@cloudflare/sandbox 0.12.9 → 0.12.11

package/dist/{sandbox-D0rNqxlr.js → sandbox-DKbJiquI.js}

@@ -1,4 +1,4 @@
-import { _ as GitLogger, b as getEnvString, c as parseSSEFrames, d as createNoOpLogger, f as TraceContext, g as DEFAULT_GIT_CLONE_TIMEOUT_MS, h as ResultImpl, i as isWSStreamChunk, l as shellEscape, m as Execution, n as isWSError, p as logCanonicalEvent, r as isWSResponse, t as generateRequestId, u as createLogger, v as extractRepoName, x as partitionEnvVars, y as filterEnvVars } from "./dist-B_eXrP83.js";
+import { _ as GitLogger, b as getEnvString, c as parseSSEFrames, d as createNoOpLogger, f as TraceContext, g as DEFAULT_GIT_CLONE_TIMEOUT_MS, h as ResultImpl, i as isWSStreamChunk, l as shellEscape, m as Execution, n as isWSError, p as logCanonicalEvent, r as isWSResponse, t as generateRequestId, u as createLogger, v as extractRepoName, x as partitionEnvVars, y as filterEnvVars } from "./dist-C3AQh4A0.js";
 import { n as getHttpStatus, r as ErrorCode, t as getSuggestion } from "./errors-CpkKPbWC.js";
 import { Container, ContainerProxy, getContainer, switchPort } from "@cloudflare/containers";
 import { AwsClient } from "aws4fetch";
@@ -1878,11 +1878,13 @@ var FileClient = class extends BaseHttpClient {
 	* Returns a ReadableStream of SSE events containing metadata, chunks, and completion
 	* @param path - File path to stream
 	* @param sessionId - The session ID for this operation
+	* @param options - Optional stream encoding; base64 preserves arbitrary bytes
 	*/
-	async readFileStream(path$1, sessionId) {
+	async readFileStream(path$1, sessionId, options) {
 		const data = {
 			path: path$1,
-			sessionId
+			sessionId,
+			encoding: options?.encoding
 		};
 		return await this.doStreamFetch("/api/read/stream", data);
 	}
@@ -4343,18 +4345,49 @@ async function* parseSSE(stream) {
 * ```
 */
 async function* streamFile(stream) {
-	let metadata = null;
-	for await (const event of parseSSE(stream)) switch (event.type) {
+	const { chunks } = await openFileStream(stream);
+	return yield* chunks;
+}
+/**
+* Read the metadata event at the head of a file stream and return it with
+* the decoded chunks that follow. Callers that need the file size before
+* consuming the body, such as sizing a FixedLengthStream, use this instead of
+* streamFile(). Call cancel() to release the stream without reading the rest.
+*/
+async function openFileStream(stream) {
+	const events = parseSSE(stream);
+	const cancel = async () => {
+		await events.return(void 0);
+	};
+	try {
+		const first = await events.next();
+		if (first.done) throw new Error("Stream ended unexpectedly");
+		const metadata = readMetadataEvent(first.value);
+		return {
+			metadata,
+			chunks: decodeChunks(events, metadata),
+			cancel
+		};
+	} catch (error) {
+		await cancel();
+		throw error;
+	}
+}
+function readMetadataEvent(event) {
+	switch (event.type) {
+		case "metadata": return toFileMetadata(event);
+		case "chunk": throw new Error("Received chunk before metadata");
+		case "complete": throw new Error("Stream completed without metadata");
+		case "error": throw new Error(`File streaming error: ${event.error}`);
+	}
+}
+async function* decodeChunks(events, initialMetadata) {
+	let metadata = initialMetadata;
+	for await (const event of events) switch (event.type) {
 		case "metadata":
-			metadata = {
-				mimeType: event.mimeType,
-				size: event.size,
-				isBinary: event.isBinary,
-				encoding: event.encoding
-			};
+			metadata = toFileMetadata(event);
 			break;
 		case "chunk":
-			if (!metadata) throw new Error("Received chunk before metadata");
 			if (metadata.isBinary && metadata.encoding === "base64") {
 				const binaryString = atob(event.data);
 				const bytes = new Uint8Array(binaryString.length);
@@ -4362,13 +4395,19 @@ async function* streamFile(stream) {
 				yield bytes;
 			} else yield event.data;
 			break;
-		case "complete":
-			if (!metadata) throw new Error("Stream completed without metadata");
-			return metadata;
+		case "complete": return metadata;
 		case "error": throw new Error(`File streaming error: ${event.error}`);
 	}
 	throw new Error("Stream ended unexpectedly");
 }
+function toFileMetadata(event) {
+	return {
+		mimeType: event.mimeType,
+		size: event.size,
+		isBinary: event.isBinary,
+		encoding: event.encoding
+	};
+}
 /**
 * Collect an entire file into memory from a stream
 *
@@ -4871,6 +4910,10 @@ const DEFAULT_POLL_INTERVAL_MS = 1e3;
 const DEFAULT_ECHO_SUPPRESS_TTL_MS = 2e3;
 const MAX_BACKOFF_MS = 3e4;
 const SYNC_CONCURRENCY = 5;
+const STREAM_TO_CONTAINER_THRESHOLD_BYTES = 4 * 1024 * 1024;
+const UPLOAD_DEBOUNCE_MS = 1500;
+/** Watch rejections that a retry with the same request cannot fix. */
+const PERMANENT_WATCH_ERRORS = new Set([ErrorCode.PERMISSION_DENIED, ErrorCode.VALIDATION_FAILED]);
 /**
 * Manages bidirectional sync between an R2 binding and a container directory.
 *
@@ -4888,7 +4931,9 @@ var LocalMountSyncManager = class {
 	pollIntervalMs;
 	echoSuppressTtlMs;
 	snapshot = /* @__PURE__ */ new Map();
-	echoSuppressSet = /* @__PURE__ */ new Set();
+	echoSuppressTimers = /* @__PURE__ */ new Map();
+	uploadTimers = /* @__PURE__ */ new Map();
+	containerToR2Queue = Promise.resolve();
 	pollTimer = null;
 	watchReconnectTimer = null;
 	watchAbortController = null;
@@ -4941,8 +4986,11 @@ var LocalMountSyncManager = class {
 			this.watchAbortController.abort();
 			this.watchAbortController = null;
 		}
+		for (const timer of this.uploadTimers.values()) clearTimeout(timer);
+		this.uploadTimers.clear();
+		for (const timer of this.echoSuppressTimers.values()) clearTimeout(timer);
+		this.echoSuppressTimers.clear();
 		this.snapshot.clear();
-		this.echoSuppressSet.clear();
 		this.logger.info("Local mount sync stopped", { mountPath: this.mountPath });
 	}
 	async fullSyncR2ToContainer() {
@@ -5000,6 +5048,7 @@ var LocalMountSyncManager = class {
 					await this.ensureParentDir(containerPath);
 					this.suppressEcho(containerPath);
 					await this.transferR2ObjectToContainer(key, containerPath);
+					this.suppressEcho(containerPath);
 					this.logger.debug("R2 -> Container: synced object", {
 						key,
 						action
@@ -5041,6 +5090,15 @@ var LocalMountSyncManager = class {
 	async transferR2ObjectToContainer(key, containerPath) {
 		const obj = await this.bucket.get(key);
 		if (!obj) return;
+		if (obj.size > STREAM_TO_CONTAINER_THRESHOLD_BYTES && this.client.getTransportMode() === "rpc") {
+			try {
+				await this.client.files.writeFileStream(containerPath, obj.body, this.sessionId);
+			} catch (error) {
+				await obj.body.cancel().catch(() => {});
+				throw error;
+			}
+			return;
+		}
 		const arrayBuffer = await obj.arrayBuffer();
 		const base64 = uint8ArrayToBase64(new Uint8Array(arrayBuffer));
 		await this.client.files.writeFile(containerPath, base64, this.sessionId, { encoding: "base64" });
@@ -5060,8 +5118,13 @@ var LocalMountSyncManager = class {
 			this.scheduleWatchReconnect();
 		}).catch((error) => {
 			if (!this.running) return;
+			const err = error instanceof Error ? error : new Error(String(error));
+			if (PERMANENT_WATCH_ERRORS.has(Reflect.get(err, "code"))) {
+				this.logger.error("Container rejected the mount watch; changes made in the container will not sync to R2. Update the container image to match the SDK version.", err, { mountPath: this.mountPath });
+				return;
+			}
 			this.consecutiveWatchFailures++;
-			this.logger.error("Container watch loop failed", error instanceof Error ? error : new Error(String(error)));
+			this.logger.error("Container watch loop failed", err);
 			this.scheduleWatchReconnect();
 		});
 	}
@@ -5091,54 +5154,108 @@ var LocalMountSyncManager = class {
 			if (event.type !== "event") continue;
 			if (event.isDirectory) continue;
 			const containerPath = event.path;
-			if (this.echoSuppressSet.has(containerPath)) continue;
+			if (this.echoSuppressTimers.has(containerPath)) continue;
 			const r2Key = this.containerPathToR2Key(containerPath);
 			if (!r2Key) continue;
-			try {
-				switch (event.eventType) {
-					case "create":
-					case "modify":
-					case "move_to":
-						await this.uploadFileToR2(containerPath, r2Key);
-						this.logger.debug("Container -> R2: synced file", {
-							path: containerPath,
-							key: r2Key,
-							action: event.eventType
-						});
-						break;
-					case "delete":
-					case "move_from":
+			switch (event.eventType) {
+				case "create":
+				case "modify":
+				case "move_to":
+					this.scheduleUpload(containerPath, r2Key);
+					break;
+				case "delete":
+				case "move_from":
+					this.cancelScheduledUpload(containerPath);
+					this.enqueueContainerToR2(containerPath, async () => {
 						await this.bucket.delete(r2Key);
 						this.snapshot.delete(r2Key);
 						this.logger.debug("Container -> R2: deleted object", {
 							path: containerPath,
 							key: r2Key
 						});
-						break;
-				}
+					});
+					break;
+			}
+		}
+	}
+	/**
+	* Upload a changed file once its burst of watch events settles. Each new
+	* event for the path restarts the wait.
+	*/
+	scheduleUpload(containerPath, r2Key) {
+		this.cancelScheduledUpload(containerPath);
+		const timer = setTimeout(() => {
+			this.uploadTimers.delete(containerPath);
+			this.enqueueContainerToR2(containerPath, async () => {
+				await this.uploadFileToR2(containerPath, r2Key);
+				this.logger.debug("Container -> R2: synced file", {
+					path: containerPath,
+					key: r2Key
+				});
+			});
+		}, UPLOAD_DEBOUNCE_MS);
+		this.uploadTimers.set(containerPath, timer);
+	}
+	cancelScheduledUpload(containerPath) {
+		const timer = this.uploadTimers.get(containerPath);
+		if (timer !== void 0) {
+			clearTimeout(timer);
+			this.uploadTimers.delete(containerPath);
+		}
+	}
+	enqueueContainerToR2(containerPath, operation) {
+		this.containerToR2Queue = this.containerToR2Queue.then(async () => {
+			if (!this.running) return;
+			try {
+				await operation();
 			} catch (error) {
 				this.logger.error(`Container -> R2 sync failed for ${containerPath}`, error instanceof Error ? error : new Error(String(error)));
 			}
-		}
+		});
 	}
 	/**
-	* Read a container file and upload it to R2, then update the local
-	* snapshot so the next poll cycle doesn't echo the write back.
+	* Stream a container file into R2, then update the local snapshot so the
+	* next poll cycle doesn't echo the write back.
 	*/
 	async uploadFileToR2(containerPath, r2Key) {
-		const bytes = base64ToUint8Array((await this.client.files.readFile(containerPath, this.sessionId, { encoding: "base64" })).content);
-		await this.bucket.put(r2Key, bytes);
+		const file = await openFileStream(await this.client.files.readFileStream(containerPath, this.sessionId, { encoding: "base64" }));
+		if (file.metadata.isBinary && file.metadata.encoding === "base64") await this.putFileStream(r2Key, file);
+		else {
+			await file.cancel();
+			const result = await this.client.files.readFile(containerPath, this.sessionId, { encoding: "base64" });
+			await this.bucket.put(r2Key, base64ToUint8Array(result.content));
+		}
 		const head = await this.bucket.head(r2Key);
 		if (head) this.snapshot.set(r2Key, {
 			etag: head.etag,
 			size: head.size
 		});
 	}
+	async putFileStream(r2Key, file) {
+		const body = new ReadableStream({
+			async pull(controller) {
+				const next = await file.chunks.next();
+				if (next.done) controller.close();
+				else if (typeof next.value === "string") controller.error(/* @__PURE__ */ new Error("Expected binary file chunks"));
+				else controller.enqueue(next.value);
+			},
+			cancel: () => file.cancel()
+		});
+		const sized = new FixedLengthStream(file.metadata.size);
+		const pipeAbort = new AbortController();
+		body.pipeTo(sized.writable, { signal: pipeAbort.signal }).catch(() => {});
+		try {
+			await this.bucket.put(r2Key, sized.readable);
+		} catch (error) {
+			pipeAbort.abort(error);
+			throw error;
+		}
+	}
 	suppressEcho(containerPath) {
-		this.echoSuppressSet.add(containerPath);
-		setTimeout(() => {
-			this.echoSuppressSet.delete(containerPath);
-		}, this.echoSuppressTtlMs);
+		clearTimeout(this.echoSuppressTimers.get(containerPath));
+		this.echoSuppressTimers.set(containerPath, setTimeout(() => {
+			this.echoSuppressTimers.delete(containerPath);
+		}, this.echoSuppressTtlMs));
 	}
 	r2KeyToContainerPath(key) {
 		let relativePath = key;
@@ -5916,6 +6033,10 @@ function isBucketRootProbe(request, realPath, url, bucket) {
 	const method = request.method.toUpperCase();
 	return (method === "GET" || method === "HEAD") && url.search === "" && getObjectKeyForPath(realPath, bucket) === "";
 }
+function isBucketRootMutation(request, realPath, bucket) {
+	const method = request.method.toUpperCase();
+	return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && getObjectKeyForPath(realPath, bucket) === "";
+}
 function deleteDirectoryMarkerCacheEntry(mountId, realPath) {
 	directoryMarkerCache.delete(getDirectoryMarkerCacheKey(mountId, realPath));
 }
@@ -6039,6 +6160,7 @@ const s3CredentialProxyHandler = async (request, env$1, ctx) => {
 	}
 	const realUrl = new URL(realPath + (url.search || ""), mount.endpoint);
 	if (isBucketRootProbe(request, realPath, url, mount.bucket)) return new Response(null, { status: 200 });
+	if (isBucketRootMutation(request, realPath, mount.bucket)) return new Response("Method Not Allowed", { status: 405 });
 	if (!isRequestWithinMountScope(realPath, url, mount.bucket, mount.prefix)) return new Response("Forbidden: request is outside mounted bucket scope", { status: 403 });
 	const copySourceError = validateCopySourceWithinMountScope(request.headers, mount.bucket, mount.prefix);
 	if (copySourceError) return copySourceError;
@@ -7180,7 +7302,7 @@ function createTunnelsHandler(host) {
 * This file is auto-updated by .github/changeset-version.ts during releases
 * DO NOT EDIT MANUALLY - Changes will be overwritten on the next version bump
 */
-const SDK_VERSION = "0.12.9";
+const SDK_VERSION = "0.12.11";
 
 //#endregion
 //#region src/sandbox.ts
@@ -9318,7 +9440,6 @@ var Sandbox = class Sandbox extends Container {
 			logCanonicalEvent(this.logger, {
 				event: "sandbox.exec",
 				outcome: execError ? "error" : "success",
-				command,
 				exitCode: execOutcome?.exitCode,
 				durationMs: Date.now() - startTime,
 				sessionId: this.getPublicExecutionSessionId(sessionId),
@@ -10834,9 +10955,9 @@ var Sandbox = class Sandbox extends Container {
 				...startLines,
 				...waitLines,
 				`FAILED=$(( ${exitVars.join(" + ")} ))`,
-				`if [ "$FAILED" -ne 0 ]; then rm -f ${shellEscape(tmpPath)}; exit 1; fi`
+				`if [ "$FAILED" -ne 0 ]; then echo "download part exit codes: ${exitVars.join(" ")}" >&2; rm -f ${shellEscape(tmpPath)}; exit 1; fi`
 			].join("; ");
-			const result = await this.execWithSession(script, backupSession, {
+			const result = await this.execWithSession(`( ${script} )`, backupSession, {
 				timeout: 181e4,
 				origin: "internal"
 			});
@@ -11561,4 +11682,4 @@ var Sandbox = class Sandbox extends Container {
 
 //#endregion
 export { PortClient as A, InvalidBackupConfigError as B, collectFile as C, SandboxClient as D, isPlatformTransientError as E, BackupCreateError as F, SessionTerminatedError as G, ProcessExitedBeforeReadyError as H, BackupExpiredError as I, BackupNotFoundError as L, FileClient as M, CommandClient as N, UtilityClient as O, BackupClient as P, BackupRestoreError as R, validateTunnelName as S, isDurableObjectCodeUpdateReset as T, ProcessReadyTimeoutError as U, OperationInterruptedError as V, RPCTransportError as W, responseToAsyncIterable as _, PREVIEW_PROXY_HEADER as a, sanitizeSandboxId as b, PREVIEW_PROXY_SANDBOX_ID_HEADER as c, BucketUnmountError as d, InvalidMountConfigError as f, parseSSEStream as g, asyncIterableToSSEStream as h, proxyTerminal as i, GitClient as j, ProcessClient as k, PREVIEW_PROXY_TOKEN_HEADER as l, S3FSMountError as m, Sandbox as n, PREVIEW_PROXY_HEADERS as o, MissingCredentialsError as p, getSandbox as r, PREVIEW_PROXY_PORT_HEADER as s, ContainerProxy$1 as t, BucketMountError as u, CodeInterpreter as v, streamFile as w, validatePort as x, SandboxSecurityError as y, ContainerUnavailableError as z };
-//# sourceMappingURL=sandbox-D0rNqxlr.js.map
+//# sourceMappingURL=sandbox-DKbJiquI.js.map