niceeval 0.12.1 → 0.12.2-canary.31

package/dist/sandbox/deadline.cjs

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SandboxCommandTimeoutError = void 0;
+exports.commandLimit = commandLimit;
+exports.applyCommandDeadline = applyCommandDeadline;
+const backend_ts_1 = require("./backend.cjs");
+/**
+ * 单条命令的上限:显式 > deadline 剩余量 > 无上限。
+ *
+ * @param base 创建沙箱时收到的 attempt 上限与截止时刻(都从 attempt deadline 派生)。
+ * `deadlineAt` 在场时按**剩余量**算——同一台沙箱上的第二条命令不该重新拿到一整份上限。
+ */
+function commandLimit(opts, base, now = Date.now()) {
+    if (opts?.timeoutMs !== undefined)
+        return { timeoutMs: opts.timeoutMs, explicit: true };
+    if (base.deadlineAt !== undefined)
+        return { timeoutMs: Math.max(1, base.deadlineAt - now), explicit: false };
+    if (base.commandTimeoutMs !== undefined)
+        return { timeoutMs: base.commandTimeoutMs, explicit: false };
+    return { explicit: false };
+}
+/** 探到就换线,探不到就什么都不做(provider 没实现 = 它的命令本来就不按 deadline 记账)。 */
+function applyCommandDeadline(sandbox, deadlineAt) {
+    const capability = (0, backend_ts_1.sandboxCapabilities)(sandbox).setCommandDeadline;
+    if (capability._tag === "Supported")
+        capability.value(deadlineAt);
+}
+/**
+ * 一条命令撞线时抛的错。带着**归属**一起抛:上限多少、是不是显式声明的——runner 据此把
+ * attempt 转成 `errored` 时落 `error.timeout`(见 runner/attempt.ts),不打一个没有归属
+ * 说明的 ✗。
+ */
+class SandboxCommandTimeoutError extends Error {
+    limitMs;
+    explicit;
+    constructor(message, limitMs, explicit) {
+        super(message);
+        this.name = "SandboxCommandTimeoutError";
+        this.limitMs = limitMs;
+        this.explicit = explicit;
+    }
+}
+exports.SandboxCommandTimeoutError = SandboxCommandTimeoutError;
+//# sourceMappingURL=deadline.cjs.map

package/dist/sandbox/deadline.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["deadline.ts"],"names":[],"mappings":";;;AAuBA,oCAWC;AAgBD,oDAIC;AA7CD,6CAAmD;AAQnD;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,IAAmD,EAAE,IAGjF,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACf,IAAI,IAAI,EAAE,SAAS,KAAK,SAAS;QAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAeD,6DAA6D;AAC7D,SAAgB,oBAAoB,CAAC,OAAgB,EAAE,UAAmB;IACtE,MAAM,UAAU,GAAG,IAAA,gCAAmB,EAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC;IACnE,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;QAC/B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AACD;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,KAAK;IACxC,OAAO,CAAS;IAChB,QAAQ,CAAU;IAC3B,YAAY,OAAe,EAAE,OAAe,EAAE,QAAiB;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;CACJ;AATD,gEASC","sourcesContent":["// 时限归属:attempt deadline 是唯一默认(契约见 docs/feature/sandbox/architecture.md\n// 「时限归属:attempt deadline 是唯一默认」)。\n//\n// provider 层**没有独立默认**。单条命令未显式传 `timeout` 时,上限就是 attempt deadline 的\n// 剩余量;四层解析链一个上限都没声明时就是没有上限,不替用户发明一条线。理由与 `timeoutMs`\n// 的解析链相同:时限多一个链外来源,症状就是「实验声明 20 分钟,命令在整 600 秒被另一层\n// 杀掉」——配置的值不生效,报错还落在离配置最远的地方。\nimport type { CommandOptions } from \"./types.ts\";\nimport type { Sandbox } from \"./types.ts\";\nimport { sandboxCapabilities } from \"./backend.ts\";\n/** 一条命令这次实际生效的上限,以及它是不是用户显式声明的。 */\nexport interface CommandLimit {\n    /** 缺席 = 这条命令没有上限(没有 deadline,也没人显式给)。 */\n    timeoutMs?: number;\n    /** `true` = 用户代码给这条命令显式传了 `timeout`,那是有意声明,不是默认值。 */\n    explicit: boolean;\n}\n/**\n * 单条命令的上限:显式 > deadline 剩余量 > 无上限。\n *\n * @param base 创建沙箱时收到的 attempt 上限与截止时刻(都从 attempt deadline 派生)。\n * `deadlineAt` 在场时按**剩余量**算——同一台沙箱上的第二条命令不该重新拿到一整份上限。\n */\nexport function commandLimit(opts: Pick<CommandOptions, \"timeoutMs\"> | undefined, base: {\n    commandTimeoutMs?: number;\n    deadlineAt?: number;\n}, now = Date.now()): CommandLimit {\n    if (opts?.timeoutMs !== undefined)\n        return { timeoutMs: opts.timeoutMs, explicit: true };\n    if (base.deadlineAt !== undefined)\n        return { timeoutMs: Math.max(1, base.deadlineAt - now), explicit: false };\n    if (base.commandTimeoutMs !== undefined)\n        return { timeoutMs: base.commandTimeoutMs, explicit: false };\n    return { explicit: false };\n}\n/**\n * 复用实例的「换一条 attempt deadline」能力(与 `suspend()` / `ensureLifetime()` 同一种\n * 「接口之外的可选能力」)。\n *\n * 一次性沙箱在 create 时就收下 deadlineAt,实例与 attempt 一一对应,所以那条线一辈子不变;\n * 复用实例活得比 attempt 长,create 时那条线只对创建它的那条 attempt 成立,后续承接的每条\n * attempt 都要换成自己的。没有这条能力时,复用实例的每条命令都落回「base 里什么都没有」\n * → provider SDK 自己的默认值(e2b 是 60 秒),于是实验声明的 timeoutMs 完全不生效——\n * 正是本文件顶部注释点名的那个症状,只不过发生在复用路径上。\n */\nexport interface SandboxCommandDeadline {\n    /** `undefined` = 这台实例接下来没有 deadline(四层都没声明上限时的正路径,不发明一条线)。 */\n    setCommandDeadline(deadlineAt?: number): void;\n}\n/** 探到就换线,探不到就什么都不做(provider 没实现 = 它的命令本来就不按 deadline 记账)。 */\nexport function applyCommandDeadline(sandbox: Sandbox, deadlineAt?: number): void {\n    const capability = sandboxCapabilities(sandbox).setCommandDeadline;\n    if (capability._tag === \"Supported\")\n        capability.value(deadlineAt);\n}\n/**\n * 一条命令撞线时抛的错。带着**归属**一起抛:上限多少、是不是显式声明的——runner 据此把\n * attempt 转成 `errored` 时落 `error.timeout`(见 runner/attempt.ts),不打一个没有归属\n * 说明的 ✗。\n */\nexport class SandboxCommandTimeoutError extends Error {\n    readonly limitMs: number;\n    readonly explicit: boolean;\n    constructor(message: string, limitMs: number, explicit: boolean) {\n        super(message);\n        this.name = \"SandboxCommandTimeoutError\";\n        this.limitMs = limitMs;\n        this.explicit = explicit;\n    }\n}\n"]}

package/dist/sandbox/deadline.d.cts

@@ -0,0 +1,45 @@
+import type { CommandOptions } from "./types.cjs";
+import type { Sandbox } from "./types.cjs";
+/** 一条命令这次实际生效的上限,以及它是不是用户显式声明的。 */
+export interface CommandLimit {
+    /** 缺席 = 这条命令没有上限(没有 deadline,也没人显式给)。 */
+    timeoutMs?: number;
+    /** `true` = 用户代码给这条命令显式传了 `timeout`,那是有意声明,不是默认值。 */
+    explicit: boolean;
+}
+/**
+ * 单条命令的上限:显式 > deadline 剩余量 > 无上限。
+ *
+ * @param base 创建沙箱时收到的 attempt 上限与截止时刻(都从 attempt deadline 派生)。
+ * `deadlineAt` 在场时按**剩余量**算——同一台沙箱上的第二条命令不该重新拿到一整份上限。
+ */
+export declare function commandLimit(opts: Pick<CommandOptions, "timeoutMs"> | undefined, base: {
+    commandTimeoutMs?: number;
+    deadlineAt?: number;
+}, now?: number): CommandLimit;
+/**
+ * 复用实例的「换一条 attempt deadline」能力(与 `suspend()` / `ensureLifetime()` 同一种
+ * 「接口之外的可选能力」)。
+ *
+ * 一次性沙箱在 create 时就收下 deadlineAt,实例与 attempt 一一对应,所以那条线一辈子不变;
+ * 复用实例活得比 attempt 长,create 时那条线只对创建它的那条 attempt 成立,后续承接的每条
+ * attempt 都要换成自己的。没有这条能力时,复用实例的每条命令都落回「base 里什么都没有」
+ * → provider SDK 自己的默认值(e2b 是 60 秒),于是实验声明的 timeoutMs 完全不生效——
+ * 正是本文件顶部注释点名的那个症状,只不过发生在复用路径上。
+ */
+export interface SandboxCommandDeadline {
+    /** `undefined` = 这台实例接下来没有 deadline(四层都没声明上限时的正路径,不发明一条线)。 */
+    setCommandDeadline(deadlineAt?: number): void;
+}
+/** 探到就换线,探不到就什么都不做(provider 没实现 = 它的命令本来就不按 deadline 记账)。 */
+export declare function applyCommandDeadline(sandbox: Sandbox, deadlineAt?: number): void;
+/**
+ * 一条命令撞线时抛的错。带着**归属**一起抛:上限多少、是不是显式声明的——runner 据此把
+ * attempt 转成 `errored` 时落 `error.timeout`(见 runner/attempt.ts),不打一个没有归属
+ * 说明的 ✗。
+ */
+export declare class SandboxCommandTimeoutError extends Error {
+    readonly limitMs: number;
+    readonly explicit: boolean;
+    constructor(message: string, limitMs: number, explicit: boolean);
+}

package/dist/sandbox/deadline.d.mts

@@ -0,0 +1,45 @@
+import type { CommandOptions } from "./types.mjs";
+import type { Sandbox } from "./types.mjs";
+/** 一条命令这次实际生效的上限,以及它是不是用户显式声明的。 */
+export interface CommandLimit {
+    /** 缺席 = 这条命令没有上限(没有 deadline,也没人显式给)。 */
+    timeoutMs?: number;
+    /** `true` = 用户代码给这条命令显式传了 `timeout`,那是有意声明,不是默认值。 */
+    explicit: boolean;
+}
+/**
+ * 单条命令的上限:显式 > deadline 剩余量 > 无上限。
+ *
+ * @param base 创建沙箱时收到的 attempt 上限与截止时刻(都从 attempt deadline 派生)。
+ * `deadlineAt` 在场时按**剩余量**算——同一台沙箱上的第二条命令不该重新拿到一整份上限。
+ */
+export declare function commandLimit(opts: Pick<CommandOptions, "timeoutMs"> | undefined, base: {
+    commandTimeoutMs?: number;
+    deadlineAt?: number;
+}, now?: number): CommandLimit;
+/**
+ * 复用实例的「换一条 attempt deadline」能力(与 `suspend()` / `ensureLifetime()` 同一种
+ * 「接口之外的可选能力」)。
+ *
+ * 一次性沙箱在 create 时就收下 deadlineAt,实例与 attempt 一一对应,所以那条线一辈子不变;
+ * 复用实例活得比 attempt 长,create 时那条线只对创建它的那条 attempt 成立,后续承接的每条
+ * attempt 都要换成自己的。没有这条能力时,复用实例的每条命令都落回「base 里什么都没有」
+ * → provider SDK 自己的默认值(e2b 是 60 秒),于是实验声明的 timeoutMs 完全不生效——
+ * 正是本文件顶部注释点名的那个症状,只不过发生在复用路径上。
+ */
+export interface SandboxCommandDeadline {
+    /** `undefined` = 这台实例接下来没有 deadline(四层都没声明上限时的正路径,不发明一条线)。 */
+    setCommandDeadline(deadlineAt?: number): void;
+}
+/** 探到就换线,探不到就什么都不做(provider 没实现 = 它的命令本来就不按 deadline 记账)。 */
+export declare function applyCommandDeadline(sandbox: Sandbox, deadlineAt?: number): void;
+/**
+ * 一条命令撞线时抛的错。带着**归属**一起抛:上限多少、是不是显式声明的——runner 据此把
+ * attempt 转成 `errored` 时落 `error.timeout`(见 runner/attempt.ts),不打一个没有归属
+ * 说明的 ✗。
+ */
+export declare class SandboxCommandTimeoutError extends Error {
+    readonly limitMs: number;
+    readonly explicit: boolean;
+    constructor(message: string, limitMs: number, explicit: boolean);
+}

package/dist/sandbox/deadline.d.ts

@@ -1,5 +1,5 @@
-import type { CommandOptions } from "./types.ts";
-import type { Sandbox } from "./types.ts";
+import type { CommandOptions } from "./types.js";
+import type { Sandbox } from "./types.js";
 /** 一条命令这次实际生效的上限,以及它是不是用户显式声明的。 */
 export interface CommandLimit {
     /** 缺席 = 这条命令没有上限(没有 deadline,也没人显式给)。 */

package/dist/sandbox/deadline.js

@@ -0,0 +1,10 @@
+import { createRequire as __niceevalCreateRequire } from "node:module";
+const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
+const __niceevalCanonical = __niceevalRequire("./deadline.cjs");
+const __niceevalExport0 = __niceevalCanonical["SandboxCommandTimeoutError"];
+export { __niceevalExport0 as SandboxCommandTimeoutError };
+const __niceevalExport1 = __niceevalCanonical["applyCommandDeadline"];
+export { __niceevalExport1 as applyCommandDeadline };
+const __niceevalExport2 = __niceevalCanonical["commandLimit"];
+export { __niceevalExport2 as commandLimit };
+//# sourceMappingURL=deadline.js.map

package/dist/sandbox/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sources":[],"names":[],"mappings":""}

package/dist/sandbox/dind-supervisor.cjs

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DIND_BOOTSTRAP_SOURCE = exports.DIND_SUPERVISOR_SOURCE = exports.DIND_SHUTDOWN_GRACE_SECONDS = void 0;
+exports.dindContainerCommand = dindContainerCommand;
+exports.dindSupervisorRevision = dindSupervisorRevision;
+const DIND_SUPERVISOR_REVISION = "niceeval-dind-supervisor-v1";
+const DIND_LOG_PATH = "/tmp/dockerd.log";
+const DIND_LOG_LIMIT_BYTES = 256 * 1024;
+exports.DIND_SHUTDOWN_GRACE_SECONDS = 3;
+/**
+ * Provider-owned DinD supervisor. It is a constant program passed to `node -e`;
+ * author-controlled values are supplied only as argv and never interpolated into shell source.
+ */
+exports.DIND_SUPERVISOR_SOURCE = String.raw `
+const { spawn } = require("node:child_process");
+const fs = require("node:fs");
+const LOG_PATH = ${JSON.stringify(DIND_LOG_PATH)};
+const LOG_LIMIT = ${DIND_LOG_LIMIT_BYTES};
+const GRACE_MS = ${exports.DIND_SHUTDOWN_GRACE_SECONDS * 1000};
+const keeperArgv = process.argv.slice(1);
+let daemon;
+let keeper;
+let daemonExited = false;
+let keeperExited = false;
+let shuttingDown = false;
+let shutdownCode = 1;
+let daemonLog = Buffer.alloc(0);
+
+function recordDaemonLog(chunk) {
+  daemonLog = Buffer.concat([daemonLog, Buffer.from(chunk)]);
+  if (daemonLog.length > LOG_LIMIT) daemonLog = daemonLog.subarray(daemonLog.length - LOG_LIMIT);
+  fs.writeFileSync(LOG_PATH, daemonLog);
+}
+
+function terminate(child, exited) {
+  if (child && !exited) {
+    try { child.kill("SIGTERM"); } catch {}
+  }
+}
+
+function finishWhenStopped() {
+  if (shuttingDown && daemonExited && keeperExited) process.exit(shutdownCode);
+}
+
+function shutdown(code, printDaemonLog = false) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  shutdownCode = code;
+  if (printDaemonLog && daemonLog.length > 0) {
+    process.stderr.write("--- dockerd.log (tail) ---\n");
+    process.stderr.write(daemonLog);
+    if (daemonLog[daemonLog.length - 1] !== 10) process.stderr.write("\n");
+  }
+  terminate(daemon, daemonExited);
+  terminate(keeper, keeperExited);
+  setTimeout(() => process.exit(shutdownCode), GRACE_MS);
+  finishWhenStopped();
+}
+
+function spawnFailure(name, error) {
+  process.stderr.write("dind-supervisor: failed to spawn " + name + ": " + error.message + "\n");
+  shutdown(1, name === "dockerd");
+}
+
+daemon = spawn("dockerd-entrypoint.sh", [
+  "dockerd",
+  "--host=unix:///var/run/docker.sock",
+  "--shutdown-timeout=2",
+], { stdio: ["ignore", "pipe", "pipe"] });
+daemon.stdout.on("data", recordDaemonLog);
+daemon.stderr.on("data", recordDaemonLog);
+daemon.on("error", (error) => spawnFailure("dockerd", error));
+daemon.on("exit", (code, signal) => {
+  daemonExited = true;
+  if (!shuttingDown) {
+    process.stderr.write("dind-supervisor: dockerd exited unexpectedly (code=" + (code ?? "null") + ", signal=" + (signal ?? "null") + ")\n");
+    shutdown(code && code > 0 ? code : 1, true);
+  }
+  finishWhenStopped();
+});
+
+if (keeperArgv.length === 0) {
+  process.stderr.write("dind-supervisor: missing keeper argv\n");
+  shutdown(1);
+} else {
+  keeper = spawn(keeperArgv[0], keeperArgv.slice(1), { stdio: "inherit" });
+  keeper.on("error", (error) => spawnFailure("keeper", error));
+  keeper.on("exit", (code) => {
+    keeperExited = true;
+    if (!shuttingDown) shutdown(code && code > 0 ? code : 0);
+    finishWhenStopped();
+  });
+}
+
+process.on("SIGTERM", () => shutdown(0, true));
+process.on("SIGINT", () => shutdown(0));
+`;
+exports.DIND_BOOTSTRAP_SOURCE = String.raw `set -eu
+for tool in docker-init node docker dockerd-entrypoint.sh timeout tail; do
+  if ! command -v "$tool" >/dev/null 2>&1; then
+    echo "dind-image-incompatible: missing $tool" >&2
+    exit 2
+  fi
+done
+touch "$3"
+chmod 666 "$3"
+exec docker-init -- node -e "$1" timeout "$2" tail -n +1 -F "$3"`;
+function dindContainerCommand(ttlSeconds, logPath) {
+    const keeperSeconds = Math.max(1, ttlSeconds - exports.DIND_SHUTDOWN_GRACE_SECONDS);
+    return Object.freeze({
+        Entrypoint: Object.freeze(["sh", "-c"]),
+        Cmd: Object.freeze([
+            exports.DIND_BOOTSTRAP_SOURCE,
+            DIND_SUPERVISOR_REVISION,
+            exports.DIND_SUPERVISOR_SOURCE,
+            String(keeperSeconds),
+            logPath,
+        ]),
+    });
+}
+function dindSupervisorRevision() {
+    return DIND_SUPERVISOR_REVISION;
+}
+//# sourceMappingURL=dind-supervisor.cjs.map

package/dist/sandbox/dind-supervisor.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dind-supervisor.js","sourceRoot":"","sources":["dind-supervisor.ts"],"names":[],"mappings":";;;AAsGA,oDAeC;AACD,wDAEC;AAxHD,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC3B,QAAA,2BAA2B,GAAG,CAAC,CAAC;AAC7C;;;GAGG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC;;;mBAG9B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;oBAC5B,oBAAoB;mBACrB,mCAA2B,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8EpD,CAAC;AACW,QAAA,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC;;;;;;;;;iEASiB,CAAC;AAClE,SAAgB,oBAAoB,CAAC,UAAkB,EAAE,OAAe;IAIpE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,mCAA2B,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACf,6BAAqB;YACrB,wBAAwB;YACxB,8BAAsB;YACtB,MAAM,CAAC,aAAa,CAAC;YACrB,OAAO;SACV,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,sBAAsB;IAClC,OAAO,wBAAwB,CAAC;AACpC,CAAC","sourcesContent":["const DIND_SUPERVISOR_REVISION = \"niceeval-dind-supervisor-v1\";\nconst DIND_LOG_PATH = \"/tmp/dockerd.log\";\nconst DIND_LOG_LIMIT_BYTES = 256 * 1024;\nexport const DIND_SHUTDOWN_GRACE_SECONDS = 3;\n/**\n * Provider-owned DinD supervisor. It is a constant program passed to `node -e`;\n * author-controlled values are supplied only as argv and never interpolated into shell source.\n */\nexport const DIND_SUPERVISOR_SOURCE = String.raw `\nconst { spawn } = require(\"node:child_process\");\nconst fs = require(\"node:fs\");\nconst LOG_PATH = ${JSON.stringify(DIND_LOG_PATH)};\nconst LOG_LIMIT = ${DIND_LOG_LIMIT_BYTES};\nconst GRACE_MS = ${DIND_SHUTDOWN_GRACE_SECONDS * 1000};\nconst keeperArgv = process.argv.slice(1);\nlet daemon;\nlet keeper;\nlet daemonExited = false;\nlet keeperExited = false;\nlet shuttingDown = false;\nlet shutdownCode = 1;\nlet daemonLog = Buffer.alloc(0);\n\nfunction recordDaemonLog(chunk) {\n  daemonLog = Buffer.concat([daemonLog, Buffer.from(chunk)]);\n  if (daemonLog.length > LOG_LIMIT) daemonLog = daemonLog.subarray(daemonLog.length - LOG_LIMIT);\n  fs.writeFileSync(LOG_PATH, daemonLog);\n}\n\nfunction terminate(child, exited) {\n  if (child && !exited) {\n    try { child.kill(\"SIGTERM\"); } catch {}\n  }\n}\n\nfunction finishWhenStopped() {\n  if (shuttingDown && daemonExited && keeperExited) process.exit(shutdownCode);\n}\n\nfunction shutdown(code, printDaemonLog = false) {\n  if (shuttingDown) return;\n  shuttingDown = true;\n  shutdownCode = code;\n  if (printDaemonLog && daemonLog.length > 0) {\n    process.stderr.write(\"--- dockerd.log (tail) ---\\n\");\n    process.stderr.write(daemonLog);\n    if (daemonLog[daemonLog.length - 1] !== 10) process.stderr.write(\"\\n\");\n  }\n  terminate(daemon, daemonExited);\n  terminate(keeper, keeperExited);\n  setTimeout(() => process.exit(shutdownCode), GRACE_MS);\n  finishWhenStopped();\n}\n\nfunction spawnFailure(name, error) {\n  process.stderr.write(\"dind-supervisor: failed to spawn \" + name + \": \" + error.message + \"\\n\");\n  shutdown(1, name === \"dockerd\");\n}\n\ndaemon = spawn(\"dockerd-entrypoint.sh\", [\n  \"dockerd\",\n  \"--host=unix:///var/run/docker.sock\",\n  \"--shutdown-timeout=2\",\n], { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\ndaemon.stdout.on(\"data\", recordDaemonLog);\ndaemon.stderr.on(\"data\", recordDaemonLog);\ndaemon.on(\"error\", (error) => spawnFailure(\"dockerd\", error));\ndaemon.on(\"exit\", (code, signal) => {\n  daemonExited = true;\n  if (!shuttingDown) {\n    process.stderr.write(\"dind-supervisor: dockerd exited unexpectedly (code=\" + (code ?? \"null\") + \", signal=\" + (signal ?? \"null\") + \")\\n\");\n    shutdown(code && code > 0 ? code : 1, true);\n  }\n  finishWhenStopped();\n});\n\nif (keeperArgv.length === 0) {\n  process.stderr.write(\"dind-supervisor: missing keeper argv\\n\");\n  shutdown(1);\n} else {\n  keeper = spawn(keeperArgv[0], keeperArgv.slice(1), { stdio: \"inherit\" });\n  keeper.on(\"error\", (error) => spawnFailure(\"keeper\", error));\n  keeper.on(\"exit\", (code) => {\n    keeperExited = true;\n    if (!shuttingDown) shutdown(code && code > 0 ? code : 0);\n    finishWhenStopped();\n  });\n}\n\nprocess.on(\"SIGTERM\", () => shutdown(0, true));\nprocess.on(\"SIGINT\", () => shutdown(0));\n`;\nexport const DIND_BOOTSTRAP_SOURCE = String.raw `set -eu\nfor tool in docker-init node docker dockerd-entrypoint.sh timeout tail; do\n  if ! command -v \"$tool\" >/dev/null 2>&1; then\n    echo \"dind-image-incompatible: missing $tool\" >&2\n    exit 2\n  fi\ndone\ntouch \"$3\"\nchmod 666 \"$3\"\nexec docker-init -- node -e \"$1\" timeout \"$2\" tail -n +1 -F \"$3\"`;\nexport function dindContainerCommand(ttlSeconds: number, logPath: string): {\n    readonly Entrypoint: readonly string[];\n    readonly Cmd: readonly string[];\n} {\n    const keeperSeconds = Math.max(1, ttlSeconds - DIND_SHUTDOWN_GRACE_SECONDS);\n    return Object.freeze({\n        Entrypoint: Object.freeze([\"sh\", \"-c\"]),\n        Cmd: Object.freeze([\n            DIND_BOOTSTRAP_SOURCE,\n            DIND_SUPERVISOR_REVISION,\n            DIND_SUPERVISOR_SOURCE,\n            String(keeperSeconds),\n            logPath,\n        ]),\n    });\n}\nexport function dindSupervisorRevision(): string {\n    return DIND_SUPERVISOR_REVISION;\n}\n"]}

package/dist/sandbox/dind-supervisor.d.cts

@@ -0,0 +1,12 @@
+export declare const DIND_SHUTDOWN_GRACE_SECONDS = 3;
+/**
+ * Provider-owned DinD supervisor. It is a constant program passed to `node -e`;
+ * author-controlled values are supplied only as argv and never interpolated into shell source.
+ */
+export declare const DIND_SUPERVISOR_SOURCE: string;
+export declare const DIND_BOOTSTRAP_SOURCE: string;
+export declare function dindContainerCommand(ttlSeconds: number, logPath: string): {
+    readonly Entrypoint: readonly string[];
+    readonly Cmd: readonly string[];
+};
+export declare function dindSupervisorRevision(): string;

package/dist/sandbox/dind-supervisor.d.mts

@@ -0,0 +1,12 @@
+export declare const DIND_SHUTDOWN_GRACE_SECONDS = 3;
+/**
+ * Provider-owned DinD supervisor. It is a constant program passed to `node -e`;
+ * author-controlled values are supplied only as argv and never interpolated into shell source.
+ */
+export declare const DIND_SUPERVISOR_SOURCE: string;
+export declare const DIND_BOOTSTRAP_SOURCE: string;
+export declare function dindContainerCommand(ttlSeconds: number, logPath: string): {
+    readonly Entrypoint: readonly string[];
+    readonly Cmd: readonly string[];
+};
+export declare function dindSupervisorRevision(): string;

package/dist/sandbox/dind-supervisor.d.ts

@@ -0,0 +1,12 @@
+export declare const DIND_SHUTDOWN_GRACE_SECONDS = 3;
+/**
+ * Provider-owned DinD supervisor. It is a constant program passed to `node -e`;
+ * author-controlled values are supplied only as argv and never interpolated into shell source.
+ */
+export declare const DIND_SUPERVISOR_SOURCE: string;
+export declare const DIND_BOOTSTRAP_SOURCE: string;
+export declare function dindContainerCommand(ttlSeconds: number, logPath: string): {
+    readonly Entrypoint: readonly string[];
+    readonly Cmd: readonly string[];
+};
+export declare function dindSupervisorRevision(): string;

package/dist/sandbox/dind-supervisor.js

@@ -0,0 +1,14 @@
+import { createRequire as __niceevalCreateRequire } from "node:module";
+const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
+const __niceevalCanonical = __niceevalRequire("./dind-supervisor.cjs");
+const __niceevalExport0 = __niceevalCanonical["DIND_BOOTSTRAP_SOURCE"];
+export { __niceevalExport0 as DIND_BOOTSTRAP_SOURCE };
+const __niceevalExport1 = __niceevalCanonical["DIND_SHUTDOWN_GRACE_SECONDS"];
+export { __niceevalExport1 as DIND_SHUTDOWN_GRACE_SECONDS };
+const __niceevalExport2 = __niceevalCanonical["DIND_SUPERVISOR_SOURCE"];
+export { __niceevalExport2 as DIND_SUPERVISOR_SOURCE };
+const __niceevalExport3 = __niceevalCanonical["dindContainerCommand"];
+export { __niceevalExport3 as dindContainerCommand };
+const __niceevalExport4 = __niceevalCanonical["dindSupervisorRevision"];
+export { __niceevalExport4 as dindSupervisorRevision };
+//# sourceMappingURL=dind-supervisor.js.map

package/dist/sandbox/dind-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dind-supervisor.js","sources":[],"names":[],"mappings":""}

package/dist/sandbox/docker-agent-image.cjs

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NICEEVAL_OPENCLAW_DOCKER_IMAGE = exports.NICEEVAL_HERMES_DOCKER_IMAGE = exports.NICEEVAL_OPENCODE_DOCKER_IMAGE = exports.NICEEVAL_BUB_DOCKER_IMAGE = exports.NICEEVAL_CODEX_DOCKER_IMAGE = exports.NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE = exports.NICEEVAL_DOCKER_IMAGE_NAME = void 0;
+exports.niceevalDockerImage = niceevalDockerImage;
+const coding_cli_versions_ts_1 = require("../agents/coding-cli-versions.cjs");
+/** 每个 Agent 的 NiceEval 公共 Docker Hub repository（不含 tag）。 */
+exports.NICEEVAL_DOCKER_IMAGE_NAME = {
+    "claude-code": "niceeval/claude-code",
+    codex: "niceeval/codex",
+    bub: "niceeval/bub",
+    opencode: "niceeval/opencode",
+    hermes: "niceeval/hermes",
+    openclaw: "niceeval/openclaw",
+};
+/**
+ * Fully pinned reference to a NiceEval official coding-agent Docker image.
+ *
+ * tag 就是[基线版本号](../agents/coding-cli-versions.ts)`<Agent 版本>-r<配方修订>`：
+ * 镜像的配方与版本常量在同一个 commit 里，Docker 侧的发布由配方变更触发的 CI 完成，
+ * 因此引用直接由版本常量派生，不另存一份易漂移的镜像 tag。
+ */
+function niceevalDockerImage(agent) {
+    return `${exports.NICEEVAL_DOCKER_IMAGE_NAME[agent]}:${(0, coding_cli_versions_ts_1.agentBaselineVersionTag)(agent)}`;
+}
+/**
+ * NiceEval 官方公共 Docker 镜像：每个值是完整、版本钉死的引用，直接交给
+ * `dockerSandbox({ source: { type: "image", image } })`，
+ * 或写进项目 Dockerfile 的 `FROM` 继续叠加依赖。
+ */
+exports.NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE = niceevalDockerImage("claude-code");
+exports.NICEEVAL_CODEX_DOCKER_IMAGE = niceevalDockerImage("codex");
+exports.NICEEVAL_BUB_DOCKER_IMAGE = niceevalDockerImage("bub");
+exports.NICEEVAL_OPENCODE_DOCKER_IMAGE = niceevalDockerImage("opencode");
+exports.NICEEVAL_HERMES_DOCKER_IMAGE = niceevalDockerImage("hermes");
+exports.NICEEVAL_OPENCLAW_DOCKER_IMAGE = niceevalDockerImage("openclaw");
+//# sourceMappingURL=docker-agent-image.cjs.map

package/dist/sandbox/docker-agent-image.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-agent-image.js","sourceRoot":"","sources":["docker-agent-image.ts"],"names":[],"mappings":";;;AAiBA,kDAEC;AAnBD,6EAAsG;AACtG,4DAA4D;AAC/C,QAAA,0BAA0B,GAAmD;IACtF,aAAa,EAAE,sBAAsB;IACrC,KAAK,EAAE,gBAAgB;IACvB,GAAG,EAAE,cAAc;IACnB,QAAQ,EAAE,mBAAmB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,QAAQ,EAAE,mBAAmB;CAChC,CAAC;AACF;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,KAA0B;IAC1D,OAAO,GAAG,kCAA0B,CAAC,KAAK,CAAC,IAAI,IAAA,gDAAuB,EAAC,KAAK,CAAC,EAAE,CAAC;AACpF,CAAC;AACD;;;;GAIG;AACU,QAAA,iCAAiC,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;AACvE,QAAA,2BAA2B,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC3D,QAAA,yBAAyB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACvD,QAAA,8BAA8B,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACjE,QAAA,4BAA4B,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC7D,QAAA,8BAA8B,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC","sourcesContent":["import { type CodingAgentBaseline, agentBaselineVersionTag, } from \"../agents/coding-cli-versions.ts\";\n/** 每个 Agent 的 NiceEval 公共 Docker Hub repository（不含 tag）。 */\nexport const NICEEVAL_DOCKER_IMAGE_NAME: globalThis.Record<CodingAgentBaseline, string> = {\n    \"claude-code\": \"niceeval/claude-code\",\n    codex: \"niceeval/codex\",\n    bub: \"niceeval/bub\",\n    opencode: \"niceeval/opencode\",\n    hermes: \"niceeval/hermes\",\n    openclaw: \"niceeval/openclaw\",\n};\n/**\n * Fully pinned reference to a NiceEval official coding-agent Docker image.\n *\n * tag 就是[基线版本号](../agents/coding-cli-versions.ts)`<Agent 版本>-r<配方修订>`：\n * 镜像的配方与版本常量在同一个 commit 里，Docker 侧的发布由配方变更触发的 CI 完成，\n * 因此引用直接由版本常量派生，不另存一份易漂移的镜像 tag。\n */\nexport function niceevalDockerImage(agent: CodingAgentBaseline): string {\n    return `${NICEEVAL_DOCKER_IMAGE_NAME[agent]}:${agentBaselineVersionTag(agent)}`;\n}\n/**\n * NiceEval 官方公共 Docker 镜像：每个值是完整、版本钉死的引用，直接交给\n * `dockerSandbox({ source: { type: \"image\", image } })`，\n * 或写进项目 Dockerfile 的 `FROM` 继续叠加依赖。\n */\nexport const NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE = niceevalDockerImage(\"claude-code\");\nexport const NICEEVAL_CODEX_DOCKER_IMAGE = niceevalDockerImage(\"codex\");\nexport const NICEEVAL_BUB_DOCKER_IMAGE = niceevalDockerImage(\"bub\");\nexport const NICEEVAL_OPENCODE_DOCKER_IMAGE = niceevalDockerImage(\"opencode\");\nexport const NICEEVAL_HERMES_DOCKER_IMAGE = niceevalDockerImage(\"hermes\");\nexport const NICEEVAL_OPENCLAW_DOCKER_IMAGE = niceevalDockerImage(\"openclaw\");\n"]}

package/dist/sandbox/docker-agent-image.d.cts

@@ -0,0 +1,22 @@
+import { type CodingAgentBaseline } from "../agents/coding-cli-versions.cjs";
+/** 每个 Agent 的 NiceEval 公共 Docker Hub repository（不含 tag）。 */
+export declare const NICEEVAL_DOCKER_IMAGE_NAME: globalThis.Record<CodingAgentBaseline, string>;
+/**
+ * Fully pinned reference to a NiceEval official coding-agent Docker image.
+ *
+ * tag 就是[基线版本号](../agents/coding-cli-versions.ts)`<Agent 版本>-r<配方修订>`：
+ * 镜像的配方与版本常量在同一个 commit 里，Docker 侧的发布由配方变更触发的 CI 完成，
+ * 因此引用直接由版本常量派生，不另存一份易漂移的镜像 tag。
+ */
+export declare function niceevalDockerImage(agent: CodingAgentBaseline): string;
+/**
+ * NiceEval 官方公共 Docker 镜像：每个值是完整、版本钉死的引用，直接交给
+ * `dockerSandbox({ source: { type: "image", image } })`，
+ * 或写进项目 Dockerfile 的 `FROM` 继续叠加依赖。
+ */
+export declare const NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE: string;
+export declare const NICEEVAL_CODEX_DOCKER_IMAGE: string;
+export declare const NICEEVAL_BUB_DOCKER_IMAGE: string;
+export declare const NICEEVAL_OPENCODE_DOCKER_IMAGE: string;
+export declare const NICEEVAL_HERMES_DOCKER_IMAGE: string;
+export declare const NICEEVAL_OPENCLAW_DOCKER_IMAGE: string;

package/dist/sandbox/docker-agent-image.d.mts

@@ -0,0 +1,22 @@
+import { type CodingAgentBaseline } from "../agents/coding-cli-versions.mjs";
+/** 每个 Agent 的 NiceEval 公共 Docker Hub repository（不含 tag）。 */
+export declare const NICEEVAL_DOCKER_IMAGE_NAME: globalThis.Record<CodingAgentBaseline, string>;
+/**
+ * Fully pinned reference to a NiceEval official coding-agent Docker image.
+ *
+ * tag 就是[基线版本号](../agents/coding-cli-versions.ts)`<Agent 版本>-r<配方修订>`：
+ * 镜像的配方与版本常量在同一个 commit 里，Docker 侧的发布由配方变更触发的 CI 完成，
+ * 因此引用直接由版本常量派生，不另存一份易漂移的镜像 tag。
+ */
+export declare function niceevalDockerImage(agent: CodingAgentBaseline): string;
+/**
+ * NiceEval 官方公共 Docker 镜像：每个值是完整、版本钉死的引用，直接交给
+ * `dockerSandbox({ source: { type: "image", image } })`，
+ * 或写进项目 Dockerfile 的 `FROM` 继续叠加依赖。
+ */
+export declare const NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE: string;
+export declare const NICEEVAL_CODEX_DOCKER_IMAGE: string;
+export declare const NICEEVAL_BUB_DOCKER_IMAGE: string;
+export declare const NICEEVAL_OPENCODE_DOCKER_IMAGE: string;
+export declare const NICEEVAL_HERMES_DOCKER_IMAGE: string;
+export declare const NICEEVAL_OPENCLAW_DOCKER_IMAGE: string;

package/dist/sandbox/docker-agent-image.d.ts

@@ -0,0 +1,22 @@
+import { type CodingAgentBaseline } from "../agents/coding-cli-versions.js";
+/** 每个 Agent 的 NiceEval 公共 Docker Hub repository（不含 tag）。 */
+export declare const NICEEVAL_DOCKER_IMAGE_NAME: globalThis.Record<CodingAgentBaseline, string>;
+/**
+ * Fully pinned reference to a NiceEval official coding-agent Docker image.
+ *
+ * tag 就是[基线版本号](../agents/coding-cli-versions.ts)`<Agent 版本>-r<配方修订>`：
+ * 镜像的配方与版本常量在同一个 commit 里，Docker 侧的发布由配方变更触发的 CI 完成，
+ * 因此引用直接由版本常量派生，不另存一份易漂移的镜像 tag。
+ */
+export declare function niceevalDockerImage(agent: CodingAgentBaseline): string;
+/**
+ * NiceEval 官方公共 Docker 镜像：每个值是完整、版本钉死的引用，直接交给
+ * `dockerSandbox({ source: { type: "image", image } })`，
+ * 或写进项目 Dockerfile 的 `FROM` 继续叠加依赖。
+ */
+export declare const NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE: string;
+export declare const NICEEVAL_CODEX_DOCKER_IMAGE: string;
+export declare const NICEEVAL_BUB_DOCKER_IMAGE: string;
+export declare const NICEEVAL_OPENCODE_DOCKER_IMAGE: string;
+export declare const NICEEVAL_HERMES_DOCKER_IMAGE: string;
+export declare const NICEEVAL_OPENCLAW_DOCKER_IMAGE: string;

package/dist/sandbox/docker-agent-image.js

@@ -0,0 +1,20 @@
+import { createRequire as __niceevalCreateRequire } from "node:module";
+const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
+const __niceevalCanonical = __niceevalRequire("./docker-agent-image.cjs");
+const __niceevalExport0 = __niceevalCanonical["NICEEVAL_BUB_DOCKER_IMAGE"];
+export { __niceevalExport0 as NICEEVAL_BUB_DOCKER_IMAGE };
+const __niceevalExport1 = __niceevalCanonical["NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE"];
+export { __niceevalExport1 as NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE };
+const __niceevalExport2 = __niceevalCanonical["NICEEVAL_CODEX_DOCKER_IMAGE"];
+export { __niceevalExport2 as NICEEVAL_CODEX_DOCKER_IMAGE };
+const __niceevalExport3 = __niceevalCanonical["NICEEVAL_DOCKER_IMAGE_NAME"];
+export { __niceevalExport3 as NICEEVAL_DOCKER_IMAGE_NAME };
+const __niceevalExport4 = __niceevalCanonical["NICEEVAL_HERMES_DOCKER_IMAGE"];
+export { __niceevalExport4 as NICEEVAL_HERMES_DOCKER_IMAGE };
+const __niceevalExport5 = __niceevalCanonical["NICEEVAL_OPENCLAW_DOCKER_IMAGE"];
+export { __niceevalExport5 as NICEEVAL_OPENCLAW_DOCKER_IMAGE };
+const __niceevalExport6 = __niceevalCanonical["NICEEVAL_OPENCODE_DOCKER_IMAGE"];
+export { __niceevalExport6 as NICEEVAL_OPENCODE_DOCKER_IMAGE };
+const __niceevalExport7 = __niceevalCanonical["niceevalDockerImage"];
+export { __niceevalExport7 as niceevalDockerImage };
+//# sourceMappingURL=docker-agent-image.js.map

package/dist/sandbox/docker-agent-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-agent-image.js","sources":[],"names":[],"mappings":""}