@mastra/e2b 0.11.0-alpha.5 → 0.11.0-alpha.6

package/dist/index.cjs

@@ -127,7 +127,7 @@ function validatePrefix(prefix) {
 * Arguments containing only safe characters are returned as-is.
 * All others are wrapped in single quotes with embedded single quotes escaped.
 */
-function shellQuote(arg) {
+function shellQuote$1(arg) {
 	if (/^[a-zA-Z0-9._\-/@:=]+$/.test(arg)) return arg;
 	return "'" + arg.replace(/'/g, "'\\''") + "'";
 }
@@ -192,7 +192,7 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 		const normalizedPrefix = validatePrefix(config.prefix);
 		bucketArg = `${config.bucket}:/${normalizedPrefix}`;
 	}
-	const mountCmd = `sudo s3fs ${shellQuote(bucketArg)} ${shellQuote(mountPath)} -o ${mountOptions.join(" -o ")}`;
+	const mountCmd = `sudo s3fs ${shellQuote$1(bucketArg)} ${shellQuote$1(mountPath)} -o ${mountOptions.join(" -o ")}`;
 	logger.debug(`${LOG_PREFIX} Mounting S3:`, hasCredentials ? mountCmd.replace(credentialsPath, "***") : mountCmd);
 	try {
 		const result = await sandbox.commands.run(mountCmd, { timeoutMs: 6e4 });
@@ -213,7 +213,7 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 		});
 		throw new Error(`Failed to mount S3 bucket: ${stderr || stdout || error}`);
 	}
-	if ((await sandbox.commands.run(`mountpoint -q ${shellQuote(mountPath)}`)).exitCode !== 0) throw new Error(`s3fs returned exit 0 but ${mountPath} is not a mountpoint. The s3fs daemon likely failed during FUSE init (common causes: region mismatch, invalid credentials, or an S3-compatible endpoint that rejects the signature). Re-run inside the sandbox with '-f -o dbglevel=info' to see the underlying error.`);
+	if ((await sandbox.commands.run(`mountpoint -q ${shellQuote$1(mountPath)}`)).exitCode !== 0) throw new Error(`s3fs returned exit 0 but ${mountPath} is not a mountpoint. The s3fs daemon likely failed during FUSE init (common causes: region mismatch, invalid credentials, or an S3-compatible endpoint that rejects the signature). Re-run inside the sandbox with '-f -o dbglevel=info' to see the underlying error.`);
 }
 //#endregion
 //#region src/sandbox/mounts/gcs.ts
@@ -233,7 +233,7 @@ async function mountGCS(mountPath, config, ctx) {
 	}
 	const [uid, gid] = (await sandbox.commands.run("id -u && id -g")).stdout.trim().split("\n");
 	const uidGidFlags = uid && gid ? `--uid=${uid} --gid=${gid}` : "";
-	const onlyDirFlag = config.prefix ? ` --only-dir=${shellQuote(validatePrefix(config.prefix))}` : "";
+	const onlyDirFlag = config.prefix ? ` --only-dir=${shellQuote$1(validatePrefix(config.prefix))}` : "";
 	const hasCredentials = !!config.serviceAccountKey;
 	let mountCmd;
 	if (hasCredentials) {
@@ -441,9 +441,9 @@ Error details: ${verifyResult.stderr || verifyResult.stdout || installResult?.st
 	await sandbox.commands.run(`sudo rm -f ${configPath}`);
 	await sandbox.files.write(configPath, yaml);
 	await sandbox.commands.run(`sudo chown root:root ${configPath} && sudo chmod 600 ${configPath}`);
-	await sandbox.commands.run(`sudo rm -rf ${shellQuote(cachePath)} && sudo mkdir -p ${shellQuote(cachePath)}`);
-	const prefixFlags = prefix ? ` --virtual-directory=true --subdirectory=${shellQuote(prefix)}` : "";
-	const mountCmd = `sudo blobfuse2 mount ${shellQuote(mountPath)} --config-file=${shellQuote(configPath)}${prefixFlags}`;
+	await sandbox.commands.run(`sudo rm -rf ${shellQuote$1(cachePath)} && sudo mkdir -p ${shellQuote$1(cachePath)}`);
+	const prefixFlags = prefix ? ` --virtual-directory=true --subdirectory=${shellQuote$1(prefix)}` : "";
+	const mountCmd = `sudo blobfuse2 mount ${shellQuote$1(mountPath)} --config-file=${shellQuote$1(configPath)}${prefixFlags}`;
 	logger.debug(`${LOG_PREFIX} Mounting Azure Blob:`, mountCmd);
 	try {
 		const result = await sandbox.commands.run(mountCmd, { timeoutMs: 6e4 });
@@ -1578,6 +1578,16 @@ function setupMarkerContent(setupCommand) {
 function setupMarkerCommand(content) {
 	return `mkdir -p "$(dirname "${SETUP_MARKER_PATH}")" && printf '%s' '${content}' > "${SETUP_MARKER_PATH}"`;
 }
+function repoCloneCommand({ cloneUrl, destination, branch, tokenEnv }) {
+	return `git ${tokenEnv ? `${gitAuthFlag$1(tokenEnv)} ` : ""}clone --depth=1 --single-branch ${branch ? `--branch ${shellQuote(branch)} ` : ""}${shellQuote(cloneUrl)} ${shellQuote(destination)}`;
+}
+/** Per-invocation auth header; `-c` config never reaches `.git/config`. */
+function gitAuthFlag$1(tokenEnv) {
+	return `-c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$${tokenEnv}" | base64 -w0)"`;
+}
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 //#endregion
 //#region src/utils/repo-template.ts
 /**
@@ -1796,7 +1806,11 @@ function buildRepoTemplateSpec(identity, token) {
 		const dir = trimTrailingSlashes(workingDirectory);
 		template = template.runCmd(`mkdir -p "${dir}"`).setWorkdir(dir);
 	}
-	template = template.runCmd(`git ${auth}clone ${cloneUrl} "${repoDir}"`);
+	template = template.runCmd(repoCloneCommand({
+		cloneUrl,
+		destination: repoDir,
+		...token ? { tokenEnv: BUILD_TOKEN_ENV } : {}
+	}));
 	if (sha) template = template.runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
 	const setupCommands = normalizeSetupCommands(setupCommand);
 	for (const command of setupCommands) template = template.runCmd(`cd "${repoDir}" && ${command}`);