pi-microsandbox 0.1.0 → 0.2.0

package/extensions/pi-msb/sandbox-manager.ts

@@ -10,6 +10,7 @@ import {
   type PreparedStorage,
   type PruneReport,
   type RuntimeExecution,
+  type RuntimePreparation,
   type RuntimeState,
   type SandboxManager,
   type SandboxTransport,
@@ -55,7 +56,7 @@ export interface SandboxManagerDeps {
   stopAndRemove(name: string, timeoutMs: number): Promise<void>;
   createTransport(raw: unknown): SandboxTransport;
   createOperations(transport: SandboxTransport): ToolOperations;
-  probeAndBootstrap(runtime: RuntimeExecution, config: Config): Promise<void>;
+  prepareRuntime(runtime: RuntimeExecution, config: Config): Promise<RuntimePreparation>;
   seed(runtime: RuntimeExecution, prepared: PreparedStorage): Promise<SeedResult>;
   persist(state: PersistedSandboxState): void;
   now?: () => number;
@@ -136,6 +137,7 @@ function infoFor(
   seedSha: string | null | undefined,
   createdAt: number,
   name: string,
+  preparation: RuntimePreparation,
 ): NonNullable<RuntimeState["info"]> {
   return {
     name,
@@ -149,6 +151,7 @@ function infoFor(
     seedBranch: seedBranch ?? null,
     seedSha: seedSha ?? null,
     createdAt,
+    docker: { ...preparation.docker },
   };
 }
 
@@ -192,6 +195,7 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
   let state: RuntimeState = { status: "disabled", info: null };
   let lock: LockHandle | null = null;
   let runtime: RuntimeExecution | null = null;
+  let runtimeInvalid = false;
   let sandboxName: string | null = null;
   let lastRequest: BootRequest | null = null;
   let retainedState: PersistedSandboxState | null = null;
@@ -240,6 +244,7 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
   async function disposeRuntime(): Promise<void> {
     const current = runtime;
     runtime = null;
+    runtimeInvalid = false;
     if (!current) return;
     try {
       await current.transport.dispose();
@@ -285,6 +290,12 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
     return request.config.sandboxName ?? sandboxNameFor(request.sessionId);
   }
 
+  function invalidatesRuntime(error: unknown): boolean {
+    if (!error || typeof error !== "object" || !("code" in error)) return false;
+    const code = (error as { code?: unknown }).code;
+    return code === "SANDBOX_DOWN";
+  }
+
   async function connectAndBuild(raw: unknown): Promise<RuntimeExecution> {
     const transport = deps.createTransport(raw);
     try {
@@ -396,7 +407,8 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
 
       bootedRuntime = await connectAndBuild(raw);
       runtime = bootedRuntime;
-      await deps.probeAndBootstrap(bootedRuntime, request.config);
+      runtimeInvalid = false;
+      const preparation = await deps.prepareRuntime(bootedRuntime, request.config);
 
       let seed: SeedResult | null = null;
       if (
@@ -428,6 +440,7 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
         seedSha,
         createdAt,
         name,
+        preparation,
       );
 
       // Bundle cleanup is deliberately before state publication: a successful
@@ -510,16 +523,16 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
       throw new Error(`sandbox ${sandboxName} configuration changed`);
     }
 
-    if (isRunning(inspected)) {
+    if (isRunning(inspected) && !runtimeInvalid) {
       // The boot-created transport remains authoritative while the sandbox is
       // running. Reconnecting here would replace a valid handle and dispose a
       // transport that may still have active callers.
       return runtime;
     }
 
-    // A stopped/unknown sandbox requires a replacement transport. Do not stop,
-    // start, or dispose the old one until every earlier callback has released
-    // its runtime-use reservation.
+    // A stopped/unknown sandbox or invalid running handle requires a
+    // replacement transport. Do not start or dispose the old one until every
+    // earlier callback has released its runtime-use reservation.
     await waitForActiveUses();
     let raw: unknown;
     if (isStopped(inspected)) {
@@ -530,8 +543,41 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
     }
 
     const replacement = await connectAndBuild(raw);
+    let preparation: RuntimePreparation;
+    try {
+      preparation = await deps.prepareRuntime(replacement, lastRequest.config);
+    } catch (error) {
+      try {
+        await replacement.transport.dispose();
+      } catch {
+        // Preserve the preparation error.
+      }
+      const previous = runtime;
+      runtime = null;
+      runtimeInvalid = false;
+      if (previous) {
+        try {
+          await previous.transport.dispose();
+        } catch {
+          // The preparation error remains authoritative.
+        }
+      }
+      const failedName = sandboxName;
+      sandboxName = null;
+      activePlan = null;
+      if (failedName) {
+        try {
+          await deps.stopAndRemove(failedName, lastRequest.config.stopTimeoutMs);
+        } catch {
+          throw new Error(`${redactMessage(error, lastRequest.config)}; failed to clean up the restarted sandbox`);
+        }
+      }
+      throw error;
+    }
     const previous = runtime;
     runtime = replacement;
+    runtimeInvalid = false;
+    if (state.info) state = { ...state, info: { ...state.info, docker: { ...preparation.docker } } };
     if (previous && previous !== replacement) {
       try {
         await previous.transport.dispose();
@@ -621,7 +667,7 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
     getState(): RuntimeState {
       return {
         status: state.status,
-        info: state.info ? { ...state.info } : null,
+        info: state.info ? { ...state.info, docker: { ...state.info.docker } } : null,
         ...(state.reason ? { reason: state.reason } : {}),
       };
     },
@@ -663,6 +709,9 @@ export function createSandboxManager(deps: SandboxManagerDeps): SandboxManager {
       }
       try {
         return await callback(current);
+      } catch (error) {
+        if (runtime === current && invalidatesRuntime(error)) runtimeInvalid = true;
+        throw error;
       } finally {
         releaseUse(true);
       }

package/extensions/pi-msb/types.ts

@@ -37,7 +37,12 @@ export type FallbackMode = "block" | "host";
 export type BootstrapTools = "auto" | boolean;
 export type PullPolicy = "always" | "if-missing" | "never";
 export type MountType = "dir" | "file" | "named" | "tmpfs";
+export type DockerMode = "auto" | "require" | "disabled";
 
+export interface DockerConfig {
+  mode: DockerMode;
+  startupTimeoutMs: number;
+}
 export interface NetworkConfig {
   mode: NetworkMode;
   allowHosts: string[];
@@ -74,6 +79,7 @@ export interface Config {
   shallowArchive: boolean;
   volumeQuotaMiB: number;
   network: NetworkConfig;
+  docker: DockerConfig;
   secrets: SecretConfig[];
   mounts: MountConfig[];
   blockThirdParty: boolean;
@@ -362,6 +368,17 @@ export type RuntimeStatus =
   | "off"
   | "host-fallback"
   | "disabled";
+export type DockerReadiness = "ready" | "missing" | "unavailable" | "disabled";
+export interface DockerCapabilityStatus {
+  mode: DockerMode;
+  readiness: DockerReadiness;
+  version?: string;
+  storageDriver?: string;
+  reason?: string;
+}
+export interface RuntimePreparation {
+  docker: DockerCapabilityStatus;
+}
 export interface SandboxInfo {
   name: string;
   displayId: string;
@@ -374,6 +391,7 @@ export interface SandboxInfo {
   seedBranch?: string | null;
   seedSha?: string | null;
   createdAt: number;
+  docker: DockerCapabilityStatus;
 }
 export interface RuntimeState {
   status: RuntimeStatus;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-microsandbox",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Microsandbox-backed isolation for Pi coding tools",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,10 @@
     "SECURITY.md",
     "docs/*.md",
     "extensions/pi-msb/*.ts",
-    "!extensions/pi-msb/*.test.ts"
+    "!extensions/pi-msb/*.test.ts",
+    "native/flock/prebuilds/darwin-arm64/flock.node",
+    "native/flock/prebuilds/linux-x64-gnu/flock.node",
+    "native/flock/prebuilds/linux-arm64-gnu/flock.node"
   ],
   "pi": {
     "extensions": [
@@ -41,16 +44,17 @@
     ]
   },
   "scripts": {
+    "build:flock": "node ./scripts/build-flock-addon.mjs",
+    "smoke:flock": "node ./scripts/smoke-flock-addon.mjs",
+    "assemble:package": "node ./scripts/assemble-package.mjs",
     "typecheck": "tsc --noEmit",
     "test": "node --experimental-strip-types --import ./test/setup.ts --test extensions/pi-msb/*.test.ts",
     "smoke": "pi --no-extensions -e . --offline --list-models __pi_msb_smoke__",
     "check": "npm run typecheck && npm test && npm run smoke",
     "package-smoke": "./scripts/package-smoke.sh",
-    "release-check": "npm run check && npm run package-smoke && npm audit --omit=dev",
-    "prepublishOnly": "npm run release-check"
+    "release-check": "npm run check && npm audit --omit=dev"
   },
   "dependencies": {
-    "fs-ext": "2.1.1",
     "microsandbox": "0.6.16"
   },
   "peerDependencies": {
@@ -61,13 +65,12 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.84.4",
     "@earendil-works/pi-tui": "0.84.4",
-    "@types/fs-ext": "^2.0.3",
     "@types/node": "^22.10.0",
+    "node-gyp": "12.1.0",
     "typebox": "1.3.23",
     "typescript": "^7.0.2"
   },
   "allowScripts": {
-    "fs-ext@2.1.1": true,
     "@google/genai": false,
     "protobufjs": false
   }