@cloudflare/sandbox 0.12.11 → 0.12.13

package/dist/{sandbox-DKbJiquI.js → sandbox-BGDk-c1Y.js}

@@ -1,5 +1,5 @@
-import { _ as GitLogger, b as getEnvString, c as parseSSEFrames, d as createNoOpLogger, f as TraceContext, g as DEFAULT_GIT_CLONE_TIMEOUT_MS, h as ResultImpl, i as isWSStreamChunk, l as shellEscape, m as Execution, n as isWSError, p as logCanonicalEvent, r as isWSResponse, t as generateRequestId, u as createLogger, v as extractRepoName, x as partitionEnvVars, y as filterEnvVars } from "./dist-C3AQh4A0.js";
-import { n as getHttpStatus, r as ErrorCode, t as getSuggestion } from "./errors-CpkKPbWC.js";
+import { S as partitionEnvVars, _ as DEFAULT_GIT_CLONE_TIMEOUT_MS, a as isWSStreamChunk, b as filterEnvVars, d as createLogger, f as createNoOpLogger, g as ResultImpl, h as Execution, i as isWSResponse, l as parseSSEFrames, m as logCanonicalEvent, n as generateRequestId, p as TraceContext, r as isWSError, t as WS_KEEPALIVE_EVENT, u as shellEscape, v as GitLogger, x as getEnvString, y as extractRepoName } from "./dist-CqPJfREN.js";
+import { n as getHttpStatus, r as ErrorCode, t as getSuggestion } from "./errors-CHhwDJNh.js";
 import { Container, ContainerProxy, getContainer, switchPort } from "@cloudflare/containers";
 import { AwsClient } from "aws4fetch";
 import { RpcSession, RpcTarget } from "capnweb";
@@ -1431,6 +1431,7 @@ var WebSocketTransport = class extends BaseTransport {
 			pending.onFirstChunk = void 0;
 		}
 		if (pending.isStreaming) this.resetStreamIdleTimeout(chunk.id, pending);
+		if (chunk.event === WS_KEEPALIVE_EVENT) return;
 		if (!pending.streamController) {
 			if (!pending.bufferedChunks) pending.bufferedChunks = [];
 			const encoder$1 = new TextEncoder();
@@ -1853,14 +1854,15 @@ var FileClient = class extends BaseHttpClient {
 	* @param path - File path to write to
 	* @param content - Content to write
 	* @param sessionId - The session ID for this operation
-	* @param options - Optional settings (encoding)
+	* @param options - Optional settings (encoding, ownerOnly)
 	*/
 	async writeFile(path$1, content, sessionId, options) {
 		const data = {
 			path: path$1,
 			content,
 			sessionId,
-			encoding: options?.encoding
+			encoding: options?.encoding,
+			...options?.ownerOnly === true && { ownerOnly: true }
 		};
 		return await this.post("/api/write", data);
 	}
@@ -2602,6 +2604,19 @@ function isDurableObjectCodeUpdateReset(error) {
 	return false;
 }
 /**
+* Whether an error was raised because the Durable Object itself was reset, by
+* a code update or a storage startup failure, rather than by the operation
+* that observed it.
+*/
+function isDurableObjectReset(error) {
+	for (const candidate of selfAndCauses(error)) {
+		const message = errorMessageOf(candidate);
+		if (SUPERSEDED_ISOLATE_PATTERN.test(message)) return true;
+		if (DO_STORAGE_STARTUP_RESET_PATTERN.test(message)) return true;
+	}
+	return false;
+}
+/**
 * Whether an error represents a transient platform lifecycle/storage failure,
 * not an application-level sandbox failure.
 */
@@ -5304,8 +5319,12 @@ async function forwardPreviewRequest(tcpPort, request, lifecycle) {
 		};
 	} catch (error) {
 		settleForward();
+		if (isDurableObjectReset(error)) throw error;
 		if (error instanceof Error && error.message.includes("Network connection lost.")) return { status: "network-lost" };
-		throw error;
+		return {
+			status: "failed",
+			error
+		};
 	}
 }
 function bridgePreviewWebSocket(response, lifecycle, settleForward) {
@@ -6772,6 +6791,23 @@ function isTunnelAlreadyRunningError(error) {
 	return hasErrorCode(error, "TUNNEL_ALREADY_RUNNING");
 }
 /**
+* The run holding `request.port` when the container rejected `request`
+* with a port conflict. Containers older than this SDK omit
+* `activeTunnelId`, which `stopTunnelRun` needs, so their conflicts yield
+* `null`.
+*/
+function conflictingRunOnPort(error, request) {
+	if (!hasErrorCode(error, "TUNNEL_RUN_CONFLICT")) return null;
+	const context = error.context;
+	const runId = context?.activeRunId;
+	const tunnelId = context?.activeTunnelId;
+	if (context?.port !== request.port || typeof runId !== "string" || typeof tunnelId !== "string" || runId === request.runId) return null;
+	return {
+		tunnelId,
+		runId
+	};
+}
+/**
 * Concrete `TunnelsHandler` implementation.
 *
 * Extends `RpcTarget` for forward compatibility with direct Workers RPC
@@ -6885,6 +6921,7 @@ var TunnelsRpcTarget = class extends RpcTarget$1 {
 			const interrupted = translateTunnelInterruption(error, "provisioning", "unknown");
 			if (!interrupted || options?.name || !interrupted.context.retryable) throw error;
 			if (recoveryAttempts >= TUNNEL_GET_MAX_RECOVERY_ATTEMPTS) {
+				await this.#stopAbandonedQuickRun(port, recovery.quickRun);
 				await this.#clearQuickTunnelStorage(port);
 				throw createTunnelInterruptedError({
 					reason: "recovery_exhausted",
@@ -6896,10 +6933,50 @@ var TunnelsRpcTarget = class extends RpcTarget$1 {
 				});
 			}
 			recoveryAttempts++;
-			if (interrupted.context.reason === "runtime_replaced") recovery.quickRun = void 0;
+			if (interrupted.context.reason === "runtime_replaced") {
+				await this.#stopAbandonedQuickRun(port, recovery.quickRun);
+				recovery.quickRun = void 0;
+			}
 			await this.#clearQuickTunnelStorage(port);
 		}
 	}
+	/**
+	* Stop a quick tunnel run that `get()` is giving up on, so its
+	* cloudflared does not keep holding the port. Best effort: the run may
+	* have died with a replaced container.
+	*/
+	async #stopAbandonedQuickRun(port, run) {
+		if (!run) return;
+		try {
+			await this.#host.client.tunnels.stopTunnelRun(run);
+		} catch (error) {
+			this.#host.logger.warn("tunnel.get: abandoned run cleanup failed", {
+				port,
+				...run,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	/**
+	* Start or replay a quick tunnel run. The Durable Object owns every
+	* tunnel run in its container and holds the port lock, so a different
+	* run already on the port lost its storage record. Stop it and retry
+	* once instead of failing every later `get()` for the port.
+	*/
+	async #ensureQuickTunnelRun(request) {
+		try {
+			return await this.#host.client.tunnels.ensureTunnelRun(request);
+		} catch (error) {
+			const orphan = conflictingRunOnPort(error, request);
+			if (!orphan) throw error;
+			this.#host.logger.warn("tunnel.get: stopping orphaned run on port", {
+				port: request.port,
+				...orphan
+			});
+			await this.#host.client.tunnels.stopTunnelRun(orphan);
+			return await this.#host.client.tunnels.ensureTunnelRun(request);
+		}
+	}
 	async #clearQuickTunnelStorage(port) {
 		await this.#host.storage.transaction(async (txn) => {
 			const map = await readMap(txn);
@@ -6980,7 +7057,7 @@ var TunnelsRpcTarget = class extends RpcTarget$1 {
 		let ensureResult;
 		let runtime = runtimeBeforeAdmission;
 		try {
-			ensureResult = await this.#host.client.tunnels.ensureTunnelRun({
+			ensureResult = await this.#ensureQuickTunnelRun({
 				tunnelId,
 				runId,
 				mode: "quick",
@@ -7209,13 +7286,33 @@ var TunnelsRpcTarget = class extends RpcTarget$1 {
 		return Object.values(map);
 	}
 };
-function createTunnelsHandler(host) {
+/**
+* Per-port serialization lock. Any operation that mutates the tunnel for
+* a given port — get() on a cache miss, destroy(), the exit callback —
+* queues behind the previous operation on the same port. Two
+* consequences:
+*
+*   - get(8080) followed by destroy(8080) is well-ordered: the destroy
+*     observes whatever the get just wrote, even though both yield to
+*     external RPCs in the middle.
+*   - Two concurrent get(8080) calls share the first call's record: the
+*     second runs after the first writes storage and takes the hit branch
+*     (so no double cloudflared spawn).
+*
+* The lock is a plain Promise chain keyed by port. `transaction()` on the
+* storage write still matters for *cross-port* writes — a get(8080) and
+* get(8081) running in parallel are independent here.
+*/
+function createPortLock() {
 	const portLocks = /* @__PURE__ */ new Map();
-	const withPortLock = (port, fn) => {
+	return (port, fn) => {
 		const next = (portLocks.get(port) ?? Promise.resolve()).then(fn, fn);
 		portLocks.set(port, next.catch(() => void 0));
 		return next;
 	};
+}
+function createTunnelsHandler(host) {
+	const withPortLock = host.withPortLock ?? createPortLock();
 	const tunnels = new TunnelsRpcTarget(host, withPortLock);
 	const handleTunnelExit = async (id, port, exitCode, runId) => {
 		const startTime = Date.now();
@@ -7302,7 +7399,7 @@ function createTunnelsHandler(host) {
 * This file is auto-updated by .github/changeset-version.ts during releases
 * DO NOT EDIT MANUALLY - Changes will be overwritten on the next version bump
 */
-const SDK_VERSION = "0.12.11";
+const SDK_VERSION = "0.12.13";
 
 //#endregion
 //#region src/sandbox.ts
@@ -7311,12 +7408,32 @@ const ACTIVE_PREVIEW_PORTS_STORAGE_KEY = "activePreviewPorts";
 const CONTAINER_PROXY_CLASS_NAME = "ContainerProxy";
 const S3_CREDENTIAL_PROXY_HOST = "s3-credential-proxy.internal";
 const S3_CREDENTIAL_PROXY_DIAGNOSTIC_HOST = "s3-credential-proxy.sandbox.test";
-var ContainerProxyOutboundTarget = class extends Container {};
-Object.defineProperty(ContainerProxyOutboundTarget, "name", { value: CONTAINER_PROXY_CLASS_NAME });
-ContainerProxyOutboundTarget.outboundHandlers = {
+const SDK_OUTBOUND_HANDLERS = {
 	r2EgressMount: r2EgressHandler,
 	s3CredentialProxyMount: s3CredentialProxyHandler
 };
+var ContainerProxyOutboundTarget = class extends Container {};
+Object.defineProperty(ContainerProxyOutboundTarget, "name", { value: CONTAINER_PROXY_CLASS_NAME });
+ContainerProxyOutboundTarget.outboundHandlers = SDK_OUTBOUND_HANDLERS;
+function noRestoredMountRoutes() {
+	return {
+		r2Buckets: {},
+		credentialProxyMounts: {}
+	};
+}
+/**
+* Read the bucket mount routes that the base Container restored from storage
+* in its constructor. `outboundByHostOverrides` is private in its types.
+*/
+function readRestoredMountRoutes(container) {
+	const overrides = container.outboundByHostOverrides ?? {};
+	const r2 = overrides["r2.internal"];
+	const credentialProxy = overrides[S3_CREDENTIAL_PROXY_HOST];
+	return {
+		r2Buckets: r2?.method === "r2EgressMount" ? { ...r2.params?.buckets } : {},
+		credentialProxyMounts: credentialProxy?.method === "s3CredentialProxyMount" ? { ...credentialProxy.params?.mounts } : {}
+	};
+}
 /**
 * SDK-level ContainerProxy that directly dispatches SDK-internal mount hosts
 * (r2.internal, s3-credential-proxy.internal) without relying on
@@ -7644,6 +7761,7 @@ var Sandbox = class Sandbox extends Container {
 	tunnelsHandler = null;
 	tunnelExitHandler = null;
 	destroyAllTunnels = null;
+	tunnelPortLock = createPortLock();
 	controlCallback;
 	normalizeId = false;
 	defaultSession = null;
@@ -7653,6 +7771,11 @@ var Sandbox = class Sandbox extends Container {
 	logger;
 	keepAliveEnabled = false;
 	activeMounts = /* @__PURE__ */ new Map();
+	restoredMountRoutes = noRestoredMountRoutes();
+	staleMountRoutes = {
+		r2: false,
+		credentialProxy: false
+	};
 	mountOperationQueue = Promise.resolve();
 	currentRuntime;
 	currentLifetime;
@@ -7801,7 +7924,15 @@ var Sandbox = class Sandbox extends Container {
 		return this.createSandboxClient();
 	}
 	constructor(ctx, env$1) {
+		if (ctx.exports?.ContainerProxy) {
+			const registry = new.target;
+			registry.outboundHandlers = {
+				...registry.outboundHandlers,
+				...SDK_OUTBOUND_HANDLERS
+			};
+		}
 		super(ctx, env$1);
+		this.restoredMountRoutes = readRestoredMountRoutes(this);
 		const envObj = env$1;
 		["SANDBOX_LOG_LEVEL", "SANDBOX_LOG_FORMAT"].forEach((key) => {
 			if (envObj?.[key]) this.envVars[key] = String(envObj[key]);
@@ -8179,23 +8310,18 @@ var Sandbox = class Sandbox extends Container {
 		const prefix = options.prefix;
 		let mountOutcome = "error";
 		let mountError;
-		let passwordFilePath;
-		let additionalHeaderFilePath;
 		try {
 			validateBucketBindingName(bucket, mountPath);
 			this.validateMountPath(mountPath);
 			this.validateProtectedS3fsOptions(options.s3fsOptions, "R2 binding");
+			const restoredRoute = this.restoredMountRoutes.r2Buckets[bucket];
+			if (restoredRoute && (restoredRoute.prefix !== prefix || (restoredRoute.readOnly ?? false) !== (options.readOnly ?? false))) throw new InvalidMountConfigError(`R2 binding "${bucket}" is already mounted with a different prefix or readOnly setting. Mount the same binding only once, or use the same settings for additional mounts.`);
 			for (const [existingMountPath, mountInfo$1] of this.activeMounts) {
 				if (mountInfo$1.mountType === "r2-egress" && mountInfo$1.bucket === bucket && mountInfo$1.prefix !== prefix) throw new InvalidMountConfigError(`R2 binding "${bucket}" is already mounted at ${existingMountPath} with a different prefix. Mount the same binding only once, or use the same prefix for additional mounts.`);
 				if (mountInfo$1.mountType === "r2-egress" && mountInfo$1.bucket === bucket && mountInfo$1.readOnly !== (options.readOnly ?? false)) throw new InvalidMountConfigError(`R2 binding "${bucket}" is already mounted at ${existingMountPath} with a different readOnly setting. Mount the same binding only once, or use the same readOnly value for additional mounts.`);
 			}
-			passwordFilePath = this.generatePasswordFilePath();
-			additionalHeaderFilePath = this.generateS3FSAdditionalHeaderFilePath();
-			await this.createPasswordFile(passwordFilePath, bucket, {
-				accessKeyId: "x",
-				secretAccessKey: "x"
-			});
-			await this.createDisableExpectHeaderFile(additionalHeaderFilePath);
+			const passwordFilePath = this.generatePasswordFilePath();
+			const additionalHeaderFilePath = this.generateS3FSAdditionalHeaderFilePath();
 			const mountInfo = {
 				mountId: crypto.randomUUID(),
 				mountType: "r2-egress",
@@ -8208,48 +8334,47 @@ var Sandbox = class Sandbox extends Container {
 				readOnly: options.readOnly ?? false
 			};
 			this.activeMounts.set(mountPath, mountInfo);
-			await this.configureR2EgressOutbound(this.getR2EgressParams());
-			await this.execInternal(`mkdir -p ${shellEscape(mountPath)}`);
-			const s3fsSource = bucket;
-			const optionsStr = shellEscape(serializeS3fsOptions({
-				passwd_file: passwordFilePath,
-				...R2_DEFAULT_S3FS_OPTIONS,
-				...parseS3fsOptions(resolveS3fsOptions("r2", options.s3fsOptions)),
-				use_path_request_style: true,
-				url: "http://r2.internal",
-				ahbe_conf: additionalHeaderFilePath,
-				...options.readOnly ? { ro: true } : {}
-			}));
-			const mountCmd = `s3fs ${shellEscape(s3fsSource)} ${shellEscape(mountPath)} -o ${optionsStr}`;
-			this.logger.debug("r2-egress: running s3fs", { mountCmd });
-			const result = await this.execInternal(mountCmd);
-			this.logger.debug("r2-egress: s3fs exited", {
-				exitCode: result.exitCode,
-				stdout: result.stdout,
-				stderr: result.stderr
-			});
-			if (result.exitCode !== 0) throw new S3FSMountError(`S3FS mount failed: ${result.stderr || result.stdout || "Unknown error"}`);
-			const mountpointCheck = await this.execInternal(`mountpoint -q ${shellEscape(mountPath)} && echo 'FUSE_MOUNTED' || echo 'NOT_FUSE_MOUNTED'`);
-			this.logger.debug("r2-egress: mountpoint check", {
-				stdout: mountpointCheck.stdout.trim(),
-				exitCode: mountpointCheck.exitCode
-			});
-			if (mountpointCheck.stdout.trim() !== "FUSE_MOUNTED") throw new S3FSMountError(`s3fs exited 0 but mount was not established at ${mountPath}`);
+			try {
+				await this.createPasswordFile(passwordFilePath, bucket, {
+					accessKeyId: "x",
+					secretAccessKey: "x"
+				});
+				await this.createDisableExpectHeaderFile(additionalHeaderFilePath);
+				await this.configureR2EgressOutbound(this.getR2EgressParams());
+				await this.execInternal(`mkdir -p ${shellEscape(mountPath)}`);
+				const s3fsSource = bucket;
+				const optionsStr = shellEscape(serializeS3fsOptions({
+					passwd_file: passwordFilePath,
+					...R2_DEFAULT_S3FS_OPTIONS,
+					...parseS3fsOptions(resolveS3fsOptions("r2", options.s3fsOptions)),
+					use_path_request_style: true,
+					url: "http://r2.internal",
+					ahbe_conf: additionalHeaderFilePath,
+					...options.readOnly ? { ro: true } : {}
+				}));
+				const mountCmd = `s3fs ${shellEscape(s3fsSource)} ${shellEscape(mountPath)} -o ${optionsStr}`;
+				this.logger.debug("r2-egress: running s3fs", { mountCmd });
+				const result = await this.execInternal(mountCmd);
+				this.logger.debug("r2-egress: s3fs exited", {
+					exitCode: result.exitCode,
+					stdout: result.stdout,
+					stderr: result.stderr
+				});
+				if (result.exitCode !== 0) throw new S3FSMountError(`S3FS mount failed: ${result.stderr || result.stdout || "Unknown error"}`);
+				const mountpointCheck = await this.execInternal(`mountpoint -q ${shellEscape(mountPath)} && echo 'FUSE_MOUNTED' || echo 'NOT_FUSE_MOUNTED'`);
+				this.logger.debug("r2-egress: mountpoint check", {
+					stdout: mountpointCheck.stdout.trim(),
+					exitCode: mountpointCheck.exitCode
+				});
+				if (mountpointCheck.stdout.trim() !== "FUSE_MOUNTED") throw new S3FSMountError(`s3fs exited 0 but mount was not established at ${mountPath}`);
+			} catch (error) {
+				await this.releaseFailedR2EgressMount(mountInfo);
+				throw error;
+			}
 			mountInfo.mounted = true;
 			mountOutcome = "success";
 		} catch (error) {
 			mountError = error instanceof Error ? error : new Error(String(error));
-			const failedMount = this.activeMounts.get(mountPath);
-			this.activeMounts.delete(mountPath);
-			if (failedMount?.mountType === "r2-egress") {
-				await this.deletePasswordFile(failedMount.passwordFilePath).catch(() => {});
-				if (failedMount.additionalHeaderFilePath) await this.deleteAdditionalHeaderFile(failedMount.additionalHeaderFilePath).catch(() => {});
-			} else {
-				if (passwordFilePath) await this.deletePasswordFile(passwordFilePath).catch(() => {});
-				if (additionalHeaderFilePath) await this.deleteAdditionalHeaderFile(additionalHeaderFilePath).catch(() => {});
-			}
-			const remainingParams = this.getR2EgressParams();
-			await this.configureR2EgressOutbound(remainingParams).catch(() => {});
 			throw error;
 		} finally {
 			logCanonicalEvent(this.logger, {
@@ -8265,6 +8390,16 @@ var Sandbox = class Sandbox extends Container {
 		}
 	}
 	/**
+	* Undo a failed R2 binding mount: drop its reservation and support files,
+	* then rebuild the `r2.internal` routes from the remaining mounts.
+	*/
+	async releaseFailedR2EgressMount(mountInfo) {
+		this.activeMounts.delete(mountInfo.mountPath);
+		await this.deletePasswordFile(mountInfo.passwordFilePath);
+		if (mountInfo.additionalHeaderFilePath) await this.deleteAdditionalHeaderFile(mountInfo.additionalHeaderFilePath);
+		await this.configureR2EgressOutbound(this.getR2EgressParams()).catch(() => {});
+	}
+	/**
 	* Production mount: S3FS-FUSE inside the container
 	*/
 	async mountBucketFuse(bucket, mountPath, options) {
@@ -8272,10 +8407,7 @@ var Sandbox = class Sandbox extends Container {
 		const prefix = options.prefix;
 		let mountOutcome = "error";
 		let mountError;
-		let passwordFilePath;
-		let additionalHeaderFilePath;
 		let provider = null;
-		let dirExisted = true;
 		try {
 			this.validateMountOptions(bucket, mountPath, {
 				...options,
@@ -8297,8 +8429,8 @@ var Sandbox = class Sandbox extends Container {
 			});
 			const credentialProxyEnabled = options.credentialProxy === true;
 			if (credentialProxyEnabled) this.validateProtectedS3fsOptions(options.s3fsOptions, "credential proxy", ["ahbe_conf", "use_path_request_style"]);
-			passwordFilePath = this.generatePasswordFilePath();
-			if (credentialProxyEnabled) additionalHeaderFilePath = this.generateS3FSAdditionalHeaderFilePath();
+			const passwordFilePath = this.generatePasswordFilePath();
+			const additionalHeaderFilePath = credentialProxyEnabled ? this.generateS3FSAdditionalHeaderFilePath() : void 0;
 			const mountId = crypto.randomUUID();
 			const mountInfo = {
 				mountId,
@@ -8321,55 +8453,37 @@ var Sandbox = class Sandbox extends Container {
 				} } : {}
 			};
 			this.activeMounts.set(mountPath, mountInfo);
-			await this.createPasswordFile(passwordFilePath, bucket, credentialProxyEnabled ? {
-				accessKeyId: "x",
-				secretAccessKey: "x"
-			} : credentials);
-			if (credentialProxyEnabled) {
-				if (additionalHeaderFilePath) await this.createDisableExpectHeaderFile(additionalHeaderFilePath);
-				await this.configureS3CredentialProxyOutbound(this.getS3CredentialProxyParams());
+			let dirExisted = true;
+			try {
+				await this.createPasswordFile(passwordFilePath, bucket, credentialProxyEnabled ? {
+					accessKeyId: "x",
+					secretAccessKey: "x"
+				} : credentials);
+				if (credentialProxyEnabled) {
+					if (additionalHeaderFilePath) await this.createDisableExpectHeaderFile(additionalHeaderFilePath);
+					await this.configureS3CredentialProxyOutbound(this.getS3CredentialProxyParams());
+				}
+				dirExisted = (await this.execInternal(`test -d ${shellEscape(mountPath)}`)).exitCode === 0;
+				await this.execInternal(`mkdir -p ${shellEscape(mountPath)}`);
+				const effectiveOptions = credentialProxyEnabled ? {
+					...options,
+					endpoint: `http://${S3_CREDENTIAL_PROXY_HOST}/${mountId}`,
+					s3fsOptions: [
+						...provider === "r2" ? R2_DEFAULT_S3FS_OPTION_ENTRIES : [],
+						...options.s3fsOptions ?? [],
+						...additionalHeaderFilePath ? [`ahbe_conf=${additionalHeaderFilePath}`] : [],
+						"use_path_request_style"
+					]
+				} : options;
+				await this.executeS3FSMount(s3fsSource, mountPath, effectiveOptions, provider, passwordFilePath);
+			} catch (error) {
+				await this.releaseFailedFuseMount(mountInfo, !dirExisted);
+				throw error;
 			}
-			dirExisted = (await this.execInternal(`test -d ${shellEscape(mountPath)}`)).exitCode === 0;
-			await this.execInternal(`mkdir -p ${shellEscape(mountPath)}`);
-			const effectiveOptions = credentialProxyEnabled ? {
-				...options,
-				endpoint: `http://${S3_CREDENTIAL_PROXY_HOST}/${mountId}`,
-				s3fsOptions: [
-					...provider === "r2" ? R2_DEFAULT_S3FS_OPTION_ENTRIES : [],
-					...options.s3fsOptions ?? [],
-					...additionalHeaderFilePath ? [`ahbe_conf=${additionalHeaderFilePath}`] : [],
-					"use_path_request_style"
-				]
-			} : options;
-			await this.executeS3FSMount(s3fsSource, mountPath, effectiveOptions, provider, passwordFilePath);
 			mountInfo.mounted = true;
 			mountOutcome = "success";
 		} catch (error) {
 			mountError = error instanceof Error ? error : new Error(String(error));
-			try {
-				await this.execInternal(`mountpoint -q ${shellEscape(mountPath)} && fusermount -u ${shellEscape(mountPath)}`);
-			} catch {}
-			if (passwordFilePath) await this.deletePasswordFile(passwordFilePath);
-			if (additionalHeaderFilePath) await this.deleteAdditionalHeaderFile(additionalHeaderFilePath);
-			if (!dirExisted) try {
-				await this.execInternal(`rmdir ${shellEscape(mountPath)} 2>/dev/null`);
-			} catch {}
-			const failedMount = this.activeMounts.get(mountPath);
-			if (failedMount?.mountType === "fuse" && failedMount.credentialProxy) try {
-				await this.configureS3CredentialProxyOutbound(this.getS3CredentialProxyParams({ excludeMountId: failedMount.mountId }));
-				this.activeMounts.delete(mountPath);
-				evictSigV4ClientCacheEntry(failedMount.mountId);
-				evictDirectoryMarkerCacheForMount(failedMount.mountId);
-			} catch (cleanupError) {
-				this.logger.warn("credential proxy cleanup failed", {
-					mountPath,
-					error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
-				});
-				this.activeMounts.delete(mountPath);
-				evictSigV4ClientCacheEntry(failedMount.mountId);
-				evictDirectoryMarkerCacheForMount(failedMount.mountId);
-			}
-			else this.activeMounts.delete(mountPath);
 			throw error;
 		} finally {
 			logCanonicalEvent(this.logger, {
@@ -8385,6 +8499,35 @@ var Sandbox = class Sandbox extends Container {
 		}
 	}
 	/**
+	* Undo a failed FUSE mount: unmount anything s3fs established, then drop
+	* its support files, the directory if this mount created it, and its
+	* reservation.
+	*/
+	async releaseFailedFuseMount(mountInfo, removeMountDirectory) {
+		const { mountPath } = mountInfo;
+		try {
+			await this.execInternal(`mountpoint -q ${shellEscape(mountPath)} && fusermount -u ${shellEscape(mountPath)}`);
+		} catch {}
+		await this.deletePasswordFile(mountInfo.passwordFilePath);
+		if (mountInfo.additionalHeaderFilePath) await this.deleteAdditionalHeaderFile(mountInfo.additionalHeaderFilePath);
+		if (removeMountDirectory) try {
+			await this.execInternal(`rmdir ${shellEscape(mountPath)} 2>/dev/null`);
+		} catch {}
+		if (mountInfo.credentialProxy) {
+			try {
+				await this.configureS3CredentialProxyOutbound(this.getS3CredentialProxyParams({ excludeMountId: mountInfo.mountId }));
+			} catch (cleanupError) {
+				this.logger.warn("credential proxy cleanup failed", {
+					mountPath,
+					error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+				});
+			}
+			evictSigV4ClientCacheEntry(mountInfo.mountId);
+			evictDirectoryMarkerCacheForMount(mountInfo.mountId);
+		}
+		this.activeMounts.delete(mountPath);
+	}
+	/**
 	* Manually unmount a bucket filesystem
 	*
 	* @param mountPath - Absolute path where the bucket is mounted
@@ -8524,11 +8667,9 @@ var Sandbox = class Sandbox extends Container {
 	}
 	/**
 	* Create s3fs ahbe_conf file that suppresses the Expect: 100-continue header.
-	* Restricted to 0600 so s3fs will accept it (same requirement as passwd files).
 	*/
 	async createDisableExpectHeaderFile(headerFilePath) {
-		await this.client.files.writeFile(headerFilePath, S3FS_DISABLE_EXPECT_HEADER_CONFIG, DISABLE_SESSION_TOKEN);
-		await this.execInternal(`chmod 0600 ${shellEscape(headerFilePath)}`);
+		await this.writeOwnerOnlyFile(headerFilePath, S3FS_DISABLE_EXPECT_HEADER_CONFIG);
 	}
 	/**
 	* Create password file with s3fs credentials
@@ -8536,8 +8677,16 @@ var Sandbox = class Sandbox extends Container {
 	*/
 	async createPasswordFile(passwordFilePath, bucket, credentials) {
 		const content = `${bucket}:${credentials.accessKeyId}:${credentials.secretAccessKey}`;
-		await this.client.files.writeFile(passwordFilePath, content, DISABLE_SESSION_TOKEN);
-		await this.execInternal(`chmod 0600 ${shellEscape(passwordFilePath)}`);
+		await this.writeOwnerOnlyFile(passwordFilePath, content);
+	}
+	/**
+	* s3fs refuses support files that other users can read. Create them with
+	* mode 0600 so the password file is never readable while it is being
+	* written. The chmod covers container images that ignore `ownerOnly`.
+	*/
+	async writeOwnerOnlyFile(path$1, content) {
+		await this.client.files.writeFile(path$1, content, DISABLE_SESSION_TOKEN, { ownerOnly: true });
+		await this.execInternal(`chmod 0600 ${shellEscape(path$1)}`);
 	}
 	/**
 	* Delete password file
@@ -8705,6 +8854,7 @@ var Sandbox = class Sandbox extends Container {
 	async onStart() {
 		this.logger.debug("Sandbox started");
 		await this.currentRuntime.markStarted();
+		await this.removeStaleMountRoutes();
 		this.checkVersionCompatibility().catch((error) => {
 			this.logger.error("Version compatibility check failed", error instanceof Error ? error : new Error(String(error)));
 		});
@@ -8786,6 +8936,7 @@ var Sandbox = class Sandbox extends Container {
 		this.containerGeneration++;
 		this.defaultSession = null;
 		this.defaultSessionInit = null;
+		const disconnectClient = this.transport !== "rpc" || this.client.isWebSocketConnected();
 		await this.currentRuntime.clear();
 		await this.clearActivePreviewPorts();
 		try {
@@ -8793,7 +8944,8 @@ var Sandbox = class Sandbox extends Container {
 		} catch (error) {
 			this.logger.error("Failed to reconcile tunnel storage after container stop", error instanceof Error ? error : new Error(String(error)));
 		}
-		this.client.disconnect(this.buildDisconnectCause("runtime_replaced", "The sandbox container stopped while the operation was pending.", params));
+		if (disconnectClient) this.client.disconnect(this.buildDisconnectCause("runtime_replaced", "The sandbox container stopped while the operation was pending.", params));
+		await this.releaseRestoredMountRoutes();
 		let hadR2EgressMount = false;
 		let hadCredentialProxyMount = false;
 		for (const [, m] of this.activeMounts) if (m.mountType === "local-sync") await m.syncManager.stop().catch(() => {});
@@ -8941,6 +9093,13 @@ var Sandbox = class Sandbox extends Container {
 	/**
 	* Explicit container-start hook for the RPC transport.
 	*
+	* The control connection calls this hook every time it connects, including
+	* when it reconnects after an idle disconnect. A running, healthy container
+	* is left alone, as in {@link containerFetch}: the base class runs
+	* `onStart()` on every `startAndWaitForPorts()`, and `onStart()` treats the
+	* container as new, recording a new runtime identity and dropping quick
+	* tunnels from storage.
+	*
 	* Runs `startAndWaitForPorts` under a short instance-get budget
 	* ({@link RPC_START_INSTANCE_GET_TIMEOUT_MS}) so a single attempt fails fast
 	* under capacity pressure — the base class throws the classifiable
@@ -8960,6 +9119,7 @@ var Sandbox = class Sandbox extends Container {
 	*/
 	async startContainerForRPC() {
 		try {
+			if ((await this.getState()).status === "healthy" && this.ctx.container?.running !== false) return;
 			await this.startAndWaitForPorts({
 				ports: 3e3,
 				cancellationOptions: {
@@ -9175,6 +9335,14 @@ var Sandbox = class Sandbox extends Container {
 			if (!await this.currentRuntime.isActive(runtime)) return this.stalePreviewURLResponse();
 			return new Response("Container suddenly disconnected, try again", { status: 500 });
 		}
+		if (result.status === "failed") {
+			if (!await this.currentRuntime.isActive(runtime)) return this.stalePreviewURLResponse();
+			this.logger.error("Preview request to container port failed", result.error instanceof Error ? result.error : new Error(String(result.error)), {
+				port,
+				method: request.method
+			});
+			return new Response(`Could not reach port ${port} in the container`, { status: 502 });
+		}
 		return result.response;
 	}
 	buildPreviewProxyRequest(request, port, sandboxId) {
@@ -9186,10 +9354,6 @@ var Sandbox = class Sandbox extends Container {
 		headers.set("X-Forwarded-Host", url.hostname);
 		headers.set("X-Forwarded-Proto", url.protocol.replace(":", ""));
 		headers.set("X-Sandbox-Name", this.sandboxName ?? sandboxId);
-		if (request.headers.get("Upgrade")?.toLowerCase() === "websocket") return new Request(request, {
-			headers,
-			redirect: "manual"
-		});
 		return new Request(proxyUrl, {
 			method: request.method,
 			headers,
@@ -10174,6 +10338,7 @@ var Sandbox = class Sandbox extends Container {
 			sandboxId: this.ctx.id.toString(),
 			currentRuntime: this.currentRuntime,
 			currentLifetime: this.currentLifetime,
+			withPortLock: this.tunnelPortLock,
 			getNamedTunnelConfig: async () => {
 				const envObj = this.env;
 				const token = getEnvString(envObj, "CLOUDFLARE_API_TOKEN");
@@ -11620,11 +11785,47 @@ var Sandbox = class Sandbox extends Container {
 			});
 		}
 	}
-	async configureR2EgressOutbound(params) {
+	/**
+	* Drop the routes restored for the mounts of a container that has stopped.
+	*/
+	async releaseRestoredMountRoutes() {
+		const { r2Buckets, credentialProxyMounts } = this.restoredMountRoutes;
+		this.restoredMountRoutes = noRestoredMountRoutes();
+		for (const mountId of Object.keys(credentialProxyMounts)) {
+			evictSigV4ClientCacheEntry(mountId);
+			evictDirectoryMarkerCacheForMount(mountId);
+		}
+		if (Object.keys(r2Buckets).length > 0) this.staleMountRoutes.r2 = true;
+		if (Object.keys(credentialProxyMounts).length > 0) this.staleMountRoutes.credentialProxy = true;
+		await this.removeStaleMountRoutes();
+	}
+	/**
+	* Rewrite the routes that still carry a stopped container's restored
+	* mounts so they cover only the mounts in activeMounts. A failed update
+	* stays marked and is retried on the next container start or stop.
+	*/
+	async removeStaleMountRoutes() {
+		if (this.staleMountRoutes.r2) try {
+			await this.configureR2EgressOutbound(this.getR2EgressParams());
+			this.staleMountRoutes.r2 = false;
+		} catch (error) {
+			this.logger.warn("Failed to remove stale R2 mount routes", { error: error instanceof Error ? error.message : String(error) });
+		}
+		if (this.staleMountRoutes.credentialProxy) try {
+			await this.configureS3CredentialProxyOutbound(this.getS3CredentialProxyParams());
+			this.staleMountRoutes.credentialProxy = false;
+		} catch (error) {
+			this.logger.warn("Failed to remove stale credential proxy mount routes", { error: error instanceof Error ? error.message : String(error) });
+		}
+	}
+	async configureR2EgressOutbound(activeParams) {
+		const params = { buckets: {
+			...this.restoredMountRoutes.r2Buckets,
+			...activeParams.buckets
+		} };
 		const ctx = this.ctx;
 		if (!ctx.container?.interceptOutboundHttp) throw new InvalidMountConfigError("R2 binding mounts require container outbound interception support");
 		if (!ctx.exports?.ContainerProxy) throw new InvalidMountConfigError("R2 binding mounts require exporting ContainerProxy from the Worker entrypoint");
-		this.constructor.outboundHandlers = { r2EgressMount: r2EgressHandler };
 		if (Object.keys(params.buckets).length > 0) await this.setOutboundByHost("r2.internal", "r2EgressMount", params);
 		else await this.removeOutboundByHost("r2.internal");
 		this.logger.debug("r2 egress: registering host interception", {
@@ -11644,12 +11845,15 @@ var Sandbox = class Sandbox extends Container {
 		if (!isFetcher(fetcher)) throw new InvalidMountConfigError("R2 binding mounts require ContainerProxy to return a valid Fetcher");
 		await ctx.container.interceptOutboundHttp("r2.internal", fetcher);
 	}
-	async configureS3CredentialProxyOutbound(params) {
+	async configureS3CredentialProxyOutbound(activeParams) {
+		const params = { mounts: {
+			...this.restoredMountRoutes.credentialProxyMounts,
+			...activeParams.mounts
+		} };
 		const ctx = this.ctx;
 		if (!ctx.container?.interceptOutboundHttp) throw new InvalidMountConfigError("Credential proxy bucket mounts require container outbound interception support");
 		if (!ctx.exports?.ContainerProxy) throw new InvalidMountConfigError("Credential proxy bucket mounts require exporting ContainerProxy from the Worker entrypoint");
 		const hosts = [S3_CREDENTIAL_PROXY_HOST, S3_CREDENTIAL_PROXY_DIAGNOSTIC_HOST];
-		this.constructor.outboundHandlers = { s3CredentialProxyMount: s3CredentialProxyHandler };
 		if (Object.keys(params.mounts).length > 0) for (const host of hosts) await this.setOutboundByHost(host, "s3CredentialProxyMount", params);
 		else for (const host of hosts) await this.removeOutboundByHost(host);
 		const hostOverrides = {};
@@ -11682,4 +11886,4 @@ var Sandbox = class Sandbox extends Container {
 
 //#endregion
 export { PortClient as A, InvalidBackupConfigError as B, collectFile as C, SandboxClient as D, isPlatformTransientError as E, BackupCreateError as F, SessionTerminatedError as G, ProcessExitedBeforeReadyError as H, BackupExpiredError as I, BackupNotFoundError as L, FileClient as M, CommandClient as N, UtilityClient as O, BackupClient as P, BackupRestoreError as R, validateTunnelName as S, isDurableObjectCodeUpdateReset as T, ProcessReadyTimeoutError as U, OperationInterruptedError as V, RPCTransportError as W, responseToAsyncIterable as _, PREVIEW_PROXY_HEADER as a, sanitizeSandboxId as b, PREVIEW_PROXY_SANDBOX_ID_HEADER as c, BucketUnmountError as d, InvalidMountConfigError as f, parseSSEStream as g, asyncIterableToSSEStream as h, proxyTerminal as i, GitClient as j, ProcessClient as k, PREVIEW_PROXY_TOKEN_HEADER as l, S3FSMountError as m, Sandbox as n, PREVIEW_PROXY_HEADERS as o, MissingCredentialsError as p, getSandbox as r, PREVIEW_PROXY_PORT_HEADER as s, ContainerProxy$1 as t, BucketMountError as u, CodeInterpreter as v, streamFile as w, validatePort as x, SandboxSecurityError as y, ContainerUnavailableError as z };
-//# sourceMappingURL=sandbox-DKbJiquI.js.map
+//# sourceMappingURL=sandbox-BGDk-c1Y.js.map