feat: add Apple container workspace sandbox#18643
Open
maxrochefortshugar wants to merge 16 commits into
Open
Conversation
|
Someone is attempting to deploy a commit to the Mastra Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a new ChangesAppleContainerSandbox workspace provider
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🦋 Changeset detectedLatest commit: 9bd98b2 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
the
Documentation
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
maxrochefortshugar
force-pushed
the
codex/apple-container-sandbox
branch
from
f275093 to
b275a91
Compare
Contributor
PR triageLinked issue check passed (#18645). Mastra uses CodeRabbit for automated code reviews. Please address all feedback from CodeRabbit by either making changes to your PR or leaving a comment explaining why you disagree with the feedback. Since CodeRabbit is an AI, it may occasionally provide incorrect feedback. PR complexity score
Applied label: Changed test gateChanged Test Gate is pending. The |
![superagent-security[bot]](https://avatars.githubusercontent.com/in/3287076?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/apple-container-sandbox.md:
- Line 5: Add a short public API usage example to the new-feature changeset so
the release note is actionable; update the Apple container sandbox note to
include a brief snippet using the public `@mastra/apple-container` API, and make
sure the example clearly reflects the new provider/workspace sandbox feature
described in the changeset.
In `@docs/src/content/en/reference/workspace/apple-container-sandbox.mdx`:
- Around line 366-372: The reconnection example is using the non-public
AppleContainerSandbox lifecycle method instead of the documented public API.
Update the snippet that creates sandbox and sandbox2 to call start() rather than
_start(), keeping the example aligned with the class’s supported interface and
the rest of the AppleContainerSandbox documentation.
In `@workspaces/apple-container/package.json`:
- Around line 25-28: The package test entrypoint is currently pointed at only
the integration suite, so the default `pnpm test` path skips the unit tests.
Update the `package.json` scripts so `test` uses the standard unit test command
in `test:unit` (or otherwise includes the unit suite by default), and keep the
integration-only command separate if needed. Make sure the change is applied in
the `test`, `test:unit`, and `test:cloud` script definitions so workspace test
runs pick up the unit coverage added in this PR.
In `@workspaces/apple-container/README.md`:
- Around line 42-66: The README options table for AppleContainerSandboxOptions
is incomplete and currently implies it lists every supported constructor field.
Update the table in the Apple container README to include the missing public
options such as publishedSockets, os, init, virtualization, capAdd, capDrop,
tmpfs, dns, dnsSearch, noDns, labels, and workingDir, or rename the section to
something narrower like “Common options” so it matches the actual scope of the
documented fields.
- Around line 71-76: The README example is incomplete because it uses
MastraEditor without importing it. Update the snippet near
appleContainerSandboxProvider to include the missing MastraEditor import
alongside the existing import so the copy-paste example works as shown.
In `@workspaces/apple-container/src/sandbox/index.integration.test.ts`:
- Around line 6-10: The AppleContainerSandbox integration suite is being
silently skipped when MASTRA_APPLE_CONTAINER_INTEGRATION=1 but the container CLI
is missing or broken. Update the test gating around shouldRunIntegration,
hasAppleContainerCli, and describe.skipIf so that local opt-out still skips, but
an explicit integration opt-in fails fast with a clear error when
spawnSync('container', ['--version']) does not succeed. Ensure the logic in
index.integration.test.ts distinguishes “not opted in” from “opted in but CLI
unavailable” instead of treating both as a skip.
In `@workspaces/apple-container/src/sandbox/index.test.ts`:
- Around line 17-20: The mocked runner in the sandbox test helper currently
returns a default successful result when the responses queue is empty, which can
hide unexpected extra runner.run() calls. Update the vi.fn implementation in the
test setup to fail fast by throwing an error when queue.shift() yields no
response, while still preserving the existing behavior of resolving queued
functions or values through cliResult for expected calls. This change should be
made in the mocked run helper used by the sandbox tests so each test must
explicitly define the full command sequence it expects.
- Around line 296-299: The AppleContainerCliResult type is missing the
truncation metadata that runAppleContainerCli already returns. Update the
AppleContainerCliResult interface to include stdoutTruncated, stderrTruncated,
stdoutDroppedBytes, and stderrDroppedBytes so the existing assertions in the
AppleContainerCliResult test can type-check without casts.
In `@workspaces/apple-container/src/sandbox/index.ts`:
- Around line 29-37: Add the missing truncation metadata to the public
AppleContainerCliResult type so it matches the object returned by
runAppleContainerCli(). Update the AppleContainerCliResult interface to include
optional stdoutTruncated, stderrTruncated, stdoutDroppedBytes, and
stderrDroppedBytes fields, keeping them optional to reflect that they only
appear when output is clipped.
- Line 146: `MastraSandbox` is not updating `status` when its plain lifecycle
methods are invoked, so `getInfo()` can stay `pending` after the sandbox starts
or stops. Update the overridden `start`, `stop`, and `destroy` methods in
`MastraSandbox` to set the `status` consistently with the existing
`_start/_stop/_destroy` flow, or route them through the same lifecycle helpers
so `callLifecycle(this._sandbox, ...)` always leaves `status` in sync.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ce47d3f6-c90b-4cb7-825d-ebdb336e6944
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (19)
.changeset/apple-container-sandbox.mddocs/src/content/en/docs/workspace/sandbox.mdxdocs/src/content/en/reference/sidebars.jsdocs/src/content/en/reference/workspace/apple-container-sandbox.mdxworkspaces/apple-container/CHANGELOG.mdworkspaces/apple-container/README.mdworkspaces/apple-container/eslint.config.jsworkspaces/apple-container/lint-staged.config.jsworkspaces/apple-container/package.jsonworkspaces/apple-container/src/index.tsworkspaces/apple-container/src/provider.tsworkspaces/apple-container/src/sandbox/index.integration.test.tsworkspaces/apple-container/src/sandbox/index.test.tsworkspaces/apple-container/src/sandbox/index.tsworkspaces/apple-container/test/core-workspace.tsworkspaces/apple-container/tsconfig.build.jsonworkspaces/apple-container/tsconfig.jsonworkspaces/apple-container/tsup.config.tsworkspaces/apple-container/vitest.config.ts
added 9 commits
June 29, 2026 22:03
dane-ai-mastra
Bot
added
complexity: critical
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add
@mastra/apple-container, a workspace sandbox provider backed by Apple'scontainerCLI.The sandbox starts or reconnects to a long-lived OCI Linux container, executes foreground workspace commands with
container exec, supports env/cwd/timeouts/streaming/output retention, and registers an editor provider for persisted workspace configs.Related issue(s)
Fixes #18645
Type of change
Architecture
Reviewer notes
ProcessHandleoutput retention/truncation logic instead of adding a new command-runner abstraction.sleepis not left running.containerBinaryas a trusted constructor option only; it is excluded from the serializable Studio provider schema.Follow-up scope
SandboxProcessManagersupport is intentionally left for a follow-up. Applecontainer exec --detachexists, but in CLI 1.0.0 it does not expose the process-list/get/kill/stdin/output semantics that Mastra's process manager contract expects. This PR therefore supports foregroundexecuteCommand()only; background process tools and LSP remain out of scope and are documented as limitations.Test Plan
pnpm --filter @mastra/apple-container testpnpm --filter @mastra/apple-container lintpnpm --filter @mastra/apple-container exec tsc -p tsconfig.build.jsonMASTRA_APPLE_CONTAINER_INTEGRATION=1 pnpm --filter @mastra/apple-container test:integrationChecklist