@mastra/platform-workspace 1.5.0-alpha.1 → 1.5.0-alpha.3

package/dist/index.cjs

@@ -1989,38 +1989,71 @@ const CLONE_URL_SEGMENT_PATTERN = /^[\w.-]+$/;
 * pins repositories to their current default-branch commit. Private repository
 * credentials are used for head resolution and sent to the provider as
 * transient build envs; they never enter the serialized definition. If the
-* head cannot be resolved, the resolver returns undefined so PlatformSandbox
-* boots from the provider default and the caller's runtime setup materializes
-* the checkout instead.
+* repository or its head cannot be resolved, the resolver keeps `cpuCount` and
+* `memoryMB` in a resources-only template so the sandbox still boots at the
+* requested size, and the caller's runtime setup materializes the checkout.
 */
 function createRepoTemplate(options) {
 	const getRepositoryAccess = options.getRepositoryAccess;
-	if (!getRepositoryAccess) return void 0;
+	const resourcesOnly = () => {
+		if (options.cpuCount === void 0 && options.memoryMB === void 0) return void 0;
+		return withResources(Template(), options);
+	};
+	if (!getRepositoryAccess) {
+		const template = resourcesOnly();
+		return template ? async () => template : void 0;
+	}
 	const resolveHead = options.resolveHead ?? resolveDefaultBranchHead;
 	return async () => {
-		const access = await getRepositoryAccess().catch(() => void 0);
-		if (!access?.cloneUrl) return void 0;
+		let accessError;
+		const access = await getRepositoryAccess().catch((error) => {
+			accessError = error;
+		});
+		if (!access?.cloneUrl) {
+			console.warn("[platform-workspace] repo template skipped: repository access unavailable", { error: redactSecrets(accessError) });
+			return resourcesOnly();
+		}
 		const cloneUrl = normalizeCloneUrl(access.cloneUrl);
-		if (!isValidCloneUrl(cloneUrl)) return void 0;
+		if (!isValidCloneUrl(cloneUrl)) {
+			console.warn("[platform-workspace] repo template skipped: clone URL failed validation", { cloneUrl: redactSecrets(cloneUrl) });
+			return resourcesOnly();
+		}
 		const token = access.authorization?.token;
-		const sha = await (token ? resolveHead(cloneUrl, token) : resolveHead(cloneUrl)).catch(() => void 0);
-		if (!sha || !SHA_PATTERN.test(sha)) return void 0;
-		const workdir = defaultWorkdir(cloneUrl);
+		let headError;
+		const sha = await (token ? resolveHead(cloneUrl, token) : resolveHead(cloneUrl)).catch((error) => {
+			headError = error;
+		});
+		if (!sha || !SHA_PATTERN.test(sha)) {
+			console.warn("[platform-workspace] repo template skipped: could not resolve default-branch head", {
+				cloneUrl,
+				sha,
+				error: redactSecrets(headError)
+			});
+			return resourcesOnly();
+		}
+		const workingDirectory = options.workingDirectory === void 0 ? void 0 : trimTrailingSlashes(assertWorkingDirectory(options.workingDirectory));
+		const repoDir = repoDirName(cloneUrl);
 		const auth = token ? `${gitAuthFlag()} ` : "";
-		const steps = [
-			`git ${auth}clone ${cloneUrl} "${workdir}"`,
-			`git -C "${workdir}" ${auth}fetch origin ${sha}`,
-			`git -C "${workdir}" checkout ${sha}`,
-			...options.setupCommand ? [`cd "${workdir}" && ${options.setupCommand}`] : []
-		];
-		const family = `repo:${cloneUrl}:${workdir}`;
+		const setupCommands = (options.setupCommand === void 0 ? [] : Array.isArray(options.setupCommand) ? options.setupCommand : [options.setupCommand]).filter((command) => command.trim() !== "");
+		const family = `repo:${cloneUrl}:${workingDirectory ?? ""}/${repoDir}`;
 		let template = Template();
-		if (token) template = template.setEnvs({ [BUILD_TOKEN_ENV]: token }, { ephemeral: true });
-		if (options.cpuCount !== void 0) template = template.cpuCount(options.cpuCount);
-		if (options.memoryMB !== void 0) template = template.memoryMB(options.memoryMB);
-		return template.runCmd(steps).withFamily(family);
+		const buildEnv = {
+			...options.buildEnv,
+			...token ? { [BUILD_TOKEN_ENV]: token } : {}
+		};
+		if (Object.keys(buildEnv).length > 0) template = template.setEnvs(buildEnv, { ephemeral: true });
+		template = withResources(template, options);
+		if (workingDirectory) template = template.runCmd(`mkdir -p "${workingDirectory}"`).setWorkdir(workingDirectory);
+		template = template.runCmd(`git ${auth}clone ${cloneUrl} "${repoDir}"`).runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
+		for (const command of setupCommands) template = template.runCmd(`cd "${repoDir}" && ${command}`);
+		return template.withFamily(family);
 	};
 }
+function withResources(template, options) {
+	if (options.cpuCount !== void 0) template = template.cpuCount(options.cpuCount);
+	if (options.memoryMB !== void 0) template = template.memoryMB(options.memoryMB);
+	return template;
+}
 function isValidCloneUrl(cloneUrl) {
 	if (cloneUrl.length > 2048 || !CLONE_URL_ALLOWED_CHARS.test(cloneUrl)) return false;
 	let url;
@@ -2046,13 +2079,74 @@ function normalizeCloneUrl(cloneUrl) {
 		return `${scheme.toLowerCase()}${host.toLowerCase()}`;
 	});
 }
-function defaultWorkdir(cloneUrl) {
-	return `$HOME/${(normalizeCloneUrl(cloneUrl).split("/").at(-1) ?? "").replace(/[^\w.-]/g, "-").replace(/^\.+/, "") || "repo"}`;
+function repoDirName(cloneUrl) {
+	return (normalizeCloneUrl(cloneUrl).split("/").at(-1) ?? "").replace(/[^\w.-]/g, "-").replace(/^\.+/, "") || "repo";
+}
+function trimTrailingSlashes(path) {
+	let end = path.length;
+	while (end > 1 && path[end - 1] === "/") end--;
+	return path.slice(0, end);
+}
+/** Validate a literal absolute path before embedding it in shell build steps. */
+function assertWorkingDirectory(dir) {
+	if (!(/^\/[A-Za-z0-9._/-]*$/.test(dir) && !dir.split("/").includes(".."))) throw new Error(`Repo template workingDirectory must be an absolute path of plain path characters (got ${JSON.stringify(dir)}); ~ and $HOME are not expanded.`);
+	return dir;
+}
+/**
+* Render a caught value for a warning without leaking credentials: URL
+* userinfo, HTTP authorization values, and GitHub token shapes are masked.
+*/
+function redactSecrets(value) {
+	if (value === void 0 || value === null) return void 0;
+	return (value instanceof Error ? value.message : typeof value === "string" ? value : String(value)).replace(/\/\/[^/@\s]+@/g, "//***@").replace(/\b(bearer|basic)\s+[^\s"']+/gi, "$1 ***").replace(/\b(gh[pousr]_|github_pat_)[A-Za-z0-9_]+/g, "$1***");
 }
 function gitAuthFlag() {
 	return `-c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$${BUILD_TOKEN_ENV}" | base64 -w0)"`;
 }
-async function resolveDefaultBranchHead(cloneUrl, token, execute = execFileAsync) {
+/**
+* `owner/repo` for a github.com clone URL, else undefined. Only the public
+* host is API-resolvable: GitHub Enterprise and other forges keep the git
+* path below.
+*/
+function parseGithubRepo(cloneUrl) {
+	let url;
+	try {
+		url = new URL(cloneUrl);
+	} catch {
+		return;
+	}
+	if (url.hostname.toLowerCase() !== "github.com") return void 0;
+	const [owner, repo, ...rest] = url.pathname.split("/").filter(Boolean);
+	if (!owner || !repo || rest.length > 0) return void 0;
+	return {
+		owner,
+		repo: repo.replace(/\.git$/i, "")
+	};
+}
+/**
+* Resolve the default-branch head. github.com repositories go through the
+* REST API so resolution works wherever the host runs, including deployed
+* images without a git binary; other hosts shell out to `git ls-remote`.
+* Throws with a redaction-safe message when the head cannot be resolved.
+*/
+async function resolveDefaultBranchHead(cloneUrl, token, execute = execFileAsync, fetchImpl = fetch) {
+	const github = parseGithubRepo(cloneUrl);
+	if (github) {
+		const response = await fetchImpl(`https://api.github.com/repos/${github.owner}/${github.repo}/commits/HEAD`, {
+			headers: {
+				Accept: "application/vnd.github.sha",
+				"X-GitHub-Api-Version": "2022-11-28",
+				"User-Agent": "mastra-platform-workspace",
+				...token ? { Authorization: `Bearer ${token}` } : {}
+			},
+			signal: AbortSignal.timeout(1e4)
+		}).catch((error) => {
+			throw new Error(`GitHub head lookup failed: ${error instanceof Error ? error.message : String(error)}`);
+		});
+		if (!response.ok) throw new Error(`GitHub head lookup failed: ${response.status} ${response.statusText}`.trim());
+		const sha = (await response.text()).trim();
+		return SHA_PATTERN.test(sha) ? sha : void 0;
+	}
 	try {
 		const env = {
 			...process.env,
@@ -2075,8 +2169,10 @@ async function resolveDefaultBranchHead(cloneUrl, token, execute = execFileAsync
 		});
 		const sha = stdout.trim().split(/\s+/, 1)[0];
 		return sha && SHA_PATTERN.test(sha) ? sha : void 0;
-	} catch {
-		return;
+	} catch (error) {
+		const stderr = error.stderr;
+		const detail = typeof stderr === "string" && stderr.trim() ? stderr.trim() : String(error);
+		throw new Error(`git ls-remote failed: ${detail}`);
 	}
 }
 //#endregion