feat(sbx,ai): snapshot all backends w/ local export; robust AI + rejoin
- /sbx save [--local] and new /sbx vmsave/vmsnaps: snapshot Docker, Multipass, and VirtualBox; --local also writes a portable artifact (docker .tar / VBox .ova) under hh-snapshots/ that survives pruning. - sandbox reappears for anyone who leaves and rejoins (host replays status + screen snapshot + ACL on Joined); SbxStatus ready handler is now idempotent so it never wipes scrollback. - received files auto-bridge into the hosted sandbox (ft::tar_path). - AI agent: translate Ollama's cryptic 404 into model/host/fix guidance. - bootstrap installs the AI layer (Ollama + default model) by default, with consent gates; --no-ai opts out, --yes skips prompts. - help menu lists the new save/vm flags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
+162
-22
@@ -374,11 +374,25 @@ impl App {
|
||||
cols,
|
||||
} => {
|
||||
if ready {
|
||||
self.sandbox = Some(SbxView {
|
||||
parser: vt100::Parser::new(rows.max(1), cols.max(1), 2000),
|
||||
backend: backend.clone(),
|
||||
});
|
||||
self.sys(format!("⛧ sandbox summoned ({backend}) — F2 to drive"));
|
||||
// Converge on the shared shell. If we already track this
|
||||
// sandbox, just match its size — recreating the parser would
|
||||
// wipe scrollback and re-announce on every re-broadcast. The
|
||||
// owner re-sends `status:ready` whenever a member (re)joins, so
|
||||
// this MUST be idempotent for everyone already in the room; only
|
||||
// a genuinely new sandbox (none yet) is created and announced.
|
||||
match &mut self.sandbox {
|
||||
Some(v) => {
|
||||
v.parser.set_size(rows.max(1), cols.max(1));
|
||||
v.backend = backend.clone();
|
||||
}
|
||||
None => {
|
||||
self.sandbox = Some(SbxView {
|
||||
parser: vt100::Parser::new(rows.max(1), cols.max(1), 2000),
|
||||
backend: backend.clone(),
|
||||
});
|
||||
self.sys(format!("⛧ sandbox summoned ({backend}) — F2 to drive"));
|
||||
}
|
||||
}
|
||||
} else {
|
||||
self.sandbox = None;
|
||||
self.driving = false;
|
||||
@@ -534,11 +548,14 @@ fn handle_ft(
|
||||
out: &UnboundedSender<WsMsg>,
|
||||
room: &Arc<fernet::Fernet>,
|
||||
downloads: &std::path::Path,
|
||||
) {
|
||||
) -> Option<std::path::PathBuf> {
|
||||
// Set to the saved path when a transfer completes & verifies, so the caller
|
||||
// can auto-bridge it into a running sandbox.
|
||||
let mut saved = None;
|
||||
match f {
|
||||
ft::Ft::Offer(o) => {
|
||||
if o.from == app.me {
|
||||
return; // our own offer echo
|
||||
return None; // our own offer echo
|
||||
}
|
||||
app.sys(format!(
|
||||
"⛧ {} offers {} ({}{}) — /accept or /reject",
|
||||
@@ -604,11 +621,14 @@ fn handle_ft(
|
||||
app.err(format!("{} — SHA-256 mismatch, discarded", t.meta.name));
|
||||
} else {
|
||||
match ft::save(downloads, &t.meta, &t.buf) {
|
||||
Ok(p) => app.sys(format!(
|
||||
"⛧ saved {} ({}) — verified ✓",
|
||||
p.display(),
|
||||
ft::human(t.buf.len())
|
||||
)),
|
||||
Ok(p) => {
|
||||
app.sys(format!(
|
||||
"⛧ saved {} ({}) — verified ✓",
|
||||
p.display(),
|
||||
ft::human(t.buf.len())
|
||||
));
|
||||
saved = Some(p);
|
||||
}
|
||||
Err(e) => app.err(format!("save failed: {e}")),
|
||||
}
|
||||
}
|
||||
@@ -624,6 +644,7 @@ fn handle_ft(
|
||||
}
|
||||
}
|
||||
}
|
||||
saved
|
||||
}
|
||||
|
||||
/// Put the terminal back the way we found it: leave raw mode, leave the
|
||||
@@ -970,7 +991,42 @@ pub async fn run(params: net::ConnParams, mut session: Session, mut theme: Theme
|
||||
}
|
||||
}
|
||||
}
|
||||
Net::Ft(f) => handle_ft(f, &mut app, &mut active_send, &out_tx, &session.room, &downloads),
|
||||
Net::Ft(f) => {
|
||||
// On a received, SHA-verified file, auto-bridge it into
|
||||
// a sandbox we host so the whole clergy can use it from
|
||||
// the shared shell. Runs off the UI thread (docker/mp
|
||||
// exec + tar stream) and reports back via the app channel.
|
||||
// A local backend already shares the host fs — nothing to do.
|
||||
if let Some(path) =
|
||||
handle_ft(f, &mut app, &mut active_send, &out_tx, &session.room, &downloads)
|
||||
{
|
||||
if let Some((be, name)) = &broker_meta {
|
||||
if !matches!(be, sbx::Backend::Local) {
|
||||
let (be, name) = (*be, name.clone());
|
||||
let run_user = sbx::run_user_for(
|
||||
be,
|
||||
app.owner.as_deref().unwrap_or(app.me.as_str()),
|
||||
);
|
||||
let tx = app_tx.clone();
|
||||
tokio::spawn(async move {
|
||||
let res = tokio::task::spawn_blocking(move || {
|
||||
sbx::push(be, &name, &run_user, &path)
|
||||
})
|
||||
.await;
|
||||
let _ = match res {
|
||||
Ok(Ok(dest)) => tx.send(Net::Sys(format!(
|
||||
"⛧ bridged into sandbox → {dest}"
|
||||
))),
|
||||
Ok(Err(e)) => tx.send(Net::Sys(format!(
|
||||
"(received file not bridged into sandbox: {e})"
|
||||
))),
|
||||
Err(e) => tx.send(Net::Err(format!("bridge task: {e}"))),
|
||||
};
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// The broker renders its sandbox locally from the PTY, so it
|
||||
// ignores its own echoed status/data; everyone else uses them.
|
||||
Net::SbxData(b) => {
|
||||
@@ -980,12 +1036,27 @@ pub async fn run(params: net::ConnParams, mut session: Session, mut theme: Theme
|
||||
}
|
||||
Net::SbxStatus { .. } if broker.is_some() => {}
|
||||
ev @ Net::Joined(_) => {
|
||||
// A late joiner (e.g. a just-summoned agent) missed any
|
||||
// ACL broadcast sent before they connected. If we host the
|
||||
// sandbox, re-broadcast so their local grant state syncs —
|
||||
// this is what makes `/ai start <m> allow` actually reach
|
||||
// the agent.
|
||||
// Someone (re)entered and missed everything broadcast
|
||||
// before they connected. If we host the sandbox, replay
|
||||
// it so it reappears for them: `status:ready` makes the
|
||||
// pane show up, the screen snapshot (`_sbx:data`) paints
|
||||
// its current contents instead of a blank pane, and the
|
||||
// ACL re-broadcast re-syncs grant state (also what makes
|
||||
// `/ai start <m> allow` reach a freshly-joined agent).
|
||||
// The status/data handlers are idempotent, so members
|
||||
// already in the room aren't disturbed by the replay.
|
||||
if broker.is_some() {
|
||||
if let (Some(v), Some((be, _))) = (&app.sandbox, &broker_meta) {
|
||||
let (rows, cols) = v.parser.screen().size();
|
||||
send_frame(&out_tx, &session.room, json!({
|
||||
"_sbx":"status","state":"ready",
|
||||
"backend": be.label(),"rows": rows,"cols": cols
|
||||
}));
|
||||
let snap = v.parser.screen().contents_formatted();
|
||||
send_frame(&out_tx, &session.room, json!({
|
||||
"_sbx":"data","b64": STANDARD.encode(&snap)
|
||||
}));
|
||||
}
|
||||
broadcast_acl(&out_tx, &session.room, &app);
|
||||
}
|
||||
app.apply(ev);
|
||||
@@ -1360,14 +1431,28 @@ fn handle_command(
|
||||
}
|
||||
}
|
||||
Some("save") => {
|
||||
let label = p.next().unwrap_or("snap").to_string();
|
||||
// `--local` (alias `-l`) also writes a portable, standalone copy
|
||||
// under hh-snapshots/ (a docker `.tar`) the saver fully owns; the
|
||||
// default keeps just the in-backend snapshot. The label is the
|
||||
// first non-flag arg.
|
||||
let args: Vec<&str> = p.collect();
|
||||
let local = args.iter().any(|a| matches!(*a, "--local" | "-l"));
|
||||
let label = args
|
||||
.iter()
|
||||
.copied()
|
||||
.find(|a| !a.starts_with('-'))
|
||||
.unwrap_or("snap")
|
||||
.to_string();
|
||||
if !is_snap_label(&label) {
|
||||
app.sys("snapshot label must be alphanumerics, '.', '_' or '-'");
|
||||
} else if let Some((be, name)) = broker_meta.clone() {
|
||||
app.sys(format!("saving sandbox state as '{label}'…"));
|
||||
app.sys(format!(
|
||||
"saving sandbox state as '{label}'{}…",
|
||||
if local { " (+ local copy)" } else { "" }
|
||||
));
|
||||
let (tx, lbl) = (app_tx.clone(), label.clone());
|
||||
tokio::spawn(async move {
|
||||
let res = tokio::task::spawn_blocking(move || sbx::save_state(be, &name, &label)).await;
|
||||
let res = tokio::task::spawn_blocking(move || sbx::save_state(be, &name, &label, local)).await;
|
||||
let _ = match res {
|
||||
Ok(Ok(desc)) => tx.send(Net::Sys(format!(
|
||||
"⛧ saved sandbox → {desc} · reload with `/sbx load {lbl}`"))),
|
||||
@@ -1447,6 +1532,61 @@ fn handle_command(
|
||||
};
|
||||
});
|
||||
}
|
||||
Some("vmsave") => {
|
||||
// Snapshot a local VirtualBox VM. `--local` (alias `-l`) also
|
||||
// exports a portable `.ova` appliance under hh-snapshots/.
|
||||
let args: Vec<&str> = p.collect();
|
||||
let local = args.iter().any(|a| matches!(*a, "--local" | "-l"));
|
||||
let mut pos = args.iter().copied().filter(|a| !a.starts_with('-'));
|
||||
match pos.next() {
|
||||
None => app.sys(
|
||||
"usage: /sbx vmsave <vm> [label] [--local] (snapshot a VirtualBox VM; list VMs with /sbx vms)",
|
||||
),
|
||||
Some(vm) => {
|
||||
let label = pos.next().unwrap_or("snap").to_string();
|
||||
if !is_snap_label(&label) {
|
||||
app.sys("snapshot label must be alphanumerics, '.', '_' or '-'");
|
||||
} else {
|
||||
app.sys(format!(
|
||||
"snapshotting VM '{vm}' as '{label}'{}…",
|
||||
if local { " (+ local .ova)" } else { "" }
|
||||
));
|
||||
let (tx, vm) = (app_tx.clone(), vm.to_string());
|
||||
tokio::spawn(async move {
|
||||
let res = tokio::task::spawn_blocking(move || {
|
||||
sbx::vm_save_state(&vm, &label, local)
|
||||
})
|
||||
.await;
|
||||
let _ = match res {
|
||||
Ok(Ok(desc)) => tx.send(Net::Sys(format!("⛧ saved VM → {desc}"))),
|
||||
Ok(Err(e)) => tx.send(Net::Err(format!("vmsave failed: {e}"))),
|
||||
Err(e) => tx.send(Net::Err(format!("vmsave task: {e}"))),
|
||||
};
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Some("vmsnaps") => {
|
||||
match p.next() {
|
||||
None => app.sys("usage: /sbx vmsnaps <vm> (list a VirtualBox VM's snapshots)"),
|
||||
Some(vm) => {
|
||||
let (tx, vm) = (app_tx.clone(), vm.to_string());
|
||||
tokio::spawn(async move {
|
||||
let res = tokio::task::spawn_blocking(move || sbx::vm_snapshots(&vm)).await;
|
||||
let _ = match res {
|
||||
Ok(Ok(v)) if !v.is_empty() => {
|
||||
tx.send(Net::Sys(format!("VM snapshots: {}", v.join(", "))))
|
||||
}
|
||||
Ok(Ok(_)) => tx.send(Net::Sys(
|
||||
"no VM snapshots yet — `/sbx vmsave <vm> [label]` to make one".into())),
|
||||
Ok(Err(e)) => tx.send(Net::Err(format!("vmsnaps: {e}"))),
|
||||
Err(e) => tx.send(Net::Err(format!("vmsnaps task: {e}"))),
|
||||
};
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
Some("gui") => {
|
||||
let gargs: Vec<&str> = p.collect();
|
||||
let first = gargs.iter().copied().find(|a| !a.starts_with('-'));
|
||||
@@ -1511,7 +1651,7 @@ fn handle_command(
|
||||
}
|
||||
}
|
||||
_ => app.sys(
|
||||
"usage: /sbx launch [local|docker|multipass] [image] · gui <vm> · vms · stop · save [label] · load <label> · snaps",
|
||||
"usage: /sbx launch [local|docker|multipass] [image] · gui <vm> · vms · stop · save [label] [--local] · load <label> · snaps · vmsave <vm> [label] [--local] · vmsnaps <vm>",
|
||||
),
|
||||
}
|
||||
} else if let Some(rest) = line.strip_prefix("/unsudo") {
|
||||
|
||||
@@ -88,6 +88,31 @@ fn tar_dir(dir: &Path) -> Result<Vec<u8>> {
|
||||
Ok(buf)
|
||||
}
|
||||
|
||||
/// Tar any local path (file or directory) to bytes for injecting into a
|
||||
/// sandbox — the archive's single top-level entry is named after the path's
|
||||
/// basename, so it extracts as `<dest>/<base>`. Enforces `MAX_SIZE`. Returns
|
||||
/// `(base_name, tar_bytes)`.
|
||||
pub fn tar_path(path: &Path) -> Result<(String, Vec<u8>)> {
|
||||
let meta = std::fs::metadata(path).with_context(|| format!("not found: {}", path.display()))?;
|
||||
let base = path
|
||||
.file_name()
|
||||
.and_then(|s| s.to_str())
|
||||
.context("path has no final component")?
|
||||
.to_string();
|
||||
let mut buf = Vec::new();
|
||||
{
|
||||
let mut tb = tar::Builder::new(&mut buf);
|
||||
if meta.is_dir() {
|
||||
tb.append_dir_all(&base, path).context("tar directory")?;
|
||||
} else {
|
||||
tb.append_path_with_name(path, &base).context("tar file")?;
|
||||
}
|
||||
tb.finish()?;
|
||||
}
|
||||
anyhow::ensure!(buf.len() <= MAX_SIZE, "too large ({})", human(buf.len()));
|
||||
Ok((base, buf))
|
||||
}
|
||||
|
||||
/// Persist received bytes under `downloads`. Directories (tar) are extracted
|
||||
/// with a guard rejecting absolute paths and `..` escapes (zip-slip).
|
||||
pub fn save(downloads: &Path, offer: &Offer, data: &[u8]) -> Result<PathBuf> {
|
||||
|
||||
+185
-1
@@ -428,6 +428,19 @@ pub fn teardown(backend: Backend, name: &str) {
|
||||
/// (`hh-snap:<label>`). Owner-side only — never pushed anywhere.
|
||||
pub const SNAP_REPO: &str = "hh-snap";
|
||||
|
||||
/// Directory (relative to the working dir) where portable snapshot artifacts
|
||||
/// land when the saver opts into a local file copy (`/sbx save … --local`).
|
||||
/// Created on demand. These are standalone files the owner keeps — they survive
|
||||
/// even if the in-backend image/snapshot is later pruned.
|
||||
pub const SNAP_DIR: &str = "hh-snapshots";
|
||||
|
||||
/// Ensure `hh-snapshots/` exists and return it. Blocking.
|
||||
fn snap_dir() -> Result<std::path::PathBuf> {
|
||||
let dir = std::path::PathBuf::from(SNAP_DIR);
|
||||
std::fs::create_dir_all(&dir).with_context(|| format!("creating {SNAP_DIR}/"))?;
|
||||
Ok(dir)
|
||||
}
|
||||
|
||||
/// Snapshot the running sandbox's filesystem state to a named artifact on the
|
||||
/// owner's machine. Blocking — run off the UI thread.
|
||||
///
|
||||
@@ -439,8 +452,15 @@ pub const SNAP_REPO: &str = "hh-snap";
|
||||
/// error is surfaced verbatim.
|
||||
/// - **Local:** no backing VM/container, so nothing to save.
|
||||
///
|
||||
/// `local` adds a portable, standalone copy under `hh-snapshots/` (a file the
|
||||
/// owner fully controls) on top of the in-backend snapshot:
|
||||
/// - **Docker:** `docker save` the committed image to a `.tar`.
|
||||
/// - **Multipass:** snapshots already live on this host under multipass's own
|
||||
/// data dir; the CLI has no single-file export, so we note that and skip the
|
||||
/// extra file rather than fake one.
|
||||
///
|
||||
/// Returns a short human description of what was written on success.
|
||||
pub fn save_state(backend: Backend, name: &str, label: &str) -> Result<String> {
|
||||
pub fn save_state(backend: Backend, name: &str, label: &str, local: bool) -> Result<String> {
|
||||
match backend {
|
||||
Backend::Docker => {
|
||||
let tag = format!("{SNAP_REPO}:{label}");
|
||||
@@ -455,6 +475,22 @@ pub fn save_state(backend: Backend, name: &str, label: &str) -> Result<String> {
|
||||
err.lines().last().unwrap_or("").trim()
|
||||
);
|
||||
}
|
||||
if local {
|
||||
let path = snap_dir()?.join(format!("hh-snap-{label}.tar"));
|
||||
let out = Command::new("docker")
|
||||
.args(["save", &tag, "-o"])
|
||||
.arg(&path)
|
||||
.output()
|
||||
.context("docker save")?;
|
||||
if !out.status.success() {
|
||||
let err = String::from_utf8_lossy(&out.stderr);
|
||||
anyhow::bail!(
|
||||
"image {tag} committed, but local export failed: {}",
|
||||
err.lines().last().unwrap_or("").trim()
|
||||
);
|
||||
}
|
||||
return Ok(format!("image {tag} + local file {}", path.display()));
|
||||
}
|
||||
Ok(format!("image {tag}"))
|
||||
}
|
||||
Backend::Multipass => {
|
||||
@@ -469,6 +505,13 @@ pub fn save_state(backend: Backend, name: &str, label: &str) -> Result<String> {
|
||||
err.lines().last().unwrap_or("").trim()
|
||||
);
|
||||
}
|
||||
if local {
|
||||
// multipass stores snapshots on this host already; no portable
|
||||
// single-file export exists in the CLI, so be honest about it.
|
||||
return Ok(format!(
|
||||
"snapshot {name}.{label} (already stored locally by multipass; no portable file)"
|
||||
));
|
||||
}
|
||||
Ok(format!("snapshot {name}.{label}"))
|
||||
}
|
||||
Backend::Local => {
|
||||
@@ -477,6 +520,74 @@ pub fn save_state(backend: Backend, name: &str, label: &str) -> Result<String> {
|
||||
}
|
||||
}
|
||||
|
||||
/// Snapshot a VirtualBox VM's state. VirtualBox isn't a brokered `Backend` (its
|
||||
/// GUI runs locally, never relayed), so it has its own save path. Blocking.
|
||||
///
|
||||
/// `VBoxManage snapshot <vm> take <label>` works whether the VM is running
|
||||
/// (live snapshot) or powered off. `local` additionally exports the whole VM to
|
||||
/// a portable `.ova` appliance under `hh-snapshots/` — the standalone artifact
|
||||
/// you'd hand to someone else (or re-import yourself) via `/sbx gui`.
|
||||
pub fn vm_save_state(vm: &str, label: &str, local: bool) -> Result<String> {
|
||||
let out = Command::new("VBoxManage")
|
||||
.args(["snapshot", vm, "take", label])
|
||||
.output()
|
||||
.context("VBoxManage snapshot take (is VirtualBox installed?)")?;
|
||||
if !out.status.success() {
|
||||
let err = String::from_utf8_lossy(&out.stderr);
|
||||
anyhow::bail!(
|
||||
"VBoxManage snapshot failed: {}",
|
||||
err.lines().last().unwrap_or("").trim()
|
||||
);
|
||||
}
|
||||
if local {
|
||||
let path = snap_dir()?.join(format!("{vm}-{label}.ova"));
|
||||
let out = Command::new("VBoxManage")
|
||||
.args(["export", vm, "-o"])
|
||||
.arg(&path)
|
||||
.output()
|
||||
.context("VBoxManage export")?;
|
||||
if !out.status.success() {
|
||||
let err = String::from_utf8_lossy(&out.stderr);
|
||||
anyhow::bail!(
|
||||
"snapshot '{label}' taken, but OVA export failed: {}",
|
||||
err.lines().last().unwrap_or("").trim()
|
||||
);
|
||||
}
|
||||
return Ok(format!("snapshot '{label}' + local appliance {}", path.display()));
|
||||
}
|
||||
Ok(format!("snapshot '{label}' of {vm}"))
|
||||
}
|
||||
|
||||
/// Snapshot names for a VirtualBox VM (`VBoxManage snapshot <vm> list
|
||||
/// --machinereadable` → `SnapshotName*="..."` lines). Blocking. An empty list
|
||||
/// (exit 1 "does not have any snapshots") is reported as no snapshots, not an
|
||||
/// error.
|
||||
pub fn vm_snapshots(vm: &str) -> Result<Vec<String>> {
|
||||
let out = Command::new("VBoxManage")
|
||||
.args(["snapshot", vm, "list", "--machinereadable"])
|
||||
.output()
|
||||
.context("VBoxManage snapshot list (is VirtualBox installed?)")?;
|
||||
if !out.status.success() {
|
||||
let err = String::from_utf8_lossy(&out.stderr);
|
||||
if err.contains("does not have any snapshots") {
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
anyhow::bail!(
|
||||
"VBoxManage snapshot list failed: {}",
|
||||
err.lines().last().unwrap_or("").trim()
|
||||
);
|
||||
}
|
||||
Ok(String::from_utf8_lossy(&out.stdout)
|
||||
.lines()
|
||||
.filter_map(|l| {
|
||||
let v = l.strip_prefix("SnapshotName")?;
|
||||
let q = v.split_once('=')?.1.trim();
|
||||
Some(q.trim_matches('"').to_string())
|
||||
})
|
||||
.filter(|s| !s.is_empty())
|
||||
.collect())
|
||||
}
|
||||
|
||||
/// List saved snapshot labels for a backend (Docker image tags under
|
||||
/// `hh-snap`, or multipass snapshots of the instance). Blocking.
|
||||
pub fn list_snapshots(backend: Backend, name: &str) -> Result<Vec<String>> {
|
||||
@@ -637,6 +748,79 @@ pub fn set_sudo(backend: Backend, name: &str, user: &str, enable: bool) {
|
||||
}
|
||||
}
|
||||
|
||||
/// The unix user the shared shell runs as for a backend — mirrors `provision`'s
|
||||
/// return (owner on Multipass, root on Docker, none on Local) but side-effect
|
||||
/// free, so callers like file-push can resolve the destination home without
|
||||
/// threading extra state through the broker.
|
||||
pub fn run_user_for(backend: Backend, owner: &str) -> String {
|
||||
match backend {
|
||||
Backend::Multipass => unix_name(owner),
|
||||
Backend::Docker => "root".to_string(),
|
||||
Backend::Local => String::new(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Inject a local file/dir into the running sandbox, dropping it under the
|
||||
/// shared shell user's home and leaving it owned by that user. The path is
|
||||
/// streamed in as a tar (built + size-capped by `ft::tar_path`) and unpacked by
|
||||
/// `tar` inside the container/VM — uniform for files and directories, and no
|
||||
/// shell interpolation of the path. Blocking — run off the UI thread. Returns
|
||||
/// the in-sandbox destination path on success.
|
||||
pub fn push(backend: Backend, name: &str, run_user: &str, local: &std::path::Path) -> Result<String> {
|
||||
let (base, tar) = crate::ft::tar_path(local)?;
|
||||
match backend {
|
||||
Backend::Local => anyhow::bail!(
|
||||
"local sandbox shares the host filesystem — {} is already reachable",
|
||||
local.display()
|
||||
),
|
||||
Backend::Docker => {
|
||||
// Shell runs as root with $HOME=/root (see `prepare`'s `-w /root`).
|
||||
let mut c = Command::new("docker");
|
||||
c.args(["exec", "-i", name, "tar", "-C", "/root", "-xf", "-"]);
|
||||
extract_tar(c, &tar)?;
|
||||
Ok(format!("/root/{base}"))
|
||||
}
|
||||
Backend::Multipass => {
|
||||
let home = format!("/home/{run_user}");
|
||||
let mut c = Command::new("multipass");
|
||||
c.args(["exec", name, "--", "sudo", "tar", "-C", &home, "-xf", "-"]);
|
||||
extract_tar(c, &tar)?;
|
||||
// Hand ownership to the account whose login shell the clergy share
|
||||
// (the tar unpacked as root via sudo).
|
||||
let owns = format!("{run_user}:{run_user}");
|
||||
let target = format!("{home}/{base}");
|
||||
mp(name, &["sudo", "chown", "-R", &owns, &target]);
|
||||
Ok(target)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Feed `tar` bytes to a `tar -x` process over stdin, surfacing the extractor's
|
||||
/// own last error line on failure.
|
||||
fn extract_tar(mut cmd: Command, tar: &[u8]) -> Result<()> {
|
||||
cmd.stdin(Stdio::piped())
|
||||
.stdout(Stdio::null())
|
||||
.stderr(Stdio::piped());
|
||||
let mut child = cmd
|
||||
.spawn()
|
||||
.context("spawn tar extractor (is the backend CLI installed?)")?;
|
||||
{
|
||||
let mut si = child.stdin.take().context("tar stdin")?;
|
||||
si.write_all(tar).context("stream tar to sandbox")?;
|
||||
} // drop closes stdin → tar sees EOF and finishes
|
||||
let out = child.wait_with_output().context("await tar extractor")?;
|
||||
anyhow::ensure!(
|
||||
out.status.success(),
|
||||
"extract failed: {}",
|
||||
String::from_utf8_lossy(&out.stderr)
|
||||
.lines()
|
||||
.last()
|
||||
.unwrap_or("")
|
||||
.trim()
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub struct Sandbox {
|
||||
// Held for the PTY's lifetime (dropping it closes the terminal) + resize.
|
||||
#[allow(dead_code)]
|
||||
|
||||
+7
-2
@@ -155,8 +155,8 @@ fn help_clusters(theme: &Theme) -> Vec<HelpCluster> {
|
||||
),
|
||||
kv("/sbx stop", "tear down the sandbox (purges the VM)"),
|
||||
kv(
|
||||
"/sbx save [label]",
|
||||
"snapshot state (docker image; survives stop)",
|
||||
"/sbx save [label] [--local]",
|
||||
"snapshot state (docker image; --local also writes a portable .tar)",
|
||||
),
|
||||
kv(
|
||||
"/sbx load <label>",
|
||||
@@ -185,6 +185,11 @@ fn help_clusters(theme: &Theme) -> Vec<HelpCluster> {
|
||||
"/sbx gui cancel",
|
||||
"abort a pending launch (nothing stopped or installed)",
|
||||
),
|
||||
kv(
|
||||
"/sbx vmsave <vm> [label] [--local]",
|
||||
"snapshot a VM (--local also exports a portable .ova)",
|
||||
),
|
||||
kv("/sbx vmsnaps <vm>", "list a VM's snapshots"),
|
||||
],
|
||||
},
|
||||
HelpCluster {
|
||||
|
||||
Reference in New Issue
Block a user