@mastra/e2b 0.11.0-alpha.1 → 0.11.0-alpha.3

package/dist/index.js

@@ -1562,7 +1562,7 @@ var E2BSandbox = class E2BSandbox extends MastraSandbox {
 * need `git fetch` + checkout of their actual ref plus setup drift, instead
 * of a cold clone + full install.
 *
-* There is exactly ONE template per (repo, setup command, workdir): the
+* There is exactly ONE template per (repo, setup command, repoDir): the
 * template name is a deterministic `mastra-repo-<hash>` over those inputs,
 * and the commit sha rides as a docker-style TAG on that name
 * (`mastra-repo-<hash>:sha-<sha>`). A moved default branch produces a new
@@ -1642,7 +1642,8 @@ function repoTemplateName(identity) {
 		identity.setupCommand ?? null,
 		identity.buildEnv ? Object.entries(identity.buildEnv).sort(([a], [b]) => a.localeCompare(b)) : null,
 		identity.cpuCount ?? 2,
-		identity.memoryMB ?? 1024
+		identity.memoryMB ?? 1024,
+		...identity.workingDirectory !== void 0 ? [identity.workingDirectory] : []
 	];
 	const hash = createHash("sha256").update(JSON.stringify(config)).digest("hex").slice(0, 8);
 	const { owner, repo } = parseCloneUrl(cloneUrl);
@@ -1698,10 +1699,11 @@ async function resolveSpecAtHead(options) {
 		spec: buildRepoTemplateSpec({
 			cloneUrl,
 			...sha ? { sha } : {},
-			...options.setupCommand ? { setupCommand: options.setupCommand } : {},
+			...normalizeSetupCommands(options.setupCommand).length > 0 ? { setupCommand: options.setupCommand } : {},
 			...buildEnv ? { buildEnv } : {},
 			...options.cpuCount !== void 0 ? { cpuCount: options.cpuCount } : {},
-			...options.memoryMB !== void 0 ? { memoryMB: options.memoryMB } : {}
+			...options.memoryMB !== void 0 ? { memoryMB: options.memoryMB } : {},
+			...options.workingDirectory !== void 0 ? { workingDirectory: trimTrailingSlashes(assertWorkingDirectory(options.workingDirectory)) } : {}
 		}, token),
 		...sha ? { sha } : {}
 	};
@@ -1739,7 +1741,7 @@ async function refreshRepoTemplate(options, connection) {
 }
 /**
 * The clone URL is the only untrusted input that reaches a build command,
-* so it is checked before it can be interpolated into one. The workdir is
+* so it is checked before it can be interpolated into one. The repoDir is
 * derived from it rather than supplied, so it needs no separate guard.
 */
 function assertCloneUrl(cloneUrl) {
@@ -1756,18 +1758,21 @@ function gitAuthFlag() {
 	return `-c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$${BUILD_TOKEN_ENV}" | base64 -w0)"`;
 }
 function buildRepoTemplateSpec(identity, token) {
-	const { sha, setupCommand, buildEnv } = identity;
+	const { sha, setupCommand, buildEnv, workingDirectory } = identity;
 	const cloneUrl = normalizeCloneUrl(identity.cloneUrl);
-	const workdir = defaultWorkdir(cloneUrl);
+	const repoDir = repoDirName(cloneUrl);
 	const auth = token ? `${gitAuthFlag()} ` : "";
-	const steps = [`git ${auth}clone ${cloneUrl} "${workdir}"`];
-	if (sha) steps.push(`git -C "${workdir}" ${auth}fetch origin ${sha}`, `git -C "${workdir}" checkout ${sha}`);
-	if (setupCommand) steps.push(`cd "${workdir}" && ${setupCommand}`);
 	let template = createDefaultMountableTemplate().template;
 	const env = { ...buildEnv };
 	if (token) env[BUILD_TOKEN_ENV] = token;
 	if (Object.keys(env).length > 0) template = template.setEnvs(env);
-	template = template.runCmd(steps);
+	if (workingDirectory) {
+		const dir = trimTrailingSlashes(workingDirectory);
+		template = template.runCmd(`mkdir -p "${dir}"`).setWorkdir(dir);
+	}
+	template = template.runCmd(`git ${auth}clone ${cloneUrl} "${repoDir}"`);
+	if (sha) template = template.runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
+	for (const command of normalizeSetupCommands(setupCommand)) template = template.runCmd(`cd "${repoDir}" && ${command}`);
 	return {
 		ref: repoTemplateRef(identity),
 		template,
@@ -1780,13 +1785,52 @@ function buildRepoTemplateSpec(identity, token) {
 	};
 }
 /**
-* Resolve the repository's current default-branch head over HTTPS
-* (`git ls-remote <url> HEAD` — no clone; authenticated via an in-process
-* `http.extraheader` when a token is provided). Returns undefined when the
+* `owner/repo` for a github.com clone URL, else undefined. Only the public
+* host is API-resolvable: GitHub Enterprise and other forges keep the git
+* path.
+*/
+function parseGithubRepo(cloneUrl) {
+	let url;
+	try {
+		url = new URL(cloneUrl);
+	} catch {
+		return;
+	}
+	if (url.hostname.toLowerCase() !== "github.com") return void 0;
+	const [owner, repo, ...rest] = url.pathname.split("/").filter(Boolean);
+	if (!owner || !repo || rest.length > 0) return void 0;
+	return {
+		owner,
+		repo: repo.replace(/\.git$/i, "")
+	};
+}
+/**
+* Resolve the repository's current default-branch head without cloning.
+* github.com repositories go through the REST API so resolution works
+* wherever the host runs, including images without a git binary; other
+* hosts use `git ls-remote <url> HEAD`, authenticated via an in-process
+* `http.extraheader` when a token is provided. Returns undefined when the
 * head cannot be resolved (inaccessible repo, offline, no git binary);
 * callers degrade to the untagged template ref.
 */
 async function resolveDefaultBranchHead(cloneUrl, token) {
+	const github = parseGithubRepo(cloneUrl);
+	if (github) try {
+		const response = await fetch(`https://api.github.com/repos/${github.owner}/${github.repo}/commits/HEAD`, {
+			headers: {
+				Accept: "application/vnd.github.sha",
+				"X-GitHub-Api-Version": "2022-11-28",
+				"User-Agent": "mastra-e2b",
+				...token ? { Authorization: `Bearer ${token}` } : {}
+			},
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!response.ok) return void 0;
+		const sha = (await response.text()).trim();
+		return SHA_PATTERN.test(sha) ? sha : void 0;
+	} catch {
+		return;
+	}
 	try {
 		const authArgs = token ? ["-c", `http.extraheader=AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`] : [];
 		const { stdout } = await execFileAsync("git", [
@@ -1834,9 +1878,23 @@ function parseCloneUrl(cloneUrl) {
 		repo
 	};
 }
-function defaultWorkdir(cloneUrl) {
+/** Normalize setup commands and drop blank entries that would produce invalid shell steps. */
+function normalizeSetupCommands(setupCommand) {
+	return (setupCommand === void 0 ? [] : Array.isArray(setupCommand) ? setupCommand : [setupCommand]).filter((command) => command.trim() !== "");
+}
+function repoDirName(cloneUrl) {
 	const { repo } = parseCloneUrl(cloneUrl);
-	return `$HOME/${repo.replace(/[^\w.-]/g, "-").replace(/^\.+/, "") || "repo"}`;
+	return repo.replace(/[^\w.-]/g, "-").replace(/^\.+/, "") || "repo";
+}
+function trimTrailingSlashes(path) {
+	let end = path.length;
+	while (end > 1 && path[end - 1] === "/") end--;
+	return path.slice(0, end);
+}
+/** Validate a literal absolute path before embedding it in shell build steps. */
+function assertWorkingDirectory(dir) {
+	if (!(/^\/[A-Za-z0-9._/-]*$/.test(dir) && !dir.split("/").includes(".."))) throw new Error(`Repo template workingDirectory must be an absolute path of plain path characters (got ${JSON.stringify(dir)}); ~ and $HOME are not expanded.`);
+	return dir;
 }
 //#endregion
 //#region src/provider.ts