daytona 0.211.2 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ae7269e4ef21322f6ac905fd214310b46842edf2bdd45291a1c5eee1e78f6e0
-  data.tar.gz: 1cc443a01e292980d47b0092cb435593b8def426a88f334cae20a556e6497130
+  metadata.gz: 868afc4f077432e39b074d0249d2a20277206a1e430f64954b42663b74496118
+  data.tar.gz: 5e8dc41efd1f588f325f8fd117d8ad985382d5c7a43a73740d58ded6d5def73e
 SHA512:
-  metadata.gz: 8011684fcd9fe5fc324eeafe02cffadb2e71311741d23cb6e08f8a52926dda8ea32feea4c47275bb496ef82112eb6db954367c8fa527c09a4b28e95ef50229cf
-  data.tar.gz: 7bb8084c0981db0281b0c6264cc8e20365a38a52012e54bc36a0a4a00aec807c39867f7b39df12eda8d3c8e4546fe646b0b8f4f41f6f4a27644d621acdba9bd7
+  metadata.gz: c5fca0242291118c5000ffba802fb450aeab89c8f4b05c2f01cde1192e9c898dff8480edf6d9c12332a317c6282656a77b8b3fc9d75b0172a6bb0a16f1bb3dbc
+  data.tar.gz: 11fb9e1f412128cdb6651852bd5af7a7441a49ba1dcd3dab1ae3ce2479ac3769ba5968c3a85e10218b6e6f2ee45bd818adaebd9f3481fdb989e884294def4899

data/lib/daytona/code_interpreter.rb

@@ -108,7 +108,7 @@ module Daytona
 
       puts "[DEBUG] Connecting to WebSocket: #{ws_url}" if ENV['DEBUG']
 
-      ws = WebSocket::Client::Simple.connect(ws_url, headers:) do |client|
+      ws = Common::WebSocketDialer.connect(ws_url, headers:) do |client|
         client.on :open do
           puts '[DEBUG] WebSocket opened, sending request' if ENV['DEBUG']
           client.send(JSON.dump(request))

data/lib/daytona/common/image.rb

@@ -5,6 +5,7 @@
 
 require 'digest'
 require 'fileutils'
+require 'json'
 require 'pathname'
 require 'shellwords'
 
@@ -362,7 +363,7 @@ module Daytona
       # @return [Array<Array<String>>] The list of the actual file path and its corresponding COPY-command source path
       def extract_copy_sources(dockerfile_content, path_prefix = '') # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
         sources = []
-        lines = dockerfile_content.split("\n")
+        lines = dockerfile_logical_lines(dockerfile_content)
 
         lines.each do |line|
           # Skip empty lines and comments
@@ -404,47 +405,65 @@ module Daytona
         sources
       end
 
+      # Joins backslash-continued physical lines into logical Dockerfile instruction lines
+      #
+      # @param dockerfile_content [String] The content of the Dockerfile
+      # @return [Array<String>] The logical instruction lines
+      def dockerfile_logical_lines(dockerfile_content) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
+        logical_lines = []
+        current = nil
+
+        dockerfile_content.each_line(chomp: true) do |physical_line|
+          is_comment = physical_line.lstrip.start_with?('#')
+          # Docker drops empty and comment lines that appear inside a continued instruction
+          next if current && (physical_line.strip.empty? || is_comment)
+
+          stripped = physical_line.rstrip
+          # A trailing backslash on a comment line is literal; comments never continue onto the next line
+          continued = !is_comment && stripped.end_with?('\\')
+          segment = continued ? stripped[0..-2] : physical_line
+          current = current ? current + segment : segment
+          next if continued
+
+          logical_lines << current
+          current = nil
+        end
+
+        logical_lines << current if current
+        logical_lines
+      end
+
       # Parses a COPY command to extract sources and destination
       #
       # @param line [String] The line to parse
       # @return [Hash, nil] A hash containing the sources and destination, or nil if parsing fails
-      def parse_copy_command(line) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
+      def parse_copy_command(line)
         # Remove initial "COPY" and strip whitespace
         parts = line.strip[4..].strip
 
-        # Handle JSON array format: COPY ["src1", "src2", "dest"]
-        if parts.start_with?('[')
-          begin
-            # Parse the JSON-like array format
-            elements = Shellwords.split(parts.delete('[]'))
-            return nil if elements.length < 2
-
-            { 'sources' => elements[0..-2], 'dest' => elements[-1] }
-          rescue StandardError
-            nil
-          end
-        end
+        # Skip leading flags. Value-taking flags use the --flag=value form (--chown=..., --chmod=...)
+        # and boolean flags stand alone (--link), so a flag never consumes the token that follows it.
+        parts = parts.sub(/\A\S+\s*/, '') while parts.start_with?('--')
 
-        # Handle regular format with possible flags
-        parts = Shellwords.split(parts)
+        # Handle JSON array format: COPY ["src1", "src2", "dest"]
+        return parse_json_copy_command(parts) if parts.start_with?('[')
 
-        # Extract flags like --chown, --chmod, --from
-        sources_start_idx = 0
-        parts.each_with_index do |part, i|
-          break unless part.start_with?('--')
+        # Handle the whitespace-separated format
+        elements = Shellwords.split(parts)
+        return nil if elements.length < 2
 
-          # Skip the flag and its value if it has one
-          sources_start_idx = if !part.include?('=') && i + 1 < parts.length && !parts[i + 1].start_with?('--')
-                                i + 2
-                              else
-                                i + 1
-                              end
-        end
+        { 'sources' => elements[0..-2], 'dest' => elements[-1] }
+      rescue ArgumentError
+        nil
+      end
 
-        # After skipping flags, we need at least one source and one destination
-        return nil if parts.length - sources_start_idx < 2
+      def parse_json_copy_command(parts)
+        elements = JSON.parse(parts)
+        return nil unless elements.is_a?(Array) && elements.all?(String) && elements.length >= 2
 
-        { 'sources' => parts[sources_start_idx..-2], 'dest' => parts[-1] }
+        { 'sources' => elements[0..-2], 'dest' => elements[-1] }
+      rescue JSON::ParserError
+        nil
       end
     end
 

data/lib/daytona/common/websocket_dialer.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+# Copyright Daytona Platforms Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+require 'openssl'
+require 'socket'
+require 'uri'
+require 'websocket'
+require 'websocket-client-simple'
+
+module Daytona
+  module Common
+    # Establishes WebSocket connections with the peer certificate fully verified
+    # before any request bytes are written.
+    #
+    # `websocket-client-simple` builds its own `SSLContext` and never calls
+    # `OpenSSL::SSL::SSLContext#set_params`, so it does not pick up Ruby's own
+    # defaults (`verify_mode: VERIFY_PEER`, `verify_hostname: true`). It applies
+    # `verify_mode` only when the caller passes it, and offers no way to enable
+    # hostname verification at all. Because the context is frozen by
+    # `SSLSocket.new` and the handshake is written before `connect` returns,
+    # there is no caller-side hook to correct this - so the dial itself has to
+    # be owned here.
+    #
+    # Chain verification alone is not sufficient: without hostname verification
+    # a peer holding any valid certificate can terminate the connection and
+    # receive the request headers.
+    module WebSocketDialer
+      # Opens a verified WebSocket connection.
+      #
+      # Mirrors `WebSocket::Client::Simple.connect`: the block, if given, receives
+      # the client before the connection is established so handlers can be
+      # registered, and the client is returned.
+      #
+      # @param url [String] The `ws://` or `wss://` URL to dial.
+      # @param options [Hash] Passed through to the client; `:headers`, `:ssl_version` and `:cert_store` are honoured.
+      # @return [VerifyingClient] The connected client.
+      # @raise [OpenSSL::SSL::SSLError] If the peer certificate fails chain or hostname verification.
+      def self.connect(url, options = {})
+        client = VerifyingClient.new
+        yield client if block_given?
+        client.connect(url, options)
+        client
+      end
+
+      # A `websocket-client-simple` client that verifies the peer before writing.
+      #
+      # `#connect` is reimplemented rather than extended because the upstream
+      # method builds the socket, performs the TLS handshake and writes the
+      # request in one pass, and returns early when `@socket` is already set.
+      #
+      # Everything after TLS setup mirrors upstream so that framing, the reader
+      # thread and event semantics stay identical. That couples to the instance
+      # variables the inherited `#send`, `#close`, `#open?` and `#closed?` read,
+      # so the gemspec pins the gem to `~> 0.9.0` - a 0.x minor bump could rename
+      # them. `websocket_dialer_spec.rb` drives a full send/close round trip
+      # against a real listener, which fails if that contract breaks.
+      class VerifyingClient < WebSocket::Client::Simple::Client
+        # @param url [String] The `ws://` or `wss://` URL to dial.
+        # @param options [Hash] Connection options.
+        # @return [void]
+        def connect(url, options = {})
+          return if @socket
+
+          @url = url
+          uri = URI.parse(url)
+          @socket = TCPSocket.new(uri.host, uri.port || (uri.scheme == 'wss' ? 443 : 80))
+          @socket = verified_ssl_socket(@socket, uri, options) if %w[https wss].include?(uri.scheme)
+
+          start_websocket(url, options)
+        end
+
+        private
+
+        # Wraps a socket in TLS with the peer certificate verified.
+        #
+        # @param socket [TCPSocket] The connected plaintext socket.
+        # @param uri [URI] The dialed URI, whose host the certificate must match.
+        # @param options [Hash] Connection options.
+        # @return [OpenSSL::SSL::SSLSocket] The connected, verified socket.
+        # @raise [OpenSSL::SSL::SSLError] If chain or hostname verification fails.
+        def verified_ssl_socket(socket, uri, options) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+          ctx = OpenSSL::SSL::SSLContext.new
+          ctx.ssl_version = options[:ssl_version] if options[:ssl_version]
+
+          # Only seed system roots into a store we own. Adding them to a
+          # caller-supplied store would silently widen their trust policy.
+          cert_store = options[:cert_store]
+          unless cert_store
+            cert_store = OpenSSL::X509::Store.new
+            cert_store.set_default_paths
+          end
+          ctx.cert_store = cert_store
+
+          # Must precede SSLSocket.new, which freezes the context.
+          ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
+          ctx.verify_hostname = true
+
+          ssl = OpenSSL::SSL::SSLSocket.new(socket, ctx)
+          ssl.sync_close = true
+          ssl.hostname = uri.host
+          begin
+            ssl.connect
+            # Redundant while verify_hostname holds, but keeps the check explicit
+            # and independent of the context surviving future changes.
+            ssl.post_connection_check(uri.host)
+          rescue StandardError
+            ssl.close
+            raise
+          end
+          ssl
+        end
+
+        # Performs the WebSocket handshake and starts the reader thread.
+        #
+        # Mirrors `WebSocket::Client::Simple::Client#connect` from the request
+        # onward. Only reached once the socket is verified.
+        #
+        # @param url [String] The dialed URL.
+        # @param options [Hash] Connection options.
+        # @return [void]
+        def start_websocket(url, options) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+          WebSocket.should_raise = true
+          @handshake = WebSocket::Handshake::Client.new(url: url, headers: options[:headers])
+          @handshaked = false
+          @pipe_broken = false
+          @closed = false
+          frame = WebSocket::Frame::Incoming::Client.new
+
+          once :__close do |err|
+            close
+            emit :close, err
+          end
+
+          @thread = Thread.new do
+            until @closed
+              begin
+                unless (recv_data = @socket.getc)
+                  sleep 1
+                  next
+                end
+                if @handshaked
+                  frame << recv_data
+                  while (msg = frame.next)
+                    emit :message, msg
+                  end
+                else
+                  @handshake << recv_data
+                  if @handshake.finished?
+                    @handshaked = true
+                    emit :open
+                  end
+                end
+              rescue StandardError => e
+                emit :error, e
+              end
+            end
+          end
+
+          @socket.write @handshake.to_s
+        end
+      end
+    end
+  end
+end

data/lib/daytona/config.rb

@@ -6,6 +6,45 @@
 require 'dotenv'
 
 module Daytona
+  # Dotenv runs `$(...)` in a value through the shell while parsing, and the working
+  # directory is frequently a cloned repository, so parsing `.env` there would execute
+  # whatever its author put in it.
+  module EnvFile
+    # Dotenv::Parser picks its substitutions up from `self.class.substitutions`, and Ruby
+    # does not inherit class-level instance variables, so declaring the list here drops
+    # command substitution while leaving Dotenv::Parser alone — a host application's own
+    # Dotenv.load keeps the behaviour its author chose. `${VAR}` is kept: it reads only
+    # keys already parsed or the process environment.
+    class Parser < Dotenv::Parser
+      @substitutions = [Dotenv::Substitutions::Variable].freeze
+    end
+
+    # Read with the mode dotenv itself uses, so the accepted format does not narrow: `bom`
+    # skips a byte-order mark an editor on Windows may have written, and pinning `utf-8`
+    # keeps the file readable under a POSIX locale, where the default external encoding
+    # would make one accented byte anywhere — a comment included — raise while it is scanned.
+    def self.parse(path)
+      verify_suppression!
+      Parser.call(File.read(path, mode: 'rb:bom|utf-8'))
+    end
+
+    # The subclass reaches into dotenv's internals rather than a public API, and dotenv has
+    # already reorganised them once inside the range the gemspec allows, so confirm the
+    # suppression actually holds in the process that relies on it rather than trusting the
+    # version pinned in CI. Checked here rather than on load: this is the operation the
+    # guard protects, so a lapse stops it, and a gem that never reads a .env still loads.
+    # A failure is not memoised, so it is raised again on the next attempt.
+    def self.verify_suppression!
+      return if @verified
+
+      probe = Parser.call('DAYTONA_PROBE=$(echo substituted)')['DAYTONA_PROBE']
+      raise "dotenv command substitution is not suppressed (got #{probe.inspect})" unless
+        probe == '$(echo substituted)'
+
+      @verified = true
+    end
+  end
+
   class Config
     API_URL = 'https://app.daytona.io/api'
 
@@ -131,9 +170,9 @@ module Daytona
     def parse_dotenv_files
       file_vars = {}
       env_file = File.join(Dir.pwd, '.env')
-      file_vars.merge!(daytona_filter(Dotenv.parse(env_file))) if File.exist?(env_file)
+      file_vars.merge!(daytona_filter(EnvFile.parse(env_file))) if File.exist?(env_file)
       env_local_file = File.join(Dir.pwd, '.env.local')
-      file_vars.merge!(daytona_filter(Dotenv.parse(env_local_file))) if File.exist?(env_local_file)
+      file_vars.merge!(daytona_filter(EnvFile.parse(env_local_file))) if File.exist?(env_local_file)
       file_vars
     end
 

data/lib/daytona/process.rb

@@ -257,7 +257,7 @@ module Daytona
 
       completion_queue = Queue.new
 
-      WebSocket::Client::Simple.connect(
+      Common::WebSocketDialer.connect(
         url.to_s,
         headers: toolbox_api.api_client.default_headers.dup.merge(
           'X-Daytona-Preview-Token' => preview_link.token,
@@ -326,7 +326,7 @@ module Daytona
 
       completion_queue = Queue.new
 
-      WebSocket::Client::Simple.connect(
+      Common::WebSocketDialer.connect(
         url.to_s,
         headers: toolbox_api.api_client.default_headers.dup.merge(
           'X-Daytona-Preview-Token' => preview_link.token,
@@ -465,7 +465,7 @@ module Daytona
       headers['Sec-WebSocket-Protocol'] = protocols.join(', ')
 
       PtyHandle.new(
-        WebSocket::Client::Simple.connect(url.to_s, headers:),
+        Common::WebSocketDialer.connect(url.to_s, headers:),
         session_id: id,
         handle_resize: ->(pty_size_arg) { resize_pty_session(id, pty_size_arg) },
         handle_kill: -> { delete_pty_session(id) }
@@ -502,7 +502,7 @@ module Daytona
         [headers['Sec-WebSocket-Protocol'], PTY_EXIT_CONTROL_SUBPROTOCOL].compact.join(', ')
 
       handle = nil
-      WebSocket::Client::Simple.connect(url.to_s, headers:) do |client|
+      Common::WebSocketDialer.connect(url.to_s, headers:) do |client|
         handle = PtyHandle.new(
           client,
           session_id:,

data/lib/daytona/sdk/version.rb

@@ -5,6 +5,6 @@
 
 module Daytona
   module Sdk
-    VERSION = '0.211.2'
+    VERSION = '0.214.0'
   end
 end

data/lib/daytona/sdk.rb

@@ -33,6 +33,7 @@ require_relative 'common/snapshot'
 require_relative 'code_interpreter'
 require_relative 'computer_use'
 require_relative 'common/socketio_client'
+require_relative 'common/websocket_dialer'
 require_relative 'common/event_dispatcher'
 require_relative 'common/event_subscription_manager'
 require_relative 'daytona'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: daytona
 version: !ruby/object:Gem::Version
-  version: 0.211.2
+  version: 0.214.0
 platform: ruby
 authors:
 - Daytona Platforms Inc.
@@ -91,42 +91,42 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.2
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.2
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: daytona_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.2
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.2
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: daytona_toolbox_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.2
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.2
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: dotenv
   requirement: !ruby/object:Gem::Requirement
@@ -181,14 +181,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: 0.9.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: 0.9.0
 description: 'High-level Ruby SDK for Daytona: sandboxes, git, filesystem, LSP, process,
   and object storage. Requires Ruby >= 3.2.'
 email:
@@ -221,6 +221,7 @@ files:
 - lib/daytona/common/response.rb
 - lib/daytona/common/snapshot.rb
 - lib/daytona/common/socketio_client.rb
+- lib/daytona/common/websocket_dialer.rb
 - lib/daytona/computer_use.rb
 - lib/daytona/config.rb
 - lib/daytona/daytona.rb