Function withSandbox

packages/ai-sandbox/src/middleware.ts:104–233

(
  definition: SandboxDefinition,
)

}

export function withSandbox(
  definition: SandboxDefinition,
): DefinedChatMiddleware<
  unknown,
  readonly [],
  readonly [typeof SandboxCapability, typeof ProjectionCapability]
> {
  return defineChatMiddleware({
    name: 'sandbox',
    provides: [SandboxCapability, ProjectionCapability],
    // SandboxPolicyCapability is provided conditionally (only when the
    // definition has a policy), so it is intentionally NOT declared here —
    // consumers read it via `getOptional`.
    optionalRequires: [SandboxStoreCapability, LocksCapability],

    async setup(ctx) {
      const ensureCtx = buildEnsureCtx(ctx)
      const handle = await definition.ensure(ensureCtx)
      provideSandbox(ctx, handle)
      if (definition.policy) provideSandboxPolicy(ctx, definition.policy)

      const workspace = definition.workspace
      if (workspace !== undefined) {
        const root = workspace.root ?? DEFAULT_WORKSPACE_ROOT
        const workspaceHash = computeWorkspaceHash(workspace)
        const secrets = workspace.secrets
        provideWorkspaceProjection(ctx, {
          skills: workspace.skills ?? [],
          plugins: workspace.plugins ?? [],
          resolveSecret: (ref) => {
            if (secrets === undefined) {
              throw new Error(
                `resolveSecret: no secrets defined on this workspace (ref: "${ref.__secretName}")`,
              )
            }
            return resolveSecret(secrets, ref)
          },
          markerPath: `${root}/.tanstack-projected-${workspaceHash}`,
          root,
          ...(workspace.scripts !== undefined
            ? { scripts: workspace.scripts }
            : {}),
        })
      }

      const hooks = definition.hooks
      await hooks?.onReady?.(handle)

      let watcher: SandboxWatchHandle | undefined
      if (definition.fileEvents !== false) {
        const runtime = getSandboxRuntime(ctx, { optional: true })
        watcher = await watchWorkspace(handle, {
          onEvent: (event: SandboxFileEvent) => {
            void dispatchDefinitionHooks(hooks, event)
            runtime?.emit(event)
          },
          ...(ctx.signal !== undefined ? { signal: ctx.signal } : {}),
        })