hammerkit 1.26.0 → 1.27.0-next.10

package/dist/harness/pi.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hammerkitPiExtension = exports.createPiOperations = void 0;
+const path_1 = require("path");
+const connect_1 = require("./connect");
+const format_1 = require("./format");
+const sandbox_client_1 = require("./sandbox-client");
+const IMAGE_TYPES = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+};
+// a listing is read in pages of this many entries, up to the most a directory answers
+const PAGE = 1000;
+const MAX_ENTRIES = 20000;
+function notFound(path) {
+    return Object.assign(new Error(`ENOENT: no such file or directory, '${path}'`), { code: 'ENOENT' });
+}
+/**
+ * The backends of pi's own tools on a hammerkit sandbox. pi resolves every path against its
+ * working directory (`root`), which stands for the root of the sandbox. The model keeps
+ * pi's tools, their parameters and their output; only where they read, write and run moves.
+ */
+function createPiOperations(client, root) {
+    const path = (absolute) => (0, sandbox_client_1.toSandboxPath)(root, absolute);
+    const stat = async (absolute) => (await client()).stat(path(absolute));
+    const readFile = async (absolute) => (await client()).readRaw(path(absolute));
+    const writeFile = async (absolute, content) => {
+        await (await client()).writeRaw(path(absolute), content);
+    };
+    const accessFile = async (absolute) => {
+        const found = await stat(absolute);
+        if (!found) {
+            throw notFound(absolute);
+        }
+    };
+    const exists = async (absolute) => (await stat(absolute)) !== undefined;
+    const read = {
+        readFile,
+        access: accessFile,
+        detectImageMimeType: async (absolute) => IMAGE_TYPES[(0, path_1.extname)(absolute).toLowerCase()] ?? null,
+    };
+    // a write makes the directories it needs
+    const write = { writeFile, mkdir: async () => undefined };
+    const edit = { readFile, writeFile, access: accessFile };
+    const bash = {
+        exec: async (command, cwd, { onData, signal, timeout }) => {
+            const sandbox = await client();
+            const ran = await sandbox.exec(command, path(cwd), {
+                signal,
+                timeoutSeconds: timeout,
+                onLine: (line) => onData(Buffer.from(`${line}\n`)),
+                onWaiting: (run) => onData(Buffer.from(`hammerkit: run ${run.id} waits for an approval of ${run.accounts.join(', ')}\n`)),
+            });
+            if (signal?.aborted) {
+                throw new Error('aborted');
+            }
+            if (timeout && ran.result?.error?.startsWith('timed out')) {
+                throw new Error(`timeout:${timeout}`);
+            }
+            if (ran.exitCode === null) {
+                // the task never ran or ended without an exit code: say why
+                const why = ran.result?.error ?? ran.run.error ?? `the run ended ${ran.run.state}`;
+                onData(Buffer.from(`hammerkit: ${why}\n`));
+            }
+            return { exitCode: ran.exitCode };
+        },
+    };
+    const ls = {
+        exists,
+        stat: async (absolute) => {
+            const found = await stat(absolute);
+            if (!found) {
+                throw notFound(absolute);
+            }
+            return { isDirectory: () => found.type === 'directory' };
+        },
+        readdir: async (absolute) => {
+            const sandbox = await client();
+            const directory = path(absolute);
+            const names = [];
+            let cursor;
+            do {
+                const page = await sandbox.tree({ path: directory || undefined, depth: 1, limit: PAGE, cursor });
+                names.push(...page.entries.map((entry) => (0, path_1.basename)(entry.path)));
+                cursor = page.cursor ?? undefined;
+            } while (cursor && names.length < MAX_ENTRIES);
+            return names;
+        },
+    };
+    const find = {
+        exists,
+        glob: async (pattern, cwd, { limit }) => {
+            const sandbox = await client();
+            const directory = path(cwd);
+            // as pi's own find (fd): a pattern matches at any depth below the directory
+            const anywhere = pattern === '**' || pattern.startsWith('**/') || pattern.startsWith('/');
+            const page = await sandbox.tree({
+                path: directory || undefined,
+                glob: anywhere ? pattern.replace(/^\/+/, '') : `**/${pattern}`,
+                limit: Math.min(Math.max(limit, 1), MAX_ENTRIES),
+            });
+            return page.entries.map((entry) => (0, path_1.join)(root, ...entry.path.split('/')));
+        },
+    };
+    // pi's grep runs ripgrep on the machine; this one runs it on the server
+    const grep = async (params) => {
+        const sandbox = await client();
+        const result = await sandbox.search({
+            pattern: params.pattern,
+            // pi takes `@src` for `src`, as its own grep does
+            path: params.path ? path(params.path.replace(/^@/, '')) || undefined : undefined,
+            glob: params.glob ? [params.glob] : undefined,
+            i: params.ignoreCase,
+            fixed_strings: params.literal,
+            C: params.context,
+            output_mode: 'content',
+            head_limit: params.limit ?? 100,
+        });
+        return { content: [{ type: 'text', text: (0, format_1.formatSearch)(result) }], details: undefined };
+    };
+    return { read, write, edit, bash, ls, find, grep };
+}
+exports.createPiOperations = createPiOperations;
+/**
+ * The pi extension: pi's read, write, edit, bash, ls, find and grep tools, and the user's
+ * `!` commands, work on a hammerkit sandbox, and `push` takes the work out as a branch. Configured with the same variables as
+ * `hammerkit remote mcp` takes options: HAMMERKIT_SERVER, HAMMERKIT_SANDBOX (or HAMMERKIT_REPO and
+ * HAMMERKIT_REF), HAMMERKIT_BUILD and HAMMERKIT_SHELL.
+ */
+function hammerkitPiExtension(library, settings = {}) {
+    return (pi) => {
+        const root = settings.cwd ?? process.cwd();
+        const environment = settings.environment ?? (0, connect_1.getHarnessEnvironment)(root);
+        const options = settings.options ?? (0, connect_1.harnessOptionsFromEnv)(environment.processEnvs);
+        const notes = [];
+        let connecting;
+        const client = () => {
+            if (!connecting) {
+                connecting = settings.client
+                    ? settings.client()
+                    : (0, connect_1.connectSandbox)(environment, options, (line) => notes.push(line));
+                // a failure is said by the call that needed it, the next one tries again
+                connecting.catch(() => (connecting = undefined));
+            }
+            return connecting;
+        };
+        const ops = createPiOperations(client, root);
+        // pi runs the tool calls of a turn in parallel, they reach the sandbox one at a time in their order
+        const inTurn = (0, sandbox_client_1.oneAtATime)();
+        const register = (tool) => pi.registerTool({ ...tool, execute: (...args) => inTurn(() => tool.execute(...args)) });
+        register(library.createReadToolDefinition(root, { operations: ops.read }));
+        register(library.createWriteToolDefinition(root, { operations: ops.write }));
+        register(library.createEditToolDefinition(root, { operations: ops.edit }));
+        register(library.createBashToolDefinition(root, { operations: ops.bash }));
+        register(library.createLsToolDefinition(root, { operations: ops.ls }));
+        register(library.createFindToolDefinition(root, { operations: ops.find }));
+        const grep = library.createGrepToolDefinition(root);
+        register({ ...grep, execute: (_id, params) => ops.grep(params) });
+        register({
+            name: 'push',
+            label: 'push',
+            description: 'Commit the changes of the hammerkit sandbox and push them to a branch of its repository, for review. ' +
+                'The server pushes only to the branches its operator allows; the sandbox is at the pushed commit afterwards.',
+            promptSnippet: 'Push the changes of the sandbox to a branch',
+            parameters: {
+                type: 'object',
+                properties: {
+                    branch: { type: 'string', description: 'The branch to push to, created when it does not exist' },
+                    message: { type: 'string', description: 'The commit message' },
+                },
+                required: ['branch', 'message'],
+            },
+            execute: async (_id, params) => {
+                const pushed = await (await client()).push(params.branch, params.message);
+                return { content: [{ type: 'text', text: `pushed ${pushed.commit} to ${pushed.branch}` }], details: pushed };
+            },
+        });
+        pi.on('session_start', async (_event, ctx) => {
+            try {
+                const sandbox = await client();
+                ctx?.ui?.setStatus?.('hammerkit', `hammerkit sandbox ${sandbox.id}`);
+                for (const note of notes.splice(0)) {
+                    ctx?.ui?.notify?.(note, 'info');
+                }
+            }
+            catch (e) {
+                ctx?.ui?.notify?.(`hammerkit: ${e instanceof Error ? e.message : String(e)}`, 'error');
+            }
+        });
+        const userBash = { exec: (...args) => inTurn(() => ops.bash.exec(...args)) };
+        pi.on('user_bash', () => ({ operations: userBash }));
+        pi.on('before_agent_start', async (event) => {
+            let sandbox;
+            try {
+                sandbox = await client();
+            }
+            catch {
+                return undefined;
+            }
+            const where = `Files and commands are on hammerkit sandbox ${sandbox.id} of ${sandbox.sandbox.repo} ` +
+                `(fetched at ${sandbox.sandbox.commit}), ${root} stands for its root. Commands run as the task ` +
+                `${sandbox.build.shell} of the published build file ${sandbox.build.hash}, in its container, ` +
+                `one at a time, and start in the root of the sandbox, where ${root} does not exist: give them ` +
+                'relative paths. Nothing is installed on this machine.';
+            const line = `Current working directory: ${root}`;
+            const prompt = event.systemPrompt;
+            return {
+                systemPrompt: prompt.includes(line) ? prompt.replace(line, `${line}\n${where}`) : `${prompt}\n\n${where}`,
+            };
+        });
+    };
+}
+exports.hammerkitPiExtension = hammerkitPiExtension;
+//# sourceMappingURL=pi.js.map

package/dist/harness/sandbox-client.js

@@ -0,0 +1,411 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
+const path_1 = require("path");
+const token_source_1 = require("../remote/token-source");
+// a write carries up to 32 MiB
+const TIMEOUT_MS = 60000;
+// a run is asked for this long at a time, the log is read in between
+const POLL_WAIT = '1s';
+// a cancelled run waits this long for the server to take the cancel, before it gives up
+const CANCEL_WAIT_MS = 10000;
+class SandboxClientError extends Error {
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.SandboxClientError = SandboxClientError;
+/**
+ * A caller's sandbox on a hammerkit server, over its HTTP API: the raw read, write and
+ * stat that harnesses plug their own tools into, the typed endpoints for clients without
+ * tools of their own, and published tasks run on the files. A shell is such a task: the
+ * build file names a task whose last command is `sh -c`, and the command is its argument.
+ */
+class SandboxClient {
+    constructor(connection, sandbox, 
+    // the hash of the published version of the build file whose tasks run on the sandbox, and
+    // its shell task
+    build) {
+        this.connection = connection;
+        this.sandbox = sandbox;
+        this.build = build;
+    }
+    get id() {
+        return this.sandbox.id;
+    }
+    static async create(connection, repo, ref) {
+        return json(await call(connection, 'POST', '/v1/sandboxes', { body: { repo, ref } }));
+    }
+    static async get(connection, id) {
+        return json(await call(connection, 'GET', `/v1/sandboxes/${encodeURIComponent(id)}`));
+    }
+    static async list(connection) {
+        return (await json(await call(connection, 'GET', '/v1/sandboxes'))).sandboxes;
+    }
+    // checks out the ref again, what changed in the sandbox is gone
+    static async fetch(connection, id, ref) {
+        return json(await call(connection, 'POST', `/v1/sandboxes/${encodeURIComponent(id)}/fetch`, { body: { ref } }));
+    }
+    async stat(path) {
+        if (checkSandboxPath(path) === '') {
+            // the root is there as long as the sandbox is
+            return { path: '', type: 'directory', size: 0, exec: false, modifiedAt: new Date(0).toISOString() };
+        }
+        const response = await call(this.connection, 'GET', this.file(path), { query: { stat: '' }, missing: true });
+        return response.status === 404 ? undefined : json(response);
+    }
+    async readRaw(path) {
+        const response = await call(this.connection, 'GET', this.file(path), { query: { raw: '' } });
+        if (response.headers.get('x-hammerkit-type') === 'directory') {
+            throw new SandboxClientError(`${path} is a directory`, 400);
+        }
+        return Buffer.from(await response.arrayBuffer());
+    }
+    async writeRaw(path, content) {
+        return json(await call(this.connection, 'PUT', this.file(path), { raw: content }));
+    }
+    // numbered lines, like `cat -n`
+    async read(path, offset, limit) {
+        return json(await call(this.connection, 'GET', this.file(path), { query: { offset, limit } }));
+    }
+    async tree(query) {
+        return json(await call(this.connection, 'GET', `${this.base()}/tree`, { query: { ...query } }));
+    }
+    async search(query) {
+        return json(await call(this.connection, 'POST', `${this.base()}/search`, { body: query }));
+    }
+    // all or nothing
+    async edit(ops, dryRun = false) {
+        const answer = await call(this.connection, 'POST', `${this.base()}/edits`, { body: { dryRun, ops } });
+        return (await json(answer)).files;
+    }
+    async changes() {
+        return json(await call(this.connection, 'GET', `${this.base()}/changes`));
+    }
+    async diff(format) {
+        return (await call(this.connection, 'GET', `${this.base()}/changes`, { query: { format } })).text();
+    }
+    /**
+     * Commits the changes of the sandbox and pushes them to a branch of its repository, one
+     * the operator lets the caller push to. The sandbox is at the pushed commit then.
+     */
+    async push(branch, message) {
+        const pushed = await json(await call(this.connection, 'POST', `${this.base()}/push`, { body: { branch, message } }));
+        return { branch: pushed.branch, commit: pushed.commit };
+    }
+    async getRun(id) {
+        return json(await call(this.connection, 'GET', `/v1/runs/${encodeURIComponent(id)}`));
+    }
+    // the log of a run: `task`, `tail`, `from`/`limit`, `grep` with `i` and `context`
+    async logs(id, query) {
+        return json(await call(this.connection, 'GET', `/v1/runs/${encodeURIComponent(id)}/logs`, { query: { ...query } }));
+    }
+    /**
+     * Runs a task of the published build file on the sandbox and follows it to its end: the
+     * lines it prints, its result and exit code. A signal cancels the run.
+     */
+    async runTask(task, options = {}) {
+        if (options.signal?.aborted) {
+            // cancelled while it waited for its turn
+            throw new SandboxClientError('the run was cancelled');
+        }
+        const runOptions = {};
+        if (options.args) {
+            runOptions.args = options.args;
+        }
+        if (options.timeoutSeconds) {
+            runOptions.timeout = `${Math.max(1, Math.ceil(options.timeoutSeconds))}s`;
+        }
+        const submitted = await submitRun(this.connection, {
+            definition: this.build.hash,
+            tasks: [task],
+            source: { type: 'sandbox', id: this.id },
+            options: runOptions,
+        });
+        const followed = await followRun(this.connection, submitted, {
+            task,
+            signal: options.signal,
+            onLine: options.onLine ? (line) => options.onLine?.(line.text) : undefined,
+            onWaiting: options.onWaiting,
+        });
+        const result = followed.run.results?.[task];
+        return {
+            run: followed.run,
+            result,
+            output: followed.lines.map((line) => line.text).join('\n'),
+            truncated: followed.truncated,
+            exitCode: exitCodeOf(result),
+        };
+    }
+    /**
+     * A shell command on the sandbox: the shell task of the build file with the command as
+     * its argument. `cwd` is a directory of the sandbox, `''` for its root.
+     */
+    async exec(command, cwd, options = {}) {
+        // on its own line: `cd dir && a; b` would run b in the root when dir is missing
+        const script = cwd && cwd !== '.' ? `cd -- ${quotePosix(cwd)} || exit 1\n${command}` : command;
+        // a shell task in a container without `mounts: [.]` runs in an empty directory: the
+        // command would see none of the files and its writes would be lost, so it does not run
+        const onLine = options.onLine;
+        const guarded = await this.runTask(this.build.shell, {
+            ...options,
+            args: [`${EMPTY_GUARD}\n${script}`],
+            onLine: onLine && ((line) => line !== EMPTY_MARKER && onLine(line)),
+        });
+        if (guarded.exitCode !== EMPTY_EXIT || !guarded.output.split('\n').includes(EMPTY_MARKER)) {
+            return guarded;
+        }
+        if ((await this.tree({ depth: 1, limit: 1 })).entries.length > 0) {
+            throw new SandboxClientError(`the shell task ${this.build.shell} of ${this.build.hash} sees none of the files of the sandbox, ` +
+                `a shell task in a container needs mounts: [.] to work on them`);
+        }
+        // the sandbox is empty indeed
+        return this.runTask(this.build.shell, { ...options, args: [script] });
+    }
+    base() {
+        return `/v1/sandboxes/${encodeURIComponent(this.id)}`;
+    }
+    file(path) {
+        const clean = checkSandboxPath(path);
+        if (!clean) {
+            throw new SandboxClientError('a file needs a path below the root of the sandbox', 400);
+        }
+        return `${this.base()}/files/${clean.split('/').map(encodeURIComponent).join('/')}`;
+    }
+}
+exports.SandboxClient = SandboxClient;
+// The first lines of every shell command: it stops when the working directory is empty,
+// links included, without any tool but the shell itself.
+const EMPTY_MARKER = 'hammerkit: the shell sees no files';
+const EMPTY_EXIT = 125;
+const EMPTY_GUARD = [
+    'hk_seen=',
+    'for hk_f in * .[!.]* ..?*; do if [ -e "$hk_f" ] || [ -L "$hk_f" ]; then hk_seen=1; break; fi; done',
+    `[ -n "$hk_seen" ] || { echo '${EMPTY_MARKER}'; exit ${EMPTY_EXIT}; }`,
+    'unset hk_seen hk_f',
+].join('\n');
+// The exit code of a task as a shell reports it: 0 for a task that succeeded or came
+// from the cache, its own when it failed, none when it never ran or ended without one.
+/**
+ * Runs the calls one at a time, in the order they came. Agents send tool calls in parallel,
+ * and the server refuses edits while a run holds the sandbox: an edit sent along with a
+ * command lands before the command starts, instead of being refused.
+ */
+function oneAtATime() {
+    let last = Promise.resolve();
+    return (call) => {
+        const next = last.then(call);
+        last = next.catch(() => undefined);
+        return next;
+    };
+}
+exports.oneAtATime = oneAtATime;
+// a run that is over, its state does not change any more
+exports.FINAL_RUN_STATES = ['succeeded', 'failed', 'cancelled', 'rejected'];
+// Submits a run, as `POST /v1/runs` takes it, and answers it as the server queued it or
+// holds it for an approval.
+async function submitRun(connection, request) {
+    return json(await call(connection, 'POST', '/v1/runs', { body: request }));
+}
+exports.submitRun = submitRun;
+/**
+ * Follows a run to its end: its log as it grows, and its state. A signal cancels the run
+ * on the server and fails the follow.
+ */
+async function followRun(connection, submitted, options = {}) {
+    const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
+    let cancelling;
+    const cancel = () => {
+        cancelling ?? (cancelling = call(connection, 'POST', `${path}/cancel`).catch(() => undefined));
+    };
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    const lines = [];
+    let from = 1;
+    let truncated = false;
+    const add = (line) => {
+        lines.push(line);
+        options.onLine?.(line);
+    };
+    const readLog = async () => {
+        for (;;) {
+            const page = await json(await call(connection, 'GET', `${path}/logs`, { query: { task: options.task, from, limit: 1000 } }));
+            truncated = page.truncated;
+            for (const line of page.lines) {
+                add(line);
+                from = line.line + 1;
+            }
+            if (!page.next) {
+                return;
+            }
+        }
+    };
+    try {
+        let run = submitted;
+        let waitingSaid = false;
+        for (;;) {
+            if (options.signal?.aborted) {
+                // the process may exit after this, so the cancel has to reach the server first
+                cancel();
+                let timer;
+                await Promise.race([cancelling, new Promise((resolve) => (timer = setTimeout(resolve, CANCEL_WAIT_MS)))]);
+                clearTimeout(timer);
+                throw new SandboxClientError('the run was cancelled');
+            }
+            if (run.state === 'awaiting-approval' && !waitingSaid) {
+                waitingSaid = true;
+                options.onWaiting?.(run);
+            }
+            await readLog();
+            if (exports.FINAL_RUN_STATES.includes(run.state)) {
+                break;
+            }
+            run = await json(await call(connection, 'GET', path, { query: { wait: POLL_WAIT } }));
+        }
+        if (truncated) {
+            // the end of a long log is kept in the results
+            const tasks = options.task !== undefined ? [options.task] : Object.keys(run.results ?? {});
+            for (const task of tasks) {
+                const result = run.results?.[task];
+                if (!result) {
+                    continue;
+                }
+                const said = options.task !== undefined ? 'the last lines were' : `the last lines of ${task} were`;
+                for (const text of [`… the server cut the log off at its limit, ${said}:`, ...result.lastLog]) {
+                    add({ line: 0, task, stream: 'stdout', text });
+                }
+            }
+        }
+        return { run, lines, truncated };
+    }
+    finally {
+        options.signal?.removeEventListener('abort', cancel);
+    }
+}
+exports.followRun = followRun;
+function exitCodeOf(result) {
+    if (!result) {
+        return null;
+    }
+    if (result.status === 'succeeded' || result.status === 'cached') {
+        return 0;
+    }
+    return result.exitCode ?? null;
+}
+exports.exitCodeOf = exitCodeOf;
+// A path of the sandbox as the API takes it: relative, `/` separated, no `..`.
+function checkSandboxPath(path) {
+    // normalize leaves no `./` but a lone `.`, and `..` only at the start
+    const normal = path_1.posix.normalize(path.replace(/\\/g, '/')).replace(/\/$/, '');
+    if (normal.startsWith('/') || normal === '..' || normal.startsWith('../')) {
+        throw new SandboxClientError(`${path} is outside of the sandbox`, 400);
+    }
+    return normal === '.' ? '' : normal;
+}
+exports.checkSandboxPath = checkSandboxPath;
+/**
+ * Maps a path of the harness onto the sandbox. Harnesses resolve paths against their own
+ * working directory, which stands for the root of the sandbox: `<root>/src/a.ts` is
+ * `src/a.ts` there. Anything outside of it is refused.
+ */
+function toSandboxPath(root, path) {
+    const relativePath = (0, path_1.isAbsolute)(path) ? (0, path_1.relative)(root, path) : path;
+    if ((0, path_1.isAbsolute)(relativePath)) {
+        throw new SandboxClientError(`${path} is outside of the sandbox at ${root}`, 400);
+    }
+    try {
+        return checkSandboxPath(relativePath.split(path_1.sep).join('/'));
+    }
+    catch {
+        throw new SandboxClientError(`${path} is outside of the sandbox at ${root}`, 400);
+    }
+}
+exports.toSandboxPath = toSandboxPath;
+// The certificate errors of a server this machine does not trust
+const UNTRUSTED_CERTIFICATE = [
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'CERT_UNTRUSTED',
+];
+/**
+ * Why a fetch failed: node's fetch says only "fetch failed" and keeps the reason, such as a
+ * refused connection or an untrusted certificate, as its cause.
+ */
+function fetchFailure(e) {
+    if (!(e instanceof Error)) {
+        return String(e);
+    }
+    const cause = e.cause;
+    if (!(cause instanceof Error)) {
+        return e.message;
+    }
+    const code = cause.code;
+    const reason = `${e.message}: ${cause.message}${code && !cause.message.includes(code) ? ` (${code})` : ''}`;
+    return code && UNTRUSTED_CERTIFICATE.includes(code)
+        ? `${reason}, this machine does not trust the certificate of the server: name its CA in NODE_EXTRA_CA_CERTS`
+        : reason;
+}
+exports.fetchFailure = fetchFailure;
+function redact(message, token) {
+    return message.split(token).join('***');
+}
+function quotePosix(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+exports.quotePosix = quotePosix;
+function json(response) {
+    return response.json();
+}
+async function call(connection, method, path, options = {}) {
+    const url = new URL(`${connection.url.replace(/\/$/, '')}${path}`);
+    for (const [key, value] of Object.entries(options.query ?? {})) {
+        if (value !== undefined) {
+            url.searchParams.set(key, String(value));
+        }
+    }
+    const send = async () => {
+        const token = await connection.token();
+        if (!(0, token_source_1.isToken)(token)) {
+            // a header refuses such a value and would quote it whole in its error
+            throw new SandboxClientError('the token is not a single line of visible characters');
+        }
+        return fetch(url, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                ...(options.body !== undefined ? { 'content-type': 'application/json' } : {}),
+                ...(options.raw !== undefined ? { 'content-type': 'application/octet-stream' } : {}),
+            },
+            body: options.body !== undefined ? JSON.stringify(options.body) : options.raw,
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+            // an answer from anywhere else is not the server's, and a PUT would send its file on
+            redirect: 'error',
+        }).catch((e) => {
+            throw new SandboxClientError(`unable to reach ${connection.url}: ${redact(fetchFailure(e), token)}`);
+        });
+    };
+    let response = await send();
+    if (response.status === 401 && connection.renew) {
+        await connection.renew();
+        response = await send();
+    }
+    if (response.ok || (options.missing && response.status === 404)) {
+        return response;
+    }
+    let said = '';
+    try {
+        const body = await json(response);
+        said = typeof body?.error === 'string' ? body.error : '';
+    }
+    catch {
+        // no JSON
+    }
+    if (response.status === 401) {
+        throw new SandboxClientError(`${connection.url} did not accept the token`, 401);
+    }
+    throw new SandboxClientError(said || `${connection.url} answered ${response.status}`, response.status);
+}
+//# sourceMappingURL=sandbox-client.js.map