@molecule/api-code-sandbox-flyio 1.0.9 → 1.0.11

package/dist/exec.d.ts

@@ -41,6 +41,16 @@ export declare const DIRECT_EXEC_BUDGET_SECONDS = 55;
  * would try to materialize the whole thing in one response body.
  */
 export declare const MAX_CAPTURED_OUTPUT_BYTES: number;
+/**
+ * Hard cap on the `sh -c <script>` argument SENT to Fly's exec endpoint. This is
+ * NOT the OS `MAX_ARG_STRLEN` (128 KB) — the Fly Machines exec API rejects a
+ * command well below that, and does so INVISIBLY: it answers `200` with
+ * `exit_code: 0` and an `Unhandled rejection: Rejection([PayloadTooLarge…])`
+ * body, so the command never runs yet reads as success. Measured against the
+ * live API: ~15.8 KB scripts run, ~23.7 KB are rejected. 15 KB is the safe
+ * ceiling; callers that move bulk data (writeFile, importFiles) chunk beneath it.
+ */
+export declare const FLY_EXEC_MAX_ARG_BYTES = 15000;
 /**
  * Exit code reported when a command's outcome is genuinely unknown — it was
  * still running when the caller's budget expired, or Fly returned no status.
@@ -73,13 +83,15 @@ export declare function buildScript(command: string, opts: ExecOptions | undefin
  * Executes a command on a Machine, choosing the direct or detached strategy
  * based on the caller's time budget.
  *
+ * A command too large to pass inline (over {@link FLY_EXEC_MAX_ARG_BYTES}) is
+ * spilled to a file via chunked writes and run from there, so there is no size
+ * ceiling the caller must respect.
  * @param rawExec - Transport callback issuing one Fly exec call.
  * @param command - The shell command to run.
  * @param opts - Core exec options (cwd, env, timeout in ms).
  * @param defaultCwd - Working directory used when `opts.cwd` is unset.
  * @returns The command's stdout, stderr and exit code.
- * @throws {Error} When the command is too large to launch (see
- *   {@link MAX_SCRIPT_BASE64_BYTES}), or when the transport itself fails.
+ * @throws {Error} When staging a large command or the transport itself fails.
  */
 export declare function execCommand(rawExec: RawExec, command: string, opts: ExecOptions | undefined, defaultCwd: string): Promise<ExecResult>;
 //# sourceMappingURL=exec.d.ts.map

package/dist/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../src/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAKjD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAA;AAE9C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAW5C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAkB,CAAA;AAWxD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,0FAA0F;AAC1F,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,CAYlE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,MAAM,CAGR;AAaD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAUrB"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../src/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAKjD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAA;AAE9C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAW5C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAkB,CAAA;AAQxD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAA;AAY5C;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,0FAA0F;AAC1F,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,CAiBlE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,MAAM,CAGR;AAmDD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAqBrB"}

package/dist/exec.js

@@ -50,10 +50,26 @@ const DEFAULT_TIMEOUT_MS = 600_000;
  */
 export const MAX_CAPTURED_OUTPUT_BYTES = 5 * 1024 * 1024;
 /**
- * Cap on the base64-encoded launcher script. `sh -c` receives it as a single
- * argument, which Linux limits to MAX_ARG_STRLEN (128 KB).
+ * Base64 chunk size for spilling a large script to a file, comfortably under
+ * {@link FLY_EXEC_MAX_ARG_BYTES} once the `printf … | base64 -d` wrapper is added.
  */
-const MAX_SCRIPT_BASE64_BYTES = 60_000;
+const SCRIPT_SPILL_CHUNK_BASE64 = 12_000;
+/**
+ * Hard cap on the `sh -c <script>` argument SENT to Fly's exec endpoint. This is
+ * NOT the OS `MAX_ARG_STRLEN` (128 KB) — the Fly Machines exec API rejects a
+ * command well below that, and does so INVISIBLY: it answers `200` with
+ * `exit_code: 0` and an `Unhandled rejection: Rejection([PayloadTooLarge…])`
+ * body, so the command never runs yet reads as success. Measured against the
+ * live API: ~15.8 KB scripts run, ~23.7 KB are rejected. 15 KB is the safe
+ * ceiling; callers that move bulk data (writeFile, importFiles) chunk beneath it.
+ */
+export const FLY_EXEC_MAX_ARG_BYTES = 15_000;
+/**
+ * Marker Fly puts in an exec response body when it REJECTS the command instead
+ * of running it (most often {@link FLY_EXEC_MAX_ARG_BYTES} exceeded). Detected so
+ * a rejection becomes a loud failure instead of a silent `exit_code: 0`.
+ */
+const FLY_EXEC_REJECTION = 'Rejection([';
 /** Directory inside the Machine holding detached-command bookkeeping files. */
 const WORK_DIR = '/tmp/.mol-exec';
 /**
@@ -73,16 +89,21 @@ export const INDETERMINATE_EXIT_CODE = -1;
  * @returns The normalized result.
  */
 export function toExecResult(response) {
+    const stdout = response.stdout ?? '';
+    const stderr = response.stderr ?? '';
+    // Fly answers a REJECTED command (over-limit payload, bad method) with a 200,
+    // `exit_code: 0`, and a rejection body — the command never ran. Trusting that
+    // 0 silently dropped every oversized write. Surface it as a failure so
+    // exit-code checks catch it instead of reporting phantom success.
+    if (stderr.includes(FLY_EXEC_REJECTION) || stdout.includes(FLY_EXEC_REJECTION)) {
+        return { stdout, stderr, exitCode: INDETERMINATE_EXIT_CODE };
+    }
     const exitCode = typeof response.exit_code === 'number'
         ? response.exit_code
         : typeof response.exit_signal === 'number' && response.exit_signal > 0
             ? 128 + response.exit_signal
             : INDETERMINATE_EXIT_CODE;
-    return {
-        stdout: response.stdout ?? '',
-        stderr: response.stderr ?? '',
-        exitCode,
-    };
+    return { stdout, stderr, exitCode };
 }
 /**
  * Builds the shell script body for a command: change directory, export the
@@ -107,23 +128,62 @@ function newRunId() {
         id += Math.floor(Math.random() * 0xffffffff).toString(16);
     return id.slice(0, 16);
 }
+/**
+ * Writes `script` to `path` on the Machine via chunked base64 execs, each under
+ * {@link FLY_EXEC_MAX_ARG_BYTES}.
+ *
+ * Fly's exec API silently drops a single over-limit `printf %s <base64>`, so a
+ * script too large to pass inline (a big `node -e`, a bulk file write) must be
+ * delivered in pieces. This is the transport-level equivalent of `docker cp` for
+ * a command body — callers never see the limit.
+ * @param rawExec - Transport callback issuing one Fly exec call.
+ * @param path - Absolute destination path on the Machine.
+ * @param script - The script body to stage.
+ * @throws {Error} When the work dir or any chunk write fails.
+ */
+async function writeScriptChunked(rawExec, path, script) {
+    const base64 = Buffer.from(script, 'utf8').toString('base64');
+    const ensure = toExecResult(await rawExec(['sh', '-c', `mkdir -p ${WORK_DIR}`], CONTROL_EXEC_TIMEOUT_SECONDS));
+    if (ensure.exitCode !== 0) {
+        throw new Error(`Failed to create the Fly exec work dir: ${ensure.stderr || ensure.stdout}`);
+    }
+    for (let i = 0; i < base64.length; i += SCRIPT_SPILL_CHUNK_BASE64) {
+        const op = i === 0 ? '>' : '>>';
+        const chunk = base64.slice(i, i + SCRIPT_SPILL_CHUNK_BASE64);
+        const written = toExecResult(await rawExec(['sh', '-c', `printf %s ${shellQuote(chunk)} | base64 -d ${op} ${path}`], CONTROL_EXEC_TIMEOUT_SECONDS));
+        if (written.exitCode !== 0) {
+            throw new Error(`Failed to stage a Fly exec script chunk: ${written.stderr || written.stdout}`);
+        }
+    }
+}
 /**
  * Executes a command on a Machine, choosing the direct or detached strategy
  * based on the caller's time budget.
  *
+ * A command too large to pass inline (over {@link FLY_EXEC_MAX_ARG_BYTES}) is
+ * spilled to a file via chunked writes and run from there, so there is no size
+ * ceiling the caller must respect.
  * @param rawExec - Transport callback issuing one Fly exec call.
  * @param command - The shell command to run.
  * @param opts - Core exec options (cwd, env, timeout in ms).
  * @param defaultCwd - Working directory used when `opts.cwd` is unset.
  * @returns The command's stdout, stderr and exit code.
- * @throws {Error} When the command is too large to launch (see
- *   {@link MAX_SCRIPT_BASE64_BYTES}), or when the transport itself fails.
+ * @throws {Error} When staging a large command or the transport itself fails.
  */
 export async function execCommand(rawExec, command, opts, defaultCwd) {
     const budgetMs = opts?.timeout ?? DEFAULT_TIMEOUT_MS;
     const script = buildScript(command, opts, defaultCwd);
     if (budgetMs <= DIRECT_EXEC_BUDGET_SECONDS * 1000) {
         const seconds = Math.max(1, Math.min(Math.ceil(budgetMs / 1000), FLY_EXEC_MAX_TIMEOUT_SECONDS));
+        // Fly's exec API silently drops a command over FLY_EXEC_MAX_ARG_BYTES. A
+        // script that big cannot go inline, so spill it to a file (chunked writes,
+        // each under the limit) and run that — matching docker exec, which has no
+        // such ceiling. The caller stays unaware of the transport's limit.
+        if (script.length > FLY_EXEC_MAX_ARG_BYTES) {
+            const path = `${WORK_DIR}/direct-${newRunId()}.sh`;
+            await writeScriptChunked(rawExec, path, script);
+            return toExecResult(await rawExec(['sh', '-c', `sh ${path}; ec=$?; rm -f ${path}; exit $ec`], seconds));
+        }
         return toExecResult(await rawExec(['sh', '-c', script], seconds));
     }
     return await execDetached(rawExec, script, budgetMs);
@@ -143,23 +203,18 @@ export async function execCommand(rawExec, command, opts, defaultCwd) {
  */
 async function execDetached(rawExec, script, budgetMs) {
     const runId = newRunId();
-    const base64 = Buffer.from(script, 'utf8').toString('base64');
-    if (base64.length > MAX_SCRIPT_BASE64_BYTES) {
-        throw new Error(t('codeSandbox.flyio.error.commandTooLarge', { limit: String(MAX_SCRIPT_BASE64_BYTES) }, {
-            defaultValue: `Command is too large to launch on a Fly Machine (encoded ${base64.length} bytes, limit ${MAX_SCRIPT_BASE64_BYTES}). ` +
-                'Write it to a file with writeFile() and exec that file instead.',
-        }));
-    }
     const scriptPath = `${WORK_DIR}/${runId}.sh`;
     const outPath = `${WORK_DIR}/${runId}.out`;
     const errPath = `${WORK_DIR}/${runId}.err`;
     const rcPath = `${WORK_DIR}/${runId}.rc`;
+    // Stage the script via chunked writes (each under the Fly exec arg limit),
+    // then launch it. A single `printf %s <base64>` would exceed the limit for a
+    // large script and Fly would drop it silently. writeScriptChunked also creates
+    // WORK_DIR, so the launcher below only has to background the run.
+    await writeScriptChunked(rawExec, scriptPath, script);
     // The `&` must apply to the nohup line ALONE. In POSIX sh, `a && b &`
-    // backgrounds the whole AND-list, which would race the script write against
-    // the launch, so these are separate statements rather than one chain.
+    // backgrounds the whole AND-list, so these are separate statements.
     const launcher = [
-        `mkdir -p ${WORK_DIR} || exit 1`,
-        `printf %s ${shellQuote(base64)} | base64 -d > ${scriptPath} || exit 1`,
         `nohup sh -c 'sh ${scriptPath} > ${outPath} 2> ${errPath}; printf %s "$?" > ${rcPath}' > /dev/null 2>&1 < /dev/null &`,
         `printf %s ${runId}`,
     ].join('\n');

package/dist/provider.js

@@ -42,11 +42,13 @@ const LIST_PAGE_SIZE = 200;
 /** Hard cap on pages fetched while listing, so a bad cursor cannot loop forever. */
 const LIST_MAX_PAGES = 50;
 /**
- * Chunk size for base64-encoded `writeFile` payloads. `sh -c` receives the whole
- * command as ONE argument, which Linux caps at MAX_ARG_STRLEN (128 KB), so a
- * file over ~45 KB has to be written across several appends.
+ * Chunk size for base64-encoded `writeFile` payloads. The binding limit is NOT
+ * the OS `MAX_ARG_STRLEN` (128 KB) but Fly's exec API, which silently rejects a
+ * command over ~15 KB (`FLY_EXEC_MAX_ARG_BYTES`) with a phantom `exit_code: 0` —
+ * so this stays well under it, leaving room for the `printf … | base64 -d`
+ * wrapper. A file over ~9 KB is written across several appends.
  */
-const WRITE_CHUNK_BASE64 = 60_000;
+const WRITE_CHUNK_BASE64 = 12_000;
 /**
  * Budget for the file-operation execs (`cat`, `ls`, `rm`, chunked writes), in ms.
  *
@@ -81,15 +83,13 @@ const DEFAULT_PROBE_TIMEOUT_MS = 3000;
  */
 const IMPORT_EXTRACT_TIMEOUT_MS = 55_000;
 /**
- * Base64 chunk size for {@link Sandbox.importFiles}'s temp-file write. Larger
- * than `WRITE_CHUNK_BASE64` (which is tuned for small single files) so a
- * multi-megabyte scaffold moves in fewer exec calls — each exec spends Fly's
- * per-action rate-limit budget, and a burst of small chunks trips 429s (and, on
- * a busy API, transient 404s). Kept well under the 128 KB `MAX_ARG_STRLEN`
- * ceiling once the `printf … | base64 -d` wrapper and `buildScript` prefix are
- * added.
+ * Base64 chunk size for {@link Sandbox.importFiles}'s temp-file write. Bounded by
+ * the same Fly exec payload limit as `WRITE_CHUNK_BASE64` (~15 KB, silently
+ * enforced) — a larger chunk is rejected with a phantom `exit_code: 0` and the
+ * bytes vanish. A multi-megabyte scaffold therefore moves in many small appends;
+ * the gzip pass before transfer is what keeps that count reasonable.
  */
-const IMPORT_WRITE_CHUNK_BASE64 = 100_000;
+const IMPORT_WRITE_CHUNK_BASE64 = 12_000;
 /** Extra seconds allowed for the probe exec beyond its connection budget. */
 const PROBE_EXEC_HEADROOM_SECONDS = 10;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-code-sandbox-flyio",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Fly.io Machines (Firecracker microVM) code sandbox provider",
   "type": "module",
   "main": "dist/index.js",