eve 0.82.0 → 0.83.0

package/dist/src/execution/sandbox/bindings/docker-connection.js

@@ -0,0 +1,2 @@
+import{randomUUID}from"node:crypto";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{dirname}from"node:path/posix";import{stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";const DOCKER_KILL_TREE_SCRIPT=[`pid_file="$1"`,`target="$(cat "$pid_file" 2>/dev/null)" || exit 0`,`[ -n "$target" ] || exit 0`,`kill_tree() {`,`  local parent="$1" dir child ppid line`,`  for dir in /proc/[0-9]*; do`,'    child="${dir#/proc/}"',`    ppid=""`,`    while IFS= read -r line; do`,`      case "$line" in`,'        PPid:*) ppid="${line#PPid:}"; ppid="${ppid//[^0-9]/}"; break ;;',`      esac`,`    done < "$dir/status" 2>/dev/null`,`    [ "$ppid" = "$parent" ] && kill_tree "$child"`,`  done`,`  kill -9 "$parent" 2>/dev/null`,`}`,`kill_tree "$target"`,`rm -f "$pid_file"`,`exit 0`].join(`
+`);function createDockerConnection(e){let{cli:t,containerIdentity:n}=e;async function killSpawnTree(e){await t.run([`exec`,n,`bash`,`-c`,DOCKER_KILL_TREE_SCRIPT,`eve-kill-tree`,e]).catch(()=>{})}return{extensions:{setNetworkPolicy:e=>setDockerNetworkPolicy(t,n,e)},async spawn(e){let r=[`exec`,`-w`,e.workingDirectory];for(let[t,n]of Object.entries(e.env))r.push(`-e`,`${t}=${n}`);let i=`/tmp/.eve-sbx-spawn-${randomUUID()}.pid`,a=`echo "$$" > ${shellQuote(i)}; bash -lc ${shellQuote(e.command)}; status=$?; rm -f ${shellQuote(i)}; exit $status`;r.push(n,`bash`,`-c`,a);let o=t.stream(r,{signal:e.abortSignal});return e.abortSignal?.addEventListener(`abort`,()=>void killSpawnTree(i),{once:!0}),{stdout:o.stdout,stderr:o.stderr,async wait(){return await o.wait()},async kill(){await killSpawnTree(i),await o.kill()}}},async readFile(e){let r=shellQuote(e.path),i=await t.run([`exec`,n,`bash`,`-lc`,`if [ -e ${r} ]; then exec cat ${r}; else exit 43; fi`],{signal:e.abortSignal});return i.exitCode===43?null:(expectDockerSuccess(i,`read "${e.path}" from sandbox container`),i.stdoutBytes)},async removePath(e){let r=`${e.recursive===!0?`r`:``}${e.force===!0?`f`:``}`,i=[`exec`,n,`rm`,...r.length>0?[`-${r}`]:[],`--`,e.path],a=await t.run(i,{signal:e.abortSignal});expectDockerSuccess(a,`remove "${e.path}" from sandbox container`)},stop:()=>stopDockerContainerIfRunning(t,n),async writeFiles(e){for(let r of e.files){let i=await t.run([`exec`,`-i`,n,`bash`,`-lc`,`mkdir -p ${shellQuote(dirname(r.path))} && cat > ${shellQuote(r.path)}`],{signal:e.abortSignal,stdin:r.content});expectDockerSuccess(i,`write "${r.path}" into sandbox container`)}}}}export{createDockerConnection};

package/dist/src/execution/sandbox/bindings/docker-container.d.ts

@@ -2,6 +2,8 @@ import type { DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
 import type { ResolvedDockerSandboxOptions } from "#execution/sandbox/bindings/docker-options.js";
 import type { DockerSandboxNetworkPolicy } from "#public/sandbox/docker-sandbox.js";
 export declare const DOCKER_SANDBOX_LABEL = "eve.sandbox";
+/** Where a template build container mounts the read-only workspace and skill resources. */
+export declare const DOCKER_RESOURCES_MOUNT_PATH = "/eve/resources";
 export declare function startDockerContainer(input: {
     readonly cli: DockerCli;
     readonly containerName: string;

package/dist/src/execution/sandbox/bindings/docker-container.js

@@ -1 +1 @@
-import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{SANDBOX_AGENT_ENV}from"#execution/sandbox/session.js";const DOCKER_SANDBOX_LABEL=`eve.sandbox`,DOCKER_KEEPALIVE_ARGS=[`-c`,`sleep 2147483647`];async function startDockerContainer(e){let t=[`run`,`-d`,`--name`,e.containerName,`--label`,`${DOCKER_SANDBOX_LABEL}=1`,`--label`,`${DOCKER_SANDBOX_LABEL}.role=${e.role}`];for(let[n,r]of Object.entries(withDevelopmentSandboxTags(e.tags)??{}))t.push(`--label`,`${DOCKER_SANDBOX_LABEL}.tag.${n}=${r}`);for(let[n,r]of Object.entries({...SANDBOX_AGENT_ENV,...e.options.env}))t.push(`-e`,`${n}=${r}`);e.initialNetworkPolicy===`deny-all`&&t.push(`--network`,`none`),e.resourcesPath!==void 0&&t.push(`--mount`,`type=bind,src=${e.resourcesPath},dst=/eve/resources,readonly`),t.push(`--workdir`,WORKSPACE_ROOT,`--entrypoint`,`/bin/sh`,e.image,...DOCKER_KEEPALIVE_ARGS),expectDockerSuccess(await e.cli.run(t),`start sandbox container "${e.containerName}" from "${e.image}"`)}async function runDockerBaseSetup(e,t){expectDockerSuccess(await e.run([`exec`,`--user`,`root`,t,`/bin/sh`,`-c`,buildDockerBaseSetupScript()]),`prepare base runtime in sandbox container "${t}"`)}async function stopDockerContainerIfRunning(e,t){await e.run([`stop`,`-t`,`0`,t]).catch(()=>{})}export{DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning};
+import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";import{SANDBOX_AGENT_ENV}from"#public/sandbox/provider.js";const DOCKER_SANDBOX_LABEL=`eve.sandbox`,DOCKER_RESOURCES_MOUNT_PATH=`/eve/resources`,DOCKER_KEEPALIVE_ARGS=[`-c`,`sleep 2147483647`];async function startDockerContainer(e){let t=[`run`,`-d`,`--name`,e.containerName,`--label`,`${DOCKER_SANDBOX_LABEL}=1`,`--label`,`${DOCKER_SANDBOX_LABEL}.role=${e.role}`];for(let[n,r]of Object.entries(withDevelopmentSandboxTags(e.tags)??{}))t.push(`--label`,`${DOCKER_SANDBOX_LABEL}.tag.${n}=${r}`);for(let[n,r]of Object.entries({...SANDBOX_AGENT_ENV,...e.options.env}))t.push(`-e`,`${n}=${r}`);e.initialNetworkPolicy===`deny-all`&&t.push(`--network`,`none`),e.resourcesPath!==void 0&&t.push(`--mount`,`type=bind,src=${e.resourcesPath},dst=${DOCKER_RESOURCES_MOUNT_PATH},readonly`),t.push(`--workdir`,WORKSPACE_ROOT,`--entrypoint`,`/bin/sh`,e.image,...DOCKER_KEEPALIVE_ARGS),expectDockerSuccess(await e.cli.run(t),`start sandbox container "${e.containerName}" from "${e.image}"`)}async function runDockerBaseSetup(e,t){expectDockerSuccess(await e.run([`exec`,`--user`,`root`,t,`/bin/sh`,`-c`,buildDockerBaseSetupScript()]),`prepare base runtime in sandbox container "${t}"`)}async function stopDockerContainerIfRunning(e,t){await e.run([`stop`,`-t`,`0`,t]).catch(()=>{})}export{DOCKER_RESOURCES_MOUNT_PATH,DOCKER_SANDBOX_LABEL,runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning};

package/dist/src/execution/sandbox/bindings/docker-network.d.ts

@@ -1,5 +1,10 @@
 import type { DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
 import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+/**
+ * Rejects a policy Docker cannot enforce, so a restrictive one never runs
+ * with open egress instead.
+ */
+export declare function assertDockerNetworkPolicy(policy: SandboxNetworkPolicy): asserts policy is "allow-all" | "deny-all";
 /**
  * Applies a coarse-grained run-time network policy by attaching or
  * detaching the container's networks. Domain-level policies and

package/dist/src/execution/sandbox/bindings/docker-network.js

@@ -1 +1 @@
-import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";async function setDockerNetworkPolicy(e,t,n){if(n!==`allow-all`&&n!==`deny-all`)throw Error(`The local Docker sandbox provider supports only the "allow-all" and "deny-all" network policies. Domain-level allow-lists and credential brokering require the Vercel provider (VercelSandbox) or MicrosandboxSandbox.`);let r=await e.run([`container`,`inspect`,`--format`,`{{json .NetworkSettings.Networks}}`,t]);expectDockerSuccess(r,`inspect networks of sandbox container "${t}"`);let i=JSON.parse(r.stdout.trim()===``?`{}`:r.stdout);if(typeof i!=`object`||!i)throw Error(`Docker returned invalid network settings for "${t}".`);let a=Object.keys(i);if(n===`deny-all`){for(let n of a)expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,n,t]),`disconnect sandbox container "${t}" from network "${n}"`);return}a.includes(`bridge`)||(a.includes(`none`)&&expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,`none`,t]),`detach sandbox container "${t}" from the none network`),expectDockerSuccess(await e.run([`network`,`connect`,`bridge`,t]),`connect sandbox container "${t}" to the bridge network`))}export{setDockerNetworkPolicy};
+import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";function assertDockerNetworkPolicy(e){if(e!==`allow-all`&&e!==`deny-all`)throw Error(`The local Docker sandbox provider supports only the "allow-all" and "deny-all" network policies. Domain-level allow-lists and credential brokering require the Vercel provider (VercelSandbox).`)}async function setDockerNetworkPolicy(e,t,n){assertDockerNetworkPolicy(n);let r=await e.run([`container`,`inspect`,`--format`,`{{json .NetworkSettings.Networks}}`,t]);expectDockerSuccess(r,`inspect networks of sandbox container "${t}"`);let i=JSON.parse(r.stdout.trim()===``?`{}`:r.stdout);if(typeof i!=`object`||!i)throw Error(`Docker returned invalid network settings for "${t}".`);let a=Object.keys(i);if(n===`deny-all`){for(let n of a)expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,n,t]),`disconnect sandbox container "${t}" from network "${n}"`);return}a.includes(`bridge`)||(a.includes(`none`)&&expectDockerSuccess(await e.run([`network`,`disconnect`,`--force`,`none`,t]),`detach sandbox container "${t}" from the none network`),expectDockerSuccess(await e.run([`network`,`connect`,`bridge`,t]),`connect sandbox container "${t}" to the bridge network`))}export{assertDockerNetworkPolicy,setDockerNetworkPolicy};

package/dist/src/execution/sandbox/bindings/docker-templates.js

@@ -1 +1 @@
-import{mkdir,readdir,rm,stat,utimes,writeFile}from"node:fs/promises";import"node:fs";import{dirname,join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL}from"#execution/sandbox/bindings/docker-container.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";const DOCKER_TEMPLATE_IMAGE_REPOSITORY=`eve-sandbox-template`;async function pruneDockerSandboxTemplates(e){let t=e.dockerCli??createDockerCli(),n=resolveDockerTemplateMarkersDirectory(resolveSandboxCacheDirectory(e.appRoot)),r;try{r=await readdir(n,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let i=await Promise.all(r.filter(e=>e.isFile()).map(async e=>{let t=join(n,e.name);return{imageTag:e.name,mtimeMs:(await stat(t)).mtimeMs,path:t}})),a=selectStaleTemplateEntries(i,{now:e.now??Date.now(),recentWindowMs:e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,retainCount:e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT});for(let e of a){let n=await t.run([`rmi`,dockerTemplateImageReferenceFromTag(e.imageTag)]),r=n.exitCode!==0&&/no such image/i.test(n.stderr);(n.exitCode===0||r)&&await rm(e.path,{force:!0})}}function dockerTemplateImageReference(e){return dockerTemplateImageReferenceFromTag(dockerTemplateImageTag(e))}function dockerTemplateImageReferenceFromTag(e){return`${DOCKER_TEMPLATE_IMAGE_REPOSITORY}:${e}`}function dockerTemplateImageTag(e){return`${e.templateKey.toLowerCase()}-${e.optionsHash}`}function resolveDockerTemplateMarkerPath(e,t){return join(resolveDockerTemplateMarkersDirectory(e),dockerTemplateImageTag(t))}async function touchDockerTemplateMarker(e,t){await mkdir(dirname(e),{recursive:!0});try{let t=new Date;await utimes(e,t,t)}catch{await writeFile(e,`${t}\n`)}}async function dockerImageExists(e,t){return(await e.run([`image`,`inspect`,`--format`,`{{.Id}}`,t])).exitCode===0}async function commitDockerTemplateImage(e){let t=await e.cli.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${e.templateKey}`,e.containerIdentity,e.imageReference]);return t.exitCode===0?`committed`:(/already(?:\s*|-)?exists/iu.test(`${t.stderr}\n${t.stdout}`)&&await dockerImageExists(e.cli,e.imageReference)||expectDockerSuccess(t,`commit sandbox template image "${e.imageReference}"`),`reused`)}async function ensureDockerBaseImage(e,t){if(t.pullPolicy===`always`){expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`);return}if(!await dockerImageExists(e,t.image)){if(t.pullPolicy===`never`)throw Error(`The local sandbox base image "${t.image}" is not present locally and pullPolicy is "never". Pull the image manually or relax the pull policy.`);expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`)}}function resolveDockerTemplateMarkersDirectory(e){return join(e,`docker`,`templates`)}export{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker};
+import{mkdir,readdir,rm,stat,utimes,writeFile}from"node:fs/promises";import"node:fs";import{dirname,join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{DOCKER_SANDBOX_LABEL}from"#execution/sandbox/bindings/docker-container.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";const DOCKER_TEMPLATE_IMAGE_REPOSITORY=`eve-sandbox-template`;async function pruneDockerSandboxTemplates(e){let t=e.dockerCli??createDockerCli(),n=resolveDockerTemplateMarkersDirectory(resolveSandboxCacheDirectory(e.appRoot)),r;try{r=await readdir(n,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let i=await Promise.all(r.filter(e=>e.isFile()).map(async e=>{let t=join(n,e.name);return{imageTag:e.name,mtimeMs:(await stat(t)).mtimeMs,path:t}})),a=selectStaleTemplateEntries(i,{now:e.now??Date.now(),recentWindowMs:e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,retainCount:e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT});for(let e of a){let n=await t.run([`rmi`,dockerTemplateImageReferenceFromTag(e.imageTag)]),r=n.exitCode!==0&&/no such image/i.test(n.stderr);(n.exitCode===0||r)&&await rm(e.path,{force:!0})}}function dockerTemplateImageReference(e){return dockerTemplateImageReferenceFromTag(dockerTemplateImageTag(e))}function dockerTemplateImageReferenceFromTag(e){return`${DOCKER_TEMPLATE_IMAGE_REPOSITORY}:${e}`}function dockerTemplateImageTag(e){return`${e.templateKey.toLowerCase()}-${e.optionsHash}`}function resolveDockerTemplateMarkerPath(e,t){return join(resolveDockerTemplateMarkersDirectory(e),dockerTemplateImageTag(t))}async function touchDockerTemplateMarker(e,t){await mkdir(dirname(e),{recursive:!0});try{let t=new Date;await utimes(e,t,t)}catch{await writeFile(e,`${t}\n`)}}async function dockerImageExists(e,t){return(await e.run([`image`,`inspect`,`--format`,`{{.Id}}`,t])).exitCode===0}async function commitDockerTemplateImage(e){let t=await e.cli.run([`commit`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}=1`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.role=template`,`--change`,`LABEL ${DOCKER_SANDBOX_LABEL}.template-key=${e.templateKey}`,e.containerIdentity,e.imageReference]);return t.exitCode===0?`committed`:(/already(?:\s*|-)?exists/iu.test(`${t.stderr}\n${t.stdout}`)&&await dockerImageExists(e.cli,e.imageReference)||expectDockerSuccess(t,`commit sandbox template image "${e.imageReference}"`),`reused`)}async function ensureDockerBaseImage(e,t){if(t.pullPolicy===`always`){expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`);return}if(!await dockerImageExists(e,t.image)){if(t.pullPolicy===`never`)throw Error(`The local sandbox base image "${t.image}" is not present locally and pullPolicy is "never". Pull the image manually or relax the pull policy.`);expectDockerSuccess(await e.run([`pull`,t.image]),`pull base image "${t.image}"`)}}function resolveDockerTemplateMarkersDirectory(e){return join(e,`docker`,`templates`)}export{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker};

package/dist/src/execution/sandbox/bindings/docker.d.ts

@@ -1,11 +1,7 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
-type NetworkPolicySandboxSession = SandboxSession & {
-    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
-};
 import { type DockerCli } from "#execution/sandbox/bindings/docker-cli.js";
-import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+import { type DockerSandboxExtensions } from "#execution/sandbox/bindings/docker-connection.js";
 import type { DockerSandboxEnvironmentOptions, DockerSandboxRuntimeOptions } from "#public/sandbox/docker-sandbox.js";
+import { type SandboxProviderImplementation } from "#public/sandbox/provider.js";
 export { DOCKER_TEMPLATE_IMAGE_REPOSITORY, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker-templates.js";
 /**
  * Stable provider name used for prepared-artifact storage and provider identity.
@@ -16,20 +12,21 @@ type DockerSandboxPreparedArtifact = {
 };
 type DockerSandboxSessionState = {
     readonly containerName: string;
-    readonly generation: string;
     readonly version: 2;
 };
+/** Environment options the provider receives: eve runs `prepare` itself. */
+export type DockerSandboxProviderOptions = Omit<DockerSandboxEnvironmentOptions, "prepare">;
 /**
  * Creates the Docker sandbox provider.
  *
  * Two-phase lifecycle mapped onto Docker primitives:
  *
- * - `prewarm` runs the base image, applies base setup, runs the
- *   authored preparation, writes seed files, then `docker commit`s the
- *   container into a reusable template image.
- * - `create` starts (or restarts) one long-lived container per session
- *   key from the template image. The container's filesystem carries
- *   session state across reconnects, so `shutdown` only stops the
- *   container and the next `create` restarts it with state intact.
+ * - `prepare` runs the base image, applies base setup, lets eve seed the
+ *   workspace and skills and run the authored preparation, then
+ *   `docker commit`s the container into a reusable template image.
+ * - `start` starts (or restarts) one long-lived container per session
+ *   from the template image. The container's filesystem carries session
+ *   state across reconnects, so stopping only stops the container and the
+ *   next `start` or `resume` restarts it with state intact.
  */
-export declare function createDockerSandboxProvider(createOptions?: DockerSandboxEnvironmentOptions, dockerCli?: DockerCli): SandboxProviderImplementation<DockerSandboxRuntimeOptions, DockerSandboxPreparedArtifact, DockerSandboxSessionState, NetworkPolicySandboxSession>;
+export declare function createDockerSandboxProvider(createOptions: DockerSandboxProviderOptions, dockerCli?: DockerCli): SandboxProviderImplementation<DockerSandboxRuntimeOptions, DockerSandboxPreparedArtifact, DockerSandboxSessionState, DockerSandboxExtensions>;

package/dist/src/execution/sandbox/bindings/docker.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{toErrorMessage}from"#shared/errors.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{runDockerBaseSetup,startDockerContainer,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{setDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{createDockerInternalSession}from"#execution/sandbox/bindings/docker-session.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=e??{},i=resolveDockerSandboxOptions(r),a=createDockerSandboxOptionsHash(i),o;function ensureDaemon(){return o??=assertDockerDaemonAvailable(n).catch(e=>{throw o=void 0,e}),o}async function inspectContainerRunning(e){let t=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,e]);return t.exitCode===0?t.stdout.trim()===`true`:void 0}async function openDockerSession(e,t,r,a,o){await ensureDaemon();let s=requirePreparedDockerArtifact(r);if(!await dockerImageExists(n,s.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,templateKey:s.imageReference});let c=await inspectContainerRunning(a);if(c===void 0){if(!o)throw Error(`Docker sandbox session container "${a}" no longer exists.`);try{await startDockerContainer({cli:n,containerName:a,image:s.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:i,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}}),c=!0}catch(e){if(c=/is already in use/u.test(toErrorMessage(e))?await inspectContainerRunning(a):void 0,c===void 0)throw e}}c||expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`);let l=await resolveDockerHandleIdentity(n,a);return{sandbox:buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:l}),e=>setDockerNetworkPolicy(n,l,e)),async onSandboxDelete(){await stopDockerContainerIfRunning(n,l),expectDockerSuccess(await n.run([`rm`,`-f`,l]),`delete sandbox session container "${a}"`)},async onSandboxStop(){await stopDockerContainerIfRunning(n,l)},async onRuntimeShutdown(){await stopDockerContainerIfRunning(n,l)}}}return{async prepare(e){e.log?.(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),o=createSandboxProviderIdentity({dockerfile:t?.contentHash,optionsHash:a,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24),s={optionsHash:a,templateKey:o},c=dockerTemplateImageReference(s),l=e.resources.source,u=l.kind===`materialized`?await prepareImmutableResources({storagePath:e.storagePath,provider:DOCKER_PROVIDER_NAME,resourcesKey:l.key,sourcePath:l.path}):void 0,d=resolveDockerTemplateMarkerPath(e.storagePath,s);if(e.log?.(`checking cached template image "${c}"`),await dockerImageExists(n,c))return e.log?.(`reusing cached template image`),await touchDockerTemplateMarker(d,c),{imageReference:c};let f=i.image;t===void 0?(e.log?.(`checking base image "${i.image}"`),await ensureDockerBaseImage(n,i)):(f=dockerfileImageReference({dockerfile:t,templateKey:o}),e.log?.(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:f}));let p=`${o}-build-${randomUUID().slice(0,8)}`;e.log?.(`starting template build container`),await startDockerContainer({cli:n,containerName:p,image:f,initialNetworkPolicy:`allow-all`,options:i,resourcesPath:u,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,p);e.log?.(`preparing base runtime inside container`),await runDockerBaseSetup(n,t);let i=buildSandboxSession(createDockerInternalSession({cli:n,containerIdentity:t}),e=>setDockerNetworkPolicy(n,t,e));await hydrateSandboxProviderResources({copySkills:!0,log:e.log,resources:e.resources,session:i}),r.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await r.prepare(createLoggingSandboxSession({log:e.log,session:i}))),e.log?.(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${p}"`),e.log?.(`committing template image "${c}"`),await commitDockerTemplateImage({cli:n,containerIdentity:t,imageReference:c,templateKey:o})===`reused`&&e.log?.(`reusing concurrently published template image`),await touchDockerTemplateMarker(d,c)}finally{await n.run([`rm`,`-f`,p]).catch(()=>{}),t!==void 0&&await n.run([`rmi`,f]).catch(()=>{})}return{imageReference:c}},async resume(e,t,n){let r=requireDockerSessionState(n);if(r.generation!==dockerGeneration(t,a))throw Error(`Docker sandbox session state is incompatible with this environment.`);return await openDockerSession(e,void 0,t,r.containerName,!1)},async start(e,t,n){let r=dockerSessionName(e.session.id,t,n,a);return{handle:await openDockerSession(e,t,n,r,!0),state:{containerName:r,generation:dockerGeneration(n,a),version:2}}}}}function dockerGeneration(e,t){return createSandboxProviderIdentity({artifact:e,environment:t,version:1})}function dockerSessionName(e,t,n,r){return`eve-sbx-${createSandboxProviderIdentity({artifact:n,environment:r,open:{networkPolicy:t?.networkPolicy},sessionId:e,version:1}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.imageReference!=`string`)throw Error(`Invalid prepared Docker artifact.`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.containerName!=`string`||typeof e.generation!=`string`)throw Error(`Invalid Docker sandbox session state.`);return{containerName:e.containerName,generation:e.generation,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};
+import{randomUUID}from"node:crypto";import{isObject}from"#shared/guards.js";import{toErrorMessage}from"#shared/errors.js";import{DOCKER_RESOURCES_MOUNT_PATH,runDockerBaseSetup,startDockerContainer}from"#execution/sandbox/bindings/docker-container.js";import{assertDockerNetworkPolicy}from"#execution/sandbox/bindings/docker-network.js";import{expectDockerSuccess}from"#execution/sandbox/bindings/docker-utils.js";import{SandboxSessionGoneError,SandboxTemplateNotProvisionedError}from"#public/sandbox/provider.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{createDockerConnection}from"#execution/sandbox/bindings/docker-connection.js";import{createDockerSandboxOptionsHash,resolveDockerSandboxOptions}from"#execution/sandbox/bindings/docker-options.js";import{DOCKER_TEMPLATE_IMAGE_REPOSITORY,commitDockerTemplateImage,dockerImageExists,dockerTemplateImageReference,ensureDockerBaseImage,pruneDockerSandboxTemplates,resolveDockerTemplateMarkerPath,touchDockerTemplateMarker}from"#execution/sandbox/bindings/docker-templates.js";import{buildSandboxDockerfile,dockerfileImageReference,materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{invalidPreparedSandboxArtifactError,invalidSandboxSessionStateError}from"#shared/sandbox-recorded-data-error.js";const DOCKER_PROVIDER_NAME=`docker`;function createDockerSandboxProvider(e,t){let n=t??createDockerCli(),r=resolveDockerSandboxOptions(e),i=createDockerSandboxOptionsHash(r),a;function ensureDaemon(){return a??=assertDockerDaemonAvailable(n).catch(e=>{throw a=void 0,e}),a}async function inspectContainerRunning(e){let t=await n.run([`container`,`inspect`,`--format`,`{{.State.Running}}`,e]);if(t.exitCode===0)return t.stdout.trim()===`true`;/no such (?:container|object)/iu.test(t.stderr)||(a=void 0,expectDockerSuccess(t,`inspect sandbox session container "${e}"`))}async function openDockerSession(e,t,i,a,o){await ensureDaemon();let s=await inspectContainerRunning(a);if(s===void 0){if(!o)throw new SandboxSessionGoneError(`Docker sandbox session container "${a}" no longer exists.`);let c=requirePreparedDockerArtifact(i);if(!await dockerImageExists(n,c.imageReference))throw new SandboxTemplateNotProvisionedError({providerName:DOCKER_PROVIDER_NAME,reason:"The Docker daemon has no image with that name: it was removed, for example by `docker image prune -a`, or the build used another Docker daemon.",templateKey:c.imageReference});try{await startDockerContainer({cli:n,containerName:a,image:c.imageReference,initialNetworkPolicy:t?.networkPolicy??`allow-all`,options:r,role:`session`,tags:{agent:e.session.id,sessionId:e.session.id}}),s=!0}catch(e){if(s=/is already in use/u.test(toErrorMessage(e))?await inspectContainerRunning(a):void 0,s===void 0)throw e}}return s||expectDockerSuccess(await n.run([`start`,a]),`restart sandbox session container "${a}"`),createDockerConnection({cli:n,containerIdentity:await resolveDockerHandleIdentity(n,a)})}return{async onSessionEnd(e,t,{abortSignal:r}){await ensureDaemon();let i=t?.containerName??dockerSessionName(e),a=await n.run([`rm`,`-f`,i],{signal:r});a.exitCode!==0&&!/no such container/iu.test(a.stderr)&&expectDockerSuccess(a,`delete sandbox session container "${i}"`)},async prepare(e){e.log(`checking Docker daemon`),await ensureDaemon();let t=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),a=e.templateKey({dockerfile:t?.contentHash,optionsHash:i,version:2}).slice(0,24),o={optionsHash:i,templateKey:a},s=dockerTemplateImageReference(o),c=resolveDockerTemplateMarkerPath(e.storagePath,o);if(e.log(`checking cached template image "${s}"`),await dockerImageExists(n,s))return e.log(`reusing cached template image`),await touchDockerTemplateMarker(c,s),{imageReference:s};let l=await e.resourcesDirectory(),u=r.image;t===void 0?(e.log(`checking base image "${r.image}"`),await ensureDockerBaseImage(n,r)):(u=dockerfileImageReference({dockerfile:t,templateKey:a}),e.log(`building sandbox Dockerfile "${t.path}"`),await buildSandboxDockerfile({cli:n,dockerfile:t,imageReference:u}));let d=`${a}-build-${randomUUID().slice(0,8)}`;e.log(`starting template build container`),await startDockerContainer({cli:n,containerName:d,image:u,initialNetworkPolicy:`allow-all`,options:r,resourcesPath:l,role:`template-build`});try{let t=await resolveDockerHandleIdentity(n,d);e.log(`preparing base runtime inside container`),await runDockerBaseSetup(n,t),await e.populate(createDockerConnection({cli:n,containerIdentity:t}),l===void 0?void 0:{mountedAt:DOCKER_RESOURCES_MOUNT_PATH}),e.log(`stopping template build container`),expectDockerSuccess(await n.run([`stop`,`-t`,`0`,t]),`stop template build container "${d}"`),e.log(`committing template image "${s}"`),await commitDockerTemplateImage({cli:n,containerIdentity:t,imageReference:s,templateKey:a})===`reused`&&e.log(`reusing concurrently published template image`),await touchDockerTemplateMarker(c,s)}finally{await n.run([`rm`,`-f`,d]).catch(()=>{}),t!==void 0&&await n.run([`rmi`,u]).catch(()=>{})}return{imageReference:s}},async resume(e,t,n){return await openDockerSession(e,void 0,t,requireDockerSessionState(n).containerName,!1)},async start(e,t,n){t?.networkPolicy!==void 0&&assertDockerNetworkPolicy(t.networkPolicy);let r=dockerSessionName(e);return{connection:await openDockerSession(e,t,n,r,!0),state:{containerName:r,version:2}}}}}function dockerSessionName(e){return`eve-sbx-${createSandboxProviderIdentity({namespace:e.storagePath,sessionId:e.session.id,version:2}).slice(0,32)}`}function requirePreparedDockerArtifact(e){if(!isObject(e)||typeof e.imageReference!=`string`)throw invalidPreparedSandboxArtifactError(`Docker sandbox`);return{imageReference:e.imageReference}}function requireDockerSessionState(e){if(!isObject(e)||e.version!==2||typeof e.containerName!=`string`)throw invalidSandboxSessionStateError(`Docker sandbox`);return{containerName:e.containerName,version:2}}async function resolveDockerHandleIdentity(e,t){let n=await e.run([`container`,`inspect`,`--format`,`{{.Id}}`,t]);expectDockerSuccess(n,`resolve sandbox container identity for "${t}"`);let r=n.stdout.trim();if(r.length===0)throw Error(`Docker returned an empty identity for sandbox container "${t}".`);return r}export{DOCKER_PROVIDER_NAME,DOCKER_TEMPLATE_IMAGE_REPOSITORY,createDockerSandboxProvider,pruneDockerSandboxTemplates};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.d.ts

@@ -1,37 +1,27 @@
-import type { SandboxProviderHandle, SandboxProviderHost } from "#shared/sandbox-provider.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
-import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
-export interface JustBashSessionMetadata {
-    readonly rootPath: string;
-}
-export interface BashSandbox {
-    captureState(): Promise<JustBashSessionMetadata>;
-    dispose(): Promise<void>;
-    readFileBytes(path: string): Promise<Buffer | null>;
-    removePath(options: SandboxRemovePathOptions): Promise<void>;
-    readonly rootPath: string;
-    readonly sessionKey: string;
-    spawn(options: SandboxSpawnOptions): Promise<SandboxProcess>;
-    writeFiles(files: ReadonlyArray<{
-        path: string;
-        content: string | Uint8Array;
-    }>): Promise<void>;
+import { type SandboxConnection } from "#public/sandbox/provider.js";
+type JustBashModule = typeof import("just-bash");
+/** One just-bash interpreter over a session or template root. The root's files outlive it. */
+export interface BashSandbox extends SandboxConnection {
+    /** Records the interpreter's environment, so sessions created from this template start with it. */
+    captureState(): Promise<void>;
 }
-export declare function createBashSandbox(input: {
+/**
+ * Loads `just-bash` for template preparation, installing it into the project
+ * when it is missing during `eve dev` (unless `autoInstall` is false).
+ */
+export declare function installJustBashModule(input: {
+    readonly appRoot: string;
     readonly autoInstall: boolean;
-    readonly host: SandboxProviderHost;
+}): Promise<JustBashModule>;
+/** Loads `just-bash` for a session without installing it. */
+export declare function importJustBashModule(appRoot: string): Promise<JustBashModule>;
+export declare function createBashSandbox(input: {
     readonly customCommands?: JustBashSandboxCreateOptions["customCommands"];
     readonly filesystem?: JustBashSandboxCreateOptions["filesystem"];
+    readonly justBash: JustBashModule;
+    resolveProjectPath(path: string): string;
     readonly rootPath: string;
-    readonly sessionKey: string;
     readonly storagePath: string;
 }): Promise<BashSandbox>;
-/**
- * The just-bash engine cannot honor a run-time network policy: just-bash takes
- * its `NetworkConfig` only at sandbox creation (no live update) and runs no
- * `git` or other binaries, so credential brokering has nothing to act on.
- * Throw rather than silently no-op so brokering code surfaces the gap instead
- * of leaking.
- */
-export declare function createJustBashHandle(sandbox: BashSandbox): SandboxProviderHandle<SandboxSession>;
+export {};

package/dist/src/execution/sandbox/bindings/just-bash-runtime.js

@@ -1 +1 @@
-import{mkdir,readFile,rm,writeFile}from"node:fs/promises";import{dirname}from"node:path";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{SANDBOX_AGENT_ENV,buildSandboxSession}from"#execution/sandbox/session.js";import{createFileBackedInternalSandboxSession,pathExists}from"#execution/sandbox/bindings/local-provider-utils.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";let justBashModulePromise;async function loadJustBashModule(e){return justBashModulePromise??=e.host.loadOptionalPackage({autoInstall:e.autoInstall,importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox provider requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use DockerSandbox or DefaultSandbox instead.",packageName:`just-bash`,ignoredOptionalDependencies:[`@mongodb-js/zstd`,`node-liblzma`]}).catch(e=>{throw justBashModulePromise=void 0,e}),await justBashModulePromise}async function createBashSandbox(e){let t=await loadJustBashModule({autoInstall:e.autoInstall,host:e.host}),{ReadWriteFs:n,Sandbox:r}=t,i=resolveLocalSandboxFilesystemRootPath(e.rootPath),a=resolveLocalSandboxMetadataPath(e.rootPath),o=await readLocalMetadata(a);await mkdir(i,{recursive:!0});let s=new n({allowSymlinks:!0,maxFileReadSize:2**53-1,root:i}),c=s;if(e.filesystem!==void 0)try{c=await e.filesystem({defaultFilesystem:s,resolveProjectPath:e.host.resolveProjectPath,storagePath:e.storagePath,justBash:t})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await ensureLocalSandboxDirectories(c);let l=await r.create({cwd:WORKSPACE_ROOT,customCommands:e.customCommands===void 0?void 0:[...e.customCommands],env:o===null?void 0:{...o.env},fs:c,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){return await writeLocalMetadata(a,{env:{...l.bashEnvInstance.getEnv()},version:1}),{rootPath:e.rootPath}},async dispose(){await l.stop()},async readFileBytes(e){let t;try{t=await c.readFileBuffer(e)}catch{return null}return Buffer.from(t)},async removePath(e){await c.rm(e.path,{force:e.force,recursive:e.recursive})},rootPath:e.rootPath,sessionKey:e.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQuote(e.workingDirectory)} && ${e.command} )`,n=await l.runCommand({args:[t],cmd:`eval`,detached:!0,env:{...SANDBOX_AGENT_ENV,...e.env},signal:e.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.type})},async writeFiles(e){for(let t of e){let e=dirname(t.path);await c.mkdir(e,{recursive:!0}),await c.writeFile(t.path,t.content)}}}}function createJustBashHandle(e){return{sandbox:buildSandboxSession(createFileBackedInternalSandboxSession({sandbox:e})),async onSandboxDelete(){await e.dispose(),await rm(e.rootPath,{force:!0,recursive:!0})},async onSandboxStop(){await e.dispose()},async onRuntimeShutdown(){await e.dispose()}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function ensureLocalSandboxDirectories(e){await e.mkdir(WORKSPACE_ROOT,{recursive:!0})}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return!isRecord(t)||t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(e,t){await mkdir(dirname(e),{recursive:!0}),await writeFile(e,`${JSON.stringify(t,null,2)}\n`)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function isStringRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,createJustBashHandle};
+import{mkdir,readFile,writeFile}from"node:fs/promises";import{isObject}from"#shared/guards.js";import{dirname}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{SANDBOX_AGENT_ENV}from"#public/sandbox/provider.js";import{pathExists}from"#execution/sandbox/bindings/local-provider-utils.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{importOptionalEnginePackage}from"#internal/application/optional-package-import.js";const JUST_BASH_PACKAGE={importModule:async()=>await import(`just-bash`),missingMessage:"The just-bash sandbox provider requires the `just-bash` package, which is not bundled with eve. Install it in your application (for example `pnpm add -D just-bash`), or use DockerSandbox or DefaultSandbox instead.",packageName:`just-bash`};async function installJustBashModule(e){return await loadOptionalEnginePackage({...JUST_BASH_PACKAGE,appRoot:e.appRoot,autoInstall:e.autoInstall,ignoredOptionalDependencies:[`@mongodb-js/zstd`,`node-liblzma`]})}async function importJustBashModule(e){return await importOptionalEnginePackage({...JUST_BASH_PACKAGE,appRoot:e})}async function createBashSandbox(e){let{justBash:t}=e,n=resolveLocalSandboxFilesystemRootPath(e.rootPath),r=resolveLocalSandboxMetadataPath(e.rootPath),i=await readLocalMetadata(r);await mkdir(n,{recursive:!0});let a=new t.ReadWriteFs({allowSymlinks:!0,maxFileReadSize:2**53-1,root:n}),o=a;if(e.filesystem!==void 0)try{o=await e.filesystem({defaultFilesystem:a,resolveProjectPath:t=>e.resolveProjectPath(t),storagePath:e.storagePath,justBash:t})}catch(e){throw Error(`Failed to create the custom just-bash filesystem.`,{cause:e})}await o.mkdir(WORKSPACE_ROOT,{recursive:!0});let s=await t.Sandbox.create({cwd:WORKSPACE_ROOT,customCommands:e.customCommands===void 0?void 0:[...e.customCommands],env:i===null?void 0:{...i.env},fs:o,network:{dangerouslyAllowFullInternetAccess:!0}});return{async captureState(){await writeLocalMetadata(r,{env:{...s.bashEnvInstance.getEnv()},version:1})},async readFile({path:e}){try{return await o.readFileBuffer(e)}catch(t){if(!await o.exists(e))return null;throw t}},async removePath(e){await o.rm(e.path,{force:e.force,recursive:e.recursive})},async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=`( cd ${shellQuote(e.workingDirectory)} && {\n${e.command}\n} )`,n=await s.runCommand({args:[t],cmd:`eval`,detached:!0,env:{...SANDBOX_AGENT_ENV,...e.env},signal:e.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.type})},async stop(){await s.stop()},async writeFiles({files:e}){for(let t of e)await o.mkdir(dirname(t.path),{recursive:!0}),await o.writeFile(t.path,t.content)}}}function resolveLocalSandboxFilesystemRootPath(e){return`${e}/fs`}function resolveLocalSandboxMetadataPath(e){return`${e}/metadata.json`}async function readLocalMetadata(e){if(!await pathExists(e))return null;let t=JSON.parse(await readFile(e,`utf8`));return!isObject(t)||t.version!==1||!isStringRecord(t.env)?null:{env:t.env,version:1}}async function writeLocalMetadata(e,t){await mkdir(dirname(e),{recursive:!0}),await writeFile(e,`${JSON.stringify(t,null,2)}\n`)}function isStringRecord(e){return isObject(e)&&Object.values(e).every(e=>typeof e==`string`)}export{createBashSandbox,importJustBashModule,installJustBashModule};

package/dist/src/execution/sandbox/bindings/just-bash.d.ts

@@ -1,16 +1,14 @@
 import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
-import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+import { type SandboxProviderImplementation } from "#public/sandbox/provider.js";
 export declare const JUST_BASH_PROVIDER_NAME = "just-bash";
 type JustBashPreparedArtifact = {
     readonly templateKey: string;
 };
 type JustBashSessionState = {
-    readonly generation: string;
     readonly rootPath: string;
     readonly version: 2;
 };
-export declare function createJustBashSandboxProvider(authoredOptions?: JustBashSandboxCreateOptions | undefined): SandboxProviderImplementation<undefined, JustBashPreparedArtifact, JustBashSessionState, SandboxSession>;
+export declare function createJustBashSandboxProvider(options?: JustBashSandboxCreateOptions): SandboxProviderImplementation<undefined, JustBashPreparedArtifact, JustBashSessionState, {}>;
 export declare function pruneJustBashSandboxTemplates(input: {
     readonly appRoot: string;
     readonly now?: number;

package/dist/src/execution/sandbox/bindings/just-bash.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{mkdir,readdir,rename,rm,stat}from"node:fs/promises";import"node:fs";import{dirname,join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{withToolSessionSandboxes}from"#execution/tool-session/sandbox.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,touchDirectory,writeSandboxSeedFiles}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{createBashSandbox,createJustBashHandle}from"#execution/sandbox/bindings/just-bash-runtime.js";const JUST_BASH_CACHE_DIRECTORY_NAME=`just-bash`,JUST_BASH_PROVIDER_NAME=`just-bash`;function createJustBashSandboxProvider(e=void 0){let t=e??{},n=t.autoInstall??!0,r={autoInstall:n,customCommands:t.customCommands,filesystem:t.filesystem,version:2};return withToolSessionSandboxes({async prepare(e){let i=createSandboxProviderIdentity({...r,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision}).slice(0,24),a=resolveTemplateRootPath(e.storagePath,i);if(await pathExists(a))return await touchDirectory(a),e.log?.(`reusing cached template filesystem`),{templateKey:i};let o=`${a}.${randomUUID()}.tmp`,s=!1,c=await createBashSandbox({autoInstall:n,host:e.host,rootPath:o,sessionKey:`prepare-${i}`,storagePath:e.storagePath}),l=buildSandboxSession(createFileBackedInternalSandboxSession({sandbox:c}));try{await writeSandboxSeedFiles(l,providerResourceTargetFiles(e.resources)),t.prepare!==void 0&&(e.log?.(`running sandbox preparation`),await t.prepare(createLoggingSandboxSession({log:e.log,session:l}))),await c.captureState(),await mkdir(dirname(a),{recursive:!0});try{await rename(o,a),s=!0}catch(e){if(await pathExists(a))return{templateKey:i};throw e}}finally{await c.dispose(),s||await rm(o,{force:!0,recursive:!0})}return{templateKey:i}},async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root "${a.rootPath}" no longer exists.`);return await openHandle(e,a.rootPath,t)},async start(e,n,r){let i=requirePreparedJustBashArtifact(r),a=sessionRootPath(e,i);return await ensureSessionRoot(resolveTemplateRootPath(e.storagePath,i.templateKey),a),{handle:await openHandle(e,a,t),state:{generation:createSandboxProviderIdentity({artifact:i,version:1}),rootPath:a,version:2}}}},{releaseHandle:e=>e.onSandboxStop()})}function sessionRootPath(e,t){return resolveSessionRootPath(e.storagePath,createSandboxProviderIdentity({artifact:t,sessionId:e.session.id,version:1}).slice(0,24))}async function ensureSessionRoot(e,t){if(!await pathExists(t)){if(!await pathExists(e))throw new SandboxTemplateNotProvisionedError({providerName:JUST_BASH_PROVIDER_NAME,templateKey:e});await copyDirectoryAtomically(e,t)}}async function openHandle(e,t,n){let r=await createBashSandbox({autoInstall:n.autoInstall??!0,customCommands:n.customCommands,filesystem:n.filesystem,host:e.host,rootPath:t,sessionKey:e.session.id,storagePath:e.storagePath});return createJustBashHandle(r)}async function pruneJustBashSandboxTemplates(e){let t=resolveLocalProviderTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot),JUST_BASH_CACHE_DIRECTORY_NAME),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a;try{a=await readdir(t,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let o=await Promise.all(a.filter(e=>e.isDirectory()).map(async e=>{let n=join(t,e.name);return{isTemporary:e.name.endsWith(`.tmp`),mtimeMs:(await stat(n)).mtimeMs,path:n}})),s=selectStaleTemplateEntries(o.filter(e=>!e.isTemporary),{now:n,recentWindowMs:r,retainCount:i}),c=selectStaleTemplateEntries(o.filter(e=>e.isTemporary),{now:n,recentWindowMs:r,retainCount:0});await Promise.all([...s,...c].map(async e=>await rm(e.path,{force:!0,recursive:!0})))}function requirePreparedJustBashArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||typeof e.templateKey!=`string`)throw Error(`Invalid prepared just-bash artifact.`);return{templateKey:e.templateKey}}function requireJustBashSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.generation!=`string`||typeof e.rootPath!=`string`)throw Error(`Invalid just-bash session state.`);return{generation:e.generation,rootPath:e.rootPath,version:2}}function resolveTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function resolveSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}export{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates};
+import{randomUUID}from"node:crypto";import{mkdir,readdir,rename,rm,stat}from"node:fs/promises";import{isObject}from"#shared/guards.js";import"node:fs";import{dirname,join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{SandboxSessionGoneError,SandboxTemplateNotProvisionedError}from"#public/sandbox/provider.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,selectStaleTemplateEntries}from"#execution/sandbox/bindings/local-template-prune.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{invalidPreparedSandboxArtifactError,invalidSandboxSessionStateError}from"#shared/sandbox-recorded-data-error.js";import{copyDirectoryAtomically,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,touchDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{createBashSandbox,importJustBashModule,installJustBashModule}from"#execution/sandbox/bindings/just-bash-runtime.js";const JUST_BASH_CACHE_DIRECTORY_NAME=`just-bash`,JUST_BASH_PROVIDER_NAME=`just-bash`;function createJustBashSandboxProvider(e={}){let t=e.autoInstall??!0;async function connect(t,n){return await createBashSandbox({customCommands:e.customCommands,filesystem:e.filesystem,justBash:await importJustBashModule(t.resolveProjectPath(`.`)),resolveProjectPath:e=>t.resolveProjectPath(e),rootPath:n,storagePath:t.storagePath})}return{async onSessionEnd(e,t){await rm(t?.rootPath??sessionRootPath(e),{force:!0,recursive:!0})},async prepare(e){let n=e.templateKey({version:2}).slice(0,24),r=resolveTemplateRootPath(e.storagePath,n);if(await pathExists(r))return await touchDirectory(r),e.log(`reusing cached template filesystem`),{templateKey:n};let i=`${r}.${randomUUID()}.tmp`,a=!1,o=await createBashSandbox({justBash:await installJustBashModule({appRoot:e.resolveProjectPath(`.`),autoInstall:t}),resolveProjectPath:t=>e.resolveProjectPath(t),rootPath:i,storagePath:e.storagePath});try{await e.populate(o),await o.captureState(),await mkdir(dirname(r),{recursive:!0});try{await rename(i,r),a=!0}catch(e){if(await pathExists(r))return{templateKey:n};throw e}}finally{await o.stop(),a||await rm(i,{force:!0,recursive:!0})}return{templateKey:n}},async resume(e,t,n){let{rootPath:r}=requireJustBashSessionState(n);if(!await pathExists(r))throw new SandboxSessionGoneError(`just-bash session root "${r}" no longer exists.`);return await connect(e,r)},async start(e,t,n){let r=requirePreparedJustBashArtifact(n),i=sessionRootPath(e);return await ensureSessionRoot(resolveTemplateRootPath(e.storagePath,r.templateKey),i),{connection:await connect(e,i),state:{rootPath:i,version:2}}},toolSessions:!0}}function sessionRootPath(e){return resolveSessionRootPath(e.storagePath,createSandboxProviderIdentity({sessionId:e.session.id,version:2}).slice(0,24))}async function ensureSessionRoot(e,t){if(!await pathExists(t)){if(!await pathExists(e))throw new SandboxTemplateNotProvisionedError({providerName:JUST_BASH_PROVIDER_NAME,reason:`The template directory does not exist: it was deleted, or the build ran on another machine.`,templateKey:e});await copyDirectoryAtomically(e,t)}}async function pruneJustBashSandboxTemplates(e){let t=resolveLocalProviderTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot),JUST_BASH_CACHE_DIRECTORY_NAME),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a;try{a=await readdir(t,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}let o=await Promise.all(a.filter(e=>e.isDirectory()).map(async e=>{let n=join(t,e.name);return{isTemporary:e.name.endsWith(`.tmp`),mtimeMs:(await stat(n)).mtimeMs,path:n}})),s=selectStaleTemplateEntries(o.filter(e=>!e.isTemporary),{now:n,recentWindowMs:r,retainCount:i}),c=selectStaleTemplateEntries(o.filter(e=>e.isTemporary),{now:n,recentWindowMs:r,retainCount:0});await Promise.all([...s,...c].map(async e=>await rm(e.path,{force:!0,recursive:!0})))}function requirePreparedJustBashArtifact(e){if(!isObject(e)||typeof e.templateKey!=`string`)throw invalidPreparedSandboxArtifactError(`just-bash sandbox`);return{templateKey:e.templateKey}}function requireJustBashSessionState(e){if(!isObject(e)||e.version!==2||typeof e.rootPath!=`string`)throw invalidSandboxSessionStateError(`just-bash sandbox`);return{rootPath:e.rootPath,version:2}}function resolveTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}function resolveSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,JUST_BASH_CACHE_DIRECTORY_NAME,t)}export{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates};

package/dist/src/execution/sandbox/bindings/local-provider-utils.d.ts

@@ -1,26 +1,6 @@
-interface SandboxSeedFile {
-    readonly content: string | Uint8Array;
-    readonly path: string;
-}
-import type { InternalSandboxSession, SandboxProcess, SandboxRemovePathOptions, SandboxSession, SandboxSpawnOptions } from "#shared/sandbox-session.js";
-interface FileBackedSandbox {
-    readFileBytes(path: string): Promise<Buffer | null>;
-    removePath(options: SandboxRemovePathOptions): Promise<void>;
-    spawn(options: SandboxSpawnOptions): Promise<SandboxProcess>;
-    writeFiles(files: ReadonlyArray<{
-        readonly path: string;
-        readonly content: Uint8Array;
-    }>): Promise<void>;
-}
-export declare function createFileBackedInternalSandboxSession(input: {
-    readonly sandbox: FileBackedSandbox;
-}): InternalSandboxSession;
-export declare function resolveWorkspacePath(path: string): string;
 export declare function pathExists(path: string): Promise<boolean>;
 export declare function copyDirectoryAtomically(sourcePath: string, targetPath: string): Promise<void>;
 export declare function touchDirectory(path: string): Promise<void>;
 export declare function resolveLocalProviderTemplateRootPath(cacheDirectory: string, providerCacheName: string, templateKey: string): string;
 export declare function resolveLocalProviderTemplatesDirectory(cacheDirectory: string, providerCacheName: string): string;
 export declare function resolveLocalProviderSessionRootPath(cacheDirectory: string, providerCacheName: string, sessionKey: string): string;
-export declare function writeSandboxSeedFiles(session: SandboxSession, seedFiles: ReadonlyArray<SandboxSeedFile>): Promise<void>;
-export {};

package/dist/src/execution/sandbox/bindings/local-provider-utils.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{dirname,join}from"node:path";import{bufferToStream,streamToBuffer}from"#execution/sandbox/stream-utils.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{resolveSandboxModelPath}from"#shared/skill-paths.js";function createFileBackedInternalSandboxSession(e){return{resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath(t){await e.sandbox.removePath(t)},async writeFile(t){let n=await streamToBuffer(t.content);await e.sandbox.writeFiles([{content:n,path:t.path}])}}}function resolveWorkspacePath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(e,t){let n=`${t}.${randomUUID()}.tmp`;await rm(n,{force:!0,recursive:!0}),await mkdir(dirname(t),{recursive:!0});try{await cp(e,n,{recursive:!0}),await rename(n,t)}catch(e){if(await rm(n,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(t))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalProviderTemplateRootPath(e,t,n){return join(resolveLocalProviderTemplatesDirectory(e,t),n)}function resolveLocalProviderTemplatesDirectory(e,t){return join(e,t,`templates`)}function resolveLocalProviderSessionRootPath(e,t,n){return join(e,t,`sessions`,n)}async function writeSandboxSeedFiles(e,t){for(let n of t){let t=await resolveSandboxModelPath({path:n.path,sandbox:e});typeof n.content==`string`?await e.writeTextFile({content:n.content,path:t}):await e.writeBinaryFile({content:n.content,path:t})}}export{copyDirectoryAtomically,createFileBackedInternalSandboxSession,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,resolveWorkspacePath,touchDirectory,writeSandboxSeedFiles};
+import{randomUUID}from"node:crypto";import{access,cp,mkdir,rename,rm,utimes}from"node:fs/promises";import{dirname,join}from"node:path";async function pathExists(e){try{return await access(e),!0}catch{return!1}}async function copyDirectoryAtomically(e,t){let n=`${t}.${randomUUID()}.tmp`;await rm(n,{force:!0,recursive:!0}),await mkdir(dirname(t),{recursive:!0});try{await cp(e,n,{recursive:!0,verbatimSymlinks:!0}),await rename(n,t)}catch(e){if(await rm(n,{force:!0,recursive:!0}).catch(()=>{}),await pathExists(t))return;throw e}}async function touchDirectory(e){let t=new Date;await utimes(e,t,t)}function resolveLocalProviderTemplateRootPath(e,t,n){return join(resolveLocalProviderTemplatesDirectory(e,t),n)}function resolveLocalProviderTemplatesDirectory(e,t){return join(e,t,`templates`)}function resolveLocalProviderSessionRootPath(e,t,n){return join(e,t,`sessions`,n)}export{copyDirectoryAtomically,pathExists,resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory,touchDirectory};

package/dist/src/execution/sandbox/bindings/local.d.ts

@@ -1,15 +1,13 @@
 export { createDockerSandboxProvider, DOCKER_PROVIDER_NAME, pruneDockerSandboxTemplates, } from "#execution/sandbox/bindings/docker.js";
 export { isLinuxDockerDaemonAvailableSync } from "#execution/sandbox/bindings/docker-cli.js";
 export { createJustBashSandboxProvider, JUST_BASH_PROVIDER_NAME, pruneJustBashSandboxTemplates, } from "#execution/sandbox/bindings/just-bash.js";
-export { createMicrosandboxSandboxProvider, MICROSANDBOX_PROVIDER_NAME, pruneMicrosandboxTemplates, } from "#execution/sandbox/bindings/microsandbox.js";
-export { isMicrosandboxPlatformSupported } from "#execution/sandbox/bindings/microsandbox-platform.js";
 export { stopDevelopmentSandboxResources } from "#execution/sandbox/development-cleanup.js";
 /**
  * Removes stale local sandbox template state for one application
- * across every local engine: just-bash template directories, Docker
- * template images (tracked through per-app marker files), and
- * microsandbox template snapshots. Docker pruning silently skips when
- * no Docker runtime is reachable so docker-less setups stay quiet.
+ * across every local engine: just-bash template directories and Docker
+ * template images (tracked through per-app marker files). Docker pruning
+ * silently skips when no Docker runtime is reachable so docker-less setups
+ * stay quiet.
  */
 export declare function pruneLocalSandboxTemplates(input: {
     readonly appRoot: string;

package/dist/src/execution/sandbox/bindings/local.js

@@ -1 +1 @@
-import{DockerDaemonUnavailableError,DockerUnavailableError,isLinuxDockerDaemonAvailableSync}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_PROVIDER_NAME,createDockerSandboxProvider,pruneDockerSandboxTemplates,pruneDockerSandboxTemplates as pruneDockerSandboxTemplates$1}from"#execution/sandbox/bindings/docker.js";import{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates,pruneJustBashSandboxTemplates as pruneJustBashSandboxTemplates$1}from"#execution/sandbox/bindings/just-bash.js";import{MICROSANDBOX_PROVIDER_NAME,createMicrosandboxSandboxProvider,pruneMicrosandboxTemplates,pruneMicrosandboxTemplates as pruneMicrosandboxTemplates$1}from"#execution/sandbox/bindings/microsandbox.js";import{isMicrosandboxPlatformSupported}from"#execution/sandbox/bindings/microsandbox-platform.js";import{stopDevelopmentSandboxResources}from"#execution/sandbox/development-cleanup.js";async function pruneLocalSandboxTemplates(e){await Promise.all([pruneJustBashSandboxTemplates$1(e),pruneMicrosandboxTemplates$1(e),pruneDockerSandboxTemplates$1(e).catch(e=>{if(!(e instanceof DockerUnavailableError||e instanceof DockerDaemonUnavailableError))throw e})])}function pruneLocalSandboxTemplatesInBackground(e){pruneLocalSandboxTemplates({appRoot:e}).catch(e=>{console.warn(`[eve:sandbox] failed to prune stale local templates: ${errorMessage(e)}`)})}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{DOCKER_PROVIDER_NAME,JUST_BASH_PROVIDER_NAME,MICROSANDBOX_PROVIDER_NAME,createDockerSandboxProvider,createJustBashSandboxProvider,createMicrosandboxSandboxProvider,isLinuxDockerDaemonAvailableSync,isMicrosandboxPlatformSupported,pruneDockerSandboxTemplates,pruneJustBashSandboxTemplates,pruneLocalSandboxTemplates,pruneLocalSandboxTemplatesInBackground,pruneMicrosandboxTemplates,stopDevelopmentSandboxResources};
+import{DockerDaemonUnavailableError,DockerUnavailableError,isLinuxDockerDaemonAvailableSync}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_PROVIDER_NAME,createDockerSandboxProvider,pruneDockerSandboxTemplates,pruneDockerSandboxTemplates as pruneDockerSandboxTemplates$1}from"#execution/sandbox/bindings/docker.js";import{JUST_BASH_PROVIDER_NAME,createJustBashSandboxProvider,pruneJustBashSandboxTemplates,pruneJustBashSandboxTemplates as pruneJustBashSandboxTemplates$1}from"#execution/sandbox/bindings/just-bash.js";import{stopDevelopmentSandboxResources}from"#execution/sandbox/development-cleanup.js";async function pruneLocalSandboxTemplates(e){await Promise.all([pruneJustBashSandboxTemplates$1(e),pruneDockerSandboxTemplates$1(e).catch(e=>{if(!(e instanceof DockerUnavailableError||e instanceof DockerDaemonUnavailableError))throw e})])}function pruneLocalSandboxTemplatesInBackground(e){pruneLocalSandboxTemplates({appRoot:e}).catch(e=>{console.warn(`[eve:sandbox] failed to prune stale local templates: ${errorMessage(e)}`)})}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{DOCKER_PROVIDER_NAME,JUST_BASH_PROVIDER_NAME,createDockerSandboxProvider,createJustBashSandboxProvider,isLinuxDockerDaemonAvailableSync,pruneDockerSandboxTemplates,pruneJustBashSandboxTemplates,pruneLocalSandboxTemplates,pruneLocalSandboxTemplatesInBackground,stopDevelopmentSandboxResources};

package/dist/src/execution/sandbox/bindings/vercel-base-runtime.d.ts

@@ -8,3 +8,5 @@ export declare function ensureVercelSandboxBaseRuntime(sandbox: VercelSandbox):
 export declare function applyInitialVercelNetworkPolicy(sandbox: VercelSandbox, networkPolicy: VercelCreateOptions["networkPolicy"]): Promise<void>;
 export declare function withBaseSetupNetworkPolicy(createOptions: VercelSandboxCreateParams): VercelSandboxCreateParams;
 export declare function createVercelNetworkPolicySetter(sandbox: VercelSandbox): (policy: SandboxNetworkPolicy) => Promise<void>;
+/** eve's policy is the SDK's shape with readonly members, and the SDK never mutates it. */
+export declare function toVercelNetworkPolicy(policy: SandboxNetworkPolicy): NonNullable<VercelCreateOptions["networkPolicy"]>;

package/dist/src/execution/sandbox/bindings/vercel-base-runtime.js

@@ -1,3 +1,3 @@
-import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";async function ensureVercelSandboxBaseRuntime(e){await runSandboxInitializationStep(e,{failureMessage:`Failed to initialize Vercel sandbox base runtime.`,script:buildDockerBaseSetupScript()})}async function applyInitialVercelNetworkPolicy(e,t){t!==void 0&&await e.update({networkPolicy:t})}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:t})}}async function runSandboxInitializationStep(e,t){let n=await runInitializationCommand(e,t.script);if(n===null)return;let r=await runInitializationCommandWithSudo(e,t.script);if(r===null)return;let i=[n,r].filter(Boolean).join(`
+import{buildDockerBaseSetupScript}from"#execution/sandbox/bindings/docker-base-setup.js";async function ensureVercelSandboxBaseRuntime(e){await runSandboxInitializationStep(e,{failureMessage:`Failed to initialize Vercel sandbox base runtime.`,script:buildDockerBaseSetupScript()})}async function applyInitialVercelNetworkPolicy(e,t){t!==void 0&&await e.update({networkPolicy:t})}function withBaseSetupNetworkPolicy(e){return{...e,networkPolicy:`allow-all`}}function createVercelNetworkPolicySetter(e){return async t=>{await e.update({networkPolicy:toVercelNetworkPolicy(t)})}}function toVercelNetworkPolicy(e){return e}async function runSandboxInitializationStep(e,t){let n=await runInitializationCommand(e,t.script);if(n===null)return;let r=await runInitializationCommandWithSudo(e,t.script);if(r===null)return;let i=[n,r].filter(Boolean).join(`
 `);throw Error(`${t.failureMessage}${i?`\n${i}`:``}`)}async function runInitializationCommand(e,t){return await readInitializationFailure(await e.runCommand({args:[`-lc`,t],cmd:`bash`}))}async function runInitializationCommandWithSudo(e,t){return await readInitializationFailure(await e.runCommand({args:[`-n`,`bash`,`-lc`,t],cmd:`sudo`}))}async function readInitializationFailure(e){if(e.exitCode===0)return null;let t=await e.stdout(),n=await e.stderr();return[t.trim(),n.trim()].filter(Boolean).join(`
-`)}export{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy};
+`)}export{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,toVercelNetworkPolicy,withBaseSetupNetworkPolicy};

package/dist/src/execution/sandbox/bindings/vercel-errors.js

@@ -1,2 +1,2 @@
-function isVercelSnapshotUnavailableError(e){return errorChainContainsStatus(e,410)}function isVercelSnapshotNotFoundError(e){for(let t of walkErrorChain(e))if(readErrorStatus(t)===410&&isRecord(t)&&(isRecord(t.json)&&isRecord(t.json.error)?t.json.error:void 0)?.code===`snapshot_not_found`)return!0;return!1}function isVercelSandboxNameConflictError(e){for(let t of walkErrorChain(e)){let e=readErrorStatus(t);if(e===409||e===400&&/\bsandbox with the name\b.*\balready exists\b/is.test(readErrorText(t)))return!0}return!1}function readErrorText(e){if(!isRecord(e))return``;let t=[];typeof e.message==`string`&&t.push(e.message),typeof e.text==`string`&&t.push(e.text);let n=isRecord(e.json)&&isRecord(e.json.error)?e.json.error:void 0;return n!==void 0&&typeof n.message==`string`&&t.push(n.message),t.join(`
-`)}function isVercelSandboxMissingError(e){return errorChainContainsStatus(e,404)}function errorChainContainsStatus(e,t){for(let n of walkErrorChain(e))if(readErrorStatus(n)===t)return!0;return!1}function readErrorStatus(e){if(isRecord(e))return typeof e.status==`number`?e.status:typeof e.statusCode==`number`?e.statusCode:isRecord(e.response)&&typeof e.response.status==`number`?e.response.status:void 0}function*walkErrorChain(e){let t=e,n=new Set;for(;t!=null&&!n.has(t);)n.add(t),yield t,t=isRecord(t)?t.cause:void 0}function isRecord(e){return typeof e==`object`&&!!e}export{isVercelSandboxMissingError,isVercelSandboxNameConflictError,isVercelSnapshotNotFoundError,isVercelSnapshotUnavailableError};
+import{isObject}from"#shared/guards.js";function isVercelSnapshotUnavailableError(e){return errorChainContainsStatus(e,410)}function isVercelSnapshotNotFoundError(e){for(let t of walkErrorChain(e))if(readErrorStatus(t)===410&&isObject(t)&&(isObject(t.json)&&isObject(t.json.error)?t.json.error:void 0)?.code===`snapshot_not_found`)return!0;return!1}function isVercelSandboxNameConflictError(e){for(let t of walkErrorChain(e)){let e=readErrorStatus(t);if(e===409||e===400&&/\bsandbox with the name\b.*\balready exists\b/is.test(readErrorText(t)))return!0}return!1}function readErrorText(e){if(!isObject(e))return``;let t=[];typeof e.message==`string`&&t.push(e.message),typeof e.text==`string`&&t.push(e.text);let n=isObject(e.json)&&isObject(e.json.error)?e.json.error:void 0;return n!==void 0&&typeof n.message==`string`&&t.push(n.message),t.join(`
+`)}function isVercelSandboxMissingError(e){return errorChainContainsStatus(e,404)}function errorChainContainsStatus(e,t){for(let n of walkErrorChain(e))if(readErrorStatus(n)===t)return!0;return!1}function readErrorStatus(e){if(isObject(e))return typeof e.status==`number`?e.status:typeof e.statusCode==`number`?e.statusCode:isObject(e.response)&&typeof e.response.status==`number`?e.response.status:void 0}function*walkErrorChain(e){let t=e,n=new Set;for(;t!=null&&!n.has(t);)n.add(t),yield t,t=isObject(t)?t.cause:void 0}export{isVercelSandboxMissingError,isVercelSandboxNameConflictError,isVercelSnapshotNotFoundError,isVercelSnapshotUnavailableError};

package/dist/src/execution/sandbox/bindings/vercel-lifecycle.d.ts

@@ -1,13 +1,15 @@
 import type { VercelCreateOptions, VercelModule, VercelSandbox } from "#execution/sandbox/bindings/vercel-sdk-types.js";
-export declare function deleteVercelSandbox(input: {
+/** Deletes the sandbox with this name, if there is one. */
+export declare function deleteNamedVercelSandbox(input: {
     readonly createOptions: VercelCreateOptions;
-    readonly loadDeleteSandboxModule: () => Promise<VercelModule>;
-    readonly sandbox: VercelSandbox;
+    readonly sandboxModule: VercelModule;
+    readonly sandboxName: string;
     readonly signal?: AbortSignal;
 }): Promise<void>;
+/** Deletes a sandbox that can no longer resume, without stopping it first. */
 export declare function deleteUnusableVercelSandbox(input: {
     readonly createOptions: VercelCreateOptions;
-    readonly loadDeleteSandboxModule: () => Promise<VercelModule>;
-    readonly sandbox: VercelSandbox;
+    readonly sandboxModule: VercelModule;
+    readonly sandboxName: string;
 }): Promise<void>;
 export declare function stopVercelSandbox(sandbox: VercelSandbox): Promise<void>;

package/dist/src/execution/sandbox/bindings/vercel-lifecycle.js

@@ -1 +1 @@
-import{getVercelSandboxFetch,resolveVercelSandboxCredentials}from"#execution/sandbox/bindings/vercel-credentials.js";async function deleteVercelSandbox(e){await stopVercelSandbox(e.sandbox),await deleteVercelSandboxRecord(e)}async function deleteUnusableVercelSandbox(e){await deleteVercelSandboxRecord(e)}async function deleteVercelSandboxRecord(e){let t=await resolveVercelSandboxCredentials(e.createOptions);await(await(await e.loadDeleteSandboxModule()).Sandbox.get({...t,fetch:getVercelSandboxFetch(e.createOptions),name:e.sandbox.name,resume:!1,signal:e.signal})).delete({deleteOrphanSnapshots:!0,signal:e.signal})}async function stopVercelSandbox(e){(e.status===`running`||e.status===`pending`)&&await e.stop()}export{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox};
+import{getVercelSandboxFetch,resolveVercelSandboxCredentials}from"#execution/sandbox/bindings/vercel-credentials.js";import{isVercelSandboxMissingError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox}from"#execution/sandbox/bindings/vercel-lookup.js";async function deleteNamedVercelSandbox(e){let t=await getNamedVercelSandbox({createOptions:e.signal===void 0?e.createOptions:{...e.createOptions,signal:e.signal},sandboxModule:e.sandboxModule,sandboxName:e.sandboxName});if(t!==null)try{await stopVercelSandbox(t),await t.delete({deleteOrphanSnapshots:!0,signal:e.signal})}catch(e){if(!isVercelSandboxMissingError(e))throw e}}async function deleteUnusableVercelSandbox(e){await(await e.sandboxModule.Sandbox.get({...await resolveVercelSandboxCredentials(e.createOptions),fetch:getVercelSandboxFetch(e.createOptions),name:e.sandboxName,resume:!1})).delete({deleteOrphanSnapshots:!0})}async function stopVercelSandbox(e){(e.status===`running`||e.status===`pending`)&&await e.stop()}export{deleteNamedVercelSandbox,deleteUnusableVercelSandbox,stopVercelSandbox};

package/dist/src/execution/sandbox/bindings/vercel.d.ts

@@ -1,7 +1,6 @@
-import type { VercelSandboxSession } from "#public/sandbox/vercel.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
-import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
+import { type SandboxProviderImplementation } from "#public/sandbox/provider.js";
 import type { VercelSandboxRuntimeOptions } from "#public/sandbox/vercel-sandbox.js";
+import type { VercelSandboxSession } from "#public/sandbox/vercel.js";
 import { type CreateVercelSandbox } from "#execution/sandbox/bindings/vercel-create-sdk.js";
 import type { VercelCreateOptions, VercelModule } from "#execution/sandbox/bindings/vercel-sdk-types.js";
 export type VercelSandboxPreparedArtifact = {
@@ -11,17 +10,12 @@ export type VercelSandboxSessionState = {
     readonly sandboxName: string;
     readonly version: 3;
 };
-type VercelEnvironmentOptions = VercelCreateOptions & {
-    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
-};
-export declare function createVercelSandboxProvider(environmentOptions: Readonly<VercelEnvironmentOptions> | undefined): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, VercelSandboxSession>;
+/** Capabilities a Vercel connection adds to the session. */
+export type VercelSandboxExtensions = Pick<VercelSandboxSession, "name" | "setNetworkPolicy">;
 interface CreateVercelSandboxInput {
     readonly createSandbox?: CreateVercelSandbox;
     readonly createOptions?: VercelCreateOptions;
-    readonly loadDeleteSandboxModule?: () => Promise<VercelModule>;
     readonly loadSandboxModule?: () => Promise<VercelModule>;
-    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
-    readonly skipEmptyPreparation?: boolean;
 }
-export declare function createVercelSandbox(input?: CreateVercelSandboxInput): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, VercelSandboxSession>;
+export declare function createVercelSandbox(input?: CreateVercelSandboxInput): SandboxProviderImplementation<VercelSandboxRuntimeOptions, VercelSandboxPreparedArtifact, VercelSandboxSessionState, VercelSandboxExtensions>;
 export {};

package/dist/src/execution/sandbox/bindings/vercel.js

@@ -1,2 +1 @@
-import{randomBytes}from"node:crypto";import{isToolSessionId}from"#execution/tool-session/id.js";import{withToolSessionSandboxes}from"#execution/tool-session/sandbox.js";import{streamToBuffer}from"#execution/sandbox/stream-utils.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{SANDBOX_AGENT_ENV,buildSandboxSession}from"#execution/sandbox/session.js";import{VERCEL_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{resolveSandboxModelPath}from"#shared/skill-paths.js";import{isVercelSandboxMissingError,isVercelSandboxNameConflictError,isVercelSnapshotNotFoundError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags}from"#execution/sandbox/bindings/vercel-options.js";import{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{withToolSessionRetention}from"#execution/sandbox/bindings/vercel-tool-sessions.js";import{getNamedVercelSandbox,isVercelSnapshotCreated}from"#execution/sandbox/bindings/vercel-lookup.js";import{deleteUnusableVercelSandbox,deleteVercelSandbox,stopVercelSandbox}from"#execution/sandbox/bindings/vercel-lifecycle.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";function createVercelSandboxProvider(e){let{prepare:t,...n}=e??{};return createVercelSandbox({createOptions:n,prepare:t})}function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n=e.loadDeleteSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),r={...e.createOptions,timeout:e.createOptions?.timeout??DEFAULT_SANDBOX_TIMEOUT_MS},i=e.createSandbox??createVercelEveImageSandbox;async function openSession(e,a,o,s){let c=requirePreparedVercelTemplate(o),{mounts:l,...u}=a??{},d=isToolSessionId(e.session.id),f={...r,...u},p=d?withToolSessionRetention(f):f,m=resolveVercelSandboxTags(p.tags,{sessionId:e.session.id}),h=await t(),g={createOptions:p,createSandbox:i,resolveSessionCreateOptions:l===void 0?void 0:async()=>({mounts:l}),sandboxModule:h,sessionKey:s,snapshotId:c.snapshotId,tags:m},_;try{if(_=await ensureSession(g),_=await ensureUsableSession({expired:d?isVercelSnapshotNotFoundError:isVercelSnapshotUnavailableError,input:g,loadDeleteSandboxModule:n,session:_}),_.created&&c.snapshotId===void 0&&u.networkPolicy!==void 0)try{await applyInitialVercelNetworkPolicy(_.sandbox,u.networkPolicy)}catch(t){try{await deleteVercelSandbox({createOptions:p,loadDeleteSandboxModule:n,sandbox:_.sandbox})}catch(n){throw AggregateError([t,n],`Failed to apply network policy and discard Vercel sandbox session "${e.session.id}".`,{cause:t})}throw t}}catch(t){throw isVercelSnapshotUnavailableError(t)&&c.snapshotId!==void 0?new SandboxTemplateNotProvisionedError({providerName:`vercel`,templateKey:c.snapshotId}):Error(`Failed to open Vercel sandbox session "${e.session.id}": ${errorMessage(t)}`,{cause:t})}return createHandle({createOptions:p,loadDeleteSandboxModule:n,sandbox:_.sandbox})}return withToolSessionSandboxes({async prepare(n){let a=providerResourceTargetFiles(n.resources);if(e.skipEmptyPreparation===!0&&e.prepare===void 0&&a.length===0)return{};let o=`eve-sbx-tpl-vercel-${createSandboxProviderIdentity({createOptions:vercelIdentityOptions(r),resolvedImage:r.source===void 0?r.image??VERCEL_EVE_SANDBOX_IMAGE:void 0,resources:sandboxProviderResourceIdentity(n.resources),sourceRevision:n.sourceRevision,version:3}).slice(0,32)}`;try{return{snapshotId:await ensureTemplate({createOptions:r,createSandbox:i,loadSandboxModule:t,log:n.log,prepareSandbox:e.prepare,seedFiles:a,templateKey:o})}}catch(e){throw Error(`Failed to prepare Vercel sandbox snapshot: ${errorMessage(e)}`,{cause:e})}},async resume(e,i,a){requirePreparedVercelTemplate(i);let o=requireVercelSessionState(a),s=await t(),c=await getNamedVercelSandbox({createOptions:r,sandboxModule:s,sandboxName:o.sandboxName});if(c===null)throw Error(`Vercel sandbox session "${o.sandboxName}" no longer exists.`);return await ensureVercelSandboxBaseRuntime(c),createHandle({createOptions:r,loadDeleteSandboxModule:n,sandbox:c})},async start(e,t,n){let i=vercelSessionName(e.session.id,t,n,r);return{handle:await openSession(e,t,n,i),state:{sandboxName:i,version:3}}}})}function vercelSessionName(e,t,n,r){let i=requirePreparedVercelTemplate(n);return`eve-sbx-vercel-${createSandboxProviderIdentity({artifact:i,createOptions:vercelIdentityOptions(r),options:vercelIdentityOptions(t),sessionId:e,version:1}).slice(0,32)}`}function vercelIdentityOptions(e){if(e===void 0)return;let t=new Set([`fetch`,`projectId`,`signal`,`teamId`,`token`]);return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function requireVercelSessionState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==3||typeof e.sandboxName!=`string`)throw Error(`Invalid Vercel sandbox session state.`);return{sandboxName:e.sandboxName,version:3}}function requirePreparedVercelTemplate(e){if(!isSandboxPreparedArtifactRecord(e)||e.snapshotId!==void 0&&typeof e.snapshotId!=`string`)throw Error(`Invalid prepared Vercel sandbox artifact.`);return e.snapshotId===void 0?{}:{snapshotId:e.snapshotId}}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),r=n?.sourceSnapshotId;if(r!==void 0&&await isVercelSnapshotCreated({createOptions:e.createOptions,sandboxModule:t,snapshotId:r}))return e.log?.(`reusing prepared sandbox template`),r;let i=await prepareTemplateSnapshot(e,t);return await publishTemplatePointer(e,t,n,i).catch(t=>{e.log?.(`could not publish sandbox template: ${errorMessage(t)}`)}),i}async function prepareTemplateSnapshot(e,t){let n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:`${e.templateKey}-${randomBytes(4).toString(`hex`)}`,persistent:!1})});try{e.log?.(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy);let t=buildSandboxSession(createVercelInternalSandboxSession(n,e.createOptions.env),createVercelNetworkPolicySetter(n));return await writeVercelSandboxSeedFiles({sandbox:n,seedFiles:e.seedFiles,session:t}),e.log?.(`running sandbox preparation`),await e.prepareSandbox?.(createLoggingSandboxSession({log:e.log,session:t})),(await n.snapshot()).snapshotId}finally{await n.delete().catch(t=>{e.log?.(`could not delete sandbox ${n.name}: ${errorMessage(t)}`)})}}async function publishTemplatePointer(e,t,n,r){if(n!==null)try{await n.delete()}catch(e){if(!isVercelSandboxMissingError(e))throw e}let{image:i,runtime:a,source:o,...s}=e.createOptions,c;try{c=await e.createSandbox({sandboxModule:t,createOptions:{...s,name:e.templateKey,persistent:!1,source:{snapshotId:r,type:`snapshot`}}})}catch(e){if(isVercelSandboxNameConflictError(e))return;throw e}await stopVercelSandbox(c)}async function ensureUsableSession(e){try{return await ensureVercelSandboxBaseRuntime(e.session.sandbox),e.session}catch(t){if(e.session.created||!e.expired(t))throw t}try{await deleteUnusableVercelSandbox({createOptions:e.input.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:e.session.sandbox})}catch(e){if(!isVercelSandboxMissingError(e))throw e}let t=await ensureSession(e.input);return await ensureVercelSandboxBaseRuntime(t.sandbox),t}async function ensureSession(e){let t=e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t,await e.resolveSessionCreateOptions?.());e.tags!==void 0&&(r.tags=e.tags);try{return{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}catch(n){if(!isVercelSandboxNameConflictError(n))throw n;let r=await getNamedVercelSandbox({...e,sandboxName:t});if(r===null)throw n;return{created:!1,sandbox:r}}}function createSessionCreateParams(e,t,n={}){let r={...e.createOptions,...n};if(e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...r,name:t,persistent:!0});let{image:i,runtime:a,source:o,...s}=r;return{...s,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function createHandle(e){let{sandbox:t}=e;return{sandbox:{...buildSandboxSession(createVercelInternalSandboxSession(t,e.createOptions.env),createVercelNetworkPolicySetter(t)),name:t.name},async onSandboxDelete(n){await deleteVercelSandbox({createOptions:e.createOptions,loadDeleteSandboxModule:e.loadDeleteSandboxModule,sandbox:t,signal:n?.abortSignal})},async onSandboxStop(){await stopVercelSandbox(t)},async onRuntimeShutdown(){try{await stopVercelSandbox(t)}catch{}}}}function createVercelInternalSandboxSession(e,t){let n={...SANDBOX_AGENT_ENV,...t};return{resolvePath:resolveVercelSandboxPath,async spawn(t){let r=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:{...n,...t.env},signal:t.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:r,getOutput:e=>e.stream})},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async writeFile(t){let n=await streamToBuffer(t.content),r=await resolveVercelWritePath(e,t.path,t.abortSignal);await e.writeFiles([{content:n,path:r}],{signal:t.abortSignal})},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(e){if(e.seedFiles.length===0)return;let t=await Promise.all(e.seedFiles.map(async t=>({content:typeof t.content==`string`?Buffer.from(t.content):t.content,path:await resolveSandboxModelPath({path:t.path,sandbox:e.session})})));await e.sandbox.writeFiles(t)}function resolveVercelSandboxPath(e){return e.startsWith(`/`)?e:`${WORKSPACE_ROOT}/${e}`}async function resolveVercelWritePath(e,t,n){let r=await e.runCommand({args:[`-m`,`--`,t],cmd:`realpath`,signal:n}),i=(await r.stdout()).trim();if(r.exitCode!==0||!i.startsWith(`/`)||i.includes(`
-`))throw Error(`Failed to resolve Vercel Sandbox write path: ${t}`);return i}const DEFAULT_SANDBOX_TIMEOUT_MS=18e5;export{createVercelSandbox,createVercelSandboxProvider};
+import{randomBytes}from"node:crypto";import{isObject}from"#shared/guards.js";import{SANDBOX_AGENT_ENV,SandboxSessionGoneError,SandboxTemplateNotProvisionedError}from"#public/sandbox/provider.js";import{VERCEL_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{invalidPreparedSandboxArtifactError,invalidSandboxSessionStateError}from"#shared/sandbox-recorded-data-error.js";import{adaptMultiplexedCommandToSandboxProcess}from"#execution/sandbox/multiplexed-command.js";import{isVercelSandboxMissingError,isVercelSandboxNameConflictError,isVercelSnapshotNotFoundError,isVercelSnapshotUnavailableError}from"#execution/sandbox/bindings/vercel-errors.js";import{getNamedVercelSandbox,isVercelSnapshotCreated}from"#execution/sandbox/bindings/vercel-lookup.js";import{ensureVercelSandboxTags,errorMessage,resolveVercelSandboxTags}from"#execution/sandbox/bindings/vercel-options.js";import{applyInitialVercelNetworkPolicy,createVercelNetworkPolicySetter,ensureVercelSandboxBaseRuntime,withBaseSetupNetworkPolicy}from"#execution/sandbox/bindings/vercel-base-runtime.js";import{createVercelEveImageSandbox}from"#execution/sandbox/bindings/vercel-create-sdk.js";import{deleteNamedVercelSandbox,deleteUnusableVercelSandbox,stopVercelSandbox}from"#execution/sandbox/bindings/vercel-lifecycle.js";import{normalizeVercelReadStream}from"#execution/sandbox/bindings/vercel-read-stream.js";import{withToolSessionRetention}from"#execution/sandbox/bindings/vercel-tool-sessions.js";function createVercelSandbox(e={}){let t=e.loadSandboxModule??(async()=>await import(`#compiled/@vercel/sandbox/index.js`)),n={...e.createOptions,env:{...SANDBOX_AGENT_ENV,...e.createOptions?.env},timeout:e.createOptions?.timeout??DEFAULT_SANDBOX_TIMEOUT_MS},r=e.createSandbox??createVercelEveImageSandbox,i=n.source===void 0&&(n.image??VERCEL_EVE_SANDBOX_IMAGE)===VERCEL_EVE_SANDBOX_IMAGE;return{async onSessionEnd(e,r,{abortSignal:i}){await deleteNamedVercelSandbox({createOptions:n,sandboxModule:await t(),sandboxName:r?.sandboxName??vercelSessionName(e.session.id),signal:i})},async prepare(e){if(e.isEmpty&&n.source===void 0)return{};try{let i=`eve-sbx-tpl-vercel-${e.templateKey({createOptions:vercelIdentityOptions(n),resolvedImage:n.source===void 0?n.image??VERCEL_EVE_SANDBOX_IMAGE:void 0,version:4}).slice(0,32)}`;return{snapshotId:await ensureTemplate({context:e,createOptions:n,createSandbox:r,loadSandboxModule:t,templateKey:i})}}catch(e){throw Error(`Failed to prepare Vercel sandbox snapshot: ${errorMessage(e)}`,{cause:e})}},async resume(e,r,i){requirePreparedVercelTemplate(r);let a=requireVercelSessionState(i),o=await t(),s=await getNamedVercelSandbox({createOptions:n,sandboxModule:o,sandboxName:a.sandboxName});if(s===null)throw new SandboxSessionGoneError(`Vercel sandbox session "${a.sandboxName}" no longer exists.`);return await ensureVercelSandboxBaseRuntime(s),createVercelConnection(s)},async start(e,t,n){let r=vercelSessionName(e.session.id);return{connection:createVercelConnection(await openSession(e,t,n,r)),state:{sandboxName:r,version:3}}},toolSessions:!0};async function openSession(e,a,o,s){let c=requirePreparedVercelTemplate(o),{mounts:l,...u}=a??{},d=e.kind===`tool-session`,f={...n,...u,env:{...SANDBOX_AGENT_ENV,...u.env??n.env}},p=d?withToolSessionRetention(f):f,m=resolveVercelSandboxTags(p.tags,{sessionId:e.session.id}),h=await t(),g={createOptions:p,createSandbox:r,mounts:l===void 0?void 0:toVercelMounts(l),sandboxModule:h,sessionKey:s,snapshotId:c.snapshotId,tags:m};try{let t=await ensureUsableSession({expired:d?isVercelSnapshotNotFoundError:isVercelSnapshotUnavailableError,inheritsBaseRuntime:c.snapshotId!==void 0&&l===void 0&&i,input:g,session:await ensureSession(g)}),r=u.networkPolicy??n.networkPolicy;if(t.created&&c.snapshotId===void 0&&r!==void 0)try{await applyInitialVercelNetworkPolicy(t.sandbox,r)}catch(n){try{await deleteNamedVercelSandbox({createOptions:p,sandboxModule:h,sandboxName:t.sandbox.name})}catch(t){throw AggregateError([n,t],`Failed to apply network policy and discard Vercel sandbox session "${e.session.id}".`,{cause:n})}throw n}return t.sandbox}catch(t){throw isVercelSnapshotUnavailableError(t)&&c.snapshotId!==void 0?new SandboxTemplateNotProvisionedError({providerName:`vercel`,reason:`The Vercel Sandbox snapshot expired or was deleted.`,templateKey:c.snapshotId}):Error(`Failed to open Vercel sandbox session "${e.session.id}": ${errorMessage(t)}`,{cause:t})}}}function vercelSessionName(e){return`eve-sbx-vercel-${createSandboxProviderIdentity({sessionId:e,version:2}).slice(0,32)}`}function vercelIdentityOptions(e){if(e===void 0)return;let t=new Set([`fetch`,`projectId`,`signal`,`teamId`,`token`]);return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function requireVercelSessionState(e){if(!isObject(e)||e.version!==3||typeof e.sandboxName!=`string`)throw invalidSandboxSessionStateError(`Vercel sandbox`);return{sandboxName:e.sandboxName,version:3}}function requirePreparedVercelTemplate(e){if(!isObject(e)||e.snapshotId!==void 0&&typeof e.snapshotId!=`string`)throw invalidPreparedSandboxArtifactError(`Vercel sandbox`);return e.snapshotId===void 0?{}:{snapshotId:e.snapshotId}}function toVercelMounts(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,`mode`in t?{drive:t.drive,mode:t.mode}:{drive:t.name,mode:`read-write`}]))}async function ensureTemplate(e){let t=await e.loadSandboxModule(),n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:t,sandboxName:e.templateKey}),r=n?.sourceSnapshotId;if(r!==void 0&&await isVercelSnapshotCreated({createOptions:e.createOptions,sandboxModule:t,snapshotId:r}))return e.context.log(`reusing prepared sandbox template`),r;let i=await prepareTemplateSnapshot(e,t);return await publishTemplatePointer(e,t,n,i).catch(t=>{e.context.log(`could not publish sandbox template: ${errorMessage(t)}`)}),i}async function prepareTemplateSnapshot(e,t){let n=await e.createSandbox({sandboxModule:t,createOptions:withBaseSetupNetworkPolicy({...e.createOptions,name:`${e.templateKey}-${randomBytes(4).toString(`hex`)}`,persistent:!1})});try{return e.context.log(`preparing base runtime inside sandbox`),await ensureVercelSandboxBaseRuntime(n),await applyInitialVercelNetworkPolicy(n,e.createOptions.networkPolicy),await e.context.populate(createVercelConnection(n)),await ensureVercelSandboxBaseRuntime(n),(await n.snapshot()).snapshotId}finally{await n.delete().catch(t=>{e.context.log(`could not delete sandbox ${n.name}: ${errorMessage(t)}`)})}}async function publishTemplatePointer(e,t,n,r){if(n!==null)try{await n.delete()}catch(e){if(!isVercelSandboxMissingError(e))throw e}let{image:i,runtime:a,source:o,...s}=e.createOptions,c;try{c=await e.createSandbox({sandboxModule:t,createOptions:{...s,name:e.templateKey,persistent:!1,source:{snapshotId:r,type:`snapshot`}}})}catch(e){if(isVercelSandboxNameConflictError(e))return;throw e}await stopVercelSandbox(c)}async function ensureUsableSession(e){let ensureBaseRuntime=async t=>{t.created&&e.inheritsBaseRuntime||await ensureVercelSandboxBaseRuntime(t.sandbox)};try{return await ensureBaseRuntime(e.session),e.session}catch(t){if(e.session.created||!e.expired(t))throw t}try{await deleteUnusableVercelSandbox({createOptions:e.input.createOptions,sandboxModule:e.input.sandboxModule,sandboxName:e.session.sandbox.name})}catch(e){if(!isVercelSandboxMissingError(e))throw e}let t=await ensureSession(e.input);return await ensureBaseRuntime(t),t}async function ensureSession(e){let t=e.sessionKey,n=await getNamedVercelSandbox({createOptions:e.createOptions,sandboxModule:e.sandboxModule,sandboxName:t});if(n!==null)return await ensureVercelSandboxTags(n,e.tags),{created:!1,sandbox:n};let r=createSessionCreateParams(e,t);e.tags!==void 0&&(r.tags=e.tags);try{return{created:!0,sandbox:await e.createSandbox({createOptions:r,sandboxModule:e.sandboxModule})}}catch(n){if(!isVercelSandboxNameConflictError(n))throw n;let r=await getNamedVercelSandbox({...e,sandboxName:t});if(r===null)throw n;return{created:!1,sandbox:r}}}function createSessionCreateParams(e,t){let n={...e.createOptions};if(e.mounts!==void 0&&(n.mounts=e.mounts),e.snapshotId===void 0)return withBaseSetupNetworkPolicy({...n,name:t,persistent:!0});let{image:r,runtime:i,source:a,...o}=n;return{...o,name:t,persistent:!0,source:{snapshotId:e.snapshotId,type:`snapshot`}}}function createVercelConnection(e){return{extensions:{name:e.name,setNetworkPolicy:createVercelNetworkPolicySetter(e)},async readFile(t){return normalizeVercelReadStream(await e.readFile({path:t.path}))},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})},async spawn(t){let n=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory,detached:!0,env:t.env,signal:t.abortSignal});return adaptMultiplexedCommandToSandboxProcess({command:n,getOutput:e=>e.stream})},async stop(){await stopVercelSandbox(e)},async writeFiles(t){t.files.length!==0&&await e.writeFiles(await resolveVercelWriteFiles(e,t.files,t.abortSignal),{signal:t.abortSignal})}}}async function resolveVercelWriteFiles(e,t,n){let r=[],i=[],a=0;for(let o of t){let t=Buffer.byteLength(o.path)+1;i.length>0&&a+t>65536&&(r.push(...await resolveVercelPaths(e,i,n)),i=[],a=0),i.push(o.path),a+=t}return r.push(...await resolveVercelPaths(e,i,n)),t.map((e,t)=>{let n=r[t];if(n===void 0||!n.startsWith(`/`))throw Error(`Failed to resolve Vercel Sandbox write path: ${e.path}`);return{content:e.content,path:n}})}async function resolveVercelPaths(e,t,n){let r=await e.runCommand({args:[`-m`,`-z`,`--`,...t],cmd:`realpath`,signal:n});if(r.exitCode!==0){let e=(await r.stderr()).trim();throw Error(`Failed to resolve Vercel Sandbox write paths with realpath: ${e}`)}let i=(await r.stdout()).split(`\0`).slice(0,-1);if(i.length!==t.length)throw Error(`Failed to resolve Vercel Sandbox write paths: realpath printed ${i.length} paths for ${t.length} files.`);return i}const DEFAULT_SANDBOX_TIMEOUT_MS=18e5;export{createVercelSandbox};

package/dist/src/execution/sandbox/development-cleanup.d.ts

@@ -1,5 +1,4 @@
 export declare function stopDevelopmentSandboxResources(input: {
-    readonly appRoot: string;
     readonly devRunId: string;
     readonly log?: (message: string) => void;
 }): Promise<void>;

package/dist/src/execution/sandbox/development-cleanup.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}from"#execution/sandbox/development-run.js";import{toErrorMessage}from"#shared/errors.js";import{DockerUnavailableError,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{DOCKER_SANDBOX_LABEL,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{createProviderName,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,stopAndSnapshotMicrosandboxSandbox}from"#execution/sandbox/bindings/microsandbox-runtime.js";async function stopDevelopmentSandboxResources(e){let t=await Promise.allSettled([stopDevelopmentDockerResources(e.devRunId),stopDevelopmentMicrosandboxResources(e.appRoot,e.devRunId,e.log)]);for(let n of t)n.status===`rejected`&&e.log?.(`failed to stop development sandbox resources: ${toErrorMessage(n.reason)}`)}async function stopDevelopmentDockerResources(e){let t=createDockerCli(),n=[`label=${DOCKER_SANDBOX_LABEL}=1`,`label=${DOCKER_SANDBOX_LABEL}.tag.${EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}=${e}`],r;try{r=await t.run([`ps`,`-q`,...n.flatMap(e=>[`--filter`,e])])}catch(e){if(e instanceof DockerUnavailableError)return;throw e}if(r.exitCode!==0)return;let i=r.stdout.trim().split(/\s+/u).filter(Boolean);await Promise.all(i.map(e=>stopDockerContainerIfRunning(t,e)))}async function stopDevelopmentMicrosandboxResources(e,t,n){let r=await loadMicrosandboxWithoutInstall(e);if(r===null)return;let i=await r.Sandbox.listWith({labels:{"eve.provider":`microsandbox`,[EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG]:t}});await Promise.all(i.filter(e=>e.status===`running`||e.status===`draining`).map(async e=>{let t=getMicrosandboxLabel(e.configJson,EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG);if(t===void 0){await(await r.Sandbox.get(e.name)).stopWithTimeout(1e4).catch(()=>{});return}let i=await readSessionMetadata(t);if(i===null||i.sandboxName!==e.name){await(await r.Sandbox.get(e.name)).stopWithTimeout(1e4).catch(()=>{});return}n?.(`snapshotting development microsandbox session "${e.name}" before shutdown`);let a=i.stateSnapshotName,o=createProviderName(`eve-sbx-state`,`${i.sandboxName}:${randomUUID()}`);await stopAndSnapshotMicrosandboxSandbox(r,e.name,o),await writeSessionMetadata(t,{networkPolicy:i.networkPolicy,optionsHash:i.optionsHash,sandboxName:i.sandboxName,stateSnapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),a!==void 0&&await removeSnapshotIfExists(r,a)}))}function getMicrosandboxLabel(e,t){let n;try{n=JSON.parse(e)}catch{return}return findLabel(n,t)}function findLabel(e,t){if(!isRecord(e))return;let n=e[t];if(typeof n==`string`)return n;let r=e.labels;if(isRecord(r)&&typeof r[t]==`string`)return r[t];if(typeof e.labelsJson==`string`){let n=parseJsonRecord(e.labelsJson);if(n!==null&&typeof n[t]==`string`)return n[t]}for(let n of Object.values(e)){let e=findLabel(n,t);if(e!==void 0)return e}}function parseJsonRecord(e){try{let t=JSON.parse(e);return isRecord(t)?t:null}catch{return null}}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{stopDevelopmentSandboxResources};
+import{EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}from"#execution/sandbox/development-run.js";import{toErrorMessage}from"#shared/errors.js";import{DOCKER_SANDBOX_LABEL,stopDockerContainerIfRunning}from"#execution/sandbox/bindings/docker-container.js";import{DockerUnavailableError,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";async function stopDevelopmentSandboxResources(e){try{await stopDevelopmentDockerResources(e.devRunId)}catch(t){e.log?.(`failed to stop development sandbox resources: ${toErrorMessage(t)}`)}}async function stopDevelopmentDockerResources(e){let t=createDockerCli(),n=[`label=${DOCKER_SANDBOX_LABEL}=1`,`label=${DOCKER_SANDBOX_LABEL}.tag.${EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG}=${e}`],r;try{r=await t.run([`ps`,`-q`,...n.flatMap(e=>[`--filter`,e])])}catch(e){if(e instanceof DockerUnavailableError)return;throw e}if(r.exitCode!==0)return;let i=r.stdout.trim().split(/\s+/u).filter(Boolean);await Promise.all(i.map(e=>stopDockerContainerIfRunning(t,e)))}export{stopDevelopmentSandboxResources};

package/dist/src/execution/sandbox/development-lazy-prewarm.js

@@ -1 +1 @@
-import{prewarmAppSandboxes}from"./prewarm.js";import{randomUUID}from"node:crypto";import{mkdir}from"node:fs/promises";import{join}from"node:path";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{acquireRecoveryLease,startPublicationJournalHeartbeat}from"#internal/application/output-publication-lock.js";import{loadSandboxPreparedArtifact}from"#runtime/sandbox/prepared-artifacts.js";async function ensureDevelopmentSandboxesPrepared(e){if(await loadSandboxPreparedArtifact(e)!==void 0)return;let t=e.compiledArtifactsSource,{compileDirectoryPath:n}=resolveRuntimeCompilerArtifactPaths(t.appRoot),r=join(n,`sandbox-preparation.lock`),i=Date.now()+6e5;await mkdir(n,{recursive:!0});let a=randomUUID(),o;for(;(o=await acquireRecoveryLease(r,a))===void 0;){if(Date.now()>=i)throw Error(`Timed out waiting for development sandbox preparation.`);await new Promise(e=>setTimeout(e,250))}let s=startPublicationJournalHeartbeat(join(r,`lease`));try{if(await loadSandboxPreparedArtifact(e)!==void 0)return;await prewarmAppSandboxes({appRoot:t.sandboxAppRoot??t.appRoot,compiledArtifactsSource:t,log:e=>console.info(e)})}finally{s(),await o.complete()}}export{ensureDevelopmentSandboxesPrepared};
+import{prewarmAppSandboxes}from"./prewarm.js";import{randomUUID}from"node:crypto";import{mkdir}from"node:fs/promises";import{join}from"node:path";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{acquireRecoveryLease,startPublicationJournalHeartbeat}from"#internal/application/output-publication-lock.js";import{loadSandboxPreparedArtifact}from"#runtime/sandbox/prepared-artifacts.js";const PREPARATION_WAIT_TIMEOUT_MS=6e5;async function ensureDevelopmentSandboxesPrepared(e){if(await loadSandboxPreparedArtifact(e)!==void 0)return;let t=e.compiledArtifactsSource,{compileDirectoryPath:n}=resolveRuntimeCompilerArtifactPaths(t.appRoot),r=join(n,`sandbox-preparation.lock`),i=Date.now()+PREPARATION_WAIT_TIMEOUT_MS;await mkdir(n,{recursive:!0});let a=randomUUID(),o;for(;(o=await acquireRecoveryLease(r,a))===void 0;){if(Date.now()>=i)throw Error(`Timed out after ${PREPARATION_WAIT_TIMEOUT_MS/6e4} minutes waiting for another request or eve dev worker to prepare sandbox environments (this request needs provider "${e.providerName}"). Check the eve dev output or run \`eve logs\` to see which step is slow, such as an image pull, a Dockerfile build, or a \`prepare\` callback. Retry after preparation finishes, or restart eve dev to cancel it.`);await new Promise(e=>setTimeout(e,250))}let s=startPublicationJournalHeartbeat(join(r,`lease`));try{if(await loadSandboxPreparedArtifact(e)!==void 0)return;await prewarmAppSandboxes({appRoot:t.sandboxAppRoot??t.appRoot,compiledArtifactsSource:t,log:e=>console.info(e)})}finally{s(),await o.complete()}}export{ensureDevelopmentSandboxesPrepared};

package/dist/src/execution/sandbox/development-run.d.ts

@@ -1,7 +1,5 @@
 export declare const EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV = "EVE_DEVELOPMENT_SANDBOX_RUN_ID";
-export declare const EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG = "eve.metadataPath";
 export declare const EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG = "devRunId";
 export declare function createDevelopmentSandboxRunId(): string;
 export declare function getDevelopmentSandboxRunId(): string | undefined;
 export declare function withDevelopmentSandboxTags(tags: Readonly<Record<string, string>> | undefined): Readonly<Record<string, string>> | undefined;
-export declare function withDevelopmentSandboxMetadataPathTag(tags: Readonly<Record<string, string>> | undefined, metadataPath: string): Readonly<Record<string, string>> | undefined;

package/dist/src/execution/sandbox/development-run.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";const EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV=`EVE_DEVELOPMENT_SANDBOX_RUN_ID`,EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG=`eve.metadataPath`,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG=`devRunId`;function createDevelopmentSandboxRunId(){return randomUUID()}function getDevelopmentSandboxRunId(){let e=process.env[EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV];return e===void 0||e.trim()===``?void 0:e}function withDevelopmentSandboxTags(e){let t=getDevelopmentSandboxRunId();return t===void 0?e:{...e,[EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG]:t}}function withDevelopmentSandboxMetadataPathTag(e,t){return getDevelopmentSandboxRunId()===void 0?e:{...e,[EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG]:t}}export{EVE_DEVELOPMENT_SANDBOX_METADATA_PATH_TAG,EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG,createDevelopmentSandboxRunId,getDevelopmentSandboxRunId,withDevelopmentSandboxMetadataPathTag,withDevelopmentSandboxTags};
+import{randomUUID}from"node:crypto";const EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV=`EVE_DEVELOPMENT_SANDBOX_RUN_ID`,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG=`devRunId`;function createDevelopmentSandboxRunId(){return randomUUID()}function getDevelopmentSandboxRunId(){let e=process.env[EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV];return e===void 0||e.trim()===``?void 0:e}function withDevelopmentSandboxTags(e){let t=getDevelopmentSandboxRunId();return t===void 0?e:{...e,[EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG]:t}}export{EVE_DEVELOPMENT_SANDBOX_RUN_ID_ENV,EVE_DEVELOPMENT_SANDBOX_RUN_ID_TAG,createDevelopmentSandboxRunId,getDevelopmentSandboxRunId,withDevelopmentSandboxTags};

package/dist/src/execution/sandbox/dockerfile.d.ts

@@ -18,7 +18,3 @@ export declare function buildSandboxDockerfile(input: {
     readonly dockerfile: SandboxDockerfile;
     readonly imageReference: string;
 }): Promise<void>;
-export declare function publishDockerImageForMicrosandbox(input: {
-    readonly cli: DockerCli;
-    readonly imageReference: string;
-}): Promise<string>;