Context
PR #26 was closed as already applied after an --onto rebase proved that its three intended patches are already present in #10's squash commit a8aa101. The review threads on that PR remain unresolved, non-outdated, and independently reproducible on current main at f216b4706a0bfa5c90cc9b2c09898197ae8a4793.
This issue preserves those shipped defects after the source PR's closure. They are ranked by impact. No readiness or dispatch label is being applied, and no fix is being started while the live cloud#3143 production outage is in progress.
Findings
1. Required durable-state writes are unchecked
Original discussion: #26 (comment)
Current-main evidence: src/microsandbox/runtime.ts:207-221 in MICROSANDBOX_RUN_ADMIT_SCRIPT. The required cmd write and later pid write have no failure guard, while the script uses only set -u and continues to print ADMITTED.
A quota, disk-full, or I/O failure can therefore produce a successful admission response for a run whose durable command/PID state was not recorded. This is false success at the admission boundary; a failed post-launch PID write also needs to terminate the wrapper it just launched.
2. Empty session ID maps to the run-state root
Original discussion: #26 (comment)
Current-main evidence: src/microsandbox/runtime.ts:2754-2756 interpolates encodeRunSegment(sessionId) beneath runStateDir, and src/microsandbox/runtime.ts:2820-2827 returns an empty string unchanged.
For explicit sessionId: "", the per-run directory is the parent run-state root itself. Admission creates the parent and then cannot create the same directory as a run, producing a false conflict and corrupting the intended directory/state boundary.
3. Bounded E2B/Daytona logs omit truncation metadata
Original discussion: #26 (comment)
Current-main evidence:
src/e2b/runtime.ts:586-597 bounds reads through readBoundedFile but returns no RunScriptResult.truncated; src/e2b/runtime.ts:623-634 drops the marker when building ExecResult.src/daytona/runtime.ts:548-583 uses a bounded tail -c fallback without setting truncated; src/daytona/runtime.ts:610-619 drops it from ExecResult.
Callers can receive shortened output described as complete on both result planes.
4. Local adapter drops reconciled
Original discussion: #26 (comment)
Current-main evidence: src/local/runtime.ts:266-291 parses Partial<AsyncRunStartResult> but returns only sessionId and commandId.
When the async endpoint reports reconciled: true, the adapter discards the outcome marker, so callers cannot distinguish adoption of an existing exact run from a fresh admission.
5. Malformed UTF-16 aliases survive the code-point fix
Original discussion: #26 (comment)
Current-main evidence: src/microsandbox/runtime.ts:2820-2829 now correctly uses the Unicode-aware /u regex for valid code points, but still passes each matched string to Buffer.from(..., "utf8") and hashes over UTF-8 for the long-segment fallback.
The code-point fix landed and this case survives it: distinct unpaired surrogates and the literal replacement character normalize to the same U+FFFD UTF-8 bytes, so malformed-but-distinct session IDs can still alias durable state. Reject non-well-formed strings or use an injective encoding for malformed UTF-16.
Validation context
The current-main checkout passed the complete workflow-equivalent local suite on Node 22.22.1 / npm 10.9.4:
npm cinpm run test:packagenpm run typechecknpm test — 766 tests, 757 pass, 0 fail, 9 expected skips
Those green tests do not cover the five cases above; each needs a regression test when scheduled.
Context
PR #26 was closed as already applied after an
--ontorebase proved that its three intended patches are already present in #10's squash commita8aa101. The review threads on that PR remain unresolved, non-outdated, and independently reproducible on currentmainatf216b4706a0bfa5c90cc9b2c09898197ae8a4793.This issue preserves those shipped defects after the source PR's closure. They are ranked by impact. No readiness or dispatch label is being applied, and no fix is being started while the live
cloud#3143production outage is in progress.Findings
1. Required durable-state writes are unchecked
Original discussion: #26 (comment)
Current-main evidence:
src/microsandbox/runtime.ts:207-221inMICROSANDBOX_RUN_ADMIT_SCRIPT. The requiredcmdwrite and laterpidwrite have no failure guard, while the script uses onlyset -uand continues to printADMITTED.A quota, disk-full, or I/O failure can therefore produce a successful admission response for a run whose durable command/PID state was not recorded. This is false success at the admission boundary; a failed post-launch PID write also needs to terminate the wrapper it just launched.
2. Empty session ID maps to the run-state root
Original discussion: #26 (comment)
Current-main evidence:
src/microsandbox/runtime.ts:2754-2756interpolatesencodeRunSegment(sessionId)beneathrunStateDir, andsrc/microsandbox/runtime.ts:2820-2827returns an empty string unchanged.For explicit
sessionId: "", the per-run directory is the parent run-state root itself. Admission creates the parent and then cannot create the same directory as a run, producing a false conflict and corrupting the intended directory/state boundary.3. Bounded E2B/Daytona logs omit truncation metadata
Original discussion: #26 (comment)
Current-main evidence:
src/e2b/runtime.ts:586-597bounds reads throughreadBoundedFilebut returns noRunScriptResult.truncated;src/e2b/runtime.ts:623-634drops the marker when buildingExecResult.src/daytona/runtime.ts:548-583uses a boundedtail -cfallback without settingtruncated;src/daytona/runtime.ts:610-619drops it fromExecResult.Callers can receive shortened output described as complete on both result planes.
4. Local adapter drops
reconciledOriginal discussion: #26 (comment)
Current-main evidence:
src/local/runtime.ts:266-291parsesPartial<AsyncRunStartResult>but returns onlysessionIdandcommandId.When the async endpoint reports
reconciled: true, the adapter discards the outcome marker, so callers cannot distinguish adoption of an existing exact run from a fresh admission.5. Malformed UTF-16 aliases survive the code-point fix
Original discussion: #26 (comment)
Current-main evidence:
src/microsandbox/runtime.ts:2820-2829now correctly uses the Unicode-aware/uregex for valid code points, but still passes each matched string toBuffer.from(..., "utf8")and hashes over UTF-8 for the long-segment fallback.The code-point fix landed and this case survives it: distinct unpaired surrogates and the literal replacement character normalize to the same U+FFFD UTF-8 bytes, so malformed-but-distinct session IDs can still alias durable state. Reject non-well-formed strings or use an injective encoding for malformed UTF-16.
Validation context
The current-main checkout passed the complete workflow-equivalent local suite on Node 22.22.1 / npm 10.9.4:
npm cinpm run test:packagenpm run typechecknpm test— 766 tests, 757 pass, 0 fail, 9 expected skipsThose green tests do not cover the five cases above; each needs a regression test when scheduled.