daytona 0.199.0 → 0.200.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10a8c1d98ef86a3f5cb94cef3bb6df610bcfbb5abf59a585eaa76c3b5c527fdd
-  data.tar.gz: d6159db7b2febce21f6670c7340a792b10cecedac1b20178bf506a44926d7467
+  metadata.gz: 714770a5cd03bbfb27825fd9c018333d0377db70c0ce32b7ed484ff62946b2da
+  data.tar.gz: 1ea5e87028fffadb41659ceb7d76e6ec635ce2801e27f53bf1319d02b66ea6a7
 SHA512:
-  metadata.gz: 434cb81dc3376883e3bdce1456f5d1bcad59c51a6cf0e0390e629fdb61f80fbaccf7475fe210e872e8214b3dc6a399da1e9b9b865e950c855d370bd6cf30fd6e
-  data.tar.gz: 7ad98fd8a62ba96305475cb3742376cd7c48d729d3bd2a7b49f0e0a8075ff188671d03285497cf8abfc429c13a7e5cd98b55e29147e88c8f1cc982fe8d4815ce
+  metadata.gz: 9f8bec4d5a367c8c1f2cc48bab297903dd2b75f03460c0c72728842a639da4dd00c781ec5668f64aef5375af1955f3e1cb6221577dfa4d3fd237c97fbb6056e2
+  data.tar.gz: 19a3b2b8bafb2c5a9fc14777411de38abe6a6ac17b1c0d132af9334142ab915ef3aa325aa8184e1ac999df7e0c867a47e8d3691975b09be3ca6a98a80584b8b8

data/lib/daytona/common/event_subscription_manager.rb

@@ -6,14 +6,29 @@
 require 'securerandom'
 
 module Daytona
+  # Tracks dispatcher subscriptions with TTL auto-expiry.
+  #
+  # All subscriptions share ONE lazily started expiry worker thread instead of a
+  # dedicated sleeping thread per subscription, so listing many sandboxes costs
+  # one thread total, not one thread each
+  # (https://github.com/daytona/clients/issues/108). #refresh only bumps the
+  # subscription deadline — it never creates or kills threads.
   class EventSubscriptionManager
     SUBSCRIPTION_TTL = 300
     private_constant :SUBSCRIPTION_TTL
 
-    def initialize(dispatcher = nil)
+    def initialize(dispatcher = nil, ttl_seconds: SUBSCRIPTION_TTL)
       @dispatcher = dispatcher
+      @ttl = ttl_seconds
       @subscriptions = {}
+      # Deadline-ordered [expires_at, sub_id] entries. Entries are lazily
+      # invalidated: a popped entry is discarded when its subscription is gone,
+      # or re-queued at the current deadline when it was refreshed meanwhile.
+      # Invariant: every live subscription has at least one queue entry.
+      @expiry_queue = []
       @mutex = Mutex.new
+      @cond = ConditionVariable.new
+      @worker = nil
       @closed = false
     end
 
@@ -24,7 +39,6 @@ module Daytona
 
       unsubscribe = @dispatcher.subscribe(resource_id, events:, &handler)
       sub_id = SecureRandom.hex(16)
-      timer_to_stop = nil
       rollback_unsubscribe = nil
 
       @mutex.synchronize do
@@ -34,8 +48,11 @@ module Daytona
           next
         end
 
-        @subscriptions[sub_id] = { unsubscribe:, timer: nil }
-        timer_to_stop = start_timer_locked(sub_id)
+        expires_at = monotonic_now + @ttl
+        @subscriptions[sub_id] = { unsubscribe:, expires_at: }
+        push_entry_locked(expires_at, sub_id)
+        ensure_worker_locked
+        @cond.signal
       end
 
       if rollback_unsubscribe
@@ -43,44 +60,36 @@ module Daytona
         return nil
       end
 
-      stop_thread(timer_to_stop)
       sub_id
     end
 
     def refresh(sub_id)
       @mutex.synchronize do
-        # Reject after shutdown to prevent use-after-close
         return false if @closed
-      end
-
-      timer_to_stop = nil
 
-      @mutex.synchronize do
-        return false unless @subscriptions.key?(sub_id)
+        subscription = @subscriptions[sub_id]
+        return false unless subscription
 
-        timer_to_stop = start_timer_locked(sub_id)
+        # No queue entry or worker wake-up needed: when the old deadline pops,
+        # the worker sees the newer expires_at and re-queues the subscription.
+        subscription[:expires_at] = monotonic_now + @ttl
+        true
       end
-
-      stop_thread(timer_to_stop)
-      true
     end
 
     def unsubscribe(sub_id)
-      subscription = nil
-      timer = nil
-
-      @mutex.synchronize do
-        subscription = @subscriptions.delete(sub_id)
-        if subscription
-          timer = subscription[:timer]
-          subscription[:timer] = nil
+      subscription = @mutex.synchronize do
+        removed = @subscriptions.delete(sub_id)
+        # The stale queue entry is discarded when the worker pops it — except
+        # when it was the last subscription: drop the leftovers and wake the
+        # worker so it exits now instead of idling until the old deadline.
+        if removed && @subscriptions.empty?
+          @expiry_queue.clear
+          @cond.signal
         end
+        removed
       end
-
-      return unless subscription
-
-      stop_thread(timer)
-      subscription[:unsubscribe].call
+      subscription&.dig(:unsubscribe)&.call
     end
 
     def shutdown
@@ -90,55 +99,96 @@ module Daytona
         @closed = true
         subscriptions = @subscriptions.values
         @subscriptions = {}
+        @expiry_queue.clear
+        @cond.broadcast
       end
 
-      subscriptions.each do |subscription|
-        stop_thread(subscription[:timer])
-        subscription[:unsubscribe].call
-      end
+      subscriptions.each { |subscription| subscription[:unsubscribe].call }
     end
 
     private
 
-    def start_timer_locked(sub_id)
-      subscription = @subscriptions[sub_id]
-      return unless subscription
+    def monotonic_now
+      ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+    end
 
-      previous_timer = cancel_timer_locked(sub_id)
-      timer = Thread.new do
-        sleep(SUBSCRIPTION_TTL)
+    # Caller must hold @mutex.
+    def push_entry_locked(expires_at, sub_id)
+      index = @expiry_queue.bsearch_index { |entry| entry[0] > expires_at } || @expiry_queue.length
+      @expiry_queue.insert(index, [expires_at, sub_id])
+    end
 
-        unsubscribe = @mutex.synchronize do
-          current_subscription = @subscriptions[sub_id]
-          next unless current_subscription && current_subscription[:timer] == Thread.current
+    # Caller must hold @mutex. The alive? check is a safety net: a worker that
+    # crashed for any reason leaves a dead-but-truthy reference, and a plain nil
+    # check would then block replacements forever, silently disabling expiry.
+    def ensure_worker_locked
+      return if @worker&.alive?
 
-          @subscriptions.delete(sub_id)&.dig(:unsubscribe)
-        end
+      @worker = Thread.new { expiry_loop }
+      @worker.name = 'daytona-subscription-expiry'
+      @worker.abort_on_exception = false
+    end
 
-        unsubscribe&.call
+    def expiry_loop
+      loop do
+        expired = collect_expired
+        return if expired.nil?
+
+        expired.each do |subscription|
+          subscription[:unsubscribe].call
+        rescue StandardError
+          # One failing dispatcher unsubscribe must not kill the shared worker
+          # and silently stop expiry for every other subscription.
+          nil
+        end
       end
-      timer.abort_on_exception = false
-      subscription[:timer] = timer
-      previous_timer
     end
 
-    def cancel_timer_locked(sub_id)
-      subscription = @subscriptions[sub_id]
-      return unless subscription
+    # Blocks until at least one subscription expires. Returns nil when the
+    # worker should exit (shutdown, or no live subscriptions remain).
+    def collect_expired
+      @mutex.synchronize do
+        expired = []
+
+        while expired.empty?
+          return nil if @closed
+
+          if @expiry_queue.empty?
+            # No live subscriptions remain (see queue invariant above):
+            # exit and let the next subscribe start a fresh worker.
+            @worker = nil
+            return nil
+          end
+
+          now = monotonic_now
+          deadline = @expiry_queue.first[0]
+          if deadline > now
+            @cond.wait(@mutex, deadline - now)
+            next
+          end
+
+          drain_due_entries_locked(now, expired)
+        end
 
-      timer = subscription[:timer]
-      subscription[:timer] = nil
-      timer
+        expired
+      end
     end
 
-    def stop_thread(thread)
-      return unless thread
-      return if thread == Thread.current
+    # Caller must hold @mutex.
+    def drain_due_entries_locked(now, expired)
+      while !@expiry_queue.empty? && @expiry_queue.first[0] <= now
+        _, sub_id = @expiry_queue.shift
+        subscription = @subscriptions[sub_id]
+        next unless subscription
 
-      thread.kill
-      thread.join
-    rescue StandardError
-      nil
+        if subscription[:expires_at] > now
+          push_entry_locked(subscription[:expires_at], sub_id)
+          next
+        end
+
+        @subscriptions.delete(sub_id)
+        expired << subscription
+      end
     end
   end
 end

data/lib/daytona/common/socketio_client.rb

@@ -5,6 +5,7 @@
 
 require 'timeout'
 
+require 'openssl'
 require 'websocket-client-simple'
 require 'json'
 require 'uri'
@@ -52,6 +53,8 @@ module Daytona
       @connected = false
       @mutex = Mutex.new
       @write_mutex = Mutex.new
+      @verify_mutex = Mutex.new
+      @tls_verified = nil
       @health_thread = nil
       @ping_interval = 25
       @ping_timeout = 20
@@ -67,13 +70,24 @@ module Daytona
       ws_url = build_ws_url
       connected_queue = Queue.new
 
+      # Reset per-connection TLS state so a reconnect re-verifies its new socket
+      # instead of reusing a cached result from the previous connection.
+      @verify_mutex.synchronize { @tls_verified = nil }
+
       # Capture self because websocket-client-simple uses instance_exec for callbacks
       client = self
 
       # Register callbacks inside the connect block so they are installed before the
       # socket dials — otherwise the Engine.IO handshake can arrive before :message
       # is bound, stalling the connection into a polling fallback/timeout.
-      @ws = WebSocket::Client::Simple.connect(ws_url) do |ws|
+      #
+      # verify_mode is passed explicitly: websocket-client-simple builds its own
+      # SSLContext and defaults to no certificate verification (VERIFY_NONE).
+      @ws = WebSocket::Client::Simple.connect(ws_url, verify_mode: OpenSSL::SSL::VERIFY_PEER) do |ws|
+        # Capture the client before its reader thread starts so #verify_tls_peer!
+        # can reach the SSL socket even when a frame arrives before .connect returns.
+        @ws = ws
+
         ws.on :message do |msg|
           client.send(:handle_raw_message, msg.data.to_s, connected_queue)
         end
@@ -104,15 +118,26 @@ module Daytona
         end
       end
 
-      # Wait for connection with timeout
       result = nil
       begin
-        Timeout.timeout(@connect_timeout) { result = connected_queue.pop }
+        Timeout.timeout(@connect_timeout) do
+          ensure_tls_verified!(connected_queue)
+          result = connected_queue.pop
+          if result == :open
+            send_connect_auth
+            result = connected_queue.pop
+          end
+        end
       rescue Timeout::Error
         close
         raise "WebSocket connection timed out after #{@connect_timeout}s"
       end
 
+      if result.is_a?(OpenSSL::SSL::SSLError)
+        close
+        raise result
+      end
+
       if result != :connected
         close
         raise "WebSocket connection failed: #{result}"
@@ -141,6 +166,46 @@ module Daytona
 
     private
 
+    # Verify the TLS peer's hostname exactly once, before any inbound frame is
+    # processed and before the auth frame is sent. websocket-client-simple
+    # verifies the certificate chain (VERIFY_PEER) during the handshake but never
+    # checks that the certificate matches the host, and its reader thread starts
+    # before #connect regains control — so a certificate that is valid for the
+    # wrong host could otherwise inject Socket.IO events (and receive the CONNECT
+    # auth frame) before verification runs. Gating both the reader path and the
+    # connect path guarantees no frame reaches the dispatcher, and no credentials
+    # are sent, until the peer is verified.
+    # @return [Boolean] true when verified (or plaintext ws://, no TLS peer to
+    #   check); false on failure, after signalling the connecting thread.
+    def ensure_tls_verified!(connected_queue)
+      @verify_mutex.synchronize do
+        return @tls_verified unless @tls_verified.nil?
+
+        begin
+          verify_tls_peer!
+          @tls_verified = true
+        rescue OpenSSL::SSL::SSLError => e
+          @tls_verified = false
+          @mutex.synchronize { @connected = false }
+          connected_queue&.push(e)
+        end
+
+        @tls_verified
+      end
+    end
+
+    def verify_tls_peer!
+      socket = @ws&.instance_variable_get(:@socket)
+      return unless socket.is_a?(OpenSSL::SSL::SSLSocket)
+
+      socket.post_connection_check(URI.parse(@api_url).host)
+    end
+
+    def send_connect_auth
+      auth = JSON.generate({ token: @token })
+      send_raw("#{EIO_MESSAGE}#{SIO_CONNECT}#{auth}")
+    end
+
     def build_ws_url
       parsed = URI.parse(@api_url)
       ws_scheme = parsed.scheme == 'https' ? 'wss' : 'ws'
@@ -160,6 +225,11 @@ module Daytona
     def handle_raw_message(raw, connected_queue)
       return if raw.nil? || raw.empty?
 
+      # Drop every frame from a peer whose hostname is not yet verified. The
+      # reader thread can run before #connect verifies, so this is the gate that
+      # stops a wrong-host peer from injecting events or eliciting the auth frame.
+      return unless ensure_tls_verified!(connected_queue)
+
       # Track all server activity for health monitoring.
       # If the server stops sending ANY data (pings, events, etc.)
       # the health monitor will detect the dead connection.
@@ -175,9 +245,10 @@ module Daytona
         rescue JSON::ParserError
           # Use default ping interval
         end
-        # Send Socket.IO CONNECT with auth
-        auth = JSON.generate({ token: @token })
-        send_raw("#{EIO_MESSAGE}#{SIO_CONNECT}#{auth}")
+        # Signal the connecting thread instead of sending the CONNECT auth frame
+        # here: the token must not leave this process until the connecting thread
+        # has completed TLS peer verification (see #connect).
+        connected_queue&.push(:open)
 
       when EIO_PING
         # Server heartbeat — respond immediately with PONG

data/lib/daytona/sdk/version.rb

@@ -5,6 +5,6 @@
 
 module Daytona
   module Sdk
-    VERSION = '0.199.0'
+    VERSION = '0.200.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: daytona
 version: !ruby/object:Gem::Version
-  version: 0.199.0
+  version: 0.200.1
 platform: ruby
 authors:
 - Daytona Platforms Inc.
@@ -85,42 +85,42 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.199.0
+        version: 0.200.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.199.0
+        version: 0.200.1
 - !ruby/object:Gem::Dependency
   name: daytona_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.199.0
+        version: 0.200.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.199.0
+        version: 0.200.1
 - !ruby/object:Gem::Dependency
   name: daytona_toolbox_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.199.0
+        version: 0.200.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.199.0
+        version: 0.200.1
 - !ruby/object:Gem::Dependency
   name: dotenv
   requirement: !ruby/object:Gem::Requirement