openpond 0.0.30-bootstrap.0

package/dist/chunks/sandbox-template-LZN4F55Z.js

@@ -0,0 +1,1646 @@
+import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
+import {
+  createSandboxFromPlan,
+  summarizeSandbox
+} from "./chunk-AUJLPKGI.js";
+import {
+  resolveGitBranch
+} from "./chunk-74O6FGVN.js";
+import "./chunk-OG75GMVO.js";
+import {
+  OPENPOND_MANIFEST_FILE_NAME,
+  SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME,
+  SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
+  formatSandboxTemplateDiagnostics,
+  sandboxTemplateBuildMetadata,
+  sandboxTemplateBuildPlan,
+  sandboxTemplateExecutableEntries,
+  sandboxTemplateJsonSchema,
+  sandboxTemplateScaffoldFiles,
+  validateSandboxTemplateYaml
+} from "./chunk-BYAPLT37.js";
+import "./chunk-WYDVQOBL.js";
+import {
+  createRepo,
+  ensureApiKey,
+  formatTokenizedRepoUrl,
+  getGitRemoteUrl,
+  loadConfig,
+  parseSandboxRuntimePromotionPolicyOption,
+  parseSandboxTemplateEnvOptions,
+  parseSandboxWorkflowModeOption,
+  promptConfirm,
+  redactToken,
+  resolveRepoUrl,
+  resolveSandboxClient,
+  runCommand,
+  runShellCommand,
+  warnOnRepoHostMismatch
+} from "./chunk-XSAXENQD.js";
+import {
+  resolveBaseUrl,
+  resolvePublicApiBaseUrl
+} from "./chunk-5G4E547X.js";
+import {
+  parseBooleanOption,
+  parseIntegerOption,
+  parseJsonOption
+} from "./chunk-3Y4EL3P6.js";
+import "./chunk-UACZUFIA.js";
+
+// src/cli/sandbox-template.ts
+import { promises as fs3, existsSync as existsSync2 } from "node:fs";
+import path4 from "node:path";
+
+// src/cli/sandbox-template-local.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { promises as fs2 } from "node:fs";
+import path3 from "node:path";
+
+// src/cli/sandbox-template-start.ts
+import { Buffer } from "node:buffer";
+import { promises as fs } from "node:fs";
+import path2 from "node:path";
+
+// src/cli/sandbox-template-schedules.ts
+async function createSandboxTemplateStartSchedules(client, sandboxId, manifest, options) {
+  const selection = resolveSandboxTemplateStartScheduleSelection(
+    manifest,
+    options
+  );
+  if (!selection) {
+    return [];
+  }
+  const overrides = parseSandboxTemplateScheduleOverrides(manifest, options);
+  const projectId = typeof options.projectId === "string" && options.projectId.trim() ? options.projectId.trim() : typeof options.runtimeProjectId === "string" ? options.runtimeProjectId.trim() : "";
+  const teamId = typeof options.teamId === "string" ? options.teamId.trim() : "";
+  const created = [];
+  for (const schedule of selection.schedules) {
+    const input2 = buildSandboxTemplateStartScheduleInput({
+      manifest,
+      schedule,
+      override: overrides.get(schedule.name),
+      mode: selection.mode,
+      sourceSandboxId: sandboxId,
+      teamId,
+      projectId
+    });
+    const result = await client.createSchedule(input2);
+    created.push({
+      id: result.schedule.id,
+      name: result.schedule.name,
+      enabled: result.schedule.enabled,
+      scheduleType: result.schedule.scheduleType,
+      scheduleExpression: result.schedule.scheduleExpression,
+      syncStatus: result.schedule.syncStatus,
+      awsScheduleArn: result.schedule.awsScheduleArn ?? null,
+      target: result.schedule.target
+    });
+  }
+  return created;
+}
+function resolveSandboxTemplateStartScheduleSelection(manifest, options) {
+  const enableRaw = options.enableSchedules ?? options.enableSchedule;
+  const disableRaw = options.disableSchedules ?? options.disableSchedule;
+  if (enableRaw !== void 0 && disableRaw !== void 0) {
+    throw new Error(
+      "pass only one of --enable-schedules or --disable-schedules"
+    );
+  }
+  let mode = null;
+  let rawSelection;
+  if (enableRaw !== void 0) {
+    mode = "enabled";
+    rawSelection = enableRaw;
+  } else if (disableRaw !== void 0) {
+    mode = "disabled";
+    rawSelection = disableRaw;
+  } else if (options.schedules !== void 0) {
+    rawSelection = options.schedules;
+    const rawMode = typeof options.scheduleMode === "string" ? options.scheduleMode.trim().toLowerCase() : "disabled";
+    if (rawMode === "none") {
+      return null;
+    }
+    if (rawMode !== "enabled" && rawMode !== "disabled") {
+      throw new Error("--schedule-mode must be enabled, disabled, or none");
+    }
+    mode = rawMode;
+  }
+  if (!mode) {
+    return null;
+  }
+  if (manifest.schedules.length === 0) {
+    return { mode, schedules: [] };
+  }
+  const selectedNames = parseSandboxTemplateScheduleNameSelection(
+    rawSelection,
+    manifest
+  );
+  const schedules = selectedNames === null ? manifest.schedules : manifest.schedules.filter(
+    (schedule) => selectedNames.has(schedule.name)
+  );
+  return { mode, schedules };
+}
+function parseSandboxTemplateScheduleNameSelection(value, manifest) {
+  if (value === void 0 || value === true) {
+    return null;
+  }
+  const raw = String(value).trim();
+  if (!raw || raw === "true" || raw.toLowerCase() === "all") {
+    return null;
+  }
+  if (raw.toLowerCase() === "none") {
+    return /* @__PURE__ */ new Set();
+  }
+  const known = new Set(manifest.schedules.map((schedule) => schedule.name));
+  const selected = new Set(
+    raw.split(",").map((item) => item.trim()).filter(Boolean)
+  );
+  for (const name of selected) {
+    if (!known.has(name)) {
+      throw new Error(`manifest schedule not found: ${name}`);
+    }
+  }
+  return selected;
+}
+function parseSandboxTemplateScheduleOverrides(manifest, options) {
+  const raw = typeof options.scheduleOverrides === "string" ? options.scheduleOverrides : typeof options.scheduleOverride === "string" ? options.scheduleOverride : "";
+  if (!raw.trim()) {
+    return /* @__PURE__ */ new Map();
+  }
+  const parsed = parseJsonOption(raw, "schedule-overrides");
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(
+      "schedule-overrides must be a JSON object keyed by schedule name"
+    );
+  }
+  const known = new Set(manifest.schedules.map((schedule) => schedule.name));
+  const out = /* @__PURE__ */ new Map();
+  for (const [name, override] of Object.entries(parsed)) {
+    if (!known.has(name)) {
+      throw new Error(`schedule override target does not exist: ${name}`);
+    }
+    if (!override || typeof override !== "object" || Array.isArray(override)) {
+      throw new Error(`schedule override for ${name} must be an object`);
+    }
+    out.set(name, override);
+  }
+  return out;
+}
+function buildSandboxTemplateStartScheduleInput(params) {
+  const schedule = mergeSandboxTemplateScheduleOverride(
+    params.schedule,
+    params.override
+  );
+  const expression = sandboxTemplateScheduleExpression(schedule);
+  return {
+    sourceSandboxId: params.sourceSandboxId,
+    ...params.teamId ? { teamId: params.teamId } : {},
+    ...params.projectId ? { projectId: params.projectId } : {},
+    name: schedule.name,
+    ...schedule.description ? { description: schedule.description } : {},
+    ...expression,
+    ...schedule.timezone ? { timezone: schedule.timezone } : {},
+    enabled: typeof params.override?.enabled === "boolean" ? params.override.enabled : params.mode === "enabled",
+    ...schedule.startAt ? { startAt: schedule.startAt } : {},
+    ...schedule.endAt ? { endAt: schedule.endAt } : {},
+    ...schedule.maxRuns !== void 0 ? { maxRuns: schedule.maxRuns } : {},
+    runtimePolicy: schedule.runtimePolicy,
+    target: sandboxTemplateScheduleCommandTarget(params.manifest, schedule),
+    ...schedule.budget ? { budget: schedule.budget } : {},
+    ...schedule.resources ? { resources: schedule.resources } : {},
+    ...schedule.quotas ? { quotas: schedule.quotas } : {},
+    ...schedule.lifecycle ? { lifecycle: schedule.lifecycle } : {},
+    ...schedule.retentionPolicy ? { retentionPolicy: schedule.retentionPolicy } : {},
+    ...schedule.env ? { env: schedule.env } : {},
+    ...schedule.integrationLeases ? {
+      integrationLeases: schedule.integrationLeases
+    } : {},
+    metadata: {
+      ...schedule.metadata ?? {},
+      manifestScheduleName: schedule.name,
+      source: "openpond-code-sandbox-template-start"
+    },
+    managementSource: "openpond.yaml",
+    manifestPath: OPENPOND_MANIFEST_FILE_NAME
+  };
+}
+function mergeSandboxTemplateScheduleOverride(schedule, override) {
+  if (!override) {
+    return schedule;
+  }
+  return {
+    ...schedule,
+    ...override,
+    target: schedule.target || override.target ? {
+      ...schedule.target ?? {},
+      ...override.target ?? {}
+    } : void 0,
+    metadata: schedule.metadata || override.metadata ? {
+      ...schedule.metadata ?? {},
+      ...override.metadata ?? {}
+    } : void 0
+  };
+}
+function sandboxTemplateScheduleExpression(schedule) {
+  if (schedule.scheduleExpression) {
+    return {
+      scheduleType: schedule.scheduleType ?? "cron",
+      scheduleExpression: schedule.scheduleExpression
+    };
+  }
+  if (schedule.rate) {
+    return {
+      scheduleType: "rate",
+      scheduleExpression: /^rate\(/i.test(schedule.rate) ? schedule.rate : `rate(${schedule.rate})`
+    };
+  }
+  if (schedule.once) {
+    return {
+      scheduleType: "once",
+      scheduleExpression: /^at\(/i.test(schedule.once) ? schedule.once : `at(${schedule.once})`
+    };
+  }
+  return {
+    scheduleType: "cron",
+    scheduleExpression: schedule.cron ?? ""
+  };
+}
+function sandboxTemplateScheduleCommandTarget(manifest, schedule) {
+  const explicitCommand = schedule.command ?? schedule.target?.command ?? null;
+  if (explicitCommand) {
+    return {
+      kind: "command",
+      command: explicitCommand,
+      requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? false
+    };
+  }
+  const targetKind = schedule.target?.kind ?? "action";
+  if (targetKind === "start") {
+    return {
+      kind: "command",
+      command: manifest.start.command,
+      requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? manifest.start.requiresStart ?? false
+    };
+  }
+  if (targetKind === "service") {
+    const serviceName = schedule.target?.name ?? "";
+    const service = manifest.services.find((item) => item.name === serviceName);
+    if (!service) {
+      throw new Error(`schedule service target does not exist: ${serviceName}`);
+    }
+    return {
+      kind: "command",
+      command: service.command,
+      requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? service.requiresStart ?? false
+    };
+  }
+  const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? schedule.target?.name : void 0);
+  const action = manifest.actions.find((item) => item.name === actionName);
+  if (!action) {
+    throw new Error(
+      `schedule action target does not exist: ${actionName ?? ""}`
+    );
+  }
+  return {
+    kind: "command",
+    command: action.command,
+    requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? action.requiresStart ?? false
+  };
+}
+
+// src/cli/sandbox-template-git.ts
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { stdin as input } from "node:process";
+async function resolveSandboxTemplateStartRepo(manifest, options, projectPath) {
+  const explicitRepo = typeof options.repo === "string" ? options.repo.trim() : "";
+  if (explicitRepo) {
+    return normalizeSandboxTemplateRepoUrl(explicitRepo);
+  }
+  await ensureGitRepository(projectPath);
+  const config = await loadConfig();
+  const uiBase = resolveBaseUrl(config);
+  const apiBase = resolvePublicApiBaseUrl(config);
+  const apiKey = await ensureApiKey(config, uiBase);
+  let originUrl = await getGitRemoteUrl(projectPath, "origin");
+  if (!originUrl) {
+    const teamId = typeof options.teamId === "string" ? options.teamId.trim() : "";
+    const response = await createRepo(apiBase, apiKey, {
+      name: manifest.name,
+      description: manifest.description,
+      repoInit: "empty",
+      ...teamId ? { teamId } : {}
+    });
+    originUrl = resolveRepoUrl(response);
+    const remoteResult = await runCommand(
+      "git",
+      ["remote", "add", "origin", originUrl],
+      {
+        cwd: projectPath
+      }
+    );
+    if (remoteResult.code !== 0) {
+      throw new Error(
+        `git remote add failed: ${remoteResult.stderr.trim() || remoteResult.stdout.trim() || "unknown error"}`
+      );
+    }
+  }
+  warnOnRepoHostMismatch(originUrl);
+  await ensureGitCommitForSandboxTemplateStart(projectPath, options);
+  if (!parseBooleanOption(options.noPush)) {
+    const branch = await resolveSandboxTemplateStartBranch(
+      projectPath,
+      options
+    );
+    await pushGitBranchForSandboxTemplateStart(
+      projectPath,
+      originUrl,
+      branch,
+      apiKey,
+      options
+    );
+  }
+  return normalizeSandboxTemplateRepoUrl(originUrl);
+}
+async function ensureGitRepository(projectPath) {
+  const gitDir = path.join(projectPath, ".git");
+  if (existsSync(gitDir)) return;
+  const result = await runCommand("git", ["init"], { cwd: projectPath });
+  if (result.code !== 0) {
+    throw new Error(
+      `git init failed: ${result.stderr.trim() || result.stdout.trim() || "unknown error"}`
+    );
+  }
+}
+async function ensureGitCommitForSandboxTemplateStart(projectPath, options) {
+  const status = await runCommand("git", ["status", "--porcelain"], {
+    cwd: projectPath
+  });
+  if (status.code !== 0) {
+    throw new Error(
+      `git status failed: ${status.stderr.trim() || status.stdout.trim() || "unknown error"}`
+    );
+  }
+  const head = await runCommand("git", ["rev-parse", "--verify", "HEAD"], {
+    cwd: projectPath
+  });
+  const hasHead = head.code === 0;
+  const dirty = status.stdout.trim().length > 0;
+  if (!dirty && hasHead) return;
+  const shouldCommit = parseBooleanOption(options.commit) || parseBooleanOption(options.yes) || (input.isTTY ? await promptConfirm(
+    hasHead ? "Commit local changes before starting the sandbox?" : "Create the initial git commit before starting the sandbox?",
+    !hasHead
+  ) : false);
+  if (!shouldCommit) {
+    if (!hasHead) {
+      throw new Error(
+        "local repository has no commits; pass --commit or commit before starting"
+      );
+    }
+    if (dirty) {
+      console.warn(
+        "warning: uncommitted local changes will not be included in the sandbox"
+      );
+    }
+    return;
+  }
+  const add = await runCommand("git", ["add", "-A"], { cwd: projectPath });
+  if (add.code !== 0) {
+    throw new Error(
+      `git add failed: ${add.stderr.trim() || add.stdout.trim() || "unknown error"}`
+    );
+  }
+  const message = typeof options.commitMessage === "string" && options.commitMessage.trim() ? options.commitMessage.trim() : `start ${OPENPOND_MANIFEST_FILE_NAME} sandbox`;
+  const commit = await runCommand("git", ["commit", "-m", message], {
+    cwd: projectPath
+  });
+  if (commit.code !== 0) {
+    const output = commit.stderr.trim() || commit.stdout.trim();
+    if (output.includes("nothing to commit") && hasHead) return;
+    throw new Error(`git commit failed: ${output || "unknown error"}`);
+  }
+}
+async function resolveSandboxTemplateStartBranch(projectPath, options) {
+  const branchOption = typeof options.branch === "string" ? options.branch.trim() : "";
+  const branch = branchOption || await resolveGitBranch(projectPath);
+  if (!branch) {
+    throw new Error("unable to resolve git branch; pass --branch");
+  }
+  return branch;
+}
+async function pushGitBranchForSandboxTemplateStart(projectPath, originUrl, branch, apiKey, options) {
+  let tokenRemote;
+  try {
+    tokenRemote = formatTokenizedRepoUrl(originUrl, apiKey);
+  } catch {
+    throw new Error("origin remote must be https for tokenized pushes");
+  }
+  const keepTokenRemote = parseBooleanOption(options.keepTokenRemote) || parseBooleanOption(options.token) || parseBooleanOption(options.setRemoteToken);
+  const alreadyTokenized = originUrl.includes("x-access-token:");
+  const restoreUrl = !keepTokenRemote && !alreadyTokenized ? originUrl : null;
+  const previousPrompt = process.env.GIT_TERMINAL_PROMPT;
+  process.env.GIT_TERMINAL_PROMPT = "0";
+  try {
+    if (!alreadyTokenized) {
+      const setResult = await runCommand(
+        "git",
+        ["remote", "set-url", "origin", tokenRemote],
+        {
+          cwd: projectPath
+        }
+      );
+      if (setResult.code !== 0) {
+        throw new Error(
+          `git remote set-url failed: ${redactToken(
+            setResult.stderr.trim() || setResult.stdout.trim() || "unknown error"
+          )}`
+        );
+      }
+    }
+    const push = await runCommand("git", ["push", "-u", "origin", branch], {
+      cwd: projectPath,
+      inherit: true
+    });
+    if (push.code !== 0) {
+      throw new Error("git push failed");
+    }
+  } finally {
+    if (restoreUrl) {
+      await runCommand("git", ["remote", "set-url", "origin", restoreUrl], {
+        cwd: projectPath
+      }).catch(() => null);
+    }
+    if (previousPrompt === void 0) {
+      delete process.env.GIT_TERMINAL_PROMPT;
+    } else {
+      process.env.GIT_TERMINAL_PROMPT = previousPrompt;
+    }
+  }
+}
+function normalizeSandboxTemplateRepoIdentity(repoUrl) {
+  return normalizeSandboxTemplateRepoUrl(repoUrl).replace(/\.git$/, "");
+}
+function normalizeSandboxTemplateRepoUrl(repoUrl) {
+  const parsed = new URL(repoUrl);
+  parsed.username = "";
+  parsed.password = "";
+  const text = parsed.toString();
+  return text.endsWith(".git") ? text : `${text.replace(/\/$/, "")}.git`;
+}
+
+// src/cli/sandbox-template-start.ts
+async function runSandboxTemplateStart(options) {
+  const filePath = resolveSandboxTemplateFilePath(options);
+  const projectPath = path2.dirname(filePath);
+  const source = await fs.readFile(filePath, "utf8");
+  const result = validateSandboxTemplateYaml(source);
+  if (!result.ok) {
+    console.error(formatSandboxTemplateDiagnostics(result.diagnostics));
+    process.exitCode = 1;
+    return;
+  }
+  const manifest = result.manifest;
+  const executable = resolveSandboxTemplateStartExecutable(manifest, options);
+  const input2 = await resolveSandboxTemplateStartInput(
+    manifest,
+    options,
+    projectPath
+  );
+  const repo = await resolveSandboxTemplateStartRepo(
+    manifest,
+    options,
+    projectPath
+  );
+  const client = await resolveSandboxClient(options);
+  const createInput = buildSandboxTemplateStartCreateInput(
+    manifest,
+    options,
+    repo
+  );
+  const sandbox = await createSandboxTemplateStartSandbox(
+    client,
+    createInput,
+    repo
+  );
+  await waitForSandboxTemplateRunnerReady(client, sandbox.id);
+  const setupCommands = await runSandboxTemplateSetupCommands(
+    client,
+    sandbox.id,
+    manifest,
+    options
+  );
+  const uploadedFiles = await uploadSandboxTemplateStartFiles(
+    client,
+    sandbox.id,
+    input2.uploadRequests
+  );
+  const commandInput = {
+    ...input2.scalars,
+    ...formatUploadedFileParams(uploadedFiles, input2.uploadRequests)
+  };
+  const execution = await runSandboxTemplateExecutable(
+    client,
+    sandbox.id,
+    executable,
+    commandInput,
+    sandboxTemplateRuntimeEnv(sandbox)
+  );
+  const previews = await openSandboxTemplatePorts(
+    client,
+    sandbox.id,
+    executable.ports
+  );
+  const schedules = await createSandboxTemplateStartSchedules(
+    client,
+    sandbox.id,
+    manifest,
+    options
+  );
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        file: filePath,
+        repo,
+        executable: {
+          kind: executable.kind,
+          name: executable.name,
+          command: executable.command
+        },
+        sandbox: summarizeSandbox(sandbox),
+        setupCommands,
+        uploadedFiles,
+        input: commandInput,
+        execution,
+        previews,
+        schedules,
+        expectedArtifacts: executable.artifactPaths
+      },
+      null,
+      2
+    )
+  );
+}
+function resolveSandboxTemplateStartExecutable(manifest, options) {
+  const executables = sandboxTemplateExecutableEntries(manifest);
+  const action = typeof options.action === "string" ? options.action.trim() : "";
+  const service = typeof options.service === "string" ? options.service.trim() : "";
+  const target = typeof options.target === "string" ? options.target.trim() : "";
+  const entrypoint = typeof options.entrypoint === "string" ? options.entrypoint.trim() : "";
+  const requested = action || service || target || entrypoint || "start";
+  const kind = action ? "action" : service ? "service" : "";
+  const match = executables.find(
+    (candidate) => candidate.name === requested && (!kind || candidate.kind === kind)
+  );
+  if (!match) {
+    throw new Error(
+      `manifest executable not found: ${requested}. Available: ${executables.map((candidate) => `${candidate.kind}:${candidate.name}`).join(", ")}`
+    );
+  }
+  return match;
+}
+function buildSandboxTemplateStartCreateInput(manifest, options, repo) {
+  const budgetUsd = typeof options.budgetUsd === "string" && options.budgetUsd.trim() ? options.budgetUsd.trim() : typeof options.budget === "string" && options.budget.trim() ? options.budget.trim() : "0.05";
+  const maxDurationSeconds = parseIntegerOption(
+    options.maxDurationSeconds,
+    "max-duration-seconds"
+  );
+  const idleTimeoutSeconds = parseIntegerOption(
+    options.idleTimeoutSeconds,
+    "idle-timeout-seconds"
+  );
+  const teamId = typeof options.teamId === "string" ? options.teamId.trim() : "";
+  const requestedProjectId = typeof options.projectId === "string" ? options.projectId.trim() : "";
+  const sandboxRuntimeProjectId = typeof options.runtimeProjectId === "string" ? options.runtimeProjectId.trim() : "";
+  if (requestedProjectId && sandboxRuntimeProjectId && requestedProjectId !== sandboxRuntimeProjectId) {
+    throw new Error(
+      "project-id and runtime-project-id must match when both are set"
+    );
+  }
+  const projectId = requestedProjectId || sandboxRuntimeProjectId;
+  const requestedAgentId = typeof options.agentId === "string" ? options.agentId.trim() : "";
+  const sandboxRuntimeAgentId = typeof options.runtimeAgentId === "string" ? options.runtimeAgentId.trim() : "";
+  if (requestedAgentId && sandboxRuntimeAgentId && requestedAgentId !== sandboxRuntimeAgentId) {
+    throw new Error(
+      "agent-id and runtime-agent-id must match when both are set"
+    );
+  }
+  const agentId = requestedAgentId || sandboxRuntimeAgentId;
+  const sandboxWorkflowMode = parseSandboxWorkflowModeOption(options.workflowMode);
+  const sandboxRuntimePromotionPolicy = parseSandboxRuntimePromotionPolicyOption(options.runtimePromotionPolicy);
+  const sandboxRuntimeBaseBranch = typeof options.runtimeBaseBranch === "string" && options.runtimeBaseBranch.trim() ? options.runtimeBaseBranch.trim() : "";
+  const sandboxRuntimeBaseSha = typeof options.runtimeBaseSha === "string" && options.runtimeBaseSha.trim() ? options.runtimeBaseSha.trim() : "";
+  const runtimeId = typeof options.runtimeId === "string" && options.runtimeId.trim() ? options.runtimeId.trim() : "";
+  const sandboxRuntimeRequested = Boolean(
+    sandboxWorkflowMode || sandboxRuntimePromotionPolicy || sandboxRuntimeBaseBranch || sandboxRuntimeBaseSha || runtimeId || sandboxRuntimeProjectId || sandboxRuntimeAgentId
+  );
+  const env = parseSandboxTemplateEnvOptions(manifest, options);
+  const workloadSource = sandboxWorkloadSourceFromManifest(manifest);
+  const sandbox = {
+    repo,
+    ...teamId ? { teamId } : {},
+    ...projectId ? { projectId } : {},
+    ...agentId ? { agentId } : {},
+    resources: manifest.resources ?? {},
+    networkPolicy: {
+      internetEgress: sandboxTemplateInternetEgressPolicy(
+        manifest.network.egress
+      )
+    },
+    budget: { maxUsd: budgetUsd },
+    quotas: {
+      maxSpendUsd: budgetUsd,
+      ...maxDurationSeconds !== void 0 ? { maxDurationSeconds } : {},
+      ...idleTimeoutSeconds !== void 0 ? { idleTimeoutSeconds } : {}
+    },
+    ...env.length > 0 ? { env } : {},
+    ...workloadSource ? { workloadSource } : {},
+    volumes: manifest.volumes,
+    metadata: {
+      source: "openpond-code-sandbox-template-start",
+      manifestFile: OPENPOND_MANIFEST_FILE_NAME,
+      template: {
+        name: manifest.name,
+        version: manifest.version,
+        useCase: manifest.useCase
+      }
+    }
+  };
+  return {
+    sandbox,
+    ...sandboxRuntimeRequested && runtimeId ? { runtimeId } : {},
+    ...sandboxRuntimeRequested && !runtimeId ? {
+      sandboxRuntime: {
+        ...teamId ? { teamId } : {},
+        ...sandboxWorkflowMode ? { workflowMode: sandboxWorkflowMode } : {},
+        ...projectId ? { projectId } : {},
+        ...agentId ? { agentId } : {},
+        baseBranch: sandboxRuntimeBaseBranch || "master",
+        ...sandboxRuntimeBaseSha ? { baseSha: sandboxRuntimeBaseSha } : {},
+        ...sandboxRuntimePromotionPolicy ? { promotionPolicy: sandboxRuntimePromotionPolicy } : {}
+      }
+    } : {}
+  };
+}
+function sandboxWorkloadSourceFromManifest(manifest) {
+  if (manifest.runtime.image) {
+    return { image: manifest.runtime.image };
+  }
+  if (manifest.runtime.dockerfile) {
+    return { dockerfile: manifest.runtime.dockerfile };
+  }
+  return void 0;
+}
+function sandboxTemplateInternetEgressPolicy(egress) {
+  return egress === "allow" ? "allow" : "block";
+}
+async function createSandboxTemplateStartSandbox(client, plan, repo) {
+  const requestedAt = Date.now();
+  try {
+    return (await createSandboxFromPlan(client, plan)).sandbox;
+  } catch (error) {
+    if (!isLikelySandboxCreateTimeout(error)) {
+      throw error;
+    }
+    console.warn(
+      "warning: sandbox create timed out; checking for the created sandbox record"
+    );
+    return recoverTimedOutSandboxCreate(
+      client,
+      plan.sandbox,
+      repo,
+      requestedAt
+    );
+  }
+}
+function isLikelySandboxCreateTimeout(error) {
+  return error instanceof Error && /\b(504|timed out|timeout)\b/i.test(error.message);
+}
+async function recoverTimedOutSandboxCreate(client, input2, repo, requestedAt) {
+  const timeoutMs = 12 * 6e4;
+  const pollMs = 3e3;
+  const deadline = Date.now() + timeoutMs;
+  const repoIdentity = normalizeSandboxTemplateRepoIdentity(repo);
+  const metadata = input2.metadata ?? {};
+  while (Date.now() < deadline) {
+    const sandboxes = await client.list({
+      ...input2.teamId ? { teamId: input2.teamId } : {},
+      ...input2.projectId ? { projectId: input2.projectId } : {},
+      ...input2.agentId ? { agentId: input2.agentId } : {}
+    });
+    const match = sandboxes.filter((sandbox) => {
+      if (!sandbox.repo) return false;
+      if (normalizeSandboxTemplateRepoIdentity(sandbox.repo) !== repoIdentity)
+        return false;
+      const createdAt = Date.parse(sandbox.createdAt);
+      if (Number.isFinite(createdAt) && createdAt < requestedAt - 3e4)
+        return false;
+      if (metadata.source && sandbox.metadata?.source !== metadata.source)
+        return false;
+      return true;
+    }).sort(
+      (left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt)
+    )[0];
+    if (match?.state === "running" || match?.state === "stopped") {
+      return match;
+    }
+    if (match?.state === "error") {
+      throw new Error(
+        `sandbox create failed after timeout: ${match.id}
+${match.logs.join(
+          "\n"
+        )}`
+      );
+    }
+    await sleep(pollMs);
+  }
+  throw new Error(
+    "sandbox create timed out and no matching created sandbox reached running state"
+  );
+}
+async function waitForSandboxTemplateRunnerReady(client, sandboxId) {
+  const timeoutMs = 12e4;
+  const pollMs = 3e3;
+  const deadline = Date.now() + timeoutMs;
+  let lastError = null;
+  while (Date.now() < deadline) {
+    try {
+      const result = await client.exec(sandboxId, {
+        command: "true",
+        timeoutSeconds: 30
+      });
+      if (result.command.status === "succeeded" && result.command.exitCode === 0) {
+        return;
+      }
+      lastError = new Error(
+        `readiness command ${result.command.status} with exit code ${String(
+          result.command.exitCode
+        )}`
+      );
+    } catch (error) {
+      lastError = error;
+      if (!isRetryableSandboxRunnerReadyError(error)) {
+        throw error;
+      }
+    }
+    await sleep(pollMs);
+  }
+  throw new Error(
+    `sandbox runner was not ready after create: ${formatUnknownError(
+      lastError
+    )}`
+  );
+}
+function isRetryableSandboxRunnerReadyError(error) {
+  return error instanceof Error && /\b(502|503|504|timed out|timeout|sandbox_not_found|sandbox_not_ready|sandbox_runner_failed)\b/i.test(
+    error.message
+  );
+}
+function formatUnknownError(error) {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  return "unknown error";
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function resolveSandboxTemplateStartInput(manifest, options, projectPath) {
+  const scalars = parseSandboxTemplateScalarInputs(options);
+  const uploadSpecs = collectSandboxTemplateUploadSpecs(manifest);
+  const uploadRequests = [];
+  const fileInputs = parseSandboxTemplateFileInputOptions(options);
+  for (const [inputName, rawValue] of Object.entries(fileInputs)) {
+    const spec = uploadSpecs.get(inputName);
+    if (!spec) {
+      throw new Error(
+        `${inputName} is not declared as a file upload input in ${OPENPOND_MANIFEST_FILE_NAME}`
+      );
+    }
+    const localPaths = await expandSandboxTemplateUploadPaths(
+      rawValue,
+      projectPath
+    );
+    if (!spec.multiple && localPaths.length > 1) {
+      throw new Error(
+        `${inputName} accepts one file, got ${localPaths.length}`
+      );
+    }
+    uploadRequests.push({ inputName, localPaths, spec });
+  }
+  const requiredInputs = Array.isArray(manifest.inputs.schema.required) ? manifest.inputs.schema.required.filter(
+    (value) => typeof value === "string"
+  ) : [];
+  for (const inputName of requiredInputs) {
+    if (uploadSpecs.has(inputName) && !uploadRequests.some((request) => request.inputName === inputName)) {
+      throw new Error(
+        `${inputName} is required; pass --input-file ${inputName}=<path> or --input-files ${inputName}=<glob>`
+      );
+    }
+  }
+  return { scalars, uploadRequests };
+}
+function parseSandboxTemplateScalarInputs(options) {
+  const rawInputs = typeof options.inputs === "string" ? options.inputs : typeof options.inputJson === "string" ? options.inputJson : typeof options.params === "string" ? options.params : "";
+  const scalars = rawInputs ? parseJsonOption(rawInputs, "inputs") : {};
+  if (!scalars || typeof scalars !== "object" || Array.isArray(scalars)) {
+    throw new Error("inputs must be a JSON object");
+  }
+  const rawInput = typeof options.input === "string" ? options.input.trim() : "";
+  if (rawInput) {
+    const [name, value] = parseKeyValueOption(rawInput, "input");
+    scalars[name] = value;
+  }
+  return scalars;
+}
+function parseSandboxTemplateFileInputOptions(options) {
+  const out = {};
+  const rawFile = typeof options.inputFile === "string" ? options.inputFile.trim() : "";
+  if (rawFile) {
+    const [name, value] = parseKeyValueOption(rawFile, "input-file");
+    out[name] = value;
+  }
+  const rawFiles = typeof options.inputFiles === "string" ? options.inputFiles.trim() : "";
+  if (rawFiles) {
+    const [name, value] = parseKeyValueOption(rawFiles, "input-files");
+    out[name] = value;
+  }
+  return out;
+}
+function parseKeyValueOption(value, label) {
+  const index = value.indexOf("=");
+  if (index <= 0) {
+    throw new Error(`${label} must be formatted as name=value`);
+  }
+  const key = value.slice(0, index).trim();
+  const raw = value.slice(index + 1).trim();
+  if (!key || !raw) {
+    throw new Error(`${label} must be formatted as name=value`);
+  }
+  return [key, raw];
+}
+function collectSandboxTemplateUploadSpecs(manifest) {
+  const properties = asPlainRecord(manifest.inputs.schema.properties) ?? {};
+  const specs = /* @__PURE__ */ new Map();
+  for (const [inputName, rawProperty] of Object.entries(properties)) {
+    const property = asPlainRecord(rawProperty);
+    if (!property) continue;
+    const upload = asPlainRecord(
+      property["x-openpond-upload"] ?? property.xOpenPondUpload
+    );
+    if (!upload) continue;
+    const targetPath = typeof upload.targetPath === "string" && upload.targetPath.trim() ? normalizeSandboxUploadTargetPath(upload.targetPath) : "";
+    if (!targetPath) {
+      throw new Error(`${inputName} upload metadata is missing targetPath`);
+    }
+    const multiple = upload.multiple === true || property.type === "array" || asPlainRecord(property.items)?.format === "file";
+    specs.set(inputName, { inputName, multiple, targetPath });
+  }
+  return specs;
+}
+function asPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function normalizeSandboxUploadTargetPath(value) {
+  const normalized = value.trim().replace(/\\/g, "/").replace(/^\/workspace\//, "").replace(/^\.\//, "").replace(/^\/+/, "");
+  if (!normalized || normalized.split("/").some((segment) => segment === ".." || segment === "")) {
+    throw new Error(`invalid upload target path: ${value}`);
+  }
+  if (normalized.split("/").some(isSandboxEnvFileName)) {
+    throw new Error(
+      "sandbox template uploads cannot target .env* files; create sandbox secrets and pass refs with --env-ref"
+    );
+  }
+  return normalized;
+}
+async function expandSandboxTemplateUploadPaths(rawValue, projectPath) {
+  const values = rawValue.split(",").map((item) => item.trim()).filter(Boolean);
+  const paths = (await Promise.all(
+    values.map((value) => expandSandboxTemplateUploadPath(value, projectPath))
+  )).flat();
+  if (paths.length === 0) {
+    throw new Error(`no files matched ${rawValue}`);
+  }
+  return paths;
+}
+async function expandSandboxTemplateUploadPath(rawValue, projectPath) {
+  const absolute = path2.resolve(projectPath, rawValue);
+  if (!rawValue.includes("*")) {
+    assertSandboxTemplateUploadPathAllowed(absolute);
+    const stats = await fs.stat(absolute);
+    if (!stats.isFile()) {
+      throw new Error(`upload path is not a file: ${absolute}`);
+    }
+    return [absolute];
+  }
+  const directory = path2.dirname(absolute);
+  const basename = path2.basename(absolute);
+  const regex = globBasenameToRegExp(basename);
+  const entries = await fs.readdir(directory, { withFileTypes: true });
+  const matchingEntries = entries.filter((entry) => entry.isFile() && regex.test(entry.name)).sort((left, right) => left.name.localeCompare(right.name));
+  const blocked = matchingEntries.find(
+    (entry) => isSandboxEnvFileName(entry.name)
+  );
+  if (blocked) {
+    throw new Error(
+      "sandbox template uploads cannot include .env* files; create sandbox secrets and pass refs with --env-ref"
+    );
+  }
+  return matchingEntries.map((entry) => path2.join(directory, entry.name)).sort((left, right) => left.localeCompare(right));
+}
+function assertSandboxTemplateUploadPathAllowed(localPath) {
+  if (isSandboxEnvFileName(path2.basename(localPath))) {
+    throw new Error(
+      "sandbox template uploads cannot include .env* files; create sandbox secrets and pass refs with --env-ref"
+    );
+  }
+}
+function isSandboxEnvFileName(name) {
+  return name === ".env" || name.startsWith(".env.");
+}
+function globBasenameToRegExp(pattern) {
+  const escaped = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`);
+}
+async function runSandboxTemplateSetupCommands(client, sandboxId, manifest, options) {
+  const timeoutSeconds = parseIntegerOption(options.setupTimeoutSeconds, "setup-timeout-seconds") ?? 900;
+  const results = [];
+  for (const command of manifest.setup.commands) {
+    const result = await runSandboxTemplateShellCommand(
+      client,
+      sandboxId,
+      command,
+      timeoutSeconds
+    );
+    results.push({
+      command,
+      status: result.status,
+      exitCode: result.exitCode
+    });
+    if (result.status !== "succeeded" || result.exitCode !== 0) {
+      throw new Error(`setup command failed: ${command}
+${result.output}`);
+    }
+  }
+  return results;
+}
+async function uploadSandboxTemplateStartFiles(client, sandboxId, requests) {
+  const uploaded = [];
+  for (const request of requests) {
+    for (const localPath of request.localPaths) {
+      const contents = await fs.readFile(localPath);
+      const sandboxPath = joinSandboxUploadPath(
+        request.spec.targetPath,
+        path2.basename(localPath)
+      );
+      await client.uploadFileBase64(
+        sandboxId,
+        sandboxPath,
+        contents.toString("base64")
+      );
+      uploaded.push({
+        inputName: request.inputName,
+        localPath,
+        sandboxPath,
+        sizeBytes: contents.byteLength
+      });
+    }
+  }
+  return uploaded;
+}
+function joinSandboxUploadPath(targetPath, basename) {
+  return `${targetPath.replace(/\/+$/, "")}/${basename.replace(/^\/+/, "")}`;
+}
+function formatUploadedFileParams(uploadedFiles, requests) {
+  const out = {};
+  for (const request of requests) {
+    const files = uploadedFiles.filter((file) => file.inputName === request.inputName).map((file) => file.sandboxPath);
+    out[request.inputName] = request.spec.multiple ? files : files[0] ?? "";
+  }
+  return out;
+}
+async function runSandboxTemplateExecutable(client, sandboxId, executable, input2, env = {}) {
+  await uploadSandboxTemplateReplayParams(client, sandboxId, input2);
+  const command = formatSandboxTemplateCommand(executable, env);
+  const timeoutSeconds = executable.timeoutSeconds;
+  if (executable.kind === "service") {
+    const result2 = await client.startProcess(sandboxId, {
+      command,
+      ...timeoutSeconds !== void 0 ? { timeoutSeconds } : {}
+    });
+    return { kind: "service", process: result2.process };
+  }
+  const result = await runSandboxTemplateProcessToCompletion(
+    client,
+    sandboxId,
+    command,
+    timeoutSeconds ?? 900
+  );
+  if (result.status !== "succeeded" || result.exitCode !== 0) {
+    throw new Error(
+      `template command failed: ${executable.name}
+${result.output}`
+    );
+  }
+  return { kind: executable.kind, process: result };
+}
+async function runSandboxTemplateShellCommand(client, sandboxId, command, timeoutSeconds) {
+  return runSandboxTemplateProcessToCompletion(
+    client,
+    sandboxId,
+    command,
+    timeoutSeconds ?? 900
+  );
+}
+async function uploadSandboxTemplateReplayParams(client, sandboxId, input2) {
+  const paramsJson = `${JSON.stringify({ input: input2 }, null, 2)}
+`;
+  await client.uploadFileBase64(
+    sandboxId,
+    "openpond-replay-params.json",
+    Buffer.from(paramsJson, "utf8").toString("base64")
+  );
+}
+async function runSandboxTemplateProcessToCompletion(client, sandboxId, command, timeoutSeconds) {
+  const started = await client.startProcess(sandboxId, {
+    command,
+    timeoutSeconds
+  });
+  let current = started.process;
+  const deadline = Date.now() + timeoutSeconds * 1e3 + 3e4;
+  while (current.status === "running" && Date.now() < deadline) {
+    await sleep(3e3);
+    const polled = await client.getProcess(sandboxId, current.id);
+    current = polled.process;
+  }
+  return {
+    command: current.command,
+    status: current.status,
+    output: current.output,
+    exitCode: current.exitCode,
+    processId: current.id
+  };
+}
+function sandboxTemplateRuntimeEnv(sandbox) {
+  return {
+    OPENPOND_SANDBOX_ID: sandbox.id,
+    ...sandbox.runtimeId ? { OPENPOND_SANDBOX_RUNTIME_ID: sandbox.runtimeId } : {}
+  };
+}
+function formatSandboxTemplateCommand(executable, env = {}) {
+  const paramsPath = quoteShellArg(replayParamsPathForExecutable(executable));
+  const envPrefix = `OPENPOND_REPLAY_PARAMS_BASE64="$(base64 -w0 ${paramsPath} 2>/dev/null || base64 ${paramsPath} | tr -d '\\n')"`;
+  const runtimeEnvPrefix = Object.entries(env).filter(([, value]) => value.length > 0).map(([name, value]) => `${name}=${quoteShellArg(value)}`).join(" ");
+  const command = [runtimeEnvPrefix, envPrefix, executable.command].filter(Boolean).join(" ");
+  if (!executable.cwd) return command;
+  return `cd ${quoteShellArg(executable.cwd)} && ${command}`;
+}
+function replayParamsPathForExecutable(executable) {
+  if (!executable.cwd) return "openpond-replay-params.json";
+  const cwd = executable.cwd.replace(/\\/g, "/").replace(/\/+$/, "") || ".";
+  return path2.posix.relative(cwd, "openpond-replay-params.json") || "openpond-replay-params.json";
+}
+function quoteShellArg(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+async function openSandboxTemplatePorts(client, sandboxId, ports) {
+  const previews = [];
+  for (const port of ports) {
+    const result = await client.openPort(sandboxId, {
+      port: port.port,
+      ...port.label ? { label: port.label } : {},
+      access: port.access,
+      autoStart: false
+    });
+    previews.push(result.preview);
+  }
+  return previews;
+}
+function resolveSandboxTemplateFilePath(options) {
+  const rawFile = typeof options.file === "string" && options.file.trim().length > 0 ? options.file.trim() : typeof options.manifest === "string" && options.manifest.trim().length > 0 ? options.manifest.trim() : OPENPOND_MANIFEST_FILE_NAME;
+  return path2.resolve(process.cwd(), rawFile);
+}
+function resolveSandboxTemplateScaffoldPath(options) {
+  const rawPath = typeof options.path === "string" && options.path.trim().length > 0 ? options.path.trim() : typeof options.dir === "string" && options.dir.trim().length > 0 ? options.dir.trim() : process.cwd();
+  return path2.resolve(process.cwd(), rawPath);
+}
+
+// src/cli/sandbox-template-local.ts
+async function runSandboxTemplateLocal(options, mode) {
+  const { plan, filePath, projectPath } = await loadSandboxTemplateBuildPlan(
+    options
+  );
+  const executable = resolveSandboxTemplateLocalExecutable(
+    plan.manifest,
+    options,
+    mode
+  );
+  const input2 = await resolveSandboxTemplateStartInput(
+    plan.manifest,
+    options,
+    projectPath
+  );
+  const volumes = await prepareLocalSandboxTemplateVolumes(
+    plan.manifest,
+    projectPath
+  );
+  const setupCommands = await runLocalSandboxTemplateSetupCommands(
+    plan.manifest,
+    projectPath,
+    options
+  );
+  const uploadedFiles = await prepareLocalSandboxTemplateUploads(
+    input2.uploadRequests,
+    projectPath
+  );
+  const commandInput = {
+    ...input2.scalars,
+    ...formatUploadedFileParams(uploadedFiles, input2.uploadRequests)
+  };
+  const replay = await writeLocalSandboxTemplateReplayParams(
+    projectPath,
+    executable,
+    commandInput
+  );
+  const previews = localSandboxTemplatePreviews(executable);
+  if (mode === "dev" || executable.kind === "service") {
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          mode,
+          file: filePath,
+          template: plan.manifest.name,
+          executable: summarizeSandboxTemplateExecutable(executable),
+          volumes,
+          setupCommands,
+          uploadedFiles,
+          input: commandInput,
+          replayParamsPath: replay.paramsPath,
+          previews,
+          status: "starting"
+        },
+        null,
+        2
+      )
+    );
+    const result = await runLocalSandboxTemplateCommand(
+      projectPath,
+      executable,
+      replay,
+      {
+        inherit: true,
+        timeoutSeconds: executable.timeoutSeconds
+      }
+    );
+    if (result.status !== "succeeded") process.exitCode = 1;
+    return;
+  }
+  const execution = await runLocalSandboxTemplateCommand(
+    projectPath,
+    executable,
+    replay,
+    {
+      timeoutSeconds: executable.timeoutSeconds ?? 900
+    }
+  );
+  const artifacts = await collectLocalSandboxTemplateArtifacts(
+    projectPath,
+    executable.artifactPaths
+  );
+  if (execution.status !== "succeeded") process.exitCode = 1;
+  console.log(
+    JSON.stringify(
+      {
+        ok: execution.status === "succeeded",
+        mode,
+        file: filePath,
+        template: plan.manifest.name,
+        executable: summarizeSandboxTemplateExecutable(executable),
+        volumes,
+        setupCommands,
+        uploadedFiles,
+        input: commandInput,
+        replayParamsPath: replay.paramsPath,
+        execution,
+        previews,
+        artifacts
+      },
+      null,
+      2
+    )
+  );
+}
+async function runSandboxTemplateExistingSandboxAction(options, rest) {
+  const sandboxId = rest[0]?.trim() || (typeof options.sandboxId === "string" ? options.sandboxId.trim() : "");
+  const actionName = rest[1]?.trim() || (typeof options.action === "string" ? options.action.trim() : "") || (typeof options.target === "string" ? options.target.trim() : "");
+  if (!sandboxId || !actionName) {
+    throw new Error(
+      `usage: sandbox-template action <sandboxId> <actionName> [--file ${OPENPOND_MANIFEST_FILE_NAME}]`
+    );
+  }
+  const { plan, filePath, projectPath } = await loadSandboxTemplateBuildPlan(
+    options
+  );
+  const executable = resolveSandboxTemplateActionExecutable(
+    plan.manifest,
+    actionName
+  );
+  const input2 = await resolveSandboxTemplateStartInput(
+    plan.manifest,
+    options,
+    projectPath
+  );
+  const client = await resolveSandboxClient(options);
+  const uploadedFiles = await uploadSandboxTemplateStartFiles(
+    client,
+    sandboxId,
+    input2.uploadRequests
+  );
+  const commandInput = {
+    ...input2.scalars,
+    ...formatUploadedFileParams(uploadedFiles, input2.uploadRequests)
+  };
+  const execution = await runSandboxTemplateExecutable(
+    client,
+    sandboxId,
+    executable,
+    commandInput
+  );
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        file: filePath,
+        sandboxId,
+        executable: summarizeSandboxTemplateExecutable(executable),
+        uploadedFiles,
+        input: commandInput,
+        execution,
+        expectedArtifacts: executable.artifactPaths
+      },
+      null,
+      2
+    )
+  );
+}
+function resolveSandboxTemplateLocalExecutable(manifest, options, mode) {
+  if (mode === "dev" && typeof options.target !== "string" && typeof options.action !== "string" && typeof options.service !== "string" && typeof options.entrypoint !== "string") {
+    const firstService = sandboxTemplateExecutableEntries(manifest).find(
+      (candidate) => candidate.kind === "service"
+    );
+    if (firstService) return firstService;
+  }
+  return resolveSandboxTemplateStartExecutable(manifest, options);
+}
+function resolveSandboxTemplateActionExecutable(manifest, actionName) {
+  const match = sandboxTemplateExecutableEntries(manifest).find(
+    (candidate) => candidate.kind === "action" && candidate.name === actionName
+  );
+  if (!match) {
+    const actions = manifest.actions.map((action) => action.name).join(", ") || "(none)";
+    throw new Error(
+      `manifest action not found: ${actionName}. Available actions: ${actions}`
+    );
+  }
+  return match;
+}
+function summarizeSandboxTemplateExecutable(executable) {
+  return {
+    kind: executable.kind,
+    name: executable.name,
+    command: executable.command,
+    cwd: executable.cwd ?? null,
+    timeoutSeconds: executable.timeoutSeconds ?? null,
+    ports: executable.ports,
+    artifactPaths: executable.artifactPaths
+  };
+}
+async function prepareLocalSandboxTemplateVolumes(manifest, projectPath) {
+  const volumes = [];
+  for (const volume of manifest.volumes) {
+    const mountPath = typeof volume.mountPath === "string" && volume.mountPath.trim() ? volume.mountPath.trim() : volume.name ? `/workspace/volumes/${volume.name}` : "";
+    if (!mountPath) continue;
+    const localPath = path3.resolve(
+      projectPath,
+      normalizeLocalWorkspacePath(mountPath)
+    );
+    await fs2.mkdir(localPath, { recursive: true });
+    volumes.push({
+      name: volume.name ?? null,
+      mountPath,
+      localPath
+    });
+  }
+  return volumes;
+}
+async function runLocalSandboxTemplateSetupCommands(manifest, projectPath, options) {
+  const timeoutSeconds = parseIntegerOption(options.setupTimeoutSeconds, "setup-timeout-seconds") ?? 900;
+  const results = [];
+  for (const command of manifest.setup.commands) {
+    const result = await runLocalShellCommandResult(command, projectPath, {
+      timeoutSeconds
+    });
+    results.push(result);
+    if (result.status !== "succeeded") {
+      throw new Error(
+        `local setup command failed: ${command}
+${result.output}`
+      );
+    }
+  }
+  return results;
+}
+async function prepareLocalSandboxTemplateUploads(requests, projectPath) {
+  const uploaded = [];
+  for (const request of requests) {
+    for (const localPath of request.localPaths) {
+      const contents = await fs2.readFile(localPath);
+      const sandboxPath = joinSandboxUploadPath(
+        request.spec.targetPath,
+        path3.basename(localPath)
+      );
+      const destination = path3.resolve(
+        projectPath,
+        normalizeLocalWorkspacePath(sandboxPath)
+      );
+      await fs2.mkdir(path3.dirname(destination), { recursive: true });
+      await fs2.copyFile(localPath, destination);
+      uploaded.push({
+        inputName: request.inputName,
+        localPath,
+        sandboxPath,
+        sizeBytes: contents.byteLength
+      });
+    }
+  }
+  return uploaded;
+}
+async function writeLocalSandboxTemplateReplayParams(projectPath, executable, input2) {
+  const paramsJson = `${JSON.stringify({ input: input2 }, null, 2)}
+`;
+  const encoded = Buffer2.from(paramsJson, "utf8").toString("base64");
+  const paramsPath = path3.join(projectPath, "openpond-replay-params.json");
+  await fs2.writeFile(paramsPath, paramsJson, "utf8");
+  if (executable.cwd) {
+    const cwdParamsPath = path3.join(
+      projectPath,
+      executable.cwd,
+      "openpond-replay-params.json"
+    );
+    if (cwdParamsPath !== paramsPath) {
+      await fs2.mkdir(path3.dirname(cwdParamsPath), { recursive: true });
+      await fs2.writeFile(cwdParamsPath, paramsJson, "utf8");
+    }
+  }
+  return { paramsPath, encoded };
+}
+async function runLocalSandboxTemplateCommand(projectPath, executable, replay, options = {}) {
+  const cwd = executable.cwd ? path3.resolve(projectPath, executable.cwd) : projectPath;
+  return runLocalShellCommandResult(executable.command, cwd, {
+    env: {
+      OPENPOND_REPLAY_PARAMS_BASE64: replay.encoded
+    },
+    timeoutSeconds: options.timeoutSeconds,
+    inherit: options.inherit
+  });
+}
+async function runLocalShellCommandResult(command, cwd, options = {}) {
+  const result = await runShellCommand(command, {
+    cwd,
+    env: options.env,
+    timeoutSeconds: options.timeoutSeconds,
+    inherit: options.inherit
+  });
+  const output = [result.stdout, result.stderr].filter(Boolean).join("");
+  return {
+    command,
+    cwd,
+    status: result.timedOut ? "timed_out" : result.code === 0 ? "succeeded" : "failed",
+    output,
+    exitCode: result.code
+  };
+}
+function localSandboxTemplatePreviews(executable) {
+  return executable.ports.map((port) => ({
+    port: port.port,
+    label: port.label ?? null,
+    access: port.access,
+    url: `http://127.0.0.1:${port.port}${port.path}`
+  }));
+}
+async function collectLocalSandboxTemplateArtifacts(projectPath, artifactPaths) {
+  const artifacts = [];
+  for (const artifactPath of artifactPaths) {
+    const localPath = path3.resolve(
+      projectPath,
+      normalizeLocalWorkspacePath(artifactPath)
+    );
+    try {
+      const stat = await fs2.stat(localPath);
+      artifacts.push({
+        path: artifactPath,
+        exists: stat.isFile(),
+        sizeBytes: stat.size
+      });
+    } catch {
+      artifacts.push({ path: artifactPath, exists: false, sizeBytes: null });
+    }
+  }
+  return artifacts;
+}
+function normalizeLocalWorkspacePath(value) {
+  const normalized = value.trim().replace(/\\/g, "/").replace(/^\/workspace\//, "").replace(/^workspace\//, "").replace(/^\.\//, "").replace(/^\/+/, "");
+  if (!normalized || normalized.split("/").some((segment) => segment === ".." || segment === "")) {
+    throw new Error(`invalid workspace path: ${value}`);
+  }
+  return normalized;
+}
+
+// src/cli/sandbox-template.ts
+async function runSandboxTemplateCommand(options, rest) {
+  const subcommand = rest[0] || "validate";
+  if (subcommand === "validate") {
+    const filePath = resolveSandboxTemplateFilePath(options);
+    const source = await fs3.readFile(filePath, "utf8");
+    const result = validateSandboxTemplateYaml(source);
+    if (!result.ok) {
+      console.error(formatSandboxTemplateDiagnostics(result.diagnostics));
+      process.exitCode = 1;
+      return;
+    }
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          file: filePath,
+          name: result.manifest.name,
+          version: result.manifest.version,
+          start: result.manifest.start.command,
+          actions: result.manifest.actions.map((action) => action.name),
+          services: result.manifest.services.map((service) => service.name),
+          schedules: result.manifest.schedules.map((schedule) => schedule.name)
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (subcommand === "print-schema") {
+    console.log(JSON.stringify(sandboxTemplateJsonSchema(), null, 2));
+    return;
+  }
+  if (subcommand === "scaffold") {
+    const outputPath = resolveSandboxTemplateScaffoldPath(options);
+    const rawName = typeof options.name === "string" && options.name.trim().length > 0 ? options.name.trim() : path4.basename(outputPath);
+    const description = typeof options.description === "string" && options.description.trim().length > 0 ? options.description.trim() : void 0;
+    const files = sandboxTemplateScaffoldFiles({ name: rawName, description });
+    const manifestPath = path4.join(outputPath, OPENPOND_MANIFEST_FILE_NAME);
+    if (existsSync2(manifestPath)) {
+      throw new Error(
+        `${OPENPOND_MANIFEST_FILE_NAME} already exists at ${manifestPath}`
+      );
+    }
+    await fs3.mkdir(outputPath, { recursive: true });
+    for (const [relativePath, contents] of Object.entries(files)) {
+      const filePath = path4.join(outputPath, relativePath);
+      await fs3.mkdir(path4.dirname(filePath), { recursive: true });
+      await fs3.writeFile(filePath, contents, "utf8");
+    }
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          path: outputPath,
+          files: Object.keys(files).sort(
+            (left, right) => left.localeCompare(right)
+          )
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (subcommand === "build") {
+    await runSandboxTemplateBuild(options);
+    return;
+  }
+  if (subcommand === "run") {
+    await runSandboxTemplateLocal(options, "run");
+    return;
+  }
+  if (subcommand === "dev") {
+    await runSandboxTemplateLocal(options, "dev");
+    return;
+  }
+  if (subcommand === "action") {
+    await runSandboxTemplateExistingSandboxAction(options, rest.slice(1));
+    return;
+  }
+  if (subcommand === "start") {
+    await runSandboxTemplateStart(options);
+    return;
+  }
+  throw new Error(
+    `usage: sandbox-template <validate|print-schema|scaffold|build|run|dev|start|action> [--file ${OPENPOND_MANIFEST_FILE_NAME}] [--path <dir>] [--name <name>]`
+  );
+}
+async function runSandboxTemplateBuild(options) {
+  const context = await loadSandboxTemplateManifestContext(options);
+  const outputPath = resolveSandboxTemplateBuildOutputPath(
+    options,
+    context.projectPath
+  );
+  const plan = sandboxTemplateBuildPlan({
+    manifest: context.manifest,
+    manifestFile: path4.relative(context.projectPath, context.filePath) || OPENPOND_MANIFEST_FILE_NAME,
+    projectRoot: path4.relative(path4.dirname(outputPath), context.projectPath) || "."
+  });
+  const shouldWrite = !parseBooleanOption(options.noWrite);
+  if (shouldWrite) {
+    await fs3.mkdir(path4.dirname(outputPath), { recursive: true });
+    await fs3.writeFile(
+      outputPath,
+      `${JSON.stringify(plan, null, 2)}
+`,
+      "utf8"
+    );
+  }
+  const metadata = sandboxTemplateBuildMetadata(context.manifest);
+  const executables = sandboxTemplateExecutableEntries(context.manifest);
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        file: context.filePath,
+        output: shouldWrite ? outputPath : null,
+        ...metadata,
+        startCommand: executables[0]?.command ?? null,
+        plan
+      },
+      null,
+      2
+    )
+  );
+}
+async function loadSandboxTemplateManifestContext(options) {
+  const filePath = resolveSandboxTemplateFilePath(options);
+  const source = await fs3.readFile(filePath, "utf8");
+  const result = validateSandboxTemplateYaml(source);
+  if (!result.ok) {
+    process.exitCode = 1;
+    throw new Error(formatSandboxTemplateDiagnostics(result.diagnostics));
+  }
+  return {
+    filePath,
+    projectPath: path4.dirname(filePath),
+    manifest: result.manifest
+  };
+}
+function resolveSandboxTemplateBuildOutputPath(options, projectPath) {
+  const rawOutput = typeof options.output === "string" && options.output.trim() ? options.output.trim() : typeof options.out === "string" && options.out.trim() ? options.out.trim() : "";
+  if (rawOutput) return path4.resolve(process.cwd(), rawOutput);
+  const rawOutputDir = typeof options.outputDir === "string" && options.outputDir.trim() ? options.outputDir.trim() : typeof options.outDir === "string" && options.outDir.trim() ? options.outDir.trim() : "dist";
+  return path4.resolve(
+    projectPath,
+    rawOutputDir,
+    SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME
+  );
+}
+async function loadSandboxTemplateBuildPlan(options) {
+  const rawBuild = typeof options.build === "string" && options.build.trim() ? options.build.trim() : typeof options.plan === "string" && options.plan.trim() ? options.plan.trim() : "";
+  if (rawBuild) {
+    const filePath = path4.resolve(process.cwd(), rawBuild);
+    const parsed = JSON.parse(
+      await fs3.readFile(filePath, "utf8")
+    );
+    if (parsed.kind !== SANDBOX_TEMPLATE_BUILD_PLAN_KIND || parsed.schemaVersion !== 1) {
+      throw new Error(`invalid sandbox template build plan: ${filePath}`);
+    }
+    return {
+      plan: parsed,
+      filePath,
+      projectPath: path4.resolve(path4.dirname(filePath), parsed.projectRoot)
+    };
+  }
+  const context = await loadSandboxTemplateManifestContext(options);
+  return {
+    plan: sandboxTemplateBuildPlan({
+      manifest: context.manifest,
+      manifestFile: path4.relative(context.projectPath, context.filePath) || OPENPOND_MANIFEST_FILE_NAME,
+      projectRoot: context.projectPath
+    }),
+    filePath: context.filePath,
+    projectPath: context.projectPath
+  };
+}
+export {
+  loadSandboxTemplateBuildPlan,
+  loadSandboxTemplateManifestContext,
+  resolveSandboxTemplateBuildOutputPath,
+  runSandboxTemplateBuild,
+  runSandboxTemplateCommand
+};