@cloudflare/sandbox 0.9.3 → 0.10.0

package/Dockerfile

@@ -1,6 +1,9 @@
 # Bun version — override via --build-arg BUN_VERSION=$(cat .bun-version)
 ARG BUN_VERSION=1
+# Node version — override via --build-arg NODE_VERSION=24
+ARG NODE_VERSION=24
 FROM oven/bun:${BUN_VERSION} AS bun-binary
+FROM node:${NODE_VERSION}-slim AS node-runtime
 
 # Sandbox container images (default and python variants)
 # Multi-stage build optimized for Turborepo monorepo
@@ -8,7 +11,7 @@ FROM oven/bun:${BUN_VERSION} AS bun-binary
 # ============================================================================
 # Stage 1: Prune monorepo to only include necessary packages
 # ============================================================================
-FROM node:20-slim AS pruner
+FROM node-runtime AS pruner
 
 WORKDIR /app
 
@@ -25,7 +28,7 @@ RUN turbo prune @repo/sandbox-container --docker
 # Using glibc-based images (not Alpine) so the standalone binary works on
 # standard Linux distributions (Debian, Ubuntu, RHEL, etc.)
 # ============================================================================
-FROM node:20-slim AS builder
+FROM node-runtime AS builder
 
 WORKDIR /app
 
@@ -126,9 +129,10 @@ RUN sed -i 's/#user_allow_other/user_allow_other/' /etc/fuse.conf
 # fusermount requires /etc/mtab to locate active mounts
 RUN ln -sf /proc/mounts /etc/mtab
 
-# Install Node.js 20 LTS from official Node image
-COPY --from=node:20-slim /usr/local/bin/node /usr/local/bin/node
-COPY --from=node:20-slim /usr/local/lib/node_modules /usr/local/lib/node_modules
+# Install Node.js from official Node image (defaults to 24 LTS,
+# override via --build-arg NODE_VERSION=<version>)
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
     ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
 

package/dist/bridge/index.js

@@ -1,6 +1,6 @@
 import "../dist-B_eXrP83.js";
 import "../errors-CBi-O-pF.js";
-import { h as streamFile, n as getSandbox } from "../sandbox-BAuU-2a0.js";
+import { h as streamFile, n as getSandbox } from "../sandbox-2bHZZmy5.js";
 import { DurableObject, env } from "cloudflare:workers";
 import { Hono } from "hono";
 

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as BackupOptions, A as DesktopStopResponse, At as ProcessStartResult, B as ExecuteResponse, Bt as WatchOptions, C as ClickOptions, Ct as Process, D as DesktopStartOptions, Dt as ProcessListResult, E as DesktopClient, Et as ProcessKillResult, F as ScreenshotRegion, Ft as SandboxTransport, G as HttpClientOptions, Gt as CodeContext, H as BaseApiResponse, Ht as isProcess, I as ScreenshotResponse, It as SessionOptions, J as SessionRequest, Jt as ExecutionResult, K as RequestConfig, Kt as CreateContextOptions, L as ScrollDirection, Lt as StreamOptions, M as ScreenSizeResponse, Mt as RemoteMountBucketOptions, N as ScreenshotBytesResponse, Nt as RestoreBackupResult, O as DesktopStartResponse, Ot as ProcessLogsResult, P as ScreenshotOptions, Pt as SandboxOptions, Q as StartProcessRequest, R as TypeOptions, Rt as WaitForLogResult, S as WriteFileRequest, St as PortListResult, T as Desktop, Tt as ProcessInfoResult, U as ContainerStub, Ut as isProcessStatus, V as BackupClient, Vt as isExecResult, W as ErrorResponse, Wt as PtyOptions, X as ExecuteRequest, Y as SandboxInterpreterAPI, Yt as RunCodeOptions, Z as ExposePortRequest, _ as GitClient, _t as LocalMountBucketOptions, a as CreateSessionRequest, at as DirectoryBackup, b as MkdirRequest, bt as PortCloseResult, c as DeleteSessionResponse, ct as ExecResult, d as ProcessClient, dt as FileMetadata, et as BaseExecOptions, f as PortClient, ft as FileStreamEvent, g as GitCheckoutRequest, gt as ListFilesOptions, h as InterpreterClient, ht as ISandbox, i as CommandsResponse, it as CheckChangesResult, j as KeyInput, jt as ProcessStatus, k as DesktopStatusResponse, kt as ProcessOptions, l as PingResponse, lt as ExecutionSession, m as ExecutionCallbacks, mt as GitCheckoutResult, n as getSandbox, nt as BucketProvider, o as CreateSessionResponse, ot as ExecEvent, p as UnexposePortRequest, pt as FileWatchSSEEvent, q as ResponseHandler, qt as Execution, r as SandboxClient, rt as CheckChangesOptions, s as DeleteSessionRequest, st as ExecOptions, t as Sandbox, tt as BucketCredentials, u as UtilityClient, ut as FileChunk, v as FileClient, vt as LogEvent, w as CursorPositionResponse, wt as ProcessCleanupResult, x as ReadFileRequest, xt as PortExposeResult, y as FileOperationRequest, yt as MountBucketOptions, z as CommandClient, zt as WaitForPortOptions } from "./sandbox-CW4QeITP.js";
+import { $ as BackupOptions, A as DesktopStopResponse, At as ProcessStartResult, B as ExecuteResponse, Bt as WatchOptions, C as ClickOptions, Ct as Process, D as DesktopStartOptions, Dt as ProcessListResult, E as DesktopClient, Et as ProcessKillResult, F as ScreenshotRegion, Ft as SandboxTransport, G as HttpClientOptions, Gt as CodeContext, H as BaseApiResponse, Ht as isProcess, I as ScreenshotResponse, It as SessionOptions, J as SessionRequest, Jt as ExecutionResult, K as RequestConfig, Kt as CreateContextOptions, L as ScrollDirection, Lt as StreamOptions, M as ScreenSizeResponse, Mt as RemoteMountBucketOptions, N as ScreenshotBytesResponse, Nt as RestoreBackupResult, O as DesktopStartResponse, Ot as ProcessLogsResult, P as ScreenshotOptions, Pt as SandboxOptions, Q as StartProcessRequest, R as TypeOptions, Rt as WaitForLogResult, S as WriteFileRequest, St as PortListResult, T as Desktop, Tt as ProcessInfoResult, U as ContainerStub, Ut as isProcessStatus, V as BackupClient, Vt as isExecResult, W as ErrorResponse, Wt as PtyOptions, X as ExecuteRequest, Y as SandboxInterpreterAPI, Yt as RunCodeOptions, Z as ExposePortRequest, _ as GitClient, _t as LocalMountBucketOptions, a as CreateSessionRequest, at as DirectoryBackup, b as MkdirRequest, bt as PortCloseResult, c as DeleteSessionResponse, ct as ExecResult, d as ProcessClient, dt as FileMetadata, et as BaseExecOptions, f as PortClient, ft as FileStreamEvent, g as GitCheckoutRequest, gt as ListFilesOptions, h as InterpreterClient, ht as ISandbox, i as CommandsResponse, it as CheckChangesResult, j as KeyInput, jt as ProcessStatus, k as DesktopStatusResponse, kt as ProcessOptions, l as PingResponse, lt as ExecutionSession, m as ExecutionCallbacks, mt as GitCheckoutResult, n as getSandbox, nt as BucketProvider, o as CreateSessionResponse, ot as ExecEvent, p as UnexposePortRequest, pt as FileWatchSSEEvent, q as ResponseHandler, qt as Execution, r as SandboxClient, rt as CheckChangesOptions, s as DeleteSessionRequest, st as ExecOptions, t as Sandbox, tt as BucketCredentials, u as UtilityClient, ut as FileChunk, v as FileClient, vt as LogEvent, w as CursorPositionResponse, wt as ProcessCleanupResult, x as ReadFileRequest, xt as PortExposeResult, y as FileOperationRequest, yt as MountBucketOptions, z as CommandClient, zt as WaitForPortOptions } from "./sandbox-C-AzrX_L.js";
 import { a as DesktopCoordinateErrorContext, d as RPCTransportContext, f as RPCTransportErrorKind, g as ErrorCode, h as OperationType, i as BackupRestoreContext, l as ProcessExitedBeforeReadyContext, m as ErrorResponse$1, n as BackupExpiredContext, o as DesktopErrorContext, p as SessionTerminatedContext, r as BackupNotFoundContext, s as InvalidBackupConfigContext, t as BackupCreateContext, u as ProcessReadyTimeoutContext } from "./contexts-D_shbnJs.js";
 import { ContainerProxy } from "@cloudflare/containers";
 

package/dist/index.js

@@ -1,6 +1,6 @@
 import { a as isExecResult, o as isProcess, s as isProcessStatus } from "./dist-B_eXrP83.js";
 import "./errors-CBi-O-pF.js";
-import { A as DesktopInvalidOptionsError, C as CommandClient, D as BackupNotFoundError, E as BackupExpiredError, F as InvalidBackupConfigError, I as ProcessExitedBeforeReadyError, L as ProcessReadyTimeoutError, M as DesktopProcessCrashedError, N as DesktopStartFailedError, O as BackupRestoreError, P as DesktopUnavailableError, R as RPCTransportError, S as DesktopClient, T as BackupCreateError, _ as UtilityClient, a as BucketMountError, b as GitClient, c as MissingCredentialsError, d as parseSSEStream, f as responseToAsyncIterable, g as SandboxClient, h as streamFile, i as proxyTerminal, j as DesktopNotStartedError, k as DesktopInvalidCoordinatesError, l as S3FSMountError, m as collectFile, n as getSandbox, o as BucketUnmountError, p as CodeInterpreter, r as proxyToSandbox, s as InvalidMountConfigError, t as Sandbox, u as asyncIterableToSSEStream, v as ProcessClient, w as BackupClient, x as FileClient, y as PortClient, z as SessionTerminatedError } from "./sandbox-BAuU-2a0.js";
+import { A as DesktopInvalidOptionsError, C as CommandClient, D as BackupNotFoundError, E as BackupExpiredError, F as InvalidBackupConfigError, I as ProcessExitedBeforeReadyError, L as ProcessReadyTimeoutError, M as DesktopProcessCrashedError, N as DesktopStartFailedError, O as BackupRestoreError, P as DesktopUnavailableError, R as RPCTransportError, S as DesktopClient, T as BackupCreateError, _ as UtilityClient, a as BucketMountError, b as GitClient, c as MissingCredentialsError, d as parseSSEStream, f as responseToAsyncIterable, g as SandboxClient, h as streamFile, i as proxyTerminal, j as DesktopNotStartedError, k as DesktopInvalidCoordinatesError, l as S3FSMountError, m as collectFile, n as getSandbox, o as BucketUnmountError, p as CodeInterpreter, r as proxyToSandbox, s as InvalidMountConfigError, t as Sandbox, u as asyncIterableToSSEStream, v as ProcessClient, w as BackupClient, x as FileClient, y as PortClient, z as SessionTerminatedError } from "./sandbox-2bHZZmy5.js";
 import { ContainerProxy } from "@cloudflare/containers";
 
 export { BackupClient, BackupCreateError, BackupExpiredError, BackupNotFoundError, BackupRestoreError, BucketMountError, BucketUnmountError, CodeInterpreter, CommandClient, ContainerProxy, DesktopClient, DesktopInvalidCoordinatesError, DesktopInvalidOptionsError, DesktopNotStartedError, DesktopProcessCrashedError, DesktopStartFailedError, DesktopUnavailableError, FileClient, GitClient, InvalidBackupConfigError, InvalidMountConfigError, MissingCredentialsError, PortClient, ProcessClient, ProcessExitedBeforeReadyError, ProcessReadyTimeoutError, RPCTransportError, S3FSMountError, Sandbox, SandboxClient, SessionTerminatedError, UtilityClient, asyncIterableToSSEStream, collectFile, getSandbox, isExecResult, isProcess, isProcessStatus, parseSSEStream, proxyTerminal, proxyToSandbox, responseToAsyncIterable, streamFile };

package/dist/openai/index.d.ts

@@ -1,4 +1,4 @@
-import { t as Sandbox } from "../sandbox-CW4QeITP.js";
+import { t as Sandbox } from "../sandbox-C-AzrX_L.js";
 import { ApplyPatchOperation, ApplyPatchResult, Editor as Editor$1, Shell as Shell$1, ShellAction, ShellResult } from "@openai/agents";
 
 //#region src/openai/index.d.ts

package/dist/opencode/index.d.ts

@@ -1,4 +1,4 @@
-import { t as Sandbox } from "../sandbox-CW4QeITP.js";
+import { t as Sandbox } from "../sandbox-C-AzrX_L.js";
 import { c as OpencodeStartupContext } from "../contexts-D_shbnJs.js";
 import { OpencodeClient } from "@opencode-ai/sdk/v2/client";
 import { Config } from "@opencode-ai/sdk/v2";

package/dist/{sandbox-BAuU-2a0.js → sandbox-2bHZZmy5.js}

@@ -765,8 +765,8 @@ function createErrorFromResponse(errorResponse, options) {
 /**
 * Container startup retry configuration
 */
-const DEFAULT_RETRY_TIMEOUT_MS = 12e4;
-const MIN_TIME_FOR_RETRY_MS = 15e3;
+const DEFAULT_RETRY_TIMEOUT_MS$1 = 12e4;
+const MIN_TIME_FOR_RETRY_MS$1 = 15e3;
 /**
 * Abstract base transport with shared retry logic
 *
@@ -780,7 +780,7 @@ var BaseTransport = class {
 	constructor(config) {
 		this.config = config;
 		this.logger = config.logger ?? createNoOpLogger();
-		this.retryTimeoutMs = config.retryTimeoutMs ?? DEFAULT_RETRY_TIMEOUT_MS;
+		this.retryTimeoutMs = config.retryTimeoutMs ?? DEFAULT_RETRY_TIMEOUT_MS$1;
 	}
 	setRetryTimeoutMs(ms) {
 		this.retryTimeoutMs = ms;
@@ -802,7 +802,7 @@ var BaseTransport = class {
 			if (response.status === 503) {
 				const elapsed = Date.now() - startTime;
 				const remaining = this.retryTimeoutMs - elapsed;
-				if (remaining > MIN_TIME_FOR_RETRY_MS) {
+				if (remaining > MIN_TIME_FOR_RETRY_MS$1) {
 					const delay = Math.min(3e3 * 2 ** attempt, 3e4);
 					this.logger.info("Container not ready, retrying", {
 						status: response.status,
@@ -2756,6 +2756,9 @@ function normalizeBackupExcludePattern(pattern) {
 //#endregion
 //#region src/container-control/connection.ts
 const DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
+const DEFAULT_RETRY_TIMEOUT_MS = 12e4;
+const MIN_TIME_FOR_RETRY_MS = 15e3;
+const MAX_RETRY_BACKOFF_MS = 3e4;
 /**
 * Manages a capnweb WebSocket RPC session to the container.
 *
@@ -2773,10 +2776,12 @@ var ContainerControlConnection = class {
 	containerStub;
 	port;
 	logger;
+	retryTimeoutMs;
 	constructor(options) {
 		this.containerStub = options.stub;
 		this.port = options.port ?? 3e3;
 		this.logger = options.logger ?? createNoOpLogger();
+		this.retryTimeoutMs = options.retryTimeoutMs ?? DEFAULT_RETRY_TIMEOUT_MS;
 		this.transport = new DeferredTransport();
 		this.session = new RpcSession(this.transport);
 		this.stub = this.session.getRemoteMain();
@@ -2826,20 +2831,17 @@ var ContainerControlConnection = class {
 		this.connected = false;
 		this.connectPromise = null;
 	}
+	/**
+	* Update the 503 retry budget without recreating the connection. Takes
+	* effect on the next `connect()`; an in-flight connect uses the value
+	* captured at start. Mirrors `WebSocketTransport.setRetryTimeoutMs`.
+	*/
+	setRetryTimeoutMs(ms) {
+		this.retryTimeoutMs = ms;
+	}
 	async doConnect() {
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), DEFAULT_CONNECT_TIMEOUT_MS);
 		try {
-			const url = `http://localhost:${this.port}/rpc`;
-			const request = new Request(url, {
-				headers: {
-					Upgrade: "websocket",
-					Connection: "Upgrade"
-				},
-				signal: controller.signal
-			});
-			const response = await this.containerStub.fetch(request);
-			clearTimeout(timeout);
+			const response = await this.fetchUpgradeWithRetry();
 			if (response.status !== 101) throw new Error(`WebSocket upgrade failed: ${response.status} ${response.statusText}`);
 			const ws = response.webSocket;
 			if (!ws) throw new Error("No WebSocket in upgrade response");
@@ -2858,13 +2860,63 @@ var ContainerControlConnection = class {
 			this.connected = true;
 			this.logger.debug("ContainerControlConnection established", { port: this.port });
 		} catch (error) {
-			clearTimeout(timeout);
 			this.connected = false;
 			this.transport.abort(error);
 			this.logger.error("ContainerControlConnection failed", error instanceof Error ? error : new Error(String(error)));
 			throw error;
 		}
 	}
+	/**
+	* Issue WebSocket upgrade fetches, retrying transient 503 responses with
+	* exponential backoff (3s → 6s → 12s → … capped at 30s) until either
+	* the upgrade succeeds, a non-503 status is returned, or the retry budget
+	* runs out. Mirrors `WebSocketTransport.fetchUpgradeWithRetry` so both
+	* transports behave the same way during container startup.
+	*/
+	async fetchUpgradeWithRetry() {
+		const retryTimeoutMs = this.retryTimeoutMs;
+		const startTime = Date.now();
+		let attempt = 0;
+		while (true) {
+			const response = await this.fetchUpgradeAttempt();
+			if (response.status !== 503) return response;
+			const remaining = retryTimeoutMs - (Date.now() - startTime);
+			if (remaining <= MIN_TIME_FOR_RETRY_MS) return response;
+			const delay = Math.min(3e3 * 2 ** attempt, MAX_RETRY_BACKOFF_MS);
+			this.logger.info("ContainerControlConnection upgrade returned 503, retrying", {
+				attempt: attempt + 1,
+				delayMs: delay,
+				remainingSec: Math.floor(remaining / 1e3)
+			});
+			await this.sleep(delay);
+			attempt++;
+		}
+	}
+	/**
+	* Single WebSocket-upgrade fetch attempt. Owns its own AbortController so
+	* each retry gets a fresh per-attempt connect timeout independent of the
+	* total retry budget.
+	*/
+	async fetchUpgradeAttempt() {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), DEFAULT_CONNECT_TIMEOUT_MS);
+		try {
+			const url = `http://localhost:${this.port}/rpc`;
+			const request = new Request(url, {
+				headers: {
+					Upgrade: "websocket",
+					Connection: "Upgrade"
+				},
+				signal: controller.signal
+			});
+			return await this.containerStub.fetch(request);
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
 };
 /**
 * RPC transport that queues sends and blocks receives until a WebSocket
@@ -3093,7 +3145,8 @@ var ContainerControlClient = class {
 		this.connOptions = {
 			stub: options.stub,
 			port: options.port,
-			logger: options.logger
+			logger: options.logger,
+			retryTimeoutMs: options.retryTimeoutMs
 		};
 		this.idleDisconnectMs = options.idleDisconnectMs ?? DEFAULT_IDLE_DISCONNECT_MS;
 		this.busyPollIntervalMs = options.busyPollIntervalMs ?? BUSY_POLL_INTERVAL_MS;
@@ -3226,7 +3279,15 @@ var ContainerControlClient = class {
 	get interpreter() {
 		return wrapStub(this.getConnection().rpc().interpreter, this.renewActivity);
 	}
-	setRetryTimeoutMs(_ms) {}
+	/**
+	* Update the 503 upgrade-retry budget. Applies to the current connection
+	* (if any) and is remembered for any future connections created after the
+	* client is torn down and reconnected.
+	*/
+	setRetryTimeoutMs(ms) {
+		this.connOptions.retryTimeoutMs = ms;
+		this.conn?.setRetryTimeoutMs(ms);
+	}
 	getTransportMode() {
 		return "rpc";
 	}
@@ -4196,7 +4257,7 @@ function isLocalhostPattern(hostname) {
 * This file is auto-updated by .github/changeset-version.ts during releases
 * DO NOT EDIT MANUALLY - Changes will be overwritten on the next version bump
 */
-const SDK_VERSION = "0.9.3";
+const SDK_VERSION = "0.10.0";
 
 //#endregion
 //#region src/sandbox.ts
@@ -4528,6 +4589,7 @@ var Sandbox = class Sandbox extends Container {
 				stub: this,
 				port: 3e3,
 				logger: this.logger,
+				retryTimeoutMs: this.computeRetryTimeoutMs(),
 				onActivity: () => {
 					this.renewActivityTimeout();
 				},
@@ -7170,9 +7232,18 @@ var Sandbox = class Sandbox extends Container {
 			sizeBytes = createResult.sizeBytes;
 			const r2Key = `${BACKUP_STORAGE_PREFIX}/${backupId}/${BACKUP_ARCHIVE_OBJECT_NAME}`;
 			const metaKey = `${BACKUP_STORAGE_PREFIX}/${backupId}/${BACKUP_METADATA_OBJECT_NAME}`;
-			const { content } = await collectFile(await this.client.files.readFileStream(archivePath, backupSession));
-			const archiveData = content instanceof Uint8Array ? content : new TextEncoder().encode(content);
-			await bucket.put(r2Key, archiveData);
+			const archiveStream = await this.client.files.readFileStream(archivePath, backupSession);
+			const sseDecoded = new ReadableStream({ async start(controller) {
+				try {
+					for await (const chunk of streamFile(archiveStream)) if (chunk instanceof Uint8Array) controller.enqueue(chunk);
+					controller.close();
+				} catch (err) {
+					controller.error(err);
+				}
+			} });
+			const fixedStream = new FixedLengthStream(createResult.sizeBytes);
+			sseDecoded.pipeTo(fixedStream.writable).catch(() => {});
+			await bucket.put(r2Key, fixedStream.readable);
 			const head = await bucket.head(r2Key);
 			if (!head || head.size !== createResult.sizeBytes) throw new BackupCreateError({
 				message: `Upload verification failed: expected ${createResult.sizeBytes} bytes, got ${head?.size ?? 0}`,
@@ -7450,20 +7521,35 @@ var Sandbox = class Sandbox extends Container {
 			});
 			backupSession = await this.ensureBackupSession();
 			const archivePath = `${BACKUP_CONTAINER_DIR}/${id}.sqsh`;
-			const archiveBuffer = await archiveObject.arrayBuffer();
-			const base64Content = Buffer.from(archiveBuffer).toString("base64");
 			await this.execWithSession(`mkdir -p ${BACKUP_CONTAINER_DIR}`, backupSession, { origin: "internal" });
-			const writeResult = await this.client.files.writeFile(archivePath, base64Content, backupSession, { encoding: "base64" });
-			if (!writeResult.success) throw new BackupRestoreError({
-				message: `Failed to write backup archive to ${archivePath}: ${"error" in writeResult && typeof writeResult.error === "object" && writeResult.error !== null && "message" in writeResult.error && typeof writeResult.error.message === "string" ? writeResult.error.message : `File write returned success: false for '${archivePath}'`}`,
-				code: ErrorCode.BACKUP_RESTORE_FAILED,
-				httpStatus: 500,
-				context: {
-					dir,
-					backupId: id
-				},
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
+			if (this.transport === "rpc") {
+				const body = archiveObject.body;
+				if (!body) throw new BackupRestoreError({
+					message: `R2 archive object has no body stream for backup ${id}`,
+					code: ErrorCode.BACKUP_RESTORE_FAILED,
+					httpStatus: 500,
+					context: {
+						dir,
+						backupId: id
+					},
+					timestamp: (/* @__PURE__ */ new Date()).toISOString()
+				});
+				await this.client.writeFileStream(archivePath, body, backupSession);
+			} else {
+				const archiveBuffer = await archiveObject.arrayBuffer();
+				const base64Content = Buffer.from(archiveBuffer).toString("base64");
+				const writeResult = await this.client.files.writeFile(archivePath, base64Content, backupSession, { encoding: "base64" });
+				if (!writeResult.success) throw new BackupRestoreError({
+					message: `Failed to write backup archive to ${archivePath}: ${"error" in writeResult && typeof writeResult.error === "object" && writeResult.error !== null && "message" in writeResult.error && typeof writeResult.error.message === "string" ? writeResult.error.message : `File write returned success: false for '${archivePath}'`}`,
+					code: ErrorCode.BACKUP_RESTORE_FAILED,
+					httpStatus: 500,
+					context: {
+						dir,
+						backupId: id
+					},
+					timestamp: (/* @__PURE__ */ new Date()).toISOString()
+				});
+			}
 			const extractResult = await this.execWithSession(`/usr/bin/unsquashfs -f -d ${shellEscape(dir)} ${shellEscape(archivePath)}`, backupSession, { origin: "internal" });
 			if (extractResult.exitCode !== 0) throw new BackupRestoreError({
 				message: `unsquashfs extraction failed (exit code ${extractResult.exitCode}): ${extractResult.stderr}`,
@@ -7506,4 +7592,4 @@ var Sandbox = class Sandbox extends Container {
 
 //#endregion
 export { DesktopInvalidOptionsError as A, CommandClient as C, BackupNotFoundError as D, BackupExpiredError as E, InvalidBackupConfigError as F, ProcessExitedBeforeReadyError as I, ProcessReadyTimeoutError as L, DesktopProcessCrashedError as M, DesktopStartFailedError as N, BackupRestoreError as O, DesktopUnavailableError as P, RPCTransportError as R, DesktopClient as S, BackupCreateError as T, UtilityClient as _, BucketMountError as a, GitClient as b, MissingCredentialsError as c, parseSSEStream as d, responseToAsyncIterable as f, SandboxClient as g, streamFile as h, proxyTerminal as i, DesktopNotStartedError as j, DesktopInvalidCoordinatesError as k, S3FSMountError as l, collectFile as m, getSandbox as n, BucketUnmountError as o, CodeInterpreter as p, proxyToSandbox as r, InvalidMountConfigError as s, Sandbox as t, asyncIterableToSSEStream as u, ProcessClient as v, BackupClient as w, FileClient as x, PortClient as y, SessionTerminatedError as z };
-//# sourceMappingURL=sandbox-BAuU-2a0.js.map
+//# sourceMappingURL=sandbox-2bHZZmy5.js.map