在 sandbox 中运行 Pi

FROM node:24-trixie-slim

RUN apt-get update \
	&& apt-get install -y --no-install-recommends bash ca-certificates git ripgrep \
	&& rm -rf /var/lib/apt/lists/*

RUN npm install --global --ignore-scripts @earendil-works/[email protected]

COPY --from=docker.io/cloudflare/sandbox:1.0.1 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim

WORKDIR /workspace
CMD ["sleep", "infinity"]

const PiEvent = z.union([
	z.object({ type: z.literal("agent_settled") }),
	z.object({
		type: z.literal("message_end"),
		message: z.object({
			role: z.literal("assistant"),
			content: z.array(
				z.object({ type: z.string(), text: z.string().optional() }),
			),
			stopReason: z.string(),
			errorMessage: z.string().optional(),
		}),
	}),
]);

type PiMessage = Extract<
	z.infer<typeof PiEvent>,
	{ type: "message_end" }
>["message"];

export class AgentSandbox extends DurableObject<Env> {
	// ...

	private agentCommand(prompt: string): string[] {
		return [
			"pi",
			// Run one task, write one JSON event per line to the events file, and exit
			"--mode",
			"json",
			// Keep the session in memory instead of saving it to disk
			"--no-session",
			// Select the built-in AI Gateway provider in Pi, which reads the account
			// and gateway IDs from the environment
			"--provider",
			"cloudflare-ai-gateway",
			// Select the model from `MODEL`
			"--model",
			this.env.MODEL,
			"--",
			prompt,
		];
	}

	private agentEnv(): Record<string, string> {
		return {
			CLOUDFLARE_API_KEY: "provided-by-worker",
			CLOUDFLARE_ACCOUNT_ID: this.env.AI_GATEWAY_ACCOUNT_ID,
			CLOUDFLARE_GATEWAY_ID: this.env.AI_GATEWAY_ID,
			PI_OFFLINE: "1",
			PI_SKIP_VERSION_CHECK: "1",
			PI_TELEMETRY: "0",
		};
	}
}

export class AgentSandbox extends DurableObject<Env> {
	// ...

	private async outcome(exitCode: number): Promise<TaskStatus> {
		if (exitCode !== 0) {
			const stderr = (await this.readOptionalText(stderrPath)) ?? "";
			return {
				state: "failed",
				error: `pi exited with ${exitCode}: ${stderr.slice(-2000)}`,
			};
		}

		let settled = false;
		let final: PiMessage | undefined;
		const events = await this.files.readFile(eventsPath);

		for await (const line of readLines(events.body)) {
			const parsed = PiEvent.safeParse(parseJson(line));

			if (!parsed.success) {
				continue;
			}

			if (parsed.data.type === "agent_settled") {
				settled = true;
			} else {
				final = parsed.data.message;
			}
		}

		if (!settled || final === undefined) {
			return { state: "failed", error: "pi exited before the agent settled" };
		}

		if (final.stopReason === "error" || final.stopReason === "aborted") {
			return {
				state: "failed",
				error: final.errorMessage ?? `pi stopped: ${final.stopReason}`,
			};
		}

		const text = final.content.flatMap((block) =>
			block.type === "text" ? [block.text ?? ""] : [],
		);
		return { state: "succeeded", result: text.join("") };
	}
}