eve 0.67.1 → 0.68.0

package/dist/src/evals/judge.d.ts

@@ -1,6 +1,6 @@
 import type { AssertionCollector } from "#evals/assertions/collector.js";
 import type { EveEvalJudgeConfig, JudgeContext } from "#evals/types.js";
-export interface JudgeDeps {
+interface JudgeDeps {
     readonly collector: AssertionCollector;
     readonly getReply: () => string | null;
     readonly getInput: () => string;
@@ -9,3 +9,4 @@ export interface JudgeDeps {
 }
 /** Bind evaluation-backed judgments to the existing assertion lifecycle. */
 export declare function buildJudgeContext(deps: JudgeDeps): JudgeContext;
+export {};

package/dist/src/evals/runner/execute-task.d.ts

@@ -21,7 +21,7 @@ interface ExecuteTaskOptions {
  * set when the `test` body threw (e.g. a failed `expectOk()` or a bespoke
  * `throw`); the partial run is still captured so recorded assertions report.
  */
-export interface ExecuteTaskResult {
+interface ExecuteTaskResult {
     readonly result: EveEvalTaskResult;
     readonly assertions: readonly AssertionResult[];
     readonly error?: string;

package/dist/src/evals/types.d.ts

@@ -244,7 +244,7 @@ export interface EveEvalLiveTurn {
     waitForEvent<TType extends MessageStreamEvent["type"]>(type: TType, options?: EveEvalWaitForEventOptions<TType>): Promise<EveEvalStreamEvent<TType>>;
 }
 /** Operations and state belonging to one accepted session. */
-export interface EveEvalSessionDriver {
+interface EveEvalSessionDriver {
     /** All events observed on this session so far. */
     readonly events: readonly MessageStreamEvent[];
     /**

package/dist/src/eve-channel/support.d.ts

@@ -2,7 +2,7 @@ import type { UserContent } from "ai";
 import type { SessionAuthContext } from "#channel/types.js";
 import type { MessageStreamEvent, SubagentCalledStreamEvent } from "#protocol/message.js";
 import type { ChannelCors } from "#public/definitions/channel.js";
-import { type EveChannelCors, type EveChannelCorsOptions, type EveChannelInput, type EveMessageContext, type EveMessageResult } from "#eve-channel/types.js";
+import { type EveChannelCors, type EveChannelInput } from "#eve-channel/types.js";
 export declare function healthResponse(): Response;
 export declare function findRemoteSubagentBinding(input: {
     readonly callId: string;
@@ -17,7 +17,6 @@ export declare function findRemoteSubagentBinding(input: {
     };
 }): Promise<SubagentCalledStreamEvent | undefined>;
 export declare function normalizeEveCors(cors: EveChannelCors | undefined): ChannelCors;
-export declare function normalizeEveCorsOrigin(origin: NonNullable<EveChannelCorsOptions["origin"]>): "*" | "null" | readonly string[];
 interface OnMessageOutcome {
     readonly auth: SessionAuthContext | null;
     readonly context?: readonly string[];
@@ -30,5 +29,4 @@ export declare function resolveOnMessage(input: {
     readonly request: Request;
     readonly sessionId?: string;
 }): Promise<OnMessageOutcome | Response>;
-export declare function defaultOnMessage(ctx: EveMessageContext): EveMessageResult;
 export {};

package/dist/src/eve-channel/support.js

@@ -1 +1 @@
-import{createLogger,logError}from"#internal/logging.js";import{defaultEveAuth}from"#eve-channel/types.js";import{workflowEntryReference}from"#execution/workflow-runtime.js";const log=createLogger(`eve.channel`);function healthResponse(){return Response.json({ok:!0,status:`ready`,workflowId:workflowEntryReference.workflowId})}async function findRemoteSubagentBinding(e){let t=await e.parent.getStreamTailIndex();if(t<0)return;let n=(await e.parent.getEventStream({startIndex:0})).getReader(),r;try{for(let i=0;i<=t;i+=1){let t=await n.read();if(t.done)break;let i=t.value;i.type===`subagent.called`&&i.data.sessionId===e.parentSessionId&&i.data.callId===e.callId&&i.data.childSessionId===e.childSessionId&&i.data.childStreamPath===e.childStreamPath&&i.data.remote!==void 0&&(r=i)}}finally{await n.cancel().catch(()=>{})}return r}function normalizeEveCors(e){if(e===void 0||e===!1)return!1;if(e===!0)return!0;let t={};return e.origin!==void 0&&(t.origin=normalizeEveCorsOrigin(e.origin)),e.methods!==void 0&&(t.methods=e.methods),e.allowedHeaders!==void 0&&(t.allowHeaders=e.allowedHeaders),e.exposedHeaders!==void 0&&(t.exposeHeaders=e.exposedHeaders),e.credentials!==void 0&&(t.credentials=e.credentials),e.maxAge!==void 0&&(t.maxAge=e.maxAge),e.preflightStatus!==void 0&&(t.preflight={statusCode:e.preflightStatus}),t}function normalizeEveCorsOrigin(e){return e===`*`||e===`null`?e:typeof e==`string`?[e]:e}async function resolveOnMessage(e){let t=e.config.onMessage??defaultOnMessage,n;try{if(n=await t({eve:e.sessionId===void 0?{caller:e.auth,request:e.request}:{caller:e.auth,request:e.request,sessionId:e.sessionId}},e.message),n==null)throw TypeError(`eveChannel onMessage must return an auth result.`)}catch(t){let n=logError(log,`onMessage handler failed`,t,{sessionId:e.sessionId});return Response.json({error:`onMessage handler failed.`,errorId:n,ok:!1},{status:500})}return{auth:n.auth,context:n.context,title:n.title}}function defaultOnMessage(e){return{auth:defaultEveAuth(e)}}export{defaultOnMessage,findRemoteSubagentBinding,healthResponse,normalizeEveCors,normalizeEveCorsOrigin,resolveOnMessage};
+import{createLogger,logError}from"#internal/logging.js";import{defaultEveAuth}from"#eve-channel/types.js";import{workflowEntryReference}from"#execution/workflow-runtime.js";const log=createLogger(`eve.channel`);function healthResponse(){return Response.json({ok:!0,status:`ready`,workflowId:workflowEntryReference.workflowId})}async function findRemoteSubagentBinding(e){let t=await e.parent.getStreamTailIndex();if(t<0)return;let n=(await e.parent.getEventStream({startIndex:0})).getReader(),r;try{for(let i=0;i<=t;i+=1){let t=await n.read();if(t.done)break;let i=t.value;i.type===`subagent.called`&&i.data.sessionId===e.parentSessionId&&i.data.callId===e.callId&&i.data.childSessionId===e.childSessionId&&i.data.childStreamPath===e.childStreamPath&&i.data.remote!==void 0&&(r=i)}}finally{await n.cancel().catch(()=>{})}return r}function normalizeEveCors(e){if(e===void 0||e===!1)return!1;if(e===!0)return!0;let t={};return e.origin!==void 0&&(t.origin=normalizeEveCorsOrigin(e.origin)),e.methods!==void 0&&(t.methods=e.methods),e.allowedHeaders!==void 0&&(t.allowHeaders=e.allowedHeaders),e.exposedHeaders!==void 0&&(t.exposeHeaders=e.exposedHeaders),e.credentials!==void 0&&(t.credentials=e.credentials),e.maxAge!==void 0&&(t.maxAge=e.maxAge),e.preflightStatus!==void 0&&(t.preflight={statusCode:e.preflightStatus}),t}function normalizeEveCorsOrigin(e){return e===`*`||e===`null`?e:typeof e==`string`?[e]:e}async function resolveOnMessage(e){let t=e.config.onMessage??defaultOnMessage,n;try{if(n=await t({eve:e.sessionId===void 0?{caller:e.auth,request:e.request}:{caller:e.auth,request:e.request,sessionId:e.sessionId}},e.message),n==null)throw TypeError(`eveChannel onMessage must return an auth result.`)}catch(t){let n=logError(log,`onMessage handler failed`,t,{sessionId:e.sessionId});return Response.json({error:`onMessage handler failed.`,errorId:n,ok:!1},{status:500})}return{auth:n.auth,context:n.context,title:n.title}}function defaultOnMessage(e){return{auth:defaultEveAuth(e)}}export{findRemoteSubagentBinding,healthResponse,normalizeEveCors,resolveOnMessage};

package/dist/src/execution/continuation-conflict-step.js

@@ -1 +1 @@
-import{walkCauseChain}from"#shared/errors.js";import{cancelRun,getWorld}from"#internal/workflow/runtime.js";import{EntityConflictError,RunExpiredError,WorkflowRunNotFoundError}from"#compiled/@workflow/errors/index.js";import{resumeSessionInbox}from"#execution/session-inbox/resume.js";async function settleContinuationConflictStep(e){"use step";try{e.command!==void 0&&await resumeSessionInbox(e.continuationToken,e.command)}finally{e.activityCollectorRunId!==void 0&&await cancelCollector(e.activityCollectorRunId)}}async function cancelCollector(e){try{await cancelRun(await getWorld(),e,{cancelReason:`Session candidate did not acquire continuation ownership`})}catch(e){if(!isInactiveRun(e))throw e}}function isInactiveRun(e){for(let t of walkCauseChain(e))if(WorkflowRunNotFoundError.is(t)||RunExpiredError.is(t)||EntityConflictError.is(t))return!0;return!1}export{settleContinuationConflictStep};
+import{cancelRun,getWorld}from"#internal/workflow/runtime.js";import{isInactiveWorkflowRunError}from"#internal/workflow/is-inactive-workflow-run-error.js";import{resumeSessionInbox}from"#execution/session-inbox/resume.js";async function settleContinuationConflictStep(e){"use step";try{e.command!==void 0&&await resumeSessionInbox(e.continuationToken,e.command)}finally{e.activityCollectorRunId!==void 0&&await cancelCollector(e.activityCollectorRunId)}}async function cancelCollector(e){try{await cancelRun(await getWorld(),e,{cancelReason:`Session candidate did not acquire continuation ownership`})}catch(e){if(!isInactiveWorkflowRunError(e))throw e}}export{settleContinuationConflictStep};

package/dist/src/execution/dynamic-workflow/schema.d.ts

@@ -20,7 +20,7 @@ export interface WorkflowProgramInput {
     readonly maxSubagents: number;
 }
 export type WorkflowProgramOptions = Pick<WorkflowProgramInput, "maxSubagents">;
-export interface WorkflowProgramAgentCall {
+interface WorkflowProgramAgentCall {
     readonly input: {
         readonly agentId?: string;
         readonly message: string;
@@ -34,3 +34,4 @@ export declare function readWorkflowProgramCallInterrupt(input: {
 }): WorkflowProgramCallInterrupt;
 export declare function readWorkflowProgramAgentCall(value: unknown): WorkflowProgramAgentCall;
 export declare function parseWorkflowProgramOutput(value: unknown): JsonValue;
+export {};

package/dist/src/execution/dynamic-workflow/tool.js

@@ -1 +1 @@
-import{runJsProgram}from"#execution/dynamic-workflow/workflow.js";async function executeWorkflowProgram(e,t){"use workflow";return runJsProgram(e.js,t,{maxSubagents:e.maxSubagents??0})}executeWorkflowProgram.workflowId=`workflow//eve@0.67.1//executeWorkflowProgram`;export{executeWorkflowProgram};
+import{runJsProgram}from"#execution/dynamic-workflow/workflow.js";async function executeWorkflowProgram(e,t){"use workflow";return runJsProgram(e.js,t,{maxSubagents:e.maxSubagents??0})}executeWorkflowProgram.workflowId=`workflow//eve@0.68.0//executeWorkflowProgram`;export{executeWorkflowProgram};

package/dist/src/execution/effective-agent-config.d.ts

@@ -3,10 +3,11 @@ import type { RuntimeTurnAgent } from "#runtime/agent/bootstrap.js";
 import type { CompiledBundle } from "#runtime/sessions/runtime-context-keys.js";
 import type { AgentLimitsDefinition } from "#shared/agent-definition.js";
 import type { DynamicSubagentAgentConfig } from "#runtime/subagents/dynamic-agent-config.js";
-export interface EffectiveAgentRuntime {
+interface EffectiveAgentRuntime {
     readonly limits?: AgentLimitsDefinition;
     readonly thresholdPercent?: number;
     readonly turnAgent: RuntimeTurnAgent;
 }
 export declare function resolveEffectiveAgentRuntime(bundle: Pick<CompiledBundle, "resolvedAgent" | "turnAgent">, context: ContextReader): EffectiveAgentRuntime;
 export declare function resolveEffectiveAgentRuntimeFromConfig(bundle: Pick<CompiledBundle, "resolvedAgent" | "turnAgent">, config: DynamicSubagentAgentConfig | undefined): EffectiveAgentRuntime;
+export {};

package/dist/src/execution/eve-workflow-attributes.d.ts

@@ -41,13 +41,13 @@ import type { EveAttributeValue } from "#runtime/attributes/normalize.js";
  * delegated child runs. Tag emitters use this to populate
  * `$eve.subagent`.
  */
-export interface SessionIdentitySummary {
+interface SessionIdentitySummary {
     readonly nodeId: string;
 }
 /**
  * Parent session lineage decoded from the serialized run context.
  */
-export interface SessionParentLineage {
+interface SessionParentLineage {
     readonly callId?: string;
     readonly rootSessionId?: string;
     readonly sessionId?: string;
@@ -60,7 +60,6 @@ export interface SessionParentLineage {
  */
 export declare function readChannelKind(serializedContext: Record<string, unknown>): string | undefined;
 export declare function isWorkflowTraceContentVisible(serializedContext: Record<string, unknown>): boolean;
-export declare function isWorkflowOtelTraceEnabled(serializedContext: Record<string, unknown>): boolean;
 export declare function readSessionTraceId(serializedContext: Record<string, unknown>): string | undefined;
 /**
  * Reads parent session lineage from a deserialized context map. Returns
@@ -90,8 +89,6 @@ export declare function readRootSessionId(serializedContext: Record<string, unkn
 export declare function readChannelRequestId(serializedContext: Record<string, unknown>): string | undefined;
 /** Reads the schedule name inherited from a schedule dispatch scope. */
 export declare function readScheduleId(serializedContext: Record<string, unknown>): string | undefined;
-/** Reads the bounded title stored for a top-level session. */
-export declare function readSessionTitle(serializedContext: Record<string, unknown>): string | undefined;
 /**
  * Maximum visible length (in code points) of a derived `$eve.title`.
  *
@@ -142,3 +139,4 @@ export declare function buildSubagentRootAttributes(input: {
     readonly rootSessionId: string;
     readonly serializedContext: Record<string, unknown>;
 }): Record<string, EveAttributeValue>;
+export {};

package/dist/src/execution/eve-workflow-attributes.js

@@ -1 +1 @@
-import{isNonEmptyString}from"#shared/guards.js";import{ConversationContextKey,normalizeConversationContext}from"#shared/conversation-context.js";import{resolveForwardedTraceSeed}from"#shared/forwarded-trace-policy.js";import{ChannelRequestIdKey,OtelTraceEnabledKey,ScheduleIdKey,SessionTitleKey,SessionTraceSeedKey}from"#context/keys.js";import{CHANNEL_CONTEXT_KEY_NAME}from"#context/key-names.js";import{shouldCaptureInstrumentationContent}from"#shared/instrumentation-content.js";import{isSampledTrace}from"#tracing/sampled-trace.js";function readChannelKind(e){let t=e[CHANNEL_CONTEXT_KEY_NAME]?.kind;return isNonEmptyString(t)?t:void 0}function isWorkflowTraceContentVisible(e){let t=e[SessionTraceSeedKey.name];if(t!==void 0){let n=resolveForwardedTraceSeed(t);if(n.forwardedTracePolicy!==void 0||readParentSessionId(e)!==void 0){let e=n.decision;return e?.action===`record`&&e.recordInputs&&e.recordOutputs}}let n=normalizeConversationContext(e[ConversationContextKey.name]);return shouldCaptureInstrumentationContent({audience:n?.audience??`unknown`,environment:n?.environment??`production`})}function isWorkflowOtelTraceEnabled(e){return e[OtelTraceEnabledKey.name]===!0}function readSessionTraceId(e){let t=e[SessionTraceSeedKey.name];if(t===void 0)return;let n=resolveForwardedTraceSeed(t);if(isSampledTrace(n))return isNonEmptyString(t.traceId)?t.traceId:void 0}function readParentLineage(e){let t=e[`eve.parentSession`],n=t?.callId,r=t?.rootSessionId,i=t?.sessionId,a=t?.turn?.id;return{callId:isNonEmptyString(n)?n:void 0,rootSessionId:isNonEmptyString(r)?r:void 0,sessionId:isNonEmptyString(i)?i:void 0,turnId:isNonEmptyString(a)?a:void 0}}function readParentSessionId(e){return readParentLineage(e).sessionId}function readRootSessionId(e){return readParentLineage(e).rootSessionId}function readChannelRequestId(e){let t=e[ChannelRequestIdKey.name];return isNonEmptyString(t)?t:void 0}function readScheduleId(e){let t=e[ScheduleIdKey.name];return isNonEmptyString(t)?t:void 0}function readSessionTitle(e){let t=e[SessionTitleKey.name];return isNonEmptyString(t)?t:void 0}const EVE_SESSION_TITLE_MAX_CHARS=125;function deriveSessionTitle(e){let t=collectMessageText(e);if(t===void 0||t.length===0)return;let n=t.replace(/\s+/gu,` `).trim();if(n.length===0)return;let r=Array.from(n);return r.length<=125?n:`${r.slice(0,124).join(``)}…`}function collectMessageText(e){if(typeof e==`string`)return e;if(!Array.isArray(e))return;let t=[];for(let n of e)n&&typeof n==`object`&&n.type===`text`&&typeof n.text==`string`&&t.push(n.text);return t.length>0?t.join(` `):void 0}function buildSessionAttributes(e){let t=isWorkflowTraceContentVisible(e.serializedContext),n=isWorkflowOtelTraceEnabled(e.serializedContext);return{"$eve.channel_request_id":readChannelRequestId(e.serializedContext),"$eve.schedule":readScheduleId(e.serializedContext),"$eve.is_otel_trace_enabled":n,"$eve.is_trace_content_visible":t,"$eve.trace_id":readSessionTraceId(e.serializedContext),"$eve.type":`session`,"$eve.trigger":readChannelKind(e.serializedContext),"$eve.title":readSessionTitle(e.serializedContext)}}function buildSubagentRootAttributes(e){return{"$eve.channel_request_id":readChannelRequestId(e.serializedContext),"$eve.is_otel_trace_enabled":isWorkflowOtelTraceEnabled(e.serializedContext),"$eve.is_trace_content_visible":isWorkflowTraceContentVisible(e.serializedContext),"$eve.trace_id":readSessionTraceId(e.serializedContext),"$eve.type":`subagent`,"$eve.parent":e.parentSessionId,"$eve.parent_call":e.parentCallId,"$eve.parent_turn":e.parentTurnId,"$eve.root":e.rootSessionId,"$eve.subagent":e.identity.nodeId,"$eve.trigger":readChannelKind(e.serializedContext)}}export{EVE_SESSION_TITLE_MAX_CHARS,buildSessionAttributes,buildSubagentRootAttributes,deriveSessionTitle,isWorkflowOtelTraceEnabled,isWorkflowTraceContentVisible,readChannelKind,readChannelRequestId,readParentLineage,readParentSessionId,readRootSessionId,readScheduleId,readSessionTitle,readSessionTraceId};
+import{isNonEmptyString}from"#shared/guards.js";import{ConversationContextKey,normalizeConversationContext}from"#shared/conversation-context.js";import{resolveForwardedTraceSeed}from"#shared/forwarded-trace-policy.js";import{ChannelRequestIdKey,OtelTraceEnabledKey,ScheduleIdKey,SessionTitleKey,SessionTraceSeedKey}from"#context/keys.js";import{CHANNEL_CONTEXT_KEY_NAME}from"#context/key-names.js";import{shouldCaptureInstrumentationContent}from"#shared/instrumentation-content.js";import{isSampledTrace}from"#tracing/sampled-trace.js";function readChannelKind(e){let t=e[CHANNEL_CONTEXT_KEY_NAME]?.kind;return isNonEmptyString(t)?t:void 0}function isWorkflowTraceContentVisible(e){let t=e[SessionTraceSeedKey.name];if(t!==void 0){let n=resolveForwardedTraceSeed(t);if(n.forwardedTracePolicy!==void 0||readParentSessionId(e)!==void 0){let e=n.decision;return e?.action===`record`&&e.recordInputs&&e.recordOutputs}}let n=normalizeConversationContext(e[ConversationContextKey.name]);return shouldCaptureInstrumentationContent({audience:n?.audience??`unknown`,environment:n?.environment??`production`})}function isWorkflowOtelTraceEnabled(e){return e[OtelTraceEnabledKey.name]===!0}function readSessionTraceId(e){let t=e[SessionTraceSeedKey.name];if(t===void 0)return;let n=resolveForwardedTraceSeed(t);if(isSampledTrace(n))return isNonEmptyString(t.traceId)?t.traceId:void 0}function readParentLineage(e){let t=e[`eve.parentSession`],n=t?.callId,r=t?.rootSessionId,i=t?.sessionId,a=t?.turn?.id;return{callId:isNonEmptyString(n)?n:void 0,rootSessionId:isNonEmptyString(r)?r:void 0,sessionId:isNonEmptyString(i)?i:void 0,turnId:isNonEmptyString(a)?a:void 0}}function readParentSessionId(e){return readParentLineage(e).sessionId}function readRootSessionId(e){return readParentLineage(e).rootSessionId}function readChannelRequestId(e){let t=e[ChannelRequestIdKey.name];return isNonEmptyString(t)?t:void 0}function readScheduleId(e){let t=e[ScheduleIdKey.name];return isNonEmptyString(t)?t:void 0}function readSessionTitle(e){let t=e[SessionTitleKey.name];return isNonEmptyString(t)?t:void 0}const EVE_SESSION_TITLE_MAX_CHARS=125;function deriveSessionTitle(e){let t=collectMessageText(e);if(t===void 0||t.length===0)return;let n=t.replace(/\s+/gu,` `).trim();if(n.length===0)return;let r=Array.from(n);return r.length<=125?n:`${r.slice(0,124).join(``)}…`}function collectMessageText(e){if(typeof e==`string`)return e;if(!Array.isArray(e))return;let t=[];for(let n of e)n&&typeof n==`object`&&n.type===`text`&&typeof n.text==`string`&&t.push(n.text);return t.length>0?t.join(` `):void 0}function buildSessionAttributes(e){let t=isWorkflowTraceContentVisible(e.serializedContext),n=isWorkflowOtelTraceEnabled(e.serializedContext);return{"$eve.channel_request_id":readChannelRequestId(e.serializedContext),"$eve.schedule":readScheduleId(e.serializedContext),"$eve.is_otel_trace_enabled":n,"$eve.is_trace_content_visible":t,"$eve.trace_id":readSessionTraceId(e.serializedContext),"$eve.type":`session`,"$eve.trigger":readChannelKind(e.serializedContext),"$eve.title":readSessionTitle(e.serializedContext)}}function buildSubagentRootAttributes(e){return{"$eve.channel_request_id":readChannelRequestId(e.serializedContext),"$eve.is_otel_trace_enabled":isWorkflowOtelTraceEnabled(e.serializedContext),"$eve.is_trace_content_visible":isWorkflowTraceContentVisible(e.serializedContext),"$eve.trace_id":readSessionTraceId(e.serializedContext),"$eve.type":`subagent`,"$eve.parent":e.parentSessionId,"$eve.parent_call":e.parentCallId,"$eve.parent_turn":e.parentTurnId,"$eve.root":e.rootSessionId,"$eve.subagent":e.identity.nodeId,"$eve.trigger":readChannelKind(e.serializedContext)}}export{EVE_SESSION_TITLE_MAX_CHARS,buildSessionAttributes,buildSubagentRootAttributes,deriveSessionTitle,isWorkflowTraceContentVisible,readChannelKind,readChannelRequestId,readParentLineage,readParentSessionId,readRootSessionId,readScheduleId,readSessionTraceId};

package/dist/src/execution/history-view.d.ts

@@ -1,9 +1,10 @@
 import type { HarnessSession } from "#harness/types.js";
 import { type HistoryViewProjector, type PreparedHistoryView } from "#shared/history-view.js";
-export interface ExecutionHistoryView {
+interface ExecutionHistoryView {
     readonly initial: PreparedHistoryView;
     readonly messages: (session: HarnessSession) => PreparedHistoryView["messages"];
     readonly prepare: (session: HarnessSession) => PreparedHistoryView;
     readonly projector: HistoryViewProjector;
 }
 export declare function createExecutionHistoryView(session: HarnessSession): ExecutionHistoryView;
+export {};

package/dist/src/execution/node-step.d.ts

@@ -12,14 +12,14 @@ import type { HistoryViewProjector, PreparedHistoryView } from "#shared/history-
  * `createWorkflowRuntime`, so callers pass the constructor directly —
  * no wrapper needed.
  */
-export type CreateRuntime = (config: {
+type CreateRuntime = (config: {
     readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;
     readonly nodeId?: string;
 }) => Runtime;
 /**
  * Input for building a harness step for one resolved runtime node.
  */
-export interface CreateExecutionNodeStepInput {
+interface CreateExecutionNodeStepInput {
     readonly steeringSignal?: AbortSignal;
     /** Cancellation signal forwarded to the tool-loop harness. */
     readonly abortSignal?: AbortSignal;
@@ -68,3 +68,4 @@ export declare function buildRuntimeIdentity(node: ResolvedRuntimeAgentNode): Ru
 export declare function createNodeHarnessTools(input: {
     readonly node: ResolvedRuntimeAgentNode;
 }): HarnessToolMap;
+export {};

package/dist/src/execution/proxied-deliver-step.js

@@ -1 +1 @@
-import{createInputResolvedEvent,encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{getPendingCoordinationBatch}from"#harness/coordination.js";import{readDurableSession,replaceDurableSessionSnapshot}from"#execution/durable-session-store.js";import{getBackgroundTasks}from"#harness/workflow-tool-runs.js";import{resumeSessionInbox}from"#execution/session-inbox/resume.js";import{createTaskInputRequestId,retireProxyInputRequests}from"#harness/proxy-input-requests.js";import{coalesceDeliverPayloads}from"#execution/deliver-payloads.js";import{hasDelegatedSessionContext}from"#execution/delegated-session-context.js";import{routeDeliverPayload}from"#subagents/hitl-proxy.js";import{sendTaskInboundPayload}from"#execution/tasks/parent/run-parent.js";import{resumeWorkflowToolRunAnswers,resumeWorkflowToolRunDismissal}from"#execution/tools/workflow/answer.js";async function routeProxiedDeliverStep(e){"use step";let t=readDurableSession(e.sessionState),n=e.delivery,r=new Map,i=new Map,a,o=!hasDelegatedSessionContext(e.serializedContext??{})&&n.caller===void 0&&n.taskDeliveryId===void 0,s=new Set;for(let[e,c]of n.payloads.entries()){let l=routeDeliverPayload({allowRoute:(e,n)=>!s.has(e)&&(n.taskId===void 0||getBackgroundTasks(t.state).get(n.taskId)!==void 0),payload:c,resolveMessage:o,state:t.state});a??=l.parentAction,l.forSelf!==void 0&&r.set(e,l.forSelf);for(let[t,r]of l.forChildren.entries()){if(r.answerHook!==void 0)for(let e of r.retireRequestIds)s.add(e);let a=[r.childContinuationToken,r.childSessionInbox?.sessionId??``,r.childResponseUrl??``,r.taskId??``].join(`\0`),o=i.get(a)??{answerHook:r.answerHook,childContinuationToken:r.childContinuationToken,childSessionInbox:r.childSessionInbox,childResponseUrl:r.childResponseUrl,dismissedRequestIds:[],metadata:[],payloads:[],retireRequestIds:[],sourcePayloadIndexes:[],taskId:r.taskId},c=o.payloads.length;if(o.payloads.push(r.payload),o.dismissedRequestIds.push(...r.dismissedRequestIds??[]),o.retireRequestIds.push(...r.retireRequestIds),o.sourcePayloadIndexes.push(e),l.forSelf===void 0&&t===0)for(let t of n.deliveryMetadata??[])t.payloadIndex===e&&o.metadata.push({...t,payloadIndex:c});i.set(a,o)}}let c=!1;for(let a of i.values()){let i=a.taskId;if(i!==void 0){let e=getBackgroundTasks(t.state).get(i)?.run;if(e===void 0){mergeStrandedResponses(r,a,i);continue}if(await sendTaskInboundPayload({taskInboxToken:e.address.hookToken,payload:{auth:n.auth,childContinuationToken:a.childContinuationToken,childSessionInbox:a.childSessionInbox,childResponseUrl:a.childResponseUrl,inputResponses:coalesceDeliverPayloads(a.payloads).inputResponses??[],kind:`input-response`,taskId:i}})===`unreachable`){mergeStrandedResponses(r,a,i);continue}t=retireProxyInputRequests(t,a.retireRequestIds),c=!0;continue}if(a.answerHook!==void 0){let n=coalesceDeliverPayloads(a.payloads).inputResponses??[];await resumeWorkflowToolRunAnswers(a.childContinuationToken,n),a.dismissedRequestIds.length>0&&await resumeWorkflowToolRunDismissal(a.childContinuationToken),a.answerHook.question!==void 0&&await emitQuestionResolutions({dismissedRequestIds:a.dismissedRequestIds,responses:n,sessionState:t.state,sessionWritable:e.sessionWritable}),t=retireProxyInputRequests(t,a.retireRequestIds),c=!0;continue}let o={...n,deliveryMetadata:a.metadata.length===0?void 0:a.metadata,payloads:a.payloads};await resumeSessionInbox(a.childSessionInbox??a.childContinuationToken,o),t=retireProxyInputRequests(t,a.retireRequestIds),c=!0}let l={serializedContext:e.serializedContext??{},sessionState:c?replaceDurableSessionSnapshot({session:t,state:e.sessionState}):e.sessionState};if(a!==void 0)return{...l,...a};let u=[...r].sort(([e],[t])=>e-t),d=u.flatMap(([e],t)=>(n.deliveryMetadata??[]).filter(t=>t.payloadIndex===e).map(e=>({...e,payloadIndex:t}))),f=u.length===0?void 0:{...n,deliveryMetadata:d.length===0?void 0:d,payloads:u.map(([,e])=>e)};return{...l,kind:`continue`,remainder:f}}async function emitQuestionResolutions(e){let t=getPendingCoordinationBatch(e.sessionState)?.event;if(t===void 0)return;let n=[...e.responses.map(e=>({kind:`question`,outcome:`answered`,requestId:e.requestId,response:e})),...e.dismissedRequestIds.map(e=>({kind:`question`,outcome:`ignored`,requestId:e}))];if(n.length===0)return;let r=e.sessionWritable.getWriter();try{await r.write(encodeMessageStreamEvent(stampMessageStreamEvent(createInputResolvedEvent({resolutions:n,...t}))))}finally{r.releaseLock()}}function mergeStrandedResponses(e,t,n){for(let[r,i]of t.payloads.entries()){let a=t.sourcePayloadIndexes[r];if(a===void 0)continue;let o=(i.inputResponses??[]).map(e=>({...e,requestId:createTaskInputRequestId(n,e.requestId)}));if(o.length===0)continue;let s=e.get(a);e.set(a,{...s,inputResponses:[...s?.inputResponses??[],...o]})}}export{routeProxiedDeliverStep};
+import{createInputResolvedEvent,encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{getPendingCoordinationBatch}from"#harness/coordination.js";import{readDurableSession,replaceDurableSessionSnapshot}from"#execution/durable-session-store.js";import{getBackgroundTasks}from"#harness/workflow-tool-runs.js";import{resumeSessionInbox}from"#execution/session-inbox/resume.js";import{createTaskInputRequestId,retireProxyInputRequests}from"#harness/proxy-input-requests.js";import{coalesceDeliverPayloads}from"#execution/deliver-payloads.js";import{hasDelegatedSessionContext}from"#execution/delegated-session-context.js";import{routeDeliverPayload}from"#subagents/hitl-proxy.js";import{sendTaskInboundPayload}from"#execution/tasks/parent/run-parent.js";import{resumeWorkflowToolRunAnswers,resumeWorkflowToolRunDismissal,toToolInputResponseResponder}from"#execution/tools/workflow/answer.js";async function routeProxiedDeliverStep(e){"use step";let t=readDurableSession(e.sessionState),n=e.delivery,r=new Map,i=new Map,a,o=!hasDelegatedSessionContext(e.serializedContext??{})&&n.caller===void 0&&n.taskDeliveryId===void 0,s=new Set;for(let[e,c]of n.payloads.entries()){let l=routeDeliverPayload({allowRoute:(e,n)=>!s.has(e)&&(n.taskId===void 0||getBackgroundTasks(t.state).get(n.taskId)!==void 0),payload:c,resolveMessage:o,state:t.state});a??=l.parentAction,l.forSelf!==void 0&&r.set(e,l.forSelf);for(let[t,r]of l.forChildren.entries()){if(r.answerHook!==void 0)for(let e of r.retireRequestIds)s.add(e);let a=[r.childContinuationToken,r.childSessionInbox?.sessionId??``,r.childResponseUrl??``,r.taskId??``].join(`\0`),o=i.get(a)??{answerHook:r.answerHook,childContinuationToken:r.childContinuationToken,childSessionInbox:r.childSessionInbox,childResponseUrl:r.childResponseUrl,dismissedRequestIds:[],metadata:[],payloads:[],retireRequestIds:[],sourcePayloadIndexes:[],taskId:r.taskId},c=o.payloads.length;if(o.payloads.push(r.payload),o.dismissedRequestIds.push(...r.dismissedRequestIds??[]),o.retireRequestIds.push(...r.retireRequestIds),o.sourcePayloadIndexes.push(e),l.forSelf===void 0&&t===0)for(let t of n.deliveryMetadata??[])t.payloadIndex===e&&o.metadata.push({...t,payloadIndex:c});i.set(a,o)}}let c=!1;for(let a of i.values()){let i=a.taskId;if(i!==void 0){let e=getBackgroundTasks(t.state).get(i)?.run;if(e===void 0){mergeStrandedResponses(r,a,i);continue}let o=coalesceDeliverPayloads(a.payloads);if(await sendTaskInboundPayload({taskInboxToken:e.address.hookToken,payload:{auth:n.auth,childContinuationToken:a.childContinuationToken,childSessionInbox:a.childSessionInbox,childResponseUrl:a.childResponseUrl,inputResponses:o.inputResponses??[],kind:`input-response`,responder:o.responder??toToolInputResponseResponder(n.auth),taskId:i}})===`unreachable`){mergeStrandedResponses(r,a,i);continue}t=retireProxyInputRequests(t,a.retireRequestIds),c=!0;continue}if(a.answerHook!==void 0){let r=coalesceDeliverPayloads(a.payloads),i=r.inputResponses??[];await resumeWorkflowToolRunAnswers(a.childContinuationToken,i,r.responder??toToolInputResponseResponder(n.auth)),a.dismissedRequestIds.length>0&&await resumeWorkflowToolRunDismissal(a.childContinuationToken),a.answerHook.question!==void 0&&await emitQuestionResolutions({dismissedRequestIds:a.dismissedRequestIds,responses:i,sessionState:t.state,sessionWritable:e.sessionWritable}),t=retireProxyInputRequests(t,a.retireRequestIds),c=!0;continue}let o={...n,deliveryMetadata:a.metadata.length===0?void 0:a.metadata,payloads:a.payloads};await resumeSessionInbox(a.childSessionInbox??a.childContinuationToken,o),t=retireProxyInputRequests(t,a.retireRequestIds),c=!0}let l={serializedContext:e.serializedContext??{},sessionState:c?replaceDurableSessionSnapshot({session:t,state:e.sessionState}):e.sessionState};if(a!==void 0)return{...l,...a};let u=[...r].sort(([e],[t])=>e-t),d=u.flatMap(([e],t)=>(n.deliveryMetadata??[]).filter(t=>t.payloadIndex===e).map(e=>({...e,payloadIndex:t}))),f=u.length===0?void 0:{...n,deliveryMetadata:d.length===0?void 0:d,payloads:u.map(([,e])=>e)};return{...l,kind:`continue`,remainder:f}}async function emitQuestionResolutions(e){let t=getPendingCoordinationBatch(e.sessionState)?.event;if(t===void 0)return;let n=[...e.responses.map(e=>({kind:`question`,outcome:`answered`,requestId:e.requestId,response:e})),...e.dismissedRequestIds.map(e=>({kind:`question`,outcome:`ignored`,requestId:e}))];if(n.length===0)return;let r=e.sessionWritable.getWriter();try{await r.write(encodeMessageStreamEvent(stampMessageStreamEvent(createInputResolvedEvent({resolutions:n,...t}))))}finally{r.releaseLock()}}function mergeStrandedResponses(e,t,n){for(let[r,i]of t.payloads.entries()){let a=t.sourcePayloadIndexes[r];if(a===void 0)continue;let o=(i.inputResponses??[]).map(e=>({...e,requestId:createTaskInputRequestId(n,e.requestId)}));if(o.length===0)continue;let s=e.get(a);e.set(a,{...s,inputResponses:[...s?.inputResponses??[],...o]})}}export{routeProxiedDeliverStep};

package/dist/src/execution/publish-channel-event.js

@@ -1 +1 @@
-import{callAdapterEventHandler}from"#channel/adapter.js";import{encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{BundleKey}from"#runtime/sessions/runtime-context-keys.js";import{dispatchStreamEventHooks}from"#context/hook-lifecycle.js";import{setChannelContext}from"#execution/channel-context.js";async function publishChannelEvent(e){let t=await writeChannelEvent(e);return await dispatchStreamEventHooks({ctx:e.ctx,registry:e.ctx.require(BundleKey).hookRegistry,event:t}),t}async function writeChannelEvent(e){let t=await callAdapterEventHandler(e.adapter,e.event,e.adapterCtx);setChannelContext(e.ctx,{...e.adapter,state:{...e.adapterCtx.state}});let n=stampMessageStreamEvent(t,e.deliveryIds);return await e.writer.write(encodeMessageStreamEvent(n)),n}export{publishChannelEvent,writeChannelEvent};
+import{callAdapterEventHandler}from"#channel/adapter.js";import{encodeMessageStreamEvent,stampMessageStreamEvent}from"#protocol/message.js";import{BundleKey}from"#runtime/sessions/runtime-context-keys.js";import{dispatchStreamEventHooks}from"#context/hook-lifecycle.js";import{setChannelContext}from"#execution/channel-context.js";async function publishChannelEvent(e){let t=await writeChannelEvent(e);return await dispatchStreamEventHooks({cancelTurn:void 0,ctx:e.ctx,registry:e.ctx.require(BundleKey).hookRegistry,event:t}),t}async function writeChannelEvent(e){let t=await callAdapterEventHandler(e.adapter,e.event,e.adapterCtx);setChannelContext(e.ctx,{...e.adapter,state:{...e.adapterCtx.state}});let n=stampMessageStreamEvent(t,e.deliveryIds);return await e.writer.write(encodeMessageStreamEvent(n)),n}export{publishChannelEvent,writeChannelEvent};

package/dist/src/execution/sandbox/active-handles.d.ts

@@ -3,7 +3,7 @@
  * Structural so handles of any session-options generic register without
  * variance friction.
  */
-export interface ShutdownCapableSandboxHandle {
+interface ShutdownCapableSandboxHandle {
     onRuntimeShutdown(): Promise<void>;
 }
 /**
@@ -23,6 +23,4 @@ export declare function trackActiveSandboxHandle(input: {
 export declare function shutdownActiveSandboxHandles(input?: {
     readonly log?: (message: string) => void;
 }): Promise<void>;
-/** Returns the number of tracked handles. Exposed for tests and logging. */
-export declare function countActiveSandboxHandles(): number;
-export declare function clearActiveSandboxHandlesForTest(): void;
+export {};

package/dist/src/execution/sandbox/active-handles.js

@@ -1 +1 @@
-import{toErrorMessage}from"#shared/errors.js";const activeSandboxHandles=new Map;function createActiveSandboxHandleKey(e,t){return`${e}\0${t}`}function trackActiveSandboxHandle(e){activeSandboxHandles.set(createActiveSandboxHandleKey(e.providerName,e.sessionId),e.handle)}async function shutdownActiveSandboxHandles(e){let t=[...activeSandboxHandles.entries()];activeSandboxHandles.clear();let n=await Promise.allSettled(t.map(([,e])=>e.onRuntimeShutdown()));for(let[r,i]of n.entries())if(i.status===`rejected`){let n=t[r];e?.log?.(`failed to shut down sandbox "${n?.[0]??`unknown`}": ${toErrorMessage(i.reason)}`)}}function countActiveSandboxHandles(){return activeSandboxHandles.size}function clearActiveSandboxHandlesForTest(){activeSandboxHandles.clear()}export{clearActiveSandboxHandlesForTest,countActiveSandboxHandles,shutdownActiveSandboxHandles,trackActiveSandboxHandle};
+import{toErrorMessage}from"#shared/errors.js";const activeSandboxHandles=new Map;function createActiveSandboxHandleKey(e,t){return`${e}\0${t}`}function trackActiveSandboxHandle(e){activeSandboxHandles.set(createActiveSandboxHandleKey(e.providerName,e.sessionId),e.handle)}async function shutdownActiveSandboxHandles(e){let t=[...activeSandboxHandles.entries()];activeSandboxHandles.clear();let n=await Promise.allSettled(t.map(([,e])=>e.onRuntimeShutdown()));for(let[r,i]of n.entries())if(i.status===`rejected`){let n=t[r];e?.log?.(`failed to shut down sandbox "${n?.[0]??`unknown`}": ${toErrorMessage(i.reason)}`)}}export{shutdownActiveSandboxHandles,trackActiveSandboxHandle};

package/dist/src/execution/sandbox/bash.d.ts

@@ -8,7 +8,7 @@ export interface BashInput {
 /**
  * Structured result returned from {@link executeBashOnSandbox}.
  */
-export interface BashResult {
+interface BashResult {
     readonly exitCode: number;
     readonly stderr: string;
     readonly stdout: string;
@@ -28,3 +28,4 @@ export interface BashResult {
  * messages and result shape identical across all bash-style tools.
  */
 export declare function executeBashOnSandbox(sandbox: SandboxSession, args: BashInput): Promise<BashResult>;
+export {};

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,a]);if(c.exitCode===0)c.stdout.trim()!==`true`&&expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);else{if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}})}let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSessionDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSessionStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),await commitDockerTemplateImage({cli:n,containerIdentity:t,imageReference:c,templateKey:o})===`reused`&&e.log?.(`reusing concurrently published template image`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{toErrorMessage}from"#shared/errors.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function inspectContainerRunning(e){let t=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,e]);return t.exitCode===0?t.stdout.trim()===`true`:void 0}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await inspectContainerRunning(a);if(c===void 0){if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);try{await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}}),c=!0}catch(e){if(c=/is already in use/u.test(toErrorMessage(e))?await inspectContainerRunning(a):void 0,c===void 0)throw e}}c||expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSessionDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSessionStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),await commitDockerTemplateImage({cli:n,containerIdentity:t,imageReference:c,templateKey:o})===`reused`&&e.log?.(`reusing concurrently published template image`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/immutable-resources.d.ts

@@ -1,11 +1,5 @@
 import { type SandboxProviderResources } from "#shared/sandbox-provider.js";
 import type { SandboxSession } from "#shared/sandbox-session.js";
-export declare const SANDBOX_RESOURCES_ROOT = "/eve/resources";
-export declare function resolveImmutableResourcesPath(input: {
-    readonly storagePath: string;
-    readonly provider: string;
-    readonly resourcesKey: string;
-}): string;
 export declare function prepareImmutableResources(input: {
     readonly storagePath: string;
     readonly provider: string;

package/dist/src/execution/sandbox/bindings/immutable-resources.js

@@ -1,2 +1,2 @@
 import{join}from"node:path";import{copyDirectoryAtomically,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-provider-utils.js";import{providerResourceTargetFiles}from"#shared/sandbox-provider.js";const SANDBOX_RESOURCES_ROOT=`/eve/resources`;function resolveImmutableResourcesPath(e){return join(e.storagePath,e.provider,`resources`,e.resourcesKey)}async function prepareImmutableResources(e){let t=resolveImmutableResourcesPath(e);return await copyDirectoryAtomically(e.sourcePath,t),t}async function hydrateSandboxProviderResources(e){switch(e.resources.source.kind){case`none`:case`inline`:await writeSandboxSeedFiles(e.session,providerResourceTargetFiles(e.resources));return;case`materialized`:e.log?.(`hydrating workspace and skills from read-only resources`),await hydrateSandboxFromImmutableResources(e.session,e.copySkills);return}}async function hydrateSandboxFromImmutableResources(e,t=!1){let n=t?[`  mkdir -p "$HOME/.agents/skills"`,`  cp -a ${SANDBOX_RESOURCES_ROOT}/skills/. "$HOME/.agents/skills/"`]:[`  ln -s ${SANDBOX_RESOURCES_ROOT}/skills "$HOME/.agents/skills"`],r=await e.run({command:[`set -e`,`if [ -d ${SANDBOX_RESOURCES_ROOT}/workspace ]; then cp -a ${SANDBOX_RESOURCES_ROOT}/workspace/. /workspace/; fi`,`if [ -d ${SANDBOX_RESOURCES_ROOT}/skills ]; then`,`  mkdir -p "$HOME/.agents"`,`  rm -rf "$HOME/.agents/skills"`,...n,`fi`].join(`
-`)});if(r.exitCode!==0)throw Error(`Failed to hydrate sandbox resources: ${r.stderr||r.stdout}`)}export{SANDBOX_RESOURCES_ROOT,hydrateSandboxFromImmutableResources,hydrateSandboxProviderResources,prepareImmutableResources,resolveImmutableResourcesPath};
+`)});if(r.exitCode!==0)throw Error(`Failed to hydrate sandbox resources: ${r.stderr||r.stdout}`)}export{hydrateSandboxFromImmutableResources,hydrateSandboxProviderResources,prepareImmutableResources};

package/dist/src/execution/sandbox/bindings/local-provider-utils.d.ts

@@ -1,9 +1,9 @@
-export interface SandboxSeedFile {
+interface SandboxSeedFile {
     readonly content: string | Uint8Array;
     readonly path: string;
 }
 import type { InternalSandboxSession, SandboxProcess, SandboxRemovePathOptions, SandboxSession, SandboxSpawnOptions } from "#shared/sandbox-session.js";
-export interface FileBackedSandbox {
+interface FileBackedSandbox {
     readFileBytes(path: string): Promise<Buffer | null>;
     removePath(options: SandboxRemovePathOptions): Promise<void>;
     spawn(options: SandboxSpawnOptions): Promise<SandboxProcess>;
@@ -23,3 +23,4 @@ export declare function resolveLocalProviderTemplateRootPath(cacheDirectory: str
 export declare function resolveLocalProviderTemplatesDirectory(cacheDirectory: string, providerCacheName: string): string;
 export declare function resolveLocalProviderSessionRootPath(cacheDirectory: string, providerCacheName: string, sessionKey: string): string;
 export declare function writeSandboxSeedFiles(session: SandboxSession, seedFiles: ReadonlyArray<SandboxSeedFile>): Promise<void>;
+export {};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.d.ts

@@ -39,5 +39,4 @@ export declare function createMicrosandboxHandle(input: {
         readonly version: 3;
     };
 }>;
-export declare function clearActiveMicrosandboxSessionHandlesForTest(): void;
 export {};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{createFileBackedInternalSandboxSession,touchDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{buildSandboxDockerfile,dockerfileImageReference,publishDockerImageForMicrosandbox}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{isSandboxPreparedArtifactRecord}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.context.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({host:e.context.host,log:e.context.log,options:e.options}),n=e.context.storagePath,r=resolveMicrosandboxTemplateRootPath(n,e.templateKey),i=resolveMicrosandboxMetadataPath(r);e.context.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.context.log?.(`reusing cached snapshot`),await touchDirectory(r),microsandboxTemplateArtifact(a);let o=createProviderName(`eve-sbx-tpl`,e.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0});let l=e.options;if(e.dockerfile!==void 0){let t=createDockerCli();await assertDockerDaemonAvailable(t);let n=dockerfileImageReference({dockerfile:e.dockerfile,templateKey:e.templateKey});e.context.log?.(`building sandbox Dockerfile "${e.dockerfile.path}"`),await buildSandboxDockerfile({cli:t,dockerfile:e.dockerfile,imageReference:n}),e.context.log?.(`publishing Dockerfile image for microsandbox`);let r=await publishDockerImageForMicrosandbox({cli:t,imageReference:n});l={...e.options,image:r,pullPolicy:`always`}}let u=e.context.resources.source,d=u.kind===`materialized`?await prepareImmutableResources({storagePath:e.context.storagePath,provider:e.providerName,resourcesKey:u.key,sourcePath:u.path}):void 0;e.context.log?.(`creating template VM from image "${l.image}"`);let f=await createPreparedMicrosandbox({log:e.context.log,module:t,name:c,networkPolicy:`allow-all`,options:l,resourcesPath:d,sessionKey:e.templateKey,setupBaseRuntime:!0,tags:void 0}),p=buildSandboxSession(createMicrosandboxInternalSession(f),async e=>{await f.setNetworkPolicy(e)});try{await hydrateSandboxProviderResources({copySkills:!0,log:e.context.log,resources:e.context.resources,session:p}),e.prepare!==void 0&&(e.context.log?.(`running sandbox preparation`),await e.prepare(createLoggingSandboxSession({log:e.context.log,session:p}))),e.context.log?.(`snapshotting template VM`),await f.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r)){let e=await readTemplateMetadata(i);if(e!==null)return microsandboxTemplateArtifact(e)}throw e}}finally{await f.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return microsandboxTemplateArtifact({image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION})}async function createMicrosandboxHandle(e){let t=requirePreparedMicrosandboxTemplate(e.artifact,e.providerName),n=e.sessionIdentity??createStableHash(`${e.context.session.id}:${t.snapshotName}:${e.optionsHash}`).slice(0,32),r=resolveMicrosandboxSessionRootPath(e.context.storagePath,n),i=resolveMicrosandboxMetadataPath(r),a=await readSessionMetadata(i),o=resolveMicrosandboxImage(a,t,e.options),s={...e.options,...o,networkPolicy:e.runtimeOptions?.networkPolicy},c=await loadMicrosandboxModule({host:e.context.host,options:s}),l=createActiveMicrosandboxSessionKey(r,e.optionsHash),u=activeMicrosandboxSessionHandles.get(l),d={optionsHash:e.optionsHash,sessionIdentity:n,version:3};if(u!==void 0)return{handle:u,state:d};let f=withDevelopmentSandboxMetadataPathTag({sessionId:e.context.session.id},i);if(a?.optionsHash===e.optionsHash&&(await sandboxExists(c,a.sandboxName)||a.stateSnapshotName!==void 0&&await snapshotExists(c,a.stateSnapshotName))){let t=await connectMicrosandbox({metadata:a,metadataPath:i,module:c,options:s,sessionKey:e.context.session.id,tags:f});if(t!==null)return{handle:cacheHandle(l,createHandle(t,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}if(e.sessionIdentity!==void 0&&e.createIfMissing===!1)throw Error(`microsandbox session "${e.sessionIdentity}" is no longer available to resume.`);if(t.optionsHash!==e.optionsHash||!await snapshotExists(c,t.snapshotName))throw new SandboxTemplateNotProvisionedError({providerName:e.providerName,templateKey:t.snapshotName});let p=createProviderName(`eve-sbx-ses`,n),m=await createPreparedMicrosandbox({fromSnapshot:t.snapshotName,module:c,name:p,networkPolicy:s.networkPolicy,options:s,sessionKey:e.context.session.id,setupBaseRuntime:!1,tags:f});return await m.writeMetadata(i,e.optionsHash),{handle:cacheHandle(l,createHandle(m,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}function resolveMicrosandboxImage(e,t,n){return e?.image===void 0?t?.image===void 0?{image:n.image,pullPolicy:n.pullPolicy}:{image:t.image,pullPolicy:`always`}:{image:e.image,pullPolicy:`always`}}function microsandboxTemplateArtifact(e){return{image:e.image??null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:e.version}}function requirePreparedMicrosandboxTemplate(e,t){if(!isSandboxPreparedArtifactRecord(e)||e.version!==MICROSANDBOX_METADATA_VERSION||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw new SandboxTemplateNotProvisionedError({providerName:t,templateKey:`invalid-artifact`});return{image:typeof e.image==`string`?e.image:void 0,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:MICROSANDBOX_METADATA_VERSION}}function createHandle(e,t,n){return{sandbox:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),async onSessionDelete(){await e.shutdown(),await e.removePersisted(),n?.()},async onSessionStop(){await e.stop(),n?.()},async onRuntimeShutdown(){n?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}function clearActiveMicrosandboxSessionHandlesForTest(){activeMicrosandboxSessionHandles.clear()}export{clearActiveMicrosandboxSessionHandlesForTest,createMicrosandboxHandle,prewarmMicrosandboxTemplate};
+import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{createFileBackedInternalSandboxSession,touchDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{buildSandboxDockerfile,dockerfileImageReference,publishDockerImageForMicrosandbox}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{isSandboxPreparedArtifactRecord}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.context.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({host:e.context.host,log:e.context.log,options:e.options}),n=e.context.storagePath,r=resolveMicrosandboxTemplateRootPath(n,e.templateKey),i=resolveMicrosandboxMetadataPath(r);e.context.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.context.log?.(`reusing cached snapshot`),await touchDirectory(r),microsandboxTemplateArtifact(a);let o=createProviderName(`eve-sbx-tpl`,e.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0});let l=e.options;if(e.dockerfile!==void 0){let t=createDockerCli();await assertDockerDaemonAvailable(t);let n=dockerfileImageReference({dockerfile:e.dockerfile,templateKey:e.templateKey});e.context.log?.(`building sandbox Dockerfile "${e.dockerfile.path}"`),await buildSandboxDockerfile({cli:t,dockerfile:e.dockerfile,imageReference:n}),e.context.log?.(`publishing Dockerfile image for microsandbox`);let r=await publishDockerImageForMicrosandbox({cli:t,imageReference:n});l={...e.options,image:r,pullPolicy:`always`}}let u=e.context.resources.source,d=u.kind===`materialized`?await prepareImmutableResources({storagePath:e.context.storagePath,provider:e.providerName,resourcesKey:u.key,sourcePath:u.path}):void 0;e.context.log?.(`creating template VM from image "${l.image}"`);let f=await createPreparedMicrosandbox({log:e.context.log,module:t,name:c,networkPolicy:`allow-all`,options:l,resourcesPath:d,sessionKey:e.templateKey,setupBaseRuntime:!0,tags:void 0}),p=buildSandboxSession(createMicrosandboxInternalSession(f),async e=>{await f.setNetworkPolicy(e)});try{await hydrateSandboxProviderResources({copySkills:!0,log:e.context.log,resources:e.context.resources,session:p}),e.prepare!==void 0&&(e.context.log?.(`running sandbox preparation`),await e.prepare(createLoggingSandboxSession({log:e.context.log,session:p}))),e.context.log?.(`snapshotting template VM`),await f.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r)){let e=await readTemplateMetadata(i);if(e!==null)return microsandboxTemplateArtifact(e)}throw e}}finally{await f.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return microsandboxTemplateArtifact({image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION})}async function createMicrosandboxHandle(e){let t=requirePreparedMicrosandboxTemplate(e.artifact,e.providerName),n=e.sessionIdentity??createStableHash(`${e.context.session.id}:${t.snapshotName}:${e.optionsHash}`).slice(0,32),r=resolveMicrosandboxSessionRootPath(e.context.storagePath,n),i=resolveMicrosandboxMetadataPath(r),a=await readSessionMetadata(i),o=resolveMicrosandboxImage(a,t,e.options),s={...e.options,...o,networkPolicy:e.runtimeOptions?.networkPolicy},c=await loadMicrosandboxModule({host:e.context.host,options:s}),l=createActiveMicrosandboxSessionKey(r,e.optionsHash),u=activeMicrosandboxSessionHandles.get(l),d={optionsHash:e.optionsHash,sessionIdentity:n,version:3};if(u!==void 0)return{handle:u,state:d};let f=withDevelopmentSandboxMetadataPathTag({sessionId:e.context.session.id},i);if(a?.optionsHash===e.optionsHash&&(await sandboxExists(c,a.sandboxName)||a.stateSnapshotName!==void 0&&await snapshotExists(c,a.stateSnapshotName))){let t=await connectMicrosandbox({metadata:a,metadataPath:i,module:c,options:s,sessionKey:e.context.session.id,tags:f});if(t!==null)return{handle:cacheHandle(l,createHandle(t,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}if(e.sessionIdentity!==void 0&&e.createIfMissing===!1)throw Error(`microsandbox session "${e.sessionIdentity}" is no longer available to resume.`);if(t.optionsHash!==e.optionsHash||!await snapshotExists(c,t.snapshotName))throw new SandboxTemplateNotProvisionedError({providerName:e.providerName,templateKey:t.snapshotName});let p=createProviderName(`eve-sbx-ses`,n),m=await createPreparedMicrosandbox({fromSnapshot:t.snapshotName,module:c,name:p,networkPolicy:s.networkPolicy,options:s,sessionKey:e.context.session.id,setupBaseRuntime:!1,tags:f});return await m.writeMetadata(i,e.optionsHash),{handle:cacheHandle(l,createHandle(m,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}function resolveMicrosandboxImage(e,t,n){return e?.image===void 0?t?.image===void 0?{image:n.image,pullPolicy:n.pullPolicy}:{image:t.image,pullPolicy:`always`}:{image:e.image,pullPolicy:`always`}}function microsandboxTemplateArtifact(e){return{image:e.image??null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:e.version}}function requirePreparedMicrosandboxTemplate(e,t){if(!isSandboxPreparedArtifactRecord(e)||e.version!==MICROSANDBOX_METADATA_VERSION||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw new SandboxTemplateNotProvisionedError({providerName:t,templateKey:`invalid-artifact`});return{image:typeof e.image==`string`?e.image:void 0,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:MICROSANDBOX_METADATA_VERSION}}function createHandle(e,t,n){return{sandbox:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),async onSessionDelete(){await e.shutdown(),await e.removePersisted(),n?.()},async onSessionStop(){await e.stop(),n?.()},async onRuntimeShutdown(){n?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}export{createMicrosandboxHandle,prewarmMicrosandboxTemplate};

package/dist/src/execution/sandbox/bindings/microsandbox-network.d.ts

@@ -6,7 +6,7 @@ interface MicrosandboxTransformHeaderRule {
     readonly match?: unknown;
     readonly placeholderHeaders: Readonly<Record<string, string>>;
 }
-export interface MicrosandboxNetworkPlan {
+interface MicrosandboxNetworkPlan {
     readonly disabled: boolean;
     readonly policy: MicrosandboxNetworkPolicy | null;
     readonly transformHeaderRules: readonly MicrosandboxTransformHeaderRule[];

package/dist/src/execution/sandbox/bindings/microsandbox-options.d.ts

@@ -1,8 +1,5 @@
 import type { MicrosandboxSandboxCreateOptions } from "#public/sandbox/microsandbox-sandbox.js";
 export declare const MICROSANDBOX_DEFAULT_IMAGE: string;
-export declare const MICROSANDBOX_DEFAULT_CPUS = 1;
-export declare const MICROSANDBOX_DEFAULT_MEMORY_MIB = 1024;
-export declare const MICROSANDBOX_DEFAULT_PULL_POLICY = "if-missing";
 /** User every sandbox command runs as, mirroring hosted Vercel Sandbox. */
 export declare const MICROSANDBOX_USER = "vercel-sandbox";
 /**

package/dist/src/execution/sandbox/bindings/microsandbox-options.js

@@ -1 +1 @@
-import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_DEFAULT_CPUS=1,MICROSANDBOX_DEFAULT_MEMORY_MIB=1024,MICROSANDBOX_DEFAULT_PULL_POLICY=`if-missing`,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_CPUS,MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_DEFAULT_MEMORY_MIB,MICROSANDBOX_DEFAULT_PULL_POLICY,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};
+import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};

package/dist/src/execution/sandbox/bindings/microsandbox-templates.d.ts

@@ -9,5 +9,4 @@ export declare function pruneMicrosandboxTemplates(input: {
     readonly retainCount?: number;
 }): Promise<void>;
 export declare function resolveMicrosandboxTemplateRootPath(cacheDirectory: string, templateKey: string): string;
-export declare function resolveMicrosandboxTemplatesDirectory(cacheDirectory: string): string;
 export declare function resolveMicrosandboxSessionRootPath(cacheDirectory: string, sessionKey: string): string;

package/dist/src/execution/sandbox/bindings/microsandbox-templates.js

@@ -1 +1 @@
-import{readdir,rm,stat}from"node:fs/promises";import"node:fs";import{join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT}from"#execution/sandbox/bindings/local-template-prune.js";import{readTemplateMetadata,resolveMicrosandboxMetadataPath}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{loadMicrosandboxWithoutInstall,removeSnapshotIfExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";const MICROSANDBOX_CACHE_DIRECTORY_NAME=`microsandbox`;async function pruneMicrosandboxTemplates(e){let t=resolveMicrosandboxTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot)),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a=await readMicrosandboxTemplateDirectories(t),o=a.filter(e=>!e.isTemporary);await Promise.all([...o.map(async(t,a)=>{a<i||n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)}),...a.filter(e=>e.isTemporary).map(async t=>{n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)})])}function resolveMicrosandboxTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}function resolveMicrosandboxTemplatesDirectory(e){return resolveLocalProviderTemplatesDirectory(e,MICROSANDBOX_CACHE_DIRECTORY_NAME)}function resolveMicrosandboxSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}async function readMicrosandboxTemplateDirectories(e){let t;try{t=await readdir(e,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return[];throw e}return(await Promise.all(t.filter(e=>e.isDirectory()).map(async t=>{let n=join(e,t.name);return{isTemporary:t.name.endsWith(`.tmp`),metadata:await readTemplateMetadata(resolveMicrosandboxMetadataPath(n)),mtimeMs:(await stat(n)).mtimeMs,path:n}}))).sort((e,t)=>t.mtimeMs-e.mtimeMs)}async function removeTemplateDirectory(e,t,n){if(await rm(t,{force:!0,recursive:!0}),n===null)return;let r=await loadMicrosandboxWithoutInstall(e);r!==null&&await removeSnapshotIfExists(r,n.snapshotName)}export{pruneMicrosandboxTemplates,resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath,resolveMicrosandboxTemplatesDirectory};
+import{readdir,rm,stat}from"node:fs/promises";import"node:fs";import{join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT}from"#execution/sandbox/bindings/local-template-prune.js";import{readTemplateMetadata,resolveMicrosandboxMetadataPath}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{loadMicrosandboxWithoutInstall,removeSnapshotIfExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";const MICROSANDBOX_CACHE_DIRECTORY_NAME=`microsandbox`;async function pruneMicrosandboxTemplates(e){let t=resolveMicrosandboxTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot)),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a=await readMicrosandboxTemplateDirectories(t),o=a.filter(e=>!e.isTemporary);await Promise.all([...o.map(async(t,a)=>{a<i||n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)}),...a.filter(e=>e.isTemporary).map(async t=>{n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)})])}function resolveMicrosandboxTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}function resolveMicrosandboxTemplatesDirectory(e){return resolveLocalProviderTemplatesDirectory(e,MICROSANDBOX_CACHE_DIRECTORY_NAME)}function resolveMicrosandboxSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}async function readMicrosandboxTemplateDirectories(e){let t;try{t=await readdir(e,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return[];throw e}return(await Promise.all(t.filter(e=>e.isDirectory()).map(async t=>{let n=join(e,t.name);return{isTemporary:t.name.endsWith(`.tmp`),metadata:await readTemplateMetadata(resolveMicrosandboxMetadataPath(n)),mtimeMs:(await stat(n)).mtimeMs,path:n}}))).sort((e,t)=>t.mtimeMs-e.mtimeMs)}async function removeTemplateDirectory(e,t,n){if(await rm(t,{force:!0,recursive:!0}),n===null)return;let r=await loadMicrosandboxWithoutInstall(e);r!==null&&await removeSnapshotIfExists(r,n.snapshotName)}export{pruneMicrosandboxTemplates,resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath};

package/dist/src/execution/sandbox/bindings/vercel.d.ts

@@ -18,7 +18,7 @@ type VercelEnvironmentOptions = VercelCreateOptions & {
     readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
 };
 export declare function createVercelSandboxProvider(environmentOptions: Readonly<VercelEnvironmentOptions> | undefined): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, NetworkPolicySandboxSession>;
-export interface CreateVercelSandboxInput {
+interface CreateVercelSandboxInput {
     readonly createSandbox?: CreateVercelSandbox;
     readonly createOptions?: VercelCreateOptions;
     readonly loadDeleteSandboxModule?: () => Promise<VercelModule>;

package/dist/src/execution/sandbox/dockerfile.d.ts

@@ -9,7 +9,6 @@ export declare function materializeSandboxDockerfile(input: {
     readonly files: SandboxProviderFiles;
     readonly storagePath: string;
 }): Promise<SandboxDockerfile | undefined>;
-export declare function resolveSandboxDockerfile(agentRoot: string): Promise<SandboxDockerfile | undefined>;
 export declare function dockerfileImageReference(input: {
     readonly dockerfile: SandboxDockerfile;
     readonly templateKey: string;

package/dist/src/execution/sandbox/dockerfile.js

@@ -1 +1 @@
-import{createHash,randomUUID}from"node:crypto";import{access,mkdir,readFile,readdir,rename,rm,writeFile}from"node:fs/promises";import{dirname,join,relative}from"node:path";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";async function materializeSandboxDockerfile(e){let t;try{t=await e.files.read(`Dockerfile`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let n=await e.files.list(),r=createHash(`sha256`),i=await Promise.all(n.map(async t=>({content:await e.files.read(t),path:t})));for(let e of i)r.update(e.path).update(`\0`).update(e.content).update(`\0`);let a=r.digest(`hex`),o=join(e.storagePath,`dockerfiles`,a);try{return await access(join(o,`Dockerfile`)),{contentHash:a,contextPath:o,path:join(o,`Dockerfile`)}}catch(e){if(!isFileNotFoundError(e))throw e}let s=`${o}.${randomUUID()}.tmp`;await Promise.all(i.map(async e=>{let t=join(s,e.path);await mkdir(dirname(t),{recursive:!0}),await writeFile(t,e.content)})),n.includes(`Dockerfile`)||(await mkdir(s,{recursive:!0}),await writeFile(join(s,`Dockerfile`),t)),await mkdir(dirname(o),{recursive:!0});try{await rename(s,o)}catch(e){try{await access(join(o,`Dockerfile`))}catch{throw e}}finally{await rm(s,{force:!0,recursive:!0})}return{contentHash:a,contextPath:o,path:join(o,`Dockerfile`)}}async function resolveSandboxDockerfile(e){let t=join(e,`sandbox`,`Dockerfile`);try{await readFile(t)}catch(e){if(isFileNotFoundError(e))return;throw e}let n=dirname(t);return{contextPath:n,contentHash:await hashDirectory(n),path:t}}function dockerfileImageReference(e){return`eve-sandbox-dockerfile:${createHash(`sha256`).update(`${e.templateKey}:${e.dockerfile.contentHash}`).digest(`hex`).slice(0,24)}`}async function buildSandboxDockerfile(e){expectDockerSuccess(await e.cli.run([`build`,`--file`,e.dockerfile.path,`--tag`,e.imageReference,e.dockerfile.contextPath]),`build sandbox Dockerfile "${e.dockerfile.path}"`)}const LOCAL_REGISTRY_CONTAINER=`eve-sandbox-registry`,LOCAL_REGISTRY_HOST=`127.0.0.1:51921`;async function publishDockerImageForMicrosandbox(e){let t=await e.cli.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,LOCAL_REGISTRY_CONTAINER]);t.exitCode===0?t.stdout.trim()!==`true`&&expectDockerSuccess(await e.cli.run([`start`,LOCAL_REGISTRY_CONTAINER]),`restart the local microsandbox image registry`):expectDockerSuccess(await e.cli.run([`run`,`--detach`,`--name`,LOCAL_REGISTRY_CONTAINER,`--publish`,`${LOCAL_REGISTRY_HOST}:5000`,`registry:2`]),`start the local microsandbox image registry`);let n=`${LOCAL_REGISTRY_HOST}/eve/${e.imageReference.replace(`:`,`-`)}`;return expectDockerSuccess(await e.cli.run([`tag`,e.imageReference,n]),`tag microsandbox image "${n}"`),expectDockerSuccess(await e.cli.run([`push`,n]),`publish microsandbox image "${n}"`),n}function isFileNotFoundError(e){return e instanceof Error&&`code`in e&&e.code===`ENOENT`}async function hashDirectory(e){let t=createHash(`sha256`),n=await collectFilePaths(e);for(let r of n)t.update(relative(e,r)),t.update(`\0`),t.update(await readFile(r)),t.update(`\0`);return t.digest(`hex`)}async function collectFilePaths(e){let t=[];for(let n of await readdir(e,{withFileTypes:!0})){let r=join(e,n.name);n.isDirectory()?t.push(...await collectFilePaths(r)):n.isFile()&&t.push(r)}return t.sort()}export{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile,publishDockerImageForMicrosandbox,resolveSandboxDockerfile};
+import{createHash,randomUUID}from"node:crypto";import{access,mkdir,rename,rm,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";async function materializeSandboxDockerfile(e){let t;try{t=await e.files.read(`Dockerfile`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let n=await e.files.list(),r=createHash(`sha256`),i=await Promise.all(n.map(async t=>({content:await e.files.read(t),path:t})));for(let e of i)r.update(e.path).update(`\0`).update(e.content).update(`\0`);let a=r.digest(`hex`),o=join(e.storagePath,`dockerfiles`,a);try{return await access(join(o,`Dockerfile`)),{contentHash:a,contextPath:o,path:join(o,`Dockerfile`)}}catch(e){if(!isFileNotFoundError(e))throw e}let s=`${o}.${randomUUID()}.tmp`;await Promise.all(i.map(async e=>{let t=join(s,e.path);await mkdir(dirname(t),{recursive:!0}),await writeFile(t,e.content)})),n.includes(`Dockerfile`)||(await mkdir(s,{recursive:!0}),await writeFile(join(s,`Dockerfile`),t)),await mkdir(dirname(o),{recursive:!0});try{await rename(s,o)}catch(e){try{await access(join(o,`Dockerfile`))}catch{throw e}}finally{await rm(s,{force:!0,recursive:!0})}return{contentHash:a,contextPath:o,path:join(o,`Dockerfile`)}}function dockerfileImageReference(e){return`eve-sandbox-dockerfile:${createHash(`sha256`).update(`${e.templateKey}:${e.dockerfile.contentHash}`).digest(`hex`).slice(0,24)}`}async function buildSandboxDockerfile(e){expectDockerSuccess(await e.cli.run([`build`,`--file`,e.dockerfile.path,`--tag`,e.imageReference,e.dockerfile.contextPath]),`build sandbox Dockerfile "${e.dockerfile.path}"`)}const LOCAL_REGISTRY_CONTAINER=`eve-sandbox-registry`,LOCAL_REGISTRY_HOST=`127.0.0.1:51921`;async function publishDockerImageForMicrosandbox(e){let t=await e.cli.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,LOCAL_REGISTRY_CONTAINER]);t.exitCode===0?t.stdout.trim()!==`true`&&expectDockerSuccess(await e.cli.run([`start`,LOCAL_REGISTRY_CONTAINER]),`restart the local microsandbox image registry`):expectDockerSuccess(await e.cli.run([`run`,`--detach`,`--name`,LOCAL_REGISTRY_CONTAINER,`--publish`,`${LOCAL_REGISTRY_HOST}:5000`,`registry:2`]),`start the local microsandbox image registry`);let n=`${LOCAL_REGISTRY_HOST}/eve/${e.imageReference.replace(`:`,`-`)}`;return expectDockerSuccess(await e.cli.run([`tag`,e.imageReference,n]),`tag microsandbox image "${n}"`),expectDockerSuccess(await e.cli.run([`push`,n]),`publish microsandbox image "${n}"`),n}function isFileNotFoundError(e){return e instanceof Error&&`code`in e&&e.code===`ENOENT`}export{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile,publishDockerImageForMicrosandbox};

package/dist/src/execution/sandbox/ensure.d.ts

@@ -1,7 +1,7 @@
 import { type RuntimeCompiledArtifactsSource } from "#runtime/compiled-artifacts-source.js";
 import type { RuntimeSandboxRegistry } from "#runtime/sandbox/registry.js";
 import type { SandboxAccess, SandboxState } from "#sandbox/state.js";
-export interface EnsureSandboxAccessInput {
+interface EnsureSandboxAccessInput {
     readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;
     readonly nodeId: string;
     readonly ownsSandbox?: boolean;
@@ -10,3 +10,4 @@ export interface EnsureSandboxAccessInput {
     readonly state: SandboxState | null;
 }
 export declare function ensureSandboxAccess(input: EnsureSandboxAccessInput): Promise<SandboxAccess>;
+export {};

package/dist/src/execution/sandbox/ensure.js

@@ -1 +1 @@
-import{contextStorage}from"#context/container.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{getSandboxEnvironmentRuntime,runWithSandboxConstructorRuntime}from"#shared/sandbox-environment.js";import{buildCallbackContext,withRuntimeSandboxLifecycle}from"#context/build-callback-context.js";import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{isSandboxPreparedArtifact}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{loadSandboxPreparedArtifact}from"#runtime/sandbox/prepared-artifacts.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{ensureDevelopmentSandboxesPrepared}from"#execution/sandbox/development-lazy-prewarm.js";import{createSandboxProviderHost}from"#execution/sandbox/provider-host.js";async function ensureSandboxAccess(e){let t=e.state?.session??null,n,r,i,a=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??process.cwd(),o=e.registry.sandbox;if(o===null)return{async captureState(){return{session:t}},async get(){return null},async stop(){}};async function open(n,i,s,c){if(r!==void 0)throw Error(`A sandbox definition can open only one sandbox.`);let l=o.inheritance,u=l?.definition??o.definition;if(u.kind!==`independent`)throw Error(`Sandbox "${u.logicalPath}" has no environment.`);if(s!==u.environment)throw Error(`Sandbox "${u.logicalPath}" selected a different environment.`);if(n!==getSandboxEnvironmentRuntime(u.environment))throw Error(`Sandbox "${u.logicalPath}" selected a different provider.`);if(t!==null)throw Error(`Sandbox "${u.logicalPath}" is already initialized.`);let d=l?.nodeId??e.nodeId,f=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:d,providerName:n.providerName});if(f===void 0)throw new SandboxTemplateNotProvisionedError({providerName:n.providerName,templateKey:d});let p={host:createSandboxProviderHost(a),session:c,storagePath:resolveSandboxCacheDirectory(a)};r=(async()=>{let e=await n.implementation.start(p,i,f);if(!isSandboxPreparedArtifact(e.state))throw Error(`Sandbox provider "${n.providerName}" returned non-serializable session state.`);return t={providerName:n.providerName,state:e.state,stateProtocolVersion:n.stateProtocolVersion},e.handle})().catch(e=>{throw r=void 0,e});let m=await r;return installHandle(n.providerName,m)}function installHandle(e,t){let r=withRuntimeSandboxLifecycle(t.sandbox,e=>t.onSessionDelete(e),()=>t.onSessionStop());return n={handle:t,providerName:e,sandbox:r},r}async function resumePersisted(n,i){if(t===null)throw Error(`Sandbox session state is missing.`);let s=getSandboxEnvironmentRuntime(n.environment);if(t.providerName!==s.providerName)throw Error(`Sandbox session state belongs to provider "${t.providerName}", not "${s.providerName}".`);if(t.stateProtocolVersion!==s.stateProtocolVersion)throw Error(`Sandbox session state protocol ${t.stateProtocolVersion} is incompatible with provider "${s.providerName}" protocol ${s.stateProtocolVersion}.`);let c=o.inheritance?.nodeId??e.nodeId,l=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:c,providerName:s.providerName});if(l===void 0)throw new SandboxTemplateNotProvisionedError({providerName:s.providerName,templateKey:c});let u={host:createSandboxProviderHost(a),session:i,storagePath:resolveSandboxCacheDirectory(a)};r=s.implementation.resume(u,l,t.state).catch(e=>{throw r=void 0,e});let d=await r;return installHandle(s.providerName,d),trackActiveSandboxHandle({handle:d,providerName:s.providerName,sessionId:e.sessionId}),d}async function resolveHandle(){let i=o.inheritance,a=i?.definition??o.definition;if(a.kind!==`independent`)throw Error(`Sandbox "${a.logicalPath}" has no resolved parent.`);isEveDevEnvironment()&&e.compiledArtifactsSource.kind===`disk`&&await ensureDevelopmentSandboxesPrepared({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:i?.nodeId??e.nodeId,providerName:getSandboxEnvironmentRuntime(a.environment).providerName});let s={...contextStorage.getStore()===void 0?{auth:{current:null,initiator:null},id:e.sessionId,turn:{id:`sandbox-initialization`,sequence:0}}:buildCallbackContext().session,id:e.sessionId};if(t!==null)return await resumePersisted(a,s);if(i!==void 0)await open(getSandboxEnvironmentRuntime(a.environment),void 0,a.environment,s);else try{let e=await runWithSandboxConstructorRuntime({open:({environment:e,options:t,provider:n})=>open(n,t,e,s)},async()=>a.selector({session:s}));if(n===void 0||e!==n.sandbox)throw Error(`Sandbox "${a.logicalPath}" must return the sandbox it opens.`)}catch(e){let i=n?.handle;if(n=void 0,r=void 0,t=null,i!==void 0)try{await i.onSessionDelete()}catch(t){throw AggregateError([e,t],`Sandbox "${a.logicalPath}" initialization and cleanup both failed.`,{cause:e})}throw e}if(n===void 0)throw Error(`Sandbox "${a.logicalPath}" did not open a provider handle.`);return trackActiveSandboxHandle({handle:n.handle,providerName:n.providerName,sessionId:e.sessionId}),n.handle}function requireHandle(){return i===void 0&&(i=resolveHandle().catch(e=>{throw i=void 0,e})),i}let s=o.inheritance?.definition??o.definition;return{environment:s.kind===`independent`?s.environment:void 0,async captureState(){return r!==void 0&&await r,{session:t}},async delete(a){if(e.ownsSandbox===!1)throw Error(`Only the owning session can delete this sandbox.`);await(await requireHandle()).onSessionDelete(a),n=void 0,r=void 0,t=null,i=void 0},async get(){return await requireHandle(),n?.sandbox??null},async stop(){await(await requireHandle()).onSessionStop(),n=void 0,r=void 0,i=void 0}}}export{ensureSandboxAccess};
+import{contextStorage}from"#context/container.js";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{getSandboxEnvironmentRuntime,runWithSandboxConstructorRuntime}from"#shared/sandbox-environment.js";import{buildCallbackContext,withRuntimeSandboxLifecycle}from"#context/build-callback-context.js";import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{trackActiveSandboxHandle}from"#execution/sandbox/active-handles.js";import{isSandboxPreparedArtifact}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{loadSandboxPreparedArtifact}from"#runtime/sandbox/prepared-artifacts.js";import{getRuntimeCompiledArtifactsSandboxAppRoot}from"#runtime/compiled-artifacts-source.js";import{ensureDevelopmentSandboxesPrepared}from"#execution/sandbox/development-lazy-prewarm.js";import{createSandboxProviderHost}from"#execution/sandbox/provider-host.js";const pendingSandboxStarts=new Map;async function ensureSandboxAccess(e){let t=e.state?.session??null,n,r,i,a=getRuntimeCompiledArtifactsSandboxAppRoot(e.compiledArtifactsSource)??process.cwd(),o=e.registry.sandbox;if(o===null)return{async captureState(){return{session:t}},async get(){return null},async stop(){}};async function open(n,i,s,c){if(r!==void 0)throw Error(`A sandbox definition can open only one sandbox.`);let l=o.inheritance,u=l?.definition??o.definition;if(u.kind!==`independent`)throw Error(`Sandbox "${u.logicalPath}" has no environment.`);if(s!==u.environment)throw Error(`Sandbox "${u.logicalPath}" selected a different environment.`);if(n!==getSandboxEnvironmentRuntime(u.environment))throw Error(`Sandbox "${u.logicalPath}" selected a different provider.`);if(t!==null)throw Error(`Sandbox "${u.logicalPath}" is already initialized.`);let d=l?.nodeId??e.nodeId,f=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:d,providerName:n.providerName});if(f===void 0)throw new SandboxTemplateNotProvisionedError({providerName:n.providerName,templateKey:d});let p={host:createSandboxProviderHost(a),session:c,storagePath:resolveSandboxCacheDirectory(a)};r=(async()=>{let e=await n.implementation.start(p,i,f);if(!isSandboxPreparedArtifact(e.state))throw Error(`Sandbox provider "${n.providerName}" returned non-serializable session state.`);return t={providerName:n.providerName,state:e.state,stateProtocolVersion:n.stateProtocolVersion},e.handle})().catch(e=>{throw r=void 0,e});let m=await r;return installHandle(n.providerName,m)}function installHandle(e,t){let r=withRuntimeSandboxLifecycle(t.sandbox,e=>t.onSessionDelete(e),()=>t.onSessionStop());return n={handle:t,providerName:e,sandbox:r},r}async function resumePersisted(n,i){if(t===null)throw Error(`Sandbox session state is missing.`);let s=getSandboxEnvironmentRuntime(n.environment);if(t.providerName!==s.providerName)throw Error(`Sandbox session state belongs to provider "${t.providerName}", not "${s.providerName}".`);if(t.stateProtocolVersion!==s.stateProtocolVersion)throw Error(`Sandbox session state protocol ${t.stateProtocolVersion} is incompatible with provider "${s.providerName}" protocol ${s.stateProtocolVersion}.`);let c=o.inheritance?.nodeId??e.nodeId,l=await loadSandboxPreparedArtifact({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:c,providerName:s.providerName});if(l===void 0)throw new SandboxTemplateNotProvisionedError({providerName:s.providerName,templateKey:c});let u={host:createSandboxProviderHost(a),session:i,storagePath:resolveSandboxCacheDirectory(a)};r=s.implementation.resume(u,l,t.state).catch(e=>{throw r=void 0,e});let d=await r;return installHandle(s.providerName,d),trackActiveSandboxHandle({handle:d,providerName:s.providerName,sessionId:e.sessionId}),d}async function resolveHandle(){let n=o.inheritance,r=n?.definition??o.definition;if(r.kind!==`independent`)throw Error(`Sandbox "${r.logicalPath}" has no resolved parent.`);isEveDevEnvironment()&&e.compiledArtifactsSource.kind===`disk`&&await ensureDevelopmentSandboxesPrepared({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:n?.nodeId??e.nodeId,providerName:getSandboxEnvironmentRuntime(r.environment).providerName});let i={...contextStorage.getStore()===void 0?{auth:{current:null,initiator:null},id:e.sessionId,turn:{id:`sandbox-initialization`,sequence:0}}:buildCallbackContext().session,id:e.sessionId};if(t!==null)return await resumePersisted(r,i);let a=`${n?.nodeId??e.nodeId}\0${e.sessionId}`,s=pendingSandboxStarts.get(a);for(;s!==void 0;){if(t=await s,t!==null)return await resumePersisted(r,i);s=pendingSandboxStarts.get(a)}let c=startHandle(r,i),l=c.then(()=>t,()=>null);pendingSandboxStarts.set(a,l);try{return await c}finally{pendingSandboxStarts.get(a)===l&&pendingSandboxStarts.delete(a)}}async function startHandle(i,a){if(o.inheritance!==void 0)await open(getSandboxEnvironmentRuntime(i.environment),void 0,i.environment,a);else try{let e=await runWithSandboxConstructorRuntime({open:({environment:e,options:t,provider:n})=>open(n,t,e,a)},async()=>i.selector({session:a}));if(n===void 0||e!==n.sandbox)throw Error(`Sandbox "${i.logicalPath}" must return the sandbox it opens.`)}catch(e){let a=n?.handle;if(n=void 0,r=void 0,t=null,a!==void 0)try{await a.onSessionDelete()}catch(t){throw AggregateError([e,t],`Sandbox "${i.logicalPath}" initialization and cleanup both failed.`,{cause:e})}throw e}if(n===void 0)throw Error(`Sandbox "${i.logicalPath}" did not open a provider handle.`);return trackActiveSandboxHandle({handle:n.handle,providerName:n.providerName,sessionId:e.sessionId}),n.handle}function requireHandle(){return i===void 0&&(i=resolveHandle().catch(e=>{throw i=void 0,e})),i}let s=o.inheritance?.definition??o.definition;return{environment:s.kind===`independent`?s.environment:void 0,async captureState(){return r!==void 0&&await r,{session:t}},async delete(a){if(e.ownsSandbox===!1)throw Error(`Only the owning session can delete this sandbox.`);await(await requireHandle()).onSessionDelete(a),n=void 0,r=void 0,t=null,i=void 0},async get(){return await requireHandle(),n?.sandbox??null},async stop(){await(await requireHandle()).onSessionStop(),n=void 0,r=void 0,i=void 0}}}export{ensureSandboxAccess};

package/dist/src/execution/sandbox/prewarm.d.ts

@@ -15,27 +15,10 @@ export interface SandboxPreparedArtifactStore {
  * templates the orchestrator emits and what preparation calls flow through
  * them.
  */
-export type SandboxProviderPrepareDispatch = (input: {
+type SandboxProviderPrepareDispatch = (input: {
     readonly context: SandboxProviderPrepareContext;
     readonly provider: SandboxProviderRuntime;
 }) => Promise<SandboxPreparedArtifact>;
-interface PrewarmSandboxesInput {
-    readonly appRoot: string;
-    readonly compileDirectoryPath: string;
-    readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;
-    readonly graph: ResolvedAgentGraphBundle;
-    readonly log?: (message: string) => void;
-    readonly dispatch?: SandboxProviderPrepareDispatch;
-    readonly preparedArtifactStore?: SandboxPreparedArtifactStore;
-}
-/**
- * Prepares every provider sandbox template required by one compiled
- * runtime graph.
- *
- * Iterates every registered sandbox and invokes `provider.prepare(...)`
- * for each provider template.
- */
-export declare function prewarmSandboxes(input: PrewarmSandboxesInput): Promise<void>;
 /**
  * Loads the compiled runtime graph for one authored app root and
  * prepares every provider sandbox template required by that graph.