@opengeni/runtime 0.14.1 → 0.14.3

package/dist/{chunk-HHWIZHQM.js → chunk-GQIFSLAC.js}

@@ -10647,17 +10647,27 @@ function getHostDockerUser() {
 }
 
 // src/sandbox/providers/docker.ts
+import { isAbsolute as isAbsolute4 } from "path";
 var dockerProvider = {
   backend: "docker",
   descriptor: CAPABILITY_DESCRIPTORS.docker,
   // Local dev container — no credentials. (The dockerNetwork decoration is
   // applied by the factory, not here: it wraps the constructed client.)
-  validateCredentials() {
+  validateCredentials(settings) {
+    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();
+    if (workspaceBaseDir && !isAbsolute4(workspaceBaseDir)) {
+      throw new SandboxConfigError(
+        "docker",
+        "OPENGENI_DOCKER_WORKSPACE_BASE_DIR must be an absolute path"
+      );
+    }
   },
   build({ settings, exposedPorts }) {
+    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();
     return new DockerSandboxClient({
       image: settings.dockerImage,
-      exposedPorts
+      exposedPorts,
+      ...workspaceBaseDir ? { workspaceBaseDir } : {}
     });
   }
 };
@@ -20525,7 +20535,11 @@ var RoutingSandboxSession = class {
       if (!s.materializeEntry) {
         throw new RoutingUnsupportedError("materializeEntry", this.cached?.kind ?? "unknown");
       }
-      return s.materializeEntry(args);
+      await s.materializeEntry(args);
+      const path = args && typeof args === "object" && typeof args.path === "string" ? args.path : null;
+      if (path) {
+        await assertProviderCanSeeMaterializedPath(s, path);
+      }
     });
   }
   /** PTY support reflects the LAST-resolved backend (a synchronous probe; the SDK
@@ -20589,6 +20603,39 @@ var RoutingSandboxSession = class {
     return this.resolve();
   }
 };
+var MATERIALIZED_PATH_MARKER = "__OPENGENI_MATERIALIZED_PATH_VISIBLE__";
+async function assertProviderCanSeeMaterializedPath(session, path) {
+  const command = `test -e ${shellSingleQuote(path)} && printf %s ${shellSingleQuote(
+    MATERIALIZED_PATH_MARKER
+  )}`;
+  const args = {
+    cmd: command,
+    workdir: providerManifestRoot(session) ?? "/workspace",
+    shell: "sh",
+    login: false,
+    tty: false
+  };
+  let output;
+  if (session.execCommand) {
+    output = await session.execCommand(args);
+  } else if (session.exec) {
+    output = formatExecResult(await session.exec(args));
+  } else {
+    throw new RoutingUnsupportedError("materializeEntry.verify", "unknown");
+  }
+  if (!output.includes(MATERIALIZED_PATH_MARKER)) {
+    throw new Error(
+      `Sandbox materialization completed but the provider cannot read the destination path: ${path}`
+    );
+  }
+}
+function providerManifestRoot(session) {
+  const root = session.state?.manifest?.root;
+  return typeof root === "string" && root.length > 0 ? root : null;
+}
+function shellSingleQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 
 // src/sandbox/turn-tool-cancellation.ts
 var TURN_EXEC_YIELD_MS = 250;
@@ -24065,4 +24112,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-HHWIZHQM.js.map
+//# sourceMappingURL=chunk-GQIFSLAC.js.map