@cloudflare/sandbox 0.12.0 → 0.12.2

package/README.md

@@ -200,6 +200,7 @@ See the [examples directory](./examples) for complete working examples:
 - [Claude Code](./examples/claude-code) - Run [Claude Code](https://claude.ai/code) headless on any repo
 - [OpenAI Agents](./examples/openai-agents) - `Shell` and `Editor` tools for [OpenAI Agents SDK](https://openai.github.io/openai-agents-js/)
 - [OpenCode](./examples/opencode) - [OpenCode](https://github.com/sst/opencode) web UI or [SDK](https://opencode.ai/docs/sdk/) in a sandbox
+- [Git Repo Per Sandbox](./examples/git-repo-per-sandbox) - One Artifacts Git repo per sandbox
 - [TypeScript Validator](./examples/typescript-validator) - Build with npm in sandbox, execute in [isolates](https://developers.cloudflare.com/workers/runtime-apis/bindings/worker-loader/)
 
 ## Status

package/dist/bridge/index.js

@@ -1,6 +1,6 @@
 import "../dist-B_eXrP83.js";
 import "../errors-aRUdk9K8.js";
-import { S as validateTunnelName, r as getSandbox, w as streamFile, x as validatePort, y as SandboxSecurityError } from "../sandbox-Duj2gvUC.js";
+import { S as validateTunnelName, r as getSandbox, w as streamFile, x as validatePort, y as SandboxSecurityError } from "../sandbox-BXMrasVs.js";
 import { DurableObject, env } from "cloudflare:workers";
 import { Hono } from "hono";
 
@@ -454,7 +454,7 @@ const OPENAPI_SCHEMA = {
 					type: "string",
 					pattern: "^[a-zA-Z0-9._-]{1,128}$"
 				},
-				description: "Scope this operation to a specific session. Uses the default session if omitted."
+				description: "Scope this operation to a specific session. If omitted, the operation runs without reusing shell state."
 			}],
 			requestBody: {
 				required: true,
@@ -618,7 +618,7 @@ const OPENAPI_SCHEMA = {
 							type: "string",
 							pattern: "^[a-zA-Z0-9._-]{1,128}$"
 						},
-						description: "Scope this operation to a specific session. Uses the default session if omitted."
+						description: "Scope this operation to a specific session. If omitted, the operation runs without reusing shell state."
 					}
 				],
 				responses: {
@@ -694,7 +694,7 @@ const OPENAPI_SCHEMA = {
 							type: "string",
 							pattern: "^[a-zA-Z0-9._-]{1,128}$"
 						},
-						description: "Scope this operation to a specific session. Uses the default session if omitted."
+						description: "Scope this operation to a specific session. If omitted, the operation runs without reusing shell state."
 					}
 				],
 				requestBody: {
@@ -794,7 +794,7 @@ const OPENAPI_SCHEMA = {
 						type: "string",
 						pattern: "^[a-zA-Z0-9._-]{1,128}$"
 					},
-					description: "Scope this operation to a specific session. Uses the default session if omitted."
+					description: "Scope this PTY to a specific session."
 				}
 			],
 			responses: {
@@ -1767,6 +1767,10 @@ function esc(s) {
 function getSandbox$1(ns, containerUUID) {
 	return getSandbox(ns, containerUUID);
 }
+/** Bridge routes should not implicitly reuse the SDK's default shell session. */
+function getSandboxWithoutDefaultSession(ns, containerUUID) {
+	return getSandbox(ns, containerUUID, { enableDefaultSession: false });
+}
 function hasEndpoint(options) {
 	return "endpoint" in options && typeof options.endpoint === "string";
 }
@@ -1910,7 +1914,7 @@ function createBridgeApp(config) {
 			return errorJson("Invalid JSON body", "invalid_request", 400);
 		}
 		if (!Array.isArray(body.argv) || body.argv.length === 0) return errorJson("argv must be a non-empty array", "invalid_request", 400);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		const rawSessionId = c.req.header("Session-Id");
 		let executor = sandbox;
 		if (rawSessionId) {
@@ -1983,7 +1987,7 @@ function createBridgeApp(config) {
 		if (!relativePath) return errorJson("file path must not be empty", "invalid_request", 400);
 		const resolvedPath = resolveWorkspacePath(`/${relativePath}`);
 		if (!resolvedPath) return errorJson("path must resolve to a location within /workspace", "invalid_request", 403);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		const rawSessionId = c.req.header("Session-Id");
 		let executor = sandbox;
 		if (rawSessionId) {
@@ -2010,7 +2014,7 @@ function createBridgeApp(config) {
 		if (!relativePath) return errorJson("file path must not be empty", "invalid_request", 400);
 		const resolvedPath = resolveWorkspacePath(`/${relativePath}`);
 		if (!resolvedPath) return errorJson("path must resolve to a location within /workspace", "invalid_request", 403);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		const rawSessionId = c.req.header("Session-Id");
 		let executor = sandbox;
 		if (rawSessionId) {
@@ -2037,7 +2041,7 @@ function createBridgeApp(config) {
 		if (!validatePort(port)) return errorJson("Invalid port", "invalid_request", 400);
 		const options = parseTunnelOptions(await c.req.text());
 		if (options instanceof Response) return options;
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		try {
 			const tunnel = await sandbox.tunnels.get(port, options);
 			return c.json(tunnel);
@@ -2048,7 +2052,7 @@ function createBridgeApp(config) {
 	app.delete(`${apiPrefix}/sandbox/:id/tunnel/:port`, async (c) => {
 		const port = Number(c.req.param("port"));
 		if (!validatePort(port)) return errorJson("Invalid port", "invalid_request", 400);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		try {
 			await sandbox.tunnels.destroy(port);
 			return c.body(null, 204);
@@ -2057,7 +2061,7 @@ function createBridgeApp(config) {
 		}
 	});
 	app.get(`${apiPrefix}/sandbox/:id/running`, async (c) => {
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		try {
 			await sandbox.exec("true");
 			return c.json({ running: true });
@@ -2068,7 +2072,7 @@ function createBridgeApp(config) {
 	app.get(`${apiPrefix}/sandbox/:id/pty`, async (c) => {
 		const upgrade = c.req.header("Upgrade");
 		if (!upgrade || upgrade.toLowerCase() !== "websocket") return errorJson("WebSocket upgrade required", "invalid_request", 400);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		const colsParam = c.req.query("cols");
 		const rowsParam = c.req.query("rows");
 		const shell = c.req.query("shell");
@@ -2097,7 +2101,7 @@ function createBridgeApp(config) {
 		const excludesParam = c.req.query("excludes") ?? "";
 		const excludes = excludesParam ? excludesParam.split(",").filter((s) => s.length > 0) : [];
 		for (const ex of excludes) if (ex.includes("..")) return errorJson("exclude paths must not contain \"..\"", "invalid_request", 400);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		const tmpPath = `/tmp/sandbox-persist-${Date.now()}.tar`;
 		const excludeArgs = excludes.map((rel) => `--exclude ${shellQuote(`./${rel.replace(/^\.\//, "")}`)}`).join(" ");
 		const tarCmd = excludeArgs ? `tar cf ${shellQuote(tmpPath)} ${excludeArgs} -C ${shellQuote(root)} .` : `tar cf ${shellQuote(tmpPath)} -C ${shellQuote(root)} .`;
@@ -2116,7 +2120,7 @@ function createBridgeApp(config) {
 	});
 	app.post(`${apiPrefix}/sandbox/:id/hydrate`, async (c) => {
 		const root = "/workspace";
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		let tarBytes;
 		try {
 			const buffer = await c.req.arrayBuffer();
@@ -2156,7 +2160,7 @@ function createBridgeApp(config) {
 		if (optionsError) return optionsError;
 		const bucketName = resolveMountBucketName(body);
 		if (bucketName instanceof Response) return bucketName;
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		const sdkOptions = toSDKMountOptions(body.options);
 		try {
 			await sandbox.mountBucket(bucketName, body.mountPath, sdkOptions);
@@ -2176,7 +2180,7 @@ function createBridgeApp(config) {
 		if (!body.mountPath.startsWith("/")) return errorJson("mountPath must be an absolute path (start with /)", "invalid_request", 400);
 		const normalizedPath = new URL(body.mountPath, "file:///").pathname;
 		if (normalizedPath === "/") return errorJson("mountPath must not resolve to / (filesystem root)", "invalid_request", 400);
-		const sandbox = getSandbox$1(getSandboxNs(c.env), c.get("containerUUID"));
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), c.get("containerUUID"));
 		try {
 			await sandbox.unmountBucket(normalizedPath);
 			const quoted = shellQuote(normalizedPath);
@@ -2213,7 +2217,7 @@ function createBridgeApp(config) {
 	});
 	app.delete(`${apiPrefix}/sandbox/:id`, async (c) => {
 		const containerUUID = c.get("containerUUID");
-		const sandbox = getSandbox$1(getSandboxNs(c.env), containerUUID);
+		const sandbox = getSandboxWithoutDefaultSession(getSandboxNs(c.env), containerUUID);
 		try {
 			await sandbox.destroy();
 		} catch {}