eve 0.64.1 → 0.66.0

package/dist/src/evals/types.d.ts

@@ -180,6 +180,8 @@ export interface AssertionResult {
     readonly severity: AssertionSeverity;
     readonly threshold?: number;
     readonly passed: boolean;
+    /** Whether the assertion failed because its scorer threw instead of producing a score. */
+    readonly errored: boolean;
     /** Human-readable failure detail, shown in console output and artifacts. */
     readonly message?: string;
     readonly metadata?: Readonly<Record<string, unknown>>;

package/dist/src/execution/coordination-dispatch-step.js

@@ -1 +1 @@
-import{createDurableSessionState}from"#execution/durable-session-store.js";import{executeTaskControlAction}from"#execution/tasks/parent/dispatch.js";import{cancelBackgroundAgentTask}from"#execution/tools/subagent/task-cancel.js";import{prepareCoordinationDispatch}from"#execution/coordination-dispatch-shared.js";import{startWorkflowTask}from"#execution/tools/workflow/start.js";async function dispatchCoordinationStep(e){"use step";let t=await prepareCoordinationDispatch({serializedContext:e.serializedContext,sessionState:e.sessionState});if(t===void 0)return{results:[],sessionState:e.sessionState};let{batch:n,session:r}=t,i=r,a=[];for(let r of t.plan){if(r.kind===`workflow-task`){let o=await startWorkflowTask({agents:t.workflowAgents,auth:t.auth,batchEvent:n.event,initiatorAuth:t.initiatorAuth,owner:e.workflowToolRunOwner,parentSession:t.parentSession,session:i,task:r.task});i=o.session,o.result!==void 0&&a.push(o.result);continue}if(r.kind===`task-control`){let e=await executeTaskControlAction({action:r.action,cancelOwnedWork:cancelBackgroundAgentTask,serializedContext:t.serializedContext,session:i});i=e.session,a.push(e.result)}}return{results:a,sessionState:i===r?t.sessionState:createDurableSessionState({session:i})}}export{dispatchCoordinationStep};
+import{createDurableSessionState}from"#execution/durable-session-store.js";import{executeTaskControlAction}from"#execution/tasks/parent/dispatch.js";import{cancelBackgroundAgentTask}from"#execution/tools/subagent/task-cancel.js";import{prepareCoordinationDispatch}from"#execution/coordination-dispatch-shared.js";import{startWorkflowTask}from"#execution/tools/workflow/start.js";async function dispatchCoordinationStep(e){"use step";let t=await prepareCoordinationDispatch({serializedContext:e.serializedContext,sessionState:e.sessionState});if(t===void 0)return{results:[],sessionState:e.sessionState};let{batch:n,session:r}=t,i=r,a=[];for(let r of t.plan){if(r.kind===`workflow-task`){let o=await startWorkflowTask({agents:t.workflowAgents,auth:t.auth,batchEvent:n.event,canRequestInput:t.capabilities?.requestInput===!0,initiatorAuth:t.initiatorAuth,owner:e.workflowToolRunOwner,parentSession:t.parentSession,session:i,task:r.task});i=o.session,o.result!==void 0&&a.push(o.result);continue}if(r.kind===`task-control`){let e=await executeTaskControlAction({action:r.action,cancelOwnedWork:cancelBackgroundAgentTask,serializedContext:t.serializedContext,session:i});i=e.session,a.push(e.result)}}return{results:a,sessionState:i===r?t.sessionState:createDurableSessionState({session:i})}}export{dispatchCoordinationStep};

package/dist/src/execution/dynamic-workflow/tool.js

@@ -1 +1 @@
-import{runJsProgram}from"#execution/dynamic-workflow/workflow.js";async function executeWorkflowProgram(e,t){"use workflow";return runJsProgram(e.js,t,{maxSubagents:e.maxSubagents??0})}executeWorkflowProgram.workflowId=`workflow//eve@0.64.1//executeWorkflowProgram`;export{executeWorkflowProgram};
+import{runJsProgram}from"#execution/dynamic-workflow/workflow.js";async function executeWorkflowProgram(e,t){"use workflow";return runJsProgram(e.js,t,{maxSubagents:e.maxSubagents??0})}executeWorkflowProgram.workflowId=`workflow//eve@0.66.0//executeWorkflowProgram`;export{executeWorkflowProgram};

package/dist/src/execution/node-step.d.ts

@@ -25,10 +25,8 @@ export interface CreateExecutionNodeStepInput {
     /** Cancellation signal forwarded to the tool-loop harness. */
     readonly abortSignal?: AbortSignal;
     /**
-     * Session-level capabilities propagated from the runtime. The
-     * harness passes this through to `buildToolSet` so `ask_question`
-     * registration and any other capability-gated behavior tracks the
-     * current run.
+     * Session-level capabilities propagated from the runtime, so
+     * capability-gated behavior tracks the current run.
      */
     readonly capabilities?: SessionCapabilities;
     /** Runs only a context clear and returns to the parked session. */

package/dist/src/execution/node-step.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{UNSPECIFIED_INPUT_SCHEMA}from"#tools/schema.js";import{createToolExecuteWithAuth}from"#execution/tool-auth.js";import{resolveRuntimeModelReference}from"#runtime/agent/resolve-model.js";import{createPreparedWorkflowToolHarnessDefinition,createWorkflowToolHarnessDefinition}from"#execution/tools/workflow/background.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{dispatchDynamicModelEvent}from"#context/dynamic-model-lifecycle.js";import{preparePersistedStepDynamicToolMetadata}from"#context/dynamic-tool-lifecycle.js";import{createToolLoopHarness}from"#harness/tool-loop.js";import{createTaskToolHarnessDefinitions}from"#execution/tools/tasks.js";import{findRegisteredRuntimeTool}from"#runtime/tools/registry.js";import{preserveFrameworkStateOnCompaction}from"#execution/compaction.js";import{ASK_QUESTION_TOOL_NAME}from"#harness/request-input-tool.js";import{WEB_SEARCH_TOOL_NAME,resolveWebSearchActivityLabel}from"#harness/provider-tool-schemas.js";const log=createLogger(`execution.node-step`);function createExecutionNodeStep(e){let t=createRuntimeModelResolver(e.modelResolutionScope),n=e.node.turnAgent.dynamicModel===void 0?void 0:createRuntimeDynamicModelEventDispatcher(e.modelResolutionScope,e.node.turnAgent.dynamicModel,e.abortSignal),r=createNodeHarnessTools({node:e.node}),i=e.instrumentation,a=i?.prepareExecution(),o=createToolLoopHarness({steeringSignal:e.steeringSignal,abortSignal:e.abortSignal,capabilities:e.capabilities,clearOnly:e.clearOnly,compactOnly:e.compactOnly,handleEvent:e.handleEvent,historyProjector:e.historyProjector,historyView:e.historyView,instrumentation:a,mode:e.mode,onCompaction:preserveFrameworkStateOnCompaction,resolveStepDynamicTools:t=>preparePersistedStepDynamicToolMetadata({...t,resolvers:e.node.agent.dynamicToolResolvers??[]}),dispatchDynamicModelEvent:n,resolveModel:t,runtimeIdentity:buildRuntimeIdentity(e.node),tools:r});return i===void 0?o:async(e,t)=>{try{return await o(e,t)}finally{await i.flush()}}}function buildRuntimeIdentity(e){let t=resolveInstalledPackageInfo(),n={agentId:e.turnAgent.id,agentName:e.agent.config?.name,eveVersion:t.version},r=process.env.VERCEL_GIT_COMMIT_SHA?.trim(),i=process.env.VERCEL_GIT_COMMIT_REF?.trim(),a=process.env.VERCEL_DEPLOYMENT_CREATED_AT?.trim();return r||i||a?{...n,build:{deployedAt:a||void 0,gitBranch:i||void 0,gitSha:r||void 0}}:n}function createRuntimeModelResolver(e){return t=>resolveRuntimeModelReference(t,e)}function createRuntimeDynamicModelEventDispatcher(e,t,n){return r=>dispatchDynamicModelEvent({abortSignal:n,ctx:r.ctx,dynamicModel:t,event:r.event,messages:r.messages,scope:e})}function createNodeHarnessTools(e){let t=new Map;for(let n of e.node.turnAgent.tools){let r=resolveHarnessToolDefinition({node:e.node,tool:n});r!==null&&t.set(n.name,r)}return t}function resolveHarnessToolDefinition(e){let t=findRegisteredRuntimeTool(e.node.toolRegistry,e.tool.name);return isPreparedRuntimeWorkflowTool(e.tool)?t===null?createPreparedWorkflowToolHarnessDefinition(e.tool):createWorkflowToolHarnessDefinition({executeInput:t.definition.executeInput,definition:createRegisteredHarnessToolDefinition({behavior:e.tool.behavior,definition:t.definition,rootOnly:e.tool.rootOnly}),nodeId:e.tool.task.nodeId,workflowId:e.tool.task.workflowId}):t===null?(log.warn(`declared tool is not registered — omitting from toolset`,{toolName:e.tool.name,nodeId:e.node.nodeId}),null):createRegisteredHarnessToolDefinition({behavior:e.tool.behavior,definition:t.definition,rootOnly:e.tool.rootOnly})}function isPreparedRuntimeWorkflowTool(e){return e.task!==void 0}function createRegisteredHarnessToolDefinition(e){let t=e.definition;if(t.owner.kind===`framework`){let n=createTaskToolHarnessDefinitions().find(e=>e.name===t.name);if(n!==void 0)return{...n,behavior:e.behavior}}let n=t.execute,r=t.owner.kind===`framework`&&t.name===ASK_QUESTION_TOOL_NAME;return{availableInSubagents:t.availableInSubagents,label:t.label??(t.owner.kind===`framework`&&t.name===WEB_SEARCH_TOOL_NAME?{start:resolveWebSearchActivityLabel}:void 0),approvalKey:t.approvalKey,behavior:e.behavior,description:t.description,execution:t.execution,executeInput:t.executeInput,execute:r?void 0:resolveAuthoredExecute({rawExecute:n,scope:t.name}),frameworkAction:t.owner.kind===`framework`&&t.name===LOAD_SKILL_TOOL_NAME?`load-skill`:void 0,inputSchema:t.inputSchema??UNSPECIFIED_INPUT_SCHEMA,name:t.name,approval:t.approval,outputSchema:t.outputSchema,rootOnly:e.rootOnly,toModelOutput:t.toModelOutput}}function resolveAuthoredExecute(e){let{rawExecute:t,scope:n}=e;return t===void 0?void 0:createToolExecuteWithAuth({execute:t,scope:n})}export{buildRuntimeIdentity,createExecutionNodeStep,createNodeHarnessTools};
+import{createLogger}from"#internal/logging.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{UNSPECIFIED_INPUT_SCHEMA}from"#tools/schema.js";import{createToolExecuteWithAuth}from"#execution/tool-auth.js";import{resolveRuntimeModelReference}from"#runtime/agent/resolve-model.js";import{createPreparedWorkflowToolHarnessDefinition,createWorkflowToolHarnessDefinition}from"#execution/tools/workflow/background.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{dispatchDynamicModelEvent}from"#context/dynamic-model-lifecycle.js";import{preparePersistedStepDynamicToolMetadata}from"#context/dynamic-tool-lifecycle.js";import{createToolLoopHarness}from"#harness/tool-loop.js";import{createTaskToolHarnessDefinitions}from"#execution/tools/tasks.js";import{findRegisteredRuntimeTool}from"#runtime/tools/registry.js";import{WEB_SEARCH_TOOL_NAME,resolveWebSearchActivityLabel}from"#harness/provider-tool-schemas.js";const log=createLogger(`execution.node-step`);function createExecutionNodeStep(e){let t=createRuntimeModelResolver(e.modelResolutionScope),n=e.node.turnAgent.dynamicModel===void 0?void 0:createRuntimeDynamicModelEventDispatcher(e.modelResolutionScope,e.node.turnAgent.dynamicModel,e.abortSignal),r=createNodeHarnessTools({node:e.node}),i=e.instrumentation,a=i?.prepareExecution(),o=createToolLoopHarness({steeringSignal:e.steeringSignal,abortSignal:e.abortSignal,capabilities:e.capabilities,clearOnly:e.clearOnly,compactOnly:e.compactOnly,handleEvent:e.handleEvent,historyProjector:e.historyProjector,historyView:e.historyView,instrumentation:a,mode:e.mode,resolveStepDynamicTools:t=>preparePersistedStepDynamicToolMetadata({...t,resolvers:e.node.agent.dynamicToolResolvers??[]}),dispatchDynamicModelEvent:n,resolveModel:t,runtimeIdentity:buildRuntimeIdentity(e.node),tools:r});return i===void 0?o:async(e,t)=>{try{return await o(e,t)}finally{await i.flush()}}}function buildRuntimeIdentity(e){let t=resolveInstalledPackageInfo(),n={agentId:e.turnAgent.id,agentName:e.agent.config?.name,eveVersion:t.version},r=process.env.VERCEL_GIT_COMMIT_SHA?.trim(),i=process.env.VERCEL_GIT_COMMIT_REF?.trim(),a=process.env.VERCEL_DEPLOYMENT_CREATED_AT?.trim();return r||i||a?{...n,build:{deployedAt:a||void 0,gitBranch:i||void 0,gitSha:r||void 0}}:n}function createRuntimeModelResolver(e){return t=>resolveRuntimeModelReference(t,e)}function createRuntimeDynamicModelEventDispatcher(e,t,n){return r=>dispatchDynamicModelEvent({abortSignal:n,ctx:r.ctx,dynamicModel:t,event:r.event,messages:r.messages,scope:e})}function createNodeHarnessTools(e){let t=new Map;for(let n of e.node.turnAgent.tools){let r=resolveHarnessToolDefinition({node:e.node,tool:n});r!==null&&t.set(n.name,r)}return t}function resolveHarnessToolDefinition(e){let t=findRegisteredRuntimeTool(e.node.toolRegistry,e.tool.name);return isPreparedRuntimeWorkflowTool(e.tool)?t===null?createPreparedWorkflowToolHarnessDefinition(e.tool):createWorkflowToolHarnessDefinition({executeInput:t.definition.executeInput,definition:createRegisteredHarnessToolDefinition({behavior:e.tool.behavior,definition:t.definition,rootOnly:e.tool.rootOnly}),nodeId:e.tool.task.nodeId,workflowId:e.tool.task.workflowId}):t===null?(log.warn(`declared tool is not registered — omitting from toolset`,{toolName:e.tool.name,nodeId:e.node.nodeId}),null):createRegisteredHarnessToolDefinition({behavior:e.tool.behavior,definition:t.definition,rootOnly:e.tool.rootOnly})}function isPreparedRuntimeWorkflowTool(e){return e.task!==void 0}function createRegisteredHarnessToolDefinition(e){let t=e.definition;if(t.owner.kind===`framework`){let n=createTaskToolHarnessDefinitions().find(e=>e.name===t.name);if(n!==void 0)return{...n,behavior:e.behavior}}let n=t.execute;return{availableInSubagents:t.availableInSubagents,label:t.label??(t.owner.kind===`framework`&&t.name===WEB_SEARCH_TOOL_NAME?{start:resolveWebSearchActivityLabel}:void 0),approvalKey:t.approvalKey,behavior:e.behavior,description:t.description,execution:t.execution,executeInput:t.executeInput,execute:resolveAuthoredExecute({rawExecute:n,scope:t.name}),frameworkAction:t.owner.kind===`framework`&&t.name===LOAD_SKILL_TOOL_NAME?`load-skill`:void 0,inputSchema:t.inputSchema??UNSPECIFIED_INPUT_SCHEMA,name:t.name,approval:t.approval,outputSchema:t.outputSchema,rootOnly:e.rootOnly,toModelOutput:t.toModelOutput}}function resolveAuthoredExecute(e){let{rawExecute:t,scope:n}=e;return t===void 0?void 0:createToolExecuteWithAuth({execute:t,scope:n})}export{buildRuntimeIdentity,createExecutionNodeStep,createNodeHarnessTools};

package/dist/src/execution/proxied-deliver-step.js

@@ -1 +1 @@
-import{readDurableSession,replaceDurableSessionSnapshot}from"#execution/durable-session-store.js";import{findBackgroundWorkflowToolRun}from"#harness/workflow-tool-runs.js";import{resumeSessionInbox}from"#execution/session-inbox/resume.js";import{createTaskInputRequestId,retireProxyInputRequests}from"#harness/proxy-input-requests.js";import{coalesceDeliverPayloads}from"#execution/deliver-payloads.js";import{routeDeliverPayload}from"#subagents/hitl-proxy.js";import{sendTaskInboundPayload}from"#execution/tasks/parent/run-parent.js";import{resumeWorkflowToolRunAnswers}from"#execution/tools/workflow/answer.js";async function routeProxiedDeliverStep(e){"use step";let t=readDurableSession(e.sessionState),n=e.delivery,r=new Map,i=new Map,a;for(let[e,o]of n.payloads.entries()){let s=routeDeliverPayload({allowRoute:(e,n)=>n.taskId===void 0||findBackgroundWorkflowToolRun(t.state,n.taskId)!==void 0,payload:o,state:t.state});a??=s.parentAction,s.forSelf!==void 0&&r.set(e,s.forSelf);for(let[t,r]of s.forChildren.entries()){let a=[r.childContinuationToken,r.childSessionInbox?.sessionId??``,r.childResponseUrl??``,r.taskId??``].join(`\0`),o=i.get(a)??{answerHook:r.answerHook,childContinuationToken:r.childContinuationToken,childSessionInbox:r.childSessionInbox,childResponseUrl:r.childResponseUrl,metadata:[],payloads:[],retireRequestIds:[],sourcePayloadIndexes:[],taskId:r.taskId},c=o.payloads.length;if(o.payloads.push(r.payload),o.retireRequestIds.push(...r.retireRequestIds),o.sourcePayloadIndexes.push(e),s.forSelf===void 0&&t===0)for(let t of n.deliveryMetadata??[])t.payloadIndex===e&&o.metadata.push({...t,payloadIndex:c});i.set(a,o)}}let o=!1;for(let e of i.values()){let i=e.taskId;if(i!==void 0){let a=findBackgroundWorkflowToolRun(t.state,i);if(a===void 0){mergeStrandedResponses(r,e,i);continue}if(await sendTaskInboundPayload({taskInboxToken:a.address.hookToken,payload:{auth:n.auth,childContinuationToken:e.childContinuationToken,childSessionInbox:e.childSessionInbox,childResponseUrl:e.childResponseUrl,inputResponses:coalesceDeliverPayloads(e.payloads).inputResponses??[],kind:`input-response`,taskId:i}})===`unreachable`){mergeStrandedResponses(r,e,i);continue}t=retireProxyInputRequests(t,e.retireRequestIds),o=!0;continue}if(e.answerHook!==void 0){await resumeWorkflowToolRunAnswers(e.childContinuationToken,coalesceDeliverPayloads(e.payloads).inputResponses),t=retireProxyInputRequests(t,e.retireRequestIds),o=!0;continue}let a={...n,deliveryMetadata:e.metadata.length===0?void 0:e.metadata,payloads:e.payloads};await resumeSessionInbox(e.childSessionInbox??e.childContinuationToken,a),t=retireProxyInputRequests(t,e.retireRequestIds),o=!0}let s={serializedContext:e.serializedContext??{},sessionState:o?replaceDurableSessionSnapshot({session:t,state:e.sessionState}):e.sessionState};if(a!==void 0)return{...s,...a};let c=[...r].sort(([e],[t])=>e-t),l=c.flatMap(([e],t)=>(n.deliveryMetadata??[]).filter(t=>t.payloadIndex===e).map(e=>({...e,payloadIndex:t}))),u=c.length===0?void 0:{...n,deliveryMetadata:l.length===0?void 0:l,payloads:c.map(([,e])=>e)};return{...s,kind:`continue`,remainder:u}}function mergeStrandedResponses(e,t,n){for(let[r,i]of t.payloads.entries()){let a=t.sourcePayloadIndexes[r];if(a===void 0)continue;let o=(i.inputResponses??[]).map(e=>({...e,requestId:createTaskInputRequestId(n,e.requestId)}));if(o.length===0)continue;let s=e.get(a);e.set(a,{...s,inputResponses:[...s?.inputResponses??[],...o]})}}export{routeProxiedDeliverStep};
+import{createInputResolvedEvent,encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{getPendingCoordinationBatch}from"#harness/coordination.js";import{readDurableSession,replaceDurableSessionSnapshot}from"#execution/durable-session-store.js";import{findBackgroundWorkflowToolRun}from"#harness/workflow-tool-runs.js";import{resumeSessionInbox}from"#execution/session-inbox/resume.js";import{createTaskInputRequestId,retireProxyInputRequests}from"#harness/proxy-input-requests.js";import{coalesceDeliverPayloads}from"#execution/deliver-payloads.js";import{routeDeliverPayload}from"#subagents/hitl-proxy.js";import{sendTaskInboundPayload}from"#execution/tasks/parent/run-parent.js";import{resumeWorkflowToolRunAnswers,resumeWorkflowToolRunDismissal}from"#execution/tools/workflow/answer.js";async function routeProxiedDeliverStep(e){"use step";let t=readDurableSession(e.sessionState),n=e.delivery,r=new Map,i=new Map,a,o=n.caller===void 0&&n.taskDeliveryId===void 0,s=new Set;for(let[e,c]of n.payloads.entries()){let l=routeDeliverPayload({allowRoute:(e,n)=>!s.has(e)&&(n.taskId===void 0||findBackgroundWorkflowToolRun(t.state,n.taskId)!==void 0),payload:c,resolveMessage:o,state:t.state});a??=l.parentAction,l.forSelf!==void 0&&r.set(e,l.forSelf);for(let[t,r]of l.forChildren.entries()){if(r.answerHook!==void 0)for(let e of r.retireRequestIds)s.add(e);let a=[r.childContinuationToken,r.childSessionInbox?.sessionId??``,r.childResponseUrl??``,r.taskId??``].join(`\0`),o=i.get(a)??{answerHook:r.answerHook,childContinuationToken:r.childContinuationToken,childSessionInbox:r.childSessionInbox,childResponseUrl:r.childResponseUrl,dismissedRequestIds:[],metadata:[],payloads:[],retireRequestIds:[],sourcePayloadIndexes:[],taskId:r.taskId},c=o.payloads.length;if(o.payloads.push(r.payload),o.dismissedRequestIds.push(...r.dismissedRequestIds??[]),o.retireRequestIds.push(...r.retireRequestIds),o.sourcePayloadIndexes.push(e),l.forSelf===void 0&&t===0)for(let t of n.deliveryMetadata??[])t.payloadIndex===e&&o.metadata.push({...t,payloadIndex:c});i.set(a,o)}}let c=!1;for(let a of i.values()){let i=a.taskId;if(i!==void 0){let e=findBackgroundWorkflowToolRun(t.state,i);if(e===void 0){mergeStrandedResponses(r,a,i);continue}if(await sendTaskInboundPayload({taskInboxToken:e.address.hookToken,payload:{auth:n.auth,childContinuationToken:a.childContinuationToken,childSessionInbox:a.childSessionInbox,childResponseUrl:a.childResponseUrl,inputResponses:coalesceDeliverPayloads(a.payloads).inputResponses??[],kind:`input-response`,taskId:i}})===`unreachable`){mergeStrandedResponses(r,a,i);continue}t=retireProxyInputRequests(t,a.retireRequestIds),c=!0;continue}if(a.answerHook!==void 0){let n=coalesceDeliverPayloads(a.payloads).inputResponses??[];await resumeWorkflowToolRunAnswers(a.childContinuationToken,n),a.dismissedRequestIds.length>0&&await resumeWorkflowToolRunDismissal(a.childContinuationToken),a.answerHook.question!==void 0&&await emitQuestionResolutions({dismissedRequestIds:a.dismissedRequestIds,responses:n,sessionState:t.state,sessionWritable:e.sessionWritable}),t=retireProxyInputRequests(t,a.retireRequestIds),c=!0;continue}let o={...n,deliveryMetadata:a.metadata.length===0?void 0:a.metadata,payloads:a.payloads};await resumeSessionInbox(a.childSessionInbox??a.childContinuationToken,o),t=retireProxyInputRequests(t,a.retireRequestIds),c=!0}let l={serializedContext:e.serializedContext??{},sessionState:c?replaceDurableSessionSnapshot({session:t,state:e.sessionState}):e.sessionState};if(a!==void 0)return{...l,...a};let u=[...r].sort(([e],[t])=>e-t),d=u.flatMap(([e],t)=>(n.deliveryMetadata??[]).filter(t=>t.payloadIndex===e).map(e=>({...e,payloadIndex:t}))),f=u.length===0?void 0:{...n,deliveryMetadata:d.length===0?void 0:d,payloads:u.map(([,e])=>e)};return{...l,kind:`continue`,remainder:f}}async function emitQuestionResolutions(e){let t=getPendingCoordinationBatch(e.sessionState)?.event;if(t===void 0)return;let n=[...e.responses.map(e=>({kind:`question`,outcome:`answered`,requestId:e.requestId,response:e})),...e.dismissedRequestIds.map(e=>({kind:`question`,outcome:`ignored`,requestId:e}))];if(n.length===0)return;let r=e.sessionWritable.getWriter();try{await r.write(encodeMessageStreamEvent(stampMessageStreamEvent(createInputResolvedEvent({resolutions:n,...t}))))}finally{r.releaseLock()}}function mergeStrandedResponses(e,t,n){for(let[r,i]of t.payloads.entries()){let a=t.sourcePayloadIndexes[r];if(a===void 0)continue;let o=(i.inputResponses??[]).map(e=>({...e,requestId:createTaskInputRequestId(n,e.requestId)}));if(o.length===0)continue;let s=e.get(a);e.set(a,{...s,inputResponses:[...s?.inputResponses??[],...o]})}}export{routeProxiedDeliverStep};

package/dist/src/execution/route-child-delivery.js

@@ -1,3 +1,3 @@
-import{recordTaskInputRequestStep,recordTerminalTaskViewsStep}from"#execution/tasks/parent/hitl-proxy-steps.js";import{coalesceDeliverPayloads}from"#execution/deliver-payloads.js";import{emitSubagentEventStep}from"#execution/tools/subagent/emit-event-step.js";import{formatTaskNotification}from"#tasks/notification.js";import{routeProxiedDeliverStep}from"#execution/proxied-deliver-step.js";import{emitRecordedTaskInputRequestStep,runProxySubagentEventStep}from"#subagents/event-proxy-step.js";import{acceptTaskAuthorizationEventStep}from"#execution/tools/subagent/accept-event-step.js";import{applyTaskAgentRequest}from"#execution/tools/subagent/task-agent-requests.js";async function routeDeliverToChildren(e){let t=coalesceDeliverPayloads(e.delivery.payloads),n=e.serializedContext,r=e.sessionState,i=new Map,a=new Set((t.task?.views??[]).map(e=>e.taskId));for(let i of t.task?.inputRequests??[]){if(a.has(i.taskId))continue;let t=await recordTaskInputRequestStep({request:i,sessionState:r});if(r=t.sessionState,!t.accepted)continue;let o=await emitRecordedTaskInputRequestStep({sessionWritable:e.sessionWritable,request:t.request,serializedContext:n,sessionState:r});n=o.serializedContext,r=o.sessionState}for(let i of t.task?.agentRequests??[]){if(i.request.kind===`agent-invoke`&&a.has(i.taskId))continue;let t=await applyTaskAgentRequest({...i,ownerId:i.taskId},{sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r});n=t.serializedContext,r=t.sessionState}for(let i of t.task?.authorizationEvents??[]){if(i.hookPayload.event.type===`authorization.required`&&a.has(i.taskId)||!await acceptTaskAuthorizationEventStep({delivery:i,sessionState:r}))continue;let t=await runProxySubagentEventStep({hookPayload:i.hookPayload,sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r});n=t.serializedContext,r=t.sessionState}if((t.task?.views?.length??0)>0){let a=await recordTerminalTaskViewsStep({serializedContext:n,sessionState:r,views:t.task?.views??[]});n=a.serializedContext,r=a.sessionState;for(let e of a.views)i.set(e.taskId,e);for(let t of a.subagentCompletions)n=(await emitSubagentEventStep({event:t,sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r})).serializedContext}let o=[],s=[];for(let[t,n]of e.delivery.payloads.entries()){let r={...n};if(delete r.task,r.message!==void 0&&n.task?.views!==void 0){let e=n.task.views.flatMap(({taskId:e})=>{let t=i.get(e);return t===void 0?[]:[formatTaskNotification(t)]});e.length===0?delete r.message:r.message=e.join(`
+import{recordTaskInputRequestStep,recordTerminalTaskViewsStep}from"#execution/tasks/parent/hitl-proxy-steps.js";import{coalesceDeliverPayloads}from"#execution/deliver-payloads.js";import{emitSubagentEventStep}from"#execution/tools/subagent/emit-event-step.js";import{formatTaskNotification}from"#tasks/notification.js";import{routeProxiedDeliverStep}from"#execution/proxied-deliver-step.js";import{emitRecordedTaskInputRequestStep,runProxySubagentEventStep}from"#subagents/event-proxy-step.js";import{acceptTaskAuthorizationEventStep}from"#execution/tools/subagent/accept-event-step.js";import{applyTaskAgentRequest}from"#execution/tools/subagent/task-agent-requests.js";async function routeDeliverToChildren(e){let t=coalesceDeliverPayloads(e.delivery.payloads),n=e.serializedContext,r=e.sessionState,i=new Map,a=new Set((t.task?.views??[]).map(e=>e.taskId));for(let i of t.task?.inputRequests??[]){if(a.has(i.taskId))continue;let t=await recordTaskInputRequestStep({request:i,sessionState:r});if(r=t.sessionState,!t.accepted)continue;let o=await emitRecordedTaskInputRequestStep({sessionWritable:e.sessionWritable,request:t.request,serializedContext:n,sessionState:r});n=o.serializedContext,r=o.sessionState}for(let i of t.task?.agentRequests??[]){if(i.request.kind===`agent-invoke`&&a.has(i.taskId))continue;let t=await applyTaskAgentRequest({...i,ownerId:i.taskId},{sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r});n=t.serializedContext,r=t.sessionState}for(let i of t.task?.authorizationEvents??[]){if(i.hookPayload.event.type===`authorization.required`&&a.has(i.taskId)||!await acceptTaskAuthorizationEventStep({delivery:i,sessionState:r}))continue;let t=await runProxySubagentEventStep({hookPayload:i.hookPayload,sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r});n=t.serializedContext,r=t.sessionState}if((t.task?.views?.length??0)>0){let a=await recordTerminalTaskViewsStep({serializedContext:n,sessionState:r,views:t.task?.views??[]});n=a.serializedContext,r=a.sessionState;for(let e of a.views)i.set(e.taskId,e);for(let t of a.subagentCompletions){let i=await emitSubagentEventStep({event:t,sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r});n=i.serializedContext,r=i.sessionState}}let o=[],s=[];for(let[t,n]of e.delivery.payloads.entries()){let r={...n};if(delete r.task,r.message!==void 0&&n.task?.views!==void 0){let e=n.task.views.flatMap(({taskId:e})=>{let t=i.get(e);return t===void 0?[]:[formatTaskNotification(t)]});e.length===0?delete r.message:r.message=e.join(`
 
 `)}if(Object.keys(r).length===0)continue;let a=o.length;o.push(r);for(let n of e.delivery.deliveryMetadata??[])n.payloadIndex===t&&s.push({...n,payloadIndex:a})}let c=o.length===0?void 0:{...e.delivery,deliveryMetadata:s.length===0?void 0:s,payloads:o};return c===void 0?{kind:`continue`,remainder:void 0,serializedContext:n,sessionState:r}:r.hasProxyInputRequests?await routeProxiedDeliverStep({delivery:c,sessionWritable:e.sessionWritable,serializedContext:n,sessionState:r}):{kind:`continue`,remainder:c,serializedContext:n,sessionState:r}}export{routeDeliverToChildren};

package/dist/src/execution/sandbox/bindings/docker-templates.d.ts

@@ -32,4 +32,10 @@ export declare function resolveDockerTemplateMarkerPath(appRoot: string, input:
 }): string;
 export declare function touchDockerTemplateMarker(markerPath: string, imageReference: string): Promise<void>;
 export declare function dockerImageExists(cli: DockerCli, imageReference: string): Promise<boolean>;
+export declare function commitDockerTemplateImage(input: {
+    readonly cli: DockerCli;
+    readonly containerIdentity: string;
+    readonly imageReference: string;
+    readonly templateKey: string;
+}): Promise<"committed" | "reused">;
 export declare function ensureDockerBaseImage(cli: DockerCli, options: ResolvedDockerSandboxOptions): Promise<void>;

package/dist/src/execution/sandbox/bindings/docker-templates.js

@@ -1 +1 @@
-import{mkdir,readdir,rm,stat,utimes,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";const DOCKER_TEMPLATE_IMAGE_REPOSITORY=`eve-sandbox-template`;async function pruneDockerSandboxTemplates(e){let t=e.dockerCli??createDockerCli(),n=resolveDockerTemplateMarkersDirectory(e.appRoot),r;try{r=await readdir(n,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let i=await Promise.all(r.filter(e=>e.isFile()).map(async e=>{let t=join(n,e.name);return{imageTag:e.name,mtimeMs:(await stat(t)).mtimeMs,path:t}})),a=selectStaleTemplateEntries(i,{now:e.now??Date.now(),recentWindowMs:e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,retainCount:e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT});for(let e of a){let n=await t.run([`rmi`,dockerTemplateImageReferenceFromTag(e.imageTag)]),r=n.exitCode!==0&&/no such image/i.test(n.stderr);(n.exitCode===0||r)&&await rm(e.path,{force:!0})}}function dockerTemplateImageReference(e){return dockerTemplateImageReferenceFromTag(dockerTemplateImageTag(e))}function dockerTemplateImageReferenceFromTag(e){return`${DOCKER_TEMPLATE_IMAGE_REPOSITORY}:${e}`}function dockerTemplateImageTag(e){return`${e.templateKey.toLowerCase()}-${e.optionsHash}`}function resolveDockerTemplateMarkerPath(e,t){return join(resolveDockerTemplateMarkersDirectory(e),dockerTemplateImageTag(t))}async function touchDockerTemplateMarker(e,t){await mkdir(dirname(e),{recursive:!0});try{let t=new Date;await utimes(e,t,t)}catch{await writeFile(e,`${t}\n`)}}async function dockerImageExists(e,t){return(await e.run([`image`,`inspect`,`--format`,`{{.Id}}`,t])).exitCode===0}async function ensureDockerBaseImage(e,t){if(t.pullPolicy===`always`){expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`);return}if(!await dockerImageExists(e,t.image)){if(t.pullPolicy===`never`)throw Error(`The local sandbox base image "${t.image}" is not present locally and pullPolicy is "never". Pull the image manually or relax the pull policy.`);expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`)}}function resolveDockerTemplateMarkersDirectory(e){return join(resolveSandboxCacheDirectory(e),`docker`,`templates`)}export{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker};
+import{mkdir,readdir,rm,stat,utimes,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";import"node:fs";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL}from"#execution/sandbox/bindings/docker-container.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";const DOCKER_TEMPLATE_IMAGE_REPOSITORY=`eve-sandbox-template`;async function pruneDockerSandboxTemplates(e){let t=e.dockerCli??createDockerCli(),n=resolveDockerTemplateMarkersDirectory(e.appRoot),r;try{r=await readdir(n,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let i=await Promise.all(r.filter(e=>e.isFile()).map(async e=>{let t=join(n,e.name);return{imageTag:e.name,mtimeMs:(await stat(t)).mtimeMs,path:t}})),a=selectStaleTemplateEntries(i,{now:e.now??Date.now(),recentWindowMs:e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,retainCount:e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT});for(let e of a){let n=await t.run([`rmi`,dockerTemplateImageReferenceFromTag(e.imageTag)]),r=n.exitCode!==0&&/no such image/i.test(n.stderr);(n.exitCode===0||r)&&await rm(e.path,{force:!0})}}function dockerTemplateImageReference(e){return dockerTemplateImageReferenceFromTag(dockerTemplateImageTag(e))}function dockerTemplateImageReferenceFromTag(e){return`${DOCKER_TEMPLATE_IMAGE_REPOSITORY}:${e}`}function dockerTemplateImageTag(e){return`${e.templateKey.toLowerCase()}-${e.optionsHash}`}function resolveDockerTemplateMarkerPath(e,t){return join(resolveDockerTemplateMarkersDirectory(e),dockerTemplateImageTag(t))}async function touchDockerTemplateMarker(e,t){await mkdir(dirname(e),{recursive:!0});try{let t=new Date;await utimes(e,t,t)}catch{await writeFile(e,`${t}\n`)}}async function dockerImageExists(e,t){return(await e.run([`image`,`inspect`,`--format`,`{{.Id}}`,t])).exitCode===0}async function commitDockerTemplateImage(e){let t=await e.cli.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${e.templateKey}`,e.containerIdentity,e.imageReference]);return t.exitCode===0?`committed`:(/already(?:\s*|-)?exists/iu.test(`${t.stderr}\n${t.stdout}`)&&await dockerImageExists(e.cli,e.imageReference)||expectDockerSuccess(t,`commit sandbox template image "${e.imageReference}"`),`reused`)}async function ensureDockerBaseImage(e,t){if(t.pullPolicy===`always`){expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`);return}if(!await dockerImageExists(e,t.image)){if(t.pullPolicy===`never`)throw Error(`The local sandbox base image "${t.image}" is not present locally and pullPolicy is "never". Pull the image manually or relax the pull policy.`);expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`)}}function resolveDockerTemplateMarkersDirectory(e){return join(resolveSandboxCacheDirectory(e),`docker`,`templates`)}export{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker};

package/dist/src/execution/sandbox/bindings/docker.d.ts

@@ -1,4 +1,8 @@
-import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+type NetworkPolicySandboxSession = SandboxSession & {
+    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
+};
 import { type DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
 import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
 import type { DockerSandboxEnvironmentOptions, DockerSandboxRuntimeOptions } from "#public/sandbox/docker-sandbox.js";
@@ -28,4 +32,4 @@ type DockerSandboxSessionState = {
  *   session state across reconnects, so `shutdown` only stops the
  *   container and the next `create` restarts it with state intact.
  */
-export declare function createDockerSandboxProvider(createOptions?: DockerSandboxEnvironmentOptions, dockerCli?: DockerCli): SandboxProviderImplementation<DockerSandboxRuntimeOptions, DockerSandboxPreparedArtifact, DockerSandboxSessionState, MutableNetworkSandboxSession>;
+export declare function createDockerSandboxProvider(createOptions?: DockerSandboxEnvironmentOptions, dockerCli?: DockerCli): SandboxProviderImplementation<DockerSandboxRuntimeOptions, DockerSandboxPreparedArtifact, DockerSandboxSessionState, NetworkPolicySandboxSession>;

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,a]);if(c.exitCode===0)c.stdout.trim()!==`true`&&expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);else{if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}})}let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSessionDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSessionStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),expectDockerSuccess(await n.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${o}`,t,c]),`commit sandbox template image "${c}"`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,a]);if(c.exitCode===0)c.stdout.trim()!==`true`&&expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);else{if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}})}let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSessionDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSessionStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),await commitDockerTemplateImage({cli:n,containerIdentity:t,imageReference:c,templateKey:o})===`reused`&&e.log?.(`reusing concurrently published template image`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.d.ts

@@ -1,5 +1,5 @@
 import type { SandboxProviderHandle, SandboxProviderHost } from "#shared/sandbox-provider.js";
-import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
 import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
 export interface JustBashSessionMetadata {
@@ -34,4 +34,4 @@ export declare function createBashSandbox(input: {
  * Throw rather than silently no-op so brokering code surfaces the gap instead
  * of leaking.
  */
-export declare function createJustBashHandle(sandbox: BashSandbox): SandboxProviderHandle<FixedNetworkSandboxSession>;
+export declare function createJustBashHandle(sandbox: BashSandbox): SandboxProviderHandle<SandboxSession>;

package/dist/src/execution/sandbox/bindings/just-bash.d.ts

@@ -1,5 +1,5 @@
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
-import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
 import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
 export declare const JUST_BASH_PROVIDER_NAME = "just-bash";
 type JustBashPreparedArtifact = {
@@ -10,7 +10,7 @@ type JustBashSessionState = {
     readonly rootPath: string;
     readonly version: 2;
 };
-export declare function createJustBashSandboxProvider(authoredOptions?: JustBashSandboxCreateOptions | undefined): SandboxProviderImplementation<undefined, JustBashPreparedArtifact, JustBashSessionState, FixedNetworkSandboxSession>;
+export declare function createJustBashSandboxProvider(authoredOptions?: JustBashSandboxCreateOptions | undefined): SandboxProviderImplementation<undefined, JustBashPreparedArtifact, JustBashSessionState, SandboxSession>;
 export declare function pruneJustBashSandboxTemplates(input: {
     readonly appRoot: string;
     readonly now?: number;

package/dist/src/execution/sandbox/bindings/local-provider-utils.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{dirname,join}from"node:path";import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";function createFileBackedInternalSandboxSession(e){return{resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(e,t){let n=`${t}.${randomUUID()}.tmp`;await rm(n,{force:!0,recursive:!0}),await mkdir(dirname(t),{recursive:!0});try{await cp(e,n,{recursive:!0}),await rename(n,t)}catch(e){if(await rm(n,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(t))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalProviderTemplateRootPath(e,t,n){return join(resolveLocalProviderTemplatesDirectory(e,t),n)}function resolveLocalProviderTemplatesDirectory(e,t){return join(e,t,`templates`)}function resolveLocalProviderSessionRootPath(e,t,n){return join(e,t,`sessions`,n)}async function writeSandboxSeedFiles(e,t){for(let n of t){let t=await resolveSandboxModelPath({path:n.path,sandbox:e});typeof n.content==`string`?await e.writeTextFile({content:n.content,path:t}):await e.writeBinaryFile({content:n.content,path:t})}}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};
+import{randomUUID}from"node:crypto";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{dirname,join}from"node:path";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";import{resolveSandboxModelPath}from"#shared/skill-paths.js";function createFileBackedInternalSandboxSession(e){return{resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(e,t){let n=`${t}.${randomUUID()}.tmp`;await rm(n,{force:!0,recursive:!0}),await mkdir(dirname(t),{recursive:!0});try{await cp(e,n,{recursive:!0}),await rename(n,t)}catch(e){if(await rm(n,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(t))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalProviderTemplateRootPath(e,t,n){return join(resolveLocalProviderTemplatesDirectory(e,t),n)}function resolveLocalProviderTemplatesDirectory(e,t){return join(e,t,`templates`)}function resolveLocalProviderSessionRootPath(e,t,n){return join(e,t,`sessions`,n)}async function writeSandboxSeedFiles(e,t){for(let n of t){let t=await resolveSandboxModelPath({path:n.path,sandbox:e});typeof n.content==`string`?await e.writeTextFile({content:n.content,path:t}):await e.writeBinaryFile({content:n.content,path:t})}}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.d.ts

@@ -1,8 +1,12 @@
+import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+type NetworkPolicySandboxSession = SandboxSession & {
+    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
+};
 import { MICROSANDBOX_METADATA_VERSION } from "#execution/sandbox/bindings/microsandbox-metadata.js";
 import type { ResolvedMicrosandboxOptions } from "#execution/sandbox/bindings/microsandbox-options.js";
 import type { MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
 import { type SandboxProviderSessionContext, type SandboxProviderHandle, type SandboxProviderPrepareContext } from "#shared/sandbox-provider.js";
-import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
 export type MicrosandboxPreparedArtifact = {
     readonly image: string | null;
     readonly optionsHash: string;
@@ -28,7 +32,7 @@ export declare function createMicrosandboxHandle(input: {
     readonly runtimeOptions?: MicrosandboxSandboxRuntimeOptions;
     readonly sessionIdentity?: string;
 }): Promise<{
-    readonly handle: SandboxProviderHandle<MutableNetworkSandboxSession>;
+    readonly handle: SandboxProviderHandle<NetworkPolicySandboxSession>;
     readonly state: {
         readonly optionsHash: string;
         readonly sessionIdentity: string;
@@ -36,3 +40,4 @@ export declare function createMicrosandboxHandle(input: {
     };
 }>;
 export declare function clearActiveMicrosandboxSessionHandlesForTest(): void;
+export {};

package/dist/src/execution/sandbox/bindings/microsandbox.d.ts

@@ -1,4 +1,8 @@
-import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+type NetworkPolicySandboxSession = SandboxSession & {
+    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
+};
 import { type MicrosandboxPreparedArtifact } from "#execution/sandbox/bindings/microsandbox-lifecycle.js";
 import type { MicrosandboxSandboxCreateOptions, MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
 import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
@@ -9,4 +13,4 @@ export type MicrosandboxProviderSessionState = {
     readonly sessionIdentity: string;
     readonly version: 3;
 };
-export declare function createMicrosandboxSandboxProvider(authoredOptions?: MicrosandboxSandboxCreateOptions | undefined): SandboxProviderImplementation<MicrosandboxSandboxRuntimeOptions, MicrosandboxPreparedArtifact, MicrosandboxProviderSessionState, MutableNetworkSandboxSession>;
+export declare function createMicrosandboxSandboxProvider(authoredOptions?: MicrosandboxSandboxCreateOptions | undefined): SandboxProviderImplementation<MicrosandboxSandboxRuntimeOptions, MicrosandboxPreparedArtifact, MicrosandboxProviderSessionState, NetworkPolicySandboxSession>;

package/dist/src/execution/sandbox/bindings/vercel.d.ts

@@ -1,4 +1,7 @@
-import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+type NetworkPolicySandboxSession = SandboxSession & {
+    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
+};
 import type { SandboxSession } from "#shared/sandbox-session.js";
 import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
 import type { VercelSandboxRuntimeOptions } from "#public/sandbox/vercel-sandbox.js";
@@ -14,7 +17,7 @@ export type VercelSandboxSessionState = {
 type VercelEnvironmentOptions = VercelCreateOptions & {
     readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
 };
-export declare function createVercelSandboxProvider(environmentOptions: Readonly<VercelEnvironmentOptions> | undefined): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, MutableNetworkSandboxSession>;
+export declare function createVercelSandboxProvider(environmentOptions: Readonly<VercelEnvironmentOptions> | undefined): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, NetworkPolicySandboxSession>;
 export interface CreateVercelSandboxInput {
     readonly createSandbox?: CreateVercelSandbox;
     readonly createOptions?: VercelCreateOptions;
@@ -23,5 +26,5 @@ export interface CreateVercelSandboxInput {
     readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
     readonly skipEmptyPreparation?: boolean;
 }
-export declare function createVercelSandbox(input?: CreateVercelSandboxInput): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, MutableNetworkSandboxSession>;
+export declare function createVercelSandbox(input?: CreateVercelSandboxInput): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, NetworkPolicySandboxSession>;
 export {};

package/dist/src/execution/sandbox/bindings/vercel.js

@@ -1,2 +1,2 @@
-import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{VERCEL_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags}from"#execution/sandbox/bindings/vercel-options.js";import{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox}from"#execution/sandbox/bindings/vercel-lifecycle.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandboxProvider(e){let{prepare:t,...n}=e??{};return createVercelSandbox({createOptions:n,prepare:t})}function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n=e.loadDeleteSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),r={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},i=e.createSandbox??createVercelEveImageSandbox;async function openSession(e,a,o,s){let c=requirePreparedVercelTemplate(o),{mounts:l,...u}=a??{},d={...r,...u},f=resolveVercelSandboxTags(d.tags,{sessionId:e.session.id}),p=await t(),m={createOptions:d,createSandbox:i,resolveSessionCreateOptions:l===void 0?void 0:async()=>({mounts:l}),sandboxModule:p,sessionKey:s,snapshotId:c.snapshotId,tags:f},h;try{if(h=await ensureSession(m),h=await ensureUsableSession({input:m,loadDeleteSandboxModule:n,session:h}),h.created&&c.snapshotId===void 0&&u.networkPolicy!==void 0)try{await applyInitialVercelNetworkPolicy(h.sandbox,u.networkPolicy)}catch(t){try{await deleteVercelSandbox({createOptions:d,loadDeleteSandboxModule:n,sandbox:h.sandbox})}catch(n){throw AggregateError([t,n],`Failed to apply network policy and discard Vercel sandbox session "${e.session.id}".`,{cause:t})}throw t}}catch(t){throw isVercelSnapshotUnavailableError(t)&&c.snapshotId!==void 0?new SandboxTemplateNotProvisionedError({providerName:`vercel`,templateKey:c.snapshotId}):Error(`Failed to open Vercel sandbox session "${e.session.id}": ${errorMessage(t)}`,{cause:t})}return createHandle({createOptions:d,loadDeleteSandboxModule:n,sandbox:h.sandbox})}return{async prepare(n){let a=providerResourceTargetFiles(n.resources);if(e.skipEmptyPreparation===!0&&e.prepare===void 0&&a.length===0)return{};let o=`eve-sbx-tpl-vercel-${createSandboxProviderIdentity({createOptions:vercelIdentityOptions(r),resolvedImage:r.source===void 0?r.image??VERCEL_EVE_SANDBOX_IMAGE:void 0,resources:sandboxProviderResourceIdentity(n.resources),sourceRevision:n.sourceRevision,version:2}).slice(0,32)}`;try{return{snapshotId:(await ensureTemplateWithUnavailableRetry({createOptions:r,createSandbox:i,loadSandboxModule:t,log:n.log,prepareSandbox:e.prepare,seedFiles:a,templateKey:o})).template.snapshotId}}catch(e){throw Error(`Failed to prepare Vercel sandbox snapshot: ${errorMessage(e)}`,{cause:e})}},async resume(e,i,a){requirePreparedVercelTemplate(i);let o=requireVercelSessionState(a),s=await t(),c=await getNamedVercelSandbox({createOptions:r,sandboxModule:s,sandboxName:o.sandboxName});if(c===null)throw Error(`Vercel sandbox session "${o.sandboxName}" no longer exists.`);return await ensureVercelSandboxBaseRuntime(c),createHandle({createOptions:r,loadDeleteSandboxModule:n,sandbox:c})},async start(e,t,n){let i=vercelSessionName(e.session.id,t,n,r);return{handle:await openSession(e,t,n,i),state:{sandboxName:i,version:3}}}}}function vercelSessionName(e,t,n,r){let i=requirePreparedVercelTemplate(n);return`eve-sbx-vercel-${createSandboxProviderIdentity({artifact:i,createOptions:vercelIdentityOptions(r),options:vercelIdentityOptions(t),sessionId:e,version:1}).slice(0,32)}`}function vercelIdentityOptions(e){if(e===void 0)return;let t=new Set([`fetch`,`projectId`,`signal`,`teamId`,`token`]);return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function requireVercelSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==3||typeof e.sandboxName!=`string`)throw Error(`Invalid Vercel sandbox session state.`);return{sandboxName:e.sandboxName,version:3}}function requirePreparedVercelTemplate(e){if(!isSandboxPreparedArtifactRecord(e)||e.snapshotId!==void 0&&typeof e.snapshotId!=`string`)throw Error(`Invalid prepared Vercel sandbox artifact.`);return e.snapshotId===void 0?{}:{snapshotId:e.snapshotId}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),r=resolveVercelSandboxTags(e.createOptions.tags,e.tags),i=extractAuthorSnapshotId(e.createOptions);n!==null&&isUnprovisionedTerminalTemplateSandbox(n,i)&&(await n.delete(),n=null),n===null?n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!0,tags:r})}):await ensureVercelSandboxTags(n,r);let a=typeof n.currentSnapshotId==`string`&&n.currentSnapshotId.length>0&&n.currentSnapshotId!==i?n.currentSnapshotId:null;if(a!==null)return{template:{sandboxName:n.name,snapshotId:a,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let o=buildSandboxSession(createVercelInternalSandboxSession(n),createVercelNetworkPolicySetter(n));await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:o}),e.log?.(`running sandbox preparation`),await e.prepareSandbox?.(createLoggingSandboxSession({log:e.log,session:o}));let s=await n.snapshot();return{template:{sandboxName:n.name,snapshotId:s.snapshotId,templateKey:e.templateKey}}}async function ensureUsableSession(e){try{return await ensureVercelSandboxBaseRuntime(e.session.sandbox),e.session}catch(t){if(e.session.created||!isVercelSnapshotUnavailableError(t))throw t}await deleteUnusableVercelSandbox({createOptions:e.input.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:e.session.sandbox});let t=await ensureSession(e.input);return await ensureVercelSandboxBaseRuntime(t.sandbox),t}async function ensureSession(e){let t=e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t,await e.resolveSessionCreateOptions?.());return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t,n={}){let r={...e.createOptions,...n};if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...r,name:t,persistent:!0});let{image:i,runtime:a,source:o,...s}=r;return{...s,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function createHandle(e){let{sandbox:t}=e;return{sandbox:buildSandboxSession(createVercelInternalSandboxSession(t),createVercelNetworkPolicySetter(t)),async onSessionDelete(n){await deleteVercelSandbox({createOptions:e.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:t,signal:n?.abortSignal})},async onSessionStop(){await stopVercelSandbox(t)},async onRuntimeShutdown(){try{await stopVercelSandbox(t)}catch{}}}}function createVercelInternalSandboxSession(e){return{resolvePath:resolveVercelSandboxPath,async spawn(t){let n=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:t.env,signal:t.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let n=await streamToBuffer(t.content),r=await resolveVercelWritePath(e,t.path,t.abortSignal);await e.writeFiles([{content:n,path:r}],{signal:t.abortSignal})},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(e){if(e.seedFiles.length===0)return;let t=await Promise.all(e.seedFiles.map(async t=>({content:typeof t.content==`string`?Buffer.from(t.content):t.content,path:await resolveSandboxModelPath({path:t.path,sandbox:e.session})})));await e.sandbox.writeFiles(t)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function resolveVercelWritePath(e,t,n){let r=await e.runCommand({args:[`-m`,`--`,t],cmd:`realpath`,signal:n}),i=(await r.stdout()).trim();if(r.exitCode!==0||!i.startsWith(`/`)||i.includes(`
+import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{VERCEL_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{isVercelSandboxMissingError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags}from"#execution/sandbox/bindings/vercel-options.js";import{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";import{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox}from"#execution/sandbox/bindings/vercel-lifecycle.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandboxProvider(e){let{prepare:t,...n}=e??{};return createVercelSandbox({createOptions:n,prepare:t})}function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n=e.loadDeleteSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),r={timeout:DEFAULT_SANDBOX_TIMEOUT_MS,...e.createOptions},i=e.createSandbox??createVercelEveImageSandbox;async function openSession(e,a,o,s){let c=requirePreparedVercelTemplate(o),{mounts:l,...u}=a??{},d={...r,...u},f=resolveVercelSandboxTags(d.tags,{sessionId:e.session.id}),p=await t(),m={createOptions:d,createSandbox:i,resolveSessionCreateOptions:l===void 0?void 0:async()=>({mounts:l}),sandboxModule:p,sessionKey:s,snapshotId:c.snapshotId,tags:f},h;try{if(h=await ensureSession(m),h=await ensureUsableSession({input:m,loadDeleteSandboxModule:n,session:h}),h.created&&c.snapshotId===void 0&&u.networkPolicy!==void 0)try{await applyInitialVercelNetworkPolicy(h.sandbox,u.networkPolicy)}catch(t){try{await deleteVercelSandbox({createOptions:d,loadDeleteSandboxModule:n,sandbox:h.sandbox})}catch(n){throw AggregateError([t,n],`Failed to apply network policy and discard Vercel sandbox session "${e.session.id}".`,{cause:t})}throw t}}catch(t){throw isVercelSnapshotUnavailableError(t)&&c.snapshotId!==void 0?new SandboxTemplateNotProvisionedError({providerName:`vercel`,templateKey:c.snapshotId}):Error(`Failed to open Vercel sandbox session "${e.session.id}": ${errorMessage(t)}`,{cause:t})}return createHandle({createOptions:d,loadDeleteSandboxModule:n,sandbox:h.sandbox})}return{async prepare(n){let a=providerResourceTargetFiles(n.resources);if(e.skipEmptyPreparation===!0&&e.prepare===void 0&&a.length===0)return{};let o=`eve-sbx-tpl-vercel-${createSandboxProviderIdentity({createOptions:vercelIdentityOptions(r),resolvedImage:r.source===void 0?r.image??VERCEL_EVE_SANDBOX_IMAGE:void 0,resources:sandboxProviderResourceIdentity(n.resources),sourceRevision:n.sourceRevision,version:2}).slice(0,32)}`;try{return{snapshotId:(await ensureTemplateWithUnavailableRetry({createOptions:r,createSandbox:i,loadSandboxModule:t,log:n.log,prepareSandbox:e.prepare,seedFiles:a,templateKey:o})).template.snapshotId}}catch(e){throw Error(`Failed to prepare Vercel sandbox snapshot: ${errorMessage(e)}`,{cause:e})}},async resume(e,i,a){requirePreparedVercelTemplate(i);let o=requireVercelSessionState(a),s=await t(),c=await getNamedVercelSandbox({createOptions:r,sandboxModule:s,sandboxName:o.sandboxName});if(c===null)throw Error(`Vercel sandbox session "${o.sandboxName}" no longer exists.`);return await ensureVercelSandboxBaseRuntime(c),createHandle({createOptions:r,loadDeleteSandboxModule:n,sandbox:c})},async start(e,t,n){let i=vercelSessionName(e.session.id,t,n,r);return{handle:await openSession(e,t,n,i),state:{sandboxName:i,version:3}}}}}function vercelSessionName(e,t,n,r){let i=requirePreparedVercelTemplate(n);return`eve-sbx-vercel-${createSandboxProviderIdentity({artifact:i,createOptions:vercelIdentityOptions(r),options:vercelIdentityOptions(t),sessionId:e,version:1}).slice(0,32)}`}function vercelIdentityOptions(e){if(e===void 0)return;let t=new Set([`fetch`,`projectId`,`signal`,`teamId`,`token`]);return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function requireVercelSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==3||typeof e.sandboxName!=`string`)throw Error(`Invalid Vercel sandbox session state.`);return{sandboxName:e.sandboxName,version:3}}function requirePreparedVercelTemplate(e){if(!isSandboxPreparedArtifactRecord(e)||e.snapshotId!==void 0&&typeof e.snapshotId!=`string`)throw Error(`Invalid prepared Vercel sandbox artifact.`);return e.snapshotId===void 0?{}:{snapshotId:e.snapshotId}}async function ensureTemplateWithUnavailableRetry(e){try{return await ensureTemplate(e)}catch(t){if(!isVercelSnapshotUnavailableError(t)&&!isVercelSandboxMissingError(t))throw t;return e.log?.(`cached template disappeared; rebuilding sandbox template`),await ensureTemplate(e)}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),r=resolveVercelSandboxTags(e.createOptions.tags,e.tags),i=extractAuthorSnapshotId(e.createOptions);n!==null&&isUnprovisionedTerminalTemplateSandbox(n,i)&&(await n.delete(),n=null),n===null?n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:e.templateKey,persistent:!0,tags:r})}):await ensureVercelSandboxTags(n,r);let a=typeof n.currentSnapshotId==`string`&&n.currentSnapshotId.length>0&&n.currentSnapshotId!==i?n.currentSnapshotId:null;if(a!==null)return{template:{sandboxName:n.name,snapshotId:a,templateKey:e.templateKey}};e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let o=buildSandboxSession(createVercelInternalSandboxSession(n),createVercelNetworkPolicySetter(n));await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:o}),e.log?.(`running sandbox preparation`),await e.prepareSandbox?.(createLoggingSandboxSession({log:e.log,session:o}));let s=await n.snapshot();return{template:{sandboxName:n.name,snapshotId:s.snapshotId,templateKey:e.templateKey}}}async function ensureUsableSession(e){try{return await ensureVercelSandboxBaseRuntime(e.session.sandbox),e.session}catch(t){if(e.session.created||!isVercelSnapshotUnavailableError(t))throw t}await deleteUnusableVercelSandbox({createOptions:e.input.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:e.session.sandbox});let t=await ensureSession(e.input);return await ensureVercelSandboxBaseRuntime(t.sandbox),t}async function ensureSession(e){let t=e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t,await e.resolveSessionCreateOptions?.());return e.tags!==void 0&&(r.tags=e.tags),{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}function createSessionCreateParams(e,t,n={}){let r={...e.createOptions,...n};if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...r,name:t,persistent:!0});let{image:i,runtime:a,source:o,...s}=r;return{...s,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function createHandle(e){let{sandbox:t}=e;return{sandbox:buildSandboxSession(createVercelInternalSandboxSession(t),createVercelNetworkPolicySetter(t)),async onSessionDelete(n){await deleteVercelSandbox({createOptions:e.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:t,signal:n?.abortSignal})},async onSessionStop(){await stopVercelSandbox(t)},async onRuntimeShutdown(){try{await stopVercelSandbox(t)}catch{}}}}function createVercelInternalSandboxSession(e){return{resolvePath:resolveVercelSandboxPath,async spawn(t){let n=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:t.env,signal:t.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let n=await streamToBuffer(t.content),r=await resolveVercelWritePath(e,t.path,t.abortSignal);await e.writeFiles([{content:n,path:r}],{signal:t.abortSignal})},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(e){if(e.seedFiles.length===0)return;let t=await Promise.all(e.seedFiles.map(async t=>({content:typeof t.content==`string`?Buffer.from(t.content):t.content,path:await resolveSandboxModelPath({path:t.path,sandbox:e.session})})));await e.sandbox.writeFiles(t)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function resolveVercelWritePath(e,t,n){let r=await e.runCommand({args:[`-m`,`--`,t],cmd:`realpath`,signal:n}),i=(await r.stdout()).trim();if(r.exitCode!==0||!i.startsWith(`/`)||i.includes(`
 `))throw Error(`Failed to resolve Vercel Sandbox write path: ${t}`);return i}function isUnprovisionedTerminalTemplateSandbox(e,t){let n=e.currentSnapshotId;return typeof n==`string`&&n.length>0&&n!==t?!1:e.status===`aborted`||e.status===`failed`||e.status===`stopped`}function extractAuthorSnapshotId(e){let t=e.source;if(t?.type===`snapshot`&&typeof t.snapshotId==`string`)return t.snapshotId}const DEFAULT_SANDBOX_TIMEOUT_MS=18e5;export{createVercelSandbox,createVercelSandboxProvider};

package/dist/src/execution/sandbox/ensure.js

@@ -1 +1 @@
-import{contextStorage}from"#context/container.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{getSandboxEnvironmentRuntime,runWithSandboxConstructorRuntime}from"#shared/sandbox-environment.js";import{buildCallbackContext,withRuntimeSandboxLifecycle}from"#context/build-callback-context.js";import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{isSandboxPreparedArtifact}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{loadSandboxPreparedArtifact}from"#runtime/sandbox/prepared-artifacts.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{ensureDevelopmentSandboxesPrepared}from"#execution/sandbox/development-lazy-prewarm.js";import{createSandboxProviderHost}from"#execution/sandbox/provider-host.js";async function ensureSandboxAccess(e){let t=e.state?.session??null,n,r,i,a=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??process.cwd(),o=e.registry.sandbox;if(o===null)return{async captureState(){return{session:t}},async get(){return null},async stop(){}};async function open(n,i,s,c){if(r!==void 0)throw Error(`A sandbox definition can open only one sandbox.`);let l=o.inheritance,u=l?.definition??o.definition;if(u.kind!==`independent`)throw Error(`Sandbox "${u.logicalPath}" has no environment.`);if(s!==u.environment)throw Error(`Sandbox "${u.logicalPath}" selected a different environment.`);if(n!==getSandboxEnvironmentRuntime(u.environment))throw Error(`Sandbox "${u.logicalPath}" selected a different provider.`);if(t!==null)throw Error(`Sandbox "${u.logicalPath}" is already initialized.`);let d=l?.nodeId??e.nodeId,f=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:d,providerName:n.providerName});if(f===void 0)throw new SandboxTemplateNotProvisionedError({providerName:n.providerName,templateKey:d});let p={host:createSandboxProviderHost(a),session:c,storagePath:resolveSandboxCacheDirectory(a)};r=(async()=>{let e=await n.implementation.start(p,i,f);if(!isSandboxPreparedArtifact(e.state))throw Error(`Sandbox provider "${n.providerName}" returned non-serializable session state.`);return t={providerName:n.providerName,state:e.state,stateProtocolVersion:n.stateProtocolVersion},e.handle})().catch(e=>{throw r=void 0,e});let m=await r;return installHandle(n.providerName,m)}function installHandle(e,t){let r=withRuntimeSandboxLifecycle(t.sandbox,e=>t.onSessionDelete(e),()=>t.onSessionStop());return n={handle:t,providerName:e,sandbox:r},r}async function resumePersisted(n,i){if(t===null)throw Error(`Sandbox session state is missing.`);let s=getSandboxEnvironmentRuntime(n.environment);if(t.providerName!==s.providerName)throw Error(`Sandbox session state belongs to provider "${t.providerName}", not "${s.providerName}".`);if(t.stateProtocolVersion!==s.stateProtocolVersion)throw Error(`Sandbox session state protocol ${t.stateProtocolVersion} is incompatible with provider "${s.providerName}" protocol ${s.stateProtocolVersion}.`);let c=o.inheritance?.nodeId??e.nodeId,l=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:c,providerName:s.providerName});if(l===void 0)throw new SandboxTemplateNotProvisionedError({providerName:s.providerName,templateKey:c});let u={host:createSandboxProviderHost(a),session:i,storagePath:resolveSandboxCacheDirectory(a)};r=s.implementation.resume(u,l,t.state).catch(e=>{throw r=void 0,e});let d=await r;return installHandle(s.providerName,d),trackActiveSandboxHandle({handle:d,providerName:s.providerName,sessionId:e.sessionId}),d}async function resolveHandle(){let i=o.inheritance,a=i?.definition??o.definition;if(a.kind!==`independent`)throw Error(`Sandbox "${a.logicalPath}" has no resolved parent.`);isEveDevEnvironment()&&e.compiledArtifactsSource.kind===`disk`&&await ensureDevelopmentSandboxesPrepared({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:i?.nodeId??e.nodeId,providerName:getSandboxEnvironmentRuntime(a.environment).providerName});let s={...contextStorage.getStore()===void 0?{auth:{current:null,initiator:null},id:e.sessionId,turn:{id:`sandbox-initialization`,sequence:0}}:buildCallbackContext().session,id:e.sessionId};if(t!==null)return await resumePersisted(a,s);if(i!==void 0)await open(getSandboxEnvironmentRuntime(a.environment),void 0,a.environment,s);else try{let e=await runWithSandboxConstructorRuntime({open:({environment:e,options:t,provider:n})=>open(n,t,e,s)},async()=>a.selector({session:s}));if(n===void 0||e!==n.sandbox)throw Error(`Sandbox "${a.logicalPath}" must return the sandbox it opens.`)}catch(e){let i=n?.handle;if(n=void 0,r=void 0,t=null,i!==void 0)try{await i.onSessionDelete()}catch(t){throw AggregateError([e,t],`Sandbox "${a.logicalPath}" initialization and cleanup both failed.`,{cause:e})}throw e}if(n===void 0)throw Error(`Sandbox "${a.logicalPath}" did not open a provider handle.`);return trackActiveSandboxHandle({handle:n.handle,providerName:n.providerName,sessionId:e.sessionId}),n.handle}function requireHandle(){return i===void 0&&(i=resolveHandle().catch(e=>{throw i=void 0,e})),i}return{async captureState(){return r!==void 0&&await r,{session:t}},async delete(a){if(e.ownsSandbox===!1)throw Error(`Only the owning session can delete this sandbox.`);await(await requireHandle()).onSessionDelete(a),n=void 0,r=void 0,t=null,i=void 0},async get(){return await requireHandle(),n?.sandbox??null},async stop(){await(await requireHandle()).onSessionStop(),n=void 0,r=void 0,i=void 0}}}export{ensureSandboxAccess};
+import{contextStorage}from"#context/container.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{getSandboxEnvironmentRuntime,runWithSandboxConstructorRuntime}from"#shared/sandbox-environment.js";import{buildCallbackContext,withRuntimeSandboxLifecycle}from"#context/build-callback-context.js";import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{isSandboxPreparedArtifact}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{loadSandboxPreparedArtifact}from"#runtime/sandbox/prepared-artifacts.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{ensureDevelopmentSandboxesPrepared}from"#execution/sandbox/development-lazy-prewarm.js";import{createSandboxProviderHost}from"#execution/sandbox/provider-host.js";async function ensureSandboxAccess(e){let t=e.state?.session??null,n,r,i,a=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??process.cwd(),o=e.registry.sandbox;if(o===null)return{async captureState(){return{session:t}},async get(){return null},async stop(){}};async function open(n,i,s,c){if(r!==void 0)throw Error(`A sandbox definition can open only one sandbox.`);let l=o.inheritance,u=l?.definition??o.definition;if(u.kind!==`independent`)throw Error(`Sandbox "${u.logicalPath}" has no environment.`);if(s!==u.environment)throw Error(`Sandbox "${u.logicalPath}" selected a different environment.`);if(n!==getSandboxEnvironmentRuntime(u.environment))throw Error(`Sandbox "${u.logicalPath}" selected a different provider.`);if(t!==null)throw Error(`Sandbox "${u.logicalPath}" is already initialized.`);let d=l?.nodeId??e.nodeId,f=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:d,providerName:n.providerName});if(f===void 0)throw new SandboxTemplateNotProvisionedError({providerName:n.providerName,templateKey:d});let p={host:createSandboxProviderHost(a),session:c,storagePath:resolveSandboxCacheDirectory(a)};r=(async()=>{let e=await n.implementation.start(p,i,f);if(!isSandboxPreparedArtifact(e.state))throw Error(`Sandbox provider "${n.providerName}" returned non-serializable session state.`);return t={providerName:n.providerName,state:e.state,stateProtocolVersion:n.stateProtocolVersion},e.handle})().catch(e=>{throw r=void 0,e});let m=await r;return installHandle(n.providerName,m)}function installHandle(e,t){let r=withRuntimeSandboxLifecycle(t.sandbox,e=>t.onSessionDelete(e),()=>t.onSessionStop());return n={handle:t,providerName:e,sandbox:r},r}async function resumePersisted(n,i){if(t===null)throw Error(`Sandbox session state is missing.`);let s=getSandboxEnvironmentRuntime(n.environment);if(t.providerName!==s.providerName)throw Error(`Sandbox session state belongs to provider "${t.providerName}", not "${s.providerName}".`);if(t.stateProtocolVersion!==s.stateProtocolVersion)throw Error(`Sandbox session state protocol ${t.stateProtocolVersion} is incompatible with provider "${s.providerName}" protocol ${s.stateProtocolVersion}.`);let c=o.inheritance?.nodeId??e.nodeId,l=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:c,providerName:s.providerName});if(l===void 0)throw new SandboxTemplateNotProvisionedError({providerName:s.providerName,templateKey:c});let u={host:createSandboxProviderHost(a),session:i,storagePath:resolveSandboxCacheDirectory(a)};r=s.implementation.resume(u,l,t.state).catch(e=>{throw r=void 0,e});let d=await r;return installHandle(s.providerName,d),trackActiveSandboxHandle({handle:d,providerName:s.providerName,sessionId:e.sessionId}),d}async function resolveHandle(){let i=o.inheritance,a=i?.definition??o.definition;if(a.kind!==`independent`)throw Error(`Sandbox "${a.logicalPath}" has no resolved parent.`);isEveDevEnvironment()&&e.compiledArtifactsSource.kind===`disk`&&await ensureDevelopmentSandboxesPrepared({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:i?.nodeId??e.nodeId,providerName:getSandboxEnvironmentRuntime(a.environment).providerName});let s={...contextStorage.getStore()===void 0?{auth:{current:null,initiator:null},id:e.sessionId,turn:{id:`sandbox-initialization`,sequence:0}}:buildCallbackContext().session,id:e.sessionId};if(t!==null)return await resumePersisted(a,s);if(i!==void 0)await open(getSandboxEnvironmentRuntime(a.environment),void 0,a.environment,s);else try{let e=await runWithSandboxConstructorRuntime({open:({environment:e,options:t,provider:n})=>open(n,t,e,s)},async()=>a.selector({session:s}));if(n===void 0||e!==n.sandbox)throw Error(`Sandbox "${a.logicalPath}" must return the sandbox it opens.`)}catch(e){let i=n?.handle;if(n=void 0,r=void 0,t=null,i!==void 0)try{await i.onSessionDelete()}catch(t){throw AggregateError([e,t],`Sandbox "${a.logicalPath}" initialization and cleanup both failed.`,{cause:e})}throw e}if(n===void 0)throw Error(`Sandbox "${a.logicalPath}" did not open a provider handle.`);return trackActiveSandboxHandle({handle:n.handle,providerName:n.providerName,sessionId:e.sessionId}),n.handle}function requireHandle(){return i===void 0&&(i=resolveHandle().catch(e=>{throw i=void 0,e})),i}let s=o.inheritance?.definition??o.definition;return{environment:s.kind===`independent`?s.environment:void 0,async captureState(){return r!==void 0&&await r,{session:t}},async delete(a){if(e.ownsSandbox===!1)throw Error(`Only the owning session can delete this sandbox.`);await(await requireHandle()).onSessionDelete(a),n=void 0,r=void 0,t=null,i=void 0},async get(){return await requireHandle(),n?.sandbox??null},async stop(){await(await requireHandle()).onSessionStop(),n=void 0,r=void 0,i=void 0}}}export{ensureSandboxAccess};

package/dist/src/execution/sandbox/glob-tool.js

@@ -1,3 +1,3 @@
-import{normalizeModelPath}from"#execution/tools/file-state.js";import{MAX_OUTPUT_BYTES}from"#execution/sandbox/truncate-output.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{resolveAbsoluteFilePath}from"#execution/sandbox/require-sandbox.js";import{ripgrepIsAvailable}from"#execution/sandbox/ripgrep-probe.js";async function executeGlobOnSandbox(e,t){let n=t.path??`/workspace`,r=await resolveAbsoluteFilePath(e,n),i=normalizeModelPath(r),a=Math.min(Math.max(1,t.limit??100),1e3),o=await ripgrepIsAvailable(e)?buildRipgrepCommand({normalizedPath:i,pattern:t.pattern}):buildPosixFindCommand({normalizedPath:i,pattern:t.pattern}),s=await e.run({command:o});if(s.exitCode!==0&&s.exitCode!==1||s.exitCode===1&&s.stderr.trim().length>0)throw buildGlobExecutionError(o,s.exitCode,s.stderr);let c=s.stdout.split(`
+import{MAX_OUTPUT_BYTES}from"#execution/sandbox/truncate-output.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{normalizeModelPath}from"#execution/tools/file-state.js";import{resolveAbsoluteFilePath}from"#execution/sandbox/require-sandbox.js";import{ripgrepIsAvailable}from"#execution/sandbox/ripgrep-probe.js";async function executeGlobOnSandbox(e,t){let n=t.path??`/workspace`,r=await resolveAbsoluteFilePath(e,n),i=normalizeModelPath(r),a=Math.min(Math.max(1,t.limit??100),1e3),o=await ripgrepIsAvailable(e)?buildRipgrepCommand({normalizedPath:i,pattern:t.pattern}):buildPosixFindCommand({normalizedPath:i,pattern:t.pattern}),s=await e.run({command:o});if(s.exitCode!==0&&s.exitCode!==1||s.exitCode===1&&s.stderr.trim().length>0)throw buildGlobExecutionError(o,s.exitCode,s.stderr);let c=s.stdout.split(`
 `).filter(e=>e.length>0),l=c.length>a,u=l?c.slice(0,a):c,d=[],f=0,p=!1;for(let e of u){let t=normalizeModelPath(e),n=Buffer.byteLength(t,`utf8`)+1;if(f+n>MAX_OUTPUT_BYTES&&d.length>0){p=!0;break}d.push(t),f+=n}if(d.length===0)return{content:`No files found`,count:0,path:i,truncated:!1};let m=l||p,h=[...d];return m&&(h.push(``),h.push(`(Results truncated: showing first ${d.length} results out of more. Use a more specific path or pattern to narrow results.)`)),{content:h.join(`
 `),count:d.length,path:i,truncated:m}}function buildRipgrepCommand(e){return[`rg --files --hidden`,`--glob '!.git/*'`,`--glob ${shellQuote(e.pattern)}`,shellQuote(e.normalizedPath)].join(` `)}function buildPosixFindCommand(e){let t=translateGlobToFindPattern(e.pattern),n=t.includes(`/`)?`-path ${shellQuote(`*/${t}`)}`:`-name ${shellQuote(t)}`;return[`find ${shellQuote(e.normalizedPath)}`,`-type f`,`-not -path '*/.git/*'`,n].join(` `)}function translateGlobToFindPattern(e){let t=e.replaceAll(`**`,`*`);for(;t.startsWith(`*/`);)t=t.slice(2);return t}function buildGlobExecutionError(e,t,n){let r=n.trim(),i=r.length>0?r:`no stderr output`;return Error(`glob failed (exit ${t}): ${i}\nCommand: ${e}`)}export{executeGlobOnSandbox};

package/dist/src/execution/sandbox/grep-tool.js

@@ -1,3 +1,3 @@
-import{normalizeModelPath}from"#execution/tools/file-state.js";import{MAX_OUTPUT_BYTES,capLineLength}from"#execution/sandbox/truncate-output.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{resolveAbsoluteFilePath}from"#execution/sandbox/require-sandbox.js";import{ripgrepIsAvailable}from"#execution/sandbox/ripgrep-probe.js";async function executeGrepOnSandbox(e,t){let n=t.path??`/workspace`,r=await resolveAbsoluteFilePath(e,n),i=normalizeModelPath(r),a=Math.min(Math.max(1,t.limit??100),1e3),o=t.context!==void 0&&t.context>0?t.context:0,s=await ripgrepIsAvailable(e)?buildRipgrepCommand({contextLines:o,effectiveLimit:a,glob:t.glob,ignoreCase:t.ignoreCase??!1,literal:t.literal??!1,normalizedPath:i,pattern:t.pattern}):buildPosixGrepCommand({contextLines:o,effectiveLimit:a,glob:t.glob,ignoreCase:t.ignoreCase??!1,literal:t.literal??!1,normalizedPath:i,pattern:t.pattern}),c=await e.run({command:s});if(c.exitCode!==0&&c.exitCode!==1||c.exitCode===1&&c.stderr.trim().length>0)throw buildGrepExecutionError(s,c.exitCode,c.stderr);let l=c.stdout;return l.trim().length===0?{content:`No matches found`,matchCount:0,path:i,truncated:!1}:processOutput({effectiveLimit:a,normalizedPath:i,stdout:l})}function buildRipgrepCommand(e){let t=[`rg`,`--line-number`,`--color=never`,`--hidden`,`--glob '!.git/*'`];return e.ignoreCase&&t.push(`--ignore-case`),e.literal&&t.push(`--fixed-strings`),e.glob!==void 0&&t.push(`--glob ${shellQuote(e.glob)}`),e.contextLines>0&&t.push(`--context ${e.contextLines}`),t.push(`--max-count ${e.effectiveLimit}`),t.push(`--`),t.push(shellQuote(e.pattern)),t.push(shellQuote(e.normalizedPath)),t.join(` `)}function buildPosixGrepCommand(e){let t=[`grep`,`-r`,`-n`,`--exclude-dir=.git`];return e.ignoreCase&&t.push(`-i`),e.literal?t.push(`-F`):t.push(`-E`),e.glob!==void 0&&t.push(`--include=${shellQuote(e.glob)}`),e.contextLines>0&&t.push(`-C ${e.contextLines}`),t.push(`-m ${e.effectiveLimit}`),t.push(`-e ${shellQuote(e.pattern)}`),t.push(shellQuote(e.normalizedPath)),t.join(` `)}function processOutput(e){let t=e.stdout.split(`
+import{MAX_OUTPUT_BYTES,capLineLength}from"#execution/sandbox/truncate-output.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{normalizeModelPath}from"#execution/tools/file-state.js";import{resolveAbsoluteFilePath}from"#execution/sandbox/require-sandbox.js";import{ripgrepIsAvailable}from"#execution/sandbox/ripgrep-probe.js";async function executeGrepOnSandbox(e,t){let n=t.path??`/workspace`,r=await resolveAbsoluteFilePath(e,n),i=normalizeModelPath(r),a=Math.min(Math.max(1,t.limit??100),1e3),o=t.context!==void 0&&t.context>0?t.context:0,s=await ripgrepIsAvailable(e)?buildRipgrepCommand({contextLines:o,effectiveLimit:a,glob:t.glob,ignoreCase:t.ignoreCase??!1,literal:t.literal??!1,normalizedPath:i,pattern:t.pattern}):buildPosixGrepCommand({contextLines:o,effectiveLimit:a,glob:t.glob,ignoreCase:t.ignoreCase??!1,literal:t.literal??!1,normalizedPath:i,pattern:t.pattern}),c=await e.run({command:s});if(c.exitCode!==0&&c.exitCode!==1||c.exitCode===1&&c.stderr.trim().length>0)throw buildGrepExecutionError(s,c.exitCode,c.stderr);let l=c.stdout;return l.trim().length===0?{content:`No matches found`,matchCount:0,path:i,truncated:!1}:processOutput({effectiveLimit:a,normalizedPath:i,stdout:l})}function buildRipgrepCommand(e){let t=[`rg`,`--line-number`,`--color=never`,`--hidden`,`--glob '!.git/*'`];return e.ignoreCase&&t.push(`--ignore-case`),e.literal&&t.push(`--fixed-strings`),e.glob!==void 0&&t.push(`--glob ${shellQuote(e.glob)}`),e.contextLines>0&&t.push(`--context ${e.contextLines}`),t.push(`--max-count ${e.effectiveLimit}`),t.push(`--`),t.push(shellQuote(e.pattern)),t.push(shellQuote(e.normalizedPath)),t.join(` `)}function buildPosixGrepCommand(e){let t=[`grep`,`-r`,`-n`,`--exclude-dir=.git`];return e.ignoreCase&&t.push(`-i`),e.literal?t.push(`-F`):t.push(`-E`),e.glob!==void 0&&t.push(`--include=${shellQuote(e.glob)}`),e.contextLines>0&&t.push(`-C ${e.contextLines}`),t.push(`-m ${e.effectiveLimit}`),t.push(`-e ${shellQuote(e.pattern)}`),t.push(shellQuote(e.normalizedPath)),t.join(` `)}function processOutput(e){let t=e.stdout.split(`
 `),n=[],r=0,i=0,a=!1;for(let e=0;e<t.length;e+=1){let o=t[e]??``;if(o.length===0&&e===t.length-1)continue;o!==`--`&&o.length>0&&/^.+:\d+:/.test(o)&&i++;let s=capLineLength(o),c=Buffer.byteLength(s,`utf8`)+1;if(r+c>MAX_OUTPUT_BYTES&&n.length>0){a=!0;break}n.push(s),r+=c}let o=a||i>=e.effectiveLimit,s=n.join(`
 `);if(o){let t=[];i>=e.effectiveLimit&&t.push(`Match limit reached (${e.effectiveLimit}). Use a larger limit or more specific pattern.`),a&&t.push(`Output truncated due to size. Use a more specific path or pattern.`),s+=`\n\n[${t.join(` `)}]`}return{content:s,matchCount:i,path:e.normalizedPath,truncated:o}}function buildGrepExecutionError(e,t,n){let r=n.trim(),i=r.length>0?r:`no stderr output`;return Error(`grep failed (exit ${t}): ${i}\nCommand: ${e}`)}export{executeGrepOnSandbox};

package/dist/src/execution/sandbox/logging-session.js

@@ -1,2 +1,2 @@
-import{truncateTail}from"#execution/sandbox/truncate-output.js";function createLoggingSandboxSession(e){let{log:t,session:n}=e;return{...n,async run(e){t?.(`preparation run: ${formatCommand(e.command)}`);let r=await n.run(e);if(r.exitCode===1)throw Error(formatPreparationRunFailure(e.command,r));return r},async spawn(e){return t?.(`preparation spawn: ${formatCommand(e.command)}`),await n.spawn(e)},...n.setNetworkPolicy===void 0?{}:{async setNetworkPolicy(e){return t?.(`preparation set network policy: ${formatNetworkPolicy(e)}`),await n.setNetworkPolicy(e)}},async writeFile(e){return t?.(`preparation write file: ${e.path}`),await n.writeFile(e)},async writeBinaryFile(e){return t?.(`preparation write binary file: ${e.path} (${e.content.byteLength} bytes)`),await n.writeBinaryFile(e)},async writeTextFile(e){return t?.(`preparation write text file: ${e.path} (${e.content.length} chars)`),await n.writeTextFile(e)},async removePath(e){return t?.(`preparation remove path: ${e.path}`),await n.removePath(e)}}}function formatPreparationRunFailure(e,t){return[`Sandbox preparation failed because sandbox.run command exited with code 1:`,e,``,`stdout:`,formatCapturedOutput(`stdout`,t.stdout),``,`stderr:`,formatCapturedOutput(`stderr`,t.stderr)].join(`
-`)}function formatCapturedOutput(e,t){let n=truncateTail(t);return n.truncated?`[${e} truncated: showing last ${n.outputLines} of ${n.totalLines} lines]\n${n.output}`:n.output}function formatCommand(e){return truncateOneLine(e)}function formatNetworkPolicy(e){return truncateOneLine(typeof e==`string`?e:JSON.stringify(e,(e,t)=>e===`transform`?`[redacted]`:t))}function truncateOneLine(e){let t=e.replaceAll(/\s+/g,` `).trim();return t.length<=240?t:`${t.slice(0,239)}…`}export{createLoggingSandboxSession};
+import{truncateTail}from"#execution/sandbox/truncate-output.js";function createLoggingSandboxSession(e){let{log:t,session:n}=e;return{...n,async run(e){t?.(`preparation run: ${formatCommand(e.command)}`);let r=await n.run(e);if(r.exitCode===1)throw Error(formatPreparationRunFailure(e.command,r));return r},async spawn(e){return t?.(`preparation spawn: ${formatCommand(e.command)}`),await n.spawn(e)},async writeFile(e){return t?.(`preparation write file: ${e.path}`),await n.writeFile(e)},async writeBinaryFile(e){return t?.(`preparation write binary file: ${e.path} (${e.content.byteLength} bytes)`),await n.writeBinaryFile(e)},async writeTextFile(e){return t?.(`preparation write text file: ${e.path} (${e.content.length} chars)`),await n.writeTextFile(e)},async removePath(e){return t?.(`preparation remove path: ${e.path}`),await n.removePath(e)}}}function formatPreparationRunFailure(e,t){return[`Sandbox preparation failed because sandbox.run command exited with code 1:`,e,``,`stdout:`,formatCapturedOutput(`stdout`,t.stdout),``,`stderr:`,formatCapturedOutput(`stderr`,t.stderr)].join(`
+`)}function formatCapturedOutput(e,t){let n=truncateTail(t);return n.truncated?`[${e} truncated: showing last ${n.outputLines} of ${n.totalLines} lines]\n${n.output}`:n.output}function formatCommand(e){return truncateOneLine(e)}function truncateOneLine(e){let t=e.replaceAll(/\s+/g,` `).trim();return t.length<=240?t:`${t.slice(0,239)}…`}export{createLoggingSandboxSession};

package/dist/src/execution/sandbox/provider-host.js

@@ -1 +1 @@
-import{resolve}from"node:path";function createSandboxProviderHost(e){return{async loadOptionalPackage(e){try{return await e.importModule()}catch(t){throw Error(e.missingMessage,{cause:t})}},resolveProjectPath(t){return resolve(e,t)}}}export{createSandboxProviderHost};
+import{resolve}from"node:path";import{importInstalledEnginePackage}from"#internal/application/optional-package-import.js";function createSandboxProviderHost(e){return{async loadOptionalPackage(t){try{return await t.importModule()}catch(n){try{return await importInstalledEnginePackage({appRoot:e,packageName:t.packageName})}catch(e){throw Error(t.missingMessage,{cause:AggregateError([n,e])})}}},resolveProjectPath(t){return resolve(e,t)}}}export{createSandboxProviderHost};

package/dist/src/execution/sandbox/read-file.js

@@ -1,3 +1,3 @@
-import{loadContext}from"#context/container.js";import{buildReadFileTargetKey,createReadFileStamp,normalizeModelPath,setReadFileStamp}from"#execution/tools/file-state.js";import{MAX_OUTPUT_BYTES,capLineLength}from"#execution/sandbox/truncate-output.js";import{resolveAbsoluteFilePath}from"#execution/sandbox/require-sandbox.js";async function executeReadFileOnSandbox(e,t){let{filePath:n,offset:r,limit:i}=t,a=await resolveAbsoluteFilePath(e,n),o=normalizeModelPath(a),s=r??1,c=i??2e3;if(s<1)throw Error(`offset must be >= 1. Received: ${s}.`);let l=await e.readTextFile({path:a});if(l===null)throw Error(`File not found: ${n}. Verify the path exists and is accessible in the sandbox.`);if(l.includes(`\0`))throw Error(`File "${n}" contains NUL bytes and appears to be a binary file. read_file only supports text files.`);let u=l.split(`
+import{loadContext}from"#context/container.js";import{MAX_OUTPUT_BYTES,capLineLength}from"#execution/sandbox/truncate-output.js";import{buildReadFileTargetKey,createReadFileStamp,normalizeModelPath,setReadFileStamp}from"#execution/tools/file-state.js";import{resolveAbsoluteFilePath}from"#execution/sandbox/require-sandbox.js";async function executeReadFileOnSandbox(e,t){let{filePath:n,offset:r,limit:i}=t,a=await resolveAbsoluteFilePath(e,n),o=normalizeModelPath(a),s=r??1,c=i??2e3;if(s<1)throw Error(`offset must be >= 1. Received: ${s}.`);let l=await e.readTextFile({path:a});if(l===null)throw Error(`File not found: ${n}. Verify the path exists and is accessible in the sandbox.`);if(l.includes(`\0`))throw Error(`File "${n}" contains NUL bytes and appears to be a binary file. read_file only supports text files.`);let u=l.split(`
 `),d=u.length>0&&u[u.length-1]===``?u.length-1:u.length;if(d===0){if(s>1)throw Error(`offset ${s} is past the end of the file (0 lines). Use the default offset to read an empty file.`)}else if(s>d)throw Error(`offset ${s} is past the end of the file (${d} lines).`);let f=createReadFileStamp({content:l,filePath:o}),p=buildReadFileTargetKey(o);if(setReadFileStamp(loadContext(),p,f),d===0)return{content:``,path:o,totalLines:0,truncated:!1};let m=s-1,h=Math.min(m+c,d),g=u.slice(m,h),_=[],v=0,y=!1;for(let e=0;e<g.length;e++){let t=`${s+e}: ${capLineLength(g[e]??``)}`,n=Buffer.byteLength(t,`utf8`)+1;if(v+n>MAX_OUTPUT_BYTES&&_.length>0){y=!0;break}_.push(t),v+=n}let b=_.join(`
 `),x=s+_.length-1;return x<d||y?{content:b,nextOffset:x+1,path:o,totalLines:d,truncated:!0}:{content:b,path:o,totalLines:d,truncated:!1}}export{executeReadFileOnSandbox};

package/dist/src/execution/sandbox/session.d.ts

@@ -1,5 +1,8 @@
-import type { InternalSandboxSession, MutableNetworkSandboxSession, SandboxSession } from "#shared/sandbox-session.js";
 import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+type NetworkPolicySandboxSession = SandboxSession & {
+    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
+};
+import type { InternalSandboxSession, SandboxSession } from "#shared/sandbox-session.js";
 export type { InternalSandboxSession };
 /**
  * Builds a public {@link SandboxSession} from provider-specific primitives.
@@ -13,5 +16,5 @@ export type { InternalSandboxSession };
  * Providers without mutable firewall support omit `setNetworkPolicy`; the
  * dedicated Vercel provider wires it to `sandbox.update`.
  */
-export declare function buildSandboxSession(primitives: InternalSandboxSession, setNetworkPolicy: (policy: SandboxNetworkPolicy) => Promise<void>): MutableNetworkSandboxSession;
+export declare function buildSandboxSession(primitives: InternalSandboxSession, setNetworkPolicy: (policy: SandboxNetworkPolicy) => Promise<void>): NetworkPolicySandboxSession;
 export declare function buildSandboxSession(primitives: InternalSandboxSession): SandboxSession;

package/dist/src/execution/sandbox/session.js

@@ -1,3 +1,3 @@
-import{bufferToStream,streamToBuffer}from"./stream-utils.js";function buildSandboxSession(e,t){async function run(t){let n=await e.spawn(t),[r,i,{exitCode:a}]=await Promise.all([collectStreamToString(n.stdout),collectStreamToString(n.stderr),n.wait()]);return{exitCode:a,stderr:i,stdout:r}}let n={resolvePath(t){return e.resolvePath(t)},run,async spawn(t){return await e.spawn(t)},async readFile(t){return await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)})},async readBinaryFile(t){let n=await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)});return n===null?null:await streamToBuffer(n)},async readTextFile(t){validateReadTextFileOptions(t);let n=await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)});return n===null?null:applyLineRange(decodeBytes(await streamToBuffer(n),t.encoding??`utf-8`),t)},async writeFile(t){await e.writeFile({abortSignal:t.abortSignal,content:t.content,path:e.resolvePath(t.path)})},async writeBinaryFile(t){await e.writeFile({abortSignal:t.abortSignal,content:bufferToStream(t.content),path:e.resolvePath(t.path)})},async writeTextFile(t){let n=encodeString(t.content,t.encoding??`utf-8`);await e.writeFile({abortSignal:t.abortSignal,content:bufferToStream(n),path:e.resolvePath(t.path)})},async removePath(t){await e.removePath({abortSignal:t.abortSignal,force:t.force,path:e.resolvePath(t.path),recursive:t.recursive})}};return t!==void 0&&(n.setNetworkPolicy=t),n}async function collectStreamToString(e){let t=await streamToBuffer(e);return new TextDecoder().decode(t)}function validateReadTextFileOptions(e){let{startLine:t,endLine:n}=e;if(t!==void 0&&(!Number.isInteger(t)||t<1))throw Error(`startLine must be a positive integer (1-based).`);if(n!==void 0&&(!Number.isInteger(n)||n<1))throw Error(`endLine must be a positive integer (1-based).`);if(t!==void 0&&n!==void 0&&t>n)throw Error(`startLine must not be greater than endLine.`)}function splitLinesPreservingEndings(e){let t=[],n=0;for(let r=0;r<e.length;r++)e[r]===`\r`?r+1<e.length&&e[r+1]===`
+import{bufferToStream,streamToBuffer}from"./stream-utils.js";function buildSandboxSession(e,t){async function run(t){let n=await e.spawn(t),[r,i,{exitCode:a}]=await Promise.all([collectStreamToString(n.stdout),collectStreamToString(n.stderr),n.wait()]);return{exitCode:a,stderr:i,stdout:r}}let n={resolvePath(t){return e.resolvePath(t)},run,async spawn(t){return await e.spawn(t)},async readFile(t){return await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)})},async readBinaryFile(t){let n=await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)});return n===null?null:await streamToBuffer(n)},async readTextFile(t){validateReadTextFileOptions(t);let n=await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)});return n===null?null:applyLineRange(decodeBytes(await streamToBuffer(n),t.encoding??`utf-8`),t)},async writeFile(t){await e.writeFile({abortSignal:t.abortSignal,content:t.content,path:e.resolvePath(t.path)})},async writeBinaryFile(t){await e.writeFile({abortSignal:t.abortSignal,content:bufferToStream(t.content),path:e.resolvePath(t.path)})},async writeTextFile(t){let n=encodeString(t.content,t.encoding??`utf-8`);await e.writeFile({abortSignal:t.abortSignal,content:bufferToStream(n),path:e.resolvePath(t.path)})},async removePath(t){await e.removePath({abortSignal:t.abortSignal,force:t.force,path:e.resolvePath(t.path),recursive:t.recursive})}};return t===void 0?n:{...n,setNetworkPolicy:t}}async function collectStreamToString(e){let t=await streamToBuffer(e);return new TextDecoder().decode(t)}function validateReadTextFileOptions(e){let{startLine:t,endLine:n}=e;if(t!==void 0&&(!Number.isInteger(t)||t<1))throw Error(`startLine must be a positive integer (1-based).`);if(n!==void 0&&(!Number.isInteger(n)||n<1))throw Error(`endLine must be a positive integer (1-based).`);if(t!==void 0&&n!==void 0&&t>n)throw Error(`startLine must not be greater than endLine.`)}function splitLinesPreservingEndings(e){let t=[],n=0;for(let r=0;r<e.length;r++)e[r]===`\r`?r+1<e.length&&e[r+1]===`
 `?(t.push(e.slice(n,r+2)),n=r+2,r++):(t.push(e.slice(n,r+1)),n=r+1):e[r]===`
 `&&(t.push(e.slice(n,r+1)),n=r+1);return n<e.length&&t.push(e.slice(n)),t}function applyLineRange(e,t){if(t.startLine===void 0&&t.endLine===void 0)return e;let n=splitLinesPreservingEndings(e),r=n.length,i=t.startLine??1,a=Math.min(t.endLine??r,r);return i>r?``:n.slice(i-1,a).join(``)}function decodeBytes(e,t){return t===`utf-8`||t===`utf8`?new TextDecoder(`utf-8`,{fatal:!0}).decode(e):Buffer.from(e.buffer,e.byteOffset,e.byteLength).toString(t)}function encodeString(e,t){return t===`utf-8`||t===`utf8`?new TextEncoder().encode(e):Buffer.from(e,t)}export{buildSandboxSession};

package/dist/src/execution/session/event-sink.d.ts

@@ -1,31 +1,25 @@
 import { buildAdapterContext } from "#channel/adapter-context.js";
 import { type ChannelAdapter } from "#channel/adapter.js";
 import type { ContextContainer } from "#context/container.js";
-import { bindDynamicConnections } from "#execution/dynamic-connections.js";
-import type { resolveEffectiveAgentRuntime } from "#execution/effective-agent-config.js";
-import type { HandleEventFn } from "#harness/types.js";
-import type { ExecutionInstrumentation } from "#instrumentation/runtime.js";
-import type { CompiledBundle } from "#runtime/sessions/runtime-context-keys.js";
+import { type MessageStreamEvent, type UnstampedMessageStreamEvent } from "#protocol/message.js";
 export interface SessionEventSinkInput {
-    readonly abortSignal: AbortSignal | undefined;
     readonly adapter: ChannelAdapter;
-    readonly bundle: CompiledBundle;
     readonly ctx: ContextContainer;
-    readonly effectiveAgent: ReturnType<typeof resolveEffectiveAgentRuntime>;
-    readonly instrumentation: ExecutionInstrumentation | undefined;
     readonly isFirstTurn: boolean;
     readonly sessionWritable: WritableStream<Uint8Array>;
     readonly sessionId: string;
 }
+export interface PublishedSessionEvent {
+    readonly event: MessageStreamEvent;
+    readonly suppressed: boolean;
+}
 export interface SessionEventSink {
     readonly adapterCtx: ReturnType<typeof buildAdapterContext>;
-    readonly dynamicConnections: ReturnType<typeof bindDynamicConnections>;
-    readonly effectiveNode: CompiledBundle["graph"]["root"];
-    readonly handleEvent: HandleEventFn;
+    emit(event: UnstampedMessageStreamEvent): Promise<PublishedSessionEvent>;
     /** Closes the parent stream; only a terminal `done` step does this. */
     close(): Promise<void>;
     /** Releases the writer lock so the next step can acquire it. Safe after `close()`. */
     release(): void;
 }
-/** Binds adapter context, dynamic connections, and event fan-out to one step's stream writer. */
+/** Publishes events without executing hooks or preparing model context. */
 export declare function createSessionEventSink(input: SessionEventSinkInput): SessionEventSink;

package/dist/src/execution/session/event-sink.js

@@ -1 +1 @@
-import{callAdapterEventHandler}from"#channel/adapter.js";import{ScheduleIdKey,TurnDeliveryIdsKey,TurnTaskDeliveryKey}from"#context/keys.js";import{encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{dispatchDynamicSubagentEvent}from"#context/dynamic-subagent-lifecycle.js";import{buildAdapterContext}from"#channel/adapter-context.js";import{dispatchDynamicModelEvent}from"#context/dynamic-model-lifecycle.js";import{dispatchDynamicToolEvent}from"#context/dynamic-tool-lifecycle.js";import{setChannelContext}from"#execution/channel-context.js";import{dispatchDynamicInstructionEvent}from"#context/dynamic-instruction-lifecycle.js";import{dispatchDynamicSkillEvent}from"#context/dynamic-skill-lifecycle.js";import{dispatchStreamEventHooks}from"#context/hook-lifecycle.js";import{dispatchMemoryLifecycleEvent}from"#context/memory-event-lifecycle.js";import*as activityCohort from"#execution/activity-cohort.js";import{bindDynamicConnections}from"#execution/dynamic-connections.js";import{observeSessionActivity}from"#execution/session-activity-projection.js";import{scheduledLaunchDeliveryEvent}from"#execution/scheduled-launch-delivery.js";import{forwardTaskEventToSessionCallback}from"#execution/task-event-callback.js";function createSessionEventSink(e){let{adapter:t,bundle:n,ctx:r,effectiveAgent:i,instrumentation:a}=e,o=buildAdapterContext(t,r),s=bindDynamicConnections(r,n.resolvedAgent),c={...n.graph.root,turnAgent:i.turnAgent},l=e.sessionWritable.getWriter(),emit=async n=>{let i=scheduledLaunchDeliveryEvent(n,{isFirstTurn:e.isFirstTurn,isScheduled:r.get(ScheduleIdKey)!==void 0,taskPhase:r.get(TurnTaskDeliveryKey)});if(i===void 0)return{event:stampMessageStreamEvent(n,r.get(TurnDeliveryIdsKey)),suppressed:!0};let a=await callAdapterEventHandler(t,i,o);setChannelContext(r,{...t,state:{...o.state}});let s=stampMessageStreamEvent(a,r.get(TurnDeliveryIdsKey));return await l.write(encodeMessageStreamEvent(s)),{event:s,suppressed:!1}},handleEvent=async(t,o)=>{activityCohort.updateActivityBlockers(r,t);let l=await forwardTaskEventToSessionCallback(r,t)?{event:stampMessageStreamEvent(t,r.get(TurnDeliveryIdsKey)),suppressed:!1}:await emit(t),u=await dispatchMemoryLifecycleEvent({abortSignal:e.abortSignal,appRoot:c.agent?.metadata?.appRoot??``,ctx:r,event:t,instrumentation:a?.memory,memories:c.agent?.memories??[],messages:o,nodeId:n.nodeId??`__root__`});observeSessionActivity({ctx:r,event:l.event,sessionId:e.sessionId}),l.suppressed||await dispatchStreamEventHooks({ctx:r,registry:n.hookRegistry,event:l.event}),l.event.type!==`step.started`&&await dispatchDynamicModelEvent({abortSignal:e.abortSignal,ctx:r,dynamicModel:i.turnAgent.dynamicModel,event:l.event,messages:u,scope:{moduleMap:n.moduleMap,nodeId:n.nodeId}}),await s.dispatch(l.event),await dispatchDynamicSubagentEvent({ctx:r,resolvers:n.subagentRegistry.dynamicResolvers??[],event:l.event,messages:u}),await dispatchDynamicToolEvent({ctx:r,resolvers:n.resolvedAgent.dynamicToolResolvers??[],event:l.event,messages:u}),await dispatchDynamicSkillEvent({ctx:r,resolvers:n.resolvedAgent.dynamicSkillResolvers??[],event:l.event,messages:u}),await dispatchDynamicInstructionEvent({ctx:r,resolvers:n.resolvedAgent.dynamicInstructionsResolvers??[],event:l.event,messages:u})},u=!1,release=()=>{u||(u=!0,l.releaseLock())};return{adapterCtx:o,close:async()=>{await l.close(),release()},dynamicConnections:s,effectiveNode:c,handleEvent,release}}export{createSessionEventSink};
+import{callAdapterEventHandler}from"#channel/adapter.js";import{ScheduleIdKey,TurnDeliveryIdsKey,TurnTaskDeliveryKey}from"#context/keys.js";import{encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{buildAdapterContext}from"#channel/adapter-context.js";import{setChannelContext}from"#execution/channel-context.js";import*as activityCohort from"#execution/activity-cohort.js";import{observeSessionActivity}from"#execution/session-activity-projection.js";import{scheduledLaunchDeliveryEvent}from"#execution/scheduled-launch-delivery.js";import{forwardTaskEventToSessionCallback}from"#execution/task-event-callback.js";function createSessionEventSink(e){let{adapter:t,ctx:n}=e,r=buildAdapterContext(t,n),i=e.sessionWritable.getWriter(),deliver=async a=>{if(await forwardTaskEventToSessionCallback(n,a))return{event:stampMessageStreamEvent(a,n.get(TurnDeliveryIdsKey)),suppressed:!1};let o=scheduledLaunchDeliveryEvent(a,{isFirstTurn:e.isFirstTurn,isScheduled:n.get(ScheduleIdKey)!==void 0,taskPhase:n.get(TurnTaskDeliveryKey)});if(o===void 0)return{event:stampMessageStreamEvent(a,n.get(TurnDeliveryIdsKey)),suppressed:!0};let s=await callAdapterEventHandler(t,o,r);setChannelContext(n,{...t,state:{...r.state}});let c=stampMessageStreamEvent(s,n.get(TurnDeliveryIdsKey));return await i.write(encodeMessageStreamEvent(c)),{event:c,suppressed:!1}},a=!1,release=()=>{a||(a=!0,i.releaseLock())};return{adapterCtx:r,async emit(t){activityCohort.updateActivityBlockers(n,t);let r=await deliver(t);return observeSessionActivity({ctx:n,event:r.event,sessionId:e.sessionId}),r},close:async()=>{await i.close(),release()},release}}export{createSessionEventSink};

package/dist/src/execution/session/handoff.d.ts

@@ -9,9 +9,9 @@ import type { RunMode } from "#shared/run-mode.js";
  * Cross-deployment checkpoint contract. The successor may run a different eve
  * build than the owner that produced it; bump when any field changes shape so
  * an incompatible successor rejects the handoff instead of misreading state.
- * The shared workflow tool run registry replaces the separate task and waiting-run records.
+ * Dynamic skill manifests retain instruction bodies and package revisions.
  */
-export declare const SESSION_CHECKPOINT_VERSION = 7;
+export declare const SESSION_CHECKPOINT_VERSION = 8;
 /** Everything a successor needs to continue an idle session. Hooks are derived from the state. */
 export interface SessionCheckpoint {
     readonly version: typeof SESSION_CHECKPOINT_VERSION;

package/dist/src/execution/session/handoff.js

@@ -1 +1 @@
-import{sessionHandoffMarkerToken}from"#execution/session-inbox/address.js";import{startSessionOwnerStep}from"#execution/workflow-runtime.js";import{createHook,getWorkflowMetadata}from"#compiled/@workflow/core/index.js";import{claimHookOwnership,disposeHook}from"#execution/hook-ownership.js";import{sessionHookTokens}from"#execution/session/hook-tokens.js";import{isSessionIdleForHandoffStep}from"#execution/session/handoff-steps.js";import{readAcceptedDeploymentId}from"#execution/session/accepted-deployment.js";const SESSION_CHECKPOINT_VERSION=7;function sessionAnchorToken(e){return`${e}:anchor`}var SessionHandoff=class{input;anchor;constructor(e){this.input=e}async tryTransfer(e,t){let{deploymentId:n,inbox:r}=this.input,i=readAcceptedDeploymentId(e.delivery);if(i===void 0)return{kind:`retained`,reason:`missing-deployment`};if(i===n)return{kind:`retained`,reason:`same-deployment`};if(!e.handoffEligible)return{kind:`retained`,reason:`busy`};if(!await isSessionIdleForHandoffStep(t))return{kind:`retained`,reason:`not-idle`};let a={...this.input.checkpoint,...t,version:7},o=sessionHookTokens(t);await this.ensureAnchor();let s=o.map(e=>createHook({token:sessionHandoffMarkerToken(e)}));await Promise.all(s.map(e=>claimHookOwnership(e)));try{let t=await r.release();if(t.length>0)return await this.recover(o,t),{kind:`retained`,reason:`accepted-during-release`};let n=[];try{let t=await this.startAndActivate(a,e.delivery,i);if(t.kind===`active`)return{kind:`transferred`};n=t.payloads}catch{}return await this.recover(o,n),{kind:`retained`,reason:`activation-failed`}}finally{await Promise.all(s.map(e=>disposeHook(e)))}}async awaitAnchoredResult(){if(this.anchor===void 0)throw Error(`Session anchor was never claimed.`);try{return await this.anchor}finally{await this.disposeAnchor()}}async disposeAnchor(){if(this.anchor===void 0)return;let e=this.anchor;this.anchor=void 0,await disposeHook(e)}async startAndActivate(e,t,n){let r=createHook({token:`${getWorkflowMetadata().workflowRunId}:handoff`});await claimHookOwnership(r);try{return await startSessionOwnerStep({activationToken:r.token,anchorRunId:this.input.sessionId,checkpoint:e,delivery:t,targetDeploymentId:n}),await r}finally{await disposeHook(r)}}async recover(e,t){await this.input.inbox.claimSessionHooks(e),this.input.inbox.restore(t)}async ensureAnchor(){this.input.isInitialOwner&&this.anchor===void 0&&(this.anchor=createHook({token:sessionAnchorToken(this.input.sessionId)}),await claimHookOwnership(this.anchor))}};export{SESSION_CHECKPOINT_VERSION,SessionHandoff,sessionAnchorToken};
+import{sessionHandoffMarkerToken}from"#execution/session-inbox/address.js";import{startSessionOwnerStep}from"#execution/workflow-runtime.js";import{createHook,getWorkflowMetadata}from"#compiled/@workflow/core/index.js";import{claimHookOwnership,disposeHook}from"#execution/hook-ownership.js";import{sessionHookTokens}from"#execution/session/hook-tokens.js";import{isSessionIdleForHandoffStep}from"#execution/session/handoff-steps.js";import{readAcceptedDeploymentId}from"#execution/session/accepted-deployment.js";const SESSION_CHECKPOINT_VERSION=8;function sessionAnchorToken(e){return`${e}:anchor`}var SessionHandoff=class{input;anchor;constructor(e){this.input=e}async tryTransfer(e,t){let{deploymentId:n,inbox:r}=this.input,i=readAcceptedDeploymentId(e.delivery);if(i===void 0)return{kind:`retained`,reason:`missing-deployment`};if(i===n)return{kind:`retained`,reason:`same-deployment`};if(!e.handoffEligible)return{kind:`retained`,reason:`busy`};if(!await isSessionIdleForHandoffStep(t))return{kind:`retained`,reason:`not-idle`};let a={...this.input.checkpoint,...t,version:8},o=sessionHookTokens(t);await this.ensureAnchor();let s=o.map(e=>createHook({token:sessionHandoffMarkerToken(e)}));await Promise.all(s.map(e=>claimHookOwnership(e)));try{let t=await r.release();if(t.length>0)return await this.recover(o,t),{kind:`retained`,reason:`accepted-during-release`};let n=[];try{let t=await this.startAndActivate(a,e.delivery,i);if(t.kind===`active`)return{kind:`transferred`};n=t.payloads}catch{}return await this.recover(o,n),{kind:`retained`,reason:`activation-failed`}}finally{await Promise.all(s.map(e=>disposeHook(e)))}}async awaitAnchoredResult(){if(this.anchor===void 0)throw Error(`Session anchor was never claimed.`);try{return await this.anchor}finally{await this.disposeAnchor()}}async disposeAnchor(){if(this.anchor===void 0)return;let e=this.anchor;this.anchor=void 0,await disposeHook(e)}async startAndActivate(e,t,n){let r=createHook({token:`${getWorkflowMetadata().workflowRunId}:handoff`});await claimHookOwnership(r);try{return await startSessionOwnerStep({activationToken:r.token,anchorRunId:this.input.sessionId,checkpoint:e,delivery:t,targetDeploymentId:n}),await r}finally{await disposeHook(r)}}async recover(e,t){await this.input.inbox.claimSessionHooks(e),this.input.inbox.restore(t)}async ensureAnchor(){this.input.isInitialOwner&&this.anchor===void 0&&(this.anchor=createHook({token:sessionAnchorToken(this.input.sessionId)}),await claimHookOwnership(this.anchor))}};export{SESSION_CHECKPOINT_VERSION,SessionHandoff,sessionAnchorToken};