sliccy 3.5.4 → 3.6.0

package/dist/node-server/_cloud_core/src/operations/start.js

@@ -0,0 +1,228 @@
+import { CloudError } from '../errors.js';
+import { filterSecretsEnv } from '../secrets-filter.js';
+import { pollCloudStatus } from '../polling.js';
+/** Fetch the last n lines of /tmp/slicc-stderr.log from inside the sandbox. */
+async function tailStderr(handle, n) {
+    try {
+        const raw = await handle.readFile('/tmp/slicc-stderr.log');
+        const lines = raw.split('\n');
+        return lines.slice(Math.max(0, lines.length - n)).join('\n');
+    }
+    catch (err) {
+        // Discriminate "file absent" (acceptable fallback) from other errors
+        // (substrate read failure — worth surfacing for debug).
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/ENOENT|not found/i.test(msg)) {
+            return '(no /tmp/slicc-stderr.log produced)';
+        }
+        return `(failed to read /tmp/slicc-stderr.log: ${msg})`;
+    }
+}
+function parseCapLimit(name, raw) {
+    const n = Number.parseInt(raw, 10);
+    if (!Number.isFinite(n) || n < 0) {
+        throw new Error(`Invalid cap env ${name}=${JSON.stringify(raw)}: must be a non-negative integer`);
+    }
+    return n;
+}
+/**
+ * Reserve a slot in the registry atomically under DO lock, BEFORE substrate.create.
+ * Returns a synthetic reservationId (pending-<uuid>) that counts toward the cap.
+ * Throws CloudError('CAP_EXCEEDED' | 'NAME_TAKEN') on conflict.
+ *
+ * Callers MUST wrap this in blockConcurrencyWhile so two concurrent calls
+ * serialize and the second sees the first's placeholder.
+ */
+export async function reserveSlot(deps, opts) {
+    const reservationId = `pending-${crypto.randomUUID()}`;
+    const createdAt = new Date().toISOString();
+    // Read existing entries to enforce caps + name conflicts.
+    // If caller provided a pre-reconciled list (worker DO path), use it directly.
+    // Otherwise (CLI path), do a full reconciliation via listCones.
+    let existing;
+    if (opts.reconciledCones) {
+        existing = opts.reconciledCones;
+    }
+    else {
+        const { listCones } = await import('./list.js');
+        existing = await listCones(deps, opts.userId ? { metadata: { userId: opts.userId } } : {});
+    }
+    // Cap check: count both running and reserved entries (reservations count as running)
+    if (opts.env) {
+        const running = existing.filter((e) => e.state === 'running' || e.state === 'reserved').length;
+        const paused = existing.filter((e) => e.state === 'paused').length;
+        const runningCap = parseCapLimit('CONE_CAP_RUNNING', opts.env.CONE_CAP_RUNNING);
+        const pausedCap = parseCapLimit('CONE_CAP_PAUSED', opts.env.CONE_CAP_PAUSED);
+        if (running >= runningCap) {
+            throw new CloudError('CAP_EXCEEDED', `at running cap (${running}/${runningCap})`, {
+                running,
+                cap: runningCap,
+            });
+        }
+        if (paused >= pausedCap) {
+            throw new CloudError('CAP_EXCEEDED', `at paused cap (${paused}/${pausedCap})`, {
+                paused,
+                cap: pausedCap,
+            });
+        }
+    }
+    // Name conflict check
+    const requestedName = opts.name?.trim();
+    if (requestedName && existing.some((e) => e.state !== 'dead' && e.name === requestedName)) {
+        throw new CloudError('NAME_TAKEN', `cloud session name already exists: ${requestedName}`);
+    }
+    // Append placeholder entry with 'reserved' state
+    const placeholder = {
+        substrate: deps.substrate.id,
+        sandboxId: reservationId,
+        name: requestedName,
+        createdAt,
+        lastSeen: createdAt,
+        state: 'reserved',
+        reservedAt: createdAt,
+        joinUrl: '',
+        metadata: opts.metadata,
+    };
+    await deps.registry.append(placeholder);
+    return { reservationId };
+}
+export async function startCone(deps, opts) {
+    const safeSecrets = filterSecretsEnv(opts.envContents);
+    // Track whichever registry entry is currently live, for cleanup on failure.
+    let activeRegistryId = opts.reservationId;
+    let handle;
+    try {
+        // Wrap create inside try block to ensure reservation cleanup on failure.
+        handle = await deps.substrate.create({
+            template: opts.template ?? 'slicc',
+            autoPauseOnCap: opts.autoPauseOnCap ?? true,
+            envVars: {
+                SLICC_TRAY_WORKER_BASE_URL: opts.workerBaseUrl,
+                ...(opts.envs ?? {}),
+            },
+            metadata: {
+                sliccVersion: opts.sliccVersion,
+                ...(opts.name ? { name: opts.name } : {}),
+                ...(opts.metadata ?? {}),
+            },
+            name: opts.name,
+        });
+        // Capture freshness baseline AFTER sandbox creation: any /tmp/slicc-join.json
+        // with updatedAt at or before this ISO is from the template snapshot, not
+        // the new sandbox's leader. Subtract a small skew margin for clock drift
+        // between the worker fetching this timestamp and the sandbox writing the
+        // file: the sandbox's clock might be slightly behind, so a tiny margin
+        // gives the leader's first real write a chance to be accepted.
+        const minUpdatedAt = new Date(Date.now() - 5_000).toISOString();
+        const createdAt = new Date().toISOString();
+        // Update or append placeholder depending on whether we have a reservation.
+        // If reservationId is provided, update it to the real sandboxId and remove the old entry.
+        // Otherwise, append a new placeholder as before.
+        //
+        // The placeholder ensures concurrent /list-cones calls see the cone in the registry
+        // (pass 1) instead of treating it as an orphan (pass 2). The empty joinUrl
+        // means the dashboard hides the Open button until pollCloudStatus completes
+        // and the entry is updated below. State is 'reserved' until poll completes.
+        if (opts.reservationId) {
+            // Remove the reservation entry and append the real one
+            await deps.registry.remove(opts.reservationId);
+            const placeholder = {
+                substrate: deps.substrate.id,
+                sandboxId: handle.sandboxId,
+                name: opts.name,
+                createdAt,
+                lastSeen: createdAt,
+                state: 'reserved',
+                joinUrl: '',
+                metadata: opts.metadata,
+            };
+            await deps.registry.append(placeholder);
+            // After swapping, the real sandboxId is the active registry key.
+            activeRegistryId = handle.sandboxId;
+        }
+        else {
+            // Legacy path: no reservation, append directly
+            const placeholder = {
+                substrate: deps.substrate.id,
+                sandboxId: handle.sandboxId,
+                name: opts.name,
+                createdAt,
+                lastSeen: createdAt,
+                state: 'reserved',
+                joinUrl: '',
+            };
+            await deps.registry.append(placeholder);
+            // The newly-appended sandboxId is the active registry key.
+            activeRegistryId = handle.sandboxId;
+        }
+        // Two-layer secrets bootstrap (see Plan B):
+        //   1. start.sh writes /slicc/secrets.env from $ADOBE_IMS_TOKEN if the file
+        //      doesn't already exist (fallback for race-free worker path where env-vars
+        //      arrive before this writeFile lands).
+        //   2. THIS writeFile uploads the full filtered secrets.env. Worker overwrites
+        //      with Adobe-only content (effectively a no-op since start.sh already wrote
+        //      the same token). CLI overwrites with non-Adobe secrets (GitHub PATs, S3
+        //      keys, etc.), load-bearing for CLI-launched cones. The CLI race is benign
+        //      because the page-side bootstrap polls /api/hosted-bootstrap after a 5s
+        //      delay, by which time this writeFile has landed.
+        await handle.writeFile('/slicc/secrets.env', safeSecrets);
+        let status;
+        try {
+            status = await pollCloudStatus(handle, {
+                timeoutMs: opts.pollTimeoutMs ?? 60_000,
+                intervalMs: opts.pollIntervalMs ?? 500,
+                minUpdatedAt,
+            });
+        }
+        catch (pollErr) {
+            // Surface boot diagnostics before tearing down. Spec failure mode #7.
+            const stderr = await tailStderr(handle, 50);
+            throw new CloudError('SANDBOX_NOT_READY', `${pollErr instanceof Error ? pollErr.message : String(pollErr)}\n` +
+                `--- last 50 lines of /tmp/slicc-stderr.log ---\n${stderr}`, { sandboxId: handle.sandboxId });
+        }
+        // Promote the placeholder to a fully-populated running entry.
+        await deps.registry.update(handle.sandboxId, {
+            state: 'running',
+            joinUrl: status.joinUrl,
+            trayId: status.trayId,
+            lastJoinUpdatedAt: status.updatedAt,
+            lastSeen: new Date().toISOString(),
+        });
+        return {
+            sandboxId: handle.sandboxId,
+            name: opts.name,
+            joinUrl: status.joinUrl,
+        };
+    }
+    catch (err) {
+        // Best-effort cleanup: remove whichever registry entry is currently active.
+        if (activeRegistryId) {
+            try {
+                await deps.registry.remove(activeRegistryId);
+            }
+            catch (cleanupErr) {
+                const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+                console.warn('[cloud-core] start cleanup', {
+                    phase: 'registry-remove',
+                    sandboxId: activeRegistryId,
+                    err: msg,
+                });
+            }
+        }
+        // Always kill the real sandbox if it was created (handle exists at this point)
+        if (handle) {
+            try {
+                await handle.kill();
+            }
+            catch (cleanupErr) {
+                const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+                console.warn('[cloud-core] start cleanup', {
+                    phase: 'handle-kill',
+                    sandboxId: handle.sandboxId,
+                    err: msg,
+                });
+            }
+        }
+        throw err;
+    }
+}

package/dist/node-server/_cloud_core/src/polling.d.ts

@@ -0,0 +1,18 @@
+import type { SandboxHandle } from './substrate.js';
+import type { CloudStatus } from './types.js';
+export interface PollOpts {
+    timeoutMs: number;
+    intervalMs: number;
+    /**
+     * Reject reads where `updatedAt` is `<=` this ISO timestamp. Required when
+     * polling from a fresh sandbox built from a template snapshot — the
+     * template-build leaves a stale /tmp/slicc-join.json baked in, so without
+     * a freshness floor the first poll returns the build-time tray URL.
+     * Caller should pass an ISO timestamp captured at the moment substrate.create()
+     * completed. If unset (CLI legacy callers), no freshness check is applied.
+     */
+    minUpdatedAt?: string;
+}
+export declare function pollCloudStatus(handle: SandboxHandle, opts: PollOpts): Promise<CloudStatus>;
+export declare function pollForRefreshedStatus(handle: SandboxHandle, baselineUpdatedAt: string | undefined, opts: PollOpts): Promise<CloudStatus>;
+//# sourceMappingURL=polling.d.ts.map

package/dist/node-server/_cloud_core/src/polling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polling.d.ts","sourceRoot":"","sources":["../../src/polling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAiCjG;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,WAAW,CAAC,CAwCtB"}

package/dist/node-server/_cloud_core/src/polling.js

@@ -0,0 +1,79 @@
+import { CloudError } from './errors.js';
+export async function pollCloudStatus(handle, opts) {
+    const start = Date.now();
+    let lastError = null;
+    let lastStalePayload = null;
+    while (Date.now() - start < opts.timeoutMs) {
+        try {
+            const raw = await handle.readFile('/tmp/slicc-join.json');
+            const parsed = JSON.parse(raw);
+            if (parsed.joinUrl) {
+                if (!opts.minUpdatedAt)
+                    return parsed;
+                if (parsed.updatedAt && parsed.updatedAt > opts.minUpdatedAt)
+                    return parsed;
+                lastStalePayload = parsed;
+            }
+        }
+        catch (err) {
+            lastError = err;
+        }
+        await new Promise((r) => setTimeout(r, opts.intervalMs));
+    }
+    let errSuffix = '';
+    if (lastStalePayload) {
+        errSuffix =
+            ` (file present but stale: minUpdatedAt=${opts.minUpdatedAt}, ` +
+                `current.updatedAt=${lastStalePayload.updatedAt}, ` +
+                `current.trayId=${lastStalePayload.trayId})`;
+    }
+    else if (lastError) {
+        errSuffix = ` (last error: ${lastError instanceof Error ? lastError.message : String(lastError)})`;
+    }
+    else {
+        errSuffix = ' (file never appeared)';
+    }
+    throw new CloudError('SANDBOX_NOT_READY', `cloud-status did not appear within ${opts.timeoutMs}ms; sandbox may have failed to boot${errSuffix}`);
+}
+export async function pollForRefreshedStatus(handle, baselineUpdatedAt, opts) {
+    const start = Date.now();
+    let lastError = null;
+    let lastStalePayload = null;
+    while (Date.now() - start < opts.timeoutMs) {
+        try {
+            const raw = await handle.readFile('/tmp/slicc-join.json');
+            const parsed = JSON.parse(raw);
+            if (parsed.joinUrl) {
+                // Require a STRICTLY newer updatedAt than the registry baseline.
+                // If we have no baseline (first-time resume of an externally-created
+                // sandbox), accept any well-formed read.
+                if (!baselineUpdatedAt)
+                    return parsed;
+                if (parsed.updatedAt && parsed.updatedAt > baselineUpdatedAt) {
+                    return parsed;
+                }
+                // File exists, joinUrl present, but updatedAt unchanged — capture for
+                // the timeout error so we can tell "missing" from "stale".
+                lastStalePayload = parsed;
+            }
+        }
+        catch (err) {
+            lastError = err;
+        }
+        await new Promise((r) => setTimeout(r, opts.intervalMs));
+    }
+    let errSuffix = '';
+    if (lastStalePayload) {
+        errSuffix =
+            ` (file present but stale: baseline.updatedAt=${baselineUpdatedAt}, ` +
+                `current.updatedAt=${lastStalePayload.updatedAt}, ` +
+                `current.trayId=${lastStalePayload.trayId})`;
+    }
+    else if (lastError) {
+        errSuffix = ` (last error: ${lastError instanceof Error ? lastError.message : String(lastError)})`;
+    }
+    else {
+        errSuffix = ' (file never appeared)';
+    }
+    throw new CloudError('LEADER_NOT_READY', `cloud-status did not refresh within ${opts.timeoutMs}ms${errSuffix}`);
+}

package/dist/node-server/_cloud_core/src/registry.d.ts

@@ -0,0 +1,27 @@
+import type { ConeEntry } from './types.js';
+/**
+ * Per-user (or per-machine) registry of cloud cones. Two implementations:
+ *  - node-server uses `FileRegistry` (backed by ~/.slicc/cloud-sessions.json)
+ *  - cloudflare-worker uses `LocalRegistry` (backed by DurableObject storage)
+ *
+ * Both implementations:
+ *  - Persist the `{ sessions: ConeEntry[] }` JSON shape (legacy schema, do not
+ *    rename — existing CLI files in the wild depend on it).
+ *  - Have UPSERT semantics on `append`: replacing an entry by sandboxId, not
+ *    throwing on duplicate. Same upsert behavior as the previous file-backed
+ *    implementation and is load-bearing for reconciliation passes.
+ */
+export interface Registry {
+    /** Read all entries. */
+    list(): Promise<ConeEntry[]>;
+    /** Resolve a query (sandboxId OR name) to a single entry, or null. */
+    findByNameOrId(query: string): Promise<ConeEntry | null>;
+    /** Add or replace an entry. Idempotent: re-appending an existing sandboxId
+     * replaces the previous record in place. */
+    append(entry: ConeEntry): Promise<void>;
+    /** Partial update by sandboxId. Throws if not found. */
+    update(sandboxId: string, patch: Partial<ConeEntry>): Promise<void>;
+    /** Remove by sandboxId. Idempotent — no-op if absent. */
+    remove(sandboxId: string): Promise<void>;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/node-server/_cloud_core/src/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ;IACvB,wBAAwB;IACxB,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7B,sEAAsE;IACtE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD;gDAC4C;IAC5C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,wDAAwD;IACxD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,yDAAyD;IACzD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C"}

package/dist/node-server/_cloud_core/src/registry.js

@@ -0,0 +1 @@
+export {};

package/dist/node-server/_cloud_core/src/secrets-filter.d.ts

@@ -0,0 +1,2 @@
+export declare function filterSecretsEnv(contents: string): string;
+//# sourceMappingURL=secrets-filter.d.ts.map

package/dist/node-server/_cloud_core/src/secrets-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-filter.d.ts","sourceRoot":"","sources":["../../src/secrets-filter.ts"],"names":[],"mappings":"AAQA,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQzD"}

package/dist/node-server/_cloud_core/src/secrets-filter.js

@@ -0,0 +1,17 @@
+/**
+ * Strip locally-only keys from secrets.env before upload. E2B_API_KEY is the
+ * user's substrate credential — there is no reason for it to live inside the
+ * cloud sandbox where the cone could use it to spawn additional sandboxes
+ * against the user's e2b account. Keep this list narrow.
+ */
+const SECRETS_STRIP_KEYS = ['E2B_API_KEY', 'E2B_API_KEY_DOMAINS'];
+export function filterSecretsEnv(contents) {
+    const out = [];
+    for (const line of contents.split('\n')) {
+        const m = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+        if (m && SECRETS_STRIP_KEYS.includes(m[1]))
+            continue;
+        out.push(line);
+    }
+    return out.join('\n');
+}

package/dist/node-server/_cloud_core/src/substrate-factory.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxSubstrate, SubstrateConfig, SubstrateId } from './substrate.js';
+export declare function createSubstrate(id: SubstrateId, cfg: SubstrateConfig): SandboxSubstrate;
+//# sourceMappingURL=substrate-factory.d.ts.map

package/dist/node-server/_cloud_core/src/substrate-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"substrate-factory.d.ts","sourceRoot":"","sources":["../../src/substrate-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGrF,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAGvF"}

package/dist/node-server/_cloud_core/src/substrate-factory.js

@@ -0,0 +1,6 @@
+import { createE2bSubstrate } from './substrates/e2b.js';
+export function createSubstrate(id, cfg) {
+    if (id === 'e2b')
+        return createE2bSubstrate(cfg);
+    throw new Error(`unknown substrate: ${id}`);
+}

package/dist/node-server/_cloud_core/src/substrate.d.ts

@@ -0,0 +1,53 @@
+import type { SandboxSummary } from './types.js';
+export type SubstrateId = 'e2b';
+export interface SubstrateConfig {
+    /** Credential for the substrate (e.g. E2B_API_KEY). */
+    apiKey: string;
+}
+export interface CreateOpts {
+    template: string;
+    envVars: Record<string, string>;
+    metadata: Record<string, string>;
+    autoPauseOnCap: boolean;
+    name?: string;
+}
+export interface SandboxInfo {
+    sandboxId: string;
+    state: 'running' | 'paused' | 'dead';
+    metadata: Record<string, string>;
+    createdAt: string;
+}
+export interface RunResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export interface SandboxHandle {
+    readonly sandboxId: string;
+    readonly substrate: SubstrateId;
+    pause(): Promise<void>;
+    kill(): Promise<void>;
+    getInfo(): Promise<SandboxInfo>;
+    writeFile(path: string, contents: string | Uint8Array): Promise<void>;
+    readFile(path: string): Promise<string>;
+    run(cmd: string): Promise<RunResult>;
+}
+export interface ListOpts {
+    metadata?: Record<string, string>;
+}
+export interface SandboxSubstrate {
+    readonly id: SubstrateId;
+    create(opts: CreateOpts): Promise<SandboxHandle>;
+    connect(sandboxId: string): Promise<SandboxHandle>;
+    list(opts?: ListOpts): Promise<SandboxSummary[]>;
+    /**
+     * Reset the sandbox's auto-pause countdown. The substrate-specific TTL
+     * floor applies (e.g. e2b Hobby plan caps at 1h, Pro at 24h). For non-e2b
+     * substrates that don't support this concept, implement as a no-op.
+     */
+    extendTimeout(sandboxId: string, ttlMs: number): Promise<void>;
+}
+export interface SubstrateFactory {
+    (id: SubstrateId, cfg: SubstrateConfig): SandboxSubstrate;
+}
+//# sourceMappingURL=substrate.d.ts.map

package/dist/node-server/_cloud_core/src/substrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"substrate.d.ts","sourceRoot":"","sources":["../../src/substrate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,MAAM,MAAM,WAAW,GAAG,KAAK,CAAC;AAEhC,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAChC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAAC;CAC3D"}

package/dist/node-server/_cloud_core/src/substrate.js

@@ -0,0 +1 @@
+export {};

package/dist/node-server/_cloud_core/src/substrates/e2b.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxSubstrate, SubstrateConfig } from '../substrate.js';
+export declare function createE2bSubstrate(cfg: SubstrateConfig): SandboxSubstrate;
+//# sourceMappingURL=e2b.d.ts.map

package/dist/node-server/_cloud_core/src/substrates/e2b.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2b.d.ts","sourceRoot":"","sources":["../../../src/substrates/e2b.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAKV,gBAAgB,EAChB,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAKzB,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAmDzE"}

package/dist/node-server/_cloud_core/src/substrates/e2b.js

@@ -0,0 +1,98 @@
+import { Sandbox } from 'e2b';
+const DEFAULT_TTL_MS = 60 * 60 * 1000; // 1 hour
+export function createE2bSubstrate(cfg) {
+    // Capture apiKey locally to pass explicitly to every SDK call (worker-safe).
+    const apiKey = cfg.apiKey;
+    return {
+        id: 'e2b',
+        async create(opts) {
+            const sbx = await Sandbox.create(opts.template, {
+                apiKey,
+                envs: opts.envVars,
+                metadata: opts.metadata,
+                timeoutMs: DEFAULT_TTL_MS,
+                ...(opts.autoPauseOnCap ? { lifecycle: { onTimeout: 'pause' } } : {}),
+            });
+            return wrap(sbx);
+        },
+        async connect(sandboxId) {
+            const sbx = await Sandbox.connect(sandboxId, { apiKey });
+            return wrap(sbx);
+        },
+        async list(opts) {
+            // The e2b SDK accepts query.metadata for server-side filtering.
+            // Pass it through if provided.
+            const paginator = Sandbox.list({
+                apiKey,
+                ...(opts?.metadata ? { query: { metadata: opts.metadata } } : {}),
+            });
+            const items = [];
+            while (paginator.hasNext) {
+                const page = await paginator.nextItems();
+                for (const info of page) {
+                    // The SDK's `templateId` is the immutable hash (e.g. cjd0k6foq…);
+                    // the alias 'slicc' is on `info.name`. Filter on the alias.
+                    if (info.name === 'slicc') {
+                        items.push({
+                            sandboxId: info.sandboxId,
+                            // Sandbox name (user-supplied `--name`) lives in metadata.
+                            // info.name is the *template* name.
+                            name: info.metadata?.['name'],
+                            state: mapState(info.state),
+                            metadata: info.metadata,
+                        });
+                    }
+                }
+            }
+            return items;
+        },
+        async extendTimeout(sandboxId, ttlMs) {
+            await Sandbox.setTimeout(sandboxId, ttlMs, { apiKey });
+        },
+    };
+}
+function wrap(sbx) {
+    return {
+        sandboxId: sbx.sandboxId,
+        substrate: 'e2b',
+        async pause() {
+            await sbx.pause();
+        },
+        async kill() {
+            await sbx.kill();
+        },
+        async getInfo() {
+            const info = await sbx.getInfo();
+            return {
+                sandboxId: sbx.sandboxId,
+                state: mapState(info.state),
+                metadata: info.metadata,
+                createdAt: info.startedAt.toISOString(),
+            };
+        },
+        async writeFile(path, contents) {
+            // The e2b SDK accepts string | ArrayBuffer | Blob | ReadableStream.
+            // If contents is Uint8Array, convert to Blob to avoid ArrayBufferLike issues.
+            const data = contents instanceof Uint8Array ? new Blob([contents]) : contents;
+            await sbx.files.write(path, data);
+        },
+        async readFile(path) {
+            return sbx.files.read(path);
+        },
+        async run(cmd) {
+            const result = await sbx.commands.run(cmd);
+            return {
+                stdout: result.stdout,
+                stderr: result.stderr,
+                exitCode: result.exitCode,
+            };
+        },
+    };
+}
+function mapState(s) {
+    // The e2b SDK only returns 'running' or 'paused'. Map appropriately.
+    if (s === 'running' || s === 'paused')
+        return s;
+    // Unreachable in practice, but TypeScript needs this to satisfy the return type.
+    return 'dead';
+}