@molecule/api-code-sandbox-flyio 1.0.8 → 1.0.10

package/dist/exec.d.ts

@@ -41,6 +41,16 @@ export declare const DIRECT_EXEC_BUDGET_SECONDS = 55;
  * would try to materialize the whole thing in one response body.
  */
 export declare const MAX_CAPTURED_OUTPUT_BYTES: number;
+/**
+ * Hard cap on the `sh -c <script>` argument SENT to Fly's exec endpoint. This is
+ * NOT the OS `MAX_ARG_STRLEN` (128 KB) — the Fly Machines exec API rejects a
+ * command well below that, and does so INVISIBLY: it answers `200` with
+ * `exit_code: 0` and an `Unhandled rejection: Rejection([PayloadTooLarge…])`
+ * body, so the command never runs yet reads as success. Measured against the
+ * live API: ~15.8 KB scripts run, ~23.7 KB are rejected. 15 KB is the safe
+ * ceiling; callers that move bulk data (writeFile, importFiles) chunk beneath it.
+ */
+export declare const FLY_EXEC_MAX_ARG_BYTES = 15000;
 /**
  * Exit code reported when a command's outcome is genuinely unknown — it was
  * still running when the caller's budget expired, or Fly returned no status.

package/dist/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../src/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAKjD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAA;AAE9C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAW5C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAkB,CAAA;AAWxD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,0FAA0F;AAC1F,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,CAYlE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,MAAM,CAGR;AAaD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAUrB"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../src/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAKjD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAA;AAE9C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAW5C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAkB,CAAA;AAQxD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAA;AAY5C;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,0FAA0F;AAC1F,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,CAiBlE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,MAAM,CAGR;AAaD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAqBrB"}

package/dist/exec.js

@@ -54,6 +54,22 @@ export const MAX_CAPTURED_OUTPUT_BYTES = 5 * 1024 * 1024;
  * argument, which Linux limits to MAX_ARG_STRLEN (128 KB).
  */
 const MAX_SCRIPT_BASE64_BYTES = 60_000;
+/**
+ * Hard cap on the `sh -c <script>` argument SENT to Fly's exec endpoint. This is
+ * NOT the OS `MAX_ARG_STRLEN` (128 KB) — the Fly Machines exec API rejects a
+ * command well below that, and does so INVISIBLY: it answers `200` with
+ * `exit_code: 0` and an `Unhandled rejection: Rejection([PayloadTooLarge…])`
+ * body, so the command never runs yet reads as success. Measured against the
+ * live API: ~15.8 KB scripts run, ~23.7 KB are rejected. 15 KB is the safe
+ * ceiling; callers that move bulk data (writeFile, importFiles) chunk beneath it.
+ */
+export const FLY_EXEC_MAX_ARG_BYTES = 15_000;
+/**
+ * Marker Fly puts in an exec response body when it REJECTS the command instead
+ * of running it (most often {@link FLY_EXEC_MAX_ARG_BYTES} exceeded). Detected so
+ * a rejection becomes a loud failure instead of a silent `exit_code: 0`.
+ */
+const FLY_EXEC_REJECTION = 'Rejection([';
 /** Directory inside the Machine holding detached-command bookkeeping files. */
 const WORK_DIR = '/tmp/.mol-exec';
 /**
@@ -73,16 +89,21 @@ export const INDETERMINATE_EXIT_CODE = -1;
  * @returns The normalized result.
  */
 export function toExecResult(response) {
+    const stdout = response.stdout ?? '';
+    const stderr = response.stderr ?? '';
+    // Fly answers a REJECTED command (over-limit payload, bad method) with a 200,
+    // `exit_code: 0`, and a rejection body — the command never ran. Trusting that
+    // 0 silently dropped every oversized write. Surface it as a failure so
+    // exit-code checks catch it instead of reporting phantom success.
+    if (stderr.includes(FLY_EXEC_REJECTION) || stdout.includes(FLY_EXEC_REJECTION)) {
+        return { stdout, stderr, exitCode: INDETERMINATE_EXIT_CODE };
+    }
     const exitCode = typeof response.exit_code === 'number'
         ? response.exit_code
         : typeof response.exit_signal === 'number' && response.exit_signal > 0
             ? 128 + response.exit_signal
             : INDETERMINATE_EXIT_CODE;
-    return {
-        stdout: response.stdout ?? '',
-        stderr: response.stderr ?? '',
-        exitCode,
-    };
+    return { stdout, stderr, exitCode };
 }
 /**
  * Builds the shell script body for a command: change directory, export the
@@ -122,6 +143,14 @@ function newRunId() {
 export async function execCommand(rawExec, command, opts, defaultCwd) {
     const budgetMs = opts?.timeout ?? DEFAULT_TIMEOUT_MS;
     const script = buildScript(command, opts, defaultCwd);
+    // A direct command travels as the `sh -c <script>` argument. Fly rejects one
+    // over FLY_EXEC_MAX_ARG_BYTES with a silent `exit_code: 0` (see the constant),
+    // so refuse it here with a message that names the real limit rather than
+    // letting the caller's data vanish. Bulk callers chunk beneath this.
+    if (script.length > FLY_EXEC_MAX_ARG_BYTES) {
+        throw new Error(`Fly exec command is ${script.length} bytes, over the ${FLY_EXEC_MAX_ARG_BYTES}-byte ` +
+            `limit the API silently rejects — chunk the payload smaller.`);
+    }
     if (budgetMs <= DIRECT_EXEC_BUDGET_SECONDS * 1000) {
         const seconds = Math.max(1, Math.min(Math.ceil(budgetMs / 1000), FLY_EXEC_MAX_TIMEOUT_SECONDS));
         return toExecResult(await rawExec(['sh', '-c', script], seconds));

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAUV,eAAe,EAEhB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,YAAY,EAAgC,MAAM,UAAU,CAAA;AAsBrE,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAEhG,OAAO,KAAK,EAEV,WAAW,EAUZ,MAAM,YAAY,CAAA;AA6yDnB;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE,YAAY,EACrB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,GACzB,eAAe,CAEjB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAUV,eAAe,EAEhB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,YAAY,EAAgC,MAAM,UAAU,CAAA;AAsBrE,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAEhG,OAAO,KAAK,EAEV,WAAW,EAUZ,MAAM,YAAY,CAAA;AAmzDnB;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE,YAAY,EACrB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,GACzB,eAAe,CAEjB"}

package/dist/provider.js

@@ -42,11 +42,13 @@ const LIST_PAGE_SIZE = 200;
 /** Hard cap on pages fetched while listing, so a bad cursor cannot loop forever. */
 const LIST_MAX_PAGES = 50;
 /**
- * Chunk size for base64-encoded `writeFile` payloads. `sh -c` receives the whole
- * command as ONE argument, which Linux caps at MAX_ARG_STRLEN (128 KB), so a
- * file over ~45 KB has to be written across several appends.
+ * Chunk size for base64-encoded `writeFile` payloads. The binding limit is NOT
+ * the OS `MAX_ARG_STRLEN` (128 KB) but Fly's exec API, which silently rejects a
+ * command over ~15 KB (`FLY_EXEC_MAX_ARG_BYTES`) with a phantom `exit_code: 0` —
+ * so this stays well under it, leaving room for the `printf … | base64 -d`
+ * wrapper. A file over ~9 KB is written across several appends.
  */
-const WRITE_CHUNK_BASE64 = 60_000;
+const WRITE_CHUNK_BASE64 = 12_000;
 /**
  * Budget for the file-operation execs (`cat`, `ls`, `rm`, chunked writes), in ms.
  *
@@ -81,15 +83,13 @@ const DEFAULT_PROBE_TIMEOUT_MS = 3000;
  */
 const IMPORT_EXTRACT_TIMEOUT_MS = 55_000;
 /**
- * Base64 chunk size for {@link Sandbox.importFiles}'s temp-file write. Larger
- * than `WRITE_CHUNK_BASE64` (which is tuned for small single files) so a
- * multi-megabyte scaffold moves in fewer exec calls — each exec spends Fly's
- * per-action rate-limit budget, and a burst of small chunks trips 429s (and, on
- * a busy API, transient 404s). Kept well under the 128 KB `MAX_ARG_STRLEN`
- * ceiling once the `printf … | base64 -d` wrapper and `buildScript` prefix are
- * added.
+ * Base64 chunk size for {@link Sandbox.importFiles}'s temp-file write. Bounded by
+ * the same Fly exec payload limit as `WRITE_CHUNK_BASE64` (~15 KB, silently
+ * enforced) — a larger chunk is rejected with a phantom `exit_code: 0` and the
+ * bytes vanish. A multi-megabyte scaffold therefore moves in many small appends;
+ * the gzip pass before transfer is what keeps that count reasonable.
  */
-const IMPORT_WRITE_CHUNK_BASE64 = 100_000;
+const IMPORT_WRITE_CHUNK_BASE64 = 12_000;
 /** Extra seconds allowed for the probe exec beyond its connection budget. */
 const PROBE_EXEC_HEADROOM_SECONDS = 10;
 /**
@@ -209,10 +209,16 @@ class FlyioSandboxProvider {
      * Builds the Fly Proxy service exposing a sandbox's preview port, or `undefined`
      * when public exposure is disabled.
      *
-     * `autostop: 'suspend'` is the scale-to-zero behaviour this bond exists for:
-     * Fly Proxy suspends the Machine when it goes idle and resumes it from its
-     * memory snapshot on the next request, so an idle sandbox bills only for its
-     * rootfs and volume.
+     * `autostart: true` wakes an idle (stopped or suspended) Machine on the next
+     * preview request. `autostop` defaults to `'off'` — NOT `'suspend'` — on
+     * purpose: Fly's autostop timer counts the PROXY service's idle time, and a
+     * sandbox spends its first minutes being provisioned over the exec API with no
+     * proxy traffic, so `'suspend'` cold-starts the Machine mid-scaffold (execs are
+     * not proxy traffic) and the scaffold's own temp state is lost. Idle-sleep is
+     * instead driven by the consumer's own per-tier hibernation loop, which calls
+     * `sleep()`/`hibernate()` — the same provider-agnostic mechanism the Docker
+     * bond relies on. An operator who wants Fly-native scale-to-zero can still opt
+     * in with `config.autostop: 'suspend'`.
      * @returns The service definition, or `undefined`.
      */
     previewService() {
@@ -226,7 +232,7 @@ class FlyioSandboxProvider {
                 { port: 443, handlers: ['tls', 'http'] },
             ],
             autostart: true,
-            autostop: this.config.autostop ?? 'suspend',
+            autostop: this.config.autostop ?? 'off',
             min_machines_running: 0,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-code-sandbox-flyio",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Fly.io Machines (Firecracker microVM) code sandbox provider",
   "type": "module",
   "main": "dist/index.js",