niceeval 0.13.3 → 0.13.4-canary.39

package/dist/sandbox/index.mjs

@@ -105,12 +105,12 @@ const __niceevalExport50 = __niceevalCanonical["isDockerExecutionProfileV1"];
 export { __niceevalExport50 as isDockerExecutionProfileV1 };
 const __niceevalExport51 = __niceevalCanonical["leakGateHintsFromComposeFile"];
 export { __niceevalExport51 as leakGateHintsFromComposeFile };
-const __niceevalExport52 = __niceevalCanonical["localSandbox"];
-export { __niceevalExport52 as localSandbox };
-const __niceevalExport53 = __niceevalCanonical["looksLikeDigestRef"];
-export { __niceevalExport53 as looksLikeDigestRef };
-const __niceevalExport54 = __niceevalCanonical["makeDockerExecutionProfileV1"];
-export { __niceevalExport54 as makeDockerExecutionProfileV1 };
+const __niceevalExport52 = __niceevalCanonical["looksLikeDigestRef"];
+export { __niceevalExport52 as looksLikeDigestRef };
+const __niceevalExport53 = __niceevalCanonical["makeDockerExecutionProfileV1"];
+export { __niceevalExport53 as makeDockerExecutionProfileV1 };
+const __niceevalExport54 = __niceevalCanonical["materializationScopeId"];
+export { __niceevalExport54 as materializationScopeId };
 const __niceevalExport55 = __niceevalCanonical["materializeDockerComposeProviderCase"];
 export { __niceevalExport55 as materializeDockerComposeProviderCase };
 const __niceevalExport56 = __niceevalCanonical["normalizeSandboxCapture"];
@@ -137,12 +137,14 @@ const __niceevalExport66 = __niceevalCanonical["resolveFloatingImageTag"];
 export { __niceevalExport66 as resolveFloatingImageTag };
 const __niceevalExport67 = __niceevalCanonical["restoreCheckpoint"];
 export { __niceevalExport67 as restoreCheckpoint };
-const __niceevalExport68 = __niceevalCanonical["sandboxLayer"];
-export { __niceevalExport68 as sandboxLayer };
-const __niceevalExport69 = __niceevalCanonical["shell"];
-export { __niceevalExport69 as shell };
-const __niceevalExport70 = __niceevalCanonical["startSandboxBuilds"];
-export { __niceevalExport70 as startSandboxBuilds };
-const __niceevalExport71 = __niceevalCanonical["vercelSandbox"];
-export { __niceevalExport71 as vercelSandbox };
+const __niceevalExport68 = __niceevalCanonical["sandboxBuildRef"];
+export { __niceevalExport68 as sandboxBuildRef };
+const __niceevalExport69 = __niceevalCanonical["sandboxLayer"];
+export { __niceevalExport69 as sandboxLayer };
+const __niceevalExport70 = __niceevalCanonical["shell"];
+export { __niceevalExport70 as shell };
+const __niceevalExport71 = __niceevalCanonical["startSandboxBuilds"];
+export { __niceevalExport71 as startSandboxBuilds };
+const __niceevalExport72 = __niceevalCanonical["vercelSandbox"];
+export { __niceevalExport72 as vercelSandbox };
 //# sourceMappingURL=index.mjs.map

package/dist/sandbox/keep.cjs

@@ -467,9 +467,7 @@ function assertProviderKeepable(provider, isCustomCreate) {
     }
     if (!exports.KEEPABLE_PROVIDERS.has(provider)) {
         throw new Error(`--keep-sandbox is not supported with the "${provider}" provider: ` +
-            (provider === "local"
-                ? "it never destroys the sandbox in the first place, so there is nothing to register for later retention — the workspace already sits exactly where the agent left it. Drop --keep-sandbox, or use a built-in cloud/container provider (docker / e2b / vercel) if you need a registry-managed retained sandbox."
-                : `expected one of: ${[...exports.KEEPABLE_PROVIDERS].join(", ")}. Drop --keep-sandbox.`));
+            `expected one of: ${[...exports.KEEPABLE_PROVIDERS].join(", ")}. Drop --keep-sandbox.`);
     }
 }
 //# sourceMappingURL=keep.cjs.map

package/dist/sandbox/keep.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"keep.js","sourceRoot":"","sources":["keep.ts"],"names":[],"mappings":";;;AAWA,wCAMC;AAOD,gDAWC;AAiBD,4CAOC;AAGD,0CAuDC;AAMD,0CA8DC;AAED,oCA8CC;AAqGD,0CAuCC;AAQD,oDAyBC;AAcD,wCAsCC;AAuCD,sDAIC;AAKD,wDAaC;AAvgBD,wDAAwD;AACxD,4EAA4E;AAC5E,mEAAmE;AACnE,0BAA0B;AAC1B,mCAAuC;AAEvC,uDAA2D;AAC3D,6CAAmD;AACnD,6DAA6D;AAChD,QAAA,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvE,sEAAsE;AAC/D,KAAK,UAAU,cAAc,CAAC,OAAgB;IACjD,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AACD;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,gBAAgB,SAAS,uBAAuB,SAAS,OAAO,CAAC;QAC5E,KAAK,KAAK;YACN,OAAO,uBAAuB,SAAS,EAAE,CAAC;QAC9C,KAAK,QAAQ;YACT,OAAO,mBAAmB,SAAS,EAAE,CAAC;QAC1C;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AACD;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvE;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,qCAAqC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9F;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;gBACvE,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,CAAC;YACD,MAAM,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,IAAI,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBACxE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC1E,IAAI,GAGS,CAAC;gBACd,OAAO,SAAS,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/B,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpH,CAAC;gBACD,IAAI,CAAC,GAAG;oBACJ,OAAO,SAAS,CAAC;gBACrB,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,CAAC;YACD,MAAM,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC;gBACD,0DAA0D;gBAC1D,0BAA0B;gBAC1B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;gBAC/E,MAAM,GAAG,GAAI,QAIX,CAAC,GAAG,CAAC;gBACP,IAAI,OAAO,GAAG,KAAK,UAAU;oBACzB,OAAO,SAAS,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK;oBACN,OAAO,SAAS,CAAC;gBACrB,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AACD;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC;gBACD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,EAAE,CAAC;gBACP,IAAK,CAEH,CAAC,UAAU,KAAK,GAAG;oBACjB,OAAO,cAAc,CAAC;gBAC1B,MAAM,CAAC,CAAC;YACZ,CAAC;QACL,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,IAAI,GAAI,aAEZ,CAAC,IAAI,CAAC;YACR,IAAI,OAAO,IAAI,KAAK,UAAU;gBAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,wEAAwE;YACxE,qDAAqD;YACrD,0DAA0D;YAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAIX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9E,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACD,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,IAAK,KAGH,CAAC,UAAU,KAAK,GAAG,IAAK,KAExB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAChB,OAAO,cAAc,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,KAAK;gBACN,OAAO,cAAc,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,gCAAgC,CAAC,CAAC;IAC/E,CAAC;AACL,CAAC;AACD,yEAAyE;AAClE,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO;gBACpB,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,IAAI,MAAM,CAAC;gBAC1E,MAAM,8BAA8B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACX,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,MAAM,GAAI,aAGd,CAAC;YACH,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpE,OAAO;YACX,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACrE,OAAO;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,sEAAsE;YACtE,6CAA6C;YAC7C,uDAAuD;YACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAEX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO;QACX,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,uBAAuB,CAAC,CAAC;IACtE,CAAC;AACL,CAAC;AAkBD,KAAK,UAAU,8BAA8B,CAAC,SAA8B,EAAE,IAAY;IACtF,OAAO,eAAM,CAAC,UAAU,CAAC,oCAAoC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC;AACD;;;;GAIG;AACH,SAAS,oCAAoC,CAAC,SAA8B,EAAE,IAAY;IACtF,MAAM,cAAc,GAAG,CAAC,QAAmC,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,+DAA+D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAClK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,QAAQ,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,QAAmC,EAA8B,EAAE,CAAC,cAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzJ,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,CAAC;QACjC,IAAI,SAAS,IAAI,CAAC;YACd,OAAO,eAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,OAAO,cAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,QAAmC,EAA8B,EAAE,CAAC,cAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACvJ,IAAI,GAAG,GAAG,QAAQ;YACd,OAAO,eAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAC5B,OAAO,eAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;gBACtB,OAAO,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAC,CAAC;IACJ,OAAO,cAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AACD;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAA8B,EAAE,IAAY,EAAE,SAAiB;IACpF,MAAM,UAAU,GAGF,eAAM,CAAC,UAAU,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;aACf,IAAI,CAAC;YACN,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;YACvB,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;SACrB,CAAC;aACG,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACvF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,SAA8B,EAAE,MAA6B,EAAgD,EAAE;QAC7H,MAAM,aAAa,GAAG,GAAS,EAAE,CAAE,MAEjC,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,OAAO,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAW,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,SAAS,GAAiD,eAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;YACpF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAsC,cAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YAC5F,aAAa,EAAE,CAAC;YAChB,OAAO,WAAoB,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC;QACJ,OAAO,eAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAgD,EAAE;YAClH,IAAI,OAAO,KAAK,WAAW;gBACvB,OAAO,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAW,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,QAAQ;gBACpB,OAAO,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,CAAC;YACvD,OAAO,eAAM,CAAC,UAAU,CAAC;gBACrB,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;aAC1B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,CAAC,CAAC,CAAC;QACjK,CAAC,CAAC,CAAC,CAAC;IACR,CAAC,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,CAAC,CAAC,CAAC;AACvK,CAAC;AACD,0CAA0C;AACnC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO;QACX,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAI,aAEb,CAAC,KAAK,CAAC;YACT,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC5D,OAAO;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,wDAAwD;YACxD,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAIX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK;gBACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,qCAAqC,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO;QACX,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,0BAA0B,CAAC,CAAC;IACzE,CAAC;AACL,CAAC;AACD;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAe;IAC3F,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3F,KAAK,KAAK;YACN,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,kEAAkE;YAClE,2CAA2C;YAC3C,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAChD,IAAI,KAAK;gBACL,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM;gBACN,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjC,IAAI,SAAS;gBACT,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,OAAO,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,oCAAoC,CAAC,CAAC;IACnF,CAAC;AACL,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAc;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACP,CAAC;AACD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAe,EAAE,MAAc;IACrG,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;gBACvC,GAAG,EAAE,OAAO;gBACZ,IAAI,EAAE,EAAE,OAAO,EAAE,wCAAsB,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;aAClF,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAMX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK;gBACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,iDAAiD,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC;gBACpC,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;gBACpB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAsB,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;aACjF,CAAC,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,GAAG,CAAC,CAAC;IAC/F,CAAC;AACL,CAAC;AACD,0DAA0D;AAC1D,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,OAAe,EAAE,MAAc;IAChF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;QAC9B,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,CAAC,WAAW,wCAAsB,EAAE,EAAE,iBAAiB,OAAO,EAAE,EAAE,WAAW,CAAC;KACtF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAClB,gDAAgD;YAChD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC1C,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrE,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,cAAc,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC;AACD;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAgB;IAClD,IAAI,0BAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,OAAO,SAAS,CAAC;IACrB,OAAO,IAAI,QAAQ,0DAA0D,CAAC,GAAG,0BAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvH,CAAC;AACD;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,QAAgB,EAAE,cAAuB;IAC5E,IAAI,cAAc,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0EAA0E,QAAQ,MAAM;YACpG,6FAA6F;YAC7F,0GAA0G;YAC1G,yBAAyB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,0BAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,cAAc;YAC/E,CAAC,QAAQ,KAAK,OAAO;gBACjB,CAAC,CAAC,8SAA8S;gBAChT,CAAC,CAAC,oBAAoB,CAAC,GAAG,0BAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/F,CAAC;AACL,CAAC","sourcesContent":["// 留存生命周期的 sandbox/ 域内路由:in-run 的 suspend(留存提交后转休眠)与事后命令\n// (`niceeval sandbox list/enter/stop`)用的 detached 能力(不需要原来的 run 进程或 Sandbox\n// 实例还活着)。provider 名的行为分支只允许出现在 sandbox/ 内(见 docs/architecture.md);\n// 运行器与评分路径不感知 provider 名。\nimport { Clock, Effect } from \"effect\";\nimport type { Sandbox } from \"../types.ts\";\nimport { DEFAULT_LEDGER_GIT_DIR } from \"./ledger-paths.ts\";\nimport { sandboxCapabilities } from \"./backend.ts\";\n/** provider 是否参与留存(defineSandbox 自定义 provider 不参与,创建前报错)。 */\nexport const KEEPABLE_PROVIDERS = new Set([\"docker\", \"e2b\", \"vercel\"]);\n/** in-run 的休眠:留存提交成功后由 Sample release 调用(sandbox.suspend 阶段,有界计时)。 */\nexport async function suspendSandbox(sandbox: Sandbox): Promise<void> {\n    const suspend = sandboxCapabilities(sandbox).suspend;\n    if (suspend._tag === \"Unsupported\") {\n        throw new Error(`sandbox provider has no suspend capability (sandboxId=${sandbox.sandboxId})`);\n    }\n    await suspend.value();\n}\n/**\n * provider 原生的进入命令(记进注册表供直连与审计;日常入口是 `niceeval sandbox enter`)。\n * `sandboxId` 对 vercel 而言是沙箱的持久 `name`——官方 CLI(独立 npm 包 `sandbox`,别名\n * `sbx`)按 name 索引,`sandbox connect <name>`(别名 `ssh`/`shell`)唤醒并打开交互式 shell,\n * 与 docker/e2b 的\"原生命令即可直连\"语义一致(vercel.com/docs/sandbox/cli-reference)。\n */\nexport function nativeEnterCommand(provider: string, sandboxId: string): string | undefined {\n    switch (provider) {\n        case \"docker\":\n            return `docker start ${sandboxId} && docker exec -it ${sandboxId} bash`;\n        case \"e2b\":\n            return `e2b sandbox connect ${sandboxId}`;\n        case \"vercel\":\n            return `sandbox connect ${sandboxId}`;\n        default:\n            return undefined;\n    }\n}\n/**\n * Vercel 持久沙箱的默认快照保留期限:`snapshotExpiration` 默认 2,592,000,000ms(30 天),\n * 从快照最后一次使用起算(官方文档 vercel.com/docs/sandbox/concepts/persistent-sandboxes)。\n * niceeval 的 `VercelSandbox.create()` 不传自定义 `snapshotExpiration`,这个默认值就是\n * suspend(`stop()`,自动打快照)之后实际生效的保留期限。\n */\nconst VERCEL_DEFAULT_SNAPSHOT_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1000;\n/**\n * 留存提交时算出 `expiresAt`——与 `nativeEnterCommand` 同步、无 IO,在 `writeKeptEntry`\n * 原子写入之前算好:provider 声明了保留期限才写。\n *\n * - **vercel**:写 `keptAt` + 默认快照保留期(30 天)。\n * - **e2b**:不写——官方文档(\"paused sandboxes are kept indefinitely; there is no\n *   automatic deletion or time-to-live limit\")明确 pause 没有自然过期时刻。\n * - **docker**:不写——docker 的留存是本地停驻容器,不是「远端保留期限」这个概念。\n */\nexport function computeExpiresAt(provider: string, keptAt: string): string | undefined {\n    switch (provider) {\n        case \"vercel\":\n            return new Date(Date.parse(keptAt) + VERCEL_DEFAULT_SNAPSHOT_EXPIRATION_MS).toISOString();\n        default:\n            return undefined;\n    }\n}\nexport type DetachedState = \"alive\" | \"dormant\" | \"expired\" | \"unknown\";\n/** 事后核对现场状态(docker 问本地 daemon;云 provider 按实例状态核对,查不到 = expired)。 */\nexport async function inspectDetached(provider: string, sandboxId: string): Promise<DetachedState> {\n    switch (provider) {\n        case \"docker\": {\n            try {\n                const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n                const info = await new Docker().getContainer(sandboxId).inspect();\n                return info.State?.Running ? \"alive\" : \"dormant\";\n            }\n            catch {\n                return \"unknown\";\n            }\n        }\n        case \"e2b\": {\n            try {\n                const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n                const paginator = E2BSdkSandbox.list({ apiKey: process.env.E2B_API_KEY });\n                let hit: {\n                    sandboxId: string;\n                    state?: string;\n                } | undefined;\n                while (paginator.hasNext && !hit) {\n                    hit = (await paginator.nextItems()).find((s) => s.sandboxId === sandboxId || s.sandboxId.startsWith(sandboxId));\n                }\n                if (!hit)\n                    return \"expired\";\n                return hit.state === \"running\" ? \"alive\" : \"dormant\";\n            }\n            catch {\n                return \"unknown\";\n            }\n        }\n        case \"vercel\": {\n            try {\n                // 查状态用 name + resume:false——不为了看一眼状态就把休眠的沙箱唤醒(list 是只读命令,\n                // 不该有唤醒这个副作用,也不该产生唤醒的计费)。\n                const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n                const get = (VSandbox as unknown as {\n                    get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                        status: string;\n                    } | null>;\n                }).get;\n                if (typeof get !== \"function\")\n                    return \"dormant\";\n                const found = await get({ name: sandboxId, resume: false });\n                if (!found)\n                    return \"expired\";\n                return found.status === \"running\" ? \"alive\" : \"dormant\";\n            }\n            catch {\n                return \"unknown\";\n            }\n        }\n        default:\n            return \"expired\";\n    }\n}\n/**\n * detached 销毁:按注册表条目的 provider 名路由,不需要 Sandbox 实例。\n * 返回 \"stopped\"(成功销毁)或 \"already-gone\"(实例已不存在,幂等);\n * 其它错误上抛——调用方保留登记项并退出 1,不能把仍活着的资源从管理面隐藏掉。\n */\nexport async function destroyDetached(provider: string, sandboxId: string): Promise<\"stopped\" | \"already-gone\"> {\n    switch (provider) {\n        case \"docker\": {\n            const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n            const container = new Docker().getContainer(sandboxId);\n            try {\n                await container.remove({ force: true });\n                return \"stopped\";\n            }\n            catch (e) {\n                if ((e as {\n                    statusCode?: number;\n                }).statusCode === 404)\n                    return \"already-gone\";\n                throw e;\n            }\n        }\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const kill = (E2BSdkSandbox as unknown as {\n                kill?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<boolean>;\n            }).kill;\n            if (typeof kill !== \"function\")\n                throw new Error(\"this e2b SDK version has no detached kill capability\");\n            const killed = await kill(sandboxId, { apiKey: process.env.E2B_API_KEY });\n            return killed ? \"stopped\" : \"already-gone\";\n        }\n        case \"vercel\": {\n            // 真正的销毁是 SDK 的 delete()(≙ 官方 CLI 的 `sandbox remove`)——stop() 只是 suspend\n            // (自动打快照、之后能 Sandbox.get 恢复),把它当销毁用会把\"已删除\"的沙箱悄悄留成可恢复\n            // 的休眠态,`sandbox stop` 的\"销毁\"承诺就不成立了。resume:false 避免删除前先唤醒。\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                    delete(): Promise<void>;\n                } | null>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no detached get capability\");\n            let found;\n            try {\n                found = await get({ name: sandboxId, resume: false });\n            }\n            catch (error) {\n                if ((error as {\n                    statusCode?: number;\n                    status?: number;\n                }).statusCode === 404 || (error as {\n                    status?: number;\n                }).status === 404) {\n                    return \"already-gone\";\n                }\n                throw error;\n            }\n            if (!found)\n                return \"already-gone\";\n            await found.delete();\n            return \"stopped\";\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no detached stop channel`);\n    }\n}\n/** 唤醒休眠现场(enter / history / diff 前);docker start,云 provider 按 SDK 恢复。 */\nexport async function wakeDetached(provider: string, sandboxId: string): Promise<void> {\n    switch (provider) {\n        case \"docker\": {\n            const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n            const container = new Docker().getContainer(sandboxId);\n            const info = await container.inspect();\n            if (!info.State?.Running)\n                await container.start();\n            if (info.Config?.Labels?.[\"niceeval.docker-access\"] === \"dind\") {\n                const user = info.Config.Labels[\"niceeval.dind-readiness-user\"] || \"root\";\n                await waitForDetachedDockerReadiness(container, user);\n            }\n            return;\n        }\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const resume = (E2BSdkSandbox as unknown as {\n                resume?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<unknown>;\n                connect?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<unknown>;\n            });\n            if (typeof resume.resume === \"function\") {\n                await resume.resume(sandboxId, { apiKey: process.env.E2B_API_KEY });\n                return;\n            }\n            if (typeof resume.connect === \"function\") {\n                await resume.connect(sandboxId, { apiKey: process.env.E2B_API_KEY });\n                return;\n            }\n            throw new Error(\"this e2b SDK version has no resume capability\");\n        }\n        case \"vercel\": {\n            // Sandbox.get({ name, resume: true })(默认值)是 SDK 原生的恢复入口:sandbox 默认持久,\n            // get() 在会话已停止时自动从最近快照恢复文件系统并起新会话——不需要另一个专门的\n            // \"resume\" API(vercel.com/docs/sandbox/sdk-reference)。\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<unknown>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no get capability\");\n            await get({ name: sandboxId, resume: true });\n            return;\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no wake channel`);\n    }\n}\ninterface DockerInfoContainer {\n    exec(options: globalThis.Record<string, unknown>): Promise<{\n        start(options: globalThis.Record<string, unknown>): Promise<NodeJS.ReadableStream>;\n        inspect(): Promise<{\n            ExitCode?: number | null;\n        }>;\n    }>;\n}\ntype DockerInfoExecution = Awaited<ReturnType<DockerInfoContainer[\"exec\"]>>;\ntype DockerInfoProbeOutcome = {\n    readonly _tag: \"completed\";\n    readonly exitCode: number | null | undefined;\n} | {\n    readonly _tag: \"timed-out\";\n} | {\n    readonly _tag: \"failed\";\n};\nasync function waitForDetachedDockerReadiness(container: DockerInfoContainer, user: string): Promise<void> {\n    return Effect.runPromise(waitForDetachedDockerReadinessEffect(container, user));\n}\n/**\n * 轮询是 NiceEval 内部策略:deadline 用 `Clock.currentTimeMillis`、间隔与竞速用 `Clock.sleep`,\n * 与原来 `Date.now()` + `setTimeout` 的 30s 窗口 / 250ms 间隔 / 剩余量封顶公式完全一致。\n * 超时或中断都在 Effect fiber 上收束,不再手工管理 timer 或 stream 之外的计时器。\n */\nfunction waitForDetachedDockerReadinessEffect(container: DockerInfoContainer, user: string): Effect.Effect<void, Error> {\n    const readinessError = (lastExit: number | null | undefined): Error => new Error(`Docker DinD sandbox did not become ready after wake as user ${JSON.stringify(user)}` +\n        (lastExit === undefined ? \"\" : ` (docker info exit ${lastExit ?? \"unknown\"})`));\n    const pollAgain = (deadline: number, lastExit: number | null | undefined): Effect.Effect<void, Error> => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => {\n        const remaining = deadline - now;\n        if (remaining <= 0)\n            return Effect.fail(readinessError(lastExit));\n        return Clock.sleep(Math.min(250, remaining)).pipe(Effect.zipRight(attempt(deadline, lastExit)));\n    }));\n    const attempt = (deadline: number, lastExit: number | null | undefined): Effect.Effect<void, Error> => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => {\n        if (now > deadline)\n            return Effect.fail(readinessError(lastExit));\n        return dockerInfoProbe(container, user, deadline - now).pipe(Effect.flatMap((outcome) => {\n            if (outcome._tag === \"timed-out\")\n                return Effect.fail(readinessError(lastExit));\n            if (outcome._tag === \"failed\")\n                return pollAgain(deadline, undefined);\n            if (outcome.exitCode === 0)\n                return Effect.succeed(undefined);\n            return pollAgain(deadline, outcome.exitCode);\n        }));\n    }));\n    return Clock.currentTimeMillis.pipe(Effect.flatMap((now) => attempt(now + 30000, undefined)));\n}\n/**\n * 单轮探测:exec `docker info` → 起 stream → 与剩余时间竞速。exec/stream/inspect 都是 dockerode\n * (Node 进程/stream 叶子),留在 Promise 面由 `tryPromise`/`async` 适配;只有「等多久」和\n * 「到点后做什么」是 NiceEval 内部的,走 Effect Clock + 中断。\n */\nfunction dockerInfoProbe(container: DockerInfoContainer, user: string, timeoutMs: number): Effect.Effect<DockerInfoProbeOutcome, never> {\n    const startProbe: Effect.Effect<{\n        readonly execution: DockerInfoExecution;\n        readonly stream: NodeJS.ReadableStream;\n    }, unknown> = Effect.tryPromise({\n        try: () => container\n            .exec({\n            Cmd: [\"docker\", \"info\"],\n            User: user,\n            AttachStdout: true,\n            AttachStderr: true,\n        })\n            .then((execution) => execution.start({}).then((stream) => ({ execution, stream }))),\n        catch: (cause) => cause,\n    });\n    const probeOne = (execution: DockerInfoExecution, stream: NodeJS.ReadableStream): Effect.Effect<DockerInfoProbeOutcome, never> => {\n        const destroyStream = (): void => (stream as NodeJS.ReadableStream & {\n            destroy(): void;\n        }).destroy();\n        if (timeoutMs <= 0) {\n            destroyStream();\n            return Effect.succeed({ _tag: \"timed-out\" } as const);\n        }\n        const completed: Effect.Effect<\"completed\" | \"failed\", never> = Effect.async((resume) => {\n            stream.on(\"end\", () => resume(Effect.succeed(\"completed\")));\n            stream.on(\"error\", () => resume(Effect.succeed(\"failed\")));\n            stream.resume();\n        });\n        const timedOut: Effect.Effect<\"timed-out\", never> = Clock.sleep(timeoutMs).pipe(Effect.map(() => {\n            destroyStream();\n            return \"timed-out\" as const;\n        }));\n        return Effect.race(completed, timedOut).pipe(Effect.flatMap((outcome): Effect.Effect<DockerInfoProbeOutcome, never> => {\n            if (outcome === \"timed-out\")\n                return Effect.succeed({ _tag: \"timed-out\" } as const);\n            if (outcome === \"failed\")\n                return Effect.succeed({ _tag: \"failed\" } as const);\n            return Effect.tryPromise({\n                try: () => execution.inspect(),\n                catch: (cause) => cause,\n            }).pipe(Effect.map((info) => ({ _tag: \"completed\" as const, exitCode: info.ExitCode })), Effect.catchAll(() => Effect.succeed({ _tag: \"failed\" } as const)));\n        }));\n    };\n    return startProbe.pipe(Effect.flatMap(({ execution, stream }) => probeOne(execution, stream)), Effect.catchAll(() => Effect.succeed({ _tag: \"failed\" } as const)));\n}\n/** 送回休眠(enter 退出后 / history、diff 读完后)。 */\nexport async function suspendDetached(provider: string, sandboxId: string): Promise<void> {\n    switch (provider) {\n        case \"docker\": {\n            const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n            await new Docker().getContainer(sandboxId).stop({ t: 5 });\n            return;\n        }\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const pause = (E2BSdkSandbox as unknown as {\n                pause?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<unknown>;\n            }).pause;\n            if (typeof pause === \"function\") {\n                await pause(sandboxId, { apiKey: process.env.E2B_API_KEY });\n                return;\n            }\n            throw new Error(\"this e2b SDK version has no detached pause capability\");\n        }\n        case \"vercel\": {\n            // suspend = stop():自动打快照保存文件系统,之后经 Sandbox.get 恢复(留存语义见\n            // docs/feature/sandbox/architecture.md「留存(keep)与注册表」)。resume:false——这里\n            // 只想找到已经醒着的实例去 stop 它,不需要 get() 顺手再唤醒一次。\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                    stop(): Promise<unknown>;\n                } | null>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no get capability\");\n            const found = await get({ name: sandboxId, resume: false });\n            if (!found)\n                throw new Error(`vercel sandbox \"${sandboxId}\" not found; it may already be gone`);\n            await found.stop();\n            return;\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no suspend channel`);\n    }\n}\n/**\n * 打开交互式 shell(`niceeval sandbox enter`的落地动作):把三家 provider 各自的原生连接\n * 命令当子进程跑,stdio 直通当前终端——不重新实现各家的 PTY 协议(docker 是 exec 直连;e2b /\n * vercel 都有官方 CLI 已经处理好 PTY 转发,niceeval 只负责唤醒、启动这个子进程、退出后回眠)。\n * 返回子进程退出码;若原生命令本身起不来(如未安装对应 CLI),抛出原始 spawn 错误,调用方\n * 据此提示改用注册表里记录的 `enter` 命令直连。\n */\nexport async function openInteractiveShell(provider: string, sandboxId: string, workdir: string): Promise<number> {\n    switch (provider) {\n        case \"docker\":\n            return spawnAndWait(\"docker\", [\"exec\", \"-it\", \"-w\", workdir, sandboxId, \"bash\", \"-l\"]);\n        case \"e2b\":\n            return spawnAndWait(\"e2b\", [\"sandbox\", \"connect\", sandboxId]);\n        case \"vercel\": {\n            // sandbox CLI 复用 niceeval 已经在用的显式凭据(与 VercelSandbox.create 同一路径),\n            // 不强制用户额外 `vercel link` / `sandbox login`。\n            const args = [\"connect\", \"--workdir\", workdir];\n            const token = process.env.VERCEL_API_TOKEN;\n            const teamId = process.env.VERCEL_TEAM_ID;\n            const projectId = process.env.VERCEL_PROJECT_ID;\n            if (token)\n                args.push(\"--token\", token);\n            if (teamId)\n                args.push(\"--scope\", teamId);\n            if (projectId)\n                args.push(\"--project\", projectId);\n            args.push(sandboxId);\n            return spawnAndWait(\"sandbox\", args);\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no interactive enter channel`);\n    }\n}\nasync function spawnAndWait(cmd: string, args: string[]): Promise<number> {\n    const { spawn } = await __niceevalDynamicImport(\"node:child_process\");\n    return new Promise((resolvePromise, reject) => {\n        const child = spawn(cmd, args, { stdio: \"inherit\" });\n        child.on(\"exit\", (code) => resolvePromise(code ?? 0));\n        child.on(\"error\", (err) => reject(err));\n    });\n}\n/**\n * 在留存现场里跑一条非交互命令(`sandbox history` / `diff` 用,读私有变更分类账)。docker 走\n * dockerode exec(多路复用流需要按帧解析);e2b / vercel 走各自 SDK 拿到一个可 runCommand 的\n * 实例句柄——`wakeDetached` 已经确保现场醒着,这里只负责拿句柄、跑命令、取回 stdout。\n */\nexport async function execInDetached(provider: string, sandboxId: string, workdir: string, script: string): Promise<string> {\n    switch (provider) {\n        case \"docker\":\n            return execInDockerLedger(sandboxId, workdir, script);\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const sbx = await E2BSdkSandbox.connect(sandboxId, { apiKey: process.env.E2B_API_KEY });\n            const res = await sbx.commands.run(script, {\n                cwd: workdir,\n                envs: { GIT_DIR: DEFAULT_LEDGER_GIT_DIR, GIT_WORK_TREE: workdir, HOME: \"/tmp\" },\n            });\n            return res.stdout;\n        }\n        case \"vercel\": {\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                    runCommand(params: globalThis.Record<string, unknown>): Promise<{\n                        stdout(): Promise<string>;\n                    }>;\n                } | null>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no get capability\");\n            const found = await get({ name: sandboxId, resume: false });\n            if (!found)\n                throw new Error(`vercel sandbox \"${sandboxId}\" not found; the in-sandbox ledger died with it`);\n            const finished = await found.runCommand({\n                cmd: \"sh\",\n                args: [\"-c\", script],\n                cwd: workdir,\n                env: { GIT_DIR: DEFAULT_LEDGER_GIT_DIR, GIT_WORK_TREE: workdir, HOME: \"/tmp\" },\n            });\n            return await finished.stdout();\n        }\n        default:\n            throw new Error(`replaying the ledger has no exec channel for provider \"${provider}\"`);\n    }\n}\n/** docker 分支:dockerode exec 一条命令,多路复用流按 8 字节头逐帧剥离拼回文本。 */\nasync function execInDockerLedger(sandboxId: string, workdir: string, script: string): Promise<string> {\n    const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n    const container = new Docker().getContainer(sandboxId);\n    const exec = await container.exec({\n        Cmd: [\"sh\", \"-c\", script],\n        AttachStdout: true,\n        AttachStderr: true,\n        Env: [`GIT_DIR=${DEFAULT_LEDGER_GIT_DIR}`, `GIT_WORK_TREE=${workdir}`, \"HOME=/tmp\"],\n    });\n    const stream = await exec.start({});\n    return await new Promise<string>((resolvePromise, reject) => {\n        const chunks: Buffer[] = [];\n        stream.on(\"data\", (chunk: Buffer) => chunks.push(chunk));\n        stream.on(\"end\", () => {\n            // docker 多路复用帧:每帧 8 字节头(stream type + 长度),逐帧剥掉。\n            const raw = Buffer.concat(chunks);\n            let out = \"\";\n            let offset = 0;\n            while (offset + 8 <= raw.length) {\n                const size = raw.readUInt32BE(offset + 4);\n                out += raw.subarray(offset + 8, offset + 8 + size).toString(\"utf-8\");\n                offset += 8 + size;\n            }\n            resolvePromise(out || raw.toString(\"utf-8\"));\n        });\n        stream.on(\"error\", reject);\n    });\n}\n/**\n * 事后命令(`enter`/`history`/`diff`)在 CLI 层是否可对某 provider 名执行的静态守门——\n * 留存注册表只可能出现 `KEEPABLE_PROVIDERS` 三家之一;命中之外(手改注册表、跨版本遗留的\n * provider 名)如实报出「不是 niceeval sandbox provider」,不是逐条 `if (provider === …)`。\n * 返回 undefined 表示可执行;否则给出可直接展示给用户的原因。\n *\n * callback 自定义 case 不支持留存：`niceeval sandbox` 不加载用户模块，也没有可发现的\n * detached provider 实现可以在另一个进程中恢复或销毁资源组。\n */\nexport function detachedCapabilityGap(provider: string): string | undefined {\n    if (KEEPABLE_PROVIDERS.has(provider))\n        return undefined;\n    return `\"${provider}\" is not a niceeval sandbox provider (expected one of: ${[...KEEPABLE_PROVIDERS].join(\", \")})`;\n}\n/**\n * 创建前组合校验入口:只有可发现的内置 KEEPABLE provider 路径。\n * Runner 合流后应优先调 `assertKeepAllowedForCase`;本函数保留给尚无 planned case 的旧路径。\n */\nexport function assertProviderKeepable(provider: string, isCustomCreate: boolean): void {\n    if (isCustomCreate) {\n        throw new Error(`--keep-sandbox is not supported with a defineSandbox custom provider (\"${provider}\"): ` +\n            `the after-the-fact 'niceeval sandbox' commands never load project code, so a detached stop ` +\n            `for user-defined sandboxes cannot be recovered safely. Use a built-in provider (docker / e2b / vercel), ` +\n            `or drop --keep-sandbox.`);\n    }\n    if (!KEEPABLE_PROVIDERS.has(provider)) {\n        throw new Error(`--keep-sandbox is not supported with the \"${provider}\" provider: ` +\n            (provider === \"local\"\n                ? \"it never destroys the sandbox in the first place, so there is nothing to register for later retention — the workspace already sits exactly where the agent left it. Drop --keep-sandbox, or use a built-in cloud/container provider (docker / e2b / vercel) if you need a registry-managed retained sandbox.\"\n                : `expected one of: ${[...KEEPABLE_PROVIDERS].join(\", \")}. Drop --keep-sandbox.`));\n    }\n}\n"]}
+{"version":3,"file":"keep.js","sourceRoot":"","sources":["keep.ts"],"names":[],"mappings":";;;AAWA,wCAMC;AAOD,gDAWC;AAiBD,4CAOC;AAGD,0CAuDC;AAMD,0CA8DC;AAED,oCA8CC;AAqGD,0CAuCC;AAQD,oDAyBC;AAcD,wCAsCC;AAuCD,sDAIC;AAKD,wDAWC;AArgBD,wDAAwD;AACxD,4EAA4E;AAC5E,mEAAmE;AACnE,0BAA0B;AAC1B,mCAAuC;AAEvC,uDAA2D;AAC3D,6CAAmD;AACnD,6DAA6D;AAChD,QAAA,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvE,sEAAsE;AAC/D,KAAK,UAAU,cAAc,CAAC,OAAgB;IACjD,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AACD;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,gBAAgB,SAAS,uBAAuB,SAAS,OAAO,CAAC;QAC5E,KAAK,KAAK;YACN,OAAO,uBAAuB,SAAS,EAAE,CAAC;QAC9C,KAAK,QAAQ;YACT,OAAO,mBAAmB,SAAS,EAAE,CAAC;QAC1C;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AACD;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvE;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,qCAAqC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9F;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;gBACvE,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,CAAC;YACD,MAAM,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,IAAI,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBACxE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC1E,IAAI,GAGS,CAAC;gBACd,OAAO,SAAS,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/B,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpH,CAAC;gBACD,IAAI,CAAC,GAAG;oBACJ,OAAO,SAAS,CAAC;gBACrB,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,CAAC;YACD,MAAM,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC;gBACD,0DAA0D;gBAC1D,0BAA0B;gBAC1B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;gBAC/E,MAAM,GAAG,GAAI,QAIX,CAAC,GAAG,CAAC;gBACP,IAAI,OAAO,GAAG,KAAK,UAAU;oBACzB,OAAO,SAAS,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK;oBACN,OAAO,SAAS,CAAC;gBACrB,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AACD;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC;gBACD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,EAAE,CAAC;gBACP,IAAK,CAEH,CAAC,UAAU,KAAK,GAAG;oBACjB,OAAO,cAAc,CAAC;gBAC1B,MAAM,CAAC,CAAC;YACZ,CAAC;QACL,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,IAAI,GAAI,aAEZ,CAAC,IAAI,CAAC;YACR,IAAI,OAAO,IAAI,KAAK,UAAU;gBAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,wEAAwE;YACxE,qDAAqD;YACrD,0DAA0D;YAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAIX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9E,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACD,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,IAAK,KAGH,CAAC,UAAU,KAAK,GAAG,IAAK,KAExB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAChB,OAAO,cAAc,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,KAAK;gBACN,OAAO,cAAc,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,gCAAgC,CAAC,CAAC;IAC/E,CAAC;AACL,CAAC;AACD,yEAAyE;AAClE,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO;gBACpB,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,IAAI,MAAM,CAAC;gBAC1E,MAAM,8BAA8B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACX,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,MAAM,GAAI,aAGd,CAAC;YACH,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpE,OAAO;YACX,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACrE,OAAO;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,sEAAsE;YACtE,6CAA6C;YAC7C,uDAAuD;YACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAEX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO;QACX,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,uBAAuB,CAAC,CAAC;IACtE,CAAC;AACL,CAAC;AAkBD,KAAK,UAAU,8BAA8B,CAAC,SAA8B,EAAE,IAAY;IACtF,OAAO,eAAM,CAAC,UAAU,CAAC,oCAAoC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC;AACD;;;;GAIG;AACH,SAAS,oCAAoC,CAAC,SAA8B,EAAE,IAAY;IACtF,MAAM,cAAc,GAAG,CAAC,QAAmC,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,+DAA+D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAClK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,QAAQ,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,QAAmC,EAA8B,EAAE,CAAC,cAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzJ,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,CAAC;QACjC,IAAI,SAAS,IAAI,CAAC;YACd,OAAO,eAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,OAAO,cAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,QAAmC,EAA8B,EAAE,CAAC,cAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACvJ,IAAI,GAAG,GAAG,QAAQ;YACd,OAAO,eAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAC5B,OAAO,eAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;gBACtB,OAAO,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAC,CAAC;IACJ,OAAO,cAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AACD;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAA8B,EAAE,IAAY,EAAE,SAAiB;IACpF,MAAM,UAAU,GAGF,eAAM,CAAC,UAAU,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;aACf,IAAI,CAAC;YACN,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;YACvB,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;SACrB,CAAC;aACG,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACvF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,SAA8B,EAAE,MAA6B,EAAgD,EAAE;QAC7H,MAAM,aAAa,GAAG,GAAS,EAAE,CAAE,MAEjC,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,OAAO,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAW,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,SAAS,GAAiD,eAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;YACpF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAsC,cAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YAC5F,aAAa,EAAE,CAAC;YAChB,OAAO,WAAoB,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC;QACJ,OAAO,eAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAgD,EAAE;YAClH,IAAI,OAAO,KAAK,WAAW;gBACvB,OAAO,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAW,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,QAAQ;gBACpB,OAAO,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,CAAC;YACvD,OAAO,eAAM,CAAC,UAAU,CAAC;gBACrB,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;aAC1B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,CAAC,CAAC,CAAC;QACjK,CAAC,CAAC,CAAC,CAAC;IACR,CAAC,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,CAAC,CAAC,CAAC;AACvK,CAAC;AACD,0CAA0C;AACnC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO;QACX,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAI,aAEb,CAAC,KAAK,CAAC;YACT,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC5D,OAAO;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,wDAAwD;YACxD,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAIX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK;gBACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,qCAAqC,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO;QACX,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,0BAA0B,CAAC,CAAC;IACzE,CAAC;AACL,CAAC;AACD;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAe;IAC3F,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3F,KAAK,KAAK;YACN,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,kEAAkE;YAClE,2CAA2C;YAC3C,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAChD,IAAI,KAAK;gBACL,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM;gBACN,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjC,IAAI,SAAS;gBACT,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,OAAO,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,oCAAoC,CAAC,CAAC;IACnF,CAAC;AACL,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAc;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACP,CAAC;AACD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAe,EAAE,MAAc;IACrG,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ;YACT,OAAO,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,KAAK,CAAC,CAAC,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;gBACvC,GAAG,EAAE,OAAO;gBACZ,IAAI,EAAE,EAAE,OAAO,EAAE,wCAAsB,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;aAClF,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAMX,CAAC,GAAG,CAAC;YACP,IAAI,OAAO,GAAG,KAAK,UAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK;gBACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,iDAAiD,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC;gBACpC,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;gBACpB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAsB,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;aACjF,CAAC,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD;YACI,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,GAAG,CAAC,CAAC;IAC/F,CAAC;AACL,CAAC;AACD,0DAA0D;AAC1D,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,OAAe,EAAE,MAAc;IAChF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;QAC9B,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,CAAC,WAAW,wCAAsB,EAAE,EAAE,iBAAiB,OAAO,EAAE,EAAE,WAAW,CAAC;KACtF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAClB,gDAAgD;YAChD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC1C,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrE,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,cAAc,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC;AACD;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAgB;IAClD,IAAI,0BAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,OAAO,SAAS,CAAC;IACrB,OAAO,IAAI,QAAQ,0DAA0D,CAAC,GAAG,0BAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvH,CAAC;AACD;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,QAAgB,EAAE,cAAuB;IAC5E,IAAI,cAAc,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0EAA0E,QAAQ,MAAM;YACpG,6FAA6F;YAC7F,0GAA0G;YAC1G,yBAAyB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,0BAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,cAAc;YAC/E,oBAAoB,CAAC,GAAG,0BAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxF,CAAC;AACL,CAAC","sourcesContent":["// 留存生命周期的 sandbox/ 域内路由:in-run 的 suspend(留存提交后转休眠)与事后命令\n// (`niceeval sandbox list/enter/stop`)用的 detached 能力(不需要原来的 run 进程或 Sandbox\n// 实例还活着)。provider 名的行为分支只允许出现在 sandbox/ 内(见 docs/architecture.md);\n// 运行器与评分路径不感知 provider 名。\nimport { Clock, Effect } from \"effect\";\nimport type { Sandbox } from \"../types.ts\";\nimport { DEFAULT_LEDGER_GIT_DIR } from \"./ledger-paths.ts\";\nimport { sandboxCapabilities } from \"./backend.ts\";\n/** provider 是否参与留存(defineSandbox 自定义 provider 不参与,创建前报错)。 */\nexport const KEEPABLE_PROVIDERS = new Set([\"docker\", \"e2b\", \"vercel\"]);\n/** in-run 的休眠:留存提交成功后由 Sample release 调用(sandbox.suspend 阶段,有界计时)。 */\nexport async function suspendSandbox(sandbox: Sandbox): Promise<void> {\n    const suspend = sandboxCapabilities(sandbox).suspend;\n    if (suspend._tag === \"Unsupported\") {\n        throw new Error(`sandbox provider has no suspend capability (sandboxId=${sandbox.sandboxId})`);\n    }\n    await suspend.value();\n}\n/**\n * provider 原生的进入命令(记进注册表供直连与审计;日常入口是 `niceeval sandbox enter`)。\n * `sandboxId` 对 vercel 而言是沙箱的持久 `name`——官方 CLI(独立 npm 包 `sandbox`,别名\n * `sbx`)按 name 索引,`sandbox connect <name>`(别名 `ssh`/`shell`)唤醒并打开交互式 shell,\n * 与 docker/e2b 的\"原生命令即可直连\"语义一致(vercel.com/docs/sandbox/cli-reference)。\n */\nexport function nativeEnterCommand(provider: string, sandboxId: string): string | undefined {\n    switch (provider) {\n        case \"docker\":\n            return `docker start ${sandboxId} && docker exec -it ${sandboxId} bash`;\n        case \"e2b\":\n            return `e2b sandbox connect ${sandboxId}`;\n        case \"vercel\":\n            return `sandbox connect ${sandboxId}`;\n        default:\n            return undefined;\n    }\n}\n/**\n * Vercel 持久沙箱的默认快照保留期限:`snapshotExpiration` 默认 2,592,000,000ms(30 天),\n * 从快照最后一次使用起算(官方文档 vercel.com/docs/sandbox/concepts/persistent-sandboxes)。\n * niceeval 的 `VercelSandbox.create()` 不传自定义 `snapshotExpiration`,这个默认值就是\n * suspend(`stop()`,自动打快照)之后实际生效的保留期限。\n */\nconst VERCEL_DEFAULT_SNAPSHOT_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1000;\n/**\n * 留存提交时算出 `expiresAt`——与 `nativeEnterCommand` 同步、无 IO,在 `writeKeptEntry`\n * 原子写入之前算好:provider 声明了保留期限才写。\n *\n * - **vercel**:写 `keptAt` + 默认快照保留期(30 天)。\n * - **e2b**:不写——官方文档(\"paused sandboxes are kept indefinitely; there is no\n *   automatic deletion or time-to-live limit\")明确 pause 没有自然过期时刻。\n * - **docker**:不写——docker 的留存是本地停驻容器,不是「远端保留期限」这个概念。\n */\nexport function computeExpiresAt(provider: string, keptAt: string): string | undefined {\n    switch (provider) {\n        case \"vercel\":\n            return new Date(Date.parse(keptAt) + VERCEL_DEFAULT_SNAPSHOT_EXPIRATION_MS).toISOString();\n        default:\n            return undefined;\n    }\n}\nexport type DetachedState = \"alive\" | \"dormant\" | \"expired\" | \"unknown\";\n/** 事后核对现场状态(docker 问本地 daemon;云 provider 按实例状态核对,查不到 = expired)。 */\nexport async function inspectDetached(provider: string, sandboxId: string): Promise<DetachedState> {\n    switch (provider) {\n        case \"docker\": {\n            try {\n                const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n                const info = await new Docker().getContainer(sandboxId).inspect();\n                return info.State?.Running ? \"alive\" : \"dormant\";\n            }\n            catch {\n                return \"unknown\";\n            }\n        }\n        case \"e2b\": {\n            try {\n                const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n                const paginator = E2BSdkSandbox.list({ apiKey: process.env.E2B_API_KEY });\n                let hit: {\n                    sandboxId: string;\n                    state?: string;\n                } | undefined;\n                while (paginator.hasNext && !hit) {\n                    hit = (await paginator.nextItems()).find((s) => s.sandboxId === sandboxId || s.sandboxId.startsWith(sandboxId));\n                }\n                if (!hit)\n                    return \"expired\";\n                return hit.state === \"running\" ? \"alive\" : \"dormant\";\n            }\n            catch {\n                return \"unknown\";\n            }\n        }\n        case \"vercel\": {\n            try {\n                // 查状态用 name + resume:false——不为了看一眼状态就把休眠的沙箱唤醒(list 是只读命令,\n                // 不该有唤醒这个副作用,也不该产生唤醒的计费)。\n                const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n                const get = (VSandbox as unknown as {\n                    get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                        status: string;\n                    } | null>;\n                }).get;\n                if (typeof get !== \"function\")\n                    return \"dormant\";\n                const found = await get({ name: sandboxId, resume: false });\n                if (!found)\n                    return \"expired\";\n                return found.status === \"running\" ? \"alive\" : \"dormant\";\n            }\n            catch {\n                return \"unknown\";\n            }\n        }\n        default:\n            return \"expired\";\n    }\n}\n/**\n * detached 销毁:按注册表条目的 provider 名路由,不需要 Sandbox 实例。\n * 返回 \"stopped\"(成功销毁)或 \"already-gone\"(实例已不存在,幂等);\n * 其它错误上抛——调用方保留登记项并退出 1,不能把仍活着的资源从管理面隐藏掉。\n */\nexport async function destroyDetached(provider: string, sandboxId: string): Promise<\"stopped\" | \"already-gone\"> {\n    switch (provider) {\n        case \"docker\": {\n            const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n            const container = new Docker().getContainer(sandboxId);\n            try {\n                await container.remove({ force: true });\n                return \"stopped\";\n            }\n            catch (e) {\n                if ((e as {\n                    statusCode?: number;\n                }).statusCode === 404)\n                    return \"already-gone\";\n                throw e;\n            }\n        }\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const kill = (E2BSdkSandbox as unknown as {\n                kill?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<boolean>;\n            }).kill;\n            if (typeof kill !== \"function\")\n                throw new Error(\"this e2b SDK version has no detached kill capability\");\n            const killed = await kill(sandboxId, { apiKey: process.env.E2B_API_KEY });\n            return killed ? \"stopped\" : \"already-gone\";\n        }\n        case \"vercel\": {\n            // 真正的销毁是 SDK 的 delete()(≙ 官方 CLI 的 `sandbox remove`)——stop() 只是 suspend\n            // (自动打快照、之后能 Sandbox.get 恢复),把它当销毁用会把\"已删除\"的沙箱悄悄留成可恢复\n            // 的休眠态,`sandbox stop` 的\"销毁\"承诺就不成立了。resume:false 避免删除前先唤醒。\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                    delete(): Promise<void>;\n                } | null>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no detached get capability\");\n            let found;\n            try {\n                found = await get({ name: sandboxId, resume: false });\n            }\n            catch (error) {\n                if ((error as {\n                    statusCode?: number;\n                    status?: number;\n                }).statusCode === 404 || (error as {\n                    status?: number;\n                }).status === 404) {\n                    return \"already-gone\";\n                }\n                throw error;\n            }\n            if (!found)\n                return \"already-gone\";\n            await found.delete();\n            return \"stopped\";\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no detached stop channel`);\n    }\n}\n/** 唤醒休眠现场(enter / history / diff 前);docker start,云 provider 按 SDK 恢复。 */\nexport async function wakeDetached(provider: string, sandboxId: string): Promise<void> {\n    switch (provider) {\n        case \"docker\": {\n            const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n            const container = new Docker().getContainer(sandboxId);\n            const info = await container.inspect();\n            if (!info.State?.Running)\n                await container.start();\n            if (info.Config?.Labels?.[\"niceeval.docker-access\"] === \"dind\") {\n                const user = info.Config.Labels[\"niceeval.dind-readiness-user\"] || \"root\";\n                await waitForDetachedDockerReadiness(container, user);\n            }\n            return;\n        }\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const resume = (E2BSdkSandbox as unknown as {\n                resume?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<unknown>;\n                connect?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<unknown>;\n            });\n            if (typeof resume.resume === \"function\") {\n                await resume.resume(sandboxId, { apiKey: process.env.E2B_API_KEY });\n                return;\n            }\n            if (typeof resume.connect === \"function\") {\n                await resume.connect(sandboxId, { apiKey: process.env.E2B_API_KEY });\n                return;\n            }\n            throw new Error(\"this e2b SDK version has no resume capability\");\n        }\n        case \"vercel\": {\n            // Sandbox.get({ name, resume: true })(默认值)是 SDK 原生的恢复入口:sandbox 默认持久,\n            // get() 在会话已停止时自动从最近快照恢复文件系统并起新会话——不需要另一个专门的\n            // \"resume\" API(vercel.com/docs/sandbox/sdk-reference)。\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<unknown>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no get capability\");\n            await get({ name: sandboxId, resume: true });\n            return;\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no wake channel`);\n    }\n}\ninterface DockerInfoContainer {\n    exec(options: globalThis.Record<string, unknown>): Promise<{\n        start(options: globalThis.Record<string, unknown>): Promise<NodeJS.ReadableStream>;\n        inspect(): Promise<{\n            ExitCode?: number | null;\n        }>;\n    }>;\n}\ntype DockerInfoExecution = Awaited<ReturnType<DockerInfoContainer[\"exec\"]>>;\ntype DockerInfoProbeOutcome = {\n    readonly _tag: \"completed\";\n    readonly exitCode: number | null | undefined;\n} | {\n    readonly _tag: \"timed-out\";\n} | {\n    readonly _tag: \"failed\";\n};\nasync function waitForDetachedDockerReadiness(container: DockerInfoContainer, user: string): Promise<void> {\n    return Effect.runPromise(waitForDetachedDockerReadinessEffect(container, user));\n}\n/**\n * 轮询是 NiceEval 内部策略:deadline 用 `Clock.currentTimeMillis`、间隔与竞速用 `Clock.sleep`,\n * 与原来 `Date.now()` + `setTimeout` 的 30s 窗口 / 250ms 间隔 / 剩余量封顶公式完全一致。\n * 超时或中断都在 Effect fiber 上收束,不再手工管理 timer 或 stream 之外的计时器。\n */\nfunction waitForDetachedDockerReadinessEffect(container: DockerInfoContainer, user: string): Effect.Effect<void, Error> {\n    const readinessError = (lastExit: number | null | undefined): Error => new Error(`Docker DinD sandbox did not become ready after wake as user ${JSON.stringify(user)}` +\n        (lastExit === undefined ? \"\" : ` (docker info exit ${lastExit ?? \"unknown\"})`));\n    const pollAgain = (deadline: number, lastExit: number | null | undefined): Effect.Effect<void, Error> => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => {\n        const remaining = deadline - now;\n        if (remaining <= 0)\n            return Effect.fail(readinessError(lastExit));\n        return Clock.sleep(Math.min(250, remaining)).pipe(Effect.zipRight(attempt(deadline, lastExit)));\n    }));\n    const attempt = (deadline: number, lastExit: number | null | undefined): Effect.Effect<void, Error> => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => {\n        if (now > deadline)\n            return Effect.fail(readinessError(lastExit));\n        return dockerInfoProbe(container, user, deadline - now).pipe(Effect.flatMap((outcome) => {\n            if (outcome._tag === \"timed-out\")\n                return Effect.fail(readinessError(lastExit));\n            if (outcome._tag === \"failed\")\n                return pollAgain(deadline, undefined);\n            if (outcome.exitCode === 0)\n                return Effect.succeed(undefined);\n            return pollAgain(deadline, outcome.exitCode);\n        }));\n    }));\n    return Clock.currentTimeMillis.pipe(Effect.flatMap((now) => attempt(now + 30000, undefined)));\n}\n/**\n * 单轮探测:exec `docker info` → 起 stream → 与剩余时间竞速。exec/stream/inspect 都是 dockerode\n * (Node 进程/stream 叶子),留在 Promise 面由 `tryPromise`/`async` 适配;只有「等多久」和\n * 「到点后做什么」是 NiceEval 内部的,走 Effect Clock + 中断。\n */\nfunction dockerInfoProbe(container: DockerInfoContainer, user: string, timeoutMs: number): Effect.Effect<DockerInfoProbeOutcome, never> {\n    const startProbe: Effect.Effect<{\n        readonly execution: DockerInfoExecution;\n        readonly stream: NodeJS.ReadableStream;\n    }, unknown> = Effect.tryPromise({\n        try: () => container\n            .exec({\n            Cmd: [\"docker\", \"info\"],\n            User: user,\n            AttachStdout: true,\n            AttachStderr: true,\n        })\n            .then((execution) => execution.start({}).then((stream) => ({ execution, stream }))),\n        catch: (cause) => cause,\n    });\n    const probeOne = (execution: DockerInfoExecution, stream: NodeJS.ReadableStream): Effect.Effect<DockerInfoProbeOutcome, never> => {\n        const destroyStream = (): void => (stream as NodeJS.ReadableStream & {\n            destroy(): void;\n        }).destroy();\n        if (timeoutMs <= 0) {\n            destroyStream();\n            return Effect.succeed({ _tag: \"timed-out\" } as const);\n        }\n        const completed: Effect.Effect<\"completed\" | \"failed\", never> = Effect.async((resume) => {\n            stream.on(\"end\", () => resume(Effect.succeed(\"completed\")));\n            stream.on(\"error\", () => resume(Effect.succeed(\"failed\")));\n            stream.resume();\n        });\n        const timedOut: Effect.Effect<\"timed-out\", never> = Clock.sleep(timeoutMs).pipe(Effect.map(() => {\n            destroyStream();\n            return \"timed-out\" as const;\n        }));\n        return Effect.race(completed, timedOut).pipe(Effect.flatMap((outcome): Effect.Effect<DockerInfoProbeOutcome, never> => {\n            if (outcome === \"timed-out\")\n                return Effect.succeed({ _tag: \"timed-out\" } as const);\n            if (outcome === \"failed\")\n                return Effect.succeed({ _tag: \"failed\" } as const);\n            return Effect.tryPromise({\n                try: () => execution.inspect(),\n                catch: (cause) => cause,\n            }).pipe(Effect.map((info) => ({ _tag: \"completed\" as const, exitCode: info.ExitCode })), Effect.catchAll(() => Effect.succeed({ _tag: \"failed\" } as const)));\n        }));\n    };\n    return startProbe.pipe(Effect.flatMap(({ execution, stream }) => probeOne(execution, stream)), Effect.catchAll(() => Effect.succeed({ _tag: \"failed\" } as const)));\n}\n/** 送回休眠(enter 退出后 / history、diff 读完后)。 */\nexport async function suspendDetached(provider: string, sandboxId: string): Promise<void> {\n    switch (provider) {\n        case \"docker\": {\n            const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n            await new Docker().getContainer(sandboxId).stop({ t: 5 });\n            return;\n        }\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const pause = (E2BSdkSandbox as unknown as {\n                pause?: (id: string, opts?: globalThis.Record<string, unknown>) => Promise<unknown>;\n            }).pause;\n            if (typeof pause === \"function\") {\n                await pause(sandboxId, { apiKey: process.env.E2B_API_KEY });\n                return;\n            }\n            throw new Error(\"this e2b SDK version has no detached pause capability\");\n        }\n        case \"vercel\": {\n            // suspend = stop():自动打快照保存文件系统,之后经 Sandbox.get 恢复(留存语义见\n            // docs/feature/sandbox/architecture.md「留存(keep)与注册表」)。resume:false——这里\n            // 只想找到已经醒着的实例去 stop 它,不需要 get() 顺手再唤醒一次。\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                    stop(): Promise<unknown>;\n                } | null>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no get capability\");\n            const found = await get({ name: sandboxId, resume: false });\n            if (!found)\n                throw new Error(`vercel sandbox \"${sandboxId}\" not found; it may already be gone`);\n            await found.stop();\n            return;\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no suspend channel`);\n    }\n}\n/**\n * 打开交互式 shell(`niceeval sandbox enter`的落地动作):把三家 provider 各自的原生连接\n * 命令当子进程跑,stdio 直通当前终端——不重新实现各家的 PTY 协议(docker 是 exec 直连;e2b /\n * vercel 都有官方 CLI 已经处理好 PTY 转发,niceeval 只负责唤醒、启动这个子进程、退出后回眠)。\n * 返回子进程退出码;若原生命令本身起不来(如未安装对应 CLI),抛出原始 spawn 错误,调用方\n * 据此提示改用注册表里记录的 `enter` 命令直连。\n */\nexport async function openInteractiveShell(provider: string, sandboxId: string, workdir: string): Promise<number> {\n    switch (provider) {\n        case \"docker\":\n            return spawnAndWait(\"docker\", [\"exec\", \"-it\", \"-w\", workdir, sandboxId, \"bash\", \"-l\"]);\n        case \"e2b\":\n            return spawnAndWait(\"e2b\", [\"sandbox\", \"connect\", sandboxId]);\n        case \"vercel\": {\n            // sandbox CLI 复用 niceeval 已经在用的显式凭据(与 VercelSandbox.create 同一路径),\n            // 不强制用户额外 `vercel link` / `sandbox login`。\n            const args = [\"connect\", \"--workdir\", workdir];\n            const token = process.env.VERCEL_API_TOKEN;\n            const teamId = process.env.VERCEL_TEAM_ID;\n            const projectId = process.env.VERCEL_PROJECT_ID;\n            if (token)\n                args.push(\"--token\", token);\n            if (teamId)\n                args.push(\"--scope\", teamId);\n            if (projectId)\n                args.push(\"--project\", projectId);\n            args.push(sandboxId);\n            return spawnAndWait(\"sandbox\", args);\n        }\n        default:\n            throw new Error(`provider \"${provider}\" has no interactive enter channel`);\n    }\n}\nasync function spawnAndWait(cmd: string, args: string[]): Promise<number> {\n    const { spawn } = await __niceevalDynamicImport(\"node:child_process\");\n    return new Promise((resolvePromise, reject) => {\n        const child = spawn(cmd, args, { stdio: \"inherit\" });\n        child.on(\"exit\", (code) => resolvePromise(code ?? 0));\n        child.on(\"error\", (err) => reject(err));\n    });\n}\n/**\n * 在留存现场里跑一条非交互命令(`sandbox history` / `diff` 用,读私有变更分类账)。docker 走\n * dockerode exec(多路复用流需要按帧解析);e2b / vercel 走各自 SDK 拿到一个可 runCommand 的\n * 实例句柄——`wakeDetached` 已经确保现场醒着,这里只负责拿句柄、跑命令、取回 stdout。\n */\nexport async function execInDetached(provider: string, sandboxId: string, workdir: string, script: string): Promise<string> {\n    switch (provider) {\n        case \"docker\":\n            return execInDockerLedger(sandboxId, workdir, script);\n        case \"e2b\": {\n            const { Sandbox: E2BSdkSandbox } = await __niceevalDynamicImport(\"e2b\");\n            const sbx = await E2BSdkSandbox.connect(sandboxId, { apiKey: process.env.E2B_API_KEY });\n            const res = await sbx.commands.run(script, {\n                cwd: workdir,\n                envs: { GIT_DIR: DEFAULT_LEDGER_GIT_DIR, GIT_WORK_TREE: workdir, HOME: \"/tmp\" },\n            });\n            return res.stdout;\n        }\n        case \"vercel\": {\n            const { Sandbox: VSandbox } = await __niceevalDynamicImport(\"@vercel/sandbox\");\n            const get = (VSandbox as unknown as {\n                get?: (opts: globalThis.Record<string, unknown>) => Promise<{\n                    runCommand(params: globalThis.Record<string, unknown>): Promise<{\n                        stdout(): Promise<string>;\n                    }>;\n                } | null>;\n            }).get;\n            if (typeof get !== \"function\")\n                throw new Error(\"this vercel SDK version has no get capability\");\n            const found = await get({ name: sandboxId, resume: false });\n            if (!found)\n                throw new Error(`vercel sandbox \"${sandboxId}\" not found; the in-sandbox ledger died with it`);\n            const finished = await found.runCommand({\n                cmd: \"sh\",\n                args: [\"-c\", script],\n                cwd: workdir,\n                env: { GIT_DIR: DEFAULT_LEDGER_GIT_DIR, GIT_WORK_TREE: workdir, HOME: \"/tmp\" },\n            });\n            return await finished.stdout();\n        }\n        default:\n            throw new Error(`replaying the ledger has no exec channel for provider \"${provider}\"`);\n    }\n}\n/** docker 分支:dockerode exec 一条命令,多路复用流按 8 字节头逐帧剥离拼回文本。 */\nasync function execInDockerLedger(sandboxId: string, workdir: string, script: string): Promise<string> {\n    const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n    const container = new Docker().getContainer(sandboxId);\n    const exec = await container.exec({\n        Cmd: [\"sh\", \"-c\", script],\n        AttachStdout: true,\n        AttachStderr: true,\n        Env: [`GIT_DIR=${DEFAULT_LEDGER_GIT_DIR}`, `GIT_WORK_TREE=${workdir}`, \"HOME=/tmp\"],\n    });\n    const stream = await exec.start({});\n    return await new Promise<string>((resolvePromise, reject) => {\n        const chunks: Buffer[] = [];\n        stream.on(\"data\", (chunk: Buffer) => chunks.push(chunk));\n        stream.on(\"end\", () => {\n            // docker 多路复用帧:每帧 8 字节头(stream type + 长度),逐帧剥掉。\n            const raw = Buffer.concat(chunks);\n            let out = \"\";\n            let offset = 0;\n            while (offset + 8 <= raw.length) {\n                const size = raw.readUInt32BE(offset + 4);\n                out += raw.subarray(offset + 8, offset + 8 + size).toString(\"utf-8\");\n                offset += 8 + size;\n            }\n            resolvePromise(out || raw.toString(\"utf-8\"));\n        });\n        stream.on(\"error\", reject);\n    });\n}\n/**\n * 事后命令(`enter`/`history`/`diff`)在 CLI 层是否可对某 provider 名执行的静态守门——\n * 留存注册表只可能出现 `KEEPABLE_PROVIDERS` 三家之一;命中之外(手改注册表、跨版本遗留的\n * provider 名)如实报出「不是 niceeval sandbox provider」,不是逐条 `if (provider === …)`。\n * 返回 undefined 表示可执行;否则给出可直接展示给用户的原因。\n *\n * callback 自定义 case 不支持留存：`niceeval sandbox` 不加载用户模块，也没有可发现的\n * detached provider 实现可以在另一个进程中恢复或销毁资源组。\n */\nexport function detachedCapabilityGap(provider: string): string | undefined {\n    if (KEEPABLE_PROVIDERS.has(provider))\n        return undefined;\n    return `\"${provider}\" is not a niceeval sandbox provider (expected one of: ${[...KEEPABLE_PROVIDERS].join(\", \")})`;\n}\n/**\n * 创建前组合校验入口:只有可发现的内置 KEEPABLE provider 路径。\n * Runner 合流后应优先调 `assertKeepAllowedForCase`;本函数保留给尚无 planned case 的旧路径。\n */\nexport function assertProviderKeepable(provider: string, isCustomCreate: boolean): void {\n    if (isCustomCreate) {\n        throw new Error(`--keep-sandbox is not supported with a defineSandbox custom provider (\"${provider}\"): ` +\n            `the after-the-fact 'niceeval sandbox' commands never load project code, so a detached stop ` +\n            `for user-defined sandboxes cannot be recovered safely. Use a built-in provider (docker / e2b / vercel), ` +\n            `or drop --keep-sandbox.`);\n    }\n    if (!KEEPABLE_PROVIDERS.has(provider)) {\n        throw new Error(`--keep-sandbox is not supported with the \"${provider}\" provider: ` +\n            `expected one of: ${[...KEEPABLE_PROVIDERS].join(\", \")}. Drop --keep-sandbox.`);\n    }\n}\n"]}

package/dist/sandbox/layer.cjs

@@ -1,7 +1,7 @@
 "use strict";
 const __niceevalDynamicImport = (specifier) => import(specifier);
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.localSandbox = exports.vercelSandbox = exports.e2bSandbox = exports.dockerComposeSandbox = exports.SandboxProviderPlanningError = exports.CustomSandboxMaterializationError = void 0;
+exports.vercelSandbox = exports.e2bSandbox = exports.dockerComposeSandbox = exports.SandboxProviderPlanningError = exports.CustomSandboxMaterializationError = void 0;
 exports.sandboxProviderPlan = sandboxProviderPlan;
 exports.sandboxProviderBindingOf = sandboxProviderBindingOf;
 exports.sandboxLayer = sandboxLayer;
@@ -35,8 +35,8 @@ const SANDBOX_PROVIDER_BINDINGS = new WeakMap();
 const SANDBOX_PROVIDER_PLAN = Symbol("niceeval.sandbox.provider-plan");
 // Runtime resource/privileged coverage changed without changing Dockerfile build bytes. Keep the
 // Dockerfile builder revision stable, but advance the provider-plan/fingerprint revision.
-const DOCKERFILE_PROVIDER_PLANNER_REVISION = "dockerfile-4";
-const DOCKER_IMAGE_PROVIDER_REVISION = "docker-image-3";
+const DOCKERFILE_PROVIDER_PLANNER_REVISION = "dockerfile-5";
+const DOCKER_IMAGE_PROVIDER_REVISION = "docker-image-4";
 class CustomSandboxMaterializationError extends effect_1.Data.TaggedError("CustomSandboxMaterializationError") {
 }
 exports.CustomSandboxMaterializationError = CustomSandboxMaterializationError;
@@ -389,8 +389,14 @@ function dockerAccess(value, path) {
         throw new TypeError(`${path}.mode must be "socket" or "dind"`);
     const isolation = nonEmptyString(value.isolation, `${path}.isolation`);
     if (isolation === "raw-privileged") {
-        assertOnlyKeys(value, ["mode", "isolation"], path);
-        return Object.freeze({ mode: "dind", isolation: "raw-privileged" });
+        assertOnlyKeys(value, ["mode", "isolation", "storageProfile"], path);
+        return Object.freeze({
+            mode: "dind",
+            isolation: "raw-privileged",
+            ...(value.storageProfile === undefined
+                ? {}
+                : { storageProfile: nonEmptyString(value.storageProfile, `${path}.storageProfile`) }),
+        });
     }
     if (isolation === "managed-rootless") {
         assertOnlyKeys(value, ["mode", "isolation", "profile"], path);
@@ -410,8 +416,9 @@ function dockerAccessConfiguration(value, legacyProfile, legacyPrivileged, path)
         }
         if (access.mode === "socket")
             return Object.freeze({ access, privileged: "disabled" });
-        if (access.isolation === "raw-privileged")
-            return Object.freeze({ access, privileged: "raw" });
+        if (access.isolation === "raw-privileged") {
+            return Object.freeze({ access, profile: access.storageProfile, privileged: "raw" });
+        }
         return Object.freeze({ access, profile: access.profile, privileged: "rootless" });
     }
     const profile = dockerProfileAlias(legacyProfile, path.replace(/dockerAccess$/, "profile"));
@@ -461,18 +468,19 @@ function managedDockerResources(value, path) {
         throw (0, errors_ts_1.dockerProfileError)({
             code: "sandbox.docker-profile-resources-required",
             path,
-            message: "profile-bound Docker sandbox requires explicit CPU, memory, PID and readOnlyRootfs resources",
+            message: "managed Docker sandbox requires explicit CPU, memory, PID, dockerDataBytes and readOnlyRootfs resources",
         });
     }
     const resources = dockerResources(value, path);
     if (resources.cpus === undefined ||
         resources.memoryBytes === undefined ||
         resources.pidsLimit === undefined ||
+        resources.dockerDataBytes === undefined ||
         resources.readOnlyRootfs !== true) {
         throw (0, errors_ts_1.dockerProfileError)({
             code: "sandbox.docker-profile-resources-required",
             path,
-            message: "profile-bound Docker sandbox requires explicit CPU, memory, PID and readOnlyRootfs: true resources",
+            message: "managed Docker sandbox requires explicit CPU, memory, PID, dockerDataBytes and readOnlyRootfs: true resources",
         });
     }
     return Object.freeze({
@@ -480,6 +488,7 @@ function managedDockerResources(value, path) {
         cpus: resources.cpus,
         memoryBytes: resources.memoryBytes,
         pidsLimit: resources.pidsLimit,
+        dockerDataBytes: resources.dockerDataBytes,
         readOnlyRootfs: true,
     });
 }
@@ -491,7 +500,32 @@ function dockerResourcesForProfile(profile, privileged, value, path) {
             message: 'privileged: "rootless" requires an explicit Docker profile alias',
         });
     }
-    return profile === undefined ? dockerResources(value, path) : managedDockerResources(value, path);
+    const resources = dockerResources(value, path);
+    if (resources.dockerDataBytes !== undefined && privileged === "disabled") {
+        throw (0, errors_ts_1.dockerProfileError)({
+            code: "sandbox.docker-profile-required",
+            path: `${path}.dockerDataBytes`,
+            message: "dockerDataBytes is only available to profile-bound DinD",
+        });
+    }
+    if (privileged === "raw") {
+        if (resources.dockerDataBytes !== undefined && profile === undefined) {
+            throw (0, errors_ts_1.dockerProfileError)({
+                code: "sandbox.docker-profile-required",
+                path: `${path}.dockerDataBytes`,
+                message: "raw privileged DinD with dockerDataBytes requires dockerAccess.storageProfile",
+            });
+        }
+        if (profile !== undefined && resources.dockerDataBytes === undefined) {
+            throw (0, errors_ts_1.dockerProfileError)({
+                code: "sandbox.docker-profile-resources-required",
+                path,
+                message: "dockerAccess.storageProfile requires resources.dockerDataBytes",
+            });
+        }
+        return resources;
+    }
+    return profile === undefined ? resources : managedDockerResources(value, path);
 }
 function readinessIdentity(readiness) {
     return readiness === undefined
@@ -523,7 +557,7 @@ function dockerResources(value, path) {
     if (value === undefined)
         return Object.freeze({});
     assertRecord(value, path);
-    assertOnlyKeys(value, ["cpus", "memoryBytes", "pidsLimit", "readOnlyRootfs", "tmpfs"], path);
+    assertOnlyKeys(value, ["cpus", "memoryBytes", "pidsLimit", "dockerDataBytes", "readOnlyRootfs", "tmpfs"], path);
     if (value.readOnlyRootfs !== undefined && typeof value.readOnlyRootfs !== "boolean") {
         throw new TypeError(`${path}.readOnlyRootfs must be a boolean`);
     }
@@ -534,6 +568,9 @@ function dockerResources(value, path) {
             if (!(0, node_path_1.isAbsolute)(mountPath) || (0, node_path_1.resolve)(mountPath) !== mountPath || mountPath === "/") {
                 throw new TypeError(`${path}.tmpfs keys must be normalized absolute paths other than /`);
             }
+            if (mountPath === "/var/lib/docker") {
+                throw new TypeError(`${path}.tmpfs must not contain /var/lib/docker; use dockerDataBytes`);
+            }
             const entry = value.tmpfs[mountPath];
             assertRecord(entry, `${path}.tmpfs.${mountPath}`);
             assertOnlyKeys(entry, ["sizeBytes", "mode", "uid", "gid", "executable"], `${path}.tmpfs.${mountPath}`);
@@ -564,6 +601,9 @@ function dockerResources(value, path) {
         ...(value.pidsLimit === undefined
             ? {}
             : { pidsLimit: positiveSafeInteger(value.pidsLimit, `${path}.pidsLimit`) }),
+        ...(value.dockerDataBytes === undefined
+            ? {}
+            : { dockerDataBytes: positiveSafeInteger(value.dockerDataBytes, `${path}.dockerDataBytes`) }),
         ...(value.readOnlyRootfs === true ? { readOnlyRootfs: true } : {}),
         ...(Object.keys(tmpfs).length === 0 ? {} : { tmpfs: Object.freeze(tmpfs) }),
     });
@@ -839,16 +879,6 @@ const vercelProviderModule = Object.freeze({
     materialize: (plan, context) => effect_1.Effect.flatMap(loadProviderRuntime(), (runtime) => runtime.materializeVercelProviderPlan(plan, context)),
     collectBuildPreparation: noBuildPreparation,
 });
-const localProviderModule = Object.freeze({
-    id: "niceeval/local-directory",
-    capabilities: Object.freeze({
-        retention: Object.freeze({ _tag: "DestroyOnly" }),
-        reuse: Object.freeze({ _tag: "Unsupported", reason: "local sandbox state is shared with the host" }),
-        sessionLimit: Object.freeze({ _tag: "Unlimited" }),
-    }),
-    materialize: (plan, context) => effect_1.Effect.flatMap(loadProviderRuntime(), (runtime) => runtime.materializeLocalProviderPlan(plan, context)),
-    collectBuildPreparation: noBuildPreparation,
-});
 function customProviderModule(name, create) {
     return Object.freeze({
         id: `custom-provider:${name}`,
@@ -876,12 +906,27 @@ function customCaseProviderModule(materialize) {
 /** Built-in factory 集合只属于 provider 侧；测试通过 services 注入，不改全局状态。 */
 function createBuiltinSandboxFactories(services) {
     const dockerTarget = () => effect_1.Effect.flatMap(services.dockerBuildPlatform, targetFromDocker);
-    const dockerTargetForProfile = (profile) => profile === undefined
+    const dockerTargetForProfile = (profile, privileged, resources) => profile === undefined
         ? effect_1.Effect.map(dockerTarget(), (target) => ({ target }))
         : effect_1.Effect.flatMap(effect_1.Effect.tryPromise({
             try: async () => (await __niceevalDynamicImport("./docker-profile/runtime.cjs")).attestDockerProfile(profile),
             catch: (cause) => providerPlanningError("sandbox.docker-profile-attestation-failed", "docker", cause instanceof Error ? cause.message : String(cause), [`Run niceeval docker profile doctor ${profile}.`]),
-        }), (profileBinding) => effect_1.Effect.map(targetFromDocker(profileBinding.platform), (target) => ({ target, profileBinding })));
+        }), (profileBinding) => {
+            const rawStorage = profileBinding.profile.securityLevel === "raw-dind-storage/v1";
+            if ((privileged === "raw") !== rawStorage) {
+                return effect_1.Effect.fail(providerPlanningError("sandbox.docker-profile-attestation-failed", "docker", privileged === "raw"
+                    ? `Docker storage profile ${profile} must declare raw-dind-storage/v1`
+                    : `Managed Docker profile ${profile} must declare a managed rootless security level`, [`Run niceeval docker profile doctor ${profile}.`]));
+            }
+            const capacity = profileBinding.profile.capacity;
+            if ((resources.cpus ?? 0) > capacity.cpus ||
+                (resources.memoryBytes ?? 0) > capacity.memoryBytes ||
+                (resources.pidsLimit ?? 0) > capacity.pids ||
+                (resources.dockerDataBytes ?? 0) > capacity.ephemeralDiskBytes) {
+                return effect_1.Effect.fail(providerPlanningError("sandbox.docker-profile-attestation-failed", "docker", `Docker profile ${profile} does not have capacity for the declared container resource vector`, [`Reduce resources or select another Docker profile.`]));
+            }
+            return effect_1.Effect.map(targetFromDocker(profileBinding.platform), (target) => ({ target, profileBinding }));
+        });
     return Object.freeze({
         dockerComposeSandbox(options) {
             assertRecord(options, "dockerComposeSandbox options");
@@ -1066,7 +1111,7 @@ function createBuiltinSandboxFactories(services) {
                         ...(targetStage === undefined ? [] : [{ name: "target", value: targetStage }]),
                     ], contextLocator.redaction === undefined ? [] : [contextLocator.redaction]),
                 leakGate: { _tag: "Dockerfile", context, dockerfile },
-                plan: ({ authorBaseDir }) => effect_1.Effect.flatMap(dockerTargetForProfile(profile), ({ target, profileBinding }) => effect_1.Effect.gen(function* () {
+                plan: ({ authorBaseDir }) => effect_1.Effect.flatMap(dockerTargetForProfile(profile, privileged, resources), ({ target, profileBinding }) => effect_1.Effect.gen(function* () {
                     const plannedContext = yield* effect_1.Effect.try({
                         try: () => plannedLocation(context, authorBaseDir),
                         catch: (cause) => providerPlanningError("sandbox.build-identity-unavailable", "docker", cause instanceof Error ? cause.message : String(cause), ["Make the Dockerfile and its filtered build context readable during physical planning."]),
@@ -1210,7 +1255,7 @@ function createBuiltinSandboxFactories(services) {
                 privateFingerprintIdentity: identity,
                 commandPlanLocator: configuredDockerImageLocator(image),
                 leakGate: { _tag: "None" },
-                plan: () => effect_1.Effect.map(dockerTargetForProfile(profile), ({ target, profileBinding }) => {
+                plan: () => effect_1.Effect.map(dockerTargetForProfile(profile, privileged, resources), ({ target, profileBinding }) => {
                     return sandboxProviderPlan({
                         provider: "docker",
                         plannerRevision: DOCKER_IMAGE_PROVIDER_REVISION,
@@ -1360,73 +1405,19 @@ function createBuiltinSandboxFactories(services) {
                 },
             });
         },
-        localSandbox(options = {}) {
-            assertRecord(options, "localSandbox options");
-            assertOnlyKeys(options, ["dir", "pathPrepend"], "localSandbox options");
-            const directory = options.dir === undefined
-                ? Object.freeze({ _tag: "AuthorBaseDir" })
-                : Object.freeze({
-                    _tag: "Configured",
-                    value: nonEmptyString(options.dir, "localSandbox options.dir"),
-                });
-            const pathPrepend = pathPrependList(options.pathPrepend, "localSandbox options.pathPrepend");
-            const identity = { provider: "local", kind: "directory", directory, ...pathPrependIdentityField(pathPrepend) };
-            return defineSandboxTemplate({
-                provider: "local",
-                kind: "directory",
-                publishableIdentity: { directory: { _tag: directory._tag }, ...pathPrependIdentityField(pathPrepend) },
-                privateFingerprintIdentity: identity,
-                commandPlanLocator: directory._tag === "AuthorBaseDir"
-                    ? configuredLocator([{ name: "dir", value: "author-base-dir" }])
-                    : configuredPathLocator(),
-                leakGate: { _tag: "None" },
-                plan: ({ authorBaseDir }) => {
-                    const configured = directory._tag === "AuthorBaseDir"
-                        ? authorBaseDir
-                        : (0, node_path_1.resolve)(authorBaseDir, directory.value);
-                    return effect_1.Effect.succeed(sandboxProviderPlan({
-                        provider: "local",
-                        plannerRevision: "local-directory-1",
-                        caseKind: "prebuilt",
-                        target: { platform: services.hostPlatform, source: "host" },
-                        scheduling: exclusiveScheduling("local-worktree"),
-                        module: localProviderModule,
-                        build: providerBuildPlan({
-                            caseKind: "prebuilt",
-                            materializerRevision: "local-directory-1",
-                            buildKeys: [],
-                            caseParams: { directory: configured, ...pathPrependIdentityField(pathPrepend) },
-                        }),
-                        runtimePlan: Object.freeze({ directory: configured, pathPrepend }),
-                        publishableIdentity: { directory: { _tag: directory._tag }, ...pathPrependIdentityField(pathPrepend) },
-                        privateFingerprintIdentity: { directory: configured, ...pathPrependIdentityField(pathPrepend) },
-                    }));
-                },
-            });
-        },
     });
 }
-function hostPlatform() {
-    const arch = normalizeArch(process.arch);
-    return process.platform === "linux"
-        ? Object.freeze({ _tag: "Linux", os: "linux", arch, libc: "gnu" })
-        : process.platform === "darwin"
-            ? Object.freeze({ _tag: "Darwin", os: "darwin", arch })
-            : Object.freeze({ _tag: "Windows", os: "windows", arch });
-}
 const LIVE_FACTORIES = createBuiltinSandboxFactories({
     dockerBuildPlatform: effect_1.Effect.tryPromise({
         try: () => (0, compose_ts_1.detectDockerBuildPlatform)(),
         catch: (cause) => providerPlanningError("sandbox.target-platform-unavailable", "docker", cause instanceof Error ? cause.message : String(cause), ["Make the Docker control plane available or set DOCKER_DEFAULT_PLATFORM."]),
     }),
-    hostPlatform: hostPlatform(),
 });
 exports.dockerComposeSandbox = LIVE_FACTORIES.dockerComposeSandbox;
 const dockerfileSourceLayer = LIVE_FACTORIES.dockerfileSourceLayer;
 const dockerImageSourceLayer = LIVE_FACTORIES.dockerImageSourceLayer;
 exports.e2bSandbox = LIVE_FACTORIES.e2bSandbox;
 exports.vercelSandbox = LIVE_FACTORIES.vercelSandbox;
-exports.localSandbox = LIVE_FACTORIES.localSandbox;
 /**
  * 统一的单容器 Docker factory。Docker access用判别联合选择显式socket、raw DinD或managed DinD；
  * 宿主路径/profile只保存到私有runtime binding。本函数不连接Docker，provider接线由后续层负责。