unfazed 0.8.1 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # Changelog
 
+## 0.10.0
+
+eve sandboxes on unfazed boxes: an eve app on unfazed gets a real sandbox (a
+browser through `@agent-browser/eve`, `bash`, files) backed by a box, with no
+stored secret.
+
+**Added**
+
+- `unfazed/eve-sandbox`: `UnfazedSandbox`, an eve sandbox provider
+  (`defineSandboxProvider`, eve 0.90 or newer, an optional peer).
+  `UnfazedSandbox.environment({ box: "<alias>" })` in `agent/sandbox.ts`.
+  - Every eve session gets its own Unix user, home and workspace on the box,
+    kept across restarts and redeploys until the session ends.
+  - The app authenticates with its workload identity token (audience: the
+    box's URL).
+  - Keyed MCP tool sessions keep their sandbox between calls.
+  - Build-time workspace and skill files travel in the eve artifact; a
+    `prepare` callback that runs commands at build time is refused (install
+    tools on the box instead).
+- `npx unfazed eve-sandbox setup|allow|deny|status|serve`, run as root inside
+  a box.
+  - `setup` installs the sandbox daemon on the box's `:3000`, agent-browser
+    and Chromium, and a boot hook that starts the daemon on every boot.
+  - Without `--allow`, every app of the box's own owner may use the box.
+  - Idle sessions lose their processes after 20 minutes (`--idle-minutes`);
+    sessions nobody used for 14 days are deleted (`--retention-days`).
+  - `--proxy <url>` routes the browsers through a proxy.
+
+## 0.9.0
+
+Workload identity: an app gets OIDC tokens from the platform with its own
+state token (`POST /oidc/token`, live on unfazed.dev since 2026-10-25). The
+rest of the SDK needs nothing newer than 0.8.1 did.
+
+**Added**
+
+- `unfazed.oidc.token(audience, { ttlSeconds?, signal? })`: a JWT for
+  `audience`, issued to the app the code runs in (issuer
+  `https://unfazed.dev/oidc`). Needs only `UNFZ_STATE_TOKEN`, which the
+  platform sets in every service and cron VM; without it the call throws
+  `not_in_app`. The audience (1 to 256 printable ASCII characters, no
+  whitespace) and `ttlSeconds` (60 to 3600) are checked before any request.
+  Tokens are cached per (audience, ttl) until 80% of their lifetime (the
+  JWT's `exp - iat`), concurrent calls share one request, and 503s (and
+  gateway 502/504s), network failures and 429s (after their `Retry-After`,
+  up to 10 s) are retried up to 3 times; no other 4xx is. When a refresh
+  still fails that way, the previous token comes back while it is valid.
+- `unfazed.oidc.tokenResponse(...)`: the same as `{ token, expiresAt }`.
+- `unfazed.oidc.fetchWithToken(audience, { ttlSeconds?, fetch? })`: a `fetch`
+  that sends `Authorization: Bearer <token>` and everything else as given,
+  for a client that takes a `fetch` (the OpenAI SDK's `fetch` option).
+- Without an instance: `oidc` (the process's `UnfazedOIDC`, one cache for the
+  process) and `oidcToken(audience)`.
+- `UnfazedOIDCError` (`code`, `status`, `description`, `retryable`,
+  `retryAfterMs`); `code` is the platform's `error` (`invalid_token`,
+  `invalid_audience`, `invalid_request`, `rate_limited`, `oidc_disabled`,
+  `temporarily_unavailable`) or the SDK's (`not_in_app`, `unreachable`,
+  `invalid_response`, `http_error`).
+- Class `UnfazedOIDC`, constants `STATE_TOKEN_ENV_VAR` and `OIDC_TOKEN_PATH`,
+  types `OIDCErrorCode`, `OIDCOptions`, `OIDCToken`, `OIDCTokenOptions`,
+  `OIDCTransport`, `FetchWithTokenOptions` and `TokenFetch`.
+
+**Changed**
+
+- `new Unfazed()` with no API token and no login no longer throws, since an
+  app has only its state token and `oidc` needs nothing more. The first
+  method that calls the API, or reading `unfazed.client`, throws the same
+  `UnfazedAuthError` with the same message. `new UnfazedClient()` still
+  throws at once.
+- `unfazed.client` is a getter (read-only, as before).
+- `help("token")` finds `oidc.token`: a method name matches after a `.` too.
+
 ## 0.8.1
 
 Follows the platform's final `waitForDeployment` and timings contract

package/README.md

@@ -25,6 +25,9 @@ SDK:  one script. Three requests. You read the four lines you cared about.
 - `npx unfazed workflow inspect runs --app <alias>`: Workflow SDK's CLI and web
   UI read your app's runs through the platform, from any directory
   ([details](#inspect-runs-from-your-terminal)).
+- `oidcToken(audience)`: inside an app, a short-lived OIDC token the platform
+  issues to it, for services that take one instead of an API key
+  ([details](#workload-identity-oidc-tokens-for-your-app)).
 - Strict TypeScript, generated from the platform's own GraphQL schema.
 - Bun-first, runs unchanged on Node >= 20 and Deno.
 
@@ -57,6 +60,12 @@ const unfazed = new Unfazed();          // UNFZ_API_TOKEN, else your `npx unfaze
 const unfazed = new Unfazed({ token }); // or pass a token explicitly
 ```
 
+**An app running on unfazed** needs neither for its own OIDC tokens
+(`unfazed.oidc`, `oidcToken`): they use the `UNFZ_STATE_TOKEN` the platform
+sets in each of its VMs ([details](#workload-identity-oidc-tokens-for-your-app)).
+`new Unfazed()` without a credential is made all the same; a method that calls
+the API then throws `UnfazedAuthError`, saying how to sign in.
+
 Both endpoint and token are configurable. `UNFZ_API_URL` overrides the endpoint
 (default `https://unfazed.dev/query`, or the stored login's); `baseUrl` is a
 convenience for self-hosted control planes where only the host differs.
@@ -203,7 +212,8 @@ Errors are typed and specific: `UnfazedAuthError`, `UnfazedHTTPError` (carries
 `status`/`body`), `UnfazedGraphQLError` (carries `errors` **and any partial
 `data`**), `UnfazedTimeoutError`, `UnfazedDeployError`, `UnfazedConflictError`,
 `UnfazedNotFoundError`, `UnfazedWriteError` (carries the write's `result` and
-the `failed` paths). All extend `UnfazedError`.
+the `failed` paths), `UnfazedOIDCError` (carries `code`, `status`,
+`description`, `retryable`). All extend `UnfazedError`.
 
 ### 2. Workflow layer — `Unfazed`
 
@@ -307,6 +317,13 @@ The chains an agent actually performs. Reach `client` from it any time:
 | `runConsole(id, { tailBytes? })` | live tail while RUNNING |
 | `runTranscript(id, { tailBytes? })` | the stored transcript once settled |
 
+**Workload identity** (the app's own OIDC tokens; no API token needed)
+| Method | Notes |
+| --- | --- |
+| `oidc.token(audience, { ttlSeconds?, signal? })` | a JWT for `audience`, cached until 80% of its lifetime |
+| `oidc.tokenResponse(audience, opts?)` | the same, as `{ token, expiresAt }` |
+| `oidc.fetchWithToken(audience, { ttlSeconds?, fetch? })` | a `fetch` that sends `Authorization: Bearer <token>` |
+
 ## The two things worth knowing
 
 ### `writeFiles` is one request and one commit
@@ -593,6 +610,134 @@ So an agent working inside a run can create workspaces, deploy, and read logs
 through this same SDK with zero configuration and no credential ever written
 into the prompt.
 
+## Workload identity: OIDC tokens for your app
+
+Code running in an app on unfazed (a service or a cron job) can prove which
+app it is. The platform issues it short-lived OIDC tokens (JWTs) for any
+audience, and a service that trusts the issuer `https://unfazed.dev/oidc`
+takes one instead of a long-lived API key kept in the app's env.
+
+```ts
+import { oidcToken } from "unfazed";
+
+const jwt = await oidcToken("https://api.example.com");   // cached and refreshed for you
+const res = await fetch("https://api.example.com/v1/things", {
+  headers: { Authorization: `Bearer ${jwt}` },
+});
+```
+
+A client that takes a `fetch` (here the OpenAI SDK, against an
+OpenAI-compatible endpoint) gets one that puts a fresh token on every request:
+
+```ts
+import OpenAI from "openai";
+import { oidc } from "unfazed";
+
+const openai = new OpenAI({
+  baseURL: process.env.PRIVATEINFERENCE_BASE_URL,
+  apiKey: "unused",                                        // the token replaces it
+  fetch: oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE),
+});
+```
+
+`oidc` is the process's own; an instance has the same methods as
+`unfazed.oidc` (`token`, `tokenResponse` for `{ token, expiresAt }`,
+`fetchWithToken`), asking the platform its client talks to (`baseUrl`,
+`endpoint`, `UNFZ_API_URL`; default `https://unfazed.dev`).
+
+- **Credential:** only the app's own `UNFZ_STATE_TOKEN`, which the platform
+  sets in each of its VMs. No `UNFZ_API_TOKEN` and no login: `new Unfazed()`
+  in an app works for `oidc` alone. Outside an app the call throws
+  `UnfazedOIDCError` with `code: "not_in_app"` ("not running inside an unfazed
+  app"), before any request.
+- **The token:** issuer `https://unfazed.dev/oidc`; claims include `sub`,
+  `aud`, `owner_id`, `project_id`, `app_id`, `alias`, `environment` and
+  `deployment_id`. `ttlSeconds` (60 to 3600) asks for a lifetime; without it
+  the platform picks. An audience is 1 to 256 printable ASCII characters
+  without whitespace, checked before any request (`fetchWithToken` checks it
+  when called, so an unset variable fails at startup).
+- **Cache:** per (audience, ttl), reused until 80% of the token's lifetime has
+  passed. The lifetime is the JWT's own (`exp - iat`), so a VM clock that is
+  off does not shorten or stretch it. Concurrent calls for one pair make one
+  request; the cache is the process's (an instance with its own `fetch` keeps
+  its own). `{ signal }` stops a call's wait, not the request others share.
+- **Retries:** a 503 (or a gateway's 502/504) and network failures are retried
+  up to 3 times (200, 400, 800 ms); a 429 too, after its `Retry-After` (up to
+  10 s; a longer one throws at once, with `retryAfterMs`). No other 4xx is
+  retried. If a refresh still fails that way while the token it replaces is
+  valid, that token comes back.
+
+Errors are `UnfazedOIDCError`, with the platform's `error` as `code` and its
+`error_description` as `description`, plus `status` and `retryable`:
+
+| `code` | Status | Means |
+| --- | --- | --- |
+| `invalid_token` | 401 | the platform refused `UNFZ_STATE_TOKEN` |
+| `invalid_audience` | 400 | the audience is malformed or not allowed (also refused locally) |
+| `invalid_request` | 400 | a malformed request, `ttlSeconds` out of range among them |
+| `rate_limited` | 429 | too many requests, after the retries |
+| `oidc_disabled` | 404 | the platform issues no OIDC tokens to this app |
+| `temporarily_unavailable` | 503 | after the retries |
+| `not_in_app` | | `UNFZ_STATE_TOKEN` is not set |
+| `unreachable` | | network failures outlasted the retries |
+
+## eve sandboxes on a box: `unfazed/eve-sandbox`
+
+[eve](https://eve.dev) runs browsers, `bash` and file tools only inside a
+sandbox, and an unfazed service has no Docker. `unfazed/eve-sandbox` backs
+eve sandboxes with an unfazed **box** (a persistent Linux VM): every eve
+session gets its own Unix user, home and workspace there, which survive box
+restarts and app redeploys until the session ends.
+
+**1. Turn a box into a sandbox host.** Inside the box, as root (`ssh <box>@unfz.to`):
+
+```bash
+npx -y unfazed@latest eve-sandbox setup
+```
+
+This installs:
+
+- the sandbox daemon on the box's `:3000`, which serves the box's URL;
+- agent-browser and Chromium for every session;
+- a boot hook that starts the daemon on every boot.
+
+It then prints the line for your app. Who may use the box:
+
+- Without `--allow`, every app of the box's own owner.
+- `--allow <app-id>,owner:<id>` names apps explicitly, and `npx unfazed eve-sandbox allow|deny <id>` changes the list later.
+- A refused app's id is in the daemon's 403 answer.
+
+Other options:
+
+- `--proxy <url>` routes the browsers through a proxy, for sites that block datacenter IPs.
+- `--idle-minutes 20` sets how long an idle session keeps its processes.
+- `--retention-days 14` sets when an unused session is deleted.
+- `npx unfazed eve-sandbox status` shows the daemon, the allow list and the sessions.
+
+**2. Point the eve app at it** (`eve` 0.90 or newer, an optional peer):
+
+```ts
+// agent/sandbox.ts
+import { defineSandbox } from "eve/sandbox";
+import { UnfazedSandbox } from "unfazed/eve-sandbox";
+
+export const environment = UnfazedSandbox.environment({ box: "my-sandbox-box" });
+export default defineSandbox(() => environment.open());
+```
+
+With `@agent-browser/eve` mounted (`agent/extensions/browser.ts`), the
+agent's `browser__*` tools run in the box. The agent-browser that `setup`
+installs is `0.41.1`. Pass `--agent-browser <version>` to match another
+`@agent-browser/eve` minor.
+
+How it behaves:
+
+- **No stored secret.** The app authenticates with its workload identity token, audience the box's URL (see "Workload identity" above). The box checks the issuer, audience and allow list.
+- **Sessions are users.** A session's commands (`bash -lc`, streamed) and file operations run as its own Unix user, so sessions cannot read each other's files or browser profiles.
+- **Keyed MCP tool sessions** (`dev.eve/tool-sessions`) keep their sandbox between calls. A sandbox nobody used for the retention period is deleted.
+- **Templates.** The agent's workspace and skill files are captured at `eve build` and seeded into each new session. A sandbox `prepare` callback that runs commands is refused at build time: install tools on the box instead (it is yours, with root).
+- **Placement.** Put the box near the app (the same server or region): every sandbox call is an HTTPS round trip to the box.
+
 ## Durable workflows: `unfazed/workflow`
 
 [Workflow SDK](https://workflow-sdk.dev) runs durable functions: a
@@ -956,7 +1101,7 @@ After bumping the `@workflow/world-postgres` devDependency, run
 `REFERENCE.md` is what `help()` returns: after editing it run
 `bun run embed-reference` (`bun run check` fails while
 `src/reference.generated.ts` is stale). `test/reference.test.ts` fails when a
-public method of `Unfazed` is missing from it.
+public method of `Unfazed` (or of `unfazed.oidc`) is missing from it.
 
 ### Regenerating from the schema
 

package/REFERENCE.md

@@ -3,8 +3,9 @@
 Every method of `Unfazed`, with its signature, in one page. In a script:
 `import { Unfazed, help } from "unfazed"; const unfazed = new Unfazed();`
 (run_script injects the credential; elsewhere `UNFZ_API_TOKEN` or
-`npx unfazed login`). `help()` returns this page; `help("writeFiles")` one
-entry. Methods are async and throw an `UnfazedError` subclass on failure.
+`npx unfazed login`; `oidc` needs neither). `help()` returns this page;
+`help("writeFiles")` one entry. Methods are async and throw an
+`UnfazedError` subclass on failure.
 Every method takes an optional last `options` with `signal` (and, for single
 requests, `timeoutMs`). The names follow the MCP tools: `listCommits` is
 `list_commits`, `waitForEvents` is `wait_for_events`.
@@ -291,6 +292,50 @@ Answers a BLOCKED run's question.
 
 ### `listRunHarnesses(): Promise<RunHarness[]>`
 
+## Workload identity
+
+OIDC tokens the platform issues to the app the code runs in (a service or a
+cron job): short-lived JWTs for one audience, from the issuer
+`https://unfazed.dev/oidc`, which a service that trusts it takes instead of
+an API key. Claims include `sub`, `aud`, `owner_id`, `project_id`, `app_id`,
+`alias`, `environment` and `deployment_id`. The only credential is the app's
+`UNFZ_STATE_TOKEN`, set in each of its VMs: no API token, so a bare
+`new Unfazed()` works in an app for this. Without an instance:
+`import { oidc, oidcToken } from "unfazed"` (`oidcToken(audience)` is
+`oidc.token(audience)`).
+
+### `oidc.token(audience: string, options?: { ttlSeconds?, signal? }): Promise<string>`
+A JWT for `audience` (1 to 256 printable ASCII characters, no whitespace);
+`ttlSeconds` from 60 to 3600, else the platform's default. Cached per
+(audience, ttl) until 80% of its lifetime; concurrent calls share one
+request. 503s, network failures and 429s (after their `Retry-After`) are
+retried up to 3 times; if a refresh still fails that way, the previous token
+comes back while it is valid. Throws `UnfazedOIDCError` (`code`, `status`,
+`description`, `retryable`, `retryAfterMs`): `not_in_app` (no
+`UNFZ_STATE_TOKEN`), `invalid_audience`, `invalid_request`, `invalid_token`,
+`rate_limited`, `oidc_disabled`, `temporarily_unavailable`, `unreachable`.
+
+```ts
+const jwt = await unfazed.oidc.token("https://api.example.com", { ttlSeconds: 300 });
+await fetch("https://api.example.com/v1/things", { headers: { Authorization: `Bearer ${jwt}` } });
+```
+
+### `oidc.tokenResponse(audience: string, options?: { ttlSeconds?, signal? }): Promise<{ token, expiresAt: Date }>`
+`oidc.token` with the token's expiry.
+
+### `oidc.fetchWithToken(audience: string, options?: { ttlSeconds?, fetch? }): fetch`
+A `fetch` that sends each request with `Authorization: Bearer <token>`
+(replacing one already there), everything else as given: for a client that
+takes a `fetch`. An invalid audience (an unset variable) throws at once.
+
+```ts
+const openai = new OpenAI({
+  baseURL: process.env.PRIVATEINFERENCE_BASE_URL,
+  apiKey: "unused",
+  fetch: unfazed.oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE),
+});
+```
+
 ## Anything else
 
 `unfazed.client` is the typed GraphQL transport over the same credential:

package/dist/cli/eve-sandbox.d.ts

@@ -0,0 +1,3 @@
+/** The agent-browser release `@agent-browser/eve` 0.41 drives; match the extension's minor. */
+export declare const DEFAULT_AGENT_BROWSER = "0.41.1";
+export declare function runEveSandbox(argv: readonly string[]): Promise<number>;

package/dist/cli/eve-sandbox.js

@@ -0,0 +1,268 @@
+/// <reference types="node" />
+/**
+ * `npx unfazed eve-sandbox <command>`, run as root inside an unfazed box:
+ * turns the box into a sandbox host for eve apps (`unfazed/eve-sandbox`).
+ *
+ *   setup [--allow <app-id|owner:id>,…] [--no-browser] [--agent-browser <version>]
+ *         [--proxy <url>] [--idle-minutes <n>] [--retention-days <n>]
+ *   allow <app-id|owner:id>      add to the allow list and restart the daemon
+ *   deny <app-id|owner:id>       remove from it and restart the daemon
+ *   status                       the daemon's health, allow list and sessions
+ *   serve                        run the daemon in the foreground
+ *
+ * `setup` copies the daemon to /data/eve-sandbox, writes its config and a box
+ * boot hook (/data/boot.d/50-eve-sandbox, run on every boot by the box's
+ * init), installs agent-browser and Chromium for every session, and (re)starts
+ * the daemon on :3000, which unfazed publishes at the box's URL. Without
+ * --allow, every app of the box's own owner may use it.
+ */
+import { execFileSync, spawn } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+/** The agent-browser release `@agent-browser/eve` 0.41 drives; match the extension's minor. */
+export const DEFAULT_AGENT_BROWSER = "0.41.1";
+const ROOT = "/data/eve-sandbox";
+const LIB = `${ROOT}/lib`;
+const CONFIG = `${ROOT}/config.json`;
+const HOOK = "/data/boot.d/50-eve-sandbox";
+const BROWSERS = "/opt/agent-browser/browsers";
+const HELP = `unfazed eve-sandbox — run eve sandboxes on this unfazed box (as root, inside the box)
+
+Usage:
+  npx unfazed eve-sandbox setup [--allow <app-id|owner:id>,…] [--no-browser]
+                                [--agent-browser <version>] [--proxy <url>]
+                                [--idle-minutes <n>] [--retention-days <n>]
+  npx unfazed eve-sandbox allow <app-id|owner:id>
+  npx unfazed eve-sandbox deny <app-id|owner:id>
+  npx unfazed eve-sandbox status
+  npx unfazed eve-sandbox serve
+
+setup installs the daemon (on :3000, the box's URL), agent-browser ${DEFAULT_AGENT_BROWSER}
+and Chromium, and a boot hook that starts the daemon on every boot. Without
+--allow, every app of this box's owner may use the box. An eve app then
+points its agent/sandbox.ts at it with UnfazedSandbox (unfazed/eve-sandbox):
+
+  export const environment = UnfazedSandbox.environment({ box: "<this box's alias>" });
+  export default defineSandbox(() => environment.open());
+`;
+function readConfig() {
+    if (!existsSync(CONFIG))
+        return { allow: [] };
+    const parsed = JSON.parse(readFileSync(CONFIG, "utf8"));
+    return { ...parsed, allow: Array.isArray(parsed.allow) ? parsed.allow : [] };
+}
+function writeConfig(config) {
+    const temp = `${CONFIG}.tmp`;
+    writeFileSync(temp, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+    renameSync(temp, CONFIG);
+}
+function sh(file, args, options = {}) {
+    return execFileSync(file, args, { encoding: "utf8", stdio: options.quiet ? ["ignore", "pipe", "pipe"] : ["ignore", "pipe", "inherit"] });
+}
+function requireBox() {
+    if (process.getuid?.() !== 0)
+        throw new Error("unfazed eve-sandbox: run this as root inside the box");
+    if (!existsSync("/sbin/unfazed-box-init") || !process.env["UNFZ_PUBLIC_URL"]) {
+        throw new Error("unfazed eve-sandbox: this is not an unfazed box (no /sbin/unfazed-box-init or UNFZ_PUBLIC_URL)");
+    }
+}
+/** The box's own owner, from its workload identity token: the default allow entry. */
+async function ownOwner() {
+    const state = process.env["UNFZ_STATE_TOKEN"];
+    const audience = process.env["UNFZ_PUBLIC_URL"];
+    if (!state)
+        throw new Error("unfazed eve-sandbox: UNFZ_STATE_TOKEN is not set; pass --allow");
+    const res = await fetch("https://unfazed.dev/oidc/token", {
+        method: "POST",
+        headers: { authorization: `Bearer ${state}`, "content-type": "application/json", "user-agent": "unfazed-eve-sandbox-setup" },
+        body: JSON.stringify({ audience }),
+    });
+    if (!res.ok)
+        throw new Error(`unfazed eve-sandbox: could not read the box's owner (${res.status}); pass --allow`);
+    const { token } = (await res.json());
+    const claims = JSON.parse(Buffer.from(token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+    if (!claims.owner_id)
+        throw new Error("unfazed eve-sandbox: the box's token names no owner; pass --allow");
+    return `owner:${claims.owner_id}`;
+}
+function installDaemon() {
+    mkdirSync(LIB, { recursive: true });
+    chmodSync(ROOT, 0o755);
+    chmodSync(LIB, 0o755);
+    const source = join(dirname(fileURLToPath(import.meta.url)), "..", "eve-sandbox");
+    for (const file of ["daemon.js", "protocol.js"]) {
+        copyFileSync(join(source, file), join(LIB, file));
+        chmodSync(join(LIB, file), 0o644);
+    }
+    mkdirSync(dirname(HOOK), { recursive: true });
+    writeFileSync(HOOK, [
+        "#!/bin/sh",
+        "# eve sandbox daemon (unfazed/eve-sandbox) on :3000, restarted if it exits.",
+        `cd ${ROOT} || exit 1`,
+        "while true; do",
+        `  ${existsSync("/usr/local/bin/node") ? "/usr/local/bin/node" : process.execPath} ${LIB}/daemon.js serve --config ${CONFIG} >>${ROOT}/daemon.log 2>&1`,
+        "  sleep 2",
+        "done",
+        "",
+    ].join("\n"), { mode: 0o755 });
+}
+/** Installs agent-browser and Chromium once for every session; returns the Chromium binary. */
+function installBrowser(version) {
+    process.stderr.write(`installing agent-browser@${version} and Chromium (a few minutes the first time)…\n`);
+    const env = { ...process.env, DEBIAN_FRONTEND: "noninteractive" };
+    execFileSync("npm", ["install", "-g", "--silent", `agent-browser@${version}`], { stdio: "inherit", env });
+    // agent-browser keeps browsers in the installing user's home; sessions are
+    // other users. Root's browser directory becomes the shared one, so a
+    // browser already there is found and not downloaded again.
+    mkdirSync(BROWSERS, { recursive: true });
+    const own = join(process.env["HOME"] ?? "/root", ".agent-browser", "browsers");
+    mkdirSync(dirname(own), { recursive: true });
+    if (existsSync(own) && !lstatSync(own).isSymbolicLink()) {
+        for (const entry of readdirSync(own)) {
+            if (!existsSync(join(BROWSERS, entry)))
+                renameSync(join(own, entry), join(BROWSERS, entry));
+        }
+        rmSync(own, { recursive: true, force: true });
+    }
+    if (!existsSync(own))
+        symlinkSync(BROWSERS, own);
+    execFileSync("agent-browser", ["install", "--with-deps"], { stdio: "inherit", env });
+    sh("chmod", ["-R", "a+rX", "/opt/agent-browser"]);
+    const latest = readdirSync(BROWSERS)
+        .filter((e) => e.startsWith("chrome-"))
+        .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
+        .at(-1);
+    const binary = latest ? join(BROWSERS, latest, "chrome") : "";
+    if (!binary || !existsSync(binary))
+        throw new Error("unfazed eve-sandbox: Chromium was not found after the install");
+    return binary;
+}
+function restartDaemon() {
+    // The boot hook's loop first (or it starts the old daemon again), then any
+    // daemon, wherever an earlier setup put it.
+    for (const pattern of ["[b]oot\\.d/50-eve-sandbox", "[e]ve-sandbox[^ ]*daemon[^ ]*\\.js serve"]) {
+        try {
+            sh("pkill", ["-f", pattern], { quiet: true });
+        }
+        catch {
+            // none running
+        }
+    }
+    execFileSync("sleep", ["1"]);
+    const child = spawn("setsid", [HOOK], { detached: true, stdio: "ignore" });
+    child.unref();
+}
+async function health() {
+    for (let i = 0; i < 20; i++) {
+        try {
+            const res = await fetch("http://127.0.0.1:3000/v1/health", { signal: AbortSignal.timeout(2000) });
+            if (res.ok)
+                return (await res.json());
+        }
+        catch {
+            // not up yet
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    return { ok: false };
+}
+function sessionCount() {
+    return sh("getent", ["passwd"], { quiet: true })
+        .split("\n")
+        .filter((line) => /^eve[0-9a-f]{12}:/.test(line)).length;
+}
+export async function runEveSandbox(argv) {
+    const { values, positionals } = parseArgs({
+        args: [...argv],
+        allowPositionals: true,
+        options: {
+            allow: { type: "string" },
+            "no-browser": { type: "boolean" },
+            "agent-browser": { type: "string" },
+            proxy: { type: "string" },
+            "idle-minutes": { type: "string" },
+            "retention-days": { type: "string" },
+            config: { type: "string" },
+            help: { type: "boolean", short: "h" },
+        },
+    });
+    const [command, arg] = positionals;
+    if (values.help || command === undefined || command === "help") {
+        process.stdout.write(HELP);
+        return command === undefined ? 1 : 0;
+    }
+    if (command === "serve") {
+        const daemon = await import("../eve-sandbox/daemon.js");
+        const config = daemon.loadConfig(values.config ?? CONFIG);
+        await daemon.createDaemon(config).listen();
+        process.stdout.write(`eve sandbox daemon on :${config.port} for ${config.audience}\n`);
+        await new Promise(() => { });
+    }
+    requireBox();
+    const url = process.env["UNFZ_PUBLIC_URL"];
+    switch (command) {
+        case "setup": {
+            const config = readConfig();
+            const allow = values.allow
+                ? values.allow.split(",").map((s) => s.trim()).filter(Boolean)
+                : config.allow.length > 0
+                    ? []
+                    : [await ownOwner()];
+            config.allow = [...new Set([...config.allow, ...allow])];
+            const number = (flag, name) => {
+                if (flag === undefined)
+                    return undefined;
+                const n = Number(flag);
+                if (!Number.isInteger(n) || n < 0)
+                    throw new Error(`unfazed eve-sandbox: --${name} must be a whole number`);
+                return n;
+            };
+            config.idleMinutes = number(values["idle-minutes"], "idle-minutes") ?? config.idleMinutes ?? 20;
+            config.retentionDays = number(values["retention-days"], "retention-days") ?? config.retentionDays ?? 14;
+            config.env = { ...(config.env ?? {}) };
+            if (values.proxy)
+                config.env["AGENT_BROWSER_PROXY"] = values.proxy;
+            installDaemon();
+            if (!values["no-browser"])
+                config.env["AGENT_BROWSER_EXECUTABLE_PATH"] = installBrowser(values["agent-browser"] ?? DEFAULT_AGENT_BROWSER);
+            writeConfig(config);
+            restartDaemon();
+            const up = await health();
+            if (!up.ok)
+                throw new Error(`unfazed eve-sandbox: the daemon did not come up; see ${ROOT}/daemon.log`);
+            const alias = new URL(url).hostname.split(".")[0];
+            process.stdout.write(`eve sandbox ready at ${url} (daemon ${up.version}); allowed: ${config.allow.join(", ")}\n\n` +
+                `In the eve app:\n  export const environment = UnfazedSandbox.environment({ box: "${alias}" });\n`);
+            return 0;
+        }
+        case "allow":
+        case "deny": {
+            if (!arg)
+                throw new Error(`unfazed eve-sandbox: ${command} needs an app id or owner:<id>`);
+            const config = readConfig();
+            config.allow = command === "allow" ? [...new Set([...config.allow, arg])] : config.allow.filter((entry) => entry !== arg);
+            if (config.allow.length === 0)
+                throw new Error("unfazed eve-sandbox: that would allow nothing; allow another app first");
+            writeConfig(config);
+            restartDaemon();
+            const up = await health();
+            process.stdout.write(`${up.ok ? "restarted" : "NOT restarted (see daemon.log)"}; allowed: ${config.allow.join(", ")}\n`);
+            return up.ok ? 0 : 1;
+        }
+        case "status": {
+            const config = readConfig();
+            const up = await health();
+            process.stdout.write(`${url}: ${up.ok ? `up (daemon ${up.version})` : "DOWN"}\n` +
+                `allowed:  ${config.allow.join(", ") || "(none)"}\n` +
+                `sessions: ${sessionCount()}\n` +
+                `browser:  ${config.env?.["AGENT_BROWSER_EXECUTABLE_PATH"] ?? "(not installed)"}\n`);
+            return up.ok ? 0 : 1;
+        }
+        default:
+            process.stderr.write(HELP);
+            return 1;
+    }
+}
+//# sourceMappingURL=eve-sandbox.js.map

package/dist/cli/eve-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-sandbox.js","sourceRoot":"","sources":["../../src/cli/eve-sandbox.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,WAAW,EACX,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,IAAI,GAAG,mBAAmB,CAAC;AACjC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;AAC1B,MAAM,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC;AACrC,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAC3C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C,MAAM,IAAI,GAAG;;;;;;;;;;;qEAWwD,qBAAqB;;;;;;;CAOzF,CAAC;AAUF,SAAS,UAAU;IACjB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAC;IAClE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,GAAG,MAAM,MAAM,CAAC;IAC7B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,EAAE,CAAC,IAAY,EAAE,IAAuB,EAAE,UAA+B,EAAE;IAClF,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC3I,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACtG,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,QAAQ;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,2BAA2B,EAAE;QAC5H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAClH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE3H,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC3G,OAAO,SAAS,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa;IACpB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EACJ;QACE,WAAW;QACX,6EAA6E;QAC7E,MAAM,IAAI,YAAY;QACtB,gBAAgB;QAChB,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,6BAA6B,MAAM,MAAM,IAAI,kBAAkB;QACvJ,WAAW;QACX,MAAM;QACN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,iDAAiD,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;IAClE,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1G,2EAA2E;IAC3E,qEAAqE;IACrE,2DAA2D;IAC3D,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/E,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,YAAY,CAAC,eAAe,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACrF,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACtC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAChE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa;IACpB,2EAA2E;IAC3E,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,CAAC,2BAA2B,EAAE,0CAA0C,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC;YACH,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC7C,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,WAAW,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,UAAU,EAAE,CAAC;IACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC;IAC5C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;gBACxB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC9D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;YACzB,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAE,EAAE;gBACxD,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAC;gBACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,yBAAyB,CAAC,CAAC;gBAC5G,OAAO,CAAC,CAAC;YACX,CAAC,CAAC;YACF,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YAChG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YACxG,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YACnE,aAAa,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,qBAAqB,CAAC,CAAC;YAC1I,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,aAAa,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,GAAG,YAAY,EAAE,CAAC,OAAO,eAAe,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC3F,oFAAoF,KAAK,SAAS,CACrG,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,gCAAgC,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;YAC1H,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzH,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gCAAgC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzH,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI;gBACzD,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI;gBACpD,aAAa,YAAY,EAAE,IAAI;gBAC/B,aAAa,MAAM,CAAC,GAAG,EAAE,CAAC,+BAA+B,CAAC,IAAI,iBAAiB,IAAI,CACtF,CAAC;YACF,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC","sourcesContent":["/// <reference types=\"node\" />\n/**\n * `npx unfazed eve-sandbox <command>`, run as root inside an unfazed box:\n * turns the box into a sandbox host for eve apps (`unfazed/eve-sandbox`).\n *\n *   setup [--allow <app-id|owner:id>,…] [--no-browser] [--agent-browser <version>]\n *         [--proxy <url>] [--idle-minutes <n>] [--retention-days <n>]\n *   allow <app-id|owner:id>      add to the allow list and restart the daemon\n *   deny <app-id|owner:id>       remove from it and restart the daemon\n *   status                       the daemon's health, allow list and sessions\n *   serve                        run the daemon in the foreground\n *\n * `setup` copies the daemon to /data/eve-sandbox, writes its config and a box\n * boot hook (/data/boot.d/50-eve-sandbox, run on every boot by the box's\n * init), installs agent-browser and Chromium for every session, and (re)starts\n * the daemon on :3000, which unfazed publishes at the box's URL. Without\n * --allow, every app of the box's own owner may use it.\n */\nimport { execFileSync, spawn } from \"node:child_process\";\nimport {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  renameSync,\n  rmSync,\n  symlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { parseArgs } from \"node:util\";\n\n/** The agent-browser release `@agent-browser/eve` 0.41 drives; match the extension's minor. */\nexport const DEFAULT_AGENT_BROWSER = \"0.41.1\";\n\nconst ROOT = \"/data/eve-sandbox\";\nconst LIB = `${ROOT}/lib`;\nconst CONFIG = `${ROOT}/config.json`;\nconst HOOK = \"/data/boot.d/50-eve-sandbox\";\nconst BROWSERS = \"/opt/agent-browser/browsers\";\n\nconst HELP = `unfazed eve-sandbox — run eve sandboxes on this unfazed box (as root, inside the box)\n\nUsage:\n  npx unfazed eve-sandbox setup [--allow <app-id|owner:id>,…] [--no-browser]\n                                [--agent-browser <version>] [--proxy <url>]\n                                [--idle-minutes <n>] [--retention-days <n>]\n  npx unfazed eve-sandbox allow <app-id|owner:id>\n  npx unfazed eve-sandbox deny <app-id|owner:id>\n  npx unfazed eve-sandbox status\n  npx unfazed eve-sandbox serve\n\nsetup installs the daemon (on :3000, the box's URL), agent-browser ${DEFAULT_AGENT_BROWSER}\nand Chromium, and a boot hook that starts the daemon on every boot. Without\n--allow, every app of this box's owner may use the box. An eve app then\npoints its agent/sandbox.ts at it with UnfazedSandbox (unfazed/eve-sandbox):\n\n  export const environment = UnfazedSandbox.environment({ box: \"<this box's alias>\" });\n  export default defineSandbox(() => environment.open());\n`;\n\ninterface Config {\n  allow: string[];\n  idleMinutes?: number;\n  retentionDays?: number;\n  env?: Record<string, string>;\n  [key: string]: unknown;\n}\n\nfunction readConfig(): Config {\n  if (!existsSync(CONFIG)) return { allow: [] };\n  const parsed = JSON.parse(readFileSync(CONFIG, \"utf8\")) as Config;\n  return { ...parsed, allow: Array.isArray(parsed.allow) ? parsed.allow : [] };\n}\n\nfunction writeConfig(config: Config): void {\n  const temp = `${CONFIG}.tmp`;\n  writeFileSync(temp, JSON.stringify(config, null, 2) + \"\\n\", { mode: 0o600 });\n  renameSync(temp, CONFIG);\n}\n\nfunction sh(file: string, args: readonly string[], options: { quiet?: boolean } = {}): string {\n  return execFileSync(file, args, { encoding: \"utf8\", stdio: options.quiet ? [\"ignore\", \"pipe\", \"pipe\"] : [\"ignore\", \"pipe\", \"inherit\"] });\n}\n\nfunction requireBox(): void {\n  if (process.getuid?.() !== 0) throw new Error(\"unfazed eve-sandbox: run this as root inside the box\");\n  if (!existsSync(\"/sbin/unfazed-box-init\") || !process.env[\"UNFZ_PUBLIC_URL\"]) {\n    throw new Error(\"unfazed eve-sandbox: this is not an unfazed box (no /sbin/unfazed-box-init or UNFZ_PUBLIC_URL)\");\n  }\n}\n\n/** The box's own owner, from its workload identity token: the default allow entry. */\nasync function ownOwner(): Promise<string> {\n  const state = process.env[\"UNFZ_STATE_TOKEN\"];\n  const audience = process.env[\"UNFZ_PUBLIC_URL\"]!;\n  if (!state) throw new Error(\"unfazed eve-sandbox: UNFZ_STATE_TOKEN is not set; pass --allow\");\n  const res = await fetch(\"https://unfazed.dev/oidc/token\", {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${state}`, \"content-type\": \"application/json\", \"user-agent\": \"unfazed-eve-sandbox-setup\" },\n    body: JSON.stringify({ audience }),\n  });\n  if (!res.ok) throw new Error(`unfazed eve-sandbox: could not read the box's owner (${res.status}); pass --allow`);\n  const { token } = (await res.json()) as { token: string };\n  const claims = JSON.parse(Buffer.from(token.split(\".\")[1]!.replace(/-/g, \"+\").replace(/_/g, \"/\"), \"base64\").toString(\"utf8\")) as {\n    owner_id?: string;\n  };\n  if (!claims.owner_id) throw new Error(\"unfazed eve-sandbox: the box's token names no owner; pass --allow\");\n  return `owner:${claims.owner_id}`;\n}\n\nfunction installDaemon(): void {\n  mkdirSync(LIB, { recursive: true });\n  chmodSync(ROOT, 0o755);\n  chmodSync(LIB, 0o755);\n  const source = join(dirname(fileURLToPath(import.meta.url)), \"..\", \"eve-sandbox\");\n  for (const file of [\"daemon.js\", \"protocol.js\"]) {\n    copyFileSync(join(source, file), join(LIB, file));\n    chmodSync(join(LIB, file), 0o644);\n  }\n  mkdirSync(dirname(HOOK), { recursive: true });\n  writeFileSync(\n    HOOK,\n    [\n      \"#!/bin/sh\",\n      \"# eve sandbox daemon (unfazed/eve-sandbox) on :3000, restarted if it exits.\",\n      `cd ${ROOT} || exit 1`,\n      \"while true; do\",\n      `  ${existsSync(\"/usr/local/bin/node\") ? \"/usr/local/bin/node\" : process.execPath} ${LIB}/daemon.js serve --config ${CONFIG} >>${ROOT}/daemon.log 2>&1`,\n      \"  sleep 2\",\n      \"done\",\n      \"\",\n    ].join(\"\\n\"),\n    { mode: 0o755 },\n  );\n}\n\n/** Installs agent-browser and Chromium once for every session; returns the Chromium binary. */\nfunction installBrowser(version: string): string {\n  process.stderr.write(`installing agent-browser@${version} and Chromium (a few minutes the first time)…\\n`);\n  const env = { ...process.env, DEBIAN_FRONTEND: \"noninteractive\" };\n  execFileSync(\"npm\", [\"install\", \"-g\", \"--silent\", `agent-browser@${version}`], { stdio: \"inherit\", env });\n  // agent-browser keeps browsers in the installing user's home; sessions are\n  // other users. Root's browser directory becomes the shared one, so a\n  // browser already there is found and not downloaded again.\n  mkdirSync(BROWSERS, { recursive: true });\n  const own = join(process.env[\"HOME\"] ?? \"/root\", \".agent-browser\", \"browsers\");\n  mkdirSync(dirname(own), { recursive: true });\n  if (existsSync(own) && !lstatSync(own).isSymbolicLink()) {\n    for (const entry of readdirSync(own)) {\n      if (!existsSync(join(BROWSERS, entry))) renameSync(join(own, entry), join(BROWSERS, entry));\n    }\n    rmSync(own, { recursive: true, force: true });\n  }\n  if (!existsSync(own)) symlinkSync(BROWSERS, own);\n  execFileSync(\"agent-browser\", [\"install\", \"--with-deps\"], { stdio: \"inherit\", env });\n  sh(\"chmod\", [\"-R\", \"a+rX\", \"/opt/agent-browser\"]);\n  const latest = readdirSync(BROWSERS)\n    .filter((e) => e.startsWith(\"chrome-\"))\n    .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))\n    .at(-1);\n  const binary = latest ? join(BROWSERS, latest, \"chrome\") : \"\";\n  if (!binary || !existsSync(binary)) throw new Error(\"unfazed eve-sandbox: Chromium was not found after the install\");\n  return binary;\n}\n\nfunction restartDaemon(): void {\n  // The boot hook's loop first (or it starts the old daemon again), then any\n  // daemon, wherever an earlier setup put it.\n  for (const pattern of [\"[b]oot\\\\.d/50-eve-sandbox\", \"[e]ve-sandbox[^ ]*daemon[^ ]*\\\\.js serve\"]) {\n    try {\n      sh(\"pkill\", [\"-f\", pattern], { quiet: true });\n    } catch {\n      // none running\n    }\n  }\n  execFileSync(\"sleep\", [\"1\"]);\n  const child = spawn(\"setsid\", [HOOK], { detached: true, stdio: \"ignore\" });\n  child.unref();\n}\n\nasync function health(): Promise<{ ok: boolean; version?: string }> {\n  for (let i = 0; i < 20; i++) {\n    try {\n      const res = await fetch(\"http://127.0.0.1:3000/v1/health\", { signal: AbortSignal.timeout(2000) });\n      if (res.ok) return (await res.json()) as { ok: boolean; version?: string };\n    } catch {\n      // not up yet\n    }\n    await new Promise((resolve) => setTimeout(resolve, 500));\n  }\n  return { ok: false };\n}\n\nfunction sessionCount(): number {\n  return sh(\"getent\", [\"passwd\"], { quiet: true })\n    .split(\"\\n\")\n    .filter((line) => /^eve[0-9a-f]{12}:/.test(line)).length;\n}\n\nexport async function runEveSandbox(argv: readonly string[]): Promise<number> {\n  const { values, positionals } = parseArgs({\n    args: [...argv],\n    allowPositionals: true,\n    options: {\n      allow: { type: \"string\" },\n      \"no-browser\": { type: \"boolean\" },\n      \"agent-browser\": { type: \"string\" },\n      proxy: { type: \"string\" },\n      \"idle-minutes\": { type: \"string\" },\n      \"retention-days\": { type: \"string\" },\n      config: { type: \"string\" },\n      help: { type: \"boolean\", short: \"h\" },\n    },\n  });\n  const [command, arg] = positionals;\n  if (values.help || command === undefined || command === \"help\") {\n    process.stdout.write(HELP);\n    return command === undefined ? 1 : 0;\n  }\n  if (command === \"serve\") {\n    const daemon = await import(\"../eve-sandbox/daemon.js\");\n    const config = daemon.loadConfig(values.config ?? CONFIG);\n    await daemon.createDaemon(config).listen();\n    process.stdout.write(`eve sandbox daemon on :${config.port} for ${config.audience}\\n`);\n    await new Promise(() => {});\n  }\n  requireBox();\n  const url = process.env[\"UNFZ_PUBLIC_URL\"]!;\n  switch (command) {\n    case \"setup\": {\n      const config = readConfig();\n      const allow = values.allow\n        ? values.allow.split(\",\").map((s) => s.trim()).filter(Boolean)\n        : config.allow.length > 0\n          ? []\n          : [await ownOwner()];\n      config.allow = [...new Set([...config.allow, ...allow])];\n      const number = (flag: string | undefined, name: string) => {\n        if (flag === undefined) return undefined;\n        const n = Number(flag);\n        if (!Number.isInteger(n) || n < 0) throw new Error(`unfazed eve-sandbox: --${name} must be a whole number`);\n        return n;\n      };\n      config.idleMinutes = number(values[\"idle-minutes\"], \"idle-minutes\") ?? config.idleMinutes ?? 20;\n      config.retentionDays = number(values[\"retention-days\"], \"retention-days\") ?? config.retentionDays ?? 14;\n      config.env = { ...(config.env ?? {}) };\n      if (values.proxy) config.env[\"AGENT_BROWSER_PROXY\"] = values.proxy;\n      installDaemon();\n      if (!values[\"no-browser\"]) config.env[\"AGENT_BROWSER_EXECUTABLE_PATH\"] = installBrowser(values[\"agent-browser\"] ?? DEFAULT_AGENT_BROWSER);\n      writeConfig(config);\n      restartDaemon();\n      const up = await health();\n      if (!up.ok) throw new Error(`unfazed eve-sandbox: the daemon did not come up; see ${ROOT}/daemon.log`);\n      const alias = new URL(url).hostname.split(\".\")[0];\n      process.stdout.write(\n        `eve sandbox ready at ${url} (daemon ${up.version}); allowed: ${config.allow.join(\", \")}\\n\\n` +\n          `In the eve app:\\n  export const environment = UnfazedSandbox.environment({ box: \"${alias}\" });\\n`,\n      );\n      return 0;\n    }\n    case \"allow\":\n    case \"deny\": {\n      if (!arg) throw new Error(`unfazed eve-sandbox: ${command} needs an app id or owner:<id>`);\n      const config = readConfig();\n      config.allow = command === \"allow\" ? [...new Set([...config.allow, arg])] : config.allow.filter((entry) => entry !== arg);\n      if (config.allow.length === 0) throw new Error(\"unfazed eve-sandbox: that would allow nothing; allow another app first\");\n      writeConfig(config);\n      restartDaemon();\n      const up = await health();\n      process.stdout.write(`${up.ok ? \"restarted\" : \"NOT restarted (see daemon.log)\"}; allowed: ${config.allow.join(\", \")}\\n`);\n      return up.ok ? 0 : 1;\n    }\n    case \"status\": {\n      const config = readConfig();\n      const up = await health();\n      process.stdout.write(\n        `${url}: ${up.ok ? `up (daemon ${up.version})` : \"DOWN\"}\\n` +\n          `allowed:  ${config.allow.join(\", \") || \"(none)\"}\\n` +\n          `sessions: ${sessionCount()}\\n` +\n          `browser:  ${config.env?.[\"AGENT_BROWSER_EXECUTABLE_PATH\"] ?? \"(not installed)\"}\\n`,\n      );\n      return up.ok ? 0 : 1;\n    }\n    default:\n      process.stderr.write(HELP);\n      return 1;\n  }\n}\n"]}