openpond 0.0.30-bootstrap.0 → 0.0.31

package/dist/chunks/{src-EYXQS6XD.js → src-J4262EAE.js}

@@ -13,7 +13,19 @@ import {
   now,
   runOpenPondServerCli,
   textFromUnknown
-} from "./chunk-Y6G6WRTG.js";
+} from "./chunk-7KYOO25A.js";
+import {
+  createOpenPondRepoApp,
+  getBundledRuntimeVersion,
+  getOpenPondAppEnvironment,
+  loadOpenPondAccountContext,
+  loadOpenPondApps,
+  loadOpenPondProviderCatalog,
+  saveOpenPondAccount,
+  streamOpenPondHostedChatTurn,
+  switchOpenPondAccount,
+  updateOpenPondAccountConfig
+} from "./chunk-IUTUUNAX.js";
 import {
   AccountStateSchema,
   AppPreferencesSchema,
@@ -222,7 +234,6 @@ import {
   buildOpenPondProfileSetupGate,
   collectProfileSourceUploadEntries,
   commitActiveProfileChanges,
-  createOpenPondRepoApp,
   createOpenPondSandboxClient,
   createPlaceholderPanes,
   crossSystemLocalToolSystemPrompt,
@@ -231,8 +242,6 @@ import {
   executeConnectedAppToolCall,
   executeProfileSkillGoalRequest,
   formatOpenPondProfileSetupRequirement,
-  getBundledRuntimeVersion,
-  getOpenPondAppEnvironment,
   hostedPublishStatusFromPayload,
   hostedRunStatusFromRunSummary,
   hostedRunSummaryFromPayload,
@@ -240,10 +249,7 @@ import {
   initLocalProfileRepo,
   loadGlobalConfig,
   loadLocalProfileRepo,
-  loadOpenPondAccountContext,
-  loadOpenPondApps,
   loadOpenPondProfileState,
-  loadOpenPondProviderCatalog,
   localPathWorkspaceId,
   normalizeOpenPondGoalStatus,
   normalizeSandboxApiUrl,
@@ -254,13 +260,9 @@ import {
   runProfileSkillCommandFromPrompt,
   runProfileSkillGoalCommand,
   saveGlobalConfig,
-  saveOpenPondAccount,
   saveProfilePushStatus,
-  streamOpenPondHostedChatTurn,
-  switchOpenPondAccount,
-  updateOpenPondAccountConfig,
   workspacePathFromLocalPathWorkspaceId
-} from "./chunk-Q57SVPEH.js";
+} from "./chunk-BX4XSB2J.js";
 import {
   CONNECTED_APP_PROVIDER_TOOL_NAMES,
   CONNECTED_APP_TOOL_CALL_ENDPOINT,
@@ -65568,15 +65570,38 @@ function scanAndRedactEvidence(text2) {
 import { Buffer as Buffer11 } from "node:buffer";
 
 // ../server/src/training/cross-system-operations/python-sandbox.ts
-import { spawn as spawn7 } from "node:child_process";
+import { execFile as execFile4, spawn as spawn7 } from "node:child_process";
 import { tmpdir } from "node:os";
 import readline from "node:readline";
 import { randomUUID as randomUUID22 } from "node:crypto";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile4);
+var DEFAULT_MAX_MEMORY_BYTES = 256 * 1024 * 1024;
+var DEFAULT_MEMORY_POLL_INTERVAL_MS = 100;
+var MAX_STDERR_BYTES = 4096;
 var WORKER_SOURCE = String.raw`
-import contextlib, io, json, math, statistics, decimal, datetime, collections, itertools, functools, resource, sys
+import contextlib, io, json, math, statistics, decimal, datetime, collections, itertools, functools, sys
+
+try:
+    import resource
+except ImportError:
+    resource = None
+
+def apply_resource_limit(kind, value):
+    if resource is None:
+        return
+    try:
+        _, current_hard = resource.getrlimit(kind)
+        hard = value if current_hard == resource.RLIM_INFINITY else min(value, current_hard)
+        resource.setrlimit(kind, (min(value, hard), hard))
+    except (OSError, ValueError):
+        # Some platforms expose a limit without accepting finite values. The
+        # parent process independently enforces the memory ceiling.
+        pass
 
-resource.setrlimit(resource.RLIMIT_CPU, (5, 5))
-resource.setrlimit(resource.RLIMIT_AS, (268435456, 268435456))
+if resource is not None:
+    apply_resource_limit(resource.RLIMIT_CPU, 5)
+    apply_resource_limit(resource.RLIMIT_AS, 268435456)
 ALLOWED_MODULES = {"math", "statistics", "decimal", "datetime", "collections", "itertools", "functools", "json"}
 real_import = __import__
 def safe_import(name, globals=None, locals=None, fromlist=(), level=0):
@@ -65616,20 +65641,39 @@ for line in sys.stdin:
 var PersistentPythonSandbox = class {
   constructor(options = {}) {
     this.options = options;
+    this.maxMemoryBytes = Math.max(1, Math.trunc(options.maxMemoryBytes ?? DEFAULT_MAX_MEMORY_BYTES));
+    this.memoryPollIntervalMs = Math.max(10, Math.trunc(options.memoryPollIntervalMs ?? DEFAULT_MEMORY_POLL_INTERVAL_MS));
+    this.memoryUsage = options.memoryUsage ?? readResidentMemoryBytes;
     this.child = spawn7(options.pythonBin ?? process.env.OPENPOND_PYTHON_BIN ?? "python3", ["-I", "-S", "-u", "-c", WORKER_SOURCE], {
       cwd: tmpdir(),
       env: { PATH: process.env.PATH ?? "/usr/bin:/bin", PYTHONIOENCODING: "utf-8", PYTHONUNBUFFERED: "1" },
       stdio: ["pipe", "pipe", "pipe"]
     });
     readline.createInterface({ input: this.child.stdout }).on("line", (line) => this.handleLine(line));
+    this.child.stderr.setEncoding("utf8");
+    this.child.stderr.on("data", (chunk2) => {
+      this.stderr = `${this.stderr}${chunk2}`.slice(-MAX_STDERR_BYTES);
+    });
     this.child.once("error", (error) => this.failAll(error));
     this.child.once("exit", (code, signal) => {
-      if (!this.closed) this.failAll(new Error(`Python sandbox exited with ${code ?? signal}.`));
+      this.stopMemoryMonitor();
+      if (!this.closed) {
+        const stderr = this.stderr.trim();
+        const detail = stderr ? `: ${stderr}` : ".";
+        this.failAll(this.terminationError ?? new Error(`Python sandbox exited with ${code ?? signal}${detail}`));
+      }
     });
   }
   options;
   child;
   pending = /* @__PURE__ */ new Map();
+  maxMemoryBytes;
+  memoryPollIntervalMs;
+  memoryUsage;
+  memoryTimer = null;
+  memoryProbeInFlight = false;
+  terminationError = null;
+  stderr = "";
   closed = false;
   async run(code, signal) {
     if (this.closed) throw new Error("Python sandbox is closed.");
@@ -65639,6 +65683,7 @@ var PersistentPythonSandbox = class {
     const result = new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
+        if (this.pending.size === 0) this.stopMemoryMonitor();
         reject(new Error("Python sandbox execution timed out."));
         void this.close();
       }, this.options.timeoutMs ?? 1500);
@@ -65650,10 +65695,12 @@ var PersistentPythonSandbox = class {
       if (!pending) return;
       clearTimeout(pending.timer);
       this.pending.delete(id);
+      if (this.pending.size === 0) this.stopMemoryMonitor();
       pending.reject(abortError(signal));
       void this.close();
     };
     signal?.addEventListener("abort", abort, { once: true });
+    this.startMemoryMonitor();
     this.child.stdin.write(`${JSON.stringify({ id, code })}
 `);
     try {
@@ -65665,6 +65712,7 @@ var PersistentPythonSandbox = class {
   async close() {
     if (this.closed) return;
     this.closed = true;
+    this.stopMemoryMonitor();
     this.failAll(new Error("Python sandbox closed."));
     if (this.child.exitCode !== null || this.child.signalCode !== null) return;
     this.child.stdin.end();
@@ -65686,6 +65734,7 @@ var PersistentPythonSandbox = class {
     if (!pending) return;
     clearTimeout(pending.timer);
     this.pending.delete(id);
+    if (this.pending.size === 0) this.stopMemoryMonitor();
     const stdout = typeof value.stdout === "string" ? value.stdout : "";
     const serialized = JSON.stringify(value.result ?? null);
     if (Buffer.byteLength(stdout + serialized, "utf8") > (this.options.maxOutputBytes ?? 16384)) {
@@ -65695,13 +65744,69 @@ var PersistentPythonSandbox = class {
     pending.resolve(value.ok === true ? { ok: true, stdout, result: value.result ?? null, error: null } : { ok: false, stdout: "", result: null, error: typeof value.error === "string" ? value.error : "Python execution failed." });
   }
   failAll(error) {
+    this.stopMemoryMonitor();
     for (const pending of this.pending.values()) {
       clearTimeout(pending.timer);
       pending.reject(error);
     }
     this.pending.clear();
   }
+  startMemoryMonitor() {
+    if (this.memoryTimer || !this.child.pid) return;
+    void this.probeMemory();
+    this.memoryTimer = setInterval(() => void this.probeMemory(), this.memoryPollIntervalMs);
+    this.memoryTimer.unref?.();
+  }
+  stopMemoryMonitor() {
+    if (this.memoryTimer) clearInterval(this.memoryTimer);
+    this.memoryTimer = null;
+  }
+  async probeMemory() {
+    const pid = this.child.pid;
+    if (!pid || this.memoryProbeInFlight || this.terminationError || this.pending.size === 0) return;
+    this.memoryProbeInFlight = true;
+    try {
+      const residentBytes = await this.memoryUsage(pid);
+      if (residentBytes !== null && residentBytes > this.maxMemoryBytes && !this.terminationError) {
+        this.terminationError = new Error(
+          `Python sandbox exceeded the ${this.maxMemoryBytes}-byte memory limit.`
+        );
+        this.stopMemoryMonitor();
+        this.child.kill("SIGKILL");
+      }
+    } finally {
+      this.memoryProbeInFlight = false;
+    }
+  }
 };
+async function readResidentMemoryBytes(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  try {
+    if (process.platform === "win32") {
+      const { stdout: stdout2 } = await execFileAsync2(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `(Get-Process -Id ${pid} -ErrorAction Stop).WorkingSet64`
+        ],
+        { encoding: "utf8", timeout: 1e3, windowsHide: true }
+      );
+      const bytes = Number(String(stdout2).trim());
+      return Number.isFinite(bytes) && bytes >= 0 ? bytes : null;
+    }
+    const { stdout } = await execFileAsync2(
+      "ps",
+      ["-o", "rss=", "-p", String(pid)],
+      { encoding: "utf8", timeout: 1e3, windowsHide: true }
+    );
+    const kibibytes = Number(String(stdout).trim());
+    return Number.isFinite(kibibytes) && kibibytes >= 0 ? kibibytes * 1024 : null;
+  } catch {
+    return null;
+  }
+}
 function abortError(signal) {
   const error = signal?.reason instanceof Error ? signal.reason : new Error("Python sandbox execution was cancelled.");
   error.name = "AbortError";

package/dist/chunks/{teams-bot-WP3FHKGA.js → teams-bot-KNY5OEXB.js}

@@ -1,13 +1,13 @@
 import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
 import {
   resolveSandboxClient
-} from "./chunk-XSAXENQD.js";
-import "./chunk-5G4E547X.js";
+} from "./chunk-NC2GQQOT.js";
+import "./chunk-4GLUNJLZ.js";
 import {
   optionString,
   parseJsonOption,
   requiredTeamId
-} from "./chunk-3Y4EL3P6.js";
+} from "./chunk-7HZBKUUB.js";
 import "./chunk-UACZUFIA.js";
 
 // src/cli/teams-bot.ts

package/dist/cli.js

@@ -4,24 +4,39 @@ import {
   parseArgs,
   resolveAccountOption,
   resolveBaseUrlOption
-} from "./chunks/chunk-5G4E547X.js";
+} from "./chunks/chunk-4GLUNJLZ.js";
 import {
   getInstalledCliVersion,
   parseBooleanOption,
   runCliCommand
-} from "./chunks/chunk-3Y4EL3P6.js";
+} from "./chunks/chunk-7HZBKUUB.js";
 import "./chunks/chunk-UACZUFIA.js";
 
+// src/cli/top-level-action.ts
+function resolveCliTopLevelAction(input) {
+  if (!input.command && parseBooleanOption(input.options.version)) return "version";
+  if (parseBooleanOption(input.options.checkUpdate)) return "check-update";
+  if (!input.command && parseBooleanOption(input.options.help)) return "help";
+  if (!input.command && parseBooleanOption(input.options.tui)) return "tui";
+  if (!input.command) return "ui";
+  return "command";
+}
+
 // src/cli/main.ts
 async function runOpenPondCli(argv = process.argv.slice(2)) {
   if (await runEmbeddedCompanion(argv)) return;
   const { command, options, rest } = parseArgs(argv);
-  if (options.version !== void 0 && !command) {
+  const action = resolveCliTopLevelAction({ command, options });
+  if (action === "version") {
     console.log(getInstalledCliVersion());
     return;
   }
-  if (options.checkUpdate !== void 0) {
-    await (await import("./chunks/core-commands-IM2UKLU4.js")).runCheckUpdate();
+  if (action === "check-update") {
+    await (await import("./chunks/core-commands-KI53GSJF.js")).runCheckUpdate();
+    return;
+  }
+  if (action === "help") {
+    (await import("./chunks/help-TIEOIVOA.js")).printHelp();
     return;
   }
   const selectedAccount = resolveAccountOption(options);
@@ -32,36 +47,32 @@ async function runOpenPondCli(argv = process.argv.slice(2)) {
   if (selectedBaseUrl) {
     process.env.OPENPOND_BASE_URL = selectedBaseUrl;
   }
-  if (parseBooleanOption(options.tui)) {
-    await (await import("./chunks/app-layer-YKXEQGOW.js")).runOpenPondTerminalCommand(options, rest);
-    return;
-  }
-  if (!command && process.stdin.isTTY && process.stdout.isTTY) {
-    await (await import("./chunks/app-layer-YKXEQGOW.js")).runOpenPondTerminalCommand(options, rest);
+  if (action === "tui") {
+    await (await import("./chunks/app-layer-53U5JVE7.js")).runOpenPondTerminalCommand(options, rest);
     return;
   }
-  if (!command) {
-    (await import("./chunks/help-LMH5FGT2.js")).printHelp();
+  if (action === "ui") {
+    await (await import("./chunks/app-layer-53U5JVE7.js")).runOpenPondServerCommand("web", options, rest);
     return;
   }
   if (await runCliCommand({ command, options, rest })) {
     return;
   }
-  (await import("./chunks/help-LMH5FGT2.js")).printHelp();
+  (await import("./chunks/help-TIEOIVOA.js")).printHelp();
   process.exit(1);
 }
 async function runEmbeddedCompanion(argv) {
   if (argv[0] === "__server") {
     process.argv = [process.execPath, "openpond-server", ...argv.slice(1)];
     const [{ createOpenPondServer }, { runOpenPondServerCli }] = await Promise.all([
-      import("./chunks/src-EYXQS6XD.js"),
-      import("./chunks/cli-NVKNE4AZ.js")
+      import("./chunks/src-J4262EAE.js"),
+      import("./chunks/cli-EP473A53.js")
     ]);
     await runOpenPondServerCli(createOpenPondServer);
     return true;
   }
   if (argv[0] === "__terminal") {
-    await (await import("./chunks/src-3RBI4DNN.js")).runOpenPondTerminalCli(argv.slice(1));
+    await (await import("./chunks/src-CBPRIWG5.js")).runOpenPondTerminalCli(argv.slice(1));
     return true;
   }
   return false;

package/docs/command-reference.md

@@ -220,12 +220,13 @@ Options:
 
 ```text
 Usage:
-  openpond ui [args]
+  openpond ui [--no-open] [--hostname HOST] [--port PORT]
 
 Options:
   --host <string>
   --hostname <string>
   --listen <string>
+  --no-open
   --port <integer>
   --web-root <string>
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpond",
-  "version": "0.0.30-bootstrap.0",
+  "version": "0.0.31",
   "openpondReleaseVersioned": true,
   "license": "MIT",
   "description": "OpenPond CLI and local harness",
@@ -71,6 +71,7 @@
     "@openpond/cloud": "workspace:*",
     "@openpond/contracts": "workspace:*",
     "@openpond/local-server": "workspace:*",
+    "@openpond/runtime": "workspace:*",
     "@openpond/terminal": "workspace:*",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "24.13.3"
@@ -79,6 +80,7 @@
     "@openpond/cloud",
     "@openpond/contracts",
     "@openpond/local-server",
+    "@openpond/runtime",
     "@openpond/terminal"
   ]
 }