=resolvePrewarmSignatureCacheKey(e),a=prewarmAppSandboxes({appRoot:e.appRoot,compiledArtifactsSource:e.compiledArtifactsSource,log:t=>recordPrewarmLog(r,t,e.log),onPrewarmSignature:e=>{completedDevelopmentPrewarmSignatures.set(i,e)},shouldPrewarmSignature:e=>completedDevelopmentPrewarmSignatures.get(i)!==e});r.promise=a,registerPrewarmAliases(t,r),a.catch(t=>{recordPrewarmLog(r,`eve: failed to initialize sandbox templates in the background: ${toErrorMessage(t)}`,e.log)}).finally(()=>{for(let e of t)pendingDevelopmentPrewarms.get(e)===r&&pendingDevelopmentPrewarms.delete(e),r.subscribers.size===0&&r.logs.length>0&&retainedDevelopmentPrewarmLogs.set(e,[...r.logs])})}function subscribeDevelopmentSandboxPrewarmLogs(e){let t=findPendingPrewarm([e.appRoot]);if(t!==void 0){for(let n of t.logs)e.log(n);return t.subscribers.add(e.log),()=>t.subscribers.delete(e.log)}let n=retainedDevelopmentPrewarmLogs.get(e.appRoot);if(n===void 0)return()=>{};retainedDevelopmentPrewarmLogs.delete(e.appRoot);for(let t of n)e.log(t);return()=>{}}async function waitForDevelopmentSandboxPrewarm(e){let t=findPendingPrewarm(resolvePrewarmKeys(e));if(t===void 0)return;let unsubscribe;if(e.log!==void 0){for(let n of t.logs)e.log(n);let subscriber=t=>e.log?.(t);t.subscribers.add(subscriber),unsubscribe=()=>t.subscribers.delete(subscriber)}try{await withProgressHeartbeat(`waiting for background sandbox template prewarm`,e.log,()=>t.promise)}finally{unsubscribe?.()}}function resolvePrewarmKeys(e){let t=new Set([e.appRoot]),n=getRuntimeCompiledArtifactsAppRoot(e.compiledArtifactsSource);n!==void 0&&t.add(n);let r=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource);return r!==void 0&&t.add(r),[...t]}function resolvePrewarmSignatureCacheKey(e){return getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??e.appRoot}function findPendingPrewarm(e){for(let t of e){let e=pendingDevelopmentPrewarms.get(t);if(e!==void 0)return e}}function registerPrewarmAliases(e,t){for(let n of e)pendingDevelopmentPrewarms.set(n,t)}function recordPrewarmLog(e,t,n){e.logs.push(t),e.logs.length>50&&e.logs.splice(0,e.logs.length-50),n?.(t);for(let n of e.subscribers)n(t)}async function withProgressHeartbeat(e,t,n){if(t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}export{startDevelopmentSandboxPrewarmInBackground,subscribeDevelopmentSandboxPrewarmLogs,waitForDevelopmentSandboxPrewarm};
+import{prewarmAppSandboxes}from"./prewarm.js";import{toErrorMessage}from"#shared/errors.js";import{getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";const pendingDevelopmentPrewarms=new Map,retainedDevelopmentPrewarmLogs=new Map;async function prewarmDevelopmentSandboxes(e){startDevelopmentSandboxPrewarmInBackground(e),await waitForDevelopmentSandboxPrewarm(e)}function startDevelopmentSandboxPrewarmInBackground(e){let t=resolvePrewarmKeys(e),n=findPendingPrewarm(t);if(n!==void 0){registerPrewarmAliases(t,n);return}let r={logs:[],promise:Promise.resolve(),subscribers:new Set};for(let e of t)retainedDevelopmentPrewarmLogs.delete(e);let i=prewarmAppSandboxes({appRoot:e.appRoot,compiledArtifactsSource:e.compiledArtifactsSource,log:t=>recordPrewarmLog(r,t,e.log)});r.promise=i,registerPrewarmAliases(t,r),i.catch(t=>{recordPrewarmLog(r,`eve: failed to initialize sandbox templates in the background: ${toErrorMessage(t)}`,e.log)}).finally(()=>{for(let e of t)pendingDevelopmentPrewarms.get(e)===r&&pendingDevelopmentPrewarms.delete(e),r.subscribers.size===0&&r.logs.length>0&&retainedDevelopmentPrewarmLogs.set(e,[...r.logs])})}function subscribeDevelopmentSandboxPrewarmLogs(e){let t=findPendingPrewarm([e.appRoot]);if(t!==void 0){for(let n of t.logs)e.log(n);return t.subscribers.add(e.log),()=>t.subscribers.delete(e.log)}let n=retainedDevelopmentPrewarmLogs.get(e.appRoot);if(n===void 0)return()=>{};retainedDevelopmentPrewarmLogs.delete(e.appRoot);for(let t of n)e.log(t);return()=>{}}async function waitForDevelopmentSandboxPrewarm(e){let t=findPendingPrewarm(resolvePrewarmKeys(e));if(t===void 0)return;let unsubscribe;if(e.log!==void 0){for(let n of t.logs)e.log(n);let subscriber=t=>e.log?.(t);t.subscribers.add(subscriber),unsubscribe=()=>t.subscribers.delete(subscriber)}try{await withProgressHeartbeat(`waiting for background sandbox template prewarm`,e.log,()=>t.promise)}finally{unsubscribe?.()}}function resolvePrewarmKeys(e){let t=new Set([e.appRoot]),n=getRuntimeCompiledArtifactsAppRoot(e.compiledArtifactsSource);n!==void 0&&t.add(n);let r=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource);return r!==void 0&&t.add(r),[...t]}function findPendingPrewarm(e){for(let t of e){let e=pendingDevelopmentPrewarms.get(t);if(e!==void 0)return e}}function registerPrewarmAliases(e,t){for(let n of e)pendingDevelopmentPrewarms.set(n,t)}function recordPrewarmLog(e,t,n){e.logs.push(t),e.logs.length>50&&e.logs.splice(0,e.logs.length-50),n?.(t);for(let n of e.subscribers)n(t)}async function withProgressHeartbeat(e,t,n){if(t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}export{prewarmDevelopmentSandboxes,startDevelopmentSandboxPrewarmInBackground,subscribeDevelopmentSandboxPrewarmLogs,waitForDevelopmentSandboxPrewarm};

package/dist/src/execution/sandbox/development-run.d.ts

@@ -1,8 +1,7 @@
-import type { SandboxBackendTags } from "#shared/sandbox-backend.js";
 export declare const EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV = "EVE_DEVELOPMENT_SANDBOX_RUN_ID";
 export declare const EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG = "eve.metadataPath";
 export declare const EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG = "devRunId";
 export declare function createDevelopmentSandboxRunId(): string;
 export declare function getDevelopmentSandboxRunId(): string | undefined;
-export declare function withDevelopmentSandboxTags(tags: SandboxBackendTags | undefined): SandboxBackendTags | undefined;
-export declare function withDevelopmentSandboxMetadataPathTag(tags: SandboxBackendTags | undefined, metadataPath: string): SandboxBackendTags | undefined;
+export declare function withDevelopmentSandboxTags(tags: Readonly<Record<string, string>> | undefined): Readonly<Record<string, string>> | undefined;
+export declare function withDevelopmentSandboxMetadataPathTag(tags: Readonly<Record<string, string>> | undefined, metadataPath: string): Readonly<Record<string, string>> | undefined;

package/dist/src/execution/sandbox/dockerfile.d.ts

@@ -0,0 +1,25 @@
+import type { DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
+import type { SandboxProviderFiles } from "#shared/sandbox-provider.js";
+export interface SandboxDockerfile {
+    readonly contextPath: string;
+    readonly contentHash: string;
+    readonly path: string;
+}
+export declare function materializeSandboxDockerfile(input: {
+    readonly files: SandboxProviderFiles;
+    readonly storagePath: string;
+}): Promise<SandboxDockerfile | undefined>;
+export declare function resolveSandboxDockerfile(agentRoot: string): Promise<SandboxDockerfile | undefined>;
+export declare function dockerfileImageReference(input: {
+    readonly dockerfile: SandboxDockerfile;
+    readonly templateKey: string;
+}): string;
+export declare function buildSandboxDockerfile(input: {
+    readonly cli: DockerCli;
+    readonly dockerfile: SandboxDockerfile;
+    readonly imageReference: string;
+}): Promise<void>;
+export declare function publishDockerImageForMicrosandbox(input: {
+    readonly cli: DockerCli;
+    readonly imageReference: string;
+}): Promise<string>;

package/dist/src/execution/sandbox/dockerfile.js

@@ -0,0 +1 @@
+import{createHash,randomUUID}from"node:crypto";import{access,mkdir,readFile,readdir,rename,rm,writeFile}from"node:fs/promises";import{dirname,join,relative}from"node:path";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";async function materializeSandboxDockerfile(e){let t;try{t=await e.files.read(`Dockerfile`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let n=await e.files.list(),r=createHash(`sha256`),i=await Promise.all(n.map(async t=>({content:await e.files.read(t),path:t})));for(let e of i)r.update(e.path).update(`\0`).update(e.content).update(`\0`);let a=r.digest(`hex`),o=join(e.storagePath,`dockerfiles`,a);try{return await access(join(o,`Dockerfile`)),{contentHash:a,contextPath:o,path:join(o,`Dockerfile`)}}catch(e){if(!isFileNotFoundError(e))throw e}let s=`${o}.${randomUUID()}.tmp`;await Promise.all(i.map(async e=>{let t=join(s,e.path);await mkdir(dirname(t),{recursive:!0}),await writeFile(t,e.content)})),n.includes(`Dockerfile`)||(await mkdir(s,{recursive:!0}),await writeFile(join(s,`Dockerfile`),t)),await mkdir(dirname(o),{recursive:!0});try{await rename(s,o)}catch(e){try{await access(join(o,`Dockerfile`))}catch{throw e}}finally{await rm(s,{force:!0,recursive:!0})}return{contentHash:a,contextPath:o,path:join(o,`Dockerfile`)}}async function resolveSandboxDockerfile(e){let t=join(e,`sandbox`,`Dockerfile`);try{await readFile(t)}catch(e){if(isFileNotFoundError(e))return;throw e}let n=dirname(t);return{contextPath:n,contentHash:await hashDirectory(n),path:t}}function dockerfileImageReference(e){return`eve-sandbox-dockerfile:${createHash(`sha256`).update(`${e.templateKey}:${e.dockerfile.contentHash}`).digest(`hex`).slice(0,24)}`}async function buildSandboxDockerfile(e){expectDockerSuccess(await e.cli.run([`build`,`--file`,e.dockerfile.path,`--tag`,e.imageReference,e.dockerfile.contextPath]),`build sandbox Dockerfile "${e.dockerfile.path}"`)}const LOCAL_REGISTRY_CONTAINER=`eve-sandbox-registry`,LOCAL_REGISTRY_HOST=`127.0.0.1:51921`;async function publishDockerImageForMicrosandbox(e){let t=await e.cli.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,LOCAL_REGISTRY_CONTAINER]);t.exitCode===0?t.stdout.trim()!==`true`&&expectDockerSuccess(await e.cli.run([`start`,LOCAL_REGISTRY_CONTAINER]),`restart the local microsandbox image registry`):expectDockerSuccess(await e.cli.run([`run`,`--detach`,`--name`,LOCAL_REGISTRY_CONTAINER,`--publish`,`${LOCAL_REGISTRY_HOST}:5000`,`registry:2`]),`start the local microsandbox image registry`);let n=`${LOCAL_REGISTRY_HOST}/eve/${e.imageReference.replace(`:`,`-`)}`;return expectDockerSuccess(await e.cli.run([`tag`,e.imageReference,n]),`tag microsandbox image "${n}"`),expectDockerSuccess(await e.cli.run([`push`,n]),`publish microsandbox image "${n}"`),n}function isFileNotFoundError(e){return e instanceof Error&&`code`in e&&e.code===`ENOENT`}async function hashDirectory(e){let t=createHash(`sha256`),n=await collectFilePaths(e);for(let r of n)t.update(relative(e,r)),t.update(`\0`),t.update(await readFile(r)),t.update(`\0`);return t.digest(`hex`)}async function collectFilePaths(e){let t=[];for(let n of await readdir(e,{withFileTypes:!0})){let r=join(e,n.name);n.isDirectory()?t.push(...await collectFilePaths(r)):n.isFile()&&t.push(r)}return t.sort()}export{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile,publishDockerImageForMicrosandbox,resolveSandboxDockerfile};