迁移其他 0.x 功能

FROM docker:dind

COPY --from=docker.io/cloudflare/sandbox:1.0.1 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim

ENTRYPOINT ["sh", "-c", "dockerd-entrypoint.sh dockerd --iptables=false --ip6tables=false --ip-forward=false > /var/log/dockerd.log 2>&1 & exec sleep infinity"]

const sandbox = getSandbox(env.Sandbox, "docker-sandbox");
const run = await sandbox.exec(
    "docker run --rm --network=host alpine:3.22 " +
        "echo Hello from Docker",
);

export class MySandbox extends DurableObject<Env> {
    // ...

    private async waitForDocker(): Promise<void> {
        const wait = await this.container.exec([
            "timeout",
            "30",
            "sh",
            "-c",
            "until docker version > /dev/null 2>&1; do sleep 0.2; done",
        ]);

        if ((await wait.exitCode) !== 0) {
            throw new Error("Docker did not start within 30 seconds");
        }
    }

    async runImage(): Promise<string> {
        await this.ensureRunning();
        // The Docker daemon starts after the container, so wait for it
        await this.waitForDocker();

        const run = await this.container.exec(
            [
                "docker",
                "run",
                "--rm",
                "--network=host",
                "alpine:3.22",
                "echo",
                "Hello from Docker",
            ],
            { env: ENV },
        );
        const result = await run.output();
        return new TextDecoder().decode(result.stdout);
    }
}

MySandbox.outboundByHost = {
    "my.kv": async (request: Request, env: Env) => {
        const key = new URL(request.url).pathname.slice(1);
        const value = await env.KV.get(key);
        return new Response(value ?? "", {
            status: value ? 200 : 404,
        });
    },
};

import { WorkerEntrypoint } from "cloudflare:workers";

type KvProps = { containerId: string };

export class KvGateway extends WorkerEntrypoint<Env, KvProps> {
    async fetch(request: Request): Promise<Response> {
        const key = new URL(request.url).pathname.slice(1);
        const value = await this.env.KV.get(key);
        return new Response(value ?? "", {
            status: value === null ? 404 : 200,
        });
    }
}

export class MySandbox extends DurableObject<Env> {
    // ...

    private async startContainer(): Promise<void> {
        const newContainer = !this.container.running;

        if (newContainer) {
            this.container.start({
                image: this.container.images.sandbox,
                instance: "standard-1",
                env: ENV,
                // 0.12 allowed Internet access by default.
                enableInternet: true,
            });
        }

        try {
            if (newContainer) {
                // Replaces onStart().
                await this.ctx.storage.put("startedAt", Date.now());
            }
            await this.container.interceptOutboundHttp(
                "my.kv",
                this.ctx.exports.KvGateway({
                    props: { containerId: this.ctx.id.toString() },
                }),
            );
            await this.container.setInactivityTimeout(
                INACTIVITY_TIMEOUT_MS,
            );
        } catch (error) {
            // The next request starts a new container.
            await this.container.destroy();
            throw error;
        }
    }
}

RUN npm install --global --ignore-scripts [email protected] \
    && ln -s /usr/local/lib/node_modules/opencode-linux-x64-baseline/bin/opencode /usr/local/bin/opencode

const sandbox = getSandbox(env.Sandbox, "my-agent");
const { client } = await createOpencode(sandbox, {
    directory: "/workspace",
    config: OPENCODE_CONFIG,
});
const session = await client.session.create({ title: "Fix tests" });

import {
    createOpencodeClient,
    type OpencodeClient,
} from "@opencode-ai/sdk/v2/client";

const OPENCODE_PORT = 4096;
const OPENCODE_DIR = `${SERVERS}/opencode`;

// Your OpenCode configuration, without apiKey values.
const OPENCODE_CONFIG = {};

const OPENCODE = [
    "opencode",
    "serve",
    "--port",
    String(OPENCODE_PORT),
    "--hostname",
    "0.0.0.0",
];

export class MySandbox extends DurableObject<Env> {
    // ...

    private opencodeReady = false;

    private async openCode(): Promise<OpencodeClient> {
        await this.ensureRunning();

        if (!this.opencodeReady) {
            await startServer(this.container, OPENCODE_DIR, OPENCODE, {
                cwd: "/workspace",
                env: {
                    ...ENV,
                    OPENCODE_CONFIG_CONTENT:
                        JSON.stringify(OPENCODE_CONFIG),
                    ANTHROPIC_API_KEY: this.env.ANTHROPIC_API_KEY,
                },
            });
            await waitForServer(
                this.container,
                OPENCODE_DIR,
                OPENCODE_PORT,
                30_000,
            );
            this.opencodeReady = true;
        }

        const port = this.container.getTcpPort(OPENCODE_PORT);
        return createOpencodeClient({
            baseUrl: "http://opencode",
            fetch: (request) => port.fetch(request),
        });
    }

    async createSession(title: string): Promise<string> {
        const client = await this.openCode();
        const session = await client.session.create({ title });

        if (!session.data) {
            throw new Error("OpenCode did not create the session");
        }

        return session.data.id;
    }
}

export class MySandbox extends DurableObject<Env> {
    // ...

    async fetch(request: Request): Promise<Response> {
        const url = new URL(request.url);
        const accept = request.headers.get("Accept") ?? "";
        const page =
            accept.includes("text/html") || url.pathname === "/";

        // The UI calls the server at the origin in ?url=.
        if (
            request.method === "GET" &&
            page &&
            !url.searchParams.has("url")
        ) {
            url.searchParams.set("url", url.origin);
            return Response.redirect(url.toString(), 302);
        }

        await this.openCode();
        // The container port accepts only http: URLs.
        url.protocol = "http:";
        return this.container
            .getTcpPort(OPENCODE_PORT)
            .fetch(new Request(url, request));
    }
}

import { Files } from "@cloudflare/sandbox";
import {
    Agent,
    applyDiff,
    applyPatchTool,
    run,
    shellTool,
    type ApplyPatchOperation,
    type ApplyPatchResult,
    type Editor,
    type Shell,
    type ShellAction,
    type ShellResult,
} from "@openai/agents";

class SandboxShell implements Shell {
    constructor(private readonly container: Container) {}

    async run(action: ShellAction): Promise<ShellResult> {
        const timeoutMs = action.timeoutMs ?? 60_000;
        const seconds = String(Math.ceil(timeoutMs / 1000));
        const limit = ["timeout", "--kill-after=5", seconds];
        const output: ShellResult["output"] = [];
        const decoder = new TextDecoder();

        for (const command of action.commands) {
            const process = await this.container.exec(
                [...limit, "bash", "-c", command],
                { cwd: "/workspace", env: ENV },
            );
            const result = await process.output();
            const timedOut = result.exitCode === 124 || result.exitCode === 137;

            output.push({
                stdout: decoder.decode(result.stdout),
                stderr: decoder.decode(result.stderr),
                outcome: timedOut
                    ? { type: "timeout" }
                    : { type: "exit", exitCode: result.exitCode },
            });

            // 0.12 also skipped the rest after a timeout.
            if (timedOut) {
                break;
            }
        }

        return {
            output,
            providerData: { working_directory: "/workspace" },
        };
    }
}

type Operation<T> = Extract<ApplyPatchOperation, { type: T }>;

class SandboxEditor implements Editor {
    constructor(private readonly files: Files) {}

    // Reads each path as relative to /workspace, as 0.12 did, and throws
    // when `..` leaves /workspace.
    private path(path: string): string {
        const root = "/workspace";
        const inRoot = path === root || path.startsWith(`${root}/`);
        const relative = inRoot ? path.slice(root.length) : path;
        const segments: string[] = [];

        for (const segment of relative.split("/")) {
            if (segment === "..") {
                if (segments.pop() === undefined) {
                    throw new Error(`Operation outside workspace: ${path}`);
                }
            } else if (segment !== "" && segment !== ".") {
                segments.push(segment);
            }
        }

        return [root, ...segments].join("/");
    }

    async createFile(
        operation: Operation<"create_file">,
    ): Promise<ApplyPatchResult> {
        const path = this.path(operation.path);
        const parent = path.slice(0, path.lastIndexOf("/"));
        await this.files.mkdir(parent, { recursive: true });
        const content = applyDiff("", operation.diff, "create");
        await this.files.writeFile(path, content);
        return {
            status: "completed",
            output: `Created ${operation.path}`,
        };
    }

    async updateFile(
        operation: Operation<"update_file">,
    ): Promise<ApplyPatchResult> {
        const path = this.path(operation.path);
        const file = await this.files.readFile(path);
        const current = await file.text();
        const content = applyDiff(current, operation.diff);
        await this.files.writeFile(path, content);
        return {
            status: "completed",
            output: `Updated ${operation.path}`,
        };
    }

    async deleteFile(
        operation: Operation<"delete_file">,
    ): Promise<ApplyPatchResult> {
        await this.files.remove(this.path(operation.path));
        return {
            status: "completed",
            output: `Deleted ${operation.path}`,
        };
    }
}

const sandbox = getSandbox(env.Sandbox, `session-${sessionId}`);
const agent = new Agent({
    name: "Sandbox agent",
    instructions: INSTRUCTIONS,
    tools: [
        shellTool({ shell: new Shell(sandbox) }),
        applyPatchTool({
            editor: new Editor(sandbox, "/workspace"),
        }),
    ],
});
const result = await run(agent, input);

export class MySandbox extends DurableObject<Env> {
    // ...

    private readonly files = new Files(this.container);

    async runAgent(input: string): Promise<string | undefined> {
        await this.ensureRunning();

        const shell = new SandboxShell(this.container);
        const editor = new SandboxEditor(this.files);
        const agent = new Agent({
            name: "Sandbox agent",
            instructions: INSTRUCTIONS,
            tools: [shellTool({ shell }), applyPatchTool({ editor })],
        });
        const result = await run(agent, input);
        return result.finalOutput;
    }
}