withruntime 0.9.0 → 0.11.0

package/dist/codesandbox/guest-service.js

@@ -30,15 +30,35 @@ def settled(run):
   # Keep terminal failure readable over the socket even when storage is full.
   run['exitCode']=125
   run['error']=(run.get('error','')+'; ' if run.get('error') else '')+'Cannot persist task result: '+str(e)
+def exited(proc):
+ if proc.returncode is not None: return True
+ # Leave the leader waitable: its PID cannot be reused before group cleanup.
+ try: return os.waitid(os.P_PID,proc.pid,os.WEXITED|os.WNOHANG|os.WNOWAIT) is not None
+ except ChildProcessError: return proc.returncode is not None
+def kill_group(proc,signum):
+ # Callers hold the run lock, so no other thread can reap this owned leader.
+ if proc.returncode is not None: return
+ try: os.killpg(proc.pid,signum)
+ except ProcessLookupError: pass
+ except PermissionError:
+  # Darwin reports EPERM for a group containing only zombies. Keep real
+  # permission failures observable; only accept a verified empty/live-free
+  # group while our unreaped leader still prevents group-ID reuse.
+  if sys.platform!='darwin' or not exited(proc): raise
+  states=subprocess.run(['ps','-o','stat=','-g',str(proc.pid)],capture_output=True,text=True,timeout=2)
+  if states.returncode not in (0,1) or any(not state.startswith('Z') for state in states.stdout.split()): raise
 def complete(run):
  fd=run['fd']
  failed=False
  try:
   with open(os.path.join(root,run['id']+'.log'),'ab',buffering=0) as out:
    while True:
+    with run['_lock']:
+     done=exited(run['process'])
+     if done: kill_group(run['process'],signal.SIGKILL)
     ready,_,_=select.select([fd],[],[],0.05)
     if not ready:
-     if run['process'].poll() is not None: break
+     if done: break
      continue
     try: data=os.read(fd,65536)
     except OSError as e:
@@ -49,27 +69,35 @@ def complete(run):
  except BaseException as e:
   failed=True
   with run['_lock']: run['error']=str(e)
-  try: os.killpg(run['process'].pid,signal.SIGKILL)
-  except ProcessLookupError: pass
+  with run['_lock']: kill_group(run['process'],signal.SIGKILL)
  finally:
-  code=run['process'].wait()
-  with run['_lock']:
-   try: os.close(fd)
-   except OSError: pass
-   run['fd']=None
-   run['exitCode']=125 if failed else code
-   run['state']='exited'
-   settled(run)
+  # A terminal can report EIO as its leader exits, before the polling branch
+  # observes that exit. Cleanup must also precede this final reap. Do not hold
+  # the run lock while a still-running leader waits, so stop remains usable.
+  while True:
+   with run['_lock']:
+    if exited(run['process']):
+     kill_group(run['process'],signal.SIGKILL)
+     code=run['process'].wait()
+     try: os.close(fd)
+     except OSError: pass
+     run['fd']=None
+     run['exitCode']=125 if failed else code
+     run['state']='exited'
+     settled(run)
+     break
+   time.sleep(0.02)
 def stop(run):
  if run.get('state')!='running': return
  proc=run.get('process')
- if proc is not None and proc.poll() is None:
-  try: os.killpg(proc.pid,signal.SIGTERM)
-  except ProcessLookupError: pass
-  try: proc.wait(timeout=2)
-  except subprocess.TimeoutExpired:
-   try: os.killpg(proc.pid,signal.SIGKILL)
-   except ProcessLookupError: pass
+ if proc is not None:
+  with run['_lock']:
+   kill_group(proc,signal.SIGTERM)
+   deadline=time.monotonic()+2
+   while not exited(proc) and time.monotonic()<deadline: time.sleep(0.02)
+   # The leader can exit on TERM while a descendant ignores it. Kill the
+   # remaining group before reaping, even when the leader already exited.
+   kill_group(proc,signal.SIGKILL)
    proc.wait()
  elif proc is None and run.get('pid') and run.get('identity') and identity(run['pid'])==run['identity']:
   # On supervisor recovery, fence against PID reuse before touching a process.
@@ -235,10 +263,19 @@ def boot():
    while True:
     try:
      with open(progress) as f: result=json.load(f)
-    except FileNotFoundError: return
+    except FileNotFoundError: raise RuntimeError('Setup exited without terminal progress')
     if result.get('state')!='IN_PROGRESS': break
+    # A second runner may have won the setup lock. Wait only while it owns
+    # that lock; an exited runner with stale progress cannot ever finish.
+    with open(os.path.join(setup_root,'lock'),'a') as active:
+     try: fcntl.flock(active,fcntl.LOCK_EX|fcntl.LOCK_NB)
+     except BlockingIOError: pass
+     else:
+      with open(progress) as f: result=json.load(f)
+      if result.get('state')=='IN_PROGRESS': raise RuntimeError('Setup exited without terminal progress')
+      break
     time.sleep(0.1)
-   if result.get('state')!='FINISHED' or result.get('config')!=setup['config']: return
+   if result.get('state')!='FINISHED' or result.get('config')!=setup['config']: raise RuntimeError('Setup exited without matching terminal progress')
  # The service owns automatic tasks independently of SDK connections.
  with mutex:
   for task,definition in cfg['tasks'].items():

package/dist/codesandbox/index.js

@@ -58,6 +58,10 @@ const metadata = (s) => ({
             : (s.info.labels["cs.privacy"] ?? "private"),
     tags: JSON.parse(s.info.labels["cs.tags"] ?? "[]"),
 });
+function validateHibernationTimeout(seconds) {
+    if (seconds !== undefined && (!Number.isSafeInteger(seconds) || seconds < 0 || seconds > 86_400))
+        throw new RangeError("hibernationTimeoutSeconds must be an integer from 0 to 86400.");
+}
 export class Sandboxes {
     runtime;
     constructor(runtime) {
@@ -73,6 +77,7 @@ export class Sandboxes {
             "vmTier",
             "hibernationTimeoutSeconds",
         ]);
+        validateHibernationTimeout(options.hibernationTimeoutSeconds);
         const labels = {
             "compat.provider": "codesandbox",
             "cs.tags": JSON.stringify([...new Set([...(options.tags ?? []), "sdk"])]),
@@ -119,6 +124,7 @@ export class Sandboxes {
     }
     async restart(id, options = {}) {
         only("CodeSandbox restart", options, ["hibernationTimeoutSeconds"]);
+        validateHibernationTimeout(options.hibernationTimeoutSeconds);
         const s = await this.runtime.sandboxes.get(id);
         await s.stop();
         await s.restart();
@@ -143,19 +149,37 @@ export class Sandboxes {
         ]);
         if (options.orderBy === "updated_at")
             throw new CompatibilityError("CodeSandbox", "sorting by updated_at");
-        let sandboxes = (await all(this.runtime, "codesandbox"))
+        const limit = options.limit ?? 50;
+        let currentPage = options.pagination?.page ?? 1;
+        const pageSize = options.pagination?.pageSize ?? limit;
+        for (const [name, value] of [
+            ["limit", limit],
+            ["page", currentPage],
+            ["pageSize", pageSize],
+        ])
+            if (!Number.isSafeInteger(value) || value <= 0)
+                throw new RangeError(`${name} must be a positive safe integer.`);
+        const sandboxes = (await all(this.runtime, "codesandbox"))
             .filter((s) => (!options.status || s.state === "running") &&
             (options.tags ?? []).every((tag) => metadata(s).tags.includes(tag)))
             .map(metadata);
         sandboxes.sort((a, b) => (a.createdAt.getTime() - b.createdAt.getTime()) * (options.direction === "desc" ? -1 : 1));
-        const totalCount = sandboxes.length, page = options.pagination?.page ?? 1, pageSize = options.pagination?.pageSize ?? options.limit ?? 50;
-        sandboxes = sandboxes.slice((page - 1) * pageSize, page * pageSize);
-        const hasMore = page * pageSize < totalCount;
+        const totalCount = sandboxes.length;
+        const selected = [];
+        let nextPage;
+        for (;;) {
+            const offset = (currentPage - 1) * pageSize;
+            selected.push(...sandboxes.slice(offset, offset + pageSize));
+            nextPage = offset + pageSize < totalCount ? currentPage + 1 : null;
+            if (nextPage === null || selected.length >= limit)
+                break;
+            currentPage = nextPage;
+        }
         return {
-            sandboxes,
+            sandboxes: selected,
             totalCount,
-            hasMore,
-            pagination: { currentPage: page, nextPage: hasMore ? page + 1 : null, pageSize },
+            hasMore: totalCount > selected.length,
+            pagination: { currentPage, nextPage, pageSize },
         };
     }
 }
@@ -475,14 +499,22 @@ export class SandboxClient {
         };
         this.ports = {
             get: async (port) => {
+                this.assertConnected();
                 if (native.info.labels["cs.privacy"] === "private")
                     throw new CompatibilityError("CodeSandbox", "private port host authentication; use Runtime signed preview URLs");
                 const p = await native.previews.create(port, { visibility: "public" });
                 this.previewURLs.set(port, p.urlWithToken ?? p.url);
                 return { port, host: new URL(p.urlWithToken ?? p.url).host };
             },
-            getAll: async () => (await native.previews.list()).map((p) => ({ port: p.port, host: new URL(p.url).host })),
+            getAll: async () => {
+                this.assertConnected();
+                return (await native.previews.list()).map((p) => ({
+                    port: p.port,
+                    host: new URL(p.url).host,
+                }));
+            },
             waitForPort: async (port, options = {}) => {
+                this.assertConnected();
                 if (!Number.isInteger(port) || port < 1 || port > 65535)
                     throw new TypeError("Invalid port");
                 await native.exec([
@@ -586,6 +618,8 @@ export class Tasks {
         this.managed = new ManagedTasks(native);
     }
     getAll() {
+        if (this.client.state !== "CONNECTED")
+            return Promise.reject(new Error("Sandbox client is disconnected."));
         return (this.cached ??= this.load().catch((error) => {
             this.cached = undefined;
             throw error;

package/dist/compat/core.d.ts

@@ -1,6 +1,7 @@
-import { Runtime, type RuntimeOptions } from "../client.js";
+import { Runtime, type CreateOptions, type RuntimeOptions } from "../client.js";
 import type { Sandbox } from "../sandbox.js";
 import type { CreateSandbox, ExecOptions } from "../types.js";
+import type { RequestOptions } from "../transport.js";
 export type ClientOptions = RuntimeOptions & {
     client?: Runtime;
 };
@@ -16,14 +17,14 @@ export declare function only(provider: string, value: object, keys: readonly str
 export declare function region(provider: string, value?: string | null): string | undefined;
 export declare const quote: (value: string) => string;
 export declare const pathAt: (path: string, cwd?: string) => string;
-export declare function environment(sandbox: Sandbox): Promise<Record<string, string>>;
-export declare function saveEnvironment(sandbox: Sandbox, env: Record<string, string>): Promise<void>;
+export declare function environment(sandbox: Sandbox, options?: RequestOptions): Promise<Record<string, string>>;
+export declare function saveEnvironment(sandbox: Sandbox, env: Record<string, string>, options?: RequestOptions): Promise<void>;
 export declare function validateEnvironment(env: Record<string, string>): void;
-export declare function execOptions(sandbox: Sandbox, options?: ExecOptions): Promise<ExecOptions>;
-export declare function create(runtime: Runtime, provider: string, input: CreateSandbox, env?: Record<string, string> | undefined, setup?: (sandbox: Sandbox) => Promise<void>): Promise<Sandbox>;
-export declare function destroy(sandbox: Sandbox): Promise<void>;
+export declare function execOptions(sandbox: Sandbox, options?: ExecOptions, request?: RequestOptions): Promise<ExecOptions>;
+export declare function create(runtime: Runtime, provider: string, input: CreateSandbox, env?: Record<string, string> | undefined, setup?: (sandbox: Sandbox) => Promise<void>, options?: CreateOptions): Promise<Sandbox>;
+export declare function destroy(sandbox: Sandbox, options?: RequestOptions): Promise<void>;
 export declare function ready(sandbox: Sandbox): Promise<Sandbox>;
-export declare function lookup(runtime: Runtime, id: string): Promise<Sandbox>;
+export declare function lookup(runtime: Runtime, id: string, options?: RequestOptions): Promise<Sandbox>;
 export declare function all(runtime: Runtime, provider: string): Promise<Sandbox[]>;
 export declare function image(runtime: Runtime, ref: string): Promise<string>;
 export declare function checked(sandbox: Sandbox, argv: string[], options?: ExecOptions): Promise<void>;
@@ -34,6 +35,6 @@ export declare function shellCommand(sandbox: Sandbox, command: string, name?: s
     env?: Record<string, string>;
     cwd?: string;
     persist?: boolean;
-}): Promise<string | string[]>;
+}, request?: RequestOptions): Promise<string | string[]>;
 export declare function closeShell(sandbox: Sandbox, name: string): Promise<void>;
 export declare function shellRoot(name: string): Promise<string>;

package/dist/compat/core.js

@@ -40,9 +40,12 @@ export function region(provider, value) {
 export const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 export const pathAt = (path, cwd = "/workspace") => path.startsWith("/") ? path : `${cwd.replace(/\/$/, "")}/${path}`;
 const ENV_PATH = "/workspace/.runtime-compat/environment.json";
-export async function environment(sandbox) {
+export async function environment(sandbox, options = {}) {
+    options.signal?.throwIfAborted();
     try {
-        return JSON.parse(await sandbox.files.readText(ENV_PATH));
+        const text = await sandbox.files.readText(ENV_PATH, options);
+        options.signal?.throwIfAborted();
+        return JSON.parse(text);
     }
     catch (error) {
         if (error instanceof NotFoundError)
@@ -50,9 +53,14 @@ export async function environment(sandbox) {
         throw error;
     }
 }
-export async function saveEnvironment(sandbox, env) {
+export async function saveEnvironment(sandbox, env, options = {}) {
+    options.signal?.throwIfAborted();
     validateEnvironment(env);
-    await sandbox.files.write(ENV_PATH, JSON.stringify(env), { mode: 0o600 });
+    await sandbox.files.write(ENV_PATH, JSON.stringify(env), {
+        mode: 0o600,
+        signal: options.signal,
+        timeoutMs: options.timeoutMs,
+    });
 }
 export function validateEnvironment(env) {
     for (const key of Object.keys(env))
@@ -62,23 +70,39 @@ export function validateEnvironment(env) {
         if (typeof value !== "string" || value.includes("\0"))
             throw new TypeError("Environment values must be strings without NUL bytes");
 }
-export async function execOptions(sandbox, options = {}) {
-    return { ...options, env: { ...(await environment(sandbox)), ...options.env } };
+export async function execOptions(sandbox, options = {}, request = {}) {
+    const requestOptions = { ...request, signal: request.signal ?? options.signal };
+    return { ...options, env: { ...(await environment(sandbox, requestOptions)), ...options.env } };
 }
-export async function create(runtime, provider, input, env = undefined, setup) {
+export async function create(runtime, provider, input, env = undefined, setup, options = {}) {
+    options.signal?.throwIfAborted();
     if (env !== undefined)
         validateEnvironment(env);
     const sandbox = await runtime.sandboxes.create({
         ...input,
         labels: { ...input.labels, "compat.provider": provider },
-    });
+    }, options);
     try {
+        options.signal?.throwIfAborted();
         if (env !== undefined || !input.snapshot)
-            await saveEnvironment(sandbox, env ?? {});
+            await saveEnvironment(sandbox, env ?? {}, options);
+        options.signal?.throwIfAborted();
         await setup?.(sandbox);
+        options.signal?.throwIfAborted();
         return sandbox;
     }
     catch (error) {
+        // Cancellation cannot authorize deleting a remote resource: the response
+        // may be a retry/reuse of a sandbox that already has somebody's work.
+        // Legacy failed-initialization rollback is limited to an ordinary create
+        // with a new SDK-generated mutation key and no replay/reuse marker.
+        if (options.signal?.aborted ||
+            (error instanceof RuntimeError && error.code === "timeout") ||
+            input.getOrCreate === true ||
+            options.idempotencyKey !== undefined ||
+            sandbox.info.replayed === true ||
+            sandbox.info.reused === true)
+            throw error;
         try {
             await destroy(sandbox);
         }
@@ -88,13 +112,16 @@ export async function create(runtime, provider, input, env = undefined, setup) {
         throw error;
     }
 }
-export async function destroy(sandbox) {
+export async function destroy(sandbox, options = {}) {
     // Stop before releasing persistence: a paused sandbox cannot change its disk
     // meter, and must never be woken solely to delete it. The stopped update queues
     // disk destruction; see ARCHITECTURE.md section 10 and migration 0181.
-    await sandbox.stop();
+    options.signal?.throwIfAborted();
+    if (options.idempotencyKey !== undefined)
+        throw new CompatibilityError("Runtime", "caller idempotency keys for compound sandbox deletion");
+    await sandbox.stop(options);
     if (sandbox.info.persistent)
-        await sandbox.update({ persistent: false });
+        await sandbox.update({ persistent: false }, options);
 }
 export async function ready(sandbox) {
     if (sandbox.state === "paused")
@@ -105,15 +132,18 @@ export async function ready(sandbox) {
         await sandbox.waitFor("running");
     return sandbox;
 }
-export async function lookup(runtime, id) {
+export async function lookup(runtime, id, options = {}) {
+    options.signal?.throwIfAborted();
     if (/^[a-f0-9-]{36}$/i.test(id))
-        return runtime.sandboxes.get(id);
-    const page = await runtime.sandboxes.list({ name: id, includeStopped: true });
-    for await (const sandbox of page)
+        return runtime.sandboxes.get(id, options);
+    const page = await runtime.sandboxes.list({ name: id, includeStopped: true }, options);
+    for await (const sandbox of page) {
+        options.signal?.throwIfAborted();
         if (sandbox.info.name === id)
             return sandbox;
+    }
     // IDs are not necessarily UUIDs in local or self-hosted servers.
-    return runtime.sandboxes.get(id);
+    return runtime.sandboxes.get(id, options);
 }
 export async function all(runtime, provider) {
     const result = [];
@@ -141,14 +171,23 @@ export function missing(path) {
 }
 /** Foreground commands share a resident Bash process. Background commands start
  * from the last completed exported environment/cwd snapshot without blocking it. */
-export async function shellCommand(sandbox, command, name, overrides = {}) {
+export async function shellCommand(sandbox, command, name, overrides = {}, request = {}) {
+    request.signal?.throwIfAborted();
     if (!name)
         return command;
     const root = await shellRoot(name);
-    await sandbox.files.mkdir(root, { parents: true });
+    await sandbox.files.mkdir(root, {
+        parents: true,
+        signal: request.signal,
+        timeoutMs: request.timeoutMs,
+    });
     if (overrides.persist !== false) {
         const script = "/workspace/.runtime-compat/shell.py";
-        await sandbox.files.write(script, SHELL_BROKER, { mode: 0o600 });
+        await sandbox.files.write(script, SHELL_BROKER, {
+            mode: 0o600,
+            signal: request.signal,
+            timeoutMs: request.timeoutMs,
+        });
         return [
             "python3",
             script,
@@ -158,7 +197,7 @@ export async function shellCommand(sandbox, command, name, overrides = {}) {
                 command,
                 env: overrides.env ?? {},
                 cwd: overrides.cwd,
-                baseEnv: await environment(sandbox),
+                baseEnv: await environment(sandbox, request),
             }),
         ];
     }

package/dist/compat/files.js

@@ -25,8 +25,8 @@ export class GuestFiles {
             return;
         }
         const staging = `/workspace/.runtime-compat/write-${crypto.randomUUID()}`;
-        await sandbox.files.write(staging, bytes, { mode: 0o600, signal: options.signal });
         try {
+            await sandbox.files.write(staging, bytes, { mode: 0o600, signal: options.signal });
             await checked(sandbox, [
                 "bash",
                 "-c",
@@ -39,7 +39,9 @@ export class GuestFiles {
             ], { signal: options.signal });
         }
         finally {
-            await sandbox.files.remove(staging);
+            // Cleanup must preserve the write's outcome, including its original
+            // failure; a successful destination write must not invite a replay.
+            await sandbox.files.remove(staging).catch(() => undefined);
         }
     }
     writeTextFile(path, content) {
@@ -58,6 +60,21 @@ export class GuestFiles {
         const sandbox = await this.get();
         if (!overwrite && (await sandbox.files.exists(this.path(to))))
             throw new Error(`Destination exists: ${to}`);
+        if (!overwrite) {
+            // cp -n alone reports success when it skips a raced destination. Stage
+            // privately, then publish without replacement and verify it moved.
+            await checked(sandbox, [
+                "bash",
+                "-c",
+                'set -e; parent=$(dirname -- "$2"); stage="$parent/.runtime-copy-$4"; mkdir -m 700 -- "$stage"; trap \'rm -rf -- "$stage"\' EXIT; if [ "$3" = true ]; then cp -R -n -- "$1" "$stage/item"; else cp -n -- "$1" "$stage/item"; fi; mv -n -T -- "$stage/item" "$2"; if [ -e "$stage/item" ] || [ -L "$stage/item" ]; then printf "Destination exists: %s\\n" "$2" >&2; exit 73; fi',
+                "bash",
+                this.path(from),
+                this.path(to),
+                String(recursive),
+                crypto.randomUUID(),
+            ]);
+            return;
+        }
         await checked(sandbox, [
             "cp",
             ...(recursive ? ["-R"] : []),
@@ -97,8 +114,8 @@ export class GuestFiles {
             return;
         }
         const staging = `/workspace/.runtime-compat/append-${crypto.randomUUID()}`;
-        await sandbox.files.write(staging, bytes, { mode: 0o600 });
         try {
+            await sandbox.files.write(staging, bytes, { mode: 0o600 });
             await checked(sandbox, [
                 "bash",
                 "-c",
@@ -109,7 +126,8 @@ export class GuestFiles {
             ]);
         }
         finally {
-            await sandbox.files.remove(staging);
+            // A cleanup failure after success must not invite appending twice.
+            await sandbox.files.remove(staging).catch(() => undefined);
         }
     }
 }

package/dist/compat/lease.d.ts

@@ -0,0 +1,36 @@
+/** The most one lease runs ahead of now. */
+export declare const LEASE_MAX_SECONDS = 3600;
+/** What the keeper needs of a Runtime sandbox. */
+export interface Leased {
+    readonly state: string;
+    readonly info: {
+        expiresAt: string;
+    };
+    extend(seconds: number): Promise<unknown>;
+    refresh(): Promise<unknown>;
+}
+/** Whole seconds to add to a lease ending at `expiresAt` (epoch ms) so it
+ * reaches toward `until`, at most an hour ahead of `now`; 0 when more than
+ * `marginMs` is left or there is nothing to add. */
+export declare function extensionSeconds(expiresAt: number, until: number, now: number, marginMs: number): number;
+/** Keeps a running sandbox's lease reaching toward `until()`: on `check()`,
+ * and once a minute on a timer that never keeps a Node or Bun process alive.
+ * When the process ends, the lease runs out within the hour and the sandbox
+ * pauses or stops as it was told to at create. A paused or stopped sandbox is
+ * left alone; the adapter wakes it on its next call. */
+export declare class LeaseKeeper {
+    #private;
+    constructor(options: {
+        sandbox: () => Leased;
+        /** Epoch ms the lease should reach; Infinity for as long as this lives. */
+        until: () => number;
+        /** Extend only when less than this is left. */
+        marginMs: () => number;
+        everyMs?: number;
+    });
+    /** Extends the lease if it is near its end and should go further; `now`
+     * extends it as far as it may go whatever is left. One call at a time. */
+    check(now?: boolean): Promise<void>;
+    /** Stops extending: after stop() or delete(). */
+    end(): void;
+}

package/dist/compat/lease.js

@@ -0,0 +1,87 @@
+import { RuntimeError } from "../errors.js";
+/* A rival's sandbox may be asked to live longer than one Runtime lease (an
+   hour at most, ARCHITECTURE.md section 10): Vercel's `timeout` over an hour,
+   Daytona's `autoStopInterval` over an hour or 0. The drop-ins keep the lease
+   reaching toward the time asked for while their sandbox object lives, one
+   extension at a time, never past that time. */
+/** The most one lease runs ahead of now. */
+export const LEASE_MAX_SECONDS = 3600;
+/** Whole seconds to add to a lease ending at `expiresAt` (epoch ms) so it
+ * reaches toward `until`, at most an hour ahead of `now`; 0 when more than
+ * `marginMs` is left or there is nothing to add. */
+export function extensionSeconds(expiresAt, until, now, marginMs) {
+    // A lease with no readable end (one that never ends) is left alone.
+    if (!Number.isFinite(expiresAt) || expiresAt - now > marginMs)
+        return 0;
+    const target = Math.min(until, now + LEASE_MAX_SECONDS * 1000);
+    return Math.max(0, Math.floor((target - expiresAt) / 1000));
+}
+/** Keeps a running sandbox's lease reaching toward `until()`: on `check()`,
+ * and once a minute on a timer that never keeps a Node or Bun process alive.
+ * When the process ends, the lease runs out within the hour and the sandbox
+ * pauses or stops as it was told to at create. A paused or stopped sandbox is
+ * left alone; the adapter wakes it on its next call. */
+export class LeaseKeeper {
+    #sandbox;
+    #until;
+    #marginMs;
+    #everyMs;
+    #timer;
+    #pending;
+    #ended = false;
+    constructor(options) {
+        this.#sandbox = options.sandbox;
+        this.#until = options.until;
+        this.#marginMs = options.marginMs;
+        this.#everyMs = options.everyMs ?? 60_000;
+    }
+    /** Starts the timer when the lease must outlive the next extension. */
+    #schedule() {
+        if (this.#ended || this.#timer)
+            return;
+        const expiresAt = Date.parse(this.#sandbox().info.expiresAt);
+        if (!Number.isFinite(expiresAt) || this.#until() <= expiresAt)
+            return;
+        this.#timer = setTimeout(() => {
+            this.#timer = undefined;
+            void this.check().catch(() => undefined);
+        }, this.#everyMs);
+        this.#timer.unref?.();
+    }
+    /** Extends the lease if it is near its end and should go further; `now`
+     * extends it as far as it may go whatever is left. One call at a time. */
+    check(now = false) {
+        if (this.#ended)
+            return Promise.resolve();
+        this.#pending ??= this.#extend(now).finally(() => {
+            this.#pending = undefined;
+            this.#schedule();
+        });
+        return this.#pending;
+    }
+    async #extend(now) {
+        const sandbox = this.#sandbox();
+        if (sandbox.state !== "running")
+            return;
+        const seconds = extensionSeconds(Date.parse(sandbox.info.expiresAt), this.#until(), Date.now(), now ? Infinity : this.#marginMs());
+        if (seconds < 1)
+            return;
+        try {
+            await sandbox.extend(seconds);
+        }
+        catch (error) {
+            // The lease may have ended since the sandbox was last read; the next
+            // call through the adapter says what state it is in.
+            if (!(error instanceof RuntimeError && error.status === 409))
+                throw error;
+            await sandbox.refresh().catch(() => undefined);
+        }
+    }
+    /** Stops extending: after stop() or delete(). */
+    end() {
+        this.#ended = true;
+        if (this.#timer)
+            clearTimeout(this.#timer);
+        this.#timer = undefined;
+    }
+}

package/dist/credentials.d.ts

@@ -14,6 +14,9 @@ export declare function connectionOrigins(env: NodeJS.ProcessEnv): {
     api: string;
     auth: string;
 };
+/** Browser-issued production credentials must only reach the production API.
+ * CLI and MCP share this boundary, including resumed device requests. */
+export declare function checkBrowserOrigins(origins: ReturnType<typeof connectionOrigins>): void;
 /** Private user storage, outside project files. Nothing reading this module
  * returns a secret to CLI output. Store names bind credentials to both origins. */
 export declare function connectionStore(env: NodeJS.ProcessEnv, directory?: string): {
@@ -27,7 +30,9 @@ export declare function connectionStore(env: NodeJS.ProcessEnv, directory?: stri
     /** Use another saved account's connection, by account id or name. The one
      * in use moves to the saved accounts. Null when none matches. */
     use(which: string): Promise<SavedConnection | null>;
-    remove(): Promise<void>;
+    /** Forget the expected credential after a remote revoke or refusal. A
+     * concurrent login may have saved another connection during that request. */
+    remove(expectedKey?: string): Promise<void>;
     /** A browser approval that was started and not yet answered, so a command
      * that was stopped while it waited picks up the same link and code rather
      * than asking the person to approve a new one. Unreadable or stale ones