tensorlake 0.5.13 → 0.5.17

package/dist/sandbox-image.d.cts

@@ -1 +1 @@
-export { a3 as BuildContext, F as CreateSandboxImageOptions, I as DockerfileBuildPlan, J as DockerfileInstruction, Y as SandboxImageSource, a1 as createSandboxImage, a4 as defaultRegisteredName, a5 as loadDockerfilePlan, a6 as loadImagePlan, a7 as logicalDockerfileLines, a8 as registerImage, a9 as runCreateSandboxImageCli } from './sandbox-image-BepgJl5u.cjs';
+export { a5 as BuildContext, F as CreateSandboxImageOptions, I as DockerfileBuildPlan, J as DockerfileInstruction, _ as SandboxImageSource, a3 as createSandboxImage, a6 as defaultRegisteredName, a7 as loadDockerfilePlan, a8 as loadImagePlan, a9 as logicalDockerfileLines, aa as registerImage, ab as runCreateSandboxImageCli } from './sandbox-image-BBcx3bSx.cjs';

package/dist/sandbox-image.d.ts

@@ -1 +1 @@
-export { a3 as BuildContext, F as CreateSandboxImageOptions, I as DockerfileBuildPlan, J as DockerfileInstruction, Y as SandboxImageSource, a1 as createSandboxImage, a4 as defaultRegisteredName, a5 as loadDockerfilePlan, a6 as loadImagePlan, a7 as logicalDockerfileLines, a8 as registerImage, a9 as runCreateSandboxImageCli } from './sandbox-image-BepgJl5u.js';
+export { a5 as BuildContext, F as CreateSandboxImageOptions, I as DockerfileBuildPlan, J as DockerfileInstruction, _ as SandboxImageSource, a3 as createSandboxImage, a6 as defaultRegisteredName, a7 as loadDockerfilePlan, a8 as loadImagePlan, a9 as logicalDockerfileLines, aa as registerImage, ab as runCreateSandboxImageCli } from './sandbox-image-BBcx3bSx.js';

package/dist/sandbox-image.js

@@ -61,7 +61,7 @@ var SDK_VERSION, API_URL, API_KEY, NAMESPACE, SANDBOX_PROXY_URL, DEFAULT_HTTP_TI
 var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
-    SDK_VERSION = "0.5.13";
+    SDK_VERSION = "0.5.17";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -2916,6 +2916,15 @@ var init_url = __esm({
 
 // src/sandbox.ts
 import WebSocket2 from "ws";
+function processUserPayload(user) {
+  if (user == null) {
+    return DEFAULT_PROCESS_USER;
+  }
+  if (typeof user === "string" && user.trim() === "") {
+    throw new SandboxError("process user must not be empty");
+  }
+  return user;
+}
 function normalizePtyMessage(message) {
   if (Buffer.isBuffer(message)) return message;
   if (Array.isArray(message)) {
@@ -2939,7 +2948,7 @@ function sendPtyFrame(socket, frame) {
     socket.send(frame, (error) => error ? reject(error) : resolve());
   });
 }
-var PTY_OP_DATA, PTY_OP_RESIZE, PTY_OP_READY, PTY_OP_EXIT, Pty, Sandbox;
+var DEFAULT_PROCESS_USER, PTY_OP_DATA, PTY_OP_RESIZE, PTY_OP_READY, PTY_OP_EXIT, Pty, Sandbox;
 var init_sandbox = __esm({
   "src/sandbox.ts"() {
     "use strict";
@@ -2951,6 +2960,7 @@ var init_sandbox = __esm({
     init_tunnel();
     init_sse();
     init_url();
+    DEFAULT_PROCESS_USER = "tl-user";
     PTY_OP_DATA = 0;
     PTY_OP_RESIZE = 1;
     PTY_OP_READY = 2;
@@ -3371,6 +3381,8 @@ var init_sandbox = __esm({
         if (options?.env) body.env = options.env;
         if (options?.workingDir) body.working_dir = options.workingDir;
         if (options?.timeout != null) body.timeout = options.timeout;
+        const user = processUserPayload(options?.user);
+        body.user = user;
         const sseStream = await this.http.requestStream(
           "POST",
           "/api/v1/processes/run",
@@ -3414,6 +3426,8 @@ var init_sandbox = __esm({
         if (options?.args != null) payload.args = options.args;
         if (options?.env != null) payload.env = options.env;
         if (options?.workingDir != null) payload.working_dir = options.workingDir;
+        const user = processUserPayload(options?.user);
+        payload.user = user;
         if (options?.stdinMode != null && options.stdinMode !== "closed" /* CLOSED */) {
           payload.stdin_mode = options.stdinMode;
         }
@@ -4897,12 +4911,16 @@ function optionalNumber(object, key) {
   }
   return value;
 }
-async function runChecked(sandbox, command, args, env, workingDir) {
-  const result = await sandbox.run(command, {
+async function runChecked(sandbox, command, args, env, workingDir, user) {
+  const options = {
     args,
     env,
     workingDir
-  });
+  };
+  if (user != null) {
+    options.user = user;
+  }
+  const result = await sandbox.run(command, options);
   if (result.exitCode !== 0) {
     throw new Error(
       `Command '${command} ${args.join(" ")}' failed with exit code ${result.exitCode}`
@@ -4914,7 +4932,8 @@ async function runStreaming(sandbox, emit, sleep3, command, args = [], env, work
   const proc = await sandbox.startProcess(command, {
     args,
     env,
-    workingDir
+    workingDir,
+    user: ROOTFS_BUILDER_PROCESS_USER
   });
   let stdoutSeen = 0;
   let stderrSeen = 0;
@@ -4956,13 +4975,37 @@ function emitOutputLines(emit, stream, response, seen) {
     emit({ type: "build_log", stream, message: line });
   }
 }
+async function ensureRemoteBuildRoot(sandbox) {
+  await runChecked(
+    sandbox,
+    "mkdir",
+    ["-p", REMOTE_BUILD_DIR],
+    void 0,
+    void 0,
+    ROOTFS_BUILDER_PROCESS_USER
+  );
+  await runChecked(
+    sandbox,
+    "chmod",
+    ["0777", REMOTE_BUILD_DIR],
+    void 0,
+    void 0,
+    ROOTFS_BUILDER_PROCESS_USER
+  );
+}
+async function ensureRemoteDirectory(sandbox, remotePath) {
+  await runChecked(sandbox, "mkdir", ["-p", remotePath]);
+}
+async function ensureRemoteParentDir(sandbox, remotePath) {
+  await ensureRemoteDirectory(sandbox, path.posix.dirname(remotePath));
+}
 async function copyLocalPathToSandbox(sandbox, localPath, remotePath) {
   const fileStats = await stat(localPath).catch(() => null);
   if (!fileStats) {
     throw new Error(`Local path not found: ${localPath}`);
   }
   if (fileStats.isFile()) {
-    await runChecked(sandbox, "mkdir", ["-p", path.posix.dirname(remotePath)]);
+    await ensureRemoteParentDir(sandbox, remotePath);
     await sandbox.writeFile(remotePath, await readFile(localPath));
     return;
   }
@@ -4974,14 +5017,10 @@ async function copyLocalPathToSandbox(sandbox, localPath, remotePath) {
     const sourcePath = path.join(localPath, entry.name);
     const destinationPath = path.posix.join(remotePath, entry.name);
     if (entry.isDirectory()) {
-      await runChecked(sandbox, "mkdir", ["-p", destinationPath]);
+      await ensureRemoteDirectory(sandbox, destinationPath);
       await copyLocalPathToSandbox(sandbox, sourcePath, destinationPath);
     } else if (entry.isFile()) {
-      await runChecked(
-        sandbox,
-        "mkdir",
-        ["-p", path.posix.dirname(destinationPath)]
-      );
+      await ensureRemoteParentDir(sandbox, destinationPath);
       await sandbox.writeFile(destinationPath, await readFile(sourcePath));
     }
   }
@@ -5078,6 +5117,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
       message: `Rootfs builder sandbox ${sandbox.sandboxId} is running`
     });
     emit({ type: "status", message: "Uploading build context..." });
+    await ensureRemoteBuildRoot(sandbox);
     await copyLocalPathToSandbox(sandbox, plan.contextDir, REMOTE_CONTEXT_DIR);
     const spec = await buildRootfsSpec(
       preparedSpec,
@@ -5085,7 +5125,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
       plan,
       options.diskMb
     );
-    await runChecked(sandbox, "mkdir", ["-p", path.posix.dirname(REMOTE_SPEC_PATH)]);
+    await ensureRemoteParentDir(sandbox, REMOTE_SPEC_PATH);
     await sandbox.writeFile(
       REMOTE_SPEC_PATH,
       new TextEncoder().encode(JSON.stringify(spec, null, 2))
@@ -5168,7 +5208,7 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
     { emit: ndjsonStdoutEmit }
   );
 }
-var DEFAULT_ROOTFS_DISK_MB, REMOTE_BUILD_DIR, REMOTE_CONTEXT_DIR, REMOTE_SPEC_PATH, REMOTE_METADATA_PATH, ROOTFS_BUILDER_BIN_DIR, ROOTFS_BUILDER_PATH, ROOTFS_BUILDER_COMMAND, UNSUPPORTED_DOCKERFILE_INSTRUCTIONS;
+var DEFAULT_ROOTFS_DISK_MB, REMOTE_BUILD_DIR, REMOTE_CONTEXT_DIR, REMOTE_SPEC_PATH, REMOTE_METADATA_PATH, ROOTFS_BUILDER_BIN_DIR, ROOTFS_BUILDER_PATH, ROOTFS_BUILDER_COMMAND, ROOTFS_BUILDER_PROCESS_USER, UNSUPPORTED_DOCKERFILE_INSTRUCTIONS;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     init_models();
@@ -5182,6 +5222,7 @@ var init_sandbox_image = __esm({
     ROOTFS_BUILDER_BIN_DIR = "/usr/local/bin";
     ROOTFS_BUILDER_PATH = "/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
     ROOTFS_BUILDER_COMMAND = "tl-rootfs-build";
+    ROOTFS_BUILDER_PROCESS_USER = "root";
     UNSUPPORTED_DOCKERFILE_INSTRUCTIONS = /* @__PURE__ */ new Set([
       "ARG",
       "ONBUILD",