@mastra/e2b 0.12.3-alpha.0 → 0.12.3-alpha.1

package/dist/index.cjs

@@ -162,16 +162,42 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 	const hasSecretKey = !!config.secretAccessKey;
 	if (hasAccessKey !== hasSecretKey) throw new Error("Both accessKeyId and secretAccessKey must be provided together.");
 	const hasCredentials = hasAccessKey && hasSecretKey;
+	if (config.sessionToken && !hasCredentials) throw new Error("sessionToken requires accessKeyId and secretAccessKey.");
+	const useSessionToken = hasCredentials && !!config.sessionToken;
 	const credentialsPath = `/tmp/.passwd-s3fs-${(0, crypto.createHash)("md5").update(mountPath).digest("hex").slice(0, 8)}`;
 	if (!hasCredentials && config.endpoint) throw new Error(`S3-compatible storage requires credentials. Detected endpoint: ${config.endpoint}. The public_bucket option only works for AWS S3 public buckets, not R2, MinIO, etc.`);
+	let bucketArg = config.bucket;
+	if (config.prefix) {
+		const normalizedPrefix = validatePrefix(config.prefix);
+		bucketArg = `${config.bucket}:/${normalizedPrefix}`;
+	}
+	const removeSessionCredentials = async () => {
+		try {
+			await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
+		} catch {
+			logger.warn(`${LOG_PREFIX} Failed to remove S3 session credentials file`);
+		}
+	};
 	if (hasCredentials) {
-		const credentialsContent = `${config.accessKeyId}:${config.secretAccessKey}`;
+		const credentialsContent = useSessionToken ? [
+			`export AWSACCESSKEYID=${shellQuote$1(config.accessKeyId)}`,
+			`export AWSSECRETACCESSKEY=${shellQuote$1(config.secretAccessKey)}`,
+			`export AWSSESSIONTOKEN=${shellQuote$1(config.sessionToken)}`,
+			`export AWS_ACCESS_KEY_ID=${shellQuote$1(config.accessKeyId)}`,
+			`export AWS_SECRET_ACCESS_KEY=${shellQuote$1(config.secretAccessKey)}`,
+			`export AWS_SESSION_TOKEN=${shellQuote$1(config.sessionToken)}`
+		].join("\n") : `${config.accessKeyId}:${config.secretAccessKey}`;
 		await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
-		await sandbox.files.write(credentialsPath, credentialsContent);
-		await sandbox.commands.run(`chmod 600 ${credentialsPath}`);
+		try {
+			await sandbox.files.write(credentialsPath, credentialsContent);
+			await sandbox.commands.run(`chmod 600 ${credentialsPath}`);
+		} catch (error) {
+			if (useSessionToken) await removeSessionCredentials();
+			throw error;
+		}
 	}
 	const mountOptions = [];
-	if (hasCredentials) mountOptions.push(`passwd_file=${credentialsPath}`);
+	if (hasCredentials) mountOptions.push(useSessionToken ? "use_session_token" : `passwd_file=${credentialsPath}`);
 	else {
 		mountOptions.push("public_bucket=1");
 		logger.debug(`${LOG_PREFIX} No credentials provided, mounting as public bucket (read-only)`);
@@ -187,12 +213,8 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 		mountOptions.push("ro");
 		logger.debug(`${LOG_PREFIX} Mounting as read-only`);
 	}
-	let bucketArg = config.bucket;
-	if (config.prefix) {
-		const normalizedPrefix = validatePrefix(config.prefix);
-		bucketArg = `${config.bucket}:/${normalizedPrefix}`;
-	}
-	const mountCmd = `sudo s3fs ${shellQuote$1(bucketArg)} ${shellQuote$1(mountPath)} -o ${mountOptions.join(" -o ")}`;
+	const s3fsCmd = `s3fs ${shellQuote$1(bucketArg)} ${shellQuote$1(mountPath)} -o ${mountOptions.join(" -o ")}`;
+	const mountCmd = useSessionToken ? `sudo sh -c ${shellQuote$1(`. ${credentialsPath} && exec ${s3fsCmd}`)}` : `sudo ${s3fsCmd}`;
 	logger.debug(`${LOG_PREFIX} Mounting S3:`, hasCredentials ? mountCmd.replace(credentialsPath, "***") : mountCmd);
 	try {
 		const result = await sandbox.commands.run(mountCmd, { timeoutMs: 6e4 });
@@ -212,6 +234,8 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 			error: String(error)
 		});
 		throw new Error(`Failed to mount S3 bucket: ${stderr || stdout || error}`);
+	} finally {
+		if (useSessionToken) await removeSessionCredentials();
 	}
 	if ((await sandbox.commands.run(`mountpoint -q ${shellQuote$1(mountPath)}`)).exitCode !== 0) throw new Error(`s3fs returned exit 0 but ${mountPath} is not a mountpoint. The s3fs daemon likely failed during FUSE init (common causes: region mismatch, invalid credentials, or an S3-compatible endpoint that rejects the signature). Re-run inside the sandbox with '-f -o dbglevel=info' to see the underlying error.`);
 }