self-bench 0.3.5 → 0.3.8

package/dist/sandbox/remote-files.d.ts

@@ -0,0 +1,11 @@
+import { type InlineSandboxFile, type RemoteSandboxFile, type SandboxFile } from "./contracts.js";
+/** Per-file budget for an in-sandbox download of a multi-hundred-MB bundle. */
+export declare const REMOTE_FILE_FETCH_TIMEOUT_MS: number;
+/** Shell that downloads one remote file inside the sandbox and verifies its digest. */
+export declare function remoteFileFetchScript(file: RemoteSandboxFile): string;
+/**
+ * Fallback for providers without an in-sandbox download step: fetch each remote file on the
+ * worker, verify it, and hand it over as inline contents.
+ */
+export declare function materializeRemoteFiles(files: readonly SandboxFile[], signal?: AbortSignal): Promise<InlineSandboxFile[]>;
+//# sourceMappingURL=remote-files.d.ts.map

package/dist/sandbox/remote-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-files.d.ts","sourceRoot":"","sources":["../../src/sandbox/remote-files.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AAExB,+EAA+E;AAC/E,eAAO,MAAM,4BAA4B,QAAc,CAAC;AAExD,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAOrE;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAuB9B"}

package/dist/sandbox/remote-files.js

@@ -0,0 +1,41 @@
+import { createHash } from "node:crypto";
+import { isRemoteSandboxFile, } from "./contracts.js";
+/** Per-file budget for an in-sandbox download of a multi-hundred-MB bundle. */
+export const REMOTE_FILE_FETCH_TIMEOUT_MS = 15 * 60_000;
+/** Shell that downloads one remote file inside the sandbox and verifies its digest. */
+export function remoteFileFetchScript(file) {
+    const path = shellQuote(file.path);
+    return [
+        `mkdir -p "$(dirname ${path})"`,
+        `curl -fsSL --retry 5 --retry-all-errors --connect-timeout 30 -o ${path} ${shellQuote(file.url)}`,
+        `printf '%s  %s\\n' ${shellQuote(file.sha256)} ${path} | sha256sum -c - >/dev/null`,
+    ].join(" && ");
+}
+/**
+ * Fallback for providers without an in-sandbox download step: fetch each remote file on the
+ * worker, verify it, and hand it over as inline contents.
+ */
+export async function materializeRemoteFiles(files, signal) {
+    const inline = [];
+    for (const file of files) {
+        if (!isRemoteSandboxFile(file)) {
+            inline.push(file);
+            continue;
+        }
+        const response = await fetch(file.url, signal ? { signal } : {});
+        if (!response.ok) {
+            throw new Error(`remote sandbox file ${file.path} failed to download: HTTP ${response.status}`);
+        }
+        const contents = new Uint8Array(await response.arrayBuffer());
+        const digest = createHash("sha256").update(contents).digest("hex");
+        if (digest !== file.sha256) {
+            throw new Error(`remote sandbox file ${file.path} digest mismatch: ${digest} != ${file.sha256}`);
+        }
+        inline.push({ path: file.path, contents });
+    }
+    return inline;
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+//# sourceMappingURL=remote-files.js.map

package/dist/sandbox/remote-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-files.js","sourceRoot":"","sources":["../../src/sandbox/remote-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAEL,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AAExB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,uBAAuB,IAAI,IAAI;QAC/B,mEAAmE,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACjG,sBAAsB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,8BAA8B;KACpF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA6B,EAC7B,MAAoB;IAEpB,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,IAAI,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,IAAI,qBAAqB,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC"}

package/dist/sandbox/request-validation.d.ts

@@ -0,0 +1,5 @@
+import type { SandboxRequest } from "./contracts.js";
+export declare const SANDBOX_WORK_DIRECTORY = "/work";
+export declare function validateSandboxRequest(request: SandboxRequest): void;
+export declare function assertSandboxWorkPath(path: string): void;
+//# sourceMappingURL=request-validation.d.ts.map

package/dist/sandbox/request-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-validation.d.ts","sourceRoot":"","sources":["../../src/sandbox/request-validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAkCpE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CASxD"}

package/dist/sandbox/request-validation.js

@@ -0,0 +1,43 @@
+import { posix } from "node:path";
+const MAX_SANDBOX_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
+export const SANDBOX_WORK_DIRECTORY = "/work";
+export function validateSandboxRequest(request) {
+    if (!request.runId || !request.stage) {
+        throw new Error("sandbox run ID and stage must not be empty");
+    }
+    if (!Number.isInteger(request.timeoutMs) || request.timeoutMs < 100) {
+        throw new Error("sandbox timeout must be an integer of at least 100ms");
+    }
+    if (request.timeoutMs > MAX_SANDBOX_TIMEOUT_MS) {
+        throw new Error("sandbox timeout cannot exceed 24 hours");
+    }
+    if (request.inactivityTimeoutMs !== undefined &&
+        (!Number.isInteger(request.inactivityTimeoutMs) || request.inactivityTimeoutMs < 1)) {
+        throw new Error("sandbox inactivity timeout must be a positive integer");
+    }
+    if (request.command.length === 0 || !request.command[0]) {
+        throw new Error("sandbox command must not be empty");
+    }
+    for (const path of [
+        ...(request.files ?? []).map((file) => file.path),
+        ...(request.outputPaths ?? []),
+    ]) {
+        assertSandboxWorkPath(path);
+    }
+    if (request.cpu !== undefined && (!Number.isInteger(request.cpu) || request.cpu < 1)) {
+        throw new Error("sandbox CPU must be a positive integer");
+    }
+    if (request.memoryMiB !== undefined &&
+        (!Number.isInteger(request.memoryMiB) || request.memoryMiB < 1)) {
+        throw new Error("sandbox memory must be a positive integer");
+    }
+}
+export function assertSandboxWorkPath(path) {
+    const normalized = posix.normalize(path);
+    if (path.includes("\0") ||
+        !path.startsWith(`${SANDBOX_WORK_DIRECTORY}/`) ||
+        !normalized.startsWith(`${SANDBOX_WORK_DIRECTORY}/`)) {
+        throw new Error(`sandbox path must be beneath ${SANDBOX_WORK_DIRECTORY}: ${path}`);
+    }
+}
+//# sourceMappingURL=request-validation.js.map

package/dist/sandbox/request-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-validation.js","sourceRoot":"","sources":["../../src/sandbox/request-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGlC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,OAAO,CAAC,mBAAmB,KAAK,SAAS;QACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,GAAG,CAAC,CAAC,EACnF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KAC/B,EAAE,CAAC;QACF,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,sBAAsB,GAAG,CAAC;QAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,sBAAsB,GAAG,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,sBAAsB,KAAK,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC"}

package/dist/sandbox/supervisor.d.ts

@@ -0,0 +1,42 @@
+import type { LiveSandbox } from "./contracts.js";
+export declare const MAILBOX_DIRECTORY = "/work/mailbox";
+export declare const MAILBOX_REQUESTS = "/work/mailbox/requests";
+export declare const MAILBOX_RESPONSES = "/work/mailbox/responses";
+export declare const MAILBOX_DONE = "/work/mailbox/done";
+export interface MailboxRequest {
+    readonly id: string;
+    readonly kind: "task" | "fix";
+    readonly definition: unknown;
+    readonly testPatch: string;
+    readonly goldPatch?: string;
+}
+export type MailboxResponse = {
+    readonly id: string;
+    readonly kind: "report";
+    readonly green: boolean;
+    readonly summary: string;
+    readonly rendered: string;
+} | {
+    readonly id: string;
+    readonly kind: "error";
+    readonly message: string;
+};
+export interface SuperviseOptions {
+    readonly handle: (request: MailboxRequest) => Promise<MailboxResponse>;
+    /** Errors that must stop supervision and fail the run (e.g. Temporal cancellation). */
+    readonly isFatal?: (error: unknown) => boolean;
+    readonly pollIntervalMs?: number;
+    readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    readonly onPoll?: (error?: unknown) => void;
+}
+export interface SupervisionSummary {
+    readonly handled: number;
+    readonly stoppedBy: "done" | "exited";
+}
+/**
+ * Worker side of the sandbox mailbox: polls the live sandbox for verify requests written by the
+ * agent's `verify` tool, runs the handler, and writes the response the tool is blocking on. Stops
+ * when the wrapper writes the done marker or the command exits.
+ */
+export declare function superviseMailbox(sandbox: LiveSandbox, exited: AbortSignal, options: SuperviseOptions): Promise<SupervisionSummary>;
+//# sourceMappingURL=supervisor.d.ts.map

package/dist/sandbox/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/sandbox/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,gBAAgB,2BAAkC,CAAC;AAChE,eAAO,MAAM,iBAAiB,4BAAmC,CAAC;AAClE,eAAO,MAAM,YAAY,uBAA8B,CAAC;AAGxD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqC7B"}

package/dist/sandbox/supervisor.js

@@ -0,0 +1,126 @@
+export const MAILBOX_DIRECTORY = "/work/mailbox";
+export const MAILBOX_REQUESTS = `${MAILBOX_DIRECTORY}/requests`;
+export const MAILBOX_RESPONSES = `${MAILBOX_DIRECTORY}/responses`;
+export const MAILBOX_DONE = `${MAILBOX_DIRECTORY}/done`;
+const DEFAULT_POLL_INTERVAL_MS = 10_000;
+/**
+ * Worker side of the sandbox mailbox: polls the live sandbox for verify requests written by the
+ * agent's `verify` tool, runs the handler, and writes the response the tool is blocking on. Stops
+ * when the wrapper writes the done marker or the command exits.
+ */
+export async function superviseMailbox(sandbox, exited, options) {
+    const seen = new Set();
+    const sleep = options.sleep ?? abortableSleep;
+    const interval = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    let handled = 0;
+    while (true) {
+        let done = false;
+        try {
+            for (const id of await listRequests(sandbox)) {
+                if (seen.has(id) || exited.aborted) {
+                    continue;
+                }
+                seen.add(id);
+                const bytes = await sandbox.readFile(`${MAILBOX_REQUESTS}/${id}.json`);
+                if (!bytes) {
+                    continue;
+                }
+                const response = await respond(id, bytes, options);
+                handled += 1;
+                await writeResponse(sandbox, response);
+            }
+            done = (await sandbox.readFile(MAILBOX_DONE)) !== undefined;
+            options.onPoll?.();
+        }
+        catch (error) {
+            if (options.isFatal?.(error)) {
+                throw error;
+            }
+            options.onPoll?.(error);
+        }
+        if (done) {
+            return { handled, stoppedBy: "done" };
+        }
+        if (exited.aborted) {
+            return { handled, stoppedBy: "exited" };
+        }
+        await sleep(interval, exited);
+    }
+}
+async function respond(id, bytes, options) {
+    let request;
+    try {
+        request = parseRequest(id, bytes);
+    }
+    catch (error) {
+        return { id, kind: "error", message: `unreadable verify request: ${messageOf(error)}` };
+    }
+    try {
+        return await options.handle(request);
+    }
+    catch (error) {
+        if (options.isFatal?.(error)) {
+            throw error;
+        }
+        return { id, kind: "error", message: `verification failed on the worker: ${messageOf(error)}` };
+    }
+}
+async function listRequests(sandbox) {
+    const listing = await sandbox.execute([
+        "sh",
+        "-c",
+        `ls -1 ${MAILBOX_REQUESTS} 2>/dev/null || true`,
+    ]);
+    return listing.stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.endsWith(".json"))
+        .map((line) => line.slice(0, -".json".length))
+        .filter((id) => /^[A-Za-z0-9._-]+$/.test(id))
+        .sort();
+}
+async function writeResponse(sandbox, response) {
+    const final = `${MAILBOX_RESPONSES}/${response.id}.json`;
+    const temporary = `${final}.tmp`;
+    await sandbox.writeFile(temporary, `${JSON.stringify(response)}\n`);
+    const moved = await sandbox.execute(["sh", "-c", `mv -f ${temporary} ${final}`]);
+    if (moved.exitCode !== 0) {
+        throw new Error(`could not deliver verify response ${response.id}: ${moved.stderr}`);
+    }
+}
+function parseRequest(id, bytes) {
+    const parsed = JSON.parse(Buffer.from(bytes).toString("utf8"));
+    if ((parsed.kind !== "task" && parsed.kind !== "fix") ||
+        typeof parsed.testPatch !== "string" ||
+        parsed.definition === undefined ||
+        (parsed.goldPatch !== undefined && typeof parsed.goldPatch !== "string")) {
+        throw new Error("request must carry kind, definition, and testPatch");
+    }
+    return {
+        id,
+        kind: parsed.kind,
+        definition: parsed.definition,
+        testPatch: parsed.testPatch,
+        ...(parsed.goldPatch !== undefined ? { goldPatch: parsed.goldPatch } : {}),
+    };
+}
+function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(finish, ms);
+        timer.unref();
+        signal.addEventListener("abort", finish, { once: true });
+        function finish() {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", finish);
+            resolve();
+        }
+    });
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=supervisor.js.map

package/dist/sandbox/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/sandbox/supervisor.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,iBAAiB,WAAW,CAAC;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,iBAAiB,YAAY,CAAC;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,iBAAiB,OAAO,CAAC;AACxD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAkCxC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoB,EACpB,MAAmB,EACnB,OAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACpE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnC,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,IAAI,EAAE,OAAO,CAAC,CAAC;gBACvE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC,CAAC;gBACb,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS,CAAC;YAC5D,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,EAAU,EACV,KAAiB,EACjB,OAAyB;IAEzB,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAoB;IAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;QACpC,IAAI;QACJ,IAAI;QACJ,SAAS,gBAAgB,sBAAsB;KAChD,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,MAAM;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC5C,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAoB,EAAE,QAAyB;IAC1E,MAAM,KAAK,GAAG,GAAG,iBAAiB,IAAI,QAAQ,CAAC,EAAE,OAAO,CAAC;IACzD,MAAM,SAAS,GAAG,GAAG,KAAK,MAAM,CAAC;IACjC,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,KAAiB;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAC1F,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;QACjD,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,EAAU,EAAE,MAAmB;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,SAAS,MAAM;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/sandbox/timeout.d.ts

@@ -0,0 +1,16 @@
+import type { SandboxExecResult, SandboxExecutor, SandboxRequest, SandboxResult, SandboxRunOptions } from "./contracts.js";
+export declare const STANDARD_VERCEL_TIMEOUT_CAP_MS: number;
+export declare const HOBBY_VERCEL_TIMEOUT_CAP_MS: number;
+export declare const STANDARD_E2B_TIMEOUT_CAP_MS: number;
+export declare const HOBBY_E2B_TIMEOUT_CAP_MS: number;
+export declare function parseSandboxTimeoutCapText(value: string): number | undefined;
+export declare class TimeoutCappedSandboxExecutor implements SandboxExecutor {
+    #private;
+    constructor(delegate: SandboxExecutor, timeoutCapMs: number);
+    run(request: SandboxRequest, options?: SandboxRunOptions): Promise<SandboxResult>;
+    execute(sandboxId: string, command: readonly string[]): Promise<SandboxExecResult>;
+    readFile(sandboxId: string, path: string): Promise<Uint8Array | undefined>;
+    writeFile(sandboxId: string, path: string, contents: Uint8Array | string): Promise<void>;
+    close(): void;
+}
+//# sourceMappingURL=timeout.d.ts.map

package/dist/sandbox/timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../../src/sandbox/timeout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAClE,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAG3D,eAAO,MAAM,2BAA2B,QAAuB,CAAC;AAChE,eAAO,MAAM,wBAAwB,QAAkB,CAAC;AAExD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmB5E;AAED,qBAAa,4BAA6B,YAAW,eAAe;;gBAItD,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM;IAQrD,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IASvF,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIlF,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAI1E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,KAAK,IAAI,IAAI;CAGd"}

package/dist/sandbox/timeout.js

@@ -0,0 +1,53 @@
+export const STANDARD_VERCEL_TIMEOUT_CAP_MS = 2 * 60 * 60 * 1_000;
+export const HOBBY_VERCEL_TIMEOUT_CAP_MS = 45 * 60 * 1_000;
+// E2B keeps a sandbox alive for at most 24 hours on Pro and 1 hour on Hobby.
+export const STANDARD_E2B_TIMEOUT_CAP_MS = 24 * 60 * 60 * 1_000;
+export const HOBBY_E2B_TIMEOUT_CAP_MS = 60 * 60 * 1_000;
+export function parseSandboxTimeoutCapText(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "") {
+        return undefined;
+    }
+    const match = /^(\d+)(ms|s|m|h)?$/.exec(normalized);
+    if (!match?.[1]) {
+        return Number.NaN;
+    }
+    const amount = Number(match[1]);
+    const multiplier = match[2] === "h"
+        ? 60 * 60 * 1_000
+        : match[2] === "m"
+            ? 60 * 1_000
+            : match[2] === "s"
+                ? 1_000
+                : 1;
+    return amount * multiplier;
+}
+export class TimeoutCappedSandboxExecutor {
+    #delegate;
+    #timeoutCapMs;
+    constructor(delegate, timeoutCapMs) {
+        if (!Number.isInteger(timeoutCapMs) || timeoutCapMs < 100) {
+            throw new Error("sandbox timeout cap must be an integer of at least 100ms");
+        }
+        this.#delegate = delegate;
+        this.#timeoutCapMs = timeoutCapMs;
+    }
+    async run(request, options) {
+        return await this.#delegate.run(request.timeoutMs > this.#timeoutCapMs
+            ? { ...request, timeoutMs: this.#timeoutCapMs }
+            : request, options);
+    }
+    execute(sandboxId, command) {
+        return this.#delegate.execute(sandboxId, command);
+    }
+    readFile(sandboxId, path) {
+        return this.#delegate.readFile(sandboxId, path);
+    }
+    writeFile(sandboxId, path, contents) {
+        return this.#delegate.writeFile(sandboxId, path, contents);
+    }
+    close() {
+        this.#delegate.close();
+    }
+}
+//# sourceMappingURL=timeout.js.map

package/dist/sandbox/timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../../src/sandbox/timeout.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAExD,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,UAAU,GACd,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QACd,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK;QACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAChB,CAAC,CAAC,EAAE,GAAG,KAAK;YACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAChB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,GAAG,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,4BAA4B;IAC9B,SAAS,CAAkB;IAC3B,aAAa,CAAS;IAE/B,YAAY,QAAyB,EAAE,YAAoB;QACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAuB,EAAE,OAA2B;QAC5D,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAC7B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa;YACpC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE;YAC/C,CAAC,CAAC,OAAO,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,SAAiB,EAAE,OAA0B;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,QAAQ,CAAC,SAAiB,EAAE,IAAY;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,IAAY,EAAE,QAA6B;QACtE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}