niceeval 0.12.2-canary.31 → 0.13.0

package/dist/sandbox/layer.d.cts

@@ -1,4 +1,4 @@
-import { Effect, Option } from "effect";
+import { Effect, Option, type Scope } from "effect";
 import type { JsonValue } from "../shared/types.cjs";
 import type { ScopedFeedback } from "../shared/types.cjs";
 import type { MaterializedSandboxCase, SandboxMaterializeContext, SandboxResourceGroup, ServiceController } from "./case-types.cjs";
@@ -344,14 +344,14 @@ export interface SandboxProviderCapabilities {
 export interface SandboxProviderModule<Plan> {
     readonly id: string;
     readonly capabilities: SandboxProviderCapabilities;
-    readonly materialize: (plan: Plan, context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError>;
+    readonly materialize: (plan: Plan, context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError, Scope.Scope>;
     readonly collectBuildPreparation: (plan: Plan, published: SandboxProviderPlan, evalId: string) => Effect.Effect<Option.Option<SandboxRuntimeBuildPreparation>, SandboxRuntimeMaterializationError>;
 }
 /** 泛型已经由闭包消去的 provider binding；只有合法 constructor 产物存在于 WeakMap 中。 */
 export interface SandboxProviderBinding {
     readonly moduleId: string;
     readonly capabilities: SandboxProviderCapabilities;
-    readonly materialize: (context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError>;
+    readonly materialize: (context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError, Scope.Scope>;
     readonly collectBuildPreparation: (evalId: string) => Effect.Effect<Option.Option<SandboxRuntimeBuildPreparation>, SandboxRuntimeMaterializationError>;
 }
 /**

package/dist/sandbox/layer.d.mts

@@ -1,4 +1,4 @@
-import { Effect, Option } from "effect";
+import { Effect, Option, type Scope } from "effect";
 import type { JsonValue } from "../shared/types.mjs";
 import type { ScopedFeedback } from "../shared/types.mjs";
 import type { MaterializedSandboxCase, SandboxMaterializeContext, SandboxResourceGroup, ServiceController } from "./case-types.mjs";
@@ -344,14 +344,14 @@ export interface SandboxProviderCapabilities {
 export interface SandboxProviderModule<Plan> {
     readonly id: string;
     readonly capabilities: SandboxProviderCapabilities;
-    readonly materialize: (plan: Plan, context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError>;
+    readonly materialize: (plan: Plan, context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError, Scope.Scope>;
     readonly collectBuildPreparation: (plan: Plan, published: SandboxProviderPlan, evalId: string) => Effect.Effect<Option.Option<SandboxRuntimeBuildPreparation>, SandboxRuntimeMaterializationError>;
 }
 /** 泛型已经由闭包消去的 provider binding；只有合法 constructor 产物存在于 WeakMap 中。 */
 export interface SandboxProviderBinding {
     readonly moduleId: string;
     readonly capabilities: SandboxProviderCapabilities;
-    readonly materialize: (context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError>;
+    readonly materialize: (context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError, Scope.Scope>;
     readonly collectBuildPreparation: (evalId: string) => Effect.Effect<Option.Option<SandboxRuntimeBuildPreparation>, SandboxRuntimeMaterializationError>;
 }
 /**

package/dist/sandbox/layer.d.ts

@@ -1,4 +1,4 @@
-import { Effect, Option } from "effect";
+import { Effect, Option, type Scope } from "effect";
 import type { JsonValue } from "../shared/types.js";
 import type { ScopedFeedback } from "../shared/types.js";
 import type { MaterializedSandboxCase, SandboxMaterializeContext, SandboxResourceGroup, ServiceController } from "./case-types.js";
@@ -344,14 +344,14 @@ export interface SandboxProviderCapabilities {
 export interface SandboxProviderModule<Plan> {
     readonly id: string;
     readonly capabilities: SandboxProviderCapabilities;
-    readonly materialize: (plan: Plan, context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError>;
+    readonly materialize: (plan: Plan, context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError, Scope.Scope>;
     readonly collectBuildPreparation: (plan: Plan, published: SandboxProviderPlan, evalId: string) => Effect.Effect<Option.Option<SandboxRuntimeBuildPreparation>, SandboxRuntimeMaterializationError>;
 }
 /** 泛型已经由闭包消去的 provider binding；只有合法 constructor 产物存在于 WeakMap 中。 */
 export interface SandboxProviderBinding {
     readonly moduleId: string;
     readonly capabilities: SandboxProviderCapabilities;
-    readonly materialize: (context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError>;
+    readonly materialize: (context: SandboxRuntimeMaterializeContext) => Effect.Effect<MaterializedSandboxCase, SandboxRuntimeMaterializationError, Scope.Scope>;
     readonly collectBuildPreparation: (evalId: string) => Effect.Effect<Option.Option<SandboxRuntimeBuildPreparation>, SandboxRuntimeMaterializationError>;
 }
 /**

package/dist/sandbox/paths.cjs

@@ -4,6 +4,7 @@ exports.resolveSandboxPath = resolveSandboxPath;
 exports.resolveLocalPath = resolveLocalPath;
 exports.resolveEvalLocalPath = resolveEvalLocalPath;
 exports.normalizeSandboxPaths = normalizeSandboxPaths;
+exports.makeSandboxAuthorFacade = makeSandboxAuthorFacade;
 const node_path_1 = require("node:path");
 const node_path_2 = require("node:path");
 const node_url_1 = require("node:url");
@@ -33,6 +34,9 @@ function resolveCommandOptions(workdir, opts) {
     return { ...opts, cwd: resolveSandboxPath(workdir, opts.cwd) };
 }
 /**
+ * resource facade:不捕获 Attempt executor、不做 IO 重试,只供 registry / stop / suspend 等
+ * 内部流程与 provider backend 归一化使用。作者面的可中断请求走 makeSandboxAuthorFacade。
+ *
  * @param provider physical plan 已确定的 provider 名，只用于报错点名是谁的 SDK
  * 在超时(见 transfer-errors.ts);省略时报错说 `sandbox`,行为不变。
  */
@@ -58,38 +62,35 @@ function normalizeSandboxPaths(sandbox, provider) {
             const resolved = resolveCommandOptions(sandbox.workdir, opts);
             return (0, backend_ts_1.providerCompatibilityPromise)(async () => (0, operations_ts_1.successfulCommandResult)(await sandbox.runShell(script, resolved), resolved?.sensitiveValues));
         },
-        readText: (path) => (0, backend_ts_1.providerCompatibilityPromise)(() => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.readText(resolveSandboxPath(sandbox.workdir, path)))),
+        readText: (path) => (0, backend_ts_1.providerCompatibilityPromise)(() => sandbox.readText(resolveSandboxPath(sandbox.workdir, path))),
         writeText: (path, content) => {
             const abs = resolveSandboxPath(sandbox.workdir, path);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "writeText", path: abs, bytes: Buffer.byteLength(content) }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.writeText(abs, content))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "writeText", path: abs, bytes: Buffer.byteLength(content) }, () => sandbox.writeText(abs, content)));
         },
         readBytes: (path) => {
             const abs = resolveSandboxPath(sandbox.workdir, path);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "readBytes", path: abs }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.readBytes(abs))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "readBytes", path: abs }, () => sandbox.readBytes(abs)));
         },
         writeBytes: (path, content) => {
             const abs = resolveSandboxPath(sandbox.workdir, path);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "writeBytes", path: abs, bytes: content.byteLength }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.writeBytes(abs, content))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "writeBytes", path: abs, bytes: content.byteLength }, () => sandbox.writeBytes(abs, content)));
         },
-        pathExists: (path) => (0, backend_ts_1.providerCompatibilityPromise)(() => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.pathExists(resolveSandboxPath(sandbox.workdir, path)))),
-        // 文件传输的超时报错在这一层补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt
-        // 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。
-        // 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。
+        pathExists: (path) => (0, backend_ts_1.providerCompatibilityPromise)(() => sandbox.pathExists(resolveSandboxPath(sandbox.workdir, path))),
         uploadFile: (source, targetPath) => {
             const abs = resolveSandboxPath(sandbox.workdir, targetPath);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "uploadFile", path: abs, localPath: resolveLocalPath(undefined, source) }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.uploadFile(source, abs))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "uploadFile", path: abs, localPath: resolveLocalPath(undefined, source) }, () => sandbox.uploadFile(source, abs)));
         },
         uploadDirectory: (sourceDir, targetDir, opts) => {
             const base = resolveSandboxPath(sandbox.workdir, targetDir);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "uploadDirectory", path: base, localPath: resolveLocalPath(undefined, sourceDir) }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.uploadDirectory(sourceDir, base, opts))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "uploadDirectory", path: base, localPath: resolveLocalPath(undefined, sourceDir) }, () => sandbox.uploadDirectory(sourceDir, base, opts)));
         },
         downloadFile: (sourcePath, target) => {
             const abs = resolveSandboxPath(sandbox.workdir, sourcePath);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "downloadFile", path: abs, localPath: resolveLocalPath(undefined, target) }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.downloadFile(abs, target))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "downloadFile", path: abs, localPath: resolveLocalPath(undefined, target) }, () => sandbox.downloadFile(abs, target)));
         },
         downloadDirectory: (sourceDir, targetDir, opts) => {
             const base = resolveSandboxPath(sandbox.workdir, sourceDir);
-            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "downloadDirectory", path: base, localPath: resolveLocalPath(undefined, targetDir) }, () => (0, io_retry_ts_1.withSandboxIoRetry)(() => sandbox.downloadDirectory(base, targetDir, opts))));
+            return (0, backend_ts_1.providerCompatibilityPromise)(() => (0, transfer_errors_ts_1.withTransferErrors)({ provider, operation: "downloadDirectory", path: base, localPath: resolveLocalPath(undefined, targetDir) }, () => sandbox.downloadDirectory(base, targetDir, opts)));
         },
         stop: () => (0, backend_ts_1.providerCompatibilityPromise)(() => sandbox.stop()),
         ...(appendLog._tag === "Supported"
@@ -99,4 +100,87 @@ function normalizeSandboxPaths(sandbox, provider) {
     (0, backend_ts_1.registerSandboxCapabilities)(normalized, sandbox.capabilities);
     return normalized;
 }
+/**
+ * author facade:Attempt 作者面拿到的那份 Sandbox。所有公开方法都经 executor 作为
+ * owner Scope 子 fiber 运行(Scope 关闭统一中断);只有幂等 IO/transfer 使用 Effect 型
+ * withSandboxIoRetry,runCommand / runShell / appendLog / stop 一律不重试。路径解析在
+ * 调用点做一次;provider Promise 叶子只经 providerBoundaryEffect 适配一次,重试分类只
+ * 看到 raw provider 失败,transfer 超时 enrichment 在重试耗尽后做一次(见 transfer-errors.ts)。
+ *
+ * 文件传输的超时报错在终局失败上补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt
+ * 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。
+ * 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。
+ */
+function makeSandboxAuthorFacade(sandbox, executor, provider) {
+    const appendLog = sandbox.capabilities.appendLog;
+    const normalized = {
+        get workdir() {
+            return sandbox.workdir;
+        },
+        get sandboxId() {
+            return sandbox.sandboxId;
+        },
+        get otlpHost() {
+            return sandbox.otlpHost;
+        },
+        runCommand: (cmd, args, opts) => {
+            const resolved = resolveCommandOptions(sandbox.workdir, opts);
+            return executor.run((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.runCommand(cmd, args, resolved)));
+        },
+        runShell: (script, opts) => {
+            const resolved = resolveCommandOptions(sandbox.workdir, opts);
+            return executor.run((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.runShell(script, resolved)));
+        },
+        runCommandOrThrow: (cmd, args, opts) => {
+            const resolved = resolveCommandOptions(sandbox.workdir, opts);
+            return executor.run((0, backend_ts_1.providerBoundaryEffect)(async () => (0, operations_ts_1.successfulCommandResult)(await sandbox.runCommand(cmd, args, resolved), resolved?.sensitiveValues)));
+        },
+        runShellOrThrow: (script, opts) => {
+            const resolved = resolveCommandOptions(sandbox.workdir, opts);
+            return executor.run((0, backend_ts_1.providerBoundaryEffect)(async () => (0, operations_ts_1.successfulCommandResult)(await sandbox.runShell(script, resolved), resolved?.sensitiveValues)));
+        },
+        readText: (path) => {
+            const abs = resolveSandboxPath(sandbox.workdir, path);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.readText(abs))));
+        },
+        writeText: (path, content) => {
+            const abs = resolveSandboxPath(sandbox.workdir, path);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.writeText(abs, content))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "writeText", path: abs, bytes: Buffer.byteLength(content) })));
+        },
+        readBytes: (path) => {
+            const abs = resolveSandboxPath(sandbox.workdir, path);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.readBytes(abs))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "readBytes", path: abs })));
+        },
+        writeBytes: (path, content) => {
+            const abs = resolveSandboxPath(sandbox.workdir, path);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.writeBytes(abs, content))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "writeBytes", path: abs, bytes: content.byteLength })));
+        },
+        pathExists: (path) => {
+            const abs = resolveSandboxPath(sandbox.workdir, path);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.pathExists(abs))));
+        },
+        uploadFile: (source, targetPath) => {
+            const abs = resolveSandboxPath(sandbox.workdir, targetPath);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.uploadFile(source, abs))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "uploadFile", path: abs, localPath: resolveLocalPath(undefined, source) })));
+        },
+        uploadDirectory: (sourceDir, targetDir, opts) => {
+            const base = resolveSandboxPath(sandbox.workdir, targetDir);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.uploadDirectory(sourceDir, base, opts))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "uploadDirectory", path: base, localPath: resolveLocalPath(undefined, sourceDir) })));
+        },
+        downloadFile: (sourcePath, target) => {
+            const abs = resolveSandboxPath(sandbox.workdir, sourcePath);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.downloadFile(abs, target))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "downloadFile", path: abs, localPath: resolveLocalPath(undefined, target) })));
+        },
+        downloadDirectory: (sourceDir, targetDir, opts) => {
+            const base = resolveSandboxPath(sandbox.workdir, sourceDir);
+            return executor.run((0, io_retry_ts_1.withSandboxIoRetry)((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.downloadDirectory(base, targetDir, opts))).pipe((0, transfer_errors_ts_1.enrichTransferErrors)({ provider, operation: "downloadDirectory", path: base, localPath: resolveLocalPath(undefined, targetDir) })));
+        },
+        stop: () => executor.run((0, backend_ts_1.providerBoundaryEffect)(() => sandbox.stop())),
+        ...(appendLog._tag === "Supported"
+            ? { appendLog: (line) => executor.run((0, backend_ts_1.providerBoundaryEffect)(() => appendLog.value(line))) }
+            : {}),
+    };
+    (0, backend_ts_1.registerSandboxCapabilities)(normalized, sandbox.capabilities);
+    return normalized;
+}
 //# sourceMappingURL=paths.cjs.map

package/dist/sandbox/paths.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["paths.ts"],"names":[],"mappings":";;AAQA,gDAIC;AACD,4CAMC;AAED,oDAEC;AAUD,sDA8DC;AA/FD,yCAAkC;AAClC,yCAAgD;AAChD,uCAAyC;AAEzC,+CAAmD;AACnD,6DAA0D;AAC1D,mDAA0D;AAC1D,6CAAuH;AACvH,SAAgB,kBAAkB,CAAC,OAAe,EAAE,IAAa;IAC7D,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QACrB,OAAO,OAAO,CAAC;IACnB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AACD,SAAgB,gBAAgB,CAAC,OAA2B,EAAE,IAAkB;IAC5E,IAAI,IAAI,YAAY,GAAG;QACnB,OAAO,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,IAAA,sBAAU,EAAC,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,OAAO,IAAA,mBAAO,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AACD,+CAA+C;AAC/C,SAAgB,oBAAoB,CAAC,OAA2B,EAAE,IAAkB;IAChF,OAAO,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AACD,SAAS,qBAAqB,CAAC,OAAe,EAAE,IAAgC;IAC5E,IAAI,CAAC,IAAI,EAAE,GAAG;QACV,OAAO,IAAI,CAAC;IAChB,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AACD;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,OAA+B,EAAE,QAAgB;IACnF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;IACjD,MAAM,UAAU,GAAY;QACxB,IAAI,OAAO;YACP,OAAO,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS;YACT,OAAO,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ;YACR,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC5B,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAChJ,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACtI,iBAAiB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,IAAA,yCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,uCAAuB,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QACvJ,CAAC;QACD,eAAe,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,IAAA,yCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,uCAAuB,EAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QAClJ,CAAC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvN,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAChB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3K,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACjN,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,sDAAsD;QACtD,yDAAyD;QACzD,4CAA4C;QAC5C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrO,CAAC;QACD,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7P,CAAC;QACD,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzO,CAAC;QACD,iBAAiB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAkB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjQ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;YAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE;YAC5F,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;IACF,IAAA,wCAA2B,EAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC;AACtB,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport { isAbsolute, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { CommandOptions, Sandbox } from \"../types.ts\";\nimport { withSandboxIoRetry } from \"./io-retry.ts\";\nimport { withTransferErrors } from \"./transfer-errors.ts\";\nimport { successfulCommandResult } from \"./operations.ts\";\nimport { providerCompatibilityPromise, registerSandboxCapabilities, type SandboxProviderBackend, } from \"./backend.ts\";\nexport function resolveSandboxPath(workdir: string, path?: string): string {\n    if (!path || path === \".\")\n        return workdir;\n    return path.startsWith(\"/\") ? path : posix.join(workdir, path);\n}\nexport function resolveLocalPath(baseDir: string | undefined, path: string | URL): string {\n    if (path instanceof URL)\n        return fileURLToPath(path);\n    if (!baseDir || isAbsolute(path))\n        return path;\n    return resolve(baseDir, path);\n}\n/** Eval 作者面的宿主传输锚点：只展开相对字符串，URL 必须原样穿过视图包装。 */\nexport function resolveEvalLocalPath(baseDir: string | undefined, path: string | URL): string | URL {\n    return path instanceof URL ? path : resolveLocalPath(baseDir, path);\n}\nfunction resolveCommandOptions(workdir: string, opts: CommandOptions | undefined): CommandOptions | undefined {\n    if (!opts?.cwd)\n        return opts;\n    return { ...opts, cwd: resolveSandboxPath(workdir, opts.cwd) };\n}\n/**\n * @param provider physical plan 已确定的 provider 名，只用于报错点名是谁的 SDK\n * 在超时(见 transfer-errors.ts);省略时报错说 `sandbox`,行为不变。\n */\nexport function normalizeSandboxPaths(sandbox: SandboxProviderBackend, provider: string): Sandbox {\n    const appendLog = sandbox.capabilities.appendLog;\n    const normalized: Sandbox = {\n        get workdir() {\n            return sandbox.workdir;\n        },\n        get sandboxId() {\n            return sandbox.sandboxId;\n        },\n        get otlpHost() {\n            return sandbox.otlpHost;\n        },\n        runCommand: (cmd, args, opts) => providerCompatibilityPromise(() => sandbox.runCommand(cmd, args, resolveCommandOptions(sandbox.workdir, opts))),\n        runShell: (script, opts) => providerCompatibilityPromise(() => sandbox.runShell(script, resolveCommandOptions(sandbox.workdir, opts))),\n        runCommandOrThrow: (cmd, args, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return providerCompatibilityPromise(async () => successfulCommandResult(await sandbox.runCommand(cmd, args, resolved), resolved?.sensitiveValues));\n        },\n        runShellOrThrow: (script, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return providerCompatibilityPromise(async () => successfulCommandResult(await sandbox.runShell(script, resolved), resolved?.sensitiveValues));\n        },\n        readText: (path) => providerCompatibilityPromise(() => withSandboxIoRetry(() => sandbox.readText(resolveSandboxPath(sandbox.workdir, path)))),\n        writeText: (path, content) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"writeText\", path: abs, bytes: Buffer.byteLength(content) }, () => withSandboxIoRetry(() => sandbox.writeText(abs, content))));\n        },\n        readBytes: (path) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"readBytes\", path: abs }, () => withSandboxIoRetry(() => sandbox.readBytes(abs))));\n        },\n        writeBytes: (path, content) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"writeBytes\", path: abs, bytes: content.byteLength }, () => withSandboxIoRetry(() => sandbox.writeBytes(abs, content))));\n        },\n        pathExists: (path) => providerCompatibilityPromise(() => withSandboxIoRetry(() => sandbox.pathExists(resolveSandboxPath(sandbox.workdir, path)))),\n        // 文件传输的超时报错在这一层补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt\n        // 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。\n        // 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。\n        uploadFile: (source, targetPath) => {\n            const abs = resolveSandboxPath(sandbox.workdir, targetPath);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"uploadFile\", path: abs, localPath: resolveLocalPath(undefined, source) }, () => withSandboxIoRetry(() => sandbox.uploadFile(source, abs))));\n        },\n        uploadDirectory: (sourceDir, targetDir, opts) => {\n            const base = resolveSandboxPath(sandbox.workdir, targetDir);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"uploadDirectory\", path: base, localPath: resolveLocalPath(undefined, sourceDir) }, () => withSandboxIoRetry(() => sandbox.uploadDirectory(sourceDir, base, opts))));\n        },\n        downloadFile: (sourcePath, target) => {\n            const abs = resolveSandboxPath(sandbox.workdir, sourcePath);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"downloadFile\", path: abs, localPath: resolveLocalPath(undefined, target) }, () => withSandboxIoRetry(() => sandbox.downloadFile(abs, target))));\n        },\n        downloadDirectory: (sourceDir, targetDir, opts) => {\n            const base = resolveSandboxPath(sandbox.workdir, sourceDir);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"downloadDirectory\", path: base, localPath: resolveLocalPath(undefined, targetDir) }, () => withSandboxIoRetry(() => sandbox.downloadDirectory(base, targetDir, opts))));\n        },\n        stop: () => providerCompatibilityPromise(() => sandbox.stop()),\n        ...(appendLog._tag === \"Supported\"\n            ? { appendLog: (line: string) => providerCompatibilityPromise(() => appendLog.value(line)) }\n            : {}),\n    };\n    registerSandboxCapabilities(normalized, sandbox.capabilities);\n    return normalized;\n}\n"]}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["paths.ts"],"names":[],"mappings":";;AASA,gDAIC;AACD,4CAMC;AAED,oDAEC;AAaD,sDA2DC;AAYD,0DAuEC;AAnLD,yCAAkC;AAClC,yCAAgD;AAChD,uCAAyC;AAEzC,+CAAmD;AACnD,6DAAgF;AAChF,mDAA0D;AAC1D,6CAA+I;AAE/I,SAAgB,kBAAkB,CAAC,OAAe,EAAE,IAAa;IAC7D,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QACrB,OAAO,OAAO,CAAC;IACnB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AACD,SAAgB,gBAAgB,CAAC,OAA2B,EAAE,IAAkB;IAC5E,IAAI,IAAI,YAAY,GAAG;QACnB,OAAO,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,IAAA,sBAAU,EAAC,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,OAAO,IAAA,mBAAO,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AACD,+CAA+C;AAC/C,SAAgB,oBAAoB,CAAC,OAA2B,EAAE,IAAkB;IAChF,OAAO,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AACD,SAAS,qBAAqB,CAAC,OAAe,EAAE,IAAgC;IAC5E,IAAI,CAAC,IAAI,EAAE,GAAG;QACV,OAAO,IAAI,CAAC;IAChB,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AACD;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,OAA+B,EAAE,QAAgB;IACnF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;IACjD,MAAM,UAAU,GAAY;QACxB,IAAI,OAAO;YACP,OAAO,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS;YACT,OAAO,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ;YACR,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC5B,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAChJ,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACtI,iBAAiB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,IAAA,yCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,uCAAuB,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QACvJ,CAAC;QACD,eAAe,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,IAAA,yCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,uCAAuB,EAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QAClJ,CAAC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACnH,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7L,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAChB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjJ,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvL,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACvH,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3M,CAAC;QACD,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnO,CAAC;QACD,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/M,CAAC;QACD,iBAAiB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,IAAA,uCAAkB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACvO,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;YAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,yCAA4B,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE;YAC5F,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;IACF,IAAA,wCAA2B,EAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC;AACtB,CAAC;AACD;;;;;;;;;;GAUG;AACH,SAAgB,uBAAuB,CAAC,OAA+B,EAAE,QAAgC,EAAE,QAAgB;IACvH,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;IACjD,MAAM,UAAU,GAAY;QACxB,IAAI,OAAO;YACP,OAAO,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS;YACT,OAAO,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ;YACR,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC5B,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,iBAAiB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAsB,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,uCAAuB,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/J,CAAC;QACD,eAAe,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAsB,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,uCAAuB,EAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1J,CAAC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1N,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAChB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9K,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QACpN,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACjB,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxO,CAAC;QACD,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChQ,CAAC;QACD,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5O,CAAC;QACD,iBAAiB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAA,gCAAkB,EAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yCAAoB,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpQ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;YAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAsB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACpG,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;IACF,IAAA,wCAA2B,EAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC;AACtB,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport { isAbsolute, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { CommandOptions, Sandbox } from \"../types.ts\";\nimport { withSandboxIoRetry } from \"./io-retry.ts\";\nimport { enrichTransferErrors, withTransferErrors } from \"./transfer-errors.ts\";\nimport { successfulCommandResult } from \"./operations.ts\";\nimport { providerBoundaryEffect, providerCompatibilityPromise, registerSandboxCapabilities, type SandboxProviderBackend, } from \"./backend.ts\";\nimport type { SandboxRequestExecutor } from \"./request-executor.ts\";\nexport function resolveSandboxPath(workdir: string, path?: string): string {\n    if (!path || path === \".\")\n        return workdir;\n    return path.startsWith(\"/\") ? path : posix.join(workdir, path);\n}\nexport function resolveLocalPath(baseDir: string | undefined, path: string | URL): string {\n    if (path instanceof URL)\n        return fileURLToPath(path);\n    if (!baseDir || isAbsolute(path))\n        return path;\n    return resolve(baseDir, path);\n}\n/** Eval 作者面的宿主传输锚点：只展开相对字符串，URL 必须原样穿过视图包装。 */\nexport function resolveEvalLocalPath(baseDir: string | undefined, path: string | URL): string | URL {\n    return path instanceof URL ? path : resolveLocalPath(baseDir, path);\n}\nfunction resolveCommandOptions(workdir: string, opts: CommandOptions | undefined): CommandOptions | undefined {\n    if (!opts?.cwd)\n        return opts;\n    return { ...opts, cwd: resolveSandboxPath(workdir, opts.cwd) };\n}\n/**\n * resource facade:不捕获 Attempt executor、不做 IO 重试,只供 registry / stop / suspend 等\n * 内部流程与 provider backend 归一化使用。作者面的可中断请求走 makeSandboxAuthorFacade。\n *\n * @param provider physical plan 已确定的 provider 名，只用于报错点名是谁的 SDK\n * 在超时(见 transfer-errors.ts);省略时报错说 `sandbox`,行为不变。\n */\nexport function normalizeSandboxPaths(sandbox: SandboxProviderBackend, provider: string): Sandbox {\n    const appendLog = sandbox.capabilities.appendLog;\n    const normalized: Sandbox = {\n        get workdir() {\n            return sandbox.workdir;\n        },\n        get sandboxId() {\n            return sandbox.sandboxId;\n        },\n        get otlpHost() {\n            return sandbox.otlpHost;\n        },\n        runCommand: (cmd, args, opts) => providerCompatibilityPromise(() => sandbox.runCommand(cmd, args, resolveCommandOptions(sandbox.workdir, opts))),\n        runShell: (script, opts) => providerCompatibilityPromise(() => sandbox.runShell(script, resolveCommandOptions(sandbox.workdir, opts))),\n        runCommandOrThrow: (cmd, args, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return providerCompatibilityPromise(async () => successfulCommandResult(await sandbox.runCommand(cmd, args, resolved), resolved?.sensitiveValues));\n        },\n        runShellOrThrow: (script, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return providerCompatibilityPromise(async () => successfulCommandResult(await sandbox.runShell(script, resolved), resolved?.sensitiveValues));\n        },\n        readText: (path) => providerCompatibilityPromise(() => sandbox.readText(resolveSandboxPath(sandbox.workdir, path))),\n        writeText: (path, content) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"writeText\", path: abs, bytes: Buffer.byteLength(content) }, () => sandbox.writeText(abs, content)));\n        },\n        readBytes: (path) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"readBytes\", path: abs }, () => sandbox.readBytes(abs)));\n        },\n        writeBytes: (path, content) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"writeBytes\", path: abs, bytes: content.byteLength }, () => sandbox.writeBytes(abs, content)));\n        },\n        pathExists: (path) => providerCompatibilityPromise(() => sandbox.pathExists(resolveSandboxPath(sandbox.workdir, path))),\n        uploadFile: (source, targetPath) => {\n            const abs = resolveSandboxPath(sandbox.workdir, targetPath);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"uploadFile\", path: abs, localPath: resolveLocalPath(undefined, source) }, () => sandbox.uploadFile(source, abs)));\n        },\n        uploadDirectory: (sourceDir, targetDir, opts) => {\n            const base = resolveSandboxPath(sandbox.workdir, targetDir);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"uploadDirectory\", path: base, localPath: resolveLocalPath(undefined, sourceDir) }, () => sandbox.uploadDirectory(sourceDir, base, opts)));\n        },\n        downloadFile: (sourcePath, target) => {\n            const abs = resolveSandboxPath(sandbox.workdir, sourcePath);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"downloadFile\", path: abs, localPath: resolveLocalPath(undefined, target) }, () => sandbox.downloadFile(abs, target)));\n        },\n        downloadDirectory: (sourceDir, targetDir, opts) => {\n            const base = resolveSandboxPath(sandbox.workdir, sourceDir);\n            return providerCompatibilityPromise(() => withTransferErrors({ provider, operation: \"downloadDirectory\", path: base, localPath: resolveLocalPath(undefined, targetDir) }, () => sandbox.downloadDirectory(base, targetDir, opts)));\n        },\n        stop: () => providerCompatibilityPromise(() => sandbox.stop()),\n        ...(appendLog._tag === \"Supported\"\n            ? { appendLog: (line: string) => providerCompatibilityPromise(() => appendLog.value(line)) }\n            : {}),\n    };\n    registerSandboxCapabilities(normalized, sandbox.capabilities);\n    return normalized;\n}\n/**\n * author facade:Attempt 作者面拿到的那份 Sandbox。所有公开方法都经 executor 作为\n * owner Scope 子 fiber 运行(Scope 关闭统一中断);只有幂等 IO/transfer 使用 Effect 型\n * withSandboxIoRetry,runCommand / runShell / appendLog / stop 一律不重试。路径解析在\n * 调用点做一次;provider Promise 叶子只经 providerBoundaryEffect 适配一次,重试分类只\n * 看到 raw provider 失败,transfer 超时 enrichment 在重试耗尽后做一次(见 transfer-errors.ts)。\n *\n * 文件传输的超时报错在终局失败上补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt\n * 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。\n * 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。\n */\nexport function makeSandboxAuthorFacade(sandbox: SandboxProviderBackend, executor: SandboxRequestExecutor, provider: string): Sandbox {\n    const appendLog = sandbox.capabilities.appendLog;\n    const normalized: Sandbox = {\n        get workdir() {\n            return sandbox.workdir;\n        },\n        get sandboxId() {\n            return sandbox.sandboxId;\n        },\n        get otlpHost() {\n            return sandbox.otlpHost;\n        },\n        runCommand: (cmd, args, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return executor.run(providerBoundaryEffect(() => sandbox.runCommand(cmd, args, resolved)));\n        },\n        runShell: (script, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return executor.run(providerBoundaryEffect(() => sandbox.runShell(script, resolved)));\n        },\n        runCommandOrThrow: (cmd, args, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return executor.run(providerBoundaryEffect(async () => successfulCommandResult(await sandbox.runCommand(cmd, args, resolved), resolved?.sensitiveValues)));\n        },\n        runShellOrThrow: (script, opts) => {\n            const resolved = resolveCommandOptions(sandbox.workdir, opts);\n            return executor.run(providerBoundaryEffect(async () => successfulCommandResult(await sandbox.runShell(script, resolved), resolved?.sensitiveValues)));\n        },\n        readText: (path) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.readText(abs))));\n        },\n        writeText: (path, content) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.writeText(abs, content))).pipe(enrichTransferErrors({ provider, operation: \"writeText\", path: abs, bytes: Buffer.byteLength(content) })));\n        },\n        readBytes: (path) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.readBytes(abs))).pipe(enrichTransferErrors({ provider, operation: \"readBytes\", path: abs })));\n        },\n        writeBytes: (path, content) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.writeBytes(abs, content))).pipe(enrichTransferErrors({ provider, operation: \"writeBytes\", path: abs, bytes: content.byteLength })));\n        },\n        pathExists: (path) => {\n            const abs = resolveSandboxPath(sandbox.workdir, path);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.pathExists(abs))));\n        },\n        uploadFile: (source, targetPath) => {\n            const abs = resolveSandboxPath(sandbox.workdir, targetPath);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.uploadFile(source, abs))).pipe(enrichTransferErrors({ provider, operation: \"uploadFile\", path: abs, localPath: resolveLocalPath(undefined, source) })));\n        },\n        uploadDirectory: (sourceDir, targetDir, opts) => {\n            const base = resolveSandboxPath(sandbox.workdir, targetDir);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.uploadDirectory(sourceDir, base, opts))).pipe(enrichTransferErrors({ provider, operation: \"uploadDirectory\", path: base, localPath: resolveLocalPath(undefined, sourceDir) })));\n        },\n        downloadFile: (sourcePath, target) => {\n            const abs = resolveSandboxPath(sandbox.workdir, sourcePath);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.downloadFile(abs, target))).pipe(enrichTransferErrors({ provider, operation: \"downloadFile\", path: abs, localPath: resolveLocalPath(undefined, target) })));\n        },\n        downloadDirectory: (sourceDir, targetDir, opts) => {\n            const base = resolveSandboxPath(sandbox.workdir, sourceDir);\n            return executor.run(withSandboxIoRetry(providerBoundaryEffect(() => sandbox.downloadDirectory(base, targetDir, opts))).pipe(enrichTransferErrors({ provider, operation: \"downloadDirectory\", path: base, localPath: resolveLocalPath(undefined, targetDir) })));\n        },\n        stop: () => executor.run(providerBoundaryEffect(() => sandbox.stop())),\n        ...(appendLog._tag === \"Supported\"\n            ? { appendLog: (line: string) => executor.run(providerBoundaryEffect(() => appendLog.value(line))) }\n            : {}),\n    };\n    registerSandboxCapabilities(normalized, sandbox.capabilities);\n    return normalized;\n}\n"]}

package/dist/sandbox/paths.d.cts

@@ -1,11 +1,27 @@
 import type { Sandbox } from "../types.cjs";
 import { type SandboxProviderBackend } from "./backend.cjs";
+import type { SandboxRequestExecutor } from "./request-executor.cjs";
 export declare function resolveSandboxPath(workdir: string, path?: string): string;
 export declare function resolveLocalPath(baseDir: string | undefined, path: string | URL): string;
 /** Eval 作者面的宿主传输锚点：只展开相对字符串，URL 必须原样穿过视图包装。 */
 export declare function resolveEvalLocalPath(baseDir: string | undefined, path: string | URL): string | URL;
 /**
+ * resource facade:不捕获 Attempt executor、不做 IO 重试,只供 registry / stop / suspend 等
+ * 内部流程与 provider backend 归一化使用。作者面的可中断请求走 makeSandboxAuthorFacade。
+ *
  * @param provider physical plan 已确定的 provider 名，只用于报错点名是谁的 SDK
  * 在超时(见 transfer-errors.ts);省略时报错说 `sandbox`,行为不变。
  */
 export declare function normalizeSandboxPaths(sandbox: SandboxProviderBackend, provider: string): Sandbox;
+/**
+ * author facade:Attempt 作者面拿到的那份 Sandbox。所有公开方法都经 executor 作为
+ * owner Scope 子 fiber 运行(Scope 关闭统一中断);只有幂等 IO/transfer 使用 Effect 型
+ * withSandboxIoRetry,runCommand / runShell / appendLog / stop 一律不重试。路径解析在
+ * 调用点做一次;provider Promise 叶子只经 providerBoundaryEffect 适配一次,重试分类只
+ * 看到 raw provider 失败,transfer 超时 enrichment 在重试耗尽后做一次(见 transfer-errors.ts)。
+ *
+ * 文件传输的超时报错在终局失败上补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt
+ * 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。
+ * 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。
+ */
+export declare function makeSandboxAuthorFacade(sandbox: SandboxProviderBackend, executor: SandboxRequestExecutor, provider: string): Sandbox;

package/dist/sandbox/paths.d.mts

@@ -1,11 +1,27 @@
 import type { Sandbox } from "../types.mjs";
 import { type SandboxProviderBackend } from "./backend.mjs";
+import type { SandboxRequestExecutor } from "./request-executor.mjs";
 export declare function resolveSandboxPath(workdir: string, path?: string): string;
 export declare function resolveLocalPath(baseDir: string | undefined, path: string | URL): string;
 /** Eval 作者面的宿主传输锚点：只展开相对字符串，URL 必须原样穿过视图包装。 */
 export declare function resolveEvalLocalPath(baseDir: string | undefined, path: string | URL): string | URL;
 /**
+ * resource facade:不捕获 Attempt executor、不做 IO 重试,只供 registry / stop / suspend 等
+ * 内部流程与 provider backend 归一化使用。作者面的可中断请求走 makeSandboxAuthorFacade。
+ *
  * @param provider physical plan 已确定的 provider 名，只用于报错点名是谁的 SDK
  * 在超时(见 transfer-errors.ts);省略时报错说 `sandbox`,行为不变。
  */
 export declare function normalizeSandboxPaths(sandbox: SandboxProviderBackend, provider: string): Sandbox;
+/**
+ * author facade:Attempt 作者面拿到的那份 Sandbox。所有公开方法都经 executor 作为
+ * owner Scope 子 fiber 运行(Scope 关闭统一中断);只有幂等 IO/transfer 使用 Effect 型
+ * withSandboxIoRetry,runCommand / runShell / appendLog / stop 一律不重试。路径解析在
+ * 调用点做一次;provider Promise 叶子只经 providerBoundaryEffect 适配一次,重试分类只
+ * 看到 raw provider 失败,transfer 超时 enrichment 在重试耗尽后做一次(见 transfer-errors.ts)。
+ *
+ * 文件传输的超时报错在终局失败上补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt
+ * 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。
+ * 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。
+ */
+export declare function makeSandboxAuthorFacade(sandbox: SandboxProviderBackend, executor: SandboxRequestExecutor, provider: string): Sandbox;

package/dist/sandbox/paths.d.ts

@@ -1,11 +1,27 @@
 import type { Sandbox } from "../types.js";
 import { type SandboxProviderBackend } from "./backend.js";
+import type { SandboxRequestExecutor } from "./request-executor.js";
 export declare function resolveSandboxPath(workdir: string, path?: string): string;
 export declare function resolveLocalPath(baseDir: string | undefined, path: string | URL): string;
 /** Eval 作者面的宿主传输锚点：只展开相对字符串，URL 必须原样穿过视图包装。 */
 export declare function resolveEvalLocalPath(baseDir: string | undefined, path: string | URL): string | URL;
 /**
+ * resource facade:不捕获 Attempt executor、不做 IO 重试,只供 registry / stop / suspend 等
+ * 内部流程与 provider backend 归一化使用。作者面的可中断请求走 makeSandboxAuthorFacade。
+ *
  * @param provider physical plan 已确定的 provider 名，只用于报错点名是谁的 SDK
  * 在超时(见 transfer-errors.ts);省略时报错说 `sandbox`,行为不变。
  */
 export declare function normalizeSandboxPaths(sandbox: SandboxProviderBackend, provider: string): Sandbox;
+/**
+ * author facade:Attempt 作者面拿到的那份 Sandbox。所有公开方法都经 executor 作为
+ * owner Scope 子 fiber 运行(Scope 关闭统一中断);只有幂等 IO/transfer 使用 Effect 型
+ * withSandboxIoRetry,runCommand / runShell / appendLog / stop 一律不重试。路径解析在
+ * 调用点做一次;provider Promise 叶子只经 providerBoundaryEffect 适配一次,重试分类只
+ * 看到 raw provider 失败,transfer 超时 enrichment 在重试耗尽后做一次(见 transfer-errors.ts)。
+ *
+ * 文件传输的超时报错在终局失败上补齐三要素(操作名 / 对象 / 这是 SDK 往返超时而非 attempt
+ * 预算):provider 各家 SDK 抛的裸超时串没有任何上下文,读到它的人会跑去调 --timeout。
+ * 只有超时形态被改写,其它错误原样上抛(见 transfer-errors.ts)。
+ */
+export declare function makeSandboxAuthorFacade(sandbox: SandboxProviderBackend, executor: SandboxRequestExecutor, provider: string): Sandbox;

package/dist/sandbox/paths.js

@@ -1,12 +1,14 @@
 import { createRequire as __niceevalCreateRequire } from "node:module";
 const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
 const __niceevalCanonical = __niceevalRequire("./paths.cjs");
-const __niceevalExport0 = __niceevalCanonical["normalizeSandboxPaths"];
-export { __niceevalExport0 as normalizeSandboxPaths };
-const __niceevalExport1 = __niceevalCanonical["resolveEvalLocalPath"];
-export { __niceevalExport1 as resolveEvalLocalPath };
-const __niceevalExport2 = __niceevalCanonical["resolveLocalPath"];
-export { __niceevalExport2 as resolveLocalPath };
-const __niceevalExport3 = __niceevalCanonical["resolveSandboxPath"];
-export { __niceevalExport3 as resolveSandboxPath };
+const __niceevalExport0 = __niceevalCanonical["makeSandboxAuthorFacade"];
+export { __niceevalExport0 as makeSandboxAuthorFacade };
+const __niceevalExport1 = __niceevalCanonical["normalizeSandboxPaths"];
+export { __niceevalExport1 as normalizeSandboxPaths };
+const __niceevalExport2 = __niceevalCanonical["resolveEvalLocalPath"];
+export { __niceevalExport2 as resolveEvalLocalPath };
+const __niceevalExport3 = __niceevalCanonical["resolveLocalPath"];
+export { __niceevalExport3 as resolveLocalPath };
+const __niceevalExport4 = __niceevalCanonical["resolveSandboxPath"];
+export { __niceevalExport4 as resolveSandboxPath };
 //# sourceMappingURL=paths.js.map

package/dist/sandbox/prepare-commands.cjs

@@ -12,7 +12,6 @@ const node_path_1 = require("node:path");
 const commands_ts_1 = require("./commands.cjs");
 const operations_ts_1 = require("./operations.cjs");
 const CHECKOUT_CACHE_ROOT = "/tmp/niceeval-checkout-cache";
-const CHECKOUT_FACT_PREFIX = "sandbox.checkout";
 function assertPlainRecord(value, path) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new TypeError(`${path} must be an object`);
@@ -119,9 +118,6 @@ function identityValue(identity) {
 function checkoutCachePath(repo, ref) {
     return `${CHECKOUT_CACHE_ROOT}/${sha256(JSON.stringify([repo, ref]))}`;
 }
-function checkoutFactKey(repo, ref) {
-    return `${CHECKOUT_FACT_PREFIX}.${sha256(JSON.stringify([repo, ref])).slice(0, 16)}.commit`;
-}
 function targetPath(workdir, into) {
     const normalizedWorkdir = node_path_1.posix.resolve(workdir);
     const target = node_path_1.posix.resolve(normalizedWorkdir, into);
@@ -200,7 +196,6 @@ function checkout(options) {
         const cachedCommit = await mirrorMatches(sandbox, cachePath, normalized.repo, normalized.ref);
         const commit = cachedCommit ?? await recreateMirror(sandbox, cachePath, normalized.repo, normalized.ref);
         await materializeCheckout(sandbox, cachePath, targetPath(sandbox.workdir, normalized.into), commit);
-        context.facts(checkoutFactKey(normalized.repo, normalized.ref), commit);
     });
 }
 async function probeTool(probe, sandbox, context) {

package/dist/sandbox/prepare-commands.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"prepare-commands.js","sourceRoot":"","sources":["prepare-commands.ts"],"names":[],"mappings":";;AAwNA,4BAcC;AA0BD,kCAgDC;AAhTD,uDAAuD;AACvD,EAAE;AACF,wEAAwE;AACxE,yCAAyC;AACzC,2CAA2C;AAC3C,6CAAyC;AACzC,yCAAkC;AAClC,+CAAiT;AACjT,mDAA0D;AAoB1D,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IAC1D,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAyC,EAAE,OAA4B,EAAE,IAAY;IACzG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,mBAAmB,CAAC,CAAC;IAC/D,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1F,MAAM,IAAI,SAAS,CAAC,4GAA4G,CAAC,CAAC;QACtI,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;YAC/E,MAAM,KAAK,CAAC;QAChB,uFAAuF;QACvF,wCAAwC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,GAAG,CAAC;IACf,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,iBAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,iBAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AACD,SAAS,wBAAwB,CAAC,KAAc;IAK5C,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7C,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;QACtD,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;AACP,CAAC;AACD,SAAS,2BAA2B,CAAC,KAAc;IAQ/C,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAChD,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,KAAK,KAAK,UAAU;QAC7C,CAAC,CAAC,IAAA,sCAAwB,EAAC,KAA6B,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,eAAe,GAAG,OAAO,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAA,sCAAwB,EAAC,OAA+B,CAAC;QAC3D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CAAC,6GAA6G,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,+GAA+G,CAAC,CAAC;IACzI,CAAC;IACD,+FAA+F;IAC/F,gGAAgG;IAChG,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAC5D,QAAQ,EAAE,KAAK,CAAC,QAAuC;QACvD,KAAK,EAAE,KAA6B;QACpC,OAAO,EAAE,OAA+B;QACxC,aAAa;QACb,eAAe;KAClB,CAAC,CAAC;AACP,CAAC;AACD,SAAS,MAAM,CAAC,KAAa;IACzB,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AACD,SAAS,aAAa,CAAC,QAAgC;IACnD,OAAO;QACH,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;KAC1B,CAAC;AACN,CAAC;AACD,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAW;IAChD,OAAO,GAAG,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AACD,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW;IAC9C,OAAO,GAAG,oBAAoB,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;AAChG,CAAC;AACD,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC7C,MAAM,iBAAiB,GAAG,iBAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,iBAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,iBAAiB,KAAK,GAAG;QAC7C,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,eAAe,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,IAAuB;IAC/E,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,OAA6B,EAAE,MAAc,EAAE,GAAW;IACpF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;QACxC,aAAa,MAAM,EAAE;QACrB,WAAW;QACX,UAAU;QACV,SAAS;QACT,GAAG,GAAG,WAAW;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,MAAc,EAAE,IAAY,EAAE,GAAW;IACjG,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,MAAM,EAAE,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxG,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QACpD,OAAO,SAAS,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI;QACtD,OAAO,SAAS,CAAC;IACrB,OAAO,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,OAA6B,EAAE,MAAc,EAAE,IAAY,EAAE,GAAW;IAClG,8FAA8F;IAC9F,4FAA4F;IAC5F,eAAe;IACf,MAAM,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC;QACjH,MAAM,IAAI,uCAAuB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,KAAK,UAAU,mBAAmB,CAAC,OAA6B,EAAE,MAAc,EAAE,WAAmB,EAAE,MAAc;IACjH,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/E,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IACxH,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACtH,CAAC;AACD;;;GAGG;AACH,SAAgB,QAAQ,CAAC,OAAwB;IAC7C,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAA,kCAAoB,EAAC;QACxB,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,UAAU;KACrB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,sBAAsB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,YAAY,IAAI,MAAM,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACzG,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACpG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC;AACD,KAAK,UAAU,SAAS,CAAC,KAA2B,EAAE,OAA6B,EAAE,OAA8B;IAC/G,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,KAAc,EAAE,CAAC;QACpB,6FAA6F;QAC7F,4FAA4F;QAC5F,sBAAsB;QACtB,IAAI,KAAK,YAAY,uCAAuB;YACxC,OAAO,MAAM,CAAC;QAClB,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AACD,MAAM,uBAAwB,SAAQ,KAAK;IAC9B,IAAI,GAAG,6BAAsC,CAAC;IACvD,YAAY,IAAY;QACpB,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IAC1C,CAAC;CACJ;AACD;;;GAGG;AACH,SAAgB,WAAW,CAAC,OAA2B;IACnD,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAA2B,IAAA,kCAAoB,EAAC,UAAU,CAAC,KAAK,CAAC,IAAI;QAChF,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACJ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,6DAA6D;SACzE;KACJ,CAAC;IACF,MAAM,WAAW,GAA2B,IAAA,kCAAoB,EAAC,UAAU,CAAC,OAAO,CAAC,IAAI;QACpF,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACJ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,iEAAiE;SAC7E;KACJ,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,uBAAuB;KACrD,CAAC,CAAC;IACH,OAAO,IAAA,yCAA2B,EAAC;QAC/B,EAAE,EAAE,+BAA+B;QACnC,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE;YACJ,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC;YAC9C,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC;SACrD;KACJ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK;YAC7D,OAAO;QACX,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;YACjE,MAAM,IAAI,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACL,CAAC,EAAE;QACC,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG;QACxD,QAAQ,EAAE;YACN,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE;YAChC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;YAC1D,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;SAC3D;KACJ,CAAC,CAAC;AACP,CAAC","sourcesContent":["// 官方 prepare 命令:把常见的「检查→必要时执行→复检」收敛为稳定 SandboxCommand。\n//\n// 这里不认识 Layer、Provider 或复用调度。checkout/installTool 都只是普通 stable command:\n// runner 仍按 owner 的 prepare 顺序执行它们。契约单源:\n// docs/feature/sandbox/prepare-commands.md\nimport { createHash } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport { defineSandboxCommand, definePlannedSandboxCommand, sandboxCommandPlanOf, sandboxCommandIdentityOf, type SandboxCommandContext, type SandboxCommandIdentity, type SandboxCommandIdentityValue, type SandboxCommandPlanNode, type SandboxCommandTarget, type StableSandboxCommand, } from \"./commands.ts\";\nimport { SandboxCommandExitError } from \"./operations.ts\";\nimport type { CommandResult } from \"./types.ts\";\nexport interface CheckoutOptions {\n    /** Git remote;HTTP(S) URL 中的 userinfo / query / fragment 一律拒绝，凭据只走 Git 原生机制。 */\n    readonly repo: string;\n    /** commit SHA 或 tag 等 Git revision；运行时解析出的 commit SHA 会作为事实记录。 */\n    readonly ref: string;\n    /** 相对 workdir 的目标目录；省略或 `.` 就是 workdir 根。 */\n    readonly into?: string;\n}\nexport interface InstallToolOptions {\n    /** 人可读、也进入 identity 的工具名；不从命令文本猜测。 */\n    readonly tool: string;\n    /** 作者声明的纯数据版本 / 来源 identity。 */\n    readonly identity: SandboxCommandIdentityValue;\n    /** 零退出表示命中；非零退出表示未命中。 */\n    readonly probe: StableSandboxCommand;\n    /** 只在 probe 未命中时执行。 */\n    readonly install: StableSandboxCommand;\n}\nconst CHECKOUT_CACHE_ROOT = \"/tmp/niceeval-checkout-cache\";\nconst CHECKOUT_FACT_PREFIX = \"sandbox.checkout\";\nfunction assertPlainRecord(value: unknown, path: string): asserts value is globalThis.Record<string, unknown> {\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n        throw new TypeError(`${path} must be an object`);\n    }\n    const prototype = Object.getPrototypeOf(value);\n    if (prototype !== Object.prototype && prototype !== null) {\n        throw new TypeError(`${path} must be a plain object`);\n    }\n}\nfunction assertOnlyKeys(value: globalThis.Record<string, unknown>, allowed: ReadonlySet<string>, path: string): void {\n    for (const key of Object.keys(value)) {\n        if (!allowed.has(key))\n            throw new TypeError(`${path}.${key} is not supported`);\n    }\n}\nfunction nonEmptyString(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\") {\n        throw new TypeError(`${path} must be a non-empty string`);\n    }\n    if (/[\\x00-\\x1f\\x7f]/.test(value)) {\n        throw new TypeError(`${path} must not contain control characters`);\n    }\n    return value;\n}\nfunction normalizeRepo(value: unknown): string {\n    const repo = nonEmptyString(value, \"checkout options.repo\");\n    try {\n        const url = new URL(repo);\n        if (url.password || (url.protocol === \"http:\" || url.protocol === \"https:\") && url.username) {\n            throw new TypeError(\"checkout options.repo must not embed credentials; configure Git credentials in the host or Sandbox instead\");\n        }\n        if (url.search || url.hash) {\n            throw new TypeError(\"checkout options.repo must not include a query or fragment\");\n        }\n    }\n    catch (error) {\n        if (error instanceof TypeError && error.message.startsWith(\"checkout options.repo\"))\n            throw error;\n        // SCP-style remotes (`git@host:owner/repo.git`) and local paths are valid Git remotes,\n        // but are intentionally not URL-parsed.\n    }\n    return repo;\n}\nfunction normalizeInto(value: unknown): string {\n    if (value === undefined)\n        return \".\";\n    const into = nonEmptyString(value, \"checkout options.into\");\n    if (posix.isAbsolute(into)) {\n        throw new TypeError(\"checkout options.into must be relative to the Sandbox workdir\");\n    }\n    const normalized = posix.normalize(into);\n    if (normalized === \"..\" || normalized.startsWith(\"../\")) {\n        throw new TypeError(\"checkout options.into must not escape the Sandbox workdir\");\n    }\n    return normalized;\n}\nfunction normalizeCheckoutOptions(value: unknown): Readonly<{\n    repo: string;\n    ref: string;\n    into: string;\n}> {\n    assertPlainRecord(value, \"checkout options\");\n    assertOnlyKeys(value, new Set([\"repo\", \"ref\", \"into\"]), \"checkout options\");\n    return Object.freeze({\n        repo: normalizeRepo(value.repo),\n        ref: nonEmptyString(value.ref, \"checkout options.ref\"),\n        into: normalizeInto(value.into),\n    });\n}\nfunction normalizeInstallToolOptions(value: unknown): Readonly<{\n    tool: string;\n    identity: SandboxCommandIdentityValue;\n    probe: StableSandboxCommand;\n    install: StableSandboxCommand;\n    probeIdentity: SandboxCommandIdentity;\n    installIdentity: SandboxCommandIdentity;\n}> {\n    assertPlainRecord(value, \"installTool options\");\n    assertOnlyKeys(value, new Set([\"tool\", \"identity\", \"probe\", \"install\"]), \"installTool options\");\n    const probe = value.probe;\n    const install = value.install;\n    const probeIdentity = typeof probe === \"function\"\n        ? sandboxCommandIdentityOf(probe as StableSandboxCommand)\n        : undefined;\n    const installIdentity = typeof install === \"function\"\n        ? sandboxCommandIdentityOf(install as StableSandboxCommand)\n        : undefined;\n    if (!probeIdentity) {\n        throw new TypeError(\"installTool options.probe must be a StableSandboxCommand from command(), shell(), or defineSandboxCommand()\");\n    }\n    if (!installIdentity) {\n        throw new TypeError(\"installTool options.install must be a StableSandboxCommand from command(), shell(), or defineSandboxCommand()\");\n    }\n    // defineSandboxCommand owns the recursive JSON-content validation and frozen snapshot. Keeping\n    // this raw value here prevents a second, subtly different identity grammar at this public edge.\n    return Object.freeze({\n        tool: nonEmptyString(value.tool, \"installTool options.tool\"),\n        identity: value.identity as SandboxCommandIdentityValue,\n        probe: probe as StableSandboxCommand,\n        install: install as StableSandboxCommand,\n        probeIdentity,\n        installIdentity,\n    });\n}\nfunction sha256(value: string): string {\n    return createHash(\"sha256\").update(value).digest(\"hex\");\n}\nfunction identityValue(identity: SandboxCommandIdentity): SandboxCommandIdentityValue {\n    return {\n        id: identity.id,\n        revision: identity.revision,\n        inputs: identity.inputs,\n    };\n}\nfunction checkoutCachePath(repo: string, ref: string): string {\n    return `${CHECKOUT_CACHE_ROOT}/${sha256(JSON.stringify([repo, ref]))}`;\n}\nfunction checkoutFactKey(repo: string, ref: string): string {\n    return `${CHECKOUT_FACT_PREFIX}.${sha256(JSON.stringify([repo, ref])).slice(0, 16)}.commit`;\n}\nfunction targetPath(workdir: string, into: string): string {\n    const normalizedWorkdir = posix.resolve(workdir);\n    const target = posix.resolve(normalizedWorkdir, into);\n    const isWithinWorkdir = normalizedWorkdir === \"/\"\n        ? target.startsWith(\"/\")\n        : target === normalizedWorkdir || target.startsWith(`${normalizedWorkdir}/`);\n    if (!isWithinWorkdir) {\n        throw new Error(\"checkout resolved outside of the Sandbox workdir\");\n    }\n    return target;\n}\nfunction validCommitSha(value: string): string | undefined {\n    const candidate = value.trim().split(/\\s+/, 1)[0] ?? \"\";\n    return /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i.test(candidate) ? candidate.toLowerCase() : undefined;\n}\nasync function commandResult(sandbox: SandboxCommandTarget, args: readonly string[]): Promise<CommandResult> {\n    return sandbox.runCommand(\"git\", args);\n}\nasync function resolvedCommit(sandbox: SandboxCommandTarget, mirror: string, ref: string): Promise<string | undefined> {\n    const result = await commandResult(sandbox, [\n        `--git-dir=${mirror}`,\n        \"rev-parse\",\n        \"--verify\",\n        \"--quiet\",\n        `${ref}^{commit}`,\n    ]);\n    return result.exitCode === 0 ? validCommitSha(result.stdout) : undefined;\n}\nasync function mirrorMatches(sandbox: SandboxCommandTarget, mirror: string, repo: string, ref: string): Promise<string | undefined> {\n    const bare = await commandResult(sandbox, [`--git-dir=${mirror}`, \"rev-parse\", \"--is-bare-repository\"]);\n    if (bare.exitCode !== 0 || bare.stdout.trim() !== \"true\")\n        return undefined;\n    const remote = await commandResult(sandbox, [`--git-dir=${mirror}`, \"remote\", \"get-url\", \"origin\"]);\n    if (remote.exitCode !== 0 || remote.stdout.trim() !== repo)\n        return undefined;\n    return resolvedCommit(sandbox, mirror, ref);\n}\nasync function recreateMirror(sandbox: SandboxCommandTarget, mirror: string, repo: string, ref: string): Promise<string> {\n    // The target is a SHA-256-derived child of this private cache root. A damaged mirror is not a\n    // user checkout, so replacing it is the documented cache-miss recovery rather than an extra\n    // error class.\n    await sandbox.runCommandOrThrow(\"rm\", [\"-rf\", mirror]);\n    await sandbox.runCommandOrThrow(\"mkdir\", [\"-p\", CHECKOUT_CACHE_ROOT]);\n    await sandbox.runCommandOrThrow(\"git\", [\"clone\", \"--mirror\", \"--quiet\", repo, mirror]);\n    const commit = await resolvedCommit(sandbox, mirror, ref);\n    if (!commit) {\n        const failed = await commandResult(sandbox, [`--git-dir=${mirror}`, \"rev-parse\", \"--verify\", `${ref}^{commit}`]);\n        throw new SandboxCommandExitError(failed);\n    }\n    return commit;\n}\nasync function materializeCheckout(sandbox: SandboxCommandTarget, mirror: string, destination: string, commit: string): Promise<void> {\n    await sandbox.runCommandOrThrow(\"mkdir\", [\"-p\", destination]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"init\", \"--quiet\"]);\n    // A prior attempt can have left this worktree at another revision. Removing only our private\n    // remote and cleaning the checkout makes the declared commit the complete visible start state.\n    await sandbox.runCommand(\"git\", [\"-C\", destination, \"remote\", \"remove\", \"niceeval-mirror\"]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"remote\", \"add\", \"niceeval-mirror\", mirror]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"clean\", \"-ffdqx\"]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"fetch\", \"--quiet\", \"--no-tags\", \"niceeval-mirror\", commit]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"checkout\", \"--quiet\", \"--force\", \"--detach\", commit]);\n}\n/**\n * 把 `(repo, ref)` 变成 Sandbox 私有 bare mirror，再从其中 materialize 到 workdir。\n * 同一 Sandbox 的相同命令会先本地验证 mirror 与 ref，只有首条或缓存损坏才触发网络 clone。\n */\nexport function checkout(options: CheckoutOptions): StableSandboxCommand {\n    const normalized = normalizeCheckoutOptions(options);\n    const cachePath = checkoutCachePath(normalized.repo, normalized.ref);\n    return defineSandboxCommand({\n        id: \"niceeval.sandbox.checkout\",\n        revision: \"1\",\n        inputs: normalized,\n    }, async (sandbox, context) => {\n        context.progress({ message: `Preparing checkout ${normalized.ref}` });\n        const cachedCommit = await mirrorMatches(sandbox, cachePath, normalized.repo, normalized.ref);\n        const commit = cachedCommit ?? await recreateMirror(sandbox, cachePath, normalized.repo, normalized.ref);\n        await materializeCheckout(sandbox, cachePath, targetPath(sandbox.workdir, normalized.into), commit);\n        context.facts(checkoutFactKey(normalized.repo, normalized.ref), commit);\n    });\n}\nasync function probeTool(probe: StableSandboxCommand, sandbox: SandboxCommandTarget, context: SandboxCommandContext): Promise<\"hit\" | \"miss\"> {\n    try {\n        await probe(sandbox, context);\n        return \"hit\";\n    }\n    catch (error: unknown) {\n        // `command()` / `shell()` and a checked custom command turn exactly a nonzero exit into this\n        // typed error. Transport / cancellation / callback failures stay failures and never trigger\n        // an install attempt.\n        if (error instanceof SandboxCommandExitError)\n            return \"miss\";\n        throw error;\n    }\n}\nclass InstallToolRecheckError extends Error {\n    readonly code = \"install-tool-recheck-missed\" as const;\n    constructor(tool: string) {\n        super(`installTool(${JSON.stringify(tool)}) finished install but its probe still did not pass`);\n        this.name = \"InstallToolRecheckError\";\n    }\n}\n/**\n * 稳定的 probe → install → recheck 封装。probe 的普通非零退出是 miss，而所有其它错误保留\n * 原样；install/recheck 的失败因此自然归当前 `sandbox.prepare.<owner>` 生命周期节点。\n */\nexport function installTool(options: InstallToolOptions): StableSandboxCommand {\n    const normalized = normalizeInstallToolOptions(options);\n    const probePlan: SandboxCommandPlanNode = sandboxCommandPlanOf(normalized.probe) ?? {\n        truth: \"opaque\",\n        reason: {\n            code: \"custom-stable-command\",\n            summary: \"custom probe callback; commands are only known when it runs\",\n        },\n    };\n    const installPlan: SandboxCommandPlanNode = sandboxCommandPlanOf(normalized.install) ?? {\n        truth: \"opaque\",\n        reason: {\n            code: \"custom-stable-command\",\n            summary: \"custom installer callback; commands are only known when it runs\",\n        },\n    };\n    const probeMiss = Object.freeze({\n        code: \"probe-miss\",\n        summary: `${normalized.tool} probe exits non-zero`,\n    });\n    return definePlannedSandboxCommand({\n        id: \"niceeval.sandbox.install-tool\",\n        revision: \"1\",\n        inputs: {\n            tool: normalized.tool,\n            identity: normalized.identity,\n            probe: identityValue(normalized.probeIdentity),\n            install: identityValue(normalized.installIdentity),\n        },\n    }, async (sandbox, context) => {\n        context.progress({ message: `Checking ${normalized.tool}` });\n        if (await probeTool(normalized.probe, sandbox, context) === \"hit\")\n            return;\n        context.progress({ message: `Installing ${normalized.tool}` });\n        await normalized.install(sandbox, context);\n        context.progress({ message: `Verifying ${normalized.tool}` });\n        if (await probeTool(normalized.probe, sandbox, context) === \"miss\") {\n            throw new InstallToolRecheckError(normalized.tool);\n        }\n    }, {\n        truth: \"conditional\",\n        label: `installTool(${JSON.stringify(normalized.tool)})`,\n        children: [\n            { ...probePlan, label: \"probe\" },\n            { ...installPlan, label: \"install\", condition: probeMiss },\n            { ...probePlan, label: \"recheck\", condition: probeMiss },\n        ],\n    });\n}\n"]}
+{"version":3,"file":"prepare-commands.js","sourceRoot":"","sources":["prepare-commands.ts"],"names":[],"mappings":";;AAoNA,4BAaC;AA0BD,kCAgDC;AA3SD,uDAAuD;AACvD,EAAE;AACF,wEAAwE;AACxE,yCAAyC;AACzC,2CAA2C;AAC3C,6CAAyC;AACzC,yCAAkC;AAClC,+CAAiT;AACjT,mDAA0D;AAoB1D,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IAC1D,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAyC,EAAE,OAA4B,EAAE,IAAY;IACzG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,mBAAmB,CAAC,CAAC;IAC/D,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1F,MAAM,IAAI,SAAS,CAAC,4GAA4G,CAAC,CAAC;QACtI,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;YAC/E,MAAM,KAAK,CAAC;QAChB,uFAAuF;QACvF,wCAAwC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,GAAG,CAAC;IACf,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,iBAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,iBAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AACD,SAAS,wBAAwB,CAAC,KAAc;IAK5C,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7C,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;QACtD,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;AACP,CAAC;AACD,SAAS,2BAA2B,CAAC,KAAc;IAQ/C,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAChD,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,KAAK,KAAK,UAAU;QAC7C,CAAC,CAAC,IAAA,sCAAwB,EAAC,KAA6B,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,eAAe,GAAG,OAAO,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAA,sCAAwB,EAAC,OAA+B,CAAC;QAC3D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CAAC,6GAA6G,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,+GAA+G,CAAC,CAAC;IACzI,CAAC;IACD,+FAA+F;IAC/F,gGAAgG;IAChG,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAC5D,QAAQ,EAAE,KAAK,CAAC,QAAuC;QACvD,KAAK,EAAE,KAA6B;QACpC,OAAO,EAAE,OAA+B;QACxC,aAAa;QACb,eAAe;KAClB,CAAC,CAAC;AACP,CAAC;AACD,SAAS,MAAM,CAAC,KAAa;IACzB,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AACD,SAAS,aAAa,CAAC,QAAgC;IACnD,OAAO;QACH,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;KAC1B,CAAC;AACN,CAAC;AACD,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAW;IAChD,OAAO,GAAG,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AACD,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC7C,MAAM,iBAAiB,GAAG,iBAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,iBAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,iBAAiB,KAAK,GAAG;QAC7C,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,eAAe,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,IAAuB;IAC/E,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,OAA6B,EAAE,MAAc,EAAE,GAAW;IACpF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;QACxC,aAAa,MAAM,EAAE;QACrB,WAAW;QACX,UAAU;QACV,SAAS;QACT,GAAG,GAAG,WAAW;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,MAAc,EAAE,IAAY,EAAE,GAAW;IACjG,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,MAAM,EAAE,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxG,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QACpD,OAAO,SAAS,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI;QACtD,OAAO,SAAS,CAAC;IACrB,OAAO,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,OAA6B,EAAE,MAAc,EAAE,IAAY,EAAE,GAAW;IAClG,8FAA8F;IAC9F,4FAA4F;IAC5F,eAAe;IACf,MAAM,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC;QACjH,MAAM,IAAI,uCAAuB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,KAAK,UAAU,mBAAmB,CAAC,OAA6B,EAAE,MAAc,EAAE,WAAmB,EAAE,MAAc;IACjH,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/E,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IACxH,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACtH,CAAC;AACD;;;GAGG;AACH,SAAgB,QAAQ,CAAC,OAAwB;IAC7C,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAA,kCAAoB,EAAC;QACxB,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,UAAU;KACrB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,sBAAsB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,YAAY,IAAI,MAAM,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACzG,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACP,CAAC;AACD,KAAK,UAAU,SAAS,CAAC,KAA2B,EAAE,OAA6B,EAAE,OAA8B;IAC/G,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,KAAc,EAAE,CAAC;QACpB,6FAA6F;QAC7F,4FAA4F;QAC5F,sBAAsB;QACtB,IAAI,KAAK,YAAY,uCAAuB;YACxC,OAAO,MAAM,CAAC;QAClB,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AACD,MAAM,uBAAwB,SAAQ,KAAK;IAC9B,IAAI,GAAG,6BAAsC,CAAC;IACvD,YAAY,IAAY;QACpB,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IAC1C,CAAC;CACJ;AACD;;;GAGG;AACH,SAAgB,WAAW,CAAC,OAA2B;IACnD,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAA2B,IAAA,kCAAoB,EAAC,UAAU,CAAC,KAAK,CAAC,IAAI;QAChF,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACJ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,6DAA6D;SACzE;KACJ,CAAC;IACF,MAAM,WAAW,GAA2B,IAAA,kCAAoB,EAAC,UAAU,CAAC,OAAO,CAAC,IAAI;QACpF,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACJ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,iEAAiE;SAC7E;KACJ,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,uBAAuB;KACrD,CAAC,CAAC;IACH,OAAO,IAAA,yCAA2B,EAAC;QAC/B,EAAE,EAAE,+BAA+B;QACnC,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE;YACJ,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC;YAC9C,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC;SACrD;KACJ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK;YAC7D,OAAO;QACX,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;YACjE,MAAM,IAAI,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACL,CAAC,EAAE;QACC,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG;QACxD,QAAQ,EAAE;YACN,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE;YAChC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;YAC1D,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;SAC3D;KACJ,CAAC,CAAC;AACP,CAAC","sourcesContent":["// 官方 prepare 命令:把常见的「检查→必要时执行→复检」收敛为稳定 SandboxCommand。\n//\n// 这里不认识 Layer、Provider 或复用调度。checkout/installTool 都只是普通 stable command:\n// runner 仍按 owner 的 prepare 顺序执行它们。契约单源:\n// docs/feature/sandbox/prepare-commands.md\nimport { createHash } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport { defineSandboxCommand, definePlannedSandboxCommand, sandboxCommandPlanOf, sandboxCommandIdentityOf, type SandboxCommandContext, type SandboxCommandIdentity, type SandboxCommandIdentityValue, type SandboxCommandPlanNode, type SandboxCommandTarget, type StableSandboxCommand, } from \"./commands.ts\";\nimport { SandboxCommandExitError } from \"./operations.ts\";\nimport type { CommandResult } from \"./types.ts\";\nexport interface CheckoutOptions {\n    /** Git remote;HTTP(S) URL 中的 userinfo / query / fragment 一律拒绝，凭据只走 Git 原生机制。 */\n    readonly repo: string;\n    /** commit SHA 或 tag 等 Git revision。 */\n    readonly ref: string;\n    /** 相对 workdir 的目标目录；省略或 `.` 就是 workdir 根。 */\n    readonly into?: string;\n}\nexport interface InstallToolOptions {\n    /** 人可读、也进入 identity 的工具名；不从命令文本猜测。 */\n    readonly tool: string;\n    /** 作者声明的纯数据版本 / 来源 identity。 */\n    readonly identity: SandboxCommandIdentityValue;\n    /** 零退出表示命中；非零退出表示未命中。 */\n    readonly probe: StableSandboxCommand;\n    /** 只在 probe 未命中时执行。 */\n    readonly install: StableSandboxCommand;\n}\nconst CHECKOUT_CACHE_ROOT = \"/tmp/niceeval-checkout-cache\";\nfunction assertPlainRecord(value: unknown, path: string): asserts value is globalThis.Record<string, unknown> {\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n        throw new TypeError(`${path} must be an object`);\n    }\n    const prototype = Object.getPrototypeOf(value);\n    if (prototype !== Object.prototype && prototype !== null) {\n        throw new TypeError(`${path} must be a plain object`);\n    }\n}\nfunction assertOnlyKeys(value: globalThis.Record<string, unknown>, allowed: ReadonlySet<string>, path: string): void {\n    for (const key of Object.keys(value)) {\n        if (!allowed.has(key))\n            throw new TypeError(`${path}.${key} is not supported`);\n    }\n}\nfunction nonEmptyString(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\") {\n        throw new TypeError(`${path} must be a non-empty string`);\n    }\n    if (/[\\x00-\\x1f\\x7f]/.test(value)) {\n        throw new TypeError(`${path} must not contain control characters`);\n    }\n    return value;\n}\nfunction normalizeRepo(value: unknown): string {\n    const repo = nonEmptyString(value, \"checkout options.repo\");\n    try {\n        const url = new URL(repo);\n        if (url.password || (url.protocol === \"http:\" || url.protocol === \"https:\") && url.username) {\n            throw new TypeError(\"checkout options.repo must not embed credentials; configure Git credentials in the host or Sandbox instead\");\n        }\n        if (url.search || url.hash) {\n            throw new TypeError(\"checkout options.repo must not include a query or fragment\");\n        }\n    }\n    catch (error) {\n        if (error instanceof TypeError && error.message.startsWith(\"checkout options.repo\"))\n            throw error;\n        // SCP-style remotes (`git@host:owner/repo.git`) and local paths are valid Git remotes,\n        // but are intentionally not URL-parsed.\n    }\n    return repo;\n}\nfunction normalizeInto(value: unknown): string {\n    if (value === undefined)\n        return \".\";\n    const into = nonEmptyString(value, \"checkout options.into\");\n    if (posix.isAbsolute(into)) {\n        throw new TypeError(\"checkout options.into must be relative to the Sandbox workdir\");\n    }\n    const normalized = posix.normalize(into);\n    if (normalized === \"..\" || normalized.startsWith(\"../\")) {\n        throw new TypeError(\"checkout options.into must not escape the Sandbox workdir\");\n    }\n    return normalized;\n}\nfunction normalizeCheckoutOptions(value: unknown): Readonly<{\n    repo: string;\n    ref: string;\n    into: string;\n}> {\n    assertPlainRecord(value, \"checkout options\");\n    assertOnlyKeys(value, new Set([\"repo\", \"ref\", \"into\"]), \"checkout options\");\n    return Object.freeze({\n        repo: normalizeRepo(value.repo),\n        ref: nonEmptyString(value.ref, \"checkout options.ref\"),\n        into: normalizeInto(value.into),\n    });\n}\nfunction normalizeInstallToolOptions(value: unknown): Readonly<{\n    tool: string;\n    identity: SandboxCommandIdentityValue;\n    probe: StableSandboxCommand;\n    install: StableSandboxCommand;\n    probeIdentity: SandboxCommandIdentity;\n    installIdentity: SandboxCommandIdentity;\n}> {\n    assertPlainRecord(value, \"installTool options\");\n    assertOnlyKeys(value, new Set([\"tool\", \"identity\", \"probe\", \"install\"]), \"installTool options\");\n    const probe = value.probe;\n    const install = value.install;\n    const probeIdentity = typeof probe === \"function\"\n        ? sandboxCommandIdentityOf(probe as StableSandboxCommand)\n        : undefined;\n    const installIdentity = typeof install === \"function\"\n        ? sandboxCommandIdentityOf(install as StableSandboxCommand)\n        : undefined;\n    if (!probeIdentity) {\n        throw new TypeError(\"installTool options.probe must be a StableSandboxCommand from command(), shell(), or defineSandboxCommand()\");\n    }\n    if (!installIdentity) {\n        throw new TypeError(\"installTool options.install must be a StableSandboxCommand from command(), shell(), or defineSandboxCommand()\");\n    }\n    // defineSandboxCommand owns the recursive JSON-content validation and frozen snapshot. Keeping\n    // this raw value here prevents a second, subtly different identity grammar at this public edge.\n    return Object.freeze({\n        tool: nonEmptyString(value.tool, \"installTool options.tool\"),\n        identity: value.identity as SandboxCommandIdentityValue,\n        probe: probe as StableSandboxCommand,\n        install: install as StableSandboxCommand,\n        probeIdentity,\n        installIdentity,\n    });\n}\nfunction sha256(value: string): string {\n    return createHash(\"sha256\").update(value).digest(\"hex\");\n}\nfunction identityValue(identity: SandboxCommandIdentity): SandboxCommandIdentityValue {\n    return {\n        id: identity.id,\n        revision: identity.revision,\n        inputs: identity.inputs,\n    };\n}\nfunction checkoutCachePath(repo: string, ref: string): string {\n    return `${CHECKOUT_CACHE_ROOT}/${sha256(JSON.stringify([repo, ref]))}`;\n}\nfunction targetPath(workdir: string, into: string): string {\n    const normalizedWorkdir = posix.resolve(workdir);\n    const target = posix.resolve(normalizedWorkdir, into);\n    const isWithinWorkdir = normalizedWorkdir === \"/\"\n        ? target.startsWith(\"/\")\n        : target === normalizedWorkdir || target.startsWith(`${normalizedWorkdir}/`);\n    if (!isWithinWorkdir) {\n        throw new Error(\"checkout resolved outside of the Sandbox workdir\");\n    }\n    return target;\n}\nfunction validCommitSha(value: string): string | undefined {\n    const candidate = value.trim().split(/\\s+/, 1)[0] ?? \"\";\n    return /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i.test(candidate) ? candidate.toLowerCase() : undefined;\n}\nasync function commandResult(sandbox: SandboxCommandTarget, args: readonly string[]): Promise<CommandResult> {\n    return sandbox.runCommand(\"git\", args);\n}\nasync function resolvedCommit(sandbox: SandboxCommandTarget, mirror: string, ref: string): Promise<string | undefined> {\n    const result = await commandResult(sandbox, [\n        `--git-dir=${mirror}`,\n        \"rev-parse\",\n        \"--verify\",\n        \"--quiet\",\n        `${ref}^{commit}`,\n    ]);\n    return result.exitCode === 0 ? validCommitSha(result.stdout) : undefined;\n}\nasync function mirrorMatches(sandbox: SandboxCommandTarget, mirror: string, repo: string, ref: string): Promise<string | undefined> {\n    const bare = await commandResult(sandbox, [`--git-dir=${mirror}`, \"rev-parse\", \"--is-bare-repository\"]);\n    if (bare.exitCode !== 0 || bare.stdout.trim() !== \"true\")\n        return undefined;\n    const remote = await commandResult(sandbox, [`--git-dir=${mirror}`, \"remote\", \"get-url\", \"origin\"]);\n    if (remote.exitCode !== 0 || remote.stdout.trim() !== repo)\n        return undefined;\n    return resolvedCommit(sandbox, mirror, ref);\n}\nasync function recreateMirror(sandbox: SandboxCommandTarget, mirror: string, repo: string, ref: string): Promise<string> {\n    // The target is a SHA-256-derived child of this private cache root. A damaged mirror is not a\n    // user checkout, so replacing it is the documented cache-miss recovery rather than an extra\n    // error class.\n    await sandbox.runCommandOrThrow(\"rm\", [\"-rf\", mirror]);\n    await sandbox.runCommandOrThrow(\"mkdir\", [\"-p\", CHECKOUT_CACHE_ROOT]);\n    await sandbox.runCommandOrThrow(\"git\", [\"clone\", \"--mirror\", \"--quiet\", repo, mirror]);\n    const commit = await resolvedCommit(sandbox, mirror, ref);\n    if (!commit) {\n        const failed = await commandResult(sandbox, [`--git-dir=${mirror}`, \"rev-parse\", \"--verify\", `${ref}^{commit}`]);\n        throw new SandboxCommandExitError(failed);\n    }\n    return commit;\n}\nasync function materializeCheckout(sandbox: SandboxCommandTarget, mirror: string, destination: string, commit: string): Promise<void> {\n    await sandbox.runCommandOrThrow(\"mkdir\", [\"-p\", destination]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"init\", \"--quiet\"]);\n    // A prior attempt can have left this worktree at another revision. Removing only our private\n    // remote and cleaning the checkout makes the declared commit the complete visible start state.\n    await sandbox.runCommand(\"git\", [\"-C\", destination, \"remote\", \"remove\", \"niceeval-mirror\"]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"remote\", \"add\", \"niceeval-mirror\", mirror]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"clean\", \"-ffdqx\"]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"fetch\", \"--quiet\", \"--no-tags\", \"niceeval-mirror\", commit]);\n    await sandbox.runCommandOrThrow(\"git\", [\"-C\", destination, \"checkout\", \"--quiet\", \"--force\", \"--detach\", commit]);\n}\n/**\n * 把 `(repo, ref)` 变成 Sandbox 私有 bare mirror，再从其中 materialize 到 workdir。\n * 同一 Sandbox 的相同命令会先本地验证 mirror 与 ref，只有首条或缓存损坏才触发网络 clone。\n */\nexport function checkout(options: CheckoutOptions): StableSandboxCommand {\n    const normalized = normalizeCheckoutOptions(options);\n    const cachePath = checkoutCachePath(normalized.repo, normalized.ref);\n    return defineSandboxCommand({\n        id: \"niceeval.sandbox.checkout\",\n        revision: \"1\",\n        inputs: normalized,\n    }, async (sandbox, context) => {\n        context.progress({ message: `Preparing checkout ${normalized.ref}` });\n        const cachedCommit = await mirrorMatches(sandbox, cachePath, normalized.repo, normalized.ref);\n        const commit = cachedCommit ?? await recreateMirror(sandbox, cachePath, normalized.repo, normalized.ref);\n        await materializeCheckout(sandbox, cachePath, targetPath(sandbox.workdir, normalized.into), commit);\n    });\n}\nasync function probeTool(probe: StableSandboxCommand, sandbox: SandboxCommandTarget, context: SandboxCommandContext): Promise<\"hit\" | \"miss\"> {\n    try {\n        await probe(sandbox, context);\n        return \"hit\";\n    }\n    catch (error: unknown) {\n        // `command()` / `shell()` and a checked custom command turn exactly a nonzero exit into this\n        // typed error. Transport / cancellation / callback failures stay failures and never trigger\n        // an install attempt.\n        if (error instanceof SandboxCommandExitError)\n            return \"miss\";\n        throw error;\n    }\n}\nclass InstallToolRecheckError extends Error {\n    readonly code = \"install-tool-recheck-missed\" as const;\n    constructor(tool: string) {\n        super(`installTool(${JSON.stringify(tool)}) finished install but its probe still did not pass`);\n        this.name = \"InstallToolRecheckError\";\n    }\n}\n/**\n * 稳定的 probe → install → recheck 封装。probe 的普通非零退出是 miss，而所有其它错误保留\n * 原样；install/recheck 的失败因此自然归当前 `sandbox.prepare.<owner>` 生命周期节点。\n */\nexport function installTool(options: InstallToolOptions): StableSandboxCommand {\n    const normalized = normalizeInstallToolOptions(options);\n    const probePlan: SandboxCommandPlanNode = sandboxCommandPlanOf(normalized.probe) ?? {\n        truth: \"opaque\",\n        reason: {\n            code: \"custom-stable-command\",\n            summary: \"custom probe callback; commands are only known when it runs\",\n        },\n    };\n    const installPlan: SandboxCommandPlanNode = sandboxCommandPlanOf(normalized.install) ?? {\n        truth: \"opaque\",\n        reason: {\n            code: \"custom-stable-command\",\n            summary: \"custom installer callback; commands are only known when it runs\",\n        },\n    };\n    const probeMiss = Object.freeze({\n        code: \"probe-miss\",\n        summary: `${normalized.tool} probe exits non-zero`,\n    });\n    return definePlannedSandboxCommand({\n        id: \"niceeval.sandbox.install-tool\",\n        revision: \"1\",\n        inputs: {\n            tool: normalized.tool,\n            identity: normalized.identity,\n            probe: identityValue(normalized.probeIdentity),\n            install: identityValue(normalized.installIdentity),\n        },\n    }, async (sandbox, context) => {\n        context.progress({ message: `Checking ${normalized.tool}` });\n        if (await probeTool(normalized.probe, sandbox, context) === \"hit\")\n            return;\n        context.progress({ message: `Installing ${normalized.tool}` });\n        await normalized.install(sandbox, context);\n        context.progress({ message: `Verifying ${normalized.tool}` });\n        if (await probeTool(normalized.probe, sandbox, context) === \"miss\") {\n            throw new InstallToolRecheckError(normalized.tool);\n        }\n    }, {\n        truth: \"conditional\",\n        label: `installTool(${JSON.stringify(normalized.tool)})`,\n        children: [\n            { ...probePlan, label: \"probe\" },\n            { ...installPlan, label: \"install\", condition: probeMiss },\n            { ...probePlan, label: \"recheck\", condition: probeMiss },\n        ],\n    });\n}\n"]}

package/dist/sandbox/prepare-commands.d.cts

@@ -2,7 +2,7 @@ import { type SandboxCommandIdentityValue, type StableSandboxCommand } from "./c
 export interface CheckoutOptions {
     /** Git remote;HTTP(S) URL 中的 userinfo / query / fragment 一律拒绝，凭据只走 Git 原生机制。 */
     readonly repo: string;
-    /** commit SHA 或 tag 等 Git revision；运行时解析出的 commit SHA 会作为事实记录。 */
+    /** commit SHA 或 tag 等 Git revision。 */
     readonly ref: string;
     /** 相对 workdir 的目标目录；省略或 `.` 就是 workdir 根。 */
     readonly into?: string;

package/dist/sandbox/prepare-commands.d.mts

@@ -2,7 +2,7 @@ import { type SandboxCommandIdentityValue, type StableSandboxCommand } from "./c
 export interface CheckoutOptions {
     /** Git remote;HTTP(S) URL 中的 userinfo / query / fragment 一律拒绝，凭据只走 Git 原生机制。 */
     readonly repo: string;
-    /** commit SHA 或 tag 等 Git revision；运行时解析出的 commit SHA 会作为事实记录。 */
+    /** commit SHA 或 tag 等 Git revision。 */
     readonly ref: string;
     /** 相对 workdir 的目标目录；省略或 `.` 就是 workdir 根。 */
     readonly into?: string;