@mastra/platform-workspace 1.5.0-alpha.5 → 1.5.0

package/dist/index.js

@@ -1023,9 +1023,9 @@ var SandboxDestroyedError = class extends Error {
 * sandbox.
 */
 function buildCommand(command, args) {
-	return args?.length ? `${command} ${args.map(shellQuote).join(" ")}` : command;
+	return args?.length ? `${command} ${args.map(shellQuote$1).join(" ")}` : command;
 }
-function shellQuote(arg) {
+function shellQuote$1(arg) {
 	if (/^[a-zA-Z0-9._\-/=:@]+$/.test(arg)) return arg;
 	return `'${arg.replace(/'/g, `'\\''`)}'`;
 }
@@ -1495,14 +1495,15 @@ var PlatformSandbox = class PlatformSandbox extends MastraSandbox {
 	* sandbox they can't safely retry.
 	*
 	* Railway requires a caller-supplied recovery `id` before it can have a
-	* checkpoint to delete. E2B also permits capture with the automatic id, so
-	* destroy releases that named snapshot even when no recovery id was supplied.
+	* checkpoint to delete. On E2B the sandbox itself is the persistent thing
+	* (idle sandboxes pause and resume in place), so destroy only kills the
+	* VM; any snapshot a caller captured on purpose is the caller's to manage.
 	*/
 	async destroy() {
 		if (!this._sandboxId) return;
 		const destroyedSandboxId = this._sandboxId;
 		this._captureInFlight = null;
-		if (this._hasRecoveryKey || this._client.sandboxProvider === "e2b") try {
+		if (this._hasRecoveryKey && this._client.sandboxProvider !== "e2b") try {
 			await this._request(`/sandbox/${encodeURIComponent(destroyedSandboxId)}/checkpoint`, {
 				method: "DELETE",
 				headers: { "content-type": "application/json" },
@@ -1965,6 +1966,16 @@ function setupMarkerContent(setupCommand) {
 function setupMarkerCommand(content) {
 	return `mkdir -p "$(dirname "${SETUP_MARKER_PATH}")" && printf '%s' '${content}' > "${SETUP_MARKER_PATH}"`;
 }
+function repoCloneCommand({ cloneUrl, destination, branch, tokenEnv }) {
+	return `git ${tokenEnv ? `${gitAuthFlag$1(tokenEnv)} ` : ""}clone --depth=1 --single-branch ${branch ? `--branch ${shellQuote(branch)} ` : ""}${shellQuote(cloneUrl)} ${shellQuote(destination)}`;
+}
+/** Per-invocation auth header; `-c` config never reaches `.git/config`. */
+function gitAuthFlag$1(tokenEnv) {
+	return `-c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$${tokenEnv}" | base64 -w0)"`;
+}
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 //#endregion
 //#region src/repo-template.ts
 const execFileAsync = promisify(execFile);
@@ -2046,7 +2057,11 @@ function createRepoTemplate(options) {
 		if (Object.keys(buildEnv).length > 0) template = template.setEnvs(buildEnv, { ephemeral: true });
 		template = withResources(template, options);
 		if (workingDirectory) template = template.runCmd(`mkdir -p "${workingDirectory}"`).setWorkdir(workingDirectory);
-		template = template.runCmd(`git ${auth}clone ${cloneUrl} "${repoDir}"`).runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
+		template = template.runCmd(repoCloneCommand({
+			cloneUrl,
+			destination: repoDir,
+			...token ? { tokenEnv: BUILD_TOKEN_ENV } : {}
+		})).runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
 		for (const command of setupCommands) template = template.runCmd(`cd "${repoDir}" && ${command}`);
 		template = template.runCmd(setupMarkerCommand(setupMarkerContent(setupCommands)));
 		return template.withFamily(family);