open-managed-agents 0.1.0

package/dist/src/control-plane/console/auth.js

@@ -0,0 +1,68 @@
+import { hashWorkspaceApiKey, } from "../workspaces/store.js";
+export const CONSOLE_ADMIN_COOKIE = "oma_console_admin";
+export const CONSOLE_WORKSPACE_COOKIE = "oma_console_workspace";
+const WORKSPACE_SESSION_SECONDS = 30 * 24 * 60 * 60;
+const ADMIN_SESSION_SECONDS = 8 * 60 * 60;
+export function createConsoleSessionAuth(input) {
+    const workspaceExpiry = () => new Date(Date.now() + WORKSPACE_SESSION_SECONDS * 1000);
+    const adminExpiry = () => new Date(Date.now() + ADMIN_SESSION_SECONDS * 1000);
+    const workspaceToken = (workspaceId, credentialSha256, kind) => input.workspaces.mintConsoleSession({
+        kind,
+        workspaceId,
+        credentialSha256,
+        expiresAt: workspaceExpiry(),
+    }).plaintextToken;
+    const authenticateAdmin = (token) => {
+        const session = input.workspaces.getConsoleSession(token);
+        return session?.kind === "admin" && input.admin?.fingerprint() === session.credential_sha256;
+    };
+    return {
+        authenticateWorkspace(token) {
+            const session = input.workspaces.getConsoleSession(token);
+            if (session?.workspace_id === null || session === undefined)
+                return undefined;
+            if (session.kind === "workspace_key") {
+                return input.workspaces.authenticateKeySha256(session.credential_sha256) === session.workspace_id
+                    ? session.workspace_id
+                    : undefined;
+            }
+            return session.kind === "admin_workspace" && input.admin?.fingerprint() === session.credential_sha256
+                ? session.workspace_id
+                : undefined;
+        },
+        authenticateAdmin,
+        createWorkspaceSession(plaintextKey) {
+            const workspaceId = input.workspaces.authenticate(plaintextKey);
+            if (workspaceId === undefined)
+                return undefined;
+            return {
+                token: workspaceToken(workspaceId, hashWorkspaceApiKey(plaintextKey), "workspace_key"),
+                workspaceId,
+            };
+        },
+        createAdminSession(plaintextKey) {
+            if (!input.admin?.verify(plaintextKey))
+                return undefined;
+            return input.workspaces.mintConsoleSession({
+                kind: "admin",
+                credentialSha256: input.admin.fingerprint(),
+                expiresAt: adminExpiry(),
+            }).plaintextToken;
+        },
+        selectWorkspace(adminToken, workspaceId) {
+            if (!authenticateAdmin(adminToken) || !input.workspaces.getWorkspace(workspaceId)) {
+                return undefined;
+            }
+            return workspaceToken(workspaceId, input.admin.fingerprint(), "admin_workspace");
+        },
+        revokeWorkspaceSession(token) {
+            input.workspaces.revokeConsoleSession(token);
+        },
+        revokeAdminSession(token) {
+            input.workspaces.revokeConsoleSession(token);
+        },
+        workspaceName(workspaceId) {
+            return input.workspaces.getWorkspace(workspaceId)?.name;
+        },
+    };
+}

package/dist/src/control-plane/console/static.js

@@ -0,0 +1,112 @@
+/**
+ * Static serving for the bundled operator console (plan 0120 §3.1).
+ *
+ * Hand-written rather than @hono/node-server's serveStatic because the
+ * console needs two things that helper cannot express: `.jsx` served as
+ * text/babel (hono's mime table has no jsx entry) and `cache-control:
+ * no-store` on every asset (its options have no header hook). The handler
+ * serves exactly one directory tree and nothing else — the traversal guard
+ * below is the one security-load-bearing piece.
+ *
+ * Guard shape (0120 review, Codex-adversarial finding): a bare
+ * `candidate.startsWith(root)` accepts prefix-sharing *siblings* such as
+ * `<root>-private/…`, so containment is checked against `root + sep`, and
+ * against the realpath so a symlink inside the tree cannot point out of it.
+ */
+import { createReadStream, realpathSync, statSync } from "node:fs";
+import { extname, resolve, sep } from "node:path";
+import { Readable } from "node:stream";
+export const CONSOLE_MOUNT = "/console";
+// Everything the console ships today. Unknown extensions 404 rather than
+// falling back to octet-stream: the tree is ours, so an unlisted type is a
+// packaging mistake we want loud, not a download prompt.
+const CONTENT_TYPES = new Map([
+    [".css", "text/css; charset=utf-8"],
+    [".html", "text/html; charset=utf-8"],
+    [".js", "text/javascript; charset=utf-8"],
+    [".jsx", "text/babel; charset=utf-8"],
+    [".json", "application/json; charset=utf-8"],
+    [".md", "text/markdown; charset=utf-8"],
+    [".png", "image/png"],
+    [".svg", "image/svg+xml; charset=utf-8"],
+]);
+// unsafe-eval is the price of in-browser Babel; unsafe-inline (script) is the
+// price of Babel executing transformed <script type="text/babel"> blocks.
+// connect-src 'self' blocks fetch/XHR/WebSocket exfiltration of the keys in
+// page memory; base-uri and form-action close the <base>-hijack and form-post
+// channels. Top-level navigation remains uncoverable by CSP — this is
+// defense-in-depth behind React's escaping, not a substitute for it.
+const CONSOLE_CSP = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-eval' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "connect-src 'self'",
+    "img-src 'self' data:",
+    "base-uri 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+].join("; ");
+export function registerConsoleRoutes(app, config) {
+    const root = resolve(config.root);
+    // Resolved once: symlink containment is checked against where the tree
+    // *really* lives, so a console dir that is itself a symlink still works.
+    const realRoot = realpathSync(root);
+    // The console's asset URLs are relative (src/api.js …); served at the bare
+    // mount they would resolve to /src/… and 404. Redirect instead of serving
+    // index.html so the browser's base URL is always the trailing-slash form.
+    app.get(CONSOLE_MOUNT, (c) => c.redirect(`${CONSOLE_MOUNT}/`, 301));
+    app.get(`${CONSOLE_MOUNT}/*`, (c) => {
+        const raw = c.req.path.slice(CONSOLE_MOUNT.length + 1);
+        const relative = raw === "" ? "index.html" : decodeOrNull(raw);
+        if (relative === null || relative.includes("\0"))
+            return notFound(c);
+        const candidate = resolve(realRoot, relative);
+        if (!contains(realRoot, candidate))
+            return notFound(c);
+        let file;
+        try {
+            file = realpathSync(candidate); // also the existence check
+        }
+        catch {
+            return notFound(c);
+        }
+        if (!contains(realRoot, file) || !statSync(file).isFile()) {
+            return notFound(c);
+        }
+        const contentType = CONTENT_TYPES.get(extname(file));
+        if (contentType === undefined)
+            return notFound(c);
+        setConsoleHeaders(c);
+        c.header("content-type", contentType);
+        return c.body(createReadableFileStream(file));
+    });
+}
+function contains(root, candidate) {
+    return candidate === root || candidate.startsWith(root + sep);
+}
+// Hono half-decodes (%2e -> "." but %2f stays); one more decode maps the
+// remaining escapes to their filesystem form so ..%2f is seen as ../ by the
+// containment check instead of sneaking past it as an opaque segment.
+function decodeOrNull(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+function notFound(c) {
+    setConsoleHeaders(c);
+    return c.text("Not found\n", 404);
+}
+function setConsoleHeaders(c) {
+    c.header("cache-control", "no-store");
+    c.header("content-security-policy", CONSOLE_CSP);
+    c.header("x-frame-options", "DENY");
+}
+function createReadableFileStream(path) {
+    // Node's fs streams convert cleanly; Response accepts web ReadableStream.
+    // Files here are ≤3 MB (babel.min.js), so streaming keeps memory flat
+    // without any range/caching complexity the console does not need.
+    return Readable.toWeb(createReadStream(path));
+}

package/dist/src/control-plane/deployment-runtime-config.js

@@ -0,0 +1,328 @@
+import { PiSessionRunner } from "./sessions/pi/runner.js";
+import { parseSandboxProviderSelection, resolveSandboxProviderFactory, } from "./sessions/pi/sandbox/selection.js";
+export const DEPLOYMENT_RUNTIME_ENV_KEYS = [
+    "OMA_SANDBOX_PROVIDER",
+    "OMA_SANDBOX_ENV_ALLOWLIST",
+    "OMA_SANDBOX_OPERATION_TIMEOUT_MS",
+    "OMA_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS",
+    "OMA_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS",
+    "OMA_ALLOW_DOCKER_LOCAL",
+    "OMA_ALLOW_MICROSANDBOX_LOCAL",
+    "OMA_ALLOW_UNSAFE_HOST_PASSTHROUGH",
+    "OMA_UNSAFE_ALLOW_HOST_PASSTHROUGH",
+    "OMA_HOST_PASSTHROUGH_WORKSPACE_ROOT",
+    "OMA_ENABLE_EGRESS",
+    "OMA_EGRESS_SIDECAR_IMAGE",
+    "OMA_EGRESS_SIDECAR_REPO_MOUNT",
+    "OMA_ENABLE_MCP",
+    "OMA_MCP_OPERATION_TIMEOUT_MS",
+];
+export const DEFAULT_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS = 24 * 60 * 60 * 1000;
+export const DEFAULT_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS = 24 * 60 * 60 * 1000;
+export function parseDeploymentRuntimeConfigFromEnv(env) {
+    // Provider-orthogonal: MCP is a control-plane capability, parsed once and
+    // merged whatever the sandbox branch below returns.
+    const mcp = mcpConfig(env);
+    const config = parseSandboxRuntimeConfigFromEnv(env);
+    return mcp === undefined ? config : { ...config, mcp };
+}
+function parseSandboxRuntimeConfigFromEnv(env) {
+    const provider = optionalString(env.OMA_SANDBOX_PROVIDER);
+    if (provider === undefined) {
+        rejectProviderSpecificEnv(env, "set OMA_SANDBOX_PROVIDER first");
+        return validateDeploymentRuntimeConfig({});
+    }
+    if (provider === "none") {
+        rejectProviderSpecificEnv(env, "OMA_SANDBOX_PROVIDER=none");
+        return validateDeploymentRuntimeConfig({
+            sandboxProviderSelection: { type: "none" },
+        });
+    }
+    if (provider === "docker-local") {
+        rejectHostPassthroughEnv(env, "OMA_SANDBOX_PROVIDER=docker-local");
+        rejectMicrosandboxEnv(env, "OMA_SANDBOX_PROVIDER=docker-local");
+        const selection = parseSandboxProviderSelection({
+            type: "docker-local",
+            ...envAllowlist(env),
+            ...operationTimeoutMs(env),
+            reapStaleContainersOlderThanMs: dockerReapStaleContainersOlderThanMs(env),
+        });
+        const egress = egressConfig(env);
+        return validateDeploymentRuntimeConfig({
+            sandboxProviderSelection: selection,
+            sandboxProviderSelectionOptions: {
+                allowDockerLocal: parseBoolean(env.OMA_ALLOW_DOCKER_LOCAL, {
+                    defaultValue: false,
+                    name: "OMA_ALLOW_DOCKER_LOCAL",
+                }),
+            },
+            ...(egress === undefined ? {} : { egress }),
+        });
+    }
+    if (provider === "microsandbox-local") {
+        rejectDockerEnv(env, "OMA_SANDBOX_PROVIDER=microsandbox-local");
+        rejectHostPassthroughEnv(env, "OMA_SANDBOX_PROVIDER=microsandbox-local");
+        rejectEnvAllowlist(env, "OMA_SANDBOX_PROVIDER=microsandbox-local");
+        rejectEgressEnv(env, "OMA_SANDBOX_PROVIDER=microsandbox-local");
+        const selection = parseSandboxProviderSelection({
+            type: "microsandbox-local",
+            ...operationTimeoutMs(env),
+            reapStaleSandboxesOlderThanMs: microsandboxReapStaleSandboxesOlderThanMs(env),
+        });
+        return validateDeploymentRuntimeConfig({
+            sandboxProviderSelection: selection,
+            sandboxProviderSelectionOptions: {
+                allowMicrosandboxLocal: parseBoolean(env.OMA_ALLOW_MICROSANDBOX_LOCAL, {
+                    defaultValue: false,
+                    name: "OMA_ALLOW_MICROSANDBOX_LOCAL",
+                }),
+            },
+        });
+    }
+    if (provider === "host-passthrough") {
+        rejectDockerEnv(env, "OMA_SANDBOX_PROVIDER=host-passthrough");
+        rejectMicrosandboxEnv(env, "OMA_SANDBOX_PROVIDER=host-passthrough");
+        rejectOperationTimeoutEnv(env, "OMA_SANDBOX_PROVIDER=host-passthrough");
+        rejectEgressEnv(env, "OMA_SANDBOX_PROVIDER=host-passthrough");
+        const unsafeAllowHostPassthrough = parseBoolean(env.OMA_UNSAFE_ALLOW_HOST_PASSTHROUGH, {
+            defaultValue: false,
+            name: "OMA_UNSAFE_ALLOW_HOST_PASSTHROUGH",
+        });
+        const selection = parseSandboxProviderSelection({
+            type: "host-passthrough",
+            unsafeAllowHostPassthrough,
+            ...envAllowlist(env),
+        });
+        return validateDeploymentRuntimeConfig({
+            sandboxProviderSelection: selection,
+            sandboxProviderSelectionOptions: {
+                allowUnsafeHostPassthrough: parseBoolean(env.OMA_ALLOW_UNSAFE_HOST_PASSTHROUGH, {
+                    defaultValue: false,
+                    name: "OMA_ALLOW_UNSAFE_HOST_PASSTHROUGH",
+                }),
+                hostPassthroughWorkspaceRoot: optionalString(env.OMA_HOST_PASSTHROUGH_WORKSPACE_ROOT),
+            },
+        });
+    }
+    throw new Error(`Unsupported OMA_SANDBOX_PROVIDER: ${provider}`);
+}
+export function validateDeploymentRuntimeConfig(config) {
+    rejectIgnoredResolverOptions(config);
+    if (config.egress !== undefined &&
+        config.sandboxProviderSelection?.type !== "docker-local") {
+        throw new Error("egress requires the docker-local sandbox provider");
+    }
+    resolveSandboxProviderFactory(config.sandboxProviderSelection, config.sandboxProviderSelectionOptions);
+    return config;
+}
+export function createDeploymentPiSessionRunner(config, opts = {}) {
+    const rawOpts = opts;
+    if (rawOpts.sandboxProviderFactory !== undefined ||
+        rawOpts.sandboxProviderSelection !== undefined ||
+        rawOpts.sandboxProviderSelectionOptions !== undefined) {
+        throw new Error("Deployment runner options cannot override sandbox provider config");
+    }
+    const { resolveEgressBundle, onSandboxesReaped, ...runnerOpts } = opts;
+    if (config.egress !== undefined && resolveEgressBundle === undefined) {
+        throw new Error("egress is enabled but no egress bundle resolver was provided");
+    }
+    const selectionOptions = {
+        ...(config.egress === undefined || resolveEgressBundle === undefined
+            ? config.sandboxProviderSelectionOptions
+            : {
+                ...config.sandboxProviderSelectionOptions,
+                egress: { ...config.egress, resolveEgressBundle },
+            }),
+        ...(onSandboxesReaped === undefined ? {} : { onReaped: onSandboxesReaped }),
+    };
+    return new PiSessionRunner({
+        ...runnerOpts,
+        sandboxProviderSelection: config.sandboxProviderSelection,
+        sandboxProviderSelectionOptions: selectionOptions,
+    });
+}
+function optionalString(value) {
+    if (value === undefined || value.trim() === "")
+        return undefined;
+    return value.trim();
+}
+function parseBoolean(value, opts) {
+    const parsed = optionalString(value);
+    if (parsed === undefined)
+        return opts.defaultValue;
+    if (parsed === "true")
+        return true;
+    if (parsed === "false")
+        return false;
+    throw new Error(`${opts.name} must be "true" or "false"`);
+}
+function envAllowlist(env) {
+    const raw = optionalString(env.OMA_SANDBOX_ENV_ALLOWLIST);
+    if (raw === undefined)
+        return {};
+    const values = raw.split(",").map((value) => value.trim());
+    if (values.some((value) => value.length === 0)) {
+        throw new Error("OMA_SANDBOX_ENV_ALLOWLIST must be comma-separated names");
+    }
+    return { envAllowlist: values };
+}
+function operationTimeoutMs(env) {
+    const raw = optionalString(env.OMA_SANDBOX_OPERATION_TIMEOUT_MS);
+    if (raw === undefined)
+        return {};
+    const value = parsePositiveInteger(raw, "OMA_SANDBOX_OPERATION_TIMEOUT_MS");
+    return { operationTimeoutMs: value };
+}
+// 0117e-3: egress requires BOTH the explicit boolean AND the image — setting
+// an image alone must never silently change network posture, and (this
+// file's idiom) partially-applied env is a loud startup error, not a warning.
+function egressConfig(env) {
+    const enabled = parseBoolean(env.OMA_ENABLE_EGRESS, {
+        defaultValue: false,
+        name: "OMA_ENABLE_EGRESS",
+    });
+    const sidecarImage = optionalString(env.OMA_EGRESS_SIDECAR_IMAGE);
+    const sidecarRepoMount = optionalString(env.OMA_EGRESS_SIDECAR_REPO_MOUNT);
+    if (!enabled) {
+        if (sidecarImage !== undefined) {
+            throw new Error("OMA_EGRESS_SIDECAR_IMAGE is ignored without OMA_ENABLE_EGRESS=true");
+        }
+        if (sidecarRepoMount !== undefined) {
+            throw new Error("OMA_EGRESS_SIDECAR_REPO_MOUNT is ignored without OMA_ENABLE_EGRESS=true");
+        }
+        return undefined;
+    }
+    if (sidecarImage === undefined) {
+        throw new Error("OMA_ENABLE_EGRESS=true requires OMA_EGRESS_SIDECAR_IMAGE (the appliance cannot introspect its own image tag)");
+    }
+    return {
+        sidecarImage,
+        ...(sidecarRepoMount === undefined ? {} : { sidecarRepoMount }),
+    };
+}
+// Same partially-applied-env-is-a-loud-error idiom as egressConfig.
+function mcpConfig(env) {
+    const enabled = parseBoolean(env.OMA_ENABLE_MCP, {
+        defaultValue: false,
+        name: "OMA_ENABLE_MCP",
+    });
+    const timeoutRaw = optionalString(env.OMA_MCP_OPERATION_TIMEOUT_MS);
+    if (!enabled) {
+        if (timeoutRaw !== undefined) {
+            throw new Error("OMA_MCP_OPERATION_TIMEOUT_MS is ignored without OMA_ENABLE_MCP=true");
+        }
+        return undefined;
+    }
+    if (timeoutRaw === undefined)
+        return {};
+    return {
+        operationTimeoutMs: parsePositiveInteger(timeoutRaw, "OMA_MCP_OPERATION_TIMEOUT_MS"),
+    };
+}
+function dockerReapStaleContainersOlderThanMs(env) {
+    const raw = optionalString(env.OMA_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS);
+    return raw === undefined
+        ? DEFAULT_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS
+        : parsePositiveInteger(raw, "OMA_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS");
+}
+function microsandboxReapStaleSandboxesOlderThanMs(env) {
+    const raw = optionalString(env.OMA_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS);
+    return raw === undefined
+        ? DEFAULT_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS
+        : parsePositiveInteger(raw, "OMA_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS");
+}
+function parsePositiveInteger(raw, name) {
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value <= 0 || String(value) !== raw) {
+        throw new Error(`${name} must be a positive integer`);
+    }
+    return value;
+}
+function rejectProviderSpecificEnv(env, context) {
+    rejectDockerEnv(env, context);
+    rejectHostPassthroughEnv(env, context);
+    rejectMicrosandboxEnv(env, context);
+    rejectEnvAllowlist(env, context);
+    rejectOperationTimeoutEnv(env, context);
+    rejectEgressEnv(env, context);
+}
+function rejectEgressEnv(env, context) {
+    for (const key of [
+        "OMA_ENABLE_EGRESS",
+        "OMA_EGRESS_SIDECAR_IMAGE",
+        "OMA_EGRESS_SIDECAR_REPO_MOUNT",
+    ]) {
+        if (env[key] !== undefined) {
+            throw new Error(`${key} is ignored by ${context}`);
+        }
+    }
+}
+function rejectIgnoredResolverOptions(config) {
+    const selection = config.sandboxProviderSelection;
+    const opts = config.sandboxProviderSelectionOptions ?? {};
+    if (selection === undefined || selection.type === "none") {
+        rejectDefinedOption(opts.allowDockerLocal, "allowDockerLocal", "no provider");
+        rejectDefinedOption(opts.allowMicrosandboxLocal, "allowMicrosandboxLocal", "no provider");
+        rejectDefinedOption(opts.allowUnsafeHostPassthrough, "allowUnsafeHostPassthrough", "no provider");
+        rejectDefinedOption(opts.hostPassthroughWorkspaceRoot, "hostPassthroughWorkspaceRoot", "no provider");
+        return;
+    }
+    if (selection.type === "docker-local") {
+        rejectDefinedOption(opts.allowMicrosandboxLocal, "allowMicrosandboxLocal", "docker-local");
+        rejectDefinedOption(opts.allowUnsafeHostPassthrough, "allowUnsafeHostPassthrough", "docker-local");
+        rejectDefinedOption(opts.hostPassthroughWorkspaceRoot, "hostPassthroughWorkspaceRoot", "docker-local");
+        return;
+    }
+    if (selection.type === "microsandbox-local") {
+        rejectDefinedOption(opts.allowDockerLocal, "allowDockerLocal", "microsandbox-local");
+        rejectDefinedOption(opts.allowUnsafeHostPassthrough, "allowUnsafeHostPassthrough", "microsandbox-local");
+        rejectDefinedOption(opts.hostPassthroughWorkspaceRoot, "hostPassthroughWorkspaceRoot", "microsandbox-local");
+        return;
+    }
+    if (selection.type === "host-passthrough") {
+        rejectDefinedOption(opts.allowDockerLocal, "allowDockerLocal", "host-passthrough");
+        rejectDefinedOption(opts.allowMicrosandboxLocal, "allowMicrosandboxLocal", "host-passthrough");
+    }
+}
+function rejectDefinedOption(value, optionName, context) {
+    if (value !== undefined) {
+        throw new Error(`${optionName} is ignored by ${context}`);
+    }
+}
+function rejectDockerEnv(env, context) {
+    if (env.OMA_ALLOW_DOCKER_LOCAL !== undefined) {
+        throw new Error(`OMA_ALLOW_DOCKER_LOCAL is ignored by ${context}`);
+    }
+    if (env.OMA_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS !== undefined) {
+        throw new Error(`OMA_DOCKER_REAP_STALE_CONTAINERS_OLDER_THAN_MS is ignored by ${context}`);
+    }
+}
+function rejectHostPassthroughEnv(env, context) {
+    if (env.OMA_ALLOW_UNSAFE_HOST_PASSTHROUGH !== undefined) {
+        throw new Error(`OMA_ALLOW_UNSAFE_HOST_PASSTHROUGH is ignored by ${context}`);
+    }
+    if (env.OMA_UNSAFE_ALLOW_HOST_PASSTHROUGH !== undefined) {
+        throw new Error(`OMA_UNSAFE_ALLOW_HOST_PASSTHROUGH is ignored by ${context}`);
+    }
+    if (env.OMA_HOST_PASSTHROUGH_WORKSPACE_ROOT !== undefined) {
+        throw new Error(`OMA_HOST_PASSTHROUGH_WORKSPACE_ROOT is ignored by ${context}`);
+    }
+}
+function rejectMicrosandboxEnv(env, context) {
+    if (env.OMA_ALLOW_MICROSANDBOX_LOCAL !== undefined) {
+        throw new Error(`OMA_ALLOW_MICROSANDBOX_LOCAL is ignored by ${context}`);
+    }
+    if (env.OMA_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS !== undefined) {
+        throw new Error(`OMA_MICROSANDBOX_REAP_STALE_SANDBOXES_OLDER_THAN_MS is ignored by ${context}`);
+    }
+}
+function rejectEnvAllowlist(env, context) {
+    if (env.OMA_SANDBOX_ENV_ALLOWLIST !== undefined) {
+        throw new Error(`OMA_SANDBOX_ENV_ALLOWLIST requires ${context}`);
+    }
+}
+function rejectOperationTimeoutEnv(env, context) {
+    if (env.OMA_SANDBOX_OPERATION_TIMEOUT_MS !== undefined) {
+        throw new Error(`OMA_SANDBOX_OPERATION_TIMEOUT_MS is ignored by ${context}`);
+    }
+}

package/dist/src/control-plane/deployment-runtime-event-coordinator.js

@@ -0,0 +1,25 @@
+import { RuntimeTurnOwnershipLostError, } from "./events/types.js";
+import { canCommitRuntimeTurn, } from "./deployment-runtime-turn-guard.js";
+export function createSingleDatabaseRuntimeEventCoordinator(opts) {
+    return {
+        commitRuntimeEventsForTurn: (input) => opts.events.withTransaction(() => {
+            if (!canCommitRuntimeTurn(opts, input)) {
+                throw new RuntimeTurnOwnershipLostError(input.turnId);
+            }
+            opts.events.appendBatchWithRuntimeChangesInTransaction(input.events, input.changes);
+        }),
+    };
+}
+export function createBestEffortRuntimeEventCoordinator(opts) {
+    return {
+        commitRuntimeEventsForTurn(input) {
+            // In-memory/test deployments do not share one database transaction
+            // across sessions and events. Keep the same fence as durable mode, but
+            // the check is best-effort before the event/runtime mutation.
+            if (!canCommitRuntimeTurn(opts, input)) {
+                throw new RuntimeTurnOwnershipLostError(input.turnId);
+            }
+            opts.events.appendBatchWithRuntimeChanges(input.events, input.changes);
+        },
+    };
+}

package/dist/src/control-plane/deployment-runtime-turn-guard.js

@@ -0,0 +1,14 @@
+export function canCommitRuntimeTurn(opts, input) {
+    // Cross-store session + runtime-turn predicate shared by deployment
+    // coordinators. Some legacy store updates still enforce only owner/generation
+    // in their WHERE clauses until their call sites get coordinator seams.
+    if (!opts.sessions.retrieve(input.workspaceId, input.sessionId))
+        return false;
+    const turn = opts.events
+        .listPendingRuntimeTurns(input.workspaceId)
+        .find((candidate) => candidate.session_id === input.sessionId &&
+        candidate.turn_id === input.turnId);
+    return (turn !== undefined &&
+        turn.owner_id === input.ownerId &&
+        turn.owner_generation === input.ownerGeneration);
+}

package/dist/src/control-plane/deployment-session-coordinator.js

@@ -0,0 +1,25 @@
+export function createSingleDatabaseSessionCoordinator(opts) {
+    return {
+        deleteSessionRows: (workspaceId, sessionId) => opts.events.withTransaction(() => {
+            const row = opts.sessions.delete(workspaceId, sessionId);
+            if (!row)
+                return undefined;
+            opts.events.deleteForSession(workspaceId, sessionId);
+            const deletedSessionOutputFiles = opts.files.deleteSessionOutputRows(workspaceId, sessionId);
+            return { row, deletedSessionOutputFiles };
+        }),
+    };
+}
+export function createInMemorySessionCoordinator(opts) {
+    return {
+        deleteSessionRows: (workspaceId, sessionId) => {
+            const row = opts.sessions.delete(workspaceId, sessionId);
+            if (!row)
+                return undefined;
+            // The in-memory deployment stores are separate :memory: databases, so
+            // this cleanup is best-effort parity with durable mode, not atomic.
+            opts.events.deleteForSession(workspaceId, sessionId);
+            return { row };
+        },
+    };
+}

package/dist/src/control-plane/deployment-session-output-coordinator.js

@@ -0,0 +1,27 @@
+import { invalidRequest } from "./errors.js";
+import { canCommitRuntimeTurn, } from "./deployment-runtime-turn-guard.js";
+export function createSingleDatabaseSessionOutputCoordinator(opts) {
+    return {
+        replaceSessionOutputsForRuntimeTurn: (input) => 
+        // Local-object storage invokes this predicate inside its SQLite metadata
+        // transaction. A Postgres coordinator should preserve that check/write
+        // atomicity with database locks instead of a process-local callback.
+        opts.files.replaceSessionOutputsIfLive(input.workspaceId, input.sessionId, input.files, () => canCommitRuntimeTurn(opts, input)),
+    };
+}
+export function createBestEffortSessionOutputCoordinator(opts) {
+    return {
+        async replaceSessionOutputsForRuntimeTurn(input) {
+            // In-memory/test deployments do not have one database transaction across
+            // sessions, runtime turns, and file metadata. This keeps behavior aligned
+            // with durable mode, but it is a best-effort check before the write.
+            if (!canCommitRuntimeTurn(opts, input)) {
+                throw inactiveSessionOutputCommit(input.sessionId);
+            }
+            return opts.files.replaceSessionOutputs(input.workspaceId, input.sessionId, input.files);
+        },
+    };
+}
+function inactiveSessionOutputCommit(sessionId) {
+    return invalidRequest(`Session outputs cannot be committed for inactive session ${sessionId}`);
+}