@mastra/e2b 0.12.2 → 0.12.3-alpha.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { MastraSandbox, ProcessHandle, SandboxNotReadyError, SandboxProcessManager, UnsupportedStdinCloseError, assertModesUnsupported } from "@mastra/core/workspace";
 import { Sandbox, Template } from "e2b";
-import { createHash, randomBytes } from "crypto";
+import { createHash } from "crypto";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { FRAME_PREFIX, buildProgramModule, buildRunner, sanitizeToolId } from "@mastra/core/tools";
@@ -161,16 +161,42 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 	const hasSecretKey = !!config.secretAccessKey;
 	if (hasAccessKey !== hasSecretKey) throw new Error("Both accessKeyId and secretAccessKey must be provided together.");
 	const hasCredentials = hasAccessKey && hasSecretKey;
+	if (config.sessionToken && !hasCredentials) throw new Error("sessionToken requires accessKeyId and secretAccessKey.");
+	const useSessionToken = hasCredentials && !!config.sessionToken;
 	const credentialsPath = `/tmp/.passwd-s3fs-${createHash("md5").update(mountPath).digest("hex").slice(0, 8)}`;
 	if (!hasCredentials && config.endpoint) throw new Error(`S3-compatible storage requires credentials. Detected endpoint: ${config.endpoint}. The public_bucket option only works for AWS S3 public buckets, not R2, MinIO, etc.`);
+	let bucketArg = config.bucket;
+	if (config.prefix) {
+		const normalizedPrefix = validatePrefix(config.prefix);
+		bucketArg = `${config.bucket}:/${normalizedPrefix}`;
+	}
+	const removeSessionCredentials = async () => {
+		try {
+			await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
+		} catch {
+			logger.warn(`${LOG_PREFIX} Failed to remove S3 session credentials file`);
+		}
+	};
 	if (hasCredentials) {
-		const credentialsContent = `${config.accessKeyId}:${config.secretAccessKey}`;
+		const credentialsContent = useSessionToken ? [
+			`export AWSACCESSKEYID=${shellQuote$1(config.accessKeyId)}`,
+			`export AWSSECRETACCESSKEY=${shellQuote$1(config.secretAccessKey)}`,
+			`export AWSSESSIONTOKEN=${shellQuote$1(config.sessionToken)}`,
+			`export AWS_ACCESS_KEY_ID=${shellQuote$1(config.accessKeyId)}`,
+			`export AWS_SECRET_ACCESS_KEY=${shellQuote$1(config.secretAccessKey)}`,
+			`export AWS_SESSION_TOKEN=${shellQuote$1(config.sessionToken)}`
+		].join("\n") : `${config.accessKeyId}:${config.secretAccessKey}`;
 		await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
-		await sandbox.files.write(credentialsPath, credentialsContent);
-		await sandbox.commands.run(`chmod 600 ${credentialsPath}`);
+		try {
+			await sandbox.files.write(credentialsPath, credentialsContent);
+			await sandbox.commands.run(`chmod 600 ${credentialsPath}`);
+		} catch (error) {
+			if (useSessionToken) await removeSessionCredentials();
+			throw error;
+		}
 	}
 	const mountOptions = [];
-	if (hasCredentials) mountOptions.push(`passwd_file=${credentialsPath}`);
+	if (hasCredentials) mountOptions.push(useSessionToken ? "use_session_token" : `passwd_file=${credentialsPath}`);
 	else {
 		mountOptions.push("public_bucket=1");
 		logger.debug(`${LOG_PREFIX} No credentials provided, mounting as public bucket (read-only)`);
@@ -186,12 +212,8 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 		mountOptions.push("ro");
 		logger.debug(`${LOG_PREFIX} Mounting as read-only`);
 	}
-	let bucketArg = config.bucket;
-	if (config.prefix) {
-		const normalizedPrefix = validatePrefix(config.prefix);
-		bucketArg = `${config.bucket}:/${normalizedPrefix}`;
-	}
-	const mountCmd = `sudo s3fs ${shellQuote$1(bucketArg)} ${shellQuote$1(mountPath)} -o ${mountOptions.join(" -o ")}`;
+	const s3fsCmd = `s3fs ${shellQuote$1(bucketArg)} ${shellQuote$1(mountPath)} -o ${mountOptions.join(" -o ")}`;
+	const mountCmd = useSessionToken ? `sudo sh -c ${shellQuote$1(`. ${credentialsPath} && exec ${s3fsCmd}`)}` : `sudo ${s3fsCmd}`;
 	logger.debug(`${LOG_PREFIX} Mounting S3:`, hasCredentials ? mountCmd.replace(credentialsPath, "***") : mountCmd);
 	try {
 		const result = await sandbox.commands.run(mountCmd, { timeoutMs: 6e4 });
@@ -211,6 +233,8 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 			error: String(error)
 		});
 		throw new Error(`Failed to mount S3 bucket: ${stderr || stdout || error}`);
+	} finally {
+		if (useSessionToken) await removeSessionCredentials();
 	}
 	if ((await sandbox.commands.run(`mountpoint -q ${shellQuote$1(mountPath)}`)).exitCode !== 0) throw new Error(`s3fs returned exit 0 but ${mountPath} is not a mountpoint. The s3fs daemon likely failed during FUSE init (common causes: region mismatch, invalid credentials, or an S3-compatible endpoint that rejects the signature). Re-run inside the sandbox with '-f -o dbglevel=info' to see the underlying error.`);
 }
@@ -2053,7 +2077,7 @@ var E2BCodeModeTransport = class {
 			externalName: sanitizeToolId(toolId)
 		}));
 		const allowList = new Set(toolIds);
-		const suffix = randomBytes(4).toString("hex");
+		const suffix = Buffer.from(globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4))).toString("hex");
 		const dir = `${SANDBOX_TMP}/${suffix}`;
 		const programPath = `${dir}/program-${suffix}.mjs`;
 		const runnerPath = `${dir}/runner-${suffix}.mjs`;