@cloudflare/sandbox 0.0.0-dc66e8e → 0.0.0-e1fa354

package/container_src/index.ts

@@ -1,8 +1,8 @@
-import { randomBytes } from "node:crypto";
 import { serve } from "bun";
 import { handleExecuteRequest, handleStreamingExecuteRequest } from "./handler/exec";
 import {
   handleDeleteFileRequest,
+  handleListFilesRequest,
   handleMkdirRequest,
   handleMoveFileRequest,
   handleReadFileRequest,
@@ -25,38 +25,78 @@ import {
   handleStartProcessRequest,
   handleStreamProcessLogsRequest,
 } from "./handler/process";
-import type { ProcessRecord, SessionData } from "./types";
-
-// In-memory session storage (in production, you'd want to use a proper database)
-const sessions = new Map<string, SessionData>();
+import { handleCreateSession, handleListSessions } from "./handler/session";
+import { hasNamespaceSupport, SessionManager } from "./isolation";
+import type { CreateContextRequest } from "./jupyter-server";
+import { JupyterNotReadyError, JupyterService } from "./jupyter-service";
 
 // In-memory storage for exposed ports
 const exposedPorts = new Map<number, { name?: string; exposedAt: Date }>();
 
-// In-memory process storage - cleared on container restart
-const processes = new Map<string, ProcessRecord>();
-
-// Generate a unique session ID using cryptographically secure randomness
-function generateSessionId(): string {
-  return `session_${Date.now()}_${randomBytes(6).toString('hex')}`;
-}
-
-// Clean up old sessions (older than 1 hour)
-function cleanupOldSessions() {
-  const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
-  for (const [sessionId, session] of sessions.entries()) {
-    if (session.createdAt < oneHourAgo && !session.activeProcess) {
-      sessions.delete(sessionId);
-      console.log(`[Server] Cleaned up old session: ${sessionId}`);
-    }
-  }
-}
+// Check isolation capabilities on startup
+const isolationAvailable = hasNamespaceSupport();
+console.log(
+  `[Container] Process isolation: ${
+    isolationAvailable
+      ? "ENABLED (production mode)"
+      : "DISABLED (development mode)"
+  }`
+);
+
+// Session manager for secure execution with isolation
+const sessionManager = new SessionManager();
+
+// Graceful shutdown handler
+const SHUTDOWN_GRACE_PERIOD_MS = 5000; // Grace period for cleanup (5 seconds for proper async cleanup)
+
+process.on("SIGTERM", async () => {
+  console.log("[Container] SIGTERM received, cleaning up sessions...");
+  await sessionManager.destroyAll();
+  setTimeout(() => {
+    process.exit(0);
+  }, SHUTDOWN_GRACE_PERIOD_MS);
+});
+
+process.on("SIGINT", async () => {
+  console.log("[Container] SIGINT received, cleaning up sessions...");
+  await sessionManager.destroyAll();
+  setTimeout(() => {
+    process.exit(0);
+  }, SHUTDOWN_GRACE_PERIOD_MS);
+});
 
-// Run cleanup every 10 minutes
-setInterval(cleanupOldSessions, 10 * 60 * 1000);
+// Cleanup on uncaught exceptions (log but still exit)
+process.on("uncaughtException", async (error) => {
+  console.error("[Container] Uncaught exception:", error);
+  await sessionManager.destroyAll();
+  process.exit(1);
+});
+
+// Initialize Jupyter service with graceful degradation
+const jupyterService = new JupyterService();
+
+// Start Jupyter initialization in background (non-blocking)
+console.log("[Container] Starting Jupyter initialization in background...");
+console.log(
+  "[Container] API endpoints are available immediately. Jupyter-dependent features will be available shortly."
+);
+
+jupyterService
+  .initialize()
+  .then(() => {
+    console.log(
+      "[Container] Jupyter fully initialized - all features available"
+    );
+  })
+  .catch((error) => {
+    console.error("[Container] Jupyter initialization failed:", error.message);
+    console.error(
+      "[Container] The API will continue in degraded mode without code execution capabilities"
+    );
+  });
 
 const server = serve({
-  fetch(req: Request) {
+  async fetch(req: Request) {
     const url = new URL(req.url);
     const pathname = url.pathname;
 
@@ -89,108 +129,41 @@ const server = serve({
 
         case "/api/session/create":
           if (req.method === "POST") {
-            const sessionId = generateSessionId();
-            const sessionData: SessionData = {
-              activeProcess: null,
-              createdAt: new Date(),
-              sessionId,
-            };
-            sessions.set(sessionId, sessionData);
-
-            console.log(`[Server] Created new session: ${sessionId}`);
-
-            return new Response(
-              JSON.stringify({
-                message: "Session created successfully",
-                sessionId,
-                timestamp: new Date().toISOString(),
-              }),
-              {
-                headers: {
-                  "Content-Type": "application/json",
-                  ...corsHeaders,
-                },
-              }
-            );
+            return handleCreateSession(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/session/list":
           if (req.method === "GET") {
-            const sessionList = Array.from(sessions.values()).map(
-              (session) => ({
-                createdAt: session.createdAt.toISOString(),
-                hasActiveProcess: !!session.activeProcess,
-                sessionId: session.sessionId,
-              })
-            );
-
-            return new Response(
-              JSON.stringify({
-                count: sessionList.length,
-                sessions: sessionList,
-                timestamp: new Date().toISOString(),
-              }),
-              {
-                headers: {
-                  "Content-Type": "application/json",
-                  ...corsHeaders,
-                },
-              }
-            );
+            return handleListSessions(corsHeaders, sessionManager);
           }
           break;
 
         case "/api/execute":
           if (req.method === "POST") {
-            return handleExecuteRequest(sessions, req, corsHeaders);
+            return handleExecuteRequest(req, corsHeaders, sessionManager);
           }
           break;
-
+  
         case "/api/execute/stream":
           if (req.method === "POST") {
-            return handleStreamingExecuteRequest(sessions, req, corsHeaders);
+            return handleStreamingExecuteRequest(req, sessionManager, corsHeaders);
           }
           break;
 
         case "/api/ping":
           if (req.method === "GET") {
+            const health = await jupyterService.getHealthStatus();
             return new Response(
               JSON.stringify({
                 message: "pong",
                 timestamp: new Date().toISOString(),
-              }),
-              {
-                headers: {
-                  "Content-Type": "application/json",
-                  ...corsHeaders,
-                },
-              }
-            );
-          }
-          break;
-
-        case "/api/commands":
-          if (req.method === "GET") {
-            return new Response(
-              JSON.stringify({
-                availableCommands: [
-                  "ls",
-                  "pwd",
-                  "echo",
-                  "cat",
-                  "grep",
-                  "find",
-                  "whoami",
-                  "date",
-                  "uptime",
-                  "ps",
-                  "top",
-                  "df",
-                  "du",
-                  "free",
-                ],
-                timestamp: new Date().toISOString(),
+                jupyter: health.ready
+                  ? "ready"
+                  : health.initializing
+                  ? "initializing"
+                  : "not ready",
+                jupyterHealth: health,
               }),
               {
                 headers: {
@@ -204,43 +177,49 @@ const server = serve({
 
         case "/api/git/checkout":
           if (req.method === "POST") {
-            return handleGitCheckoutRequest(sessions, req, corsHeaders);
+            return handleGitCheckoutRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/mkdir":
           if (req.method === "POST") {
-            return handleMkdirRequest(sessions, req, corsHeaders);
+            return handleMkdirRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/write":
           if (req.method === "POST") {
-            return handleWriteFileRequest(req, corsHeaders);
+            return handleWriteFileRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/read":
           if (req.method === "POST") {
-            return handleReadFileRequest(req, corsHeaders);
+            return handleReadFileRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/delete":
           if (req.method === "POST") {
-            return handleDeleteFileRequest(req, corsHeaders);
+            return handleDeleteFileRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/rename":
           if (req.method === "POST") {
-            return handleRenameFileRequest(req, corsHeaders);
+            return handleRenameFileRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/move":
           if (req.method === "POST") {
-            return handleMoveFileRequest(req, corsHeaders);
+            return handleMoveFileRequest(req, corsHeaders, sessionManager);
+          }
+          break;
+
+        case "/api/list-files":
+          if (req.method === "POST") {
+            return handleListFilesRequest(req, corsHeaders, sessionManager);
           }
           break;
 
@@ -264,38 +243,291 @@ const server = serve({
 
         case "/api/process/start":
           if (req.method === "POST") {
-            return handleStartProcessRequest(processes, req, corsHeaders);
+            return handleStartProcessRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/process/list":
           if (req.method === "GET") {
-            return handleListProcessesRequest(processes, req, corsHeaders);
+            return handleListProcessesRequest(req, corsHeaders, sessionManager);
           }
           break;
 
         case "/api/process/kill-all":
           if (req.method === "DELETE") {
-            return handleKillAllProcessesRequest(processes, req, corsHeaders);
+            return handleKillAllProcessesRequest(
+              req,
+              corsHeaders,
+              sessionManager
+            );
+          }
+          break;
+
+        case "/api/contexts":
+          if (req.method === "POST") {
+            try {
+              const body = (await req.json()) as CreateContextRequest;
+              const context = await jupyterService.createContext(body);
+              return new Response(
+                JSON.stringify({
+                  id: context.id,
+                  language: context.language,
+                  cwd: context.cwd,
+                  createdAt: context.createdAt,
+                  lastUsed: context.lastUsed,
+                }),
+                {
+                  headers: {
+                    "Content-Type": "application/json",
+                    ...corsHeaders,
+                  },
+                }
+              );
+            } catch (error) {
+              if (error instanceof JupyterNotReadyError) {
+                console.log(
+                  `[Container] Request timed out waiting for Jupyter (${error.progress}% complete)`
+                );
+                return new Response(
+                  JSON.stringify({
+                    error: error.message,
+                    status: "initializing",
+                    progress: error.progress,
+                  }),
+                  {
+                    status: 503,
+                    headers: {
+                      "Content-Type": "application/json",
+                      "Retry-After": String(error.retryAfter),
+                      ...corsHeaders,
+                    },
+                  }
+                );
+              }
+
+              // Check if it's a circuit breaker error
+              if (
+                error instanceof Error &&
+                error.message.includes("Circuit breaker is open")
+              ) {
+                console.log(
+                  "[Container] Circuit breaker is open:",
+                  error.message
+                );
+                return new Response(
+                  JSON.stringify({
+                    error:
+                      "Service temporarily unavailable due to high error rate. Please try again later.",
+                    status: "circuit_open",
+                    details: error.message,
+                  }),
+                  {
+                    status: 503,
+                    headers: {
+                      "Content-Type": "application/json",
+                      "Retry-After": "60",
+                      ...corsHeaders,
+                    },
+                  }
+                );
+              }
+
+              // Only log actual errors with stack traces
+              console.error("[Container] Error creating context:", error);
+              return new Response(
+                JSON.stringify({
+                  error:
+                    error instanceof Error
+                      ? error.message
+                      : "Failed to create context",
+                }),
+                {
+                  status: 500,
+                  headers: {
+                    "Content-Type": "application/json",
+                    ...corsHeaders,
+                  },
+                }
+              );
+            }
+          } else if (req.method === "GET") {
+            const contexts = await jupyterService.listContexts();
+            return new Response(JSON.stringify({ contexts }), {
+              headers: {
+                "Content-Type": "application/json",
+                ...corsHeaders,
+              },
+            });
+          }
+          break;
+
+        case "/api/execute/code":
+          if (req.method === "POST") {
+            try {
+              const body = (await req.json()) as {
+                context_id: string;
+                code: string;
+                language?: string;
+              };
+              return await jupyterService.executeCode(
+                body.context_id,
+                body.code,
+                body.language
+              );
+            } catch (error) {
+              // Check if it's a circuit breaker error
+              if (
+                error instanceof Error &&
+                error.message.includes("Circuit breaker is open")
+              ) {
+                console.log(
+                  "[Container] Circuit breaker is open for code execution:",
+                  error.message
+                );
+                return new Response(
+                  JSON.stringify({
+                    error:
+                      "Service temporarily unavailable due to high error rate. Please try again later.",
+                    status: "circuit_open",
+                    details: error.message,
+                  }),
+                  {
+                    status: 503,
+                    headers: {
+                      "Content-Type": "application/json",
+                      "Retry-After": "30",
+                      ...corsHeaders,
+                    },
+                  }
+                );
+              }
+
+              // Don't log stack traces for expected initialization state
+              if (
+                error instanceof Error &&
+                error.message.includes("initializing")
+              ) {
+                console.log(
+                  "[Container] Code execution deferred - Jupyter still initializing"
+                );
+              } else {
+                console.error("[Container] Error executing code:", error);
+              }
+              // Error response is already handled by jupyterService.executeCode for not ready state
+              return new Response(
+                JSON.stringify({
+                  error:
+                    error instanceof Error
+                      ? error.message
+                      : "Failed to execute code",
+                }),
+                {
+                  status: 500,
+                  headers: {
+                    "Content-Type": "application/json",
+                    ...corsHeaders,
+                  },
+                }
+              );
+            }
           }
           break;
 
         default:
+          // Handle dynamic routes for contexts
+          if (
+            pathname.startsWith("/api/contexts/") &&
+            pathname.split("/").length === 4
+          ) {
+            const contextId = pathname.split("/")[3];
+            if (req.method === "DELETE") {
+              try {
+                await jupyterService.deleteContext(contextId);
+                return new Response(JSON.stringify({ success: true }), {
+                  headers: {
+                    "Content-Type": "application/json",
+                    ...corsHeaders,
+                  },
+                });
+              } catch (error) {
+                if (error instanceof JupyterNotReadyError) {
+                  console.log(
+                    `[Container] Request timed out waiting for Jupyter (${error.progress}% complete)`
+                  );
+                  return new Response(
+                    JSON.stringify({
+                      error: error.message,
+                      status: "initializing",
+                      progress: error.progress,
+                    }),
+                    {
+                      status: 503,
+                      headers: {
+                        "Content-Type": "application/json",
+                        "Retry-After": "5",
+                        ...corsHeaders,
+                      },
+                    }
+                  );
+                }
+                return new Response(
+                  JSON.stringify({
+                    error:
+                      error instanceof Error
+                        ? error.message
+                        : "Failed to delete context",
+                  }),
+                  {
+                    status:
+                      error instanceof Error &&
+                      error.message.includes("not found")
+                        ? 404
+                        : 500,
+                    headers: {
+                      "Content-Type": "application/json",
+                      ...corsHeaders,
+                    },
+                  }
+                );
+              }
+            }
+          }
+
           // Handle dynamic routes for individual processes
           if (pathname.startsWith("/api/process/")) {
-            const segments = pathname.split('/');
+            const segments = pathname.split("/");
             if (segments.length >= 4) {
               const processId = segments[3];
               const action = segments[4]; // Optional: logs, stream, etc.
 
               if (!action && req.method === "GET") {
-                return handleGetProcessRequest(processes, req, corsHeaders, processId);
+                return handleGetProcessRequest(
+                  req,
+                  corsHeaders,
+                  processId,
+                  sessionManager
+                );
               } else if (!action && req.method === "DELETE") {
-                return handleKillProcessRequest(processes, req, corsHeaders, processId);
+                return handleKillProcessRequest(
+                  req,
+                  corsHeaders,
+                  processId,
+                  sessionManager
+                );
               } else if (action === "logs" && req.method === "GET") {
-                return handleGetProcessLogsRequest(processes, req, corsHeaders, processId);
+                return handleGetProcessLogsRequest(
+                  req,
+                  corsHeaders,
+                  processId,
+                  sessionManager
+                );
               } else if (action === "stream" && req.method === "GET") {
-                return handleStreamProcessLogsRequest(processes, req, corsHeaders, processId);
+                return handleStreamProcessLogsRequest(
+                  req,
+                  corsHeaders,
+                  processId,
+                  sessionManager
+                );
               }
             }
           }
@@ -311,7 +543,10 @@ const server = serve({
           });
       }
     } catch (error) {
-      console.error(`[Container] Error handling ${req.method} ${pathname}:`, error);
+      console.error(
+        `[Container] Error handling ${req.method} ${pathname}:`,
+        error
+      );
       return new Response(
         JSON.stringify({
           error: "Internal server error",
@@ -330,7 +565,7 @@ const server = serve({
   hostname: "0.0.0.0",
   port: 3000,
   // We don't need this, but typescript complains
-  websocket: { async message() { } },
+  websocket: { async message() {} },
 });
 
 console.log(`🚀 Bun server running on http://0.0.0.0:${server.port}`);
@@ -357,5 +592,10 @@ console.log(`   GET  /api/process/{id}/logs - Get process logs`);
 console.log(`   GET  /api/process/{id}/stream - Stream process logs (SSE)`);
 console.log(`   DELETE /api/process/kill-all - Kill all processes`);
 console.log(`   GET  /proxy/{port}/* - Proxy requests to exposed ports`);
+console.log(`   POST /api/contexts - Create a code execution context`);
+console.log(`   GET  /api/contexts - List all contexts`);
+console.log(`   DELETE /api/contexts/{id} - Delete a context`);
+console.log(
+  `   POST /api/execute/code - Execute code in a context (streaming)`
+);
 console.log(`   GET  /api/ping - Health check`);
-console.log(`   GET  /api/commands - List available commands`);