openpond 0.1.1 → 0.2.1

package/dist/chunks/sandbox-template-S4WRUWJ6.js

@@ -1,1653 +0,0 @@
-import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
-import {
-  createSandboxFromPlan,
-  summarizeSandbox
-} from "./chunk-DNXBJZAU.js";
-import {
-  resolveGitBranch
-} from "./chunk-CNTM26OW.js";
-import {
-  OPENPOND_MANIFEST_FILE_NAME,
-  SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME,
-  SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
-  formatSandboxTemplateDiagnostics,
-  sandboxTemplateBuildMetadata,
-  sandboxTemplateBuildPlan,
-  sandboxTemplateExecutableEntries,
-  sandboxTemplateJsonSchema,
-  sandboxTemplateScaffoldFiles,
-  validateSandboxTemplateYaml
-} from "./chunk-YVCYVDNP.js";
-import "./chunk-X7ZG4TSW.js";
-import {
-  ensureApiKey,
-  formatTokenizedRepoUrl,
-  getGitRemoteUrl,
-  parseSandboxRuntimePromotionPolicyOption,
-  parseSandboxTemplateEnvOptions,
-  parseSandboxWorkflowModeOption,
-  promptConfirm,
-  redactToken,
-  resolveRepoUrl,
-  resolveSandboxClient,
-  runCommand,
-  runShellCommand,
-  warnOnRepoHostMismatch
-} from "./chunk-HFPUR4CQ.js";
-import "./chunk-2JABRRNR.js";
-import {
-  resolveBaseUrl,
-  resolvePublicApiBaseUrl
-} from "./chunk-SMNFI2FU.js";
-import "./chunk-N3TGCM7J.js";
-import "./chunk-4L3ZJS2T.js";
-import "./chunk-JTHL5XJ2.js";
-import {
-  createRepo,
-  loadConfig
-} from "./chunk-D7BO5Y5J.js";
-import "./chunk-KSRWKXRB.js";
-import "./chunk-FQS2QL5F.js";
-import {
-  parseBooleanOption,
-  parseIntegerOption,
-  parseJsonOption
-} from "./chunk-MUMPWI4O.js";
-import "./chunk-UACZUFIA.js";
-
-// src/cli/sandbox-template.ts
-import { promises as fs3, existsSync as existsSync2 } from "node:fs";
-import path4 from "node:path";
-
-// src/cli/sandbox-template-local.ts
-import { Buffer as Buffer2 } from "node:buffer";
-import { promises as fs2 } from "node:fs";
-import path3 from "node:path";
-
-// src/cli/sandbox-template-start.ts
-import { Buffer } from "node:buffer";
-import { promises as fs } from "node:fs";
-import path2 from "node:path";
-
-// src/cli/sandbox-template-schedules.ts
-async function createSandboxTemplateStartSchedules(client, sandboxId, manifest, options) {
-  const selection = resolveSandboxTemplateStartScheduleSelection(
-    manifest,
-    options
-  );
-  if (!selection) {
-    return [];
-  }
-  const overrides = parseSandboxTemplateScheduleOverrides(manifest, options);
-  const projectId = typeof options.projectId === "string" && options.projectId.trim() ? options.projectId.trim() : typeof options.runtimeProjectId === "string" ? options.runtimeProjectId.trim() : "";
-  const teamId = typeof options.teamId === "string" ? options.teamId.trim() : "";
-  const created = [];
-  for (const schedule of selection.schedules) {
-    const input2 = buildSandboxTemplateStartScheduleInput({
-      manifest,
-      schedule,
-      override: overrides.get(schedule.name),
-      mode: selection.mode,
-      sourceSandboxId: sandboxId,
-      teamId,
-      projectId
-    });
-    const result = await client.createSchedule(input2);
-    created.push({
-      id: result.schedule.id,
-      name: result.schedule.name,
-      enabled: result.schedule.enabled,
-      scheduleType: result.schedule.scheduleType,
-      scheduleExpression: result.schedule.scheduleExpression,
-      syncStatus: result.schedule.syncStatus,
-      awsScheduleArn: result.schedule.awsScheduleArn ?? null,
-      target: result.schedule.target
-    });
-  }
-  return created;
-}
-function resolveSandboxTemplateStartScheduleSelection(manifest, options) {
-  const enableRaw = options.enableSchedules ?? options.enableSchedule;
-  const disableRaw = options.disableSchedules ?? options.disableSchedule;
-  if (enableRaw !== void 0 && disableRaw !== void 0) {
-    throw new Error(
-      "pass only one of --enable-schedules or --disable-schedules"
-    );
-  }
-  let mode = null;
-  let rawSelection;
-  if (enableRaw !== void 0) {
-    mode = "enabled";
-    rawSelection = enableRaw;
-  } else if (disableRaw !== void 0) {
-    mode = "disabled";
-    rawSelection = disableRaw;
-  } else if (options.schedules !== void 0) {
-    rawSelection = options.schedules;
-    const rawMode = typeof options.scheduleMode === "string" ? options.scheduleMode.trim().toLowerCase() : "disabled";
-    if (rawMode === "none") {
-      return null;
-    }
-    if (rawMode !== "enabled" && rawMode !== "disabled") {
-      throw new Error("--schedule-mode must be enabled, disabled, or none");
-    }
-    mode = rawMode;
-  }
-  if (!mode) {
-    return null;
-  }
-  if (manifest.schedules.length === 0) {
-    return { mode, schedules: [] };
-  }
-  const selectedNames = parseSandboxTemplateScheduleNameSelection(
-    rawSelection,
-    manifest
-  );
-  const schedules = selectedNames === null ? manifest.schedules : manifest.schedules.filter(
-    (schedule) => selectedNames.has(schedule.name)
-  );
-  return { mode, schedules };
-}
-function parseSandboxTemplateScheduleNameSelection(value, manifest) {
-  if (value === void 0 || value === true) {
-    return null;
-  }
-  const raw = String(value).trim();
-  if (!raw || raw === "true" || raw.toLowerCase() === "all") {
-    return null;
-  }
-  if (raw.toLowerCase() === "none") {
-    return /* @__PURE__ */ new Set();
-  }
-  const known = new Set(manifest.schedules.map((schedule) => schedule.name));
-  const selected = new Set(
-    raw.split(",").map((item) => item.trim()).filter(Boolean)
-  );
-  for (const name of selected) {
-    if (!known.has(name)) {
-      throw new Error(`manifest schedule not found: ${name}`);
-    }
-  }
-  return selected;
-}
-function parseSandboxTemplateScheduleOverrides(manifest, options) {
-  const raw = typeof options.scheduleOverrides === "string" ? options.scheduleOverrides : typeof options.scheduleOverride === "string" ? options.scheduleOverride : "";
-  if (!raw.trim()) {
-    return /* @__PURE__ */ new Map();
-  }
-  const parsed = parseJsonOption(raw, "schedule-overrides");
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(
-      "schedule-overrides must be a JSON object keyed by schedule name"
-    );
-  }
-  const known = new Set(manifest.schedules.map((schedule) => schedule.name));
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, override] of Object.entries(parsed)) {
-    if (!known.has(name)) {
-      throw new Error(`schedule override target does not exist: ${name}`);
-    }
-    if (!override || typeof override !== "object" || Array.isArray(override)) {
-      throw new Error(`schedule override for ${name} must be an object`);
-    }
-    out.set(name, override);
-  }
-  return out;
-}
-function buildSandboxTemplateStartScheduleInput(params) {
-  const schedule = mergeSandboxTemplateScheduleOverride(
-    params.schedule,
-    params.override
-  );
-  const expression = sandboxTemplateScheduleExpression(schedule);
-  return {
-    sourceSandboxId: params.sourceSandboxId,
-    ...params.teamId ? { teamId: params.teamId } : {},
-    ...params.projectId ? { projectId: params.projectId } : {},
-    name: schedule.name,
-    ...schedule.description ? { description: schedule.description } : {},
-    ...expression,
-    ...schedule.timezone ? { timezone: schedule.timezone } : {},
-    enabled: typeof params.override?.enabled === "boolean" ? params.override.enabled : params.mode === "enabled",
-    ...schedule.startAt ? { startAt: schedule.startAt } : {},
-    ...schedule.endAt ? { endAt: schedule.endAt } : {},
-    ...schedule.maxRuns !== void 0 ? { maxRuns: schedule.maxRuns } : {},
-    runtimePolicy: schedule.runtimePolicy,
-    target: sandboxTemplateScheduleCommandTarget(params.manifest, schedule),
-    ...schedule.budget ? { budget: schedule.budget } : {},
-    ...schedule.resources ? { resources: schedule.resources } : {},
-    ...schedule.quotas ? { quotas: schedule.quotas } : {},
-    ...schedule.lifecycle ? { lifecycle: schedule.lifecycle } : {},
-    ...schedule.retentionPolicy ? { retentionPolicy: schedule.retentionPolicy } : {},
-    ...schedule.env ? { env: schedule.env } : {},
-    ...schedule.integrationLeases ? {
-      integrationLeases: schedule.integrationLeases
-    } : {},
-    metadata: {
-      ...schedule.metadata ?? {},
-      manifestScheduleName: schedule.name,
-      source: "openpond-code-sandbox-template-start"
-    },
-    managementSource: "openpond.yaml",
-    manifestPath: OPENPOND_MANIFEST_FILE_NAME
-  };
-}
-function mergeSandboxTemplateScheduleOverride(schedule, override) {
-  if (!override) {
-    return schedule;
-  }
-  return {
-    ...schedule,
-    ...override,
-    target: schedule.target || override.target ? {
-      ...schedule.target ?? {},
-      ...override.target ?? {}
-    } : void 0,
-    metadata: schedule.metadata || override.metadata ? {
-      ...schedule.metadata ?? {},
-      ...override.metadata ?? {}
-    } : void 0
-  };
-}
-function sandboxTemplateScheduleExpression(schedule) {
-  if (schedule.scheduleExpression) {
-    return {
-      scheduleType: schedule.scheduleType ?? "cron",
-      scheduleExpression: schedule.scheduleExpression
-    };
-  }
-  if (schedule.rate) {
-    return {
-      scheduleType: "rate",
-      scheduleExpression: /^rate\(/i.test(schedule.rate) ? schedule.rate : `rate(${schedule.rate})`
-    };
-  }
-  if (schedule.once) {
-    return {
-      scheduleType: "once",
-      scheduleExpression: /^at\(/i.test(schedule.once) ? schedule.once : `at(${schedule.once})`
-    };
-  }
-  return {
-    scheduleType: "cron",
-    scheduleExpression: schedule.cron ?? ""
-  };
-}
-function sandboxTemplateScheduleCommandTarget(manifest, schedule) {
-  const explicitCommand = schedule.command ?? schedule.target?.command ?? null;
-  if (explicitCommand) {
-    return {
-      kind: "command",
-      command: explicitCommand,
-      requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? false
-    };
-  }
-  const targetKind = schedule.target?.kind ?? "action";
-  if (targetKind === "start") {
-    return {
-      kind: "command",
-      command: manifest.start.command,
-      requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? manifest.start.requiresStart ?? false
-    };
-  }
-  if (targetKind === "service") {
-    const serviceName = schedule.target?.name ?? "";
-    const service = manifest.services.find((item) => item.name === serviceName);
-    if (!service) {
-      throw new Error(`schedule service target does not exist: ${serviceName}`);
-    }
-    return {
-      kind: "command",
-      command: service.command,
-      requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? service.requiresStart ?? false
-    };
-  }
-  const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? schedule.target?.name : void 0);
-  const action = manifest.actions.find((item) => item.name === actionName);
-  if (!action) {
-    throw new Error(
-      `schedule action target does not exist: ${actionName ?? ""}`
-    );
-  }
-  return {
-    kind: "command",
-    command: action.command,
-    requiresStart: schedule.requiresStart ?? schedule.target?.requiresStart ?? action.requiresStart ?? false
-  };
-}
-
-// src/cli/sandbox-template-git.ts
-import { existsSync } from "node:fs";
-import path from "node:path";
-import { stdin as input } from "node:process";
-async function resolveSandboxTemplateStartRepo(manifest, options, projectPath) {
-  const explicitRepo = typeof options.repo === "string" ? options.repo.trim() : "";
-  if (explicitRepo) {
-    return normalizeSandboxTemplateRepoUrl(explicitRepo);
-  }
-  await ensureGitRepository(projectPath);
-  const config = await loadConfig();
-  const uiBase = resolveBaseUrl(config);
-  const apiBase = resolvePublicApiBaseUrl(config);
-  const apiKey = await ensureApiKey(config, uiBase);
-  let originUrl = await getGitRemoteUrl(projectPath, "origin");
-  if (!originUrl) {
-    const teamId = typeof options.teamId === "string" ? options.teamId.trim() : "";
-    const response = await createRepo(apiBase, apiKey, {
-      name: manifest.name,
-      description: manifest.description,
-      repoInit: "empty",
-      ...teamId ? { teamId } : {}
-    });
-    originUrl = resolveRepoUrl(response);
-    const remoteResult = await runCommand(
-      "git",
-      ["remote", "add", "origin", originUrl],
-      {
-        cwd: projectPath
-      }
-    );
-    if (remoteResult.code !== 0) {
-      throw new Error(
-        `git remote add failed: ${remoteResult.stderr.trim() || remoteResult.stdout.trim() || "unknown error"}`
-      );
-    }
-  }
-  warnOnRepoHostMismatch(originUrl);
-  await ensureGitCommitForSandboxTemplateStart(projectPath, options);
-  if (!parseBooleanOption(options.noPush)) {
-    const branch = await resolveSandboxTemplateStartBranch(
-      projectPath,
-      options
-    );
-    await pushGitBranchForSandboxTemplateStart(
-      projectPath,
-      originUrl,
-      branch,
-      apiKey,
-      options
-    );
-  }
-  return normalizeSandboxTemplateRepoUrl(originUrl);
-}
-async function ensureGitRepository(projectPath) {
-  const gitDir = path.join(projectPath, ".git");
-  if (existsSync(gitDir)) return;
-  const result = await runCommand("git", ["init"], { cwd: projectPath });
-  if (result.code !== 0) {
-    throw new Error(
-      `git init failed: ${result.stderr.trim() || result.stdout.trim() || "unknown error"}`
-    );
-  }
-}
-async function ensureGitCommitForSandboxTemplateStart(projectPath, options) {
-  const status = await runCommand("git", ["status", "--porcelain"], {
-    cwd: projectPath
-  });
-  if (status.code !== 0) {
-    throw new Error(
-      `git status failed: ${status.stderr.trim() || status.stdout.trim() || "unknown error"}`
-    );
-  }
-  const head = await runCommand("git", ["rev-parse", "--verify", "HEAD"], {
-    cwd: projectPath
-  });
-  const hasHead = head.code === 0;
-  const dirty = status.stdout.trim().length > 0;
-  if (!dirty && hasHead) return;
-  const shouldCommit = parseBooleanOption(options.commit) || parseBooleanOption(options.yes) || (input.isTTY ? await promptConfirm(
-    hasHead ? "Commit local changes before starting the sandbox?" : "Create the initial git commit before starting the sandbox?",
-    !hasHead
-  ) : false);
-  if (!shouldCommit) {
-    if (!hasHead) {
-      throw new Error(
-        "local repository has no commits; pass --commit or commit before starting"
-      );
-    }
-    if (dirty) {
-      console.warn(
-        "warning: uncommitted local changes will not be included in the sandbox"
-      );
-    }
-    return;
-  }
-  const add = await runCommand("git", ["add", "-A"], { cwd: projectPath });
-  if (add.code !== 0) {
-    throw new Error(
-      `git add failed: ${add.stderr.trim() || add.stdout.trim() || "unknown error"}`
-    );
-  }
-  const message = typeof options.commitMessage === "string" && options.commitMessage.trim() ? options.commitMessage.trim() : `start ${OPENPOND_MANIFEST_FILE_NAME} sandbox`;
-  const commit = await runCommand("git", ["commit", "-m", message], {
-    cwd: projectPath
-  });
-  if (commit.code !== 0) {
-    const output = commit.stderr.trim() || commit.stdout.trim();
-    if (output.includes("nothing to commit") && hasHead) return;
-    throw new Error(`git commit failed: ${output || "unknown error"}`);
-  }
-}
-async function resolveSandboxTemplateStartBranch(projectPath, options) {
-  const branchOption = typeof options.branch === "string" ? options.branch.trim() : "";
-  const branch = branchOption || await resolveGitBranch(projectPath);
-  if (!branch) {
-    throw new Error("unable to resolve git branch; pass --branch");
-  }
-  return branch;
-}
-async function pushGitBranchForSandboxTemplateStart(projectPath, originUrl, branch, apiKey, options) {
-  let tokenRemote;
-  try {
-    tokenRemote = formatTokenizedRepoUrl(originUrl, apiKey);
-  } catch {
-    throw new Error("origin remote must be https for tokenized pushes");
-  }
-  const keepTokenRemote = parseBooleanOption(options.keepTokenRemote) || parseBooleanOption(options.token) || parseBooleanOption(options.setRemoteToken);
-  const alreadyTokenized = originUrl.includes("x-access-token:");
-  const restoreUrl = !keepTokenRemote && !alreadyTokenized ? originUrl : null;
-  const previousPrompt = process.env.GIT_TERMINAL_PROMPT;
-  process.env.GIT_TERMINAL_PROMPT = "0";
-  try {
-    if (!alreadyTokenized) {
-      const setResult = await runCommand(
-        "git",
-        ["remote", "set-url", "origin", tokenRemote],
-        {
-          cwd: projectPath
-        }
-      );
-      if (setResult.code !== 0) {
-        throw new Error(
-          `git remote set-url failed: ${redactToken(
-            setResult.stderr.trim() || setResult.stdout.trim() || "unknown error"
-          )}`
-        );
-      }
-    }
-    const push = await runCommand("git", ["push", "-u", "origin", branch], {
-      cwd: projectPath,
-      inherit: true
-    });
-    if (push.code !== 0) {
-      throw new Error("git push failed");
-    }
-  } finally {
-    if (restoreUrl) {
-      await runCommand("git", ["remote", "set-url", "origin", restoreUrl], {
-        cwd: projectPath
-      }).catch(() => null);
-    }
-    if (previousPrompt === void 0) {
-      delete process.env.GIT_TERMINAL_PROMPT;
-    } else {
-      process.env.GIT_TERMINAL_PROMPT = previousPrompt;
-    }
-  }
-}
-function normalizeSandboxTemplateRepoIdentity(repoUrl) {
-  return normalizeSandboxTemplateRepoUrl(repoUrl).replace(/\.git$/, "");
-}
-function normalizeSandboxTemplateRepoUrl(repoUrl) {
-  const parsed = new URL(repoUrl);
-  parsed.username = "";
-  parsed.password = "";
-  const text = parsed.toString();
-  return text.endsWith(".git") ? text : `${text.replace(/\/$/, "")}.git`;
-}
-
-// src/cli/sandbox-template-start.ts
-async function runSandboxTemplateStart(options) {
-  const filePath = resolveSandboxTemplateFilePath(options);
-  const projectPath = path2.dirname(filePath);
-  const source = await fs.readFile(filePath, "utf8");
-  const result = validateSandboxTemplateYaml(source);
-  if (!result.ok) {
-    console.error(formatSandboxTemplateDiagnostics(result.diagnostics));
-    process.exitCode = 1;
-    return;
-  }
-  const manifest = result.manifest;
-  const executable = resolveSandboxTemplateStartExecutable(manifest, options);
-  const input2 = await resolveSandboxTemplateStartInput(
-    manifest,
-    options,
-    projectPath
-  );
-  const repo = await resolveSandboxTemplateStartRepo(
-    manifest,
-    options,
-    projectPath
-  );
-  const client = await resolveSandboxClient(options);
-  const createInput = buildSandboxTemplateStartCreateInput(
-    manifest,
-    options,
-    repo
-  );
-  const sandbox = await createSandboxTemplateStartSandbox(
-    client,
-    createInput,
-    repo
-  );
-  await waitForSandboxTemplateRunnerReady(client, sandbox.id);
-  const setupCommands = await runSandboxTemplateSetupCommands(
-    client,
-    sandbox.id,
-    manifest,
-    options
-  );
-  const uploadedFiles = await uploadSandboxTemplateStartFiles(
-    client,
-    sandbox.id,
-    input2.uploadRequests
-  );
-  const commandInput = {
-    ...input2.scalars,
-    ...formatUploadedFileParams(uploadedFiles, input2.uploadRequests)
-  };
-  const execution = await runSandboxTemplateExecutable(
-    client,
-    sandbox.id,
-    executable,
-    commandInput,
-    sandboxTemplateRuntimeEnv(sandbox)
-  );
-  const previews = await openSandboxTemplatePorts(
-    client,
-    sandbox.id,
-    executable.ports
-  );
-  const schedules = await createSandboxTemplateStartSchedules(
-    client,
-    sandbox.id,
-    manifest,
-    options
-  );
-  console.log(
-    JSON.stringify(
-      {
-        ok: true,
-        file: filePath,
-        repo,
-        executable: {
-          kind: executable.kind,
-          name: executable.name,
-          command: executable.command
-        },
-        sandbox: summarizeSandbox(sandbox),
-        setupCommands,
-        uploadedFiles,
-        input: commandInput,
-        execution,
-        previews,
-        schedules,
-        expectedArtifacts: executable.artifactPaths
-      },
-      null,
-      2
-    )
-  );
-}
-function resolveSandboxTemplateStartExecutable(manifest, options) {
-  const executables = sandboxTemplateExecutableEntries(manifest);
-  const action = typeof options.action === "string" ? options.action.trim() : "";
-  const service = typeof options.service === "string" ? options.service.trim() : "";
-  const target = typeof options.target === "string" ? options.target.trim() : "";
-  const entrypoint = typeof options.entrypoint === "string" ? options.entrypoint.trim() : "";
-  const requested = action || service || target || entrypoint || "start";
-  const kind = action ? "action" : service ? "service" : "";
-  const match = executables.find(
-    (candidate) => candidate.name === requested && (!kind || candidate.kind === kind)
-  );
-  if (!match) {
-    throw new Error(
-      `manifest executable not found: ${requested}. Available: ${executables.map((candidate) => `${candidate.kind}:${candidate.name}`).join(", ")}`
-    );
-  }
-  return match;
-}
-function buildSandboxTemplateStartCreateInput(manifest, options, repo) {
-  const budgetUsd = typeof options.budgetUsd === "string" && options.budgetUsd.trim() ? options.budgetUsd.trim() : typeof options.budget === "string" && options.budget.trim() ? options.budget.trim() : "0.05";
-  const maxDurationSeconds = parseIntegerOption(
-    options.maxDurationSeconds,
-    "max-duration-seconds"
-  );
-  const idleTimeoutSeconds = parseIntegerOption(
-    options.idleTimeoutSeconds,
-    "idle-timeout-seconds"
-  );
-  const teamId = typeof options.teamId === "string" ? options.teamId.trim() : "";
-  const requestedProjectId = typeof options.projectId === "string" ? options.projectId.trim() : "";
-  const sandboxRuntimeProjectId = typeof options.runtimeProjectId === "string" ? options.runtimeProjectId.trim() : "";
-  if (requestedProjectId && sandboxRuntimeProjectId && requestedProjectId !== sandboxRuntimeProjectId) {
-    throw new Error(
-      "project-id and runtime-project-id must match when both are set"
-    );
-  }
-  const projectId = requestedProjectId || sandboxRuntimeProjectId;
-  const requestedAgentId = typeof options.agentId === "string" ? options.agentId.trim() : "";
-  const sandboxRuntimeAgentId = typeof options.runtimeAgentId === "string" ? options.runtimeAgentId.trim() : "";
-  if (requestedAgentId && sandboxRuntimeAgentId && requestedAgentId !== sandboxRuntimeAgentId) {
-    throw new Error(
-      "agent-id and runtime-agent-id must match when both are set"
-    );
-  }
-  const agentId = requestedAgentId || sandboxRuntimeAgentId;
-  const sandboxWorkflowMode = parseSandboxWorkflowModeOption(options.workflowMode);
-  const sandboxRuntimePromotionPolicy = parseSandboxRuntimePromotionPolicyOption(options.runtimePromotionPolicy);
-  const sandboxRuntimeBaseBranch = typeof options.runtimeBaseBranch === "string" && options.runtimeBaseBranch.trim() ? options.runtimeBaseBranch.trim() : "";
-  const sandboxRuntimeBaseSha = typeof options.runtimeBaseSha === "string" && options.runtimeBaseSha.trim() ? options.runtimeBaseSha.trim() : "";
-  const runtimeId = typeof options.runtimeId === "string" && options.runtimeId.trim() ? options.runtimeId.trim() : "";
-  const sandboxRuntimeRequested = Boolean(
-    sandboxWorkflowMode || sandboxRuntimePromotionPolicy || sandboxRuntimeBaseBranch || sandboxRuntimeBaseSha || runtimeId || sandboxRuntimeProjectId || sandboxRuntimeAgentId
-  );
-  const env = parseSandboxTemplateEnvOptions(manifest, options);
-  const workloadSource = sandboxWorkloadSourceFromManifest(manifest);
-  const sandbox = {
-    repo,
-    ...teamId ? { teamId } : {},
-    ...projectId ? { projectId } : {},
-    ...agentId ? { agentId } : {},
-    resources: manifest.resources ?? {},
-    networkPolicy: {
-      internetEgress: sandboxTemplateInternetEgressPolicy(
-        manifest.network.egress
-      )
-    },
-    budget: { maxUsd: budgetUsd },
-    quotas: {
-      maxSpendUsd: budgetUsd,
-      ...maxDurationSeconds !== void 0 ? { maxDurationSeconds } : {},
-      ...idleTimeoutSeconds !== void 0 ? { idleTimeoutSeconds } : {}
-    },
-    ...env.length > 0 ? { env } : {},
-    ...workloadSource ? { workloadSource } : {},
-    volumes: manifest.volumes,
-    metadata: {
-      source: "openpond-code-sandbox-template-start",
-      manifestFile: OPENPOND_MANIFEST_FILE_NAME,
-      template: {
-        name: manifest.name,
-        version: manifest.version,
-        useCase: manifest.useCase
-      }
-    }
-  };
-  return {
-    sandbox,
-    ...sandboxRuntimeRequested && runtimeId ? { runtimeId } : {},
-    ...sandboxRuntimeRequested && !runtimeId ? {
-      sandboxRuntime: {
-        ...teamId ? { teamId } : {},
-        ...sandboxWorkflowMode ? { workflowMode: sandboxWorkflowMode } : {},
-        ...projectId ? { projectId } : {},
-        ...agentId ? { agentId } : {},
-        baseBranch: sandboxRuntimeBaseBranch || "master",
-        ...sandboxRuntimeBaseSha ? { baseSha: sandboxRuntimeBaseSha } : {},
-        ...sandboxRuntimePromotionPolicy ? { promotionPolicy: sandboxRuntimePromotionPolicy } : {}
-      }
-    } : {}
-  };
-}
-function sandboxWorkloadSourceFromManifest(manifest) {
-  if (manifest.runtime.image) {
-    return { image: manifest.runtime.image };
-  }
-  if (manifest.runtime.dockerfile) {
-    return { dockerfile: manifest.runtime.dockerfile };
-  }
-  return void 0;
-}
-function sandboxTemplateInternetEgressPolicy(egress) {
-  return egress === "allow" ? "allow" : "block";
-}
-async function createSandboxTemplateStartSandbox(client, plan, repo) {
-  const requestedAt = Date.now();
-  try {
-    return (await createSandboxFromPlan(client, plan)).sandbox;
-  } catch (error) {
-    if (!isLikelySandboxCreateTimeout(error)) {
-      throw error;
-    }
-    console.warn(
-      "warning: sandbox create timed out; checking for the created sandbox record"
-    );
-    return recoverTimedOutSandboxCreate(
-      client,
-      plan.sandbox,
-      repo,
-      requestedAt
-    );
-  }
-}
-function isLikelySandboxCreateTimeout(error) {
-  return error instanceof Error && /\b(504|timed out|timeout)\b/i.test(error.message);
-}
-async function recoverTimedOutSandboxCreate(client, input2, repo, requestedAt) {
-  const timeoutMs = 12 * 6e4;
-  const pollMs = 3e3;
-  const deadline = Date.now() + timeoutMs;
-  const repoIdentity = normalizeSandboxTemplateRepoIdentity(repo);
-  const metadata = input2.metadata ?? {};
-  while (Date.now() < deadline) {
-    const sandboxes = await client.list({
-      ...input2.teamId ? { teamId: input2.teamId } : {},
-      ...input2.projectId ? { projectId: input2.projectId } : {},
-      ...input2.agentId ? { agentId: input2.agentId } : {}
-    });
-    const match = sandboxes.filter((sandbox) => {
-      if (!sandbox.repo) return false;
-      if (normalizeSandboxTemplateRepoIdentity(sandbox.repo) !== repoIdentity)
-        return false;
-      const createdAt = Date.parse(sandbox.createdAt);
-      if (Number.isFinite(createdAt) && createdAt < requestedAt - 3e4)
-        return false;
-      if (metadata.source && sandbox.metadata?.source !== metadata.source)
-        return false;
-      return true;
-    }).sort(
-      (left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt)
-    )[0];
-    if (match?.state === "running" || match?.state === "stopped") {
-      return match;
-    }
-    if (match?.state === "error") {
-      throw new Error(
-        `sandbox create failed after timeout: ${match.id}
-${match.logs.join(
-          "\n"
-        )}`
-      );
-    }
-    await sleep(pollMs);
-  }
-  throw new Error(
-    "sandbox create timed out and no matching created sandbox reached running state"
-  );
-}
-async function waitForSandboxTemplateRunnerReady(client, sandboxId) {
-  const timeoutMs = 12e4;
-  const pollMs = 3e3;
-  const deadline = Date.now() + timeoutMs;
-  let lastError = null;
-  while (Date.now() < deadline) {
-    try {
-      const result = await client.exec(sandboxId, {
-        command: "true",
-        timeoutSeconds: 30
-      });
-      if (result.command.status === "succeeded" && result.command.exitCode === 0) {
-        return;
-      }
-      lastError = new Error(
-        `readiness command ${result.command.status} with exit code ${String(
-          result.command.exitCode
-        )}`
-      );
-    } catch (error) {
-      lastError = error;
-      if (!isRetryableSandboxRunnerReadyError(error)) {
-        throw error;
-      }
-    }
-    await sleep(pollMs);
-  }
-  throw new Error(
-    `sandbox runner was not ready after create: ${formatUnknownError(
-      lastError
-    )}`
-  );
-}
-function isRetryableSandboxRunnerReadyError(error) {
-  return error instanceof Error && /\b(502|503|504|timed out|timeout|sandbox_not_found|sandbox_not_ready|sandbox_runner_failed)\b/i.test(
-    error.message
-  );
-}
-function formatUnknownError(error) {
-  if (error instanceof Error) return error.message;
-  if (typeof error === "string") return error;
-  return "unknown error";
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function resolveSandboxTemplateStartInput(manifest, options, projectPath) {
-  const scalars = parseSandboxTemplateScalarInputs(options);
-  const uploadSpecs = collectSandboxTemplateUploadSpecs(manifest);
-  const uploadRequests = [];
-  const fileInputs = parseSandboxTemplateFileInputOptions(options);
-  for (const [inputName, rawValue] of Object.entries(fileInputs)) {
-    const spec = uploadSpecs.get(inputName);
-    if (!spec) {
-      throw new Error(
-        `${inputName} is not declared as a file upload input in ${OPENPOND_MANIFEST_FILE_NAME}`
-      );
-    }
-    const localPaths = await expandSandboxTemplateUploadPaths(
-      rawValue,
-      projectPath
-    );
-    if (!spec.multiple && localPaths.length > 1) {
-      throw new Error(
-        `${inputName} accepts one file, got ${localPaths.length}`
-      );
-    }
-    uploadRequests.push({ inputName, localPaths, spec });
-  }
-  const requiredInputs = Array.isArray(manifest.inputs.schema.required) ? manifest.inputs.schema.required.filter(
-    (value) => typeof value === "string"
-  ) : [];
-  for (const inputName of requiredInputs) {
-    if (uploadSpecs.has(inputName) && !uploadRequests.some((request) => request.inputName === inputName)) {
-      throw new Error(
-        `${inputName} is required; pass --input-file ${inputName}=<path> or --input-files ${inputName}=<glob>`
-      );
-    }
-  }
-  return { scalars, uploadRequests };
-}
-function parseSandboxTemplateScalarInputs(options) {
-  const rawInputs = typeof options.inputs === "string" ? options.inputs : typeof options.inputJson === "string" ? options.inputJson : typeof options.params === "string" ? options.params : "";
-  const scalars = rawInputs ? parseJsonOption(rawInputs, "inputs") : {};
-  if (!scalars || typeof scalars !== "object" || Array.isArray(scalars)) {
-    throw new Error("inputs must be a JSON object");
-  }
-  const rawInput = typeof options.input === "string" ? options.input.trim() : "";
-  if (rawInput) {
-    const [name, value] = parseKeyValueOption(rawInput, "input");
-    scalars[name] = value;
-  }
-  return scalars;
-}
-function parseSandboxTemplateFileInputOptions(options) {
-  const out = {};
-  const rawFile = typeof options.inputFile === "string" ? options.inputFile.trim() : "";
-  if (rawFile) {
-    const [name, value] = parseKeyValueOption(rawFile, "input-file");
-    out[name] = value;
-  }
-  const rawFiles = typeof options.inputFiles === "string" ? options.inputFiles.trim() : "";
-  if (rawFiles) {
-    const [name, value] = parseKeyValueOption(rawFiles, "input-files");
-    out[name] = value;
-  }
-  return out;
-}
-function parseKeyValueOption(value, label) {
-  const index = value.indexOf("=");
-  if (index <= 0) {
-    throw new Error(`${label} must be formatted as name=value`);
-  }
-  const key = value.slice(0, index).trim();
-  const raw = value.slice(index + 1).trim();
-  if (!key || !raw) {
-    throw new Error(`${label} must be formatted as name=value`);
-  }
-  return [key, raw];
-}
-function collectSandboxTemplateUploadSpecs(manifest) {
-  const properties = asPlainRecord(manifest.inputs.schema.properties) ?? {};
-  const specs = /* @__PURE__ */ new Map();
-  for (const [inputName, rawProperty] of Object.entries(properties)) {
-    const property = asPlainRecord(rawProperty);
-    if (!property) continue;
-    const upload = asPlainRecord(
-      property["x-openpond-upload"] ?? property.xOpenPondUpload
-    );
-    if (!upload) continue;
-    const targetPath = typeof upload.targetPath === "string" && upload.targetPath.trim() ? normalizeSandboxUploadTargetPath(upload.targetPath) : "";
-    if (!targetPath) {
-      throw new Error(`${inputName} upload metadata is missing targetPath`);
-    }
-    const multiple = upload.multiple === true || property.type === "array" || asPlainRecord(property.items)?.format === "file";
-    specs.set(inputName, { inputName, multiple, targetPath });
-  }
-  return specs;
-}
-function asPlainRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  return value;
-}
-function normalizeSandboxUploadTargetPath(value) {
-  const normalized = value.trim().replace(/\\/g, "/").replace(/^\/workspace\//, "").replace(/^\.\//, "").replace(/^\/+/, "");
-  if (!normalized || normalized.split("/").some((segment) => segment === ".." || segment === "")) {
-    throw new Error(`invalid upload target path: ${value}`);
-  }
-  if (normalized.split("/").some(isSandboxEnvFileName)) {
-    throw new Error(
-      "sandbox template uploads cannot target .env* files; create sandbox secrets and pass refs with --env-ref"
-    );
-  }
-  return normalized;
-}
-async function expandSandboxTemplateUploadPaths(rawValue, projectPath) {
-  const values = rawValue.split(",").map((item) => item.trim()).filter(Boolean);
-  const paths = (await Promise.all(
-    values.map((value) => expandSandboxTemplateUploadPath(value, projectPath))
-  )).flat();
-  if (paths.length === 0) {
-    throw new Error(`no files matched ${rawValue}`);
-  }
-  return paths;
-}
-async function expandSandboxTemplateUploadPath(rawValue, projectPath) {
-  const absolute = path2.resolve(projectPath, rawValue);
-  if (!rawValue.includes("*")) {
-    assertSandboxTemplateUploadPathAllowed(absolute);
-    const stats = await fs.stat(absolute);
-    if (!stats.isFile()) {
-      throw new Error(`upload path is not a file: ${absolute}`);
-    }
-    return [absolute];
-  }
-  const directory = path2.dirname(absolute);
-  const basename = path2.basename(absolute);
-  const regex = globBasenameToRegExp(basename);
-  const entries = await fs.readdir(directory, { withFileTypes: true });
-  const matchingEntries = entries.filter((entry) => entry.isFile() && regex.test(entry.name)).sort((left, right) => left.name.localeCompare(right.name));
-  const blocked = matchingEntries.find(
-    (entry) => isSandboxEnvFileName(entry.name)
-  );
-  if (blocked) {
-    throw new Error(
-      "sandbox template uploads cannot include .env* files; create sandbox secrets and pass refs with --env-ref"
-    );
-  }
-  return matchingEntries.map((entry) => path2.join(directory, entry.name)).sort((left, right) => left.localeCompare(right));
-}
-function assertSandboxTemplateUploadPathAllowed(localPath) {
-  if (isSandboxEnvFileName(path2.basename(localPath))) {
-    throw new Error(
-      "sandbox template uploads cannot include .env* files; create sandbox secrets and pass refs with --env-ref"
-    );
-  }
-}
-function isSandboxEnvFileName(name) {
-  return name === ".env" || name.startsWith(".env.");
-}
-function globBasenameToRegExp(pattern) {
-  const escaped = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-  return new RegExp(`^${escaped}$`);
-}
-async function runSandboxTemplateSetupCommands(client, sandboxId, manifest, options) {
-  const timeoutSeconds = parseIntegerOption(options.setupTimeoutSeconds, "setup-timeout-seconds") ?? 900;
-  const results = [];
-  for (const command of manifest.setup.commands) {
-    const result = await runSandboxTemplateShellCommand(
-      client,
-      sandboxId,
-      command,
-      timeoutSeconds
-    );
-    results.push({
-      command,
-      status: result.status,
-      exitCode: result.exitCode
-    });
-    if (result.status !== "succeeded" || result.exitCode !== 0) {
-      throw new Error(`setup command failed: ${command}
-${result.output}`);
-    }
-  }
-  return results;
-}
-async function uploadSandboxTemplateStartFiles(client, sandboxId, requests) {
-  const uploaded = [];
-  for (const request of requests) {
-    for (const localPath of request.localPaths) {
-      const contents = await fs.readFile(localPath);
-      const sandboxPath = joinSandboxUploadPath(
-        request.spec.targetPath,
-        path2.basename(localPath)
-      );
-      await client.uploadFileBase64(
-        sandboxId,
-        sandboxPath,
-        contents.toString("base64")
-      );
-      uploaded.push({
-        inputName: request.inputName,
-        localPath,
-        sandboxPath,
-        sizeBytes: contents.byteLength
-      });
-    }
-  }
-  return uploaded;
-}
-function joinSandboxUploadPath(targetPath, basename) {
-  return `${targetPath.replace(/\/+$/, "")}/${basename.replace(/^\/+/, "")}`;
-}
-function formatUploadedFileParams(uploadedFiles, requests) {
-  const out = {};
-  for (const request of requests) {
-    const files = uploadedFiles.filter((file) => file.inputName === request.inputName).map((file) => file.sandboxPath);
-    out[request.inputName] = request.spec.multiple ? files : files[0] ?? "";
-  }
-  return out;
-}
-async function runSandboxTemplateExecutable(client, sandboxId, executable, input2, env = {}) {
-  await uploadSandboxTemplateReplayParams(client, sandboxId, input2);
-  const command = formatSandboxTemplateCommand(executable, env);
-  const timeoutSeconds = executable.timeoutSeconds;
-  if (executable.kind === "service") {
-    const result2 = await client.startProcess(sandboxId, {
-      command,
-      ...timeoutSeconds !== void 0 ? { timeoutSeconds } : {}
-    });
-    return { kind: "service", process: result2.process };
-  }
-  const result = await runSandboxTemplateProcessToCompletion(
-    client,
-    sandboxId,
-    command,
-    timeoutSeconds ?? 900
-  );
-  if (result.status !== "succeeded" || result.exitCode !== 0) {
-    throw new Error(
-      `template command failed: ${executable.name}
-${result.output}`
-    );
-  }
-  return { kind: executable.kind, process: result };
-}
-async function runSandboxTemplateShellCommand(client, sandboxId, command, timeoutSeconds) {
-  return runSandboxTemplateProcessToCompletion(
-    client,
-    sandboxId,
-    command,
-    timeoutSeconds ?? 900
-  );
-}
-async function uploadSandboxTemplateReplayParams(client, sandboxId, input2) {
-  const paramsJson = `${JSON.stringify({ input: input2 }, null, 2)}
-`;
-  await client.uploadFileBase64(
-    sandboxId,
-    "openpond-replay-params.json",
-    Buffer.from(paramsJson, "utf8").toString("base64")
-  );
-}
-async function runSandboxTemplateProcessToCompletion(client, sandboxId, command, timeoutSeconds) {
-  const started = await client.startProcess(sandboxId, {
-    command,
-    timeoutSeconds
-  });
-  let current = started.process;
-  const deadline = Date.now() + timeoutSeconds * 1e3 + 3e4;
-  while (current.status === "running" && Date.now() < deadline) {
-    await sleep(3e3);
-    const polled = await client.getProcess(sandboxId, current.id);
-    current = polled.process;
-  }
-  return {
-    command: current.command,
-    status: current.status,
-    output: current.output,
-    exitCode: current.exitCode,
-    processId: current.id
-  };
-}
-function sandboxTemplateRuntimeEnv(sandbox) {
-  return {
-    OPENPOND_SANDBOX_ID: sandbox.id,
-    ...sandbox.runtimeId ? { OPENPOND_SANDBOX_RUNTIME_ID: sandbox.runtimeId } : {}
-  };
-}
-function formatSandboxTemplateCommand(executable, env = {}) {
-  const paramsPath = quoteShellArg(replayParamsPathForExecutable(executable));
-  const envPrefix = `OPENPOND_REPLAY_PARAMS_BASE64="$(base64 -w0 ${paramsPath} 2>/dev/null || base64 ${paramsPath} | tr -d '\\n')"`;
-  const runtimeEnvPrefix = Object.entries(env).filter(([, value]) => value.length > 0).map(([name, value]) => `${name}=${quoteShellArg(value)}`).join(" ");
-  const command = [runtimeEnvPrefix, envPrefix, executable.command].filter(Boolean).join(" ");
-  if (!executable.cwd) return command;
-  return `cd ${quoteShellArg(executable.cwd)} && ${command}`;
-}
-function replayParamsPathForExecutable(executable) {
-  if (!executable.cwd) return "openpond-replay-params.json";
-  const cwd = executable.cwd.replace(/\\/g, "/").replace(/\/+$/, "") || ".";
-  return path2.posix.relative(cwd, "openpond-replay-params.json") || "openpond-replay-params.json";
-}
-function quoteShellArg(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
-}
-async function openSandboxTemplatePorts(client, sandboxId, ports) {
-  const previews = [];
-  for (const port of ports) {
-    const result = await client.openPort(sandboxId, {
-      port: port.port,
-      ...port.label ? { label: port.label } : {},
-      access: port.access,
-      autoStart: false
-    });
-    previews.push(result.preview);
-  }
-  return previews;
-}
-function resolveSandboxTemplateFilePath(options) {
-  const rawFile = typeof options.file === "string" && options.file.trim().length > 0 ? options.file.trim() : typeof options.manifest === "string" && options.manifest.trim().length > 0 ? options.manifest.trim() : OPENPOND_MANIFEST_FILE_NAME;
-  return path2.resolve(process.cwd(), rawFile);
-}
-function resolveSandboxTemplateScaffoldPath(options) {
-  const rawPath = typeof options.path === "string" && options.path.trim().length > 0 ? options.path.trim() : typeof options.dir === "string" && options.dir.trim().length > 0 ? options.dir.trim() : process.cwd();
-  return path2.resolve(process.cwd(), rawPath);
-}
-
-// src/cli/sandbox-template-local.ts
-async function runSandboxTemplateLocal(options, mode) {
-  const { plan, filePath, projectPath } = await loadSandboxTemplateBuildPlan(
-    options
-  );
-  const executable = resolveSandboxTemplateLocalExecutable(
-    plan.manifest,
-    options,
-    mode
-  );
-  const input2 = await resolveSandboxTemplateStartInput(
-    plan.manifest,
-    options,
-    projectPath
-  );
-  const volumes = await prepareLocalSandboxTemplateVolumes(
-    plan.manifest,
-    projectPath
-  );
-  const setupCommands = await runLocalSandboxTemplateSetupCommands(
-    plan.manifest,
-    projectPath,
-    options
-  );
-  const uploadedFiles = await prepareLocalSandboxTemplateUploads(
-    input2.uploadRequests,
-    projectPath
-  );
-  const commandInput = {
-    ...input2.scalars,
-    ...formatUploadedFileParams(uploadedFiles, input2.uploadRequests)
-  };
-  const replay = await writeLocalSandboxTemplateReplayParams(
-    projectPath,
-    executable,
-    commandInput
-  );
-  const previews = localSandboxTemplatePreviews(executable);
-  if (mode === "dev" || executable.kind === "service") {
-    console.log(
-      JSON.stringify(
-        {
-          ok: true,
-          mode,
-          file: filePath,
-          template: plan.manifest.name,
-          executable: summarizeSandboxTemplateExecutable(executable),
-          volumes,
-          setupCommands,
-          uploadedFiles,
-          input: commandInput,
-          replayParamsPath: replay.paramsPath,
-          previews,
-          status: "starting"
-        },
-        null,
-        2
-      )
-    );
-    const result = await runLocalSandboxTemplateCommand(
-      projectPath,
-      executable,
-      replay,
-      {
-        inherit: true,
-        timeoutSeconds: executable.timeoutSeconds
-      }
-    );
-    if (result.status !== "succeeded") process.exitCode = 1;
-    return;
-  }
-  const execution = await runLocalSandboxTemplateCommand(
-    projectPath,
-    executable,
-    replay,
-    {
-      timeoutSeconds: executable.timeoutSeconds ?? 900
-    }
-  );
-  const artifacts = await collectLocalSandboxTemplateArtifacts(
-    projectPath,
-    executable.artifactPaths
-  );
-  if (execution.status !== "succeeded") process.exitCode = 1;
-  console.log(
-    JSON.stringify(
-      {
-        ok: execution.status === "succeeded",
-        mode,
-        file: filePath,
-        template: plan.manifest.name,
-        executable: summarizeSandboxTemplateExecutable(executable),
-        volumes,
-        setupCommands,
-        uploadedFiles,
-        input: commandInput,
-        replayParamsPath: replay.paramsPath,
-        execution,
-        previews,
-        artifacts
-      },
-      null,
-      2
-    )
-  );
-}
-async function runSandboxTemplateExistingSandboxAction(options, rest) {
-  const sandboxId = rest[0]?.trim() || (typeof options.sandboxId === "string" ? options.sandboxId.trim() : "");
-  const actionName = rest[1]?.trim() || (typeof options.action === "string" ? options.action.trim() : "") || (typeof options.target === "string" ? options.target.trim() : "");
-  if (!sandboxId || !actionName) {
-    throw new Error(
-      `usage: sandbox-template action <sandboxId> <actionName> [--file ${OPENPOND_MANIFEST_FILE_NAME}]`
-    );
-  }
-  const { plan, filePath, projectPath } = await loadSandboxTemplateBuildPlan(
-    options
-  );
-  const executable = resolveSandboxTemplateActionExecutable(
-    plan.manifest,
-    actionName
-  );
-  const input2 = await resolveSandboxTemplateStartInput(
-    plan.manifest,
-    options,
-    projectPath
-  );
-  const client = await resolveSandboxClient(options);
-  const uploadedFiles = await uploadSandboxTemplateStartFiles(
-    client,
-    sandboxId,
-    input2.uploadRequests
-  );
-  const commandInput = {
-    ...input2.scalars,
-    ...formatUploadedFileParams(uploadedFiles, input2.uploadRequests)
-  };
-  const execution = await runSandboxTemplateExecutable(
-    client,
-    sandboxId,
-    executable,
-    commandInput
-  );
-  console.log(
-    JSON.stringify(
-      {
-        ok: true,
-        file: filePath,
-        sandboxId,
-        executable: summarizeSandboxTemplateExecutable(executable),
-        uploadedFiles,
-        input: commandInput,
-        execution,
-        expectedArtifacts: executable.artifactPaths
-      },
-      null,
-      2
-    )
-  );
-}
-function resolveSandboxTemplateLocalExecutable(manifest, options, mode) {
-  if (mode === "dev" && typeof options.target !== "string" && typeof options.action !== "string" && typeof options.service !== "string" && typeof options.entrypoint !== "string") {
-    const firstService = sandboxTemplateExecutableEntries(manifest).find(
-      (candidate) => candidate.kind === "service"
-    );
-    if (firstService) return firstService;
-  }
-  return resolveSandboxTemplateStartExecutable(manifest, options);
-}
-function resolveSandboxTemplateActionExecutable(manifest, actionName) {
-  const match = sandboxTemplateExecutableEntries(manifest).find(
-    (candidate) => candidate.kind === "action" && candidate.name === actionName
-  );
-  if (!match) {
-    const actions = manifest.actions.map((action) => action.name).join(", ") || "(none)";
-    throw new Error(
-      `manifest action not found: ${actionName}. Available actions: ${actions}`
-    );
-  }
-  return match;
-}
-function summarizeSandboxTemplateExecutable(executable) {
-  return {
-    kind: executable.kind,
-    name: executable.name,
-    command: executable.command,
-    cwd: executable.cwd ?? null,
-    timeoutSeconds: executable.timeoutSeconds ?? null,
-    ports: executable.ports,
-    artifactPaths: executable.artifactPaths
-  };
-}
-async function prepareLocalSandboxTemplateVolumes(manifest, projectPath) {
-  const volumes = [];
-  for (const volume of manifest.volumes) {
-    const mountPath = typeof volume.mountPath === "string" && volume.mountPath.trim() ? volume.mountPath.trim() : volume.name ? `/workspace/volumes/${volume.name}` : "";
-    if (!mountPath) continue;
-    const localPath = path3.resolve(
-      projectPath,
-      normalizeLocalWorkspacePath(mountPath)
-    );
-    await fs2.mkdir(localPath, { recursive: true });
-    volumes.push({
-      name: volume.name ?? null,
-      mountPath,
-      localPath
-    });
-  }
-  return volumes;
-}
-async function runLocalSandboxTemplateSetupCommands(manifest, projectPath, options) {
-  const timeoutSeconds = parseIntegerOption(options.setupTimeoutSeconds, "setup-timeout-seconds") ?? 900;
-  const results = [];
-  for (const command of manifest.setup.commands) {
-    const result = await runLocalShellCommandResult(command, projectPath, {
-      timeoutSeconds
-    });
-    results.push(result);
-    if (result.status !== "succeeded") {
-      throw new Error(
-        `local setup command failed: ${command}
-${result.output}`
-      );
-    }
-  }
-  return results;
-}
-async function prepareLocalSandboxTemplateUploads(requests, projectPath) {
-  const uploaded = [];
-  for (const request of requests) {
-    for (const localPath of request.localPaths) {
-      const contents = await fs2.readFile(localPath);
-      const sandboxPath = joinSandboxUploadPath(
-        request.spec.targetPath,
-        path3.basename(localPath)
-      );
-      const destination = path3.resolve(
-        projectPath,
-        normalizeLocalWorkspacePath(sandboxPath)
-      );
-      await fs2.mkdir(path3.dirname(destination), { recursive: true });
-      await fs2.copyFile(localPath, destination);
-      uploaded.push({
-        inputName: request.inputName,
-        localPath,
-        sandboxPath,
-        sizeBytes: contents.byteLength
-      });
-    }
-  }
-  return uploaded;
-}
-async function writeLocalSandboxTemplateReplayParams(projectPath, executable, input2) {
-  const paramsJson = `${JSON.stringify({ input: input2 }, null, 2)}
-`;
-  const encoded = Buffer2.from(paramsJson, "utf8").toString("base64");
-  const paramsPath = path3.join(projectPath, "openpond-replay-params.json");
-  await fs2.writeFile(paramsPath, paramsJson, "utf8");
-  if (executable.cwd) {
-    const cwdParamsPath = path3.join(
-      projectPath,
-      executable.cwd,
-      "openpond-replay-params.json"
-    );
-    if (cwdParamsPath !== paramsPath) {
-      await fs2.mkdir(path3.dirname(cwdParamsPath), { recursive: true });
-      await fs2.writeFile(cwdParamsPath, paramsJson, "utf8");
-    }
-  }
-  return { paramsPath, encoded };
-}
-async function runLocalSandboxTemplateCommand(projectPath, executable, replay, options = {}) {
-  const cwd = executable.cwd ? path3.resolve(projectPath, executable.cwd) : projectPath;
-  return runLocalShellCommandResult(executable.command, cwd, {
-    env: {
-      OPENPOND_REPLAY_PARAMS_BASE64: replay.encoded
-    },
-    timeoutSeconds: options.timeoutSeconds,
-    inherit: options.inherit
-  });
-}
-async function runLocalShellCommandResult(command, cwd, options = {}) {
-  const result = await runShellCommand(command, {
-    cwd,
-    env: options.env,
-    timeoutSeconds: options.timeoutSeconds,
-    inherit: options.inherit
-  });
-  const output = [result.stdout, result.stderr].filter(Boolean).join("");
-  return {
-    command,
-    cwd,
-    status: result.timedOut ? "timed_out" : result.code === 0 ? "succeeded" : "failed",
-    output,
-    exitCode: result.code
-  };
-}
-function localSandboxTemplatePreviews(executable) {
-  return executable.ports.map((port) => ({
-    port: port.port,
-    label: port.label ?? null,
-    access: port.access,
-    url: `http://127.0.0.1:${port.port}${port.path}`
-  }));
-}
-async function collectLocalSandboxTemplateArtifacts(projectPath, artifactPaths) {
-  const artifacts = [];
-  for (const artifactPath of artifactPaths) {
-    const localPath = path3.resolve(
-      projectPath,
-      normalizeLocalWorkspacePath(artifactPath)
-    );
-    try {
-      const stat = await fs2.stat(localPath);
-      artifacts.push({
-        path: artifactPath,
-        exists: stat.isFile(),
-        sizeBytes: stat.size
-      });
-    } catch {
-      artifacts.push({ path: artifactPath, exists: false, sizeBytes: null });
-    }
-  }
-  return artifacts;
-}
-function normalizeLocalWorkspacePath(value) {
-  const normalized = value.trim().replace(/\\/g, "/").replace(/^\/workspace\//, "").replace(/^workspace\//, "").replace(/^\.\//, "").replace(/^\/+/, "");
-  if (!normalized || normalized.split("/").some((segment) => segment === ".." || segment === "")) {
-    throw new Error(`invalid workspace path: ${value}`);
-  }
-  return normalized;
-}
-
-// src/cli/sandbox-template.ts
-async function runSandboxTemplateCommand(options, rest) {
-  const subcommand = rest[0] || "validate";
-  if (subcommand === "validate") {
-    const filePath = resolveSandboxTemplateFilePath(options);
-    const source = await fs3.readFile(filePath, "utf8");
-    const result = validateSandboxTemplateYaml(source);
-    if (!result.ok) {
-      console.error(formatSandboxTemplateDiagnostics(result.diagnostics));
-      process.exitCode = 1;
-      return;
-    }
-    console.log(
-      JSON.stringify(
-        {
-          ok: true,
-          file: filePath,
-          name: result.manifest.name,
-          version: result.manifest.version,
-          start: result.manifest.start.command,
-          actions: result.manifest.actions.map((action) => action.name),
-          services: result.manifest.services.map((service) => service.name),
-          schedules: result.manifest.schedules.map((schedule) => schedule.name)
-        },
-        null,
-        2
-      )
-    );
-    return;
-  }
-  if (subcommand === "print-schema") {
-    console.log(JSON.stringify(sandboxTemplateJsonSchema(), null, 2));
-    return;
-  }
-  if (subcommand === "scaffold") {
-    const outputPath = resolveSandboxTemplateScaffoldPath(options);
-    const rawName = typeof options.name === "string" && options.name.trim().length > 0 ? options.name.trim() : path4.basename(outputPath);
-    const description = typeof options.description === "string" && options.description.trim().length > 0 ? options.description.trim() : void 0;
-    const files = sandboxTemplateScaffoldFiles({ name: rawName, description });
-    const manifestPath = path4.join(outputPath, OPENPOND_MANIFEST_FILE_NAME);
-    if (existsSync2(manifestPath)) {
-      throw new Error(
-        `${OPENPOND_MANIFEST_FILE_NAME} already exists at ${manifestPath}`
-      );
-    }
-    await fs3.mkdir(outputPath, { recursive: true });
-    for (const [relativePath, contents] of Object.entries(files)) {
-      const filePath = path4.join(outputPath, relativePath);
-      await fs3.mkdir(path4.dirname(filePath), { recursive: true });
-      await fs3.writeFile(filePath, contents, "utf8");
-    }
-    console.log(
-      JSON.stringify(
-        {
-          ok: true,
-          path: outputPath,
-          files: Object.keys(files).sort(
-            (left, right) => left.localeCompare(right)
-          )
-        },
-        null,
-        2
-      )
-    );
-    return;
-  }
-  if (subcommand === "build") {
-    await runSandboxTemplateBuild(options);
-    return;
-  }
-  if (subcommand === "run") {
-    await runSandboxTemplateLocal(options, "run");
-    return;
-  }
-  if (subcommand === "dev") {
-    await runSandboxTemplateLocal(options, "dev");
-    return;
-  }
-  if (subcommand === "action") {
-    await runSandboxTemplateExistingSandboxAction(options, rest.slice(1));
-    return;
-  }
-  if (subcommand === "start") {
-    await runSandboxTemplateStart(options);
-    return;
-  }
-  throw new Error(
-    `usage: sandbox-template <validate|print-schema|scaffold|build|run|dev|start|action> [--file ${OPENPOND_MANIFEST_FILE_NAME}] [--path <dir>] [--name <name>]`
-  );
-}
-async function runSandboxTemplateBuild(options) {
-  const context = await loadSandboxTemplateManifestContext(options);
-  const outputPath = resolveSandboxTemplateBuildOutputPath(
-    options,
-    context.projectPath
-  );
-  const plan = sandboxTemplateBuildPlan({
-    manifest: context.manifest,
-    manifestFile: path4.relative(context.projectPath, context.filePath) || OPENPOND_MANIFEST_FILE_NAME,
-    projectRoot: path4.relative(path4.dirname(outputPath), context.projectPath) || "."
-  });
-  const shouldWrite = !parseBooleanOption(options.noWrite);
-  if (shouldWrite) {
-    await fs3.mkdir(path4.dirname(outputPath), { recursive: true });
-    await fs3.writeFile(
-      outputPath,
-      `${JSON.stringify(plan, null, 2)}
-`,
-      "utf8"
-    );
-  }
-  const metadata = sandboxTemplateBuildMetadata(context.manifest);
-  const executables = sandboxTemplateExecutableEntries(context.manifest);
-  console.log(
-    JSON.stringify(
-      {
-        ok: true,
-        file: context.filePath,
-        output: shouldWrite ? outputPath : null,
-        ...metadata,
-        startCommand: executables[0]?.command ?? null,
-        plan
-      },
-      null,
-      2
-    )
-  );
-}
-async function loadSandboxTemplateManifestContext(options) {
-  const filePath = resolveSandboxTemplateFilePath(options);
-  const source = await fs3.readFile(filePath, "utf8");
-  const result = validateSandboxTemplateYaml(source);
-  if (!result.ok) {
-    process.exitCode = 1;
-    throw new Error(formatSandboxTemplateDiagnostics(result.diagnostics));
-  }
-  return {
-    filePath,
-    projectPath: path4.dirname(filePath),
-    manifest: result.manifest
-  };
-}
-function resolveSandboxTemplateBuildOutputPath(options, projectPath) {
-  const rawOutput = typeof options.output === "string" && options.output.trim() ? options.output.trim() : typeof options.out === "string" && options.out.trim() ? options.out.trim() : "";
-  if (rawOutput) return path4.resolve(process.cwd(), rawOutput);
-  const rawOutputDir = typeof options.outputDir === "string" && options.outputDir.trim() ? options.outputDir.trim() : typeof options.outDir === "string" && options.outDir.trim() ? options.outDir.trim() : "dist";
-  return path4.resolve(
-    projectPath,
-    rawOutputDir,
-    SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME
-  );
-}
-async function loadSandboxTemplateBuildPlan(options) {
-  const rawBuild = typeof options.build === "string" && options.build.trim() ? options.build.trim() : typeof options.plan === "string" && options.plan.trim() ? options.plan.trim() : "";
-  if (rawBuild) {
-    const filePath = path4.resolve(process.cwd(), rawBuild);
-    const parsed = JSON.parse(
-      await fs3.readFile(filePath, "utf8")
-    );
-    if (parsed.kind !== SANDBOX_TEMPLATE_BUILD_PLAN_KIND || parsed.schemaVersion !== 1) {
-      throw new Error(`invalid sandbox template build plan: ${filePath}`);
-    }
-    return {
-      plan: parsed,
-      filePath,
-      projectPath: path4.resolve(path4.dirname(filePath), parsed.projectRoot)
-    };
-  }
-  const context = await loadSandboxTemplateManifestContext(options);
-  return {
-    plan: sandboxTemplateBuildPlan({
-      manifest: context.manifest,
-      manifestFile: path4.relative(context.projectPath, context.filePath) || OPENPOND_MANIFEST_FILE_NAME,
-      projectRoot: context.projectPath
-    }),
-    filePath: context.filePath,
-    projectPath: context.projectPath
-  };
-}
-export {
-  loadSandboxTemplateBuildPlan,
-  loadSandboxTemplateManifestContext,
-  resolveSandboxTemplateBuildOutputPath,
-  runSandboxTemplateBuild,
-  runSandboxTemplateCommand
-};