eve 0.63.0 → 0.64.1

package/dist/src/execution/sandbox/bash.js

@@ -1 +1 @@
-import{isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{truncateTail}from"#execution/sandbox/truncate-output.js";async function executeBashOnSandbox(e,t){let n=await runWithDevelopmentSandboxProgress(e,t.command),r=truncateTail(n.stdout),i=truncateTail(n.stderr),a=r.truncated||i.truncated,o=r.output;r.truncated&&(o=`[stdout truncated: showing last ${r.outputLines} of ${r.totalLines} lines]\n`+o);let s=i.output;return i.truncated&&(s=`[stderr truncated: showing last ${i.outputLines} of ${i.totalLines} lines]\n`+s),{exitCode:n.exitCode,stderr:s,stdout:o,truncated:a}}async function runWithDevelopmentSandboxProgress(e,t){if(logDevelopmentSandboxCommand(`eve: starting sandbox command: ${formatCommand(t)}`),!isEveDevEnvironment())return await e.run({command:t});let n=Date.now(),r=setInterval(()=>{logDevelopmentSandboxCommand(`eve: waiting for sandbox command (${Math.round((Date.now()-n)/1e3)}s elapsed): ${formatCommand(t)}`)},5e3);r.unref?.();try{let n=await e.run({command:t});return logDevelopmentSandboxCommand(`eve: sandbox command finished (exit ${n.exitCode}): ${formatCommand(t)}`),n}catch(e){throw logDevelopmentSandboxCommand(`eve: sandbox command failed: ${formatCommand(t)}`),e}finally{clearInterval(r)}}function logDevelopmentSandboxCommand(e){isEveDevEnvironment()&&console.log(e)}function formatCommand(e){let t=e.replaceAll(/\s+/g,` `).trim();return t.length<=240?t:`${t.slice(0,239)}…`}export{executeBashOnSandbox};
+import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{truncateTail}from"#execution/sandbox/truncate-output.js";async function executeBashOnSandbox(e,t){let n=await runWithDevelopmentSandboxProgress(e,t.command),r=truncateTail(n.stdout),i=truncateTail(n.stderr),a=r.truncated||i.truncated,o=r.output;r.truncated&&(o=`[stdout truncated: showing last ${r.outputLines} of ${r.totalLines} lines]\n`+o);let s=i.output;return i.truncated&&(s=`[stderr truncated: showing last ${i.outputLines} of ${i.totalLines} lines]\n`+s),{exitCode:n.exitCode,stderr:s,stdout:o,truncated:a}}async function runWithDevelopmentSandboxProgress(e,t){if(logDevelopmentSandboxCommand(`eve: starting sandbox command: ${formatCommand(t)}`),!isEveDevEnvironment())return await e.run({command:t});let n=Date.now(),r=setInterval(()=>{logDevelopmentSandboxCommand(`eve: waiting for sandbox command (${Math.round((Date.now()-n)/1e3)}s elapsed): ${formatCommand(t)}`)},5e3);r.unref?.();try{let n=await e.run({command:t});return logDevelopmentSandboxCommand(`eve: sandbox command finished (exit ${n.exitCode}): ${formatCommand(t)}`),n}catch(e){throw logDevelopmentSandboxCommand(`eve: sandbox command failed: ${formatCommand(t)}`),e}finally{clearInterval(r)}}function logDevelopmentSandboxCommand(e){isEveDevEnvironment()&&console.log(e)}function formatCommand(e){let t=e.replaceAll(/\s+/g,` `).trim();return t.length<=240?t:`${t.slice(0,239)}…`}export{executeBashOnSandbox};

package/dist/src/execution/sandbox/bindings/docker-cli.d.ts

@@ -72,7 +72,7 @@ export declare function assertDockerDaemonAvailable(cli: DockerCli): Promise<voi
  * containers, for `defaultSandbox()`'s availability chain. eve's Docker
  * sandbox image is Linux-only, so a Windows-container daemon is not a
  * compatible default even though it answers the Docker CLI. The result is
- * cached for the process lifetime: backend selection must be stable, and
+ * cached for the process lifetime: provider selection must be stable, and
  * the probe costs a subprocess round-trip.
  */
 export declare function isLinuxDockerDaemonAvailableSync(): boolean;

package/dist/src/execution/sandbox/bindings/docker-cli.js

@@ -1,2 +1,2 @@
-import{Readable}from"node:stream";import{spawn,spawnSync}from"node:child_process";var DockerUnavailableError=class extends Error{hint="Install and start Docker Desktop, OrbStack, Colima, or another runtime exposing a Docker-compatible `docker` CLI (or point EVE_DOCKER_PATH at one, e.g. Podman). Alternatively use microsandbox(), the dependency-free justbash(), vercel(), or defaultSandbox() to pick by availability.";constructor(e){super("The Docker sandbox backend requires Docker, but the `docker` CLI was not found.",{cause:e}),this.name=`DockerUnavailableError`}},DockerDaemonUnavailableError=class extends Error{hint="Start Docker Desktop (or your Docker-compatible runtime) and retry. Alternatively use microsandbox(), the dependency-free justbash() (installed automatically by `eve dev`, or `pnpm add -D just-bash`), vercel(), or defaultSandbox() to pick by availability.";constructor(e){super(`The Docker sandbox backend requires a running Docker daemon, but it is not reachable. Docker reported: ${e}`),this.name=`DockerDaemonUnavailableError`}};async function assertDockerDaemonAvailable(e){let t=await e.run([`version`,`--format`,`{{.Server.Version}}`]);if(t.exitCode!==0)throw new DockerDaemonUnavailableError(firstLine(t.stderr)||`exit ${t.exitCode}`)}function resolveDockerExecutable(){let e=process.env.EVE_DOCKER_PATH?.trim();return e!==void 0&&e.length>0?e:`docker`}let cachedLinuxDockerAvailability;function isLinuxDockerDaemonAvailableSync(){return cachedLinuxDockerAvailability??=probeLinuxDockerDaemonSync(),cachedLinuxDockerAvailability}function probeLinuxDockerDaemonSync(){try{let e=spawnSync(resolveDockerExecutable(),[`version`,`--format`,`{{.Server.Os}}`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`],timeout:5e3});return e.status===0&&e.stdout.trim().toLowerCase()===`linux`}catch{return!1}}function createDockerCli(){return{async run(e,t={}){throwIfAborted(t.signal);let n=spawn(resolveDockerExecutable(),e,{signal:t.signal,stdio:[t.stdin===void 0?`ignore`:`pipe`,`pipe`,`pipe`]}),r=[],i=[];n.stdout?.on(`data`,e=>r.push(e)),n.stderr?.on(`data`,e=>i.push(e)),t.stdin!==void 0&&n.stdin?.end(t.stdin);let a=await new Promise((e,t)=>{n.on(`error`,e=>t(adaptSpawnError(e))),n.on(`close`,t=>e(t??1))}),o=Buffer.concat(r);return{exitCode:a,stderr:Buffer.concat(i).toString(`utf8`),stdout:o.toString(`utf8`),stdoutBytes:o}},stream(e,t={}){throwIfAborted(t.signal);let n=spawn(resolveDockerExecutable(),e,{signal:t.signal,stdio:[`ignore`,`pipe`,`pipe`]}),r=new Promise((e,t)=>{n.on(`error`,e=>t(adaptSpawnError(e))),n.on(`close`,t=>e(t??1))});return r.catch(()=>{}),{stdout:Readable.toWeb(n.stdout),stderr:Readable.toWeb(n.stderr),async wait(){return{exitCode:await r}},async kill(){n.kill(`SIGKILL`),await r.catch(()=>{})}}}}}function adaptSpawnError(e){return e.code===`ENOENT`?new DockerUnavailableError(e):e.code===`ABORT_ERR`?new DOMException(`The operation was aborted.`,`AbortError`):e}function throwIfAborted(e){if(e?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`)}function firstLine(e){return e.split(`
+import{Readable}from"node:stream";import{spawn,spawnSync}from"node:child_process";var DockerUnavailableError=class extends Error{hint="Install and start Docker Desktop, OrbStack, Colima, or another runtime exposing a Docker-compatible `docker` CLI (or point EVE_DOCKER_PATH at one, e.g. Podman). Alternatively use MicrosandboxSandbox, the dependency-free JustBashSandbox, VercelSandbox, or DefaultSandbox to pick by availability.";constructor(e){super("The Docker sandbox provider requires Docker, but the `docker` CLI was not found.",{cause:e}),this.name=`DockerUnavailableError`}},DockerDaemonUnavailableError=class extends Error{hint="Start Docker Desktop (or your Docker-compatible runtime) and retry. Alternatively use MicrosandboxSandbox, the dependency-free JustBashSandbox (installed automatically by `eve dev`, or `pnpm add -D just-bash`), VercelSandbox, or DefaultSandbox to pick by availability.";constructor(e){super(`The Docker sandbox provider requires a running Docker daemon, but it is not reachable. Docker reported: ${e}`),this.name=`DockerDaemonUnavailableError`}};async function assertDockerDaemonAvailable(e){let t=await e.run([`version`,`--format`,`{{.Server.Version}}`]);if(t.exitCode!==0)throw new DockerDaemonUnavailableError(firstLine(t.stderr)||`exit ${t.exitCode}`)}function resolveDockerExecutable(){let e=process.env.EVE_DOCKER_PATH?.trim();return e!==void 0&&e.length>0?e:`docker`}let cachedLinuxDockerAvailability;function isLinuxDockerDaemonAvailableSync(){return cachedLinuxDockerAvailability??=probeLinuxDockerDaemonSync(),cachedLinuxDockerAvailability}function probeLinuxDockerDaemonSync(){try{let e=spawnSync(resolveDockerExecutable(),[`version`,`--format`,`{{.Server.Os}}`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`],timeout:5e3});return e.status===0&&e.stdout.trim().toLowerCase()===`linux`}catch{return!1}}function createDockerCli(){return{async run(e,t={}){throwIfAborted(t.signal);let n=spawn(resolveDockerExecutable(),e,{signal:t.signal,stdio:[t.stdin===void 0?`ignore`:`pipe`,`pipe`,`pipe`]}),r=[],i=[];n.stdout?.on(`data`,e=>r.push(e)),n.stderr?.on(`data`,e=>i.push(e)),t.stdin!==void 0&&n.stdin?.end(t.stdin);let a=await new Promise((e,t)=>{n.on(`error`,e=>t(adaptSpawnError(e))),n.on(`close`,t=>e(t??1))}),o=Buffer.concat(r);return{exitCode:a,stderr:Buffer.concat(i).toString(`utf8`),stdout:o.toString(`utf8`),stdoutBytes:o}},stream(e,t={}){throwIfAborted(t.signal);let n=spawn(resolveDockerExecutable(),e,{signal:t.signal,stdio:[`ignore`,`pipe`,`pipe`]}),r=new Promise((e,t)=>{n.on(`error`,e=>t(adaptSpawnError(e))),n.on(`close`,t=>e(t??1))});return r.catch(()=>{}),{stdout:Readable.toWeb(n.stdout),stderr:Readable.toWeb(n.stderr),async wait(){return{exitCode:await r}},async kill(){n.kill(`SIGKILL`),await r.catch(()=>{})}}}}}function adaptSpawnError(e){return e.code===`ENOENT`?new DockerUnavailableError(e):e.code===`ABORT_ERR`?new DOMException(`The operation was aborted.`,`AbortError`):e}function throwIfAborted(e){if(e?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`)}function firstLine(e){return e.split(`
 `,1)[0]?.trim()??``}export{DockerDaemonUnavailableError,DockerUnavailableError,assertDockerDaemonAvailable,createDockerCli,isLinuxDockerDaemonAvailableSync};

package/dist/src/execution/sandbox/bindings/docker-container.d.ts

@@ -1,6 +1,5 @@
 import type { DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
 import type { ResolvedDockerSandboxOptions } from "#execution/sandbox/bindings/docker-options.js";
-import type { SandboxBackendTags } from "#public/definitions/sandbox-backend.js";
 import type { DockerSandboxNetworkPolicy } from "#public/sandbox/docker-sandbox.js";
 export declare const DOCKER_SANDBOX_LABEL = "eve.sandbox";
 export declare function startDockerContainer(input: {
@@ -9,8 +8,9 @@ export declare function startDockerContainer(input: {
     readonly image: string;
     readonly initialNetworkPolicy: DockerSandboxNetworkPolicy;
     readonly options: ResolvedDockerSandboxOptions;
+    readonly resourcesPath?: string;
     readonly role: "session" | "template-build";
-    readonly tags?: SandboxBackendTags;
+    readonly tags?: Readonly<Record<string, string>>;
 }): Promise<void>;
 export declare function runDockerBaseSetup(cli: DockerCli, containerName: string): Promise<void>;
 export declare function stopDockerContainerIfRunning(cli: DockerCli, containerName: string): Promise<void>;

package/dist/src/execution/sandbox/bindings/docker-container.js

@@ -1 +1 @@
-import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";const DOCKER_SANDBOX_LABEL=`eve.sandbox`,DOCKER_KEEPALIVE_ARGS=[`-c`,`sleep 2147483647`];async function startDockerContainer(e){let t=[`run`,`-d`,`--name`,e.containerName,`--label`,`${DOCKER_SANDBOX_LABEL}=1`,`--label`,`${DOCKER_SANDBOX_LABEL}.role=${e.role}`];for(let[n,r]of Object.entries(withDevelopmentSandboxTags(e.tags)??{}))t.push(`--label`,`${DOCKER_SANDBOX_LABEL}.tag.${n}=${r}`);for(let[n,r]of Object.entries(e.options.env))t.push(`-e`,`${n}=${r}`);e.initialNetworkPolicy===`deny-all`&&t.push(`--network`,`none`),t.push(`--workdir`,WORKSPACE_ROOT,`--entrypoint`,`/bin/sh`,e.image,...DOCKER_KEEPALIVE_ARGS),expectDockerSuccess(await e.cli.run(t),`start sandbox container "${e.containerName}" from "${e.image}"`)}async function runDockerBaseSetup(e,t){expectDockerSuccess(await e.run([`exec`,`--user`,`root`,t,`/bin/sh`,`-c`,buildDockerBaseSetupScript()]),`prepare base runtime in sandbox container "${t}"`)}async function stopDockerContainerIfRunning(e,t){await e.run([`stop`,`-t`,`0`,t]).catch(()=>{})}export{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning};
+import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";const DOCKER_SANDBOX_LABEL=`eve.sandbox`,DOCKER_KEEPALIVE_ARGS=[`-c`,`sleep 2147483647`];async function startDockerContainer(e){let t=[`run`,`-d`,`--name`,e.containerName,`--label`,`${DOCKER_SANDBOX_LABEL}=1`,`--label`,`${DOCKER_SANDBOX_LABEL}.role=${e.role}`];for(let[n,r]of Object.entries(withDevelopmentSandboxTags(e.tags)??{}))t.push(`--label`,`${DOCKER_SANDBOX_LABEL}.tag.${n}=${r}`);for(let[n,r]of Object.entries(e.options.env))t.push(`-e`,`${n}=${r}`);e.initialNetworkPolicy===`deny-all`&&t.push(`--network`,`none`),e.resourcesPath!==void 0&&t.push(`--mount`,`type=bind,src=${e.resourcesPath},dst=/eve/resources,readonly`),t.push(`--workdir`,WORKSPACE_ROOT,`--entrypoint`,`/bin/sh`,e.image,...DOCKER_KEEPALIVE_ARGS),expectDockerSuccess(await e.cli.run(t),`start sandbox container "${e.containerName}" from "${e.image}"`)}async function runDockerBaseSetup(e,t){expectDockerSuccess(await e.run([`exec`,`--user`,`root`,t,`/bin/sh`,`-c`,buildDockerBaseSetupScript()]),`prepare base runtime in sandbox container "${t}"`)}async function stopDockerContainerIfRunning(e,t){await e.run([`stop`,`-t`,`0`,t]).catch(()=>{})}export{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning};

package/dist/src/execution/sandbox/bindings/docker-network.d.ts

@@ -3,6 +3,6 @@ import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 /**
  * Applies a coarse-grained run-time network policy by attaching or
  * detaching the container's networks. Domain-level policies and
- * credential brokering require the firewall on the Vercel backend.
+ * credential brokering require the firewall on the Vercel provider.
  */
 export declare function setDockerNetworkPolicy(cli: DockerCli, containerName: string, policy: SandboxNetworkPolicy): Promise<void>;

package/dist/src/execution/sandbox/bindings/docker-network.js

@@ -1 +1 @@
-import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";async function setDockerNetworkPolicy(e,t,n){if(n!==`allow-all`&&n!==`deny-all`)throw Error(`The local Docker sandbox backend supports only the "allow-all" and "deny-all" network policies. Domain-level allow-lists and credential brokering require the Vercel backend (vercel()) or microsandbox().`);let r=await e.run([`container`,`inspect`,`--format`,`{{json .NetworkSettings.Networks}}`,t]);expectDockerSuccess(r,`inspect networks of sandbox container "${t}"`);let i=Object.keys(JSON.parse(r.stdout.trim()===``?`{}`:r.stdout));if(n===`deny-all`){for(let n of i)expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,n,t]),`disconnect sandbox container "${t}" from network "${n}"`);return}i.includes(`bridge`)||(i.includes(`none`)&&expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,`none`,t]),`detach sandbox container "${t}" from the none network`),expectDockerSuccess(await e.run([`network`,`connect`,`bridge`,t]),`connect sandbox container "${t}" to the bridge network`))}export{setDockerNetworkPolicy};
+import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";async function setDockerNetworkPolicy(e,t,n){if(n!==`allow-all`&&n!==`deny-all`)throw Error(`The local Docker sandbox provider supports only the "allow-all" and "deny-all" network policies. Domain-level allow-lists and credential brokering require the Vercel provider (VercelSandbox) or MicrosandboxSandbox.`);let r=await e.run([`container`,`inspect`,`--format`,`{{json .NetworkSettings.Networks}}`,t]);expectDockerSuccess(r,`inspect networks of sandbox container "${t}"`);let i=JSON.parse(r.stdout.trim()===``?`{}`:r.stdout);if(typeof i!=`object`||!i)throw Error(`Docker returned invalid network settings for "${t}".`);let a=Object.keys(i);if(n===`deny-all`){for(let n of a)expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,n,t]),`disconnect sandbox container "${t}" from network "${n}"`);return}a.includes(`bridge`)||(a.includes(`none`)&&expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,`none`,t]),`detach sandbox container "${t}" from the none network`),expectDockerSuccess(await e.run([`network`,`connect`,`bridge`,t]),`connect sandbox container "${t}" to the bridge network`))}export{setDockerNetworkPolicy};

package/dist/src/execution/sandbox/bindings/docker-options.d.ts

@@ -1,21 +1,20 @@
-import type { DockerSandboxCreateOptions, DockerSandboxNetworkPolicy, DockerSandboxPullPolicy } from "#public/sandbox/docker-sandbox.js";
+import type { DockerSandboxEnvironmentOptions, DockerSandboxPullPolicy } from "#public/sandbox/docker-sandbox.js";
 /**
- * Default base image for the Docker backend: eve's published sandbox
+ * Default base image for the Docker provider: eve's published sandbox
  * runtime image.
  */
 export declare const DEFAULT_DOCKER_SANDBOX_IMAGE: string;
 /**
- * Fully-defaulted Docker backend options consumed by the backend
+ * Fully-defaulted Docker provider options consumed by the provider
  * implementation.
  */
 export interface ResolvedDockerSandboxOptions {
     readonly env: Readonly<Record<string, string>>;
     readonly image: string;
-    readonly networkPolicy: DockerSandboxNetworkPolicy;
     readonly pullPolicy: DockerSandboxPullPolicy;
 }
 /**
  * Applies defaults to `docker(opts)`.
  */
-export declare function resolveDockerSandboxOptions(options?: DockerSandboxCreateOptions): ResolvedDockerSandboxOptions;
+export declare function resolveDockerSandboxOptions(options?: DockerSandboxEnvironmentOptions): ResolvedDockerSandboxOptions;
 export declare function createDockerSandboxOptionsHash(options: ResolvedDockerSandboxOptions): string;

package/dist/src/execution/sandbox/bindings/docker-options.js

@@ -1 +1 @@
-import{createHash}from"node:crypto";import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const DEFAULT_DOCKER_SANDBOX_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE;function resolveDockerSandboxOptions(e={}){return{env:e.env??{},image:e.image??DEFAULT_DOCKER_SANDBOX_IMAGE,networkPolicy:e.networkPolicy??`allow-all`,pullPolicy:e.pullPolicy??`if-not-present`}}function createDockerSandboxOptionsHash(e){return createHash(`sha256`).update(JSON.stringify(dockerOptionsForHash(e))).digest(`hex`).slice(0,20)}function dockerOptionsForHash(e){return{env:sortStringRecord(e.env),image:e.image,networkPolicy:e.networkPolicy,pullPolicy:e.pullPolicy}}function sortStringRecord(e){return Object.fromEntries(Object.entries(e).sort(([e],[t])=>e.localeCompare(t)))}export{DEFAULT_DOCKER_SANDBOX_IMAGE,createDockerSandboxOptionsHash,resolveDockerSandboxOptions};
+import{createHash}from"node:crypto";import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const DEFAULT_DOCKER_SANDBOX_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE;function resolveDockerSandboxOptions(e={}){return{env:e.env??{},image:e.image??DEFAULT_DOCKER_SANDBOX_IMAGE,pullPolicy:e.pullPolicy??`if-not-present`}}function createDockerSandboxOptionsHash(e){return createHash(`sha256`).update(JSON.stringify(dockerOptionsForHash(e))).digest(`hex`).slice(0,20)}function dockerOptionsForHash(e){return{env:sortStringRecord(e.env),image:e.image,pullPolicy:e.pullPolicy}}function sortStringRecord(e){return Object.fromEntries(Object.entries(e).sort(([e],[t])=>e.localeCompare(t)))}export{DEFAULT_DOCKER_SANDBOX_IMAGE,createDockerSandboxOptionsHash,resolveDockerSandboxOptions};

package/dist/src/execution/sandbox/bindings/docker-session.d.ts

@@ -3,5 +3,4 @@ import type { InternalSandboxSession } from "#shared/sandbox-session.js";
 export declare function createDockerInternalSession(input: {
     readonly cli: DockerCli;
     readonly containerIdentity: string;
-    readonly id: string;
 }): InternalSandboxSession;

package/dist/src/execution/sandbox/bindings/docker-session.js

@@ -1,2 +1,2 @@
-import{randomUUID}from"node:crypto";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{dirname}from"node:path/posix";import{resolveWorkspacePath}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";const DOCKER_KILL_TREE_SCRIPT=[`pid_file="$1"`,`target="$(cat "$pid_file" 2>/dev/null)" || exit 0`,`[ -n "$target" ] || exit 0`,`kill_tree() {`,`  local parent="$1" dir child ppid line`,`  for dir in /proc/[0-9]*; do`,'    child="${dir#/proc/}"',`    ppid=""`,`    while IFS= read -r line; do`,`      case "$line" in`,'        PPid:*) ppid="${line#PPid:}"; ppid="${ppid//[^0-9]/}"; break ;;',`      esac`,`    done < "$dir/status" 2>/dev/null`,`    [ "$ppid" = "$parent" ] && kill_tree "$child"`,`  done`,`  kill -9 "$parent" 2>/dev/null`,`}`,`kill_tree "$target"`,`rm -f "$pid_file"`,`exit 0`].join(`
-`);function createDockerInternalSession(e){let{cli:t,containerIdentity:n}=e;async function killSpawnTree(e){await t.run([`exec`,n,`bash`,`-c`,DOCKER_KILL_TREE_SCRIPT,`eve-kill-tree`,e]).catch(()=>{})}return{id:e.id,resolvePath:resolveWorkspacePath,async spawn(e){let r=[`exec`,`-w`,resolveWorkspacePath(e.workingDirectory??WORKSPACE_ROOT)];for(let[t,n]of Object.entries(e.env??{}))r.push(`-e`,`${t}=${n}`);let i=`/tmp/.eve-sbx-spawn-${randomUUID()}.pid`,a=`echo "$$" > ${shellQuote(i)}; bash -lc ${shellQuote(e.command)}; status=$?; rm -f ${shellQuote(i)}; exit $status`;r.push(n,`bash`,`-c`,a);let o=t.stream(r,{signal:e.abortSignal});return e.abortSignal?.addEventListener(`abort`,()=>void killSpawnTree(i),{once:!0}),{stdout:o.stdout,stderr:o.stderr,async wait(){return await o.wait()},async kill(){await killSpawnTree(i),await o.kill()}}},async readFile(e){let r=shellQuote(e.path),i=await t.run([`exec`,n,`bash`,`-lc`,`if [ -e ${r} ]; then exec cat ${r}; else exit 43; fi`],{signal:e.abortSignal});return i.exitCode===43?null:(expectDockerSuccess(i,`read "${e.path}" from sandbox container`),bufferToStream(i.stdoutBytes))},async removePath(e){let r=`${e.recursive===!0?`r`:``}${e.force===!0?`f`:``}`,i=[`exec`,n,`rm`,...r.length>0?[`-${r}`]:[],`--`,e.path],a=await t.run(i,{signal:e.abortSignal});expectDockerSuccess(a,`remove "${e.path}" from sandbox container`)},async writeFile(e){let r=await streamToBuffer(e.content),i=await t.run([`exec`,`-i`,n,`bash`,`-lc`,`mkdir -p ${shellQuote(dirname(e.path))} && cat > ${shellQuote(e.path)}`],{signal:e.abortSignal,stdin:r});expectDockerSuccess(i,`write "${e.path}" into sandbox container`)}}}export{createDockerInternalSession};
+import{randomUUID}from"node:crypto";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{dirname}from"node:path/posix";import{resolveWorkspacePath}from"#execution/sandbox/bindings/local-provider-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";const DOCKER_KILL_TREE_SCRIPT=[`pid_file="$1"`,`target="$(cat "$pid_file" 2>/dev/null)" || exit 0`,`[ -n "$target" ] || exit 0`,`kill_tree() {`,`  local parent="$1" dir child ppid line`,`  for dir in /proc/[0-9]*; do`,'    child="${dir#/proc/}"',`    ppid=""`,`    while IFS= read -r line; do`,`      case "$line" in`,'        PPid:*) ppid="${line#PPid:}"; ppid="${ppid//[^0-9]/}"; break ;;',`      esac`,`    done < "$dir/status" 2>/dev/null`,`    [ "$ppid" = "$parent" ] && kill_tree "$child"`,`  done`,`  kill -9 "$parent" 2>/dev/null`,`}`,`kill_tree "$target"`,`rm -f "$pid_file"`,`exit 0`].join(`
+`);function createDockerInternalSession(e){let{cli:t,containerIdentity:n}=e;async function killSpawnTree(e){await t.run([`exec`,n,`bash`,`-c`,DOCKER_KILL_TREE_SCRIPT,`eve-kill-tree`,e]).catch(()=>{})}return{resolvePath:resolveWorkspacePath,async spawn(e){let r=[`exec`,`-w`,resolveWorkspacePath(e.workingDirectory??WORKSPACE_ROOT)];for(let[t,n]of Object.entries(e.env??{}))r.push(`-e`,`${t}=${n}`);let i=`/tmp/.eve-sbx-spawn-${randomUUID()}.pid`,a=`echo "$$" > ${shellQuote(i)}; bash -lc ${shellQuote(e.command)}; status=$?; rm -f ${shellQuote(i)}; exit $status`;r.push(n,`bash`,`-c`,a);let o=t.stream(r,{signal:e.abortSignal});return e.abortSignal?.addEventListener(`abort`,()=>void killSpawnTree(i),{once:!0}),{stdout:o.stdout,stderr:o.stderr,async wait(){return await o.wait()},async kill(){await killSpawnTree(i),await o.kill()}}},async readFile(e){let r=shellQuote(e.path),i=await t.run([`exec`,n,`bash`,`-lc`,`if [ -e ${r} ]; then exec cat ${r}; else exit 43; fi`],{signal:e.abortSignal});return i.exitCode===43?null:(expectDockerSuccess(i,`read "${e.path}" from sandbox container`),bufferToStream(i.stdoutBytes))},async removePath(e){let r=`${e.recursive===!0?`r`:``}${e.force===!0?`f`:``}`,i=[`exec`,n,`rm`,...r.length>0?[`-${r}`]:[],`--`,e.path],a=await t.run(i,{signal:e.abortSignal});expectDockerSuccess(a,`remove "${e.path}" from sandbox container`)},async writeFile(e){let r=await streamToBuffer(e.content),i=await t.run([`exec`,`-i`,n,`bash`,`-lc`,`mkdir -p ${shellQuote(dirname(e.path))} && cat > ${shellQuote(e.path)}`],{signal:e.abortSignal,stdin:r});expectDockerSuccess(i,`write "${e.path}" into sandbox container`)}}}export{createDockerInternalSession};

package/dist/src/execution/sandbox/bindings/docker.d.ts

@@ -1,33 +1,31 @@
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
 import { type DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
-import type { DockerSandboxCreateOptions } from "#public/sandbox/docker-sandbox.js";
+import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+import type { DockerSandboxEnvironmentOptions, DockerSandboxRuntimeOptions } from "#public/sandbox/docker-sandbox.js";
 export { DOCKER_TEMPLATE_IMAGE_REPOSITORY, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker-templates.js";
 /**
- * Stable backend name. Participates in template/session key derivation
- * and persisted reconnect state.
+ * Stable provider name used for prepared-artifact storage and provider identity.
  */
-export declare const DOCKER_BACKEND_NAME = "docker";
+export declare const DOCKER_PROVIDER_NAME = "docker";
+type DockerSandboxPreparedArtifact = {
+    readonly imageReference: string;
+};
+type DockerSandboxSessionState = {
+    readonly containerName: string;
+    readonly generation: string;
+    readonly version: 2;
+};
 /**
- * Construction input for {@link createDockerSandboxBackend}. Internal —
- * the public surface is the `docker()` factory under
- * `eve/sandbox`.
- */
-export interface CreateDockerSandboxBackendInput {
-    readonly createOptions?: DockerSandboxCreateOptions;
-    /** Injectable Docker driver so backend logic is testable without a daemon. */
-    readonly dockerCli?: DockerCli;
-}
-/**
- * Creates the Docker sandbox backend.
+ * Creates the Docker sandbox provider.
  *
  * Two-phase lifecycle mapped onto Docker primitives:
  *
  * - `prewarm` runs the base image, applies base setup, runs the
- *   authored `bootstrap`, writes seed files, then `docker commit`s the
+ *   authored preparation, writes seed files, then `docker commit`s the
  *   container into a reusable template image.
  * - `create` starts (or restarts) one long-lived container per session
  *   key from the template image. The container's filesystem carries
  *   session state across reconnects, so `shutdown` only stops the
  *   container and the next `create` restarts it with state intact.
  */
-export declare function createDockerSandboxBackend(input?: CreateDockerSandboxBackendInput): SandboxBackend;
+export declare function createDockerSandboxProvider(createOptions?: DockerSandboxEnvironmentOptions, dockerCli?: DockerCli): SandboxProviderImplementation<DockerSandboxRuntimeOptions, DockerSandboxPreparedArtifact, DockerSandboxSessionState, MutableNetworkSandboxSession>;

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";const DOCKER_BACKEND_NAME=`docker`;function createDockerSandboxBackend(e={}){let t=e.dockerCli??createDockerCli(),n=resolveDockerSandboxOptions(e.createOptions),r=createDockerSandboxOptionsHash(n),i;function ensureDaemon(){return i??=assertDockerDaemonAvailable(t).catch(e=>{throw i=void 0,e}),i}return{name:DOCKER_BACKEND_NAME,async prewarm(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let i={optionsHash:r,templateKey:e.templateKey},a=dockerTemplateImageReference(i),o=resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,i);if(e.log?.(`checking cached template image "${a}"`),await dockerImageExists(t,a))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(o,a),{reused:!0};e.log?.(`checking base image "${n.image}"`),await ensureDockerBaseImage(t,n);let s=`${e.templateKey}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:t,containerName:s,image:n.image,initialNetworkPolicy:`allow-all`,options:n,role:`template-build`});try{let r=await resolveDockerHandleIdentity(t,s);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(t,r),n.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await setDockerNetworkPolicy(t,r,n.networkPolicy));let i=buildSandboxSession(createDockerInternalSession({cli:t,containerIdentity:r,id:e.templateKey}),e=>setDockerNetworkPolicy(t,r,e));e.seedFiles.length>0&&e.log?.(`writing ${e.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(i,e.seedFiles),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async()=>createLoggingSandboxSession({log:e.log,session:i})})),e.log?.(`stopping template build container`),expectDockerSuccess(await t.run([`stop`,`-t`,`0`,r]),`stop template build container "${s}"`),e.log?.(`committing template image "${a}"`),expectDockerSuccess(await t.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${e.templateKey}`,r,a]),`commit sandbox template image "${a}"`),await touchDockerTemplateMarker(o,a)}finally{await t.run([`rm`,`-f`,s]).catch(()=>{})}return{reused:!1}},async create(e){await ensureDaemon();let i=getDockerContainerName(e.existingMetadata)??e.sessionKey,a=await t.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,i]);if(a.exitCode===0)a.stdout.trim()!==`true`&&expectDockerSuccess(await t.run([`start`,i]),`restart sandbox session container "${i}"`);else{let a;if(e.templateKey===null)await ensureDockerBaseImage(t,n),a=n.image;else{let n={optionsHash:r,templateKey:e.templateKey};if(a=dockerTemplateImageReference(n),!await dockerImageExists(t,a))throw new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey});await touchDockerTemplateMarker(resolveDockerTemplateMarkerPath(e.runtimeContext.appRoot,n),a)}try{await startDockerContainer({cli:t,containerName:i,image:a,initialNetworkPolicy:e.templateKey===null?`allow-all`:n.networkPolicy,options:n,role:`session`,tags:e.tags})}catch(t){throw e.templateKey===null?t:new SandboxTemplateNotProvisionedError({backendName:DOCKER_BACKEND_NAME,templateKey:e.templateKey})}e.templateKey===null&&(await runDockerBaseSetup(t,i),n.networkPolicy!==`allow-all`&&await setDockerNetworkPolicy(t,i,n.networkPolicy))}let o=await resolveDockerHandleIdentity(t,i),s=buildSandboxSession(createDockerInternalSession({cli:t,containerIdentity:o,id:e.sessionKey}),e=>setDockerNetworkPolicy(t,o,e));return{session:s,useSessionFn:async()=>s,async captureState(){return{backendName:DOCKER_BACKEND_NAME,metadata:{containerName:i},sessionKey:e.sessionKey}},async delete(){await stopDockerContainerIfRunning(t,o),expectDockerSuccess(await t.run([`rm`,`-f`,o]),`delete sandbox session container "${i}"`)},async stop(){await stopDockerContainerIfRunning(t,o)},async shutdown(){await stopDockerContainerIfRunning(t,o)}}}}}function getDockerContainerName(e){let t=e?.containerName;return typeof t==`string`?t:void 0}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_BACKEND_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxBackend,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,a]);if(c.exitCode===0)c.stdout.trim()!==`true`&&expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);else{if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}})}let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSessionDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSessionStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),expectDockerSuccess(await n.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${o}`,t,c]),`commit sandbox template image "${c}"`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/immutable-resources.d.ts

@@ -0,0 +1,21 @@
+import { type SandboxProviderResources } from "#shared/sandbox-provider.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+export declare const SANDBOX_RESOURCES_ROOT = "/eve/resources";
+export declare function resolveImmutableResourcesPath(input: {
+    readonly storagePath: string;
+    readonly provider: string;
+    readonly resourcesKey: string;
+}): string;
+export declare function prepareImmutableResources(input: {
+    readonly storagePath: string;
+    readonly provider: string;
+    readonly resourcesKey: string;
+    readonly sourcePath: string;
+}): Promise<string>;
+export declare function hydrateSandboxProviderResources(input: {
+    readonly copySkills?: boolean;
+    readonly log?: (message: string) => void;
+    readonly resources: SandboxProviderResources;
+    readonly session: SandboxSession;
+}): Promise<void>;
+export declare function hydrateSandboxFromImmutableResources(session: SandboxSession, copySkills?: boolean): Promise<void>;

package/dist/src/execution/sandbox/bindings/immutable-resources.js

@@ -0,0 +1,2 @@
+import{join}from"node:path";import{copyDirectoryAtomically,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-provider-utils.js";import{providerResourceTargetFiles}from"#shared/sandbox-provider.js";const SANDBOX_RESOURCES_ROOT=`/eve/resources`;function resolveImmutableResourcesPath(e){return join(e.storagePath,e.provider,`resources`,e.resourcesKey)}async function prepareImmutableResources(e){let t=resolveImmutableResourcesPath(e);return await copyDirectoryAtomically(e.sourcePath,t),t}async function hydrateSandboxProviderResources(e){switch(e.resources.source.kind){case`none`:case`inline`:await writeSandboxSeedFiles(e.session,providerResourceTargetFiles(e.resources));return;case`materialized`:e.log?.(`hydrating workspace and skills from read-only resources`),await hydrateSandboxFromImmutableResources(e.session,e.copySkills);return}}async function hydrateSandboxFromImmutableResources(e,t=!1){let n=t?[`  mkdir -p "$HOME/.agents/skills"`,`  cp -a ${SANDBOX_RESOURCES_ROOT}/skills/. "$HOME/.agents/skills/"`]:[`  ln -s ${SANDBOX_RESOURCES_ROOT}/skills "$HOME/.agents/skills"`],r=await e.run({command:[`set -e`,`if [ -d ${SANDBOX_RESOURCES_ROOT}/workspace ]; then cp -a ${SANDBOX_RESOURCES_ROOT}/workspace/. /workspace/; fi`,`if [ -d ${SANDBOX_RESOURCES_ROOT}/skills ]; then`,`  mkdir -p "$HOME/.agents"`,`  rm -rf "$HOME/.agents/skills"`,...n,`fi`].join(`
+`)});if(r.exitCode!==0)throw Error(`Failed to hydrate sandbox resources: ${r.stderr||r.stdout}`)}export{SANDBOX_RESOURCES_ROOT,hydrateSandboxFromImmutableResources,hydrateSandboxProviderResources,prepareImmutableResources,resolveImmutableResourcesPath};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.d.ts

@@ -1,8 +1,12 @@
-import type { SandboxBackendHandle } from "#public/definitions/sandbox-backend.js";
+import type { SandboxProviderHandle, SandboxProviderHost } from "#shared/sandbox-provider.js";
+import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
 import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
+export interface JustBashSessionMetadata {
+    readonly rootPath: string;
+}
 export interface BashSandbox {
-    captureState(): Promise<Record<string, unknown> | null>;
+    captureState(): Promise<JustBashSessionMetadata>;
     dispose(): Promise<void>;
     readFileBytes(path: string): Promise<Buffer | null>;
     removePath(options: SandboxRemovePathOptions): Promise<void>;
@@ -15,12 +19,13 @@ export interface BashSandbox {
     }>): Promise<void>;
 }
 export declare function createBashSandbox(input: {
-    readonly appRoot: string;
     readonly autoInstall: boolean;
+    readonly host: SandboxProviderHost;
     readonly customCommands?: JustBashSandboxCreateOptions["customCommands"];
     readonly filesystem?: JustBashSandboxCreateOptions["filesystem"];
     readonly rootPath: string;
     readonly sessionKey: string;
+    readonly storagePath: string;
 }): Promise<BashSandbox>;
 /**
  * The just-bash engine cannot honor a run-time network policy: just-bash takes
@@ -29,5 +34,4 @@ export declare function createBashSandbox(input: {
  * Throw rather than silently no-op so brokering code surfaces the gap instead
  * of leaking.
  */
-export declare function justBashSetNetworkPolicyUnsupported(): Promise<never>;
-export declare function createJustBashHandle(sandbox: BashSandbox, backendName: string): SandboxBackendHandle;
+export declare function createJustBashHandle(sandbox: BashSandbox): SandboxProviderHandle<FixedNetworkSandboxSession>;

package/dist/src/execution/sandbox/bindings/just-bash-runtime.js

@@ -1 +1 @@
-import{mkdir,readFile,rm,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-backend-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=loadOptionalEnginePackage({appRoot:e.appRoot,autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox backend requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use docker() / defaultSandbox() instead.",packageName:`just-bash`}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(e){let t=await loadJustBashModule({appRoot:e.appRoot,autoInstall:e.autoInstall}),{ReadWriteFs:n,Sandbox:r}=t,i=resolveLocalSandboxFilesystemRootPath(e.rootPath),a=resolveLocalSandboxMetadataPath(e.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(e.filesystem!==void 0)try{c=await e.filesystem({appRoot:e.appRoot,defaultFilesystem:s,justBash:t})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,customCommands:e.customCommands===void 0?void 0:[...e.customCommands],env:o?.env,fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:e.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:e.rootPath,sessionKey:e.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`,n=await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}async function justBashSetNetworkPolicyUnsupported(){throw Error(`setNetworkPolicy() is not supported on the just-bash sandbox backend. just-bash applies its network policy only at sandbox creation (no run-time update) and does not run git or other binaries. Use docker() for coarse egress control or vercel() / microsandbox() for credential brokering.`)}function createJustBashHandle(e,t){let n=buildSandboxSession(createFileBackedInternalSandboxSession({id:e.sessionKey,sandbox:e}),justBashSetNetworkPolicyUnsupported);return{session:n,useSessionFn:async()=>n,async captureState(){return{backendName:t,metadata:await e.captureState()??{},sessionKey:e.sessionKey}},async delete(){await e.dispose(),await rm(e.rootPath,{force:!0,recursive:!0})},async stop(){await e.dispose()},async shutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(e,t){await mkdir(dirname(e),{recursive:!0}),await writeFile(e,`${JSON.stringify(t,null,2)}\n`)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported};
+import{mkdir,readFile,rm,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-provider-utils.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=e.host.loadOptionalPackage({autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox provider requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use DockerSandbox or DefaultSandbox instead.",packageName:`just-bash`,ignoredOptionalDependencies:[`@mongodb-js/zstd`,`node-liblzma`]}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(e){let t=await loadJustBashModule({autoInstall:e.autoInstall,host:e.host}),{ReadWriteFs:n,Sandbox:r}=t,i=resolveLocalSandboxFilesystemRootPath(e.rootPath),a=resolveLocalSandboxMetadataPath(e.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(e.filesystem!==void 0)try{c=await e.filesystem({defaultFilesystem:s,resolveProjectPath:e.host.resolveProjectPath,storagePath:e.storagePath,justBash:t})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,customCommands:e.customCommands===void 0?void 0:[...e.customCommands],env:o===null?void 0:{...o.env},fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:e.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:e.rootPath,sessionKey:e.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`,n=await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:e.env,signal:e.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}function createJustBashHandle(e){return{sandbox:buildSandboxSession(createFileBackedInternalSandboxSession({sandbox:e})),async onSessionDelete(){await e.dispose(),await rm(e.rootPath,{force:!0,recursive:!0})},async onSessionStop(){await e.dispose()},async onRuntimeShutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return!isRecord(t)||t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(e,t){await mkdir(dirname(e),{recursive:!0}),await writeFile(e,`${JSON.stringify(t,null,2)}\n`)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle};

package/dist/src/execution/sandbox/bindings/just-bash.d.ts

@@ -1,33 +1,20 @@
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
-/**
- * Stable backend name. Participates in template/session key derivation
- * and persisted reconnect state.
- */
-export declare const JUST_BASH_BACKEND_NAME = "just-bash";
-/**
- * Construction input for {@link createJustBashSandboxBackend}. Internal —
- * the public surface is the `justbash()` factory under
- * `eve/sandbox`.
- */
-export interface CreateJustBashSandboxBackendInput {
-    readonly createOptions?: JustBashSandboxCreateOptions;
-}
-/**
- * Creates the just-bash sandbox backend.
- *
- * The cache directory is derived from the runtime context's `appRoot`
- * on every `create` call so the backend stays stateless and matches
- * the framework's per-call dispatch contract.
- */
-export declare function createJustBashSandboxBackend(input?: CreateJustBashSandboxBackendInput): SandboxBackend;
-/**
- * Removes stale just-bash sandbox template directories for one
- * application's cache.
- */
+import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
+import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+export declare const JUST_BASH_PROVIDER_NAME = "just-bash";
+type JustBashPreparedArtifact = {
+    readonly templateRootPath: string;
+};
+type JustBashSessionState = {
+    readonly generation: string;
+    readonly rootPath: string;
+    readonly version: 2;
+};
+export declare function createJustBashSandboxProvider(authoredOptions?: JustBashSandboxCreateOptions | undefined): SandboxProviderImplementation<undefined, JustBashPreparedArtifact, JustBashSessionState, FixedNetworkSandboxSession>;
 export declare function pruneJustBashSandboxTemplates(input: {
     readonly appRoot: string;
     readonly now?: number;
     readonly recentWindowMs?: number;
     readonly retainCount?: number;
 }): Promise<void>;
+export {};

package/dist/src/execution/sandbox/bindings/just-bash.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,readdir,rename,rm,stat}from"node:fs/promises";import{dirname,join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalBackendSessionRootPath,resolveLocalBackendTemplateRootPath,resolveLocalBackendTemplatesDirectory,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{createBashSandbox,createJustBashHandle,justBashSetNetworkPolicyUnsupported}from"#execution/sandbox/bindings/just-bash-runtime.js";const JUST_BASH_CACHE_DIRECTORY_NAME=`just-bash`,JUST_BASH_BACKEND_NAME=`just-bash`;function createJustBashSandboxBackend(e={}){let t=e.createOptions?.autoInstall??!0,n=e.createOptions?.customCommands,r=e.createOptions?.filesystem;return{name:JUST_BASH_BACKEND_NAME,async prewarm(e){let n=resolveTemplateRootPath(resolveSandboxCacheDirectory(e.runtimeContext.appRoot),e.templateKey);if(await pathExists(n))return await touchDirectory(n),{reused:!0};let r=`${n}.${randomUUID()}.tmp`,i=!1,a=await createBashSandbox({appRoot:e.runtimeContext.appRoot,autoInstall:t,rootPath:r,sessionKey:e.templateKey}),o=buildSandboxSession(createFileBackedInternalSandboxSession({id:a.sessionKey,sandbox:a}),justBashSetNetworkPolicyUnsupported);try{if(await writeSandboxSeedFiles(o,e.seedFiles),e.bootstrap!==void 0&&(e.log?.(`running sandbox bootstrap`),await e.bootstrap({use:async()=>createLoggingSandboxSession({log:e.log,session:o})})),await a.captureState()===null)throw Error(`Failed to capture local sandbox template state for "${e.templateKey}".`);await mkdir(dirname(n),{recursive:!0});try{await rename(r,n),i=!0}catch(e){if(await pathExists(n))return{reused:!0};throw e}}finally{await a.dispose(),i||await rm(r,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}},async create(e){let i=resolveSandboxCacheDirectory(e.runtimeContext.appRoot),a=getLocalRootPath(e.existingMetadata)??resolveSessionRootPath(i,e.sessionKey);if(!await pathExists(a)){if(e.templateKey===null)await mkdir(a,{recursive:!0});else{let t=resolveTemplateRootPath(i,e.templateKey);if(!await pathExists(t))throw new SandboxTemplateNotProvisionedError({backendName:JUST_BASH_BACKEND_NAME,templateKey:e.templateKey});await copyDirectoryAtomically(t,a)}}let o=await createBashSandbox({appRoot:e.runtimeContext.appRoot,autoInstall:t,customCommands:n,filesystem:r,rootPath:a,sessionKey:e.sessionKey});return createJustBashHandle(o,JUST_BASH_BACKEND_NAME)}}}async function pruneJustBashSandboxTemplates(e){let t=resolveLocalBackendTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot),JUST_BASH_CACHE_DIRECTORY_NAME),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a;try{a=await readdir(t,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let o=await Promise.all(a.filter(e=>e.isDirectory()).map(async e=>{let n=join(t,e.name);return{isTemporary:e.name.endsWith(`.tmp`),mtimeMs:(await stat(n)).mtimeMs,path:n}})),s=selectStaleTemplateEntries(o.filter(e=>!e.isTemporary),{now:n,recentWindowMs:r,retainCount:i}),c=selectStaleTemplateEntries(o.filter(e=>e.isTemporary),{now:n,recentWindowMs:r,retainCount:0});await Promise.all([...s,...c].map(async e=>await rm(e.path,{force:!0,recursive:!0})))}function resolveTemplateRootPath(e,t){return resolveLocalBackendTemplateRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function resolveSessionRootPath(e,t){return resolveLocalBackendSessionRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function getLocalRootPath(e){let t=e?.rootPath;return typeof t==`string`?t:void 0}export{JUST_BASH_BACKEND_NAME,createJustBashSandboxBackend,pruneJustBashSandboxTemplates};
+import{randomUUID}from"node:crypto";import{mkdir,readdir,rename,rm,stat}from"node:fs/promises";import{dirname,join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{createBashSandbox,createJustBashHandle}from"#execution/sandbox/bindings/just-bash-runtime.js";const JUST_BASH_CACHE_DIRECTORY_NAME=`just-bash`,JUST_BASH_PROVIDER_NAME=`just-bash`;function createJustBashSandboxProvider(e=void 0){let t=e??{},n=t.autoInstall??!0,r={autoInstall:n,customCommands:t.customCommands,filesystem:t.filesystem,version:2};return{async prepare(e){let i=createSandboxProviderIdentity({...r,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision}).slice(0,24),a=resolveTemplateRootPath(e.storagePath,i);if(await pathExists(a))return await touchDirectory(a),e.log?.(`reusing cached template filesystem`),{templateRootPath:a};let o=`${a}.${randomUUID()}.tmp`,s=!1,c=await createBashSandbox({autoInstall:n,host:e.host,rootPath:o,sessionKey:`prepare-${i}`,storagePath:e.storagePath}),l=buildSandboxSession(createFileBackedInternalSandboxSession({sandbox:c}));try{await writeSandboxSeedFiles(l,providerResourceTargetFiles(e.resources)),t.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await t.prepare(createLoggingSandboxSession({log:e.log,session:l}))),await c.captureState(),await mkdir(dirname(a),{recursive:!0});try{await rename(o,a),s=!0}catch(e){if(await pathExists(a))return{templateRootPath:a};throw e}}finally{await c.dispose(),s||await rm(o,{force:!0,recursive:!0})}return{templateRootPath:a}},async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root "${a.rootPath}" no longer exists.`);return await openHandle(e,a.rootPath,t)},async start(e,n,r){let i=requirePreparedJustBashArtifact(r),a=sessionRootPath(e,i);return await ensureSessionRoot(i,a),{handle:await openHandle(e,a,t),state:{generation:createSandboxProviderIdentity({artifact:i,version:1}),rootPath:a,version:2}}}}}function sessionRootPath(e,t){return resolveSessionRootPath(e.storagePath,createSandboxProviderIdentity({artifact:t,sessionId:e.session.id,version:1}).slice(0,24))}async function ensureSessionRoot(e,t){if(!await pathExists(t)){if(!await pathExists(e.templateRootPath))throw new SandboxTemplateNotProvisionedError({providerName:JUST_BASH_PROVIDER_NAME,templateKey:e.templateRootPath});await copyDirectoryAtomically(e.templateRootPath,t)}}async function openHandle(e,t,n){let r=await createBashSandbox({autoInstall:n.autoInstall??!0,customCommands:n.customCommands,filesystem:n.filesystem,host:e.host,rootPath:t,sessionKey:e.session.id,storagePath:e.storagePath});return createJustBashHandle(r)}async function pruneJustBashSandboxTemplates(e){let t=resolveLocalProviderTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot),JUST_BASH_CACHE_DIRECTORY_NAME),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a;try{a=await readdir(t,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let o=await Promise.all(a.filter(e=>e.isDirectory()).map(async e=>{let n=join(t,e.name);return{isTemporary:e.name.endsWith(`.tmp`),mtimeMs:(await stat(n)).mtimeMs,path:n}})),s=selectStaleTemplateEntries(o.filter(e=>!e.isTemporary),{now:n,recentWindowMs:r,retainCount:i}),c=selectStaleTemplateEntries(o.filter(e=>e.isTemporary),{now:n,recentWindowMs:r,retainCount:0});await Promise.all([...s,...c].map(async e=>await rm(e.path,{force:!0,recursive:!0})))}function requirePreparedJustBashArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.templateRootPath!=`string`)throw Error(`Invalid prepared just-bash artifact.`);return{templateRootPath:e.templateRootPath}}function requireJustBashSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.generation!=`string`||typeof e.rootPath!=`string`)throw Error(`Invalid just-bash session state.`);return{generation:e.generation,rootPath:e.rootPath,version:2}}function resolveTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function resolveSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}export{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates};

package/dist/src/execution/sandbox/bindings/{local-backend-utils.d.ts → local-provider-utils.d.ts}

@@ -1,4 +1,7 @@
-import type { SandboxSeedFile } from "#shared/sandbox-backend.js";
+export interface SandboxSeedFile {
+    readonly content: string | Uint8Array;
+    readonly path: string;
+}
 import type { InternalSandboxSession, SandboxProcess, SandboxRemovePathOptions, SandboxSession, SandboxSpawnOptions } from "#shared/sandbox-session.js";
 export interface FileBackedSandbox {
     readFileBytes(path: string): Promise<Buffer | null>;
@@ -10,14 +13,13 @@ export interface FileBackedSandbox {
     }>): Promise<void>;
 }
 export declare function createFileBackedInternalSandboxSession(input: {
-    readonly id: string;
     readonly sandbox: FileBackedSandbox;
 }): InternalSandboxSession;
 export declare function resolveWorkspacePath(path: string): string;
 export declare function pathExists(path: string): Promise<boolean>;
 export declare function copyDirectoryAtomically(sourcePath: string, targetPath: string): Promise<void>;
 export declare function touchDirectory(path: string): Promise<void>;
-export declare function resolveLocalBackendTemplateRootPath(cacheDirectory: string, backendCacheName: string, templateKey: string): string;
-export declare function resolveLocalBackendTemplatesDirectory(cacheDirectory: string, backendCacheName: string): string;
-export declare function resolveLocalBackendSessionRootPath(cacheDirectory: string, backendCacheName: string, sessionKey: string): string;
+export declare function resolveLocalProviderTemplateRootPath(cacheDirectory: string, providerCacheName: string, templateKey: string): string;
+export declare function resolveLocalProviderTemplatesDirectory(cacheDirectory: string, providerCacheName: string): string;
+export declare function resolveLocalProviderSessionRootPath(cacheDirectory: string, providerCacheName: string, sessionKey: string): string;
 export declare function writeSandboxSeedFiles(session: SandboxSession, seedFiles: ReadonlyArray<SandboxSeedFile>): Promise<void>;

package/dist/src/execution/sandbox/bindings/local-provider-utils.js

@@ -0,0 +1 @@
+import{randomUUID}from"node:crypto";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{dirname,join}from"node:path";import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";function createFileBackedInternalSandboxSession(e){return{resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(e,t){let n=`${t}.${randomUUID()}.tmp`;await rm(n,{force:!0,recursive:!0}),await mkdir(dirname(t),{recursive:!0});try{await cp(e,n,{recursive:!0}),await rename(n,t)}catch(e){if(await rm(n,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(t))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalProviderTemplateRootPath(e,t,n){return join(resolveLocalProviderTemplatesDirectory(e,t),n)}function resolveLocalProviderTemplatesDirectory(e,t){return join(e,t,`templates`)}function resolveLocalProviderSessionRootPath(e,t,n){return join(e,t,`sessions`,n)}async function writeSandboxSeedFiles(e,t){for(let n of t){let t=await resolveSandboxModelPath({path:n.path,sandbox:e});typeof n.content==`string`?await e.writeTextFile({content:n.content,path:t}):await e.writeBinaryFile({content:n.content,path:t})}}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};

package/dist/src/execution/sandbox/bindings/local.d.ts

@@ -1,7 +1,7 @@
-export { createDockerSandboxBackend, DOCKER_BACKEND_NAME, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker.js";
+export { createDockerSandboxProvider, DOCKER_PROVIDER_NAME, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker.js";
 export { isLinuxDockerDaemonAvailableSync } from "#execution/sandbox/bindings/docker-cli.js";
-export { createJustBashSandboxBackend, JUST_BASH_BACKEND_NAME, pruneJustBashSandboxTemplates, } from "#execution/sandbox/bindings/just-bash.js";
-export { createMicrosandboxSandboxBackend, MICROSANDBOX_BACKEND_NAME, pruneMicrosandboxTemplates, } from "#execution/sandbox/bindings/microsandbox.js";
+export { createJustBashSandboxProvider, JUST_BASH_PROVIDER_NAME, pruneJustBashSandboxTemplates, } from "#execution/sandbox/bindings/just-bash.js";
+export { createMicrosandboxSandboxProvider, MICROSANDBOX_PROVIDER_NAME, pruneMicrosandboxTemplates, } from "#execution/sandbox/bindings/microsandbox.js";
 export { isMicrosandboxPlatformSupported } from "#execution/sandbox/bindings/microsandbox-platform.js";
 export { stopDevelopmentSandboxResources } from "#execution/sandbox/development-cleanup.js";
 /**

package/dist/src/execution/sandbox/bindings/local.js

@@ -1 +1 @@
-import{DockerDaemonUnavailableError,DockerUnavailableError,isLinuxDockerDaemonAvailableSync}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_BACKEND_NAME,createDockerSandboxBackend,pruneDockerSandboxTemplates,pruneDockerSandboxTemplates as pruneDockerSandboxTemplates$1}from"#execution/sandbox/bindings/docker.js";import{JUST_BASH_BACKEND_NAME,createJustBashSandboxBackend,pruneJustBashSandboxTemplates,pruneJustBashSandboxTemplates as pruneJustBashSandboxTemplates$1}from"#execution/sandbox/bindings/just-bash.js";import{MICROSANDBOX_BACKEND_NAME,createMicrosandboxSandboxBackend,pruneMicrosandboxTemplates,pruneMicrosandboxTemplates as pruneMicrosandboxTemplates$1}from"#execution/sandbox/bindings/microsandbox.js";import{isMicrosandboxPlatformSupported}from"#execution/sandbox/bindings/microsandbox-platform.js";import{stopDevelopmentSandboxResources}from"#execution/sandbox/development-cleanup.js";async function pruneLocalSandboxTemplates(e){await Promise.all([pruneJustBashSandboxTemplates$1(e),pruneMicrosandboxTemplates$1(e),pruneDockerSandboxTemplates$1(e).catch(e=>{if(!(e instanceof DockerUnavailableError||e instanceof DockerDaemonUnavailableError))throw e})])}function pruneLocalSandboxTemplatesInBackground(e){pruneLocalSandboxTemplates({appRoot:e}).catch(e=>{console.warn(`[eve:dev] failed to prune stale local sandbox templates: ${errorMessage(e)}`)})}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{DOCKER_BACKEND_NAME,JUST_BASH_BACKEND_NAME,MICROSANDBOX_BACKEND_NAME,createDockerSandboxBackend,createJustBashSandboxBackend,createMicrosandboxSandboxBackend,isLinuxDockerDaemonAvailableSync,isMicrosandboxPlatformSupported,pruneDockerSandboxTemplates,pruneJustBashSandboxTemplates,pruneLocalSandboxTemplates,pruneLocalSandboxTemplatesInBackground,pruneMicrosandboxTemplates,stopDevelopmentSandboxResources};
+import{DockerDaemonUnavailableError,DockerUnavailableError,isLinuxDockerDaemonAvailableSync}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_PROVIDER_NAME,createDockerSandboxProvider,pruneDockerSandboxTemplates,pruneDockerSandboxTemplates as pruneDockerSandboxTemplates$1}from"#execution/sandbox/bindings/docker.js";import{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates,pruneJustBashSandboxTemplates as pruneJustBashSandboxTemplates$1}from"#execution/sandbox/bindings/just-bash.js";import{MICROSANDBOX_PROVIDER_NAME,createMicrosandboxSandboxProvider,pruneMicrosandboxTemplates,pruneMicrosandboxTemplates as pruneMicrosandboxTemplates$1}from"#execution/sandbox/bindings/microsandbox.js";import{isMicrosandboxPlatformSupported}from"#execution/sandbox/bindings/microsandbox-platform.js";import{stopDevelopmentSandboxResources}from"#execution/sandbox/development-cleanup.js";async function pruneLocalSandboxTemplates(e){await Promise.all([pruneJustBashSandboxTemplates$1(e),pruneMicrosandboxTemplates$1(e),pruneDockerSandboxTemplates$1(e).catch(e=>{if(!(e instanceof DockerUnavailableError||e instanceof DockerDaemonUnavailableError))throw e})])}function pruneLocalSandboxTemplatesInBackground(e){pruneLocalSandboxTemplates({appRoot:e}).catch(e=>{console.warn(`[eve:sandbox] failed to prune stale local templates: ${errorMessage(e)}`)})}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{DOCKER_PROVIDER_NAME,JUST_BASH_PROVIDER_NAME,MICROSANDBOX_PROVIDER_NAME,createDockerSandboxProvider,createJustBashSandboxProvider,createMicrosandboxSandboxProvider,isLinuxDockerDaemonAvailableSync,isMicrosandboxPlatformSupported,pruneDockerSandboxTemplates,pruneJustBashSandboxTemplates,pruneLocalSandboxTemplates,pruneLocalSandboxTemplatesInBackground,pruneMicrosandboxTemplates,stopDevelopmentSandboxResources};

package/dist/src/execution/sandbox/bindings/microsandbox-create.js

@@ -1 +1 @@
-import{toErrorMessage}from"#shared/errors.js";async function createMicrosandboxWithProgress(e){let t={phase:`resolving the image`};try{let n=await e.builder.createWithPullProgress(),r=reportMicrosandboxCreateProgress(n,t,e.log);try{return await withHeartbeat(t,e.log,async()=>await n.awaitSandbox())}finally{await r.catch(()=>{})}}catch(n){throw enrichMicrosandboxError({context:`Failed to create microsandbox VM from ${e.source} while ${t.phase}`,error:n,errorType:e.errorType})}}function enrichMicrosandboxError(e){if(e.error instanceof MicrosandboxDiagnosticError)return e.error;let t=readMicrosandboxErrorCode(e.error,e.errorType),n=t===void 0?``:` [${t}]`,r=toErrorMessage(e.error),i=/[.!?]$/u.test(r)?r:`${r}.`;return new MicrosandboxDiagnosticError(`${e.context}${n}: ${i}`,{cause:e.error,hint:microsandboxErrorHint(t)})}var MicrosandboxDiagnosticError=class extends Error{hint;constructor(e,t){super(e,t),this.name=`MicrosandboxDiagnosticError`,t?.hint!==void 0&&(this.hint=t.hint)}};async function reportMicrosandboxCreateProgress(e,t,n){for await(let r of e){let e=microsandboxCreatePhase(r,t.phase);e!==t.phase&&(t.phase=e,n?.(e))}}function microsandboxCreatePhase(e,t){switch(e.kind){case`resolving`:case`resolved`:return`resolving the image`;case`layerDownloadProgress`:case`layerDownloadComplete`:case`layerDownloadVerifying`:case`layerMaterializeStarted`:case`layerMaterializeProgress`:case`layerMaterializeWriting`:case`layerMaterializeComplete`:return`downloading and materializing image layers`;case`stitchMergingTrees`:case`stitchWritingFsmeta`:case`stitchWritingVmdk`:case`stitchComplete`:return`assembling the image filesystem`;case`complete`:return`image ready; booting microsandbox VM`;default:return t}}async function withHeartbeat(e,t,n){if(t?.(e.phase),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{let n=Math.round((Date.now()-r)/1e3);t(`${e.phase} (${n}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}const MICROSANDBOX_ERROR_HINTS={database:`Check that the microsandbox npm package and installed VM runtime use the same version. If versions changed, use a clean MSB_HOME or migrate the existing database.`,imageNotFound:`Check that the image exists and that the registry credentials can pull it.`,libkrunfwNotFound:"Run `npx microsandbox install` and verify that MSB_PATH points to the installed runtime."};function readMicrosandboxErrorCode(e,t){if(t!==void 0&&e instanceof t||e instanceof Error&&`code`in e&&typeof e.code==`string`&&Object.hasOwn(MICROSANDBOX_ERROR_HINTS,e.code))return e.code}function microsandboxErrorHint(e){return e===void 0?void 0:MICROSANDBOX_ERROR_HINTS[e]}export{createMicrosandboxWithProgress,enrichMicrosandboxError};
+import{toErrorMessage}from"#shared/errors.js";async function createMicrosandboxWithProgress(e){let t={phase:`resolving the image`};try{let n=await e.builder.createWithPullProgress(),r=reportMicrosandboxCreateProgress(n,t,e.log);try{return await withHeartbeat(t,e.log,async()=>await n.awaitSandbox())}finally{await r.catch(()=>{})}}catch(n){throw enrichMicrosandboxError({context:`Failed to create microsandbox VM from ${e.source} while ${t.phase}`,error:n,errorType:e.errorType})}}function enrichMicrosandboxError(e){if(e.error instanceof MicrosandboxDiagnosticError)return e.error;let t=readMicrosandboxErrorCode(e.error,e.errorType),n=t===void 0?``:` [${t}]`,r=toErrorMessage(e.error),i=/[.!?]$/u.test(r)?r:`${r}.`;return new MicrosandboxDiagnosticError(`${e.context}${n}: ${i}`,{cause:e.error,hint:microsandboxErrorHint(t)})}var MicrosandboxDiagnosticError=class extends Error{hint;constructor(e,t){super(e,t),this.name=`MicrosandboxDiagnosticError`,t?.hint!==void 0&&(this.hint=t.hint)}};async function reportMicrosandboxCreateProgress(e,t,n){for await(let r of e){let e=microsandboxCreatePhase(r,t.phase);e!==t.phase&&(t.phase=e,n?.(e))}}function microsandboxCreatePhase(e,t){switch(e.kind){case`resolving`:case`resolved`:return`resolving the image`;case`layerDownloadProgress`:case`layerDownloadComplete`:case`layerDownloadVerifying`:case`layerMaterializeStarted`:case`layerMaterializeProgress`:case`layerMaterializeWriting`:case`layerMaterializeComplete`:return`downloading and materializing image layers`;case`stitchMergingTrees`:case`stitchWritingFsmeta`:case`stitchWritingVmdk`:case`stitchComplete`:return`assembling the image filesystem`;case`complete`:return`image ready; booting microsandbox VM`;default:return t}}async function withHeartbeat(e,t,n){if(t?.(e.phase),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{let n=Math.round((Date.now()-r)/1e3);t(`${e.phase} (${n}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}const MICROSANDBOX_ERROR_HINTS={database:`Check that the microsandbox npm package and installed VM runtime use the same version. If versions changed, use a clean MSB_HOME or migrate the existing database.`,imageNotFound:`Check that the image exists and that the registry credentials can pull it.`,libkrunfwNotFound:"Run `npx microsandbox install` and verify that MSB_PATH points to the installed runtime."};function readMicrosandboxErrorCode(e,t){if(t!==void 0&&e instanceof t||e instanceof Error&&`code`in e&&typeof e.code==`string`&&isMicrosandboxErrorCodeWithHint(e.code))return e.code}function isMicrosandboxErrorCodeWithHint(e){return e===`database`||e===`imageNotFound`||e===`libkrunfwNotFound`}function microsandboxErrorHint(e){return e===void 0?void 0:MICROSANDBOX_ERROR_HINTS[e]}export{createMicrosandboxWithProgress,enrichMicrosandboxError};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.d.ts

@@ -1,16 +1,38 @@
+import { MICROSANDBOX_METADATA_VERSION } from "#execution/sandbox/bindings/microsandbox-metadata.js";
 import type { ResolvedMicrosandboxOptions } from "#execution/sandbox/bindings/microsandbox-options.js";
-import type { SandboxBackendCreateInput, SandboxBackendHandle, SandboxBackendPrewarmInput, SandboxBackendPrewarmResult } from "#public/definitions/sandbox-backend.js";
-import type { MicrosandboxBootstrapUseOptions, MicrosandboxSessionUseOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import type { MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import { type SandboxProviderSessionContext, type SandboxProviderHandle, type SandboxProviderPrepareContext } from "#shared/sandbox-provider.js";
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+export type MicrosandboxPreparedArtifact = {
+    readonly image: string | null;
+    readonly optionsHash: string;
+    readonly snapshotName: string;
+    readonly version: typeof MICROSANDBOX_METADATA_VERSION;
+};
 export declare function prewarmMicrosandboxTemplate(input: {
-    readonly backendName: string;
+    readonly providerName: string;
     readonly options: ResolvedMicrosandboxOptions;
     readonly optionsHash: string;
-    readonly prewarmInput: SandboxBackendPrewarmInput<MicrosandboxBootstrapUseOptions>;
-}): Promise<SandboxBackendPrewarmResult>;
+    readonly context: SandboxProviderPrepareContext;
+    readonly dockerfile?: import("#execution/sandbox/dockerfile.js").SandboxDockerfile;
+    readonly prepare?: (sandbox: import("#shared/sandbox-session.js").SandboxSession) => Promise<void> | void;
+    readonly templateKey: string;
+}): Promise<MicrosandboxPreparedArtifact>;
 export declare function createMicrosandboxHandle(input: {
-    readonly backendName: string;
-    readonly createInput: SandboxBackendCreateInput;
+    readonly artifact: MicrosandboxPreparedArtifact;
+    readonly context: SandboxProviderSessionContext;
+    readonly createIfMissing?: boolean;
     readonly options: ResolvedMicrosandboxOptions;
     readonly optionsHash: string;
-}): Promise<SandboxBackendHandle<MicrosandboxSessionUseOptions>>;
+    readonly providerName: string;
+    readonly runtimeOptions?: MicrosandboxSandboxRuntimeOptions;
+    readonly sessionIdentity?: string;
+}): Promise<{
+    readonly handle: SandboxProviderHandle<MutableNetworkSandboxSession>;
+    readonly state: {
+        readonly optionsHash: string;
+        readonly sessionIdentity: string;
+        readonly version: 3;
+    };
+}>;
 export declare function clearActiveMicrosandboxSessionHandlesForTest(): void;

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{createFileBackedInternalSandboxSession,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-backend-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.prewarmInput.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({appRoot:e.prewarmInput.runtimeContext.appRoot,log:e.prewarmInput.log,options:e.options}),n=resolveSandboxCacheDirectory(e.prewarmInput.runtimeContext.appRoot),r=resolveMicrosandboxTemplateRootPath(n,e.prewarmInput.templateKey),i=resolveMicrosandboxMetadataPath(r);e.prewarmInput.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.prewarmInput.log?.(`reusing cached snapshot`),await touchDirectory(r),{reused:!0};let o=createProviderName(`eve-sbx-tpl`,e.prewarmInput.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.prewarmInput.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0}),e.prewarmInput.log?.(`creating template VM from image "${e.options.image}"`);let l=await createPreparedMicrosandbox({log:e.prewarmInput.log,module:t,name:c,networkPolicy:e.options.networkPolicy,options:e.options,sessionKey:e.prewarmInput.templateKey,setupBaseRuntime:!0,tags:void 0}),u=buildSandboxSession(createMicrosandboxInternalSession(l),async e=>{await l.setNetworkPolicy(e)});try{e.prewarmInput.seedFiles.length>0&&e.prewarmInput.log?.(`writing ${e.prewarmInput.seedFiles.length} seed file(s)`),await writeSandboxSeedFiles(u,e.prewarmInput.seedFiles),e.prewarmInput.bootstrap!==void 0&&(e.prewarmInput.log?.(`running sandbox bootstrap`),await e.prewarmInput.bootstrap({use:async t=>(t?.networkPolicy!==void 0&&await l.setNetworkPolicy(t.networkPolicy),createLoggingSandboxSession({log:e.prewarmInput.log,session:u}))})),e.prewarmInput.log?.(`snapshotting template VM`),await l.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r))return{reused:!0};throw e}}finally{await l.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return{reused:!1}}async function createMicrosandboxHandle(e){let t=await loadMicrosandboxModule({appRoot:e.createInput.runtimeContext.appRoot,options:e.options}),n=resolveSandboxCacheDirectory(e.createInput.runtimeContext.appRoot),r=resolveMicrosandboxSessionRootPath(n,e.createInput.sessionKey),i=createActiveMicrosandboxSessionKey(r,e.optionsHash),a=activeMicrosandboxSessionHandles.get(i);if(a!==void 0)return a;let o=resolveMicrosandboxMetadataPath(r),s=readSessionMetadataRecord(e.createInput.existingMetadata)??await readSessionMetadata(o),c=withDevelopmentSandboxMetadataPathTag(e.createInput.tags,o);if(s?.optionsHash===e.optionsHash&&(await sandboxExists(t,s.sandboxName)||s.stateSnapshotName!==void 0&&await snapshotExists(t,s.stateSnapshotName))){let n=await connectMicrosandbox({metadata:s,metadataPath:o,module:t,options:e.options,sessionKey:e.createInput.sessionKey,tags:c});if(n!==null)return cacheHandle(i,createHandle(n,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(i)}))}let l=null;if(e.createInput.templateKey!==null){let r=resolveMicrosandboxTemplateRootPath(n,e.createInput.templateKey),i=await readTemplateMetadata(resolveMicrosandboxMetadataPath(r));if(i===null||i.optionsHash!==e.optionsHash||!await snapshotExists(t,i.snapshotName))throw new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey});l=i.snapshotName}let u=createProviderName(`eve-sbx-ses`,`${e.createInput.sessionKey}:${randomUUID()}`),d;try{d=await createPreparedMicrosandbox({fromSnapshot:l??void 0,module:t,name:u,networkPolicy:e.options.networkPolicy,options:e.options,sessionKey:e.createInput.sessionKey,setupBaseRuntime:l===null,tags:c})}catch(t){throw l!==null&&e.createInput.templateKey!==null&&isMicrosandboxNotFoundError(t)?new SandboxTemplateNotProvisionedError({backendName:e.backendName,templateKey:e.createInput.templateKey}):t}return await d.writeMetadata(o,e.optionsHash),cacheHandle(i,createHandle(d,e.backendName,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(i)}))}function createHandle(e,t,n,r){return{session:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),useSessionFn:async t=>(t?.networkPolicy!==void 0&&await e.setNetworkPolicy(t.networkPolicy),buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)})),async captureState(){return{backendName:t,metadata:{...await e.captureState(n)},sessionKey:e.id}},async delete(){await e.shutdown(),await e.removePersisted(),r?.()},async stop(){await e.stop(),r?.()},async shutdown(){r?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({id:e.id,sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};
+import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{createFileBackedInternalSandboxSession,touchDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{buildSandboxDockerfile,dockerfileImageReference,publishDockerImageForMicrosandbox}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{isSandboxPreparedArtifactRecord}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.context.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({host:e.context.host,log:e.context.log,options:e.options}),n=e.context.storagePath,r=resolveMicrosandboxTemplateRootPath(n,e.templateKey),i=resolveMicrosandboxMetadataPath(r);e.context.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.context.log?.(`reusing cached snapshot`),await touchDirectory(r),microsandboxTemplateArtifact(a);let o=createProviderName(`eve-sbx-tpl`,e.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0});let l=e.options;if(e.dockerfile!==void 0){let t=createDockerCli();await assertDockerDaemonAvailable(t);let n=dockerfileImageReference({dockerfile:e.dockerfile,templateKey:e.templateKey});e.context.log?.(`building sandbox Dockerfile "${e.dockerfile.path}"`),await buildSandboxDockerfile({cli:t,dockerfile:e.dockerfile,imageReference:n}),e.context.log?.(`publishing Dockerfile image for microsandbox`);let r=await publishDockerImageForMicrosandbox({cli:t,imageReference:n});l={...e.options,image:r,pullPolicy:`always`}}let u=e.context.resources.source,d=u.kind===`materialized`?await prepareImmutableResources({storagePath:e.context.storagePath,provider:e.providerName,resourcesKey:u.key,sourcePath:u.path}):void 0;e.context.log?.(`creating template VM from image "${l.image}"`);let f=await createPreparedMicrosandbox({log:e.context.log,module:t,name:c,networkPolicy:`allow-all`,options:l,resourcesPath:d,sessionKey:e.templateKey,setupBaseRuntime:!0,tags:void 0}),p=buildSandboxSession(createMicrosandboxInternalSession(f),async e=>{await f.setNetworkPolicy(e)});try{await hydrateSandboxProviderResources({copySkills:!0,log:e.context.log,resources:e.context.resources,session:p}),e.prepare!==void 0&&(e.context.log?.(`running sandbox preparation`),await e.prepare(createLoggingSandboxSession({log:e.context.log,session:p}))),e.context.log?.(`snapshotting template VM`),await f.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r)){let e=await readTemplateMetadata(i);if(e!==null)return microsandboxTemplateArtifact(e)}throw e}}finally{await f.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return microsandboxTemplateArtifact({image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION})}async function createMicrosandboxHandle(e){let t=requirePreparedMicrosandboxTemplate(e.artifact,e.providerName),n=e.sessionIdentity??createStableHash(`${e.context.session.id}:${t.snapshotName}:${e.optionsHash}`).slice(0,32),r=resolveMicrosandboxSessionRootPath(e.context.storagePath,n),i=resolveMicrosandboxMetadataPath(r),a=await readSessionMetadata(i),o=resolveMicrosandboxImage(a,t,e.options),s={...e.options,...o,networkPolicy:e.runtimeOptions?.networkPolicy},c=await loadMicrosandboxModule({host:e.context.host,options:s}),l=createActiveMicrosandboxSessionKey(r,e.optionsHash),u=activeMicrosandboxSessionHandles.get(l),d={optionsHash:e.optionsHash,sessionIdentity:n,version:3};if(u!==void 0)return{handle:u,state:d};let f=withDevelopmentSandboxMetadataPathTag({sessionId:e.context.session.id},i);if(a?.optionsHash===e.optionsHash&&(await sandboxExists(c,a.sandboxName)||a.stateSnapshotName!==void 0&&await snapshotExists(c,a.stateSnapshotName))){let t=await connectMicrosandbox({metadata:a,metadataPath:i,module:c,options:s,sessionKey:e.context.session.id,tags:f});if(t!==null)return{handle:cacheHandle(l,createHandle(t,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}if(e.sessionIdentity!==void 0&&e.createIfMissing===!1)throw Error(`microsandbox session "${e.sessionIdentity}" is no longer available to resume.`);if(t.optionsHash!==e.optionsHash||!await snapshotExists(c,t.snapshotName))throw new SandboxTemplateNotProvisionedError({providerName:e.providerName,templateKey:t.snapshotName});let p=createProviderName(`eve-sbx-ses`,n),m=await createPreparedMicrosandbox({fromSnapshot:t.snapshotName,module:c,name:p,networkPolicy:s.networkPolicy,options:s,sessionKey:e.context.session.id,setupBaseRuntime:!1,tags:f});return await m.writeMetadata(i,e.optionsHash),{handle:cacheHandle(l,createHandle(m,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}function resolveMicrosandboxImage(e,t,n){return e?.image===void 0?t?.image===void 0?{image:n.image,pullPolicy:n.pullPolicy}:{image:t.image,pullPolicy:`always`}:{image:e.image,pullPolicy:`always`}}function microsandboxTemplateArtifact(e){return{image:e.image??null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:e.version}}function requirePreparedMicrosandboxTemplate(e,t){if(!isSandboxPreparedArtifactRecord(e)||e.version!==MICROSANDBOX_METADATA_VERSION||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw new SandboxTemplateNotProvisionedError({providerName:t,templateKey:`invalid-artifact`});return{image:typeof e.image==`string`?e.image:void 0,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:MICROSANDBOX_METADATA_VERSION}}function createHandle(e,t,n){return{sandbox:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),async onSessionDelete(){await e.shutdown(),await e.removePersisted(),n?.()},async onSessionStop(){await e.stop(),n?.()},async onRuntimeShutdown(){n?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};