@cloudflare/sandbox 0.13.0-next.802.1 → 0.13.0-next.808.1

package/dist/openai/index.d.ts

@@ -1,6 +1,6 @@
 import "../process-types-GStiZ8f8.js";
-import "../filesystem-Y5aF3nmJ.js";
-import { t as ISandbox } from "../sandbox-CBkS3tGv.js";
+import "../filesystem-Cd6xd_Pe.js";
+import { t as ISandbox } from "../sandbox-D1BoB5f7.js";
 import { ApplyPatchOperation, ApplyPatchResult, Editor as Editor$1, Shell as Shell$1, ShellAction, ShellResult } from "@openai/agents";
 
 //#region src/openai/index.d.ts

package/dist/opencode/index.d.ts

@@ -1,7 +1,7 @@
 import { D as OpenCodeStartupContext } from "../contexts-DNFVmC9N.js";
 import "../process-types-GStiZ8f8.js";
-import "../filesystem-Y5aF3nmJ.js";
-import { c as SandboxExtension, l as SandboxLike } from "../index-DfXx3uZL.js";
+import "../filesystem-Cd6xd_Pe.js";
+import { c as SandboxExtension, l as SandboxLike } from "../index-Fbdwkfft.js";
 import { OpencodeClient } from "@opencode-ai/sdk/v2/client";
 import { Config } from "@opencode-ai/sdk/v2";
 

package/dist/opencode/index.js

@@ -1,7 +1,7 @@
 import { i as ErrorCode } from "../errors-Bb3s6nBS.js";
 import "../errors--yR3zLC_.js";
 import { r as createLogger } from "../dist-n_eniPAR.js";
-import { n as createExtensionProcessSandbox, t as SandboxExtension } from "../extensions-BKL2zqL4.js";
+import { n as createExtensionProcessSandbox, t as SandboxExtension } from "../extensions-038QzSIg.js";
 
 //#region ../../extensions/opencode/src/client.ts
 let createSDKClient;

package/dist/{sandbox-CaesWCLh.js → sandbox-CpelK4pU.js}

@@ -1,7 +1,7 @@
 import { i as ErrorCode, n as getSuggestion, r as getHttpStatus } from "./errors-Bb3s6nBS.js";
 import { $ as TerminalControlError, G as BackupRestoreError, H as BackupCreateError, Q as StaleTerminalHandleError, U as BackupExpiredError, W as BackupNotFoundError, X as OperationInterruptedError, Z as RPCTransportError, _ as StaleProcessHandleError, n as RuntimeIdentityInactiveError, p as ProcessNotFoundError, q as InvalidBackupConfigError, r as RuntimeControlProtocolError, t as createErrorFromResponse, tt as SandboxError, v as CustomDomainRequiredError } from "./errors--yR3zLC_.js";
 import { a as TraceContext, d as partitionEnvVars, i as createNoOpLogger, o as logCanonicalEvent, r as createLogger, t as parseSSEFrames, u as getEnvString } from "./dist-n_eniPAR.js";
-import { a as PullSubscriptionTarget, i as createSandboxProcess, o as openRemoteSubscription, r as sandboxRuntimeCall, s as translateRPCError, t as SandboxExtension } from "./extensions-BKL2zqL4.js";
+import { a as PullSubscriptionTarget, i as createSandboxProcess, o as openRemoteSubscription, r as sandboxRuntimeCall, s as translateRPCError, t as SandboxExtension } from "./extensions-038QzSIg.js";
 import { Container, ContainerProxy, getContainer, switchPort } from "@cloudflare/containers";
 import { RpcTarget } from "cloudflare:workers";
 import { AwsClient } from "aws4fetch";
@@ -190,7 +190,7 @@ function isPlatformTransientError(error) {
 
 //#endregion
 //#region src/pty/proxy.ts
-function terminalHandle(stub, snapshot, runtimeIncarnationID, outputProtocol = "stream") {
+function terminalHandle(stub, snapshot, runtimeIncarnationID, outputProtocol = "stream", release = () => void 0) {
 	const id = snapshot.id;
 	return {
 		id,
@@ -211,7 +211,8 @@ function terminalHandle(stub, snapshot, runtimeIncarnationID, outputProtocol = "
 				...options,
 				runtimeIncarnationID
 			});
-		}
+		},
+		[Symbol.dispose]: release
 	};
 }
 function terminalHandleFromRPCDescriptor(descriptor, fetch$1) {
@@ -224,7 +225,7 @@ function terminalHandleFromRPCDescriptor(descriptor, fetch$1) {
 		interrupt: () => capability.interrupt(),
 		terminate: () => capability.terminate(),
 		fetch: fetch$1
-	}, descriptor.snapshot, descriptor.runtimeIncarnationID, "pull");
+	}, descriptor.snapshot, descriptor.runtimeIncarnationID, "pull", () => capability[Symbol.dispose]?.());
 }
 async function terminalOutput(stub, id, options, protocol) {
 	const { signal, ...rpcOptions } = options ?? {};
@@ -1530,16 +1531,53 @@ var ContainerProxy$1 = class extends ContainerProxy {
 };
 ContainerProxy$1.outboundHandlers = SDK_OUTBOUND_HANDLERS;
 
+//#endregion
+//#region src/storage-mount/outbound/params.ts
+function hasExcludedID(excludedIDs, mountId) {
+	if (!excludedIDs) return false;
+	for (const excludedID of excludedIDs) if (excludedID === mountId) return true;
+	return false;
+}
+function buildR2EgressParams(mounts, options) {
+	const buckets = {};
+	for (const [, mountInfo] of mounts) if (mountInfo.mountType === "r2-egress" && mountInfo.mountId !== options?.excludeMountId && !hasExcludedID(options?.excludeMountIds, mountInfo.mountId)) buckets[mountInfo.bucket] = {
+		prefix: mountInfo.prefix,
+		readOnly: mountInfo.readOnly
+	};
+	return { buckets };
+}
+function buildS3CredentialProxyParams(mounts, options) {
+	const params = {};
+	const addMount = (mountInfo) => {
+		if (!mountInfo.credentialProxy || mountInfo.mountId === options?.excludeMountId || hasExcludedID(options?.excludeMountIds, mountInfo.mountId)) return;
+		params[mountInfo.mountId] = {
+			endpoint: mountInfo.credentialProxy.endpoint,
+			bucket: mountInfo.credentialProxy.bucket,
+			...mountInfo.credentialProxy.prefix !== void 0 ? { prefix: mountInfo.credentialProxy.prefix } : {},
+			credentials: mountInfo.credentialProxy.credentials,
+			readOnly: mountInfo.credentialProxy.readOnly,
+			provider: mountInfo.credentialProxy.provider,
+			authStrategy: mountInfo.credentialProxy.authStrategy
+		};
+	};
+	for (const [, mountInfo] of mounts) if (mountInfo.mountType === "fuse") addMount(mountInfo);
+	if (options?.includeMount) addMount(options.includeMount);
+	return { mounts: params };
+}
+
 //#endregion
 //#region src/storage-mount/outbound/index.ts
 function isFetcher(value) {
 	return typeof value === "object" && value !== null && "fetch" in value && typeof value.fetch === "function";
 }
-async function configureR2EgressOutbound(host, params) {
+async function configureR2EgressOutbound(host, activeParams) {
+	const params = { buckets: {
+		...host.restoredMountRoutes.r2Buckets,
+		...activeParams.buckets
+	} };
 	const ctx = host.ctx;
 	if (!ctx.container?.interceptOutboundHttp) throw new InvalidMountConfigError("R2 binding mounts require container outbound interception support");
 	if (!ctx.exports?.ContainerProxy) throw new InvalidMountConfigError("R2 binding mounts require exporting ContainerProxy from the Worker entrypoint");
-	installSDKOutboundHandlers(host.constructorRef);
 	if (Object.keys(params.buckets).length > 0) await host.setOutboundByHost("r2.internal", "r2EgressMount", params);
 	else await host.removeOutboundByHost("r2.internal");
 	host.logger.debug("r2 egress: registering host interception", {
@@ -1563,7 +1601,6 @@ async function configureGitAuthInterceptor(host, params) {
 	const ctx = host.ctx;
 	if (!ctx.container?.interceptOutboundHttp) throw new InvalidMountConfigError("Git extension authentication requires container outbound interception support");
 	if (!ctx.exports?.ContainerProxy) throw new InvalidMountConfigError("Git extension authentication requires exporting ContainerProxy from the Worker entrypoint. Import ContainerProxy from @cloudflare/sandbox and export it from your Worker to use git auth interception.");
-	installSDKOutboundHandlers(host.constructorRef);
 	const hostOverrides = {};
 	for (const outboundHost of Object.keys(params.hosts)) {
 		hostOverrides[outboundHost] = {
@@ -1581,12 +1618,15 @@ async function configureGitAuthInterceptor(host, params) {
 	if (!isFetcher(fetcher)) throw new InvalidMountConfigError("Git extension authentication requires ContainerProxy to return a valid Fetcher");
 	for (const outboundHost of Object.keys(params.hosts)) await ctx.container.interceptOutboundHttp(outboundHost, fetcher);
 }
-async function configureS3CredentialProxyOutbound(host, params) {
+async function configureS3CredentialProxyOutbound(host, activeParams) {
+	const params = { mounts: {
+		...host.restoredMountRoutes.credentialProxyMounts,
+		...activeParams.mounts
+	} };
 	const ctx = host.ctx;
 	if (!ctx.container?.interceptOutboundHttp) throw new InvalidMountConfigError("Credential proxy bucket mounts require container outbound interception support");
 	if (!ctx.exports?.ContainerProxy) throw new InvalidMountConfigError("Credential proxy bucket mounts require exporting ContainerProxy from the Worker entrypoint");
 	const hosts = [S3_CREDENTIAL_PROXY_HOST, S3_CREDENTIAL_PROXY_DIAGNOSTIC_HOST];
-	installSDKOutboundHandlers(host.constructorRef);
 	if (Object.keys(params.mounts).length > 0) for (const outboundHost of hosts) await host.setOutboundByHost(outboundHost, "s3CredentialProxyMount", params);
 	else for (const outboundHost of hosts) await host.removeOutboundByHost(outboundHost);
 	const hostOverrides = {};
@@ -1615,6 +1655,70 @@ async function configureS3CredentialProxyOutbound(host, params) {
 	}
 	for (const outboundHost of hosts) await ctx.container.interceptOutboundHttp(outboundHost, fetcher);
 }
+/**
+* Drop the routes restored for the mounts of a container that has stopped.
+*/
+async function releaseRestoredMountRoutes(host, mounts) {
+	const routes = host.restoredMountRoutes;
+	for (const mountId of Object.keys(routes.credentialProxyMounts)) {
+		evictSigV4ClientCacheEntry(mountId);
+		evictDirectoryMarkerCacheForMount(mountId);
+	}
+	if (Object.keys(routes.r2Buckets).length > 0) routes.staleR2 = true;
+	if (Object.keys(routes.credentialProxyMounts).length > 0) routes.staleCredentialProxy = true;
+	routes.r2Buckets = {};
+	routes.credentialProxyMounts = {};
+	await removeStaleMountRoutes(host, mounts);
+}
+/**
+* Rewrite the routes that still carry a stopped container's restored mounts
+* so they cover only `mounts`. A failed update stays marked and is retried on
+* the next container start or stop.
+*/
+async function removeStaleMountRoutes(host, mounts) {
+	const routes = host.restoredMountRoutes;
+	if (routes.staleR2) try {
+		await configureR2EgressOutbound(host, buildR2EgressParams(mounts));
+		routes.staleR2 = false;
+	} catch (error) {
+		host.logger.warn("Failed to remove stale R2 mount routes", { error: error instanceof Error ? error.message : String(error) });
+	}
+	if (routes.staleCredentialProxy) try {
+		await configureS3CredentialProxyOutbound(host, buildS3CredentialProxyParams(mounts));
+		routes.staleCredentialProxy = false;
+	} catch (error) {
+		host.logger.warn("Failed to remove stale credential proxy mount routes", { error: error instanceof Error ? error.message : String(error) });
+	}
+}
+
+//#endregion
+//#region src/storage-mount/outbound/restored-routes.ts
+/**
+* Bucket mount routes restored from a previous instance of this Durable
+* Object. The mount registry starts empty after a restart, but s3fs mounts in
+* a container that kept running still send requests, so every route update
+* keeps these routes until onStop() reports that container stopped. The base
+* class reports a stop it missed before it starts a new container.
+*/
+var RestoredMountRoutes = class RestoredMountRoutes {
+	r2Buckets = {};
+	credentialProxyMounts = {};
+	staleR2 = false;
+	staleCredentialProxy = false;
+	/**
+	* Read the overrides the base Container restored from storage in its
+	* constructor. `outboundByHostOverrides` is private in its types.
+	*/
+	static fromContainer(container) {
+		const overrides = container.outboundByHostOverrides ?? {};
+		const routes = new RestoredMountRoutes();
+		const r2 = overrides["r2.internal"];
+		if (r2?.method === "r2EgressMount") routes.r2Buckets = { ...r2.params?.buckets };
+		const credentialProxy = overrides[S3_CREDENTIAL_PROXY_HOST];
+		if (credentialProxy?.method === "s3CredentialProxyMount") routes.credentialProxyMounts = { ...credentialProxy.params?.mounts };
+		return routes;
+	}
+};
 
 //#endregion
 //#region src/storage-mount/registry.ts
@@ -1695,6 +1799,10 @@ function resolveS3fsOptions(provider, userOptions) {
 //#endregion
 //#region src/storage-mount/s3fs/support-files.ts
 const S3FS_DISABLE_EXPECT_HEADER_CONFIG = " Expect:\n";
+async function writeOwnerOnlyFile(host, operation, path$1, content) {
+	await host.runRuntimeCall(`mount.s3fs.write${operation}`, (control) => control.files.writeFile(path$1, content, { ownerOnly: true }));
+	await host.runRuntimeCall(`mount.s3fs.chmod${operation}`, (control) => control.mounts.chmodOwnerOnly(path$1));
+}
 function generatePasswordFilePath() {
 	return `/tmp/.passwd-s3fs-${crypto.randomUUID()}`;
 }
@@ -1702,13 +1810,10 @@ function generateS3FSAdditionalHeaderFilePath() {
 	return `/tmp/.s3fs-ahbe-${crypto.randomUUID()}.conf`;
 }
 async function createDisableExpectHeaderFile(host, headerFilePath) {
-	await host.runRuntimeCall("mount.s3fs.writeHeaderFile", (control) => control.files.writeFile(headerFilePath, S3FS_DISABLE_EXPECT_HEADER_CONFIG));
-	await host.runRuntimeCall("mount.s3fs.chmodHeaderFile", (control) => control.mounts.chmodOwnerOnly(headerFilePath));
+	await writeOwnerOnlyFile(host, "HeaderFile", headerFilePath, S3FS_DISABLE_EXPECT_HEADER_CONFIG);
 }
 async function createPasswordFile(host, passwordFilePath, bucket, credentials) {
-	const content = `${bucket}:${credentials.accessKeyId}:${credentials.secretAccessKey}`;
-	await host.runRuntimeCall("mount.s3fs.writePasswordFile", (control) => control.files.writeFile(passwordFilePath, content));
-	await host.runRuntimeCall("mount.s3fs.chmodPasswordFile", (control) => control.mounts.chmodOwnerOnly(passwordFilePath));
+	await writeOwnerOnlyFile(host, "PasswordFile", passwordFilePath, `${bucket}:${credentials.accessKeyId}:${credentials.secretAccessKey}`);
 }
 async function deletePasswordFile(host, passwordFilePath) {
 	try {
@@ -1794,40 +1899,6 @@ async function unmountTrackedFuseMount(host, mountPath, mountInfo) {
 	return true;
 }
 
-//#endregion
-//#region src/storage-mount/outbound/params.ts
-function hasExcludedID(excludedIDs, mountId) {
-	if (!excludedIDs) return false;
-	for (const excludedID of excludedIDs) if (excludedID === mountId) return true;
-	return false;
-}
-function buildR2EgressParams(mounts, options) {
-	const buckets = {};
-	for (const [, mountInfo] of mounts) if (mountInfo.mountType === "r2-egress" && mountInfo.mountId !== options?.excludeMountId && !hasExcludedID(options?.excludeMountIds, mountInfo.mountId)) buckets[mountInfo.bucket] = {
-		prefix: mountInfo.prefix,
-		readOnly: mountInfo.readOnly
-	};
-	return { buckets };
-}
-function buildS3CredentialProxyParams(mounts, options) {
-	const params = {};
-	const addMount = (mountInfo) => {
-		if (!mountInfo.credentialProxy || mountInfo.mountId === options?.excludeMountId || hasExcludedID(options?.excludeMountIds, mountInfo.mountId)) return;
-		params[mountInfo.mountId] = {
-			endpoint: mountInfo.credentialProxy.endpoint,
-			bucket: mountInfo.credentialProxy.bucket,
-			...mountInfo.credentialProxy.prefix !== void 0 ? { prefix: mountInfo.credentialProxy.prefix } : {},
-			credentials: mountInfo.credentialProxy.credentials,
-			readOnly: mountInfo.credentialProxy.readOnly,
-			provider: mountInfo.credentialProxy.provider,
-			authStrategy: mountInfo.credentialProxy.authStrategy
-		};
-	};
-	for (const [, mountInfo] of mounts) if (mountInfo.mountType === "fuse") addMount(mountInfo);
-	if (options?.includeMount) addMount(options.includeMount);
-	return { mounts: params };
-}
-
 //#endregion
 //#region src/storage-mount/lifecycle-cleanup.ts
 async function cleanupBucketMountsForDestroy(host) {
@@ -1895,6 +1966,7 @@ async function cleanupBucketMountsForDestroy(host) {
 }
 async function cleanupBucketMountsForStop(host) {
 	return host.runMountOperation(async () => {
+		await releaseRestoredMountRoutes(host.getOutboundHost(), host.registry);
 		let hadR2EgressMount = false;
 		let hadCredentialProxyMount = false;
 		for (const [, mountInfo] of host.registry) if (mountInfo.mountType === "local-sync") mountInfo.syncManager.interrupt();
@@ -2510,6 +2582,8 @@ function validateR2EgressMount(context, bucket, mountPath, options) {
 	validateBucketBindingName(bucket, mountPath);
 	validateMountPath(context.registry.activeMounts, mountPath);
 	validateProtectedS3fsOptions(options.s3fsOptions, "R2 binding");
+	const restoredRoute = context.getOutboundHost().restoredMountRoutes.r2Buckets[bucket];
+	if (restoredRoute && (restoredRoute.prefix !== prefix || (restoredRoute.readOnly ?? false) !== (options.readOnly ?? false))) throw new InvalidMountConfigError(`R2 binding "${bucket}" is already mounted with a different prefix or readOnly setting. Mount the same binding only once, or use the same settings for additional mounts.`);
 	for (const [existingMountPath, existingMount] of context.registry) {
 		if (existingMount.mountType === "r2-egress" && existingMount.bucket === bucket && existingMount.prefix !== prefix) throw new InvalidMountConfigError(`R2 binding "${bucket}" is already mounted at ${existingMountPath} with a different prefix. Mount the same binding only once, or use the same prefix for additional mounts.`);
 		if (existingMount.mountType === "r2-egress" && existingMount.bucket === bucket && existingMount.readOnly !== (options.readOnly ?? false)) throw new InvalidMountConfigError(`R2 binding "${bucket}" is already mounted at ${existingMountPath} with a different readOnly setting. Mount the same binding only once, or use the same readOnly value for additional mounts.`);
@@ -2977,7 +3051,10 @@ var BucketMountService = class {
 		});
 	}
 	async mountBucketR2Egress(bucket, mountPath, options) {
-		validateR2EgressMount({ registry: this.registry }, bucket, mountPath, options);
+		validateR2EgressMount({
+			registry: this.registry,
+			getOutboundHost: () => this.deps.getOutboundHost()
+		}, bucket, mountPath, options);
 		await this.deps.runMountAttempt("mount.r2-egress", async (lease) => {
 			const runRuntimeCall = callWithMountControl(lease.control);
 			await mountR2EgressBucket({
@@ -3092,6 +3169,14 @@ var BucketMountService = class {
 			runMountOperation: (operation) => operation()
 		});
 	}
+	/**
+	* Retry removing a stopped container's restored mount routes. Runs outside
+	* the mount operation queue because a queued mount can be what started the
+	* container.
+	*/
+	async removeStaleRoutes() {
+		await removeStaleMountRoutes(this.deps.getOutboundHost(), this.registry);
+	}
 	async cleanupForStop() {
 		return cleanupBucketMountsForStop({
 			registry: this.registry,
@@ -8886,6 +8971,7 @@ var Sandbox = class extends Container {
 	logger;
 	keepAliveEnabled = false;
 	bucketMounts;
+	restoredMountRoutes;
 	currentLifetime;
 	backupService;
 	previewService;
@@ -8954,7 +9040,9 @@ var Sandbox = class extends Container {
 		return stub;
 	}
 	constructor(ctx, env$1) {
+		if (ctx.exports?.ContainerProxy) installSDKOutboundHandlers(new.target);
 		super(ctx, env$1);
+		this.restoredMountRoutes = RestoredMountRoutes.fromContainer(this);
 		const envObj = env$1;
 		["SANDBOX_LOG_LEVEL", "SANDBOX_LOG_FORMAT"].forEach((key) => {
 			if (envObj?.[key]) this.envVars[key] = String(envObj[key]);
@@ -9327,6 +9415,7 @@ var Sandbox = class extends Container {
 	async onStart() {
 		const replacementStartTransitionCompleted = this.runtimeLifecycle.markRuntimeStarted();
 		this.logger.debug("Sandbox started", { replacementStartTransitionCompleted });
+		await this.bucketMounts.removeStaleRoutes();
 	}
 	async start(options) {
 		await this.runtimeRunner.runWaking("runtime.start", async () => void 0, { startOptions: options });
@@ -10191,7 +10280,7 @@ var Sandbox = class extends Container {
 	getMountOutboundHost() {
 		return {
 			ctx: this.ctx,
-			constructorRef: this.constructor,
+			restoredMountRoutes: this.restoredMountRoutes,
 			enableInternet: this.enableInternet,
 			logger: this.logger,
 			setOutboundByHost: (host, method, params) => this.setOutboundByHost(host, method, params),
@@ -10202,4 +10291,4 @@ var Sandbox = class extends Container {
 
 //#endregion
 export { proxyTerminal as _, responseToAsyncIterable as a, collectFile as b, BucketUnmountError as c, S3FSMountError as d, parsePreviewRoute as f, validateTunnelName as g, validatePort as h, parseSSEStream as i, InvalidMountConfigError as l, SandboxSecurityError as m, getSandbox as n, ContainerProxy$1 as o, withPreviewProxyMetadata as p, asyncIterableToSSEStream as r, BucketMountError as s, Sandbox as t, MissingCredentialsError as u, isDurableObjectCodeUpdateReset as v, streamFile as x, isPlatformTransientError as y };
-//# sourceMappingURL=sandbox-CaesWCLh.js.map
+//# sourceMappingURL=sandbox-CpelK4pU.js.map