sliccy 4.26.0 → 4.27.1

package/dist/node-server/_cloud_core/src/cone-config/index.d.ts

@@ -74,4 +74,25 @@ export declare function bundleIndex(cfg: ConeConfig): ConeConfigIndex;
 /** Portable base64 of a UTF-8 string (worker/browser/node all have btoa+TextEncoder). */
 export declare function encodeBundleEnv(json: string): string;
 export declare function decodeBundleEnv(b64: string): string;
+/**
+ * Best-effort expiry (epoch ms) of an Adobe IMS access token, for stamping
+ * onto a synthesized Adobe `OAuthAccount.tokenExpiresAt`.
+ *
+ * Why it matters: a window-less kernel-worker cone must not treat a still-valid
+ * token as expired. The webapp's `getValidAccessToken` (providers/adobe.ts)
+ * returns the token only while `tokenExpiresAt` is in the future; otherwise it
+ * attempts a silent renewal that ALWAYS returns null in a worker (no `window`)
+ * and then throws "Adobe session expired". Without an expiry the account
+ * defaults to `tokenExpiresAt ?? 0`, so the very first turn fails. Every site
+ * that synthesizes an Adobe oauth account from a bare IMS bearer — node-server's
+ * legacy-token branch and the worker's back-compat + resume paths — must stamp
+ * this or reintroduce that failure mode.
+ *
+ * IMS access tokens are JWTs whose payload carries `created_at` + `expires_in`
+ * (both epoch ms). Returns `created_at + expires_in`, or `undefined` for opaque
+ * / unparseable tokens (callers then leave `tokenExpiresAt` unset — prior
+ * behavior). Side-effect- and dependency-free (`atob`, not `node:Buffer`) so it
+ * is safe to call from the CF Worker and the browser as well as node-server.
+ */
+export declare function imsTokenExpiry(token: string): number | undefined;
 //# sourceMappingURL=index.d.ts.map

package/dist/node-server/_cloud_core/src/cone-config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cone-config/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC;IAC3D,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAMhD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAS7D;AA6DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAiDvE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,UAAU,CAYpF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAOlE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAM7F;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAW5D;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cone-config/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC;IAC3D,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAMhD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAS7D;AAyGD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAWvE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,UAAU,CAYpF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAOlE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAM7F;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAW5D;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAWD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBhE"}

package/dist/node-server/_cloud_core/src/cone-config/index.js

@@ -83,6 +83,48 @@ function validateSecret(s) {
     }
     return { name: sec.name, value: sec.value, domains: sec.domains };
 }
+/** Validate the `upsert` arm of a resume delta (accounts/secrets reuse the full-bundle validators). */
+function validateDeltaUpsert(input) {
+    if (!input || typeof input !== 'object') {
+        throw new Error('cone-config: delta.upsert must be an object');
+    }
+    const up = input;
+    const upsert = {};
+    if (up.accounts !== undefined) {
+        if (!Array.isArray(up.accounts)) {
+            throw new Error('cone-config: delta.upsert.accounts must be an array');
+        }
+        upsert.accounts = up.accounts.map((a) => validateAccount(a));
+    }
+    if (up.secrets !== undefined) {
+        if (!Array.isArray(up.secrets)) {
+            throw new Error('cone-config: delta.upsert.secrets must be an array');
+        }
+        upsert.secrets = up.secrets.map((s) => validateSecret(s));
+    }
+    return upsert;
+}
+/** Validate the `delete` arm of a resume delta (provider-id / secret-name string lists). */
+function validateDeltaDelete(input) {
+    if (!input || typeof input !== 'object') {
+        throw new Error('cone-config: delta.delete must be an object');
+    }
+    const del = input;
+    const deletion = {};
+    if (del.providerIds !== undefined) {
+        if (!Array.isArray(del.providerIds) || !del.providerIds.every(isStr)) {
+            throw new Error('cone-config: delta.delete.providerIds must be string[]');
+        }
+        deletion.providerIds = del.providerIds;
+    }
+    if (del.secretNames !== undefined) {
+        if (!Array.isArray(del.secretNames) || !del.secretNames.every(isStr)) {
+            throw new Error('cone-config: delta.delete.secretNames must be string[]');
+        }
+        deletion.secretNames = del.secretNames;
+    }
+    return deletion;
+}
 /**
  * Validate an untrusted resume delta (the worker receives it as `unknown`).
  * Nested accounts/secrets go through the same validators as a full bundle, so a
@@ -99,46 +141,10 @@ export function validateConeConfigDelta(input) {
             throw new Error('cone-config: delta.model must be a string');
         out.model = d.model;
     }
-    if (d.upsert !== undefined) {
-        if (!d.upsert || typeof d.upsert !== 'object') {
-            throw new Error('cone-config: delta.upsert must be an object');
-        }
-        const up = d.upsert;
-        const upsert = {};
-        if (up.accounts !== undefined) {
-            if (!Array.isArray(up.accounts)) {
-                throw new Error('cone-config: delta.upsert.accounts must be an array');
-            }
-            upsert.accounts = up.accounts.map((a) => validateAccount(a));
-        }
-        if (up.secrets !== undefined) {
-            if (!Array.isArray(up.secrets)) {
-                throw new Error('cone-config: delta.upsert.secrets must be an array');
-            }
-            upsert.secrets = up.secrets.map((s) => validateSecret(s));
-        }
-        out.upsert = upsert;
-    }
-    if (d.delete !== undefined) {
-        if (!d.delete || typeof d.delete !== 'object') {
-            throw new Error('cone-config: delta.delete must be an object');
-        }
-        const del = d.delete;
-        const deletion = {};
-        if (del.providerIds !== undefined) {
-            if (!Array.isArray(del.providerIds) || !del.providerIds.every(isStr)) {
-                throw new Error('cone-config: delta.delete.providerIds must be string[]');
-            }
-            deletion.providerIds = del.providerIds;
-        }
-        if (del.secretNames !== undefined) {
-            if (!Array.isArray(del.secretNames) || !del.secretNames.every(isStr)) {
-                throw new Error('cone-config: delta.delete.secretNames must be string[]');
-            }
-            deletion.secretNames = del.secretNames;
-        }
-        out.delete = deletion;
-    }
+    if (d.upsert !== undefined)
+        out.upsert = validateDeltaUpsert(d.upsert);
+    if (d.delete !== undefined)
+        out.delete = validateDeltaDelete(d.delete);
     return out;
 }
 export function mergeConeConfig(base, delta) {
@@ -207,3 +213,48 @@ export function decodeBundleEnv(b64) {
     const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
     return new TextDecoder().decode(bytes);
 }
+/** Decode a base64url segment (JWT alphabet) to a UTF-8 string. */
+function decodeBase64Url(seg) {
+    // base64url → base64; atob (forgiving-base64) tolerates the missing padding.
+    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/');
+    const bin = atob(b64);
+    const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+/**
+ * Best-effort expiry (epoch ms) of an Adobe IMS access token, for stamping
+ * onto a synthesized Adobe `OAuthAccount.tokenExpiresAt`.
+ *
+ * Why it matters: a window-less kernel-worker cone must not treat a still-valid
+ * token as expired. The webapp's `getValidAccessToken` (providers/adobe.ts)
+ * returns the token only while `tokenExpiresAt` is in the future; otherwise it
+ * attempts a silent renewal that ALWAYS returns null in a worker (no `window`)
+ * and then throws "Adobe session expired". Without an expiry the account
+ * defaults to `tokenExpiresAt ?? 0`, so the very first turn fails. Every site
+ * that synthesizes an Adobe oauth account from a bare IMS bearer — node-server's
+ * legacy-token branch and the worker's back-compat + resume paths — must stamp
+ * this or reintroduce that failure mode.
+ *
+ * IMS access tokens are JWTs whose payload carries `created_at` + `expires_in`
+ * (both epoch ms). Returns `created_at + expires_in`, or `undefined` for opaque
+ * / unparseable tokens (callers then leave `tokenExpiresAt` unset — prior
+ * behavior). Side-effect- and dependency-free (`atob`, not `node:Buffer`) so it
+ * is safe to call from the CF Worker and the browser as well as node-server.
+ */
+export function imsTokenExpiry(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const payload = JSON.parse(decodeBase64Url(parts[1]));
+        const created = Number(payload.created_at);
+        const ttl = Number(payload.expires_in);
+        if (Number.isFinite(created) && created > 0 && Number.isFinite(ttl) && ttl > 0) {
+            return created + ttl;
+        }
+    }
+    catch {
+        // opaque / malformed token — leave expiry unset
+    }
+    return undefined;
+}

package/dist/node-server/_cloud_core/src/index.d.ts

@@ -15,6 +15,6 @@ export type { Registry } from './registry.js';
 export { filterSecretsEnv } from './secrets-filter.js';
 export * from './substrate.js';
 export * from './substrate-factory.js';
-export { createE2bSubstrate } from './substrates/e2b.js';
+export { createE2bSubstrate, isSliccTemplate } from './substrates/e2b.js';
 export * from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/node-server/_cloud_core/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC/D,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC/D,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC1E,cAAc,YAAY,CAAC"}

package/dist/node-server/_cloud_core/src/index.js

@@ -16,5 +16,5 @@ export * from './polling.js';
 export { filterSecretsEnv } from './secrets-filter.js';
 export * from './substrate.js';
 export * from './substrate-factory.js';
-export { createE2bSubstrate } from './substrates/e2b.js';
+export { createE2bSubstrate, isSliccTemplate } from './substrates/e2b.js';
 export * from './types.js';

package/dist/node-server/_cloud_core/src/substrates/e2b.d.ts

@@ -1,3 +1,12 @@
 import type { SandboxSubstrate, SubstrateConfig } from '../substrate.js';
+/**
+ * Does an e2b template alias belong to SLICC? `Sandbox.list` returns every
+ * sandbox on the team, so we filter by template alias (`info.name`) to ignore
+ * unrelated sandboxes. We match the `slicc` PREFIX, not exact `slicc`, so cones
+ * booted from an isolated test alias (e.g. `slicc-test`, built via
+ * SLICC_E2B_TEMPLATE_NAME) still appear in `--cloud list` instead of showing as
+ * `dead`. The undefined guard keeps a nameless sandbox from throwing.
+ */
+export declare function isSliccTemplate(name: string | undefined): boolean;
 export declare function createE2bSubstrate(cfg: SubstrateConfig): SandboxSubstrate;
 //# sourceMappingURL=e2b.d.ts.map

package/dist/node-server/_cloud_core/src/substrates/e2b.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"e2b.d.ts","sourceRoot":"","sources":["../../../src/substrates/e2b.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAKV,gBAAgB,EAChB,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAKzB,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CA6DzE"}
+{"version":3,"file":"e2b.d.ts","sourceRoot":"","sources":["../../../src/substrates/e2b.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAKV,gBAAgB,EAChB,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAKzB;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CA8DzE"}

package/dist/node-server/_cloud_core/src/substrates/e2b.js

@@ -1,5 +1,16 @@
 import { Sandbox } from 'e2b';
 const DEFAULT_TTL_MS = 60 * 60 * 1000; // 1 hour
+/**
+ * Does an e2b template alias belong to SLICC? `Sandbox.list` returns every
+ * sandbox on the team, so we filter by template alias (`info.name`) to ignore
+ * unrelated sandboxes. We match the `slicc` PREFIX, not exact `slicc`, so cones
+ * booted from an isolated test alias (e.g. `slicc-test`, built via
+ * SLICC_E2B_TEMPLATE_NAME) still appear in `--cloud list` instead of showing as
+ * `dead`. The undefined guard keeps a nameless sandbox from throwing.
+ */
+export function isSliccTemplate(name) {
+    return name?.startsWith('slicc') ?? false;
+}
 export function createE2bSubstrate(cfg) {
     // Capture apiKey locally to pass explicitly to every SDK call (worker-safe).
     const apiKey = cfg.apiKey;
@@ -40,8 +51,9 @@ export function createE2bSubstrate(cfg) {
                 const page = await paginator.nextItems();
                 for (const info of page) {
                     // The SDK's `templateId` is the immutable hash (e.g. cjd0k6foq…);
-                    // the alias 'slicc' is on `info.name`. Filter on the alias.
-                    if (info.name === 'slicc') {
+                    // the alias (`slicc`, `slicc-test`, …) is on `info.name`. Filter on
+                    // the alias prefix so isolated test-template cones list too.
+                    if (isSliccTemplate(info.name)) {
                         items.push({
                             sandboxId: info.sandboxId,
                             // Sandbox name (user-supplied `--name`) lives in metadata.

package/dist/node-server/_cloud_core/tests/cone-config/cone-config.test.js

@@ -1,5 +1,18 @@
 import { describe, expect, it } from 'vitest';
-import { bundleIndex, bundleToFiles, decodeBundleEnv, encodeBundleEnv, MAX_CONE_CONFIG_BYTES, mergeConeConfig, serializeSecretsEnv, validateConeConfig, validateConeConfigDelta, } from '../../src/cone-config/index.js';
+import { bundleIndex, bundleToFiles, decodeBundleEnv, encodeBundleEnv, imsTokenExpiry, MAX_CONE_CONFIG_BYTES, mergeConeConfig, serializeSecretsEnv, validateConeConfig, validateConeConfigDelta, } from '../../src/cone-config/index.js';
+/**
+ * Build a fake Adobe IMS access token (JWT) with the given timing claims,
+ * using the portable base64url encoding that `imsTokenExpiry` decodes via
+ * `atob` (no node:Buffer — this helper runs in the CF Worker too).
+ */
+function fakeImsJwt(createdAt, expiresIn) {
+    const b64url = (o) => btoa(JSON.stringify(o)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return [
+        b64url({ alg: 'RS256', typ: 'JWT' }),
+        b64url({ created_at: String(createdAt), expires_in: String(expiresIn), type: 'access_token' }),
+        'sig',
+    ].join('.');
+}
 const base = {
     model: 'anthropic:claude-opus-4-6',
     accounts: [
@@ -117,3 +130,23 @@ describe('base64 env round-trip', () => {
         expect(MAX_CONE_CONFIG_BYTES).toBeGreaterThan(0);
     });
 });
+describe('imsTokenExpiry', () => {
+    it('returns created_at + expires_in for a JWT IMS token', () => {
+        expect(imsTokenExpiry(fakeImsJwt(1_780_000_000_000, 86_400_000))).toBe(1_780_000_000_000 + 86_400_000);
+    });
+    it('returns undefined for an opaque (non-JWT) token', () => {
+        expect(imsTokenExpiry('opaque-token')).toBeUndefined();
+    });
+    it('returns undefined when the JWT payload lacks timing claims', () => {
+        const b64url = (o) => btoa(JSON.stringify(o)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+        const token = [b64url({ alg: 'RS256' }), b64url({ sub: 'x' }), 'sig'].join('.');
+        expect(imsTokenExpiry(token)).toBeUndefined();
+    });
+    it('returns undefined when timing claims are non-positive', () => {
+        expect(imsTokenExpiry(fakeImsJwt(0, 86_400_000))).toBeUndefined();
+        expect(imsTokenExpiry(fakeImsJwt(1_780_000_000_000, 0))).toBeUndefined();
+    });
+    it('returns undefined for a malformed base64 payload', () => {
+        expect(imsTokenExpiry('a.!!!notbase64!!!.c')).toBeUndefined();
+    });
+});

package/dist/node-server/_cloud_core/tests/e2b-substrate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=e2b-substrate.test.d.ts.map

package/dist/node-server/_cloud_core/tests/e2b-substrate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2b-substrate.test.d.ts","sourceRoot":"","sources":["../../tests/e2b-substrate.test.ts"],"names":[],"mappings":""}

package/dist/node-server/_cloud_core/tests/e2b-substrate.test.js

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest';
+import { isSliccTemplate } from '../src/substrates/e2b.js';
+describe('isSliccTemplate (e2b list alias filter)', () => {
+    it('matches the production slicc alias', () => {
+        expect(isSliccTemplate('slicc')).toBe(true);
+    });
+    it('matches isolated test aliases (slicc-test) so they list instead of showing dead', () => {
+        expect(isSliccTemplate('slicc-test')).toBe(true);
+        expect(isSliccTemplate('slicc-pr-1108')).toBe(true);
+    });
+    it('rejects unrelated team templates', () => {
+        expect(isSliccTemplate('base')).toBe(false);
+        expect(isSliccTemplate('not-slicc')).toBe(false);
+    });
+    it('rejects a nameless sandbox without throwing', () => {
+        expect(isSliccTemplate(undefined)).toBe(false);
+    });
+});

package/dist/node-server/cloud/dispatch.d.ts

@@ -5,6 +5,7 @@ export type ParsedCloudArgs = {
         substrate: SubstrateId;
         name?: string;
         envFile?: string;
+        template?: string;
     };
 } | {
     subcommand: 'list';

package/dist/node-server/cloud/dispatch.js

@@ -1,19 +1,16 @@
 const VALID_SUBCOMMANDS = ['start', 'list', 'pause', 'resume', 'kill'];
-export function parseCloudArgs(argv) {
-    if (argv.includes('--hosted') && argv.includes('--cloud')) {
-        throw new Error('--cloud and --hosted are mutually exclusive');
-    }
-    const cloudIdx = argv.indexOf('--cloud');
-    if (cloudIdx === -1)
-        return null;
-    const sub = argv[cloudIdx + 1];
-    if (!sub || !VALID_SUBCOMMANDS.includes(sub)) {
-        throw new Error(`unknown subcommand: ${sub ?? '(none)'} (expected one of: ${VALID_SUBCOMMANDS.join(', ')})`);
-    }
-    const rest = argv.slice(cloudIdx + 2);
-    const baseArgs = {
-        substrate: 'e2b',
-    };
+/** Subcommands that accept a positional query (sandbox ID or name). */
+function takesQuery(sub) {
+    return sub === 'pause' || sub === 'resume' || sub === 'kill';
+}
+/**
+ * Parse the flag list that follows `--cloud <subcommand>` into a flat
+ * `BaseArgs` bag. The discriminated union is assembled later in
+ * `buildParsedArgs`; keeping the two phases separate holds each function's
+ * cognitive complexity under the biome cap.
+ */
+function parseBaseArgs(rest, sub) {
+    const baseArgs = { substrate: 'e2b' };
     let i = 0;
     while (i < rest.length) {
         const a = rest[i];
@@ -23,15 +20,19 @@ export function parseCloudArgs(argv) {
         else if (a === '--env-file') {
             baseArgs.envFile = rest[++i];
         }
+        else if (a === '--template') {
+            // Substrate template alias to launch from (default 'slicc'). Lets
+            // `--cloud start` boot an isolated test template (e.g. 'slicc-test')
+            // built via SLICC_E2B_TEMPLATE_NAME without touching production.
+            baseArgs.template = rest[++i];
+        }
         else if (a === '--substrate') {
             const v = rest[++i];
             if (v !== 'e2b')
                 throw new Error(`unsupported substrate: ${v} (MVP only supports 'e2b')`);
             baseArgs.substrate = v;
         }
-        else if (!a.startsWith('--') &&
-            !baseArgs.query &&
-            (sub === 'pause' || sub === 'resume' || sub === 'kill')) {
+        else if (!a.startsWith('--') && !baseArgs.query && takesQuery(sub)) {
             baseArgs.query = a;
         }
         else {
@@ -39,7 +40,17 @@ export function parseCloudArgs(argv) {
         }
         i++;
     }
-    // Build discriminated union based on subcommand
+    return baseArgs;
+}
+/** Require and return the positional query for the query-taking subcommands. */
+function requireQuery(sub, query) {
+    if (!query) {
+        throw new Error(`${sub} requires a query argument (sandbox ID or name)`);
+    }
+    return query;
+}
+/** Assemble the discriminated union from the parsed flag bag. */
+function buildParsedArgs(sub, baseArgs) {
     switch (sub) {
         case 'start':
             return {
@@ -48,32 +59,39 @@ export function parseCloudArgs(argv) {
                     substrate: baseArgs.substrate,
                     name: baseArgs.name,
                     envFile: baseArgs.envFile,
+                    template: baseArgs.template,
                 },
             };
         case 'list':
             return { subcommand: 'list', args: { substrate: baseArgs.substrate } };
         case 'pause':
         case 'kill':
-            if (!baseArgs.query) {
-                throw new Error(`${sub} requires a query argument (sandbox ID or name)`);
-            }
             return {
                 subcommand: sub,
-                args: { substrate: baseArgs.substrate, query: baseArgs.query },
+                args: { substrate: baseArgs.substrate, query: requireQuery(sub, baseArgs.query) },
             };
         case 'resume':
-            if (!baseArgs.query) {
-                throw new Error(`${sub} requires a query argument (sandbox ID or name)`);
-            }
             return {
                 subcommand: 'resume',
                 args: {
                     substrate: baseArgs.substrate,
-                    query: baseArgs.query,
+                    query: requireQuery(sub, baseArgs.query),
                     envFile: baseArgs.envFile,
                 },
             };
-        default:
-            throw new Error(`unknown subcommand: ${sub}`);
     }
 }
+export function parseCloudArgs(argv) {
+    if (argv.includes('--hosted') && argv.includes('--cloud')) {
+        throw new Error('--cloud and --hosted are mutually exclusive');
+    }
+    const cloudIdx = argv.indexOf('--cloud');
+    if (cloudIdx === -1)
+        return null;
+    const sub = argv[cloudIdx + 1];
+    if (!sub || !VALID_SUBCOMMANDS.includes(sub)) {
+        throw new Error(`unknown subcommand: ${sub ?? '(none)'} (expected one of: ${VALID_SUBCOMMANDS.join(', ')})`);
+    }
+    const baseArgs = parseBaseArgs(argv.slice(cloudIdx + 2), sub);
+    return buildParsedArgs(sub, baseArgs);
+}

package/dist/node-server/cloud/start.d.ts

@@ -1,5 +1,19 @@
 import type { SandboxSubstrate } from '../_cloud_core/src/index.js';
 import { type SandboxHandle, type StartResult } from '../_cloud_core/src/index.js';
+/**
+ * CLI poll budget for `/tmp/slicc-join.json` to appear after sandbox create.
+ *
+ * cloud-core defaults this to 60s, which is too tight for a COLD boot of the
+ * hosted-leader image: start.sh budgets chromium cold-start alone at 60s
+ * (SLICC_CDP_LAUNCH_TIMEOUT_MS), and node boot + tray registration push the
+ * observed first-boot time to ~50-70s. The 60s default loses that race on the
+ * coldest (first-after-build) boot, surfacing as a spurious SANDBOX_NOT_READY.
+ *
+ * The worker path deliberately keeps the tighter 60s default (its request is
+ * wall-clock-constrained by the dashboard fetch / CF edge), but a laptop CLI
+ * can afford to wait — so we give it generous headroom here.
+ */
+export declare const CLI_START_POLL_TIMEOUT_MS = 180000;
 export interface RunStartOpts {
     substrate: SandboxSubstrate;
     envFilePath: string;

package/dist/node-server/cloud/start.js

@@ -1,6 +1,20 @@
 import { promises as fs } from 'node:fs';
 import { startCone } from '../_cloud_core/src/index.js';
 import { FileRegistry } from './registry-file.js';
+/**
+ * CLI poll budget for `/tmp/slicc-join.json` to appear after sandbox create.
+ *
+ * cloud-core defaults this to 60s, which is too tight for a COLD boot of the
+ * hosted-leader image: start.sh budgets chromium cold-start alone at 60s
+ * (SLICC_CDP_LAUNCH_TIMEOUT_MS), and node boot + tray registration push the
+ * observed first-boot time to ~50-70s. The 60s default loses that race on the
+ * coldest (first-after-build) boot, surfacing as a spurious SANDBOX_NOT_READY.
+ *
+ * The worker path deliberately keeps the tighter 60s default (its request is
+ * wall-clock-constrained by the dashboard fetch / CF edge), but a laptop CLI
+ * can afford to wait — so we give it generous headroom here.
+ */
+export const CLI_START_POLL_TIMEOUT_MS = 180_000;
 /**
  * Extract ADOBE_IMS_TOKEN (+ DOMAINS) from an env-file body so they can be
  * injected as sandbox env vars at Sandbox.create. start.sh writes them to
@@ -40,7 +54,7 @@ export async function runStart(opts) {
         template: opts.template,
         name: opts.name,
         sliccVersion: opts.sliccVersion,
-        pollTimeoutMs: opts.pollTimeoutMs,
+        pollTimeoutMs: opts.pollTimeoutMs ?? CLI_START_POLL_TIMEOUT_MS,
         pollIntervalMs: opts.pollIntervalMs,
         metadata: {
             createdBy: process.env['USER'] ?? 'unknown',

package/dist/node-server/hosted-bootstrap.d.ts

@@ -1,6 +1,7 @@
-import type { Account } from './_cloud_core/src/index.js';
+import { type Account, imsTokenExpiry } from './_cloud_core/src/index.js';
 import type { Express } from 'express';
 import type { SecretStore } from './secrets/types.js';
+export { imsTokenExpiry };
 export interface HostedBootstrapPayload {
     model?: string;
     accounts?: Account[];

package/dist/node-server/hosted-bootstrap.js

@@ -14,7 +14,15 @@
  * orchestrator talks to the leader through the tray-worker tunnel, not http.
  */
 import { readFileSync } from 'node:fs';
+// Import from the package root (not the './cone-config' subpath): node-server's
+// inline-workspaces packaging only rewrites the bare '@slicc/cloud-core'
+// specifier, so a subpath import leaks an un-inlined workspace reference.
+import { imsTokenExpiry } from './_cloud_core/src/index.js';
 import { requireLoopback } from './cloud-status.js';
+// Re-export so existing callers/tests can keep importing it from here. The
+// implementation now lives in @slicc/cloud-core/cone-config (side-effect-free,
+// Buffer-free) so the worker's back-compat + resume paths reuse the same logic.
+export { imsTokenExpiry };
 const CONE_CONFIG_PATH = '/slicc/cone-config.json';
 const DEFAULT_MODEL = 'adobe:claude-opus-4-6';
 export function buildHostedBootstrapPayload(sources) {
@@ -25,9 +33,17 @@ export function buildHostedBootstrapPayload(sources) {
     }
     const legacy = sources.getLegacyAdobeToken();
     if (legacy) {
+        const expiresAt = imsTokenExpiry(legacy);
         return {
             model: DEFAULT_MODEL,
-            accounts: [{ providerId: 'adobe', kind: 'oauth', accessToken: legacy }],
+            accounts: [
+                {
+                    providerId: 'adobe',
+                    kind: 'oauth',
+                    accessToken: legacy,
+                    ...(expiresAt !== undefined ? { tokenExpiresAt: expiresAt } : {}),
+                },
+            ],
             adobeImsToken: legacy,
         };
     }

package/dist/node-server/index.js

@@ -1360,6 +1360,7 @@ async function runCloudSubcommand(parsed) {
                 workerBaseUrl: process.env['SLICC_TRAY_WORKER_BASE_URL']?.trim() || 'https://www.sliccy.ai',
                 sliccVersion: localSliccVersion,
                 name: parsed.args.name,
+                template: parsed.args.template,
             });
             console.log(`Sandbox ${result.sandboxId} ready.`);
             console.log(`Open: ${result.joinUrl}`);