tensorlake 0.5.13 → 0.5.17

package/dist/index.cjs

@@ -35,7 +35,7 @@ var SDK_VERSION, API_URL, API_KEY, NAMESPACE, SANDBOX_PROXY_URL, DEFAULT_HTTP_TI
 var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
-    SDK_VERSION = "0.5.13";
+    SDK_VERSION = "0.5.17";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -2995,6 +2995,15 @@ var init_url = __esm({
 });
 
 // src/sandbox.ts
+function processUserPayload(user) {
+  if (user == null) {
+    return DEFAULT_PROCESS_USER;
+  }
+  if (typeof user === "string" && user.trim() === "") {
+    throw new SandboxError("process user must not be empty");
+  }
+  return user;
+}
 function normalizePtyMessage(message) {
   if (Buffer.isBuffer(message)) return message;
   if (Array.isArray(message)) {
@@ -3018,7 +3027,7 @@ function sendPtyFrame(socket, frame) {
     socket.send(frame, (error) => error ? reject(error) : resolve());
   });
 }
-var import_ws2, PTY_OP_DATA, PTY_OP_RESIZE, PTY_OP_READY, PTY_OP_EXIT, Pty, Sandbox;
+var import_ws2, DEFAULT_PROCESS_USER, PTY_OP_DATA, PTY_OP_RESIZE, PTY_OP_READY, PTY_OP_EXIT, Pty, Sandbox;
 var init_sandbox = __esm({
   "src/sandbox.ts"() {
     "use strict";
@@ -3031,6 +3040,7 @@ var init_sandbox = __esm({
     init_sse();
     init_url();
     import_ws2 = __toESM(require("ws"), 1);
+    DEFAULT_PROCESS_USER = "tl-user";
     PTY_OP_DATA = 0;
     PTY_OP_RESIZE = 1;
     PTY_OP_READY = 2;
@@ -3451,6 +3461,8 @@ var init_sandbox = __esm({
         if (options?.env) body.env = options.env;
         if (options?.workingDir) body.working_dir = options.workingDir;
         if (options?.timeout != null) body.timeout = options.timeout;
+        const user = processUserPayload(options?.user);
+        body.user = user;
         const sseStream = await this.http.requestStream(
           "POST",
           "/api/v1/processes/run",
@@ -3494,6 +3506,8 @@ var init_sandbox = __esm({
         if (options?.args != null) payload.args = options.args;
         if (options?.env != null) payload.env = options.env;
         if (options?.workingDir != null) payload.working_dir = options.workingDir;
+        const user = processUserPayload(options?.user);
+        payload.user = user;
         if (options?.stdinMode != null && options.stdinMode !== "closed" /* CLOSED */) {
           payload.stdin_mode = options.stdinMode;
         }
@@ -5077,12 +5091,16 @@ function optionalNumber(object, key) {
   }
   return value;
 }
-async function runChecked(sandbox, command, args, env, workingDir) {
-  const result = await sandbox.run(command, {
+async function runChecked(sandbox, command, args, env, workingDir, user) {
+  const options = {
     args,
     env,
     workingDir
-  });
+  };
+  if (user != null) {
+    options.user = user;
+  }
+  const result = await sandbox.run(command, options);
   if (result.exitCode !== 0) {
     throw new Error(
       `Command '${command} ${args.join(" ")}' failed with exit code ${result.exitCode}`
@@ -5094,7 +5112,8 @@ async function runStreaming(sandbox, emit, sleep3, command, args = [], env, work
   const proc = await sandbox.startProcess(command, {
     args,
     env,
-    workingDir
+    workingDir,
+    user: ROOTFS_BUILDER_PROCESS_USER
   });
   let stdoutSeen = 0;
   let stderrSeen = 0;
@@ -5136,13 +5155,37 @@ function emitOutputLines(emit, stream, response, seen) {
     emit({ type: "build_log", stream, message: line });
   }
 }
+async function ensureRemoteBuildRoot(sandbox) {
+  await runChecked(
+    sandbox,
+    "mkdir",
+    ["-p", REMOTE_BUILD_DIR],
+    void 0,
+    void 0,
+    ROOTFS_BUILDER_PROCESS_USER
+  );
+  await runChecked(
+    sandbox,
+    "chmod",
+    ["0777", REMOTE_BUILD_DIR],
+    void 0,
+    void 0,
+    ROOTFS_BUILDER_PROCESS_USER
+  );
+}
+async function ensureRemoteDirectory(sandbox, remotePath) {
+  await runChecked(sandbox, "mkdir", ["-p", remotePath]);
+}
+async function ensureRemoteParentDir(sandbox, remotePath) {
+  await ensureRemoteDirectory(sandbox, import_node_path.default.posix.dirname(remotePath));
+}
 async function copyLocalPathToSandbox(sandbox, localPath, remotePath) {
   const fileStats = await (0, import_promises.stat)(localPath).catch(() => null);
   if (!fileStats) {
     throw new Error(`Local path not found: ${localPath}`);
   }
   if (fileStats.isFile()) {
-    await runChecked(sandbox, "mkdir", ["-p", import_node_path.default.posix.dirname(remotePath)]);
+    await ensureRemoteParentDir(sandbox, remotePath);
     await sandbox.writeFile(remotePath, await (0, import_promises.readFile)(localPath));
     return;
   }
@@ -5154,14 +5197,10 @@ async function copyLocalPathToSandbox(sandbox, localPath, remotePath) {
     const sourcePath = import_node_path.default.join(localPath, entry.name);
     const destinationPath = import_node_path.default.posix.join(remotePath, entry.name);
     if (entry.isDirectory()) {
-      await runChecked(sandbox, "mkdir", ["-p", destinationPath]);
+      await ensureRemoteDirectory(sandbox, destinationPath);
       await copyLocalPathToSandbox(sandbox, sourcePath, destinationPath);
     } else if (entry.isFile()) {
-      await runChecked(
-        sandbox,
-        "mkdir",
-        ["-p", import_node_path.default.posix.dirname(destinationPath)]
-      );
+      await ensureRemoteParentDir(sandbox, destinationPath);
       await sandbox.writeFile(destinationPath, await (0, import_promises.readFile)(sourcePath));
     }
   }
@@ -5258,6 +5297,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
       message: `Rootfs builder sandbox ${sandbox.sandboxId} is running`
     });
     emit({ type: "status", message: "Uploading build context..." });
+    await ensureRemoteBuildRoot(sandbox);
     await copyLocalPathToSandbox(sandbox, plan.contextDir, REMOTE_CONTEXT_DIR);
     const spec = await buildRootfsSpec(
       preparedSpec,
@@ -5265,7 +5305,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
       plan,
       options.diskMb
     );
-    await runChecked(sandbox, "mkdir", ["-p", import_node_path.default.posix.dirname(REMOTE_SPEC_PATH)]);
+    await ensureRemoteParentDir(sandbox, REMOTE_SPEC_PATH);
     await sandbox.writeFile(
       REMOTE_SPEC_PATH,
       new TextEncoder().encode(JSON.stringify(spec, null, 2))
@@ -5348,7 +5388,7 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
     { emit: ndjsonStdoutEmit }
   );
 }
-var import_promises, import_node_os, import_node_path, import_node_util, DEFAULT_ROOTFS_DISK_MB, REMOTE_BUILD_DIR, REMOTE_CONTEXT_DIR, REMOTE_SPEC_PATH, REMOTE_METADATA_PATH, ROOTFS_BUILDER_BIN_DIR, ROOTFS_BUILDER_PATH, ROOTFS_BUILDER_COMMAND, UNSUPPORTED_DOCKERFILE_INSTRUCTIONS;
+var import_promises, import_node_os, import_node_path, import_node_util, DEFAULT_ROOTFS_DISK_MB, REMOTE_BUILD_DIR, REMOTE_CONTEXT_DIR, REMOTE_SPEC_PATH, REMOTE_METADATA_PATH, ROOTFS_BUILDER_BIN_DIR, ROOTFS_BUILDER_PATH, ROOTFS_BUILDER_COMMAND, ROOTFS_BUILDER_PROCESS_USER, UNSUPPORTED_DOCKERFILE_INSTRUCTIONS;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     "use strict";
@@ -5367,6 +5407,7 @@ var init_sandbox_image = __esm({
     ROOTFS_BUILDER_BIN_DIR = "/usr/local/bin";
     ROOTFS_BUILDER_PATH = "/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
     ROOTFS_BUILDER_COMMAND = "tl-rootfs-build";
+    ROOTFS_BUILDER_PROCESS_USER = "root";
     UNSUPPORTED_DOCKERFILE_INSTRUCTIONS = /* @__PURE__ */ new Set([
       "ARG",
       "ONBUILD",