Naresh

Back up a directory to R2 and restore it anywhere Saving a workspace so that it survives an image update meant writing the archive to the Container's disk, reading it back through the Durable Object, and extracting it over the target with shell tools, as backup-workspace did. That doubled the disk space a backup needed, funnelled every byte through one stream, and left a half-written directory when a restore failed. DirectoryBackups backs up one directory to an R2 bucket and restores it into any Container, including one on a newer image. The shim writes a tar archive compressed with zstd straight to an R2 multipart upload in parallel parts, and restores with parallel ranged reads. It extracts beside the target, checks the size and SHA-256, and swaps the result in with one rename, so a failed or aborted restore leaves the target as it was. The application keeps the returned record and decides when to delete it. The Container reaches R2 only through DirectoryBackupGateway, and only for the one object its current operation writes or reads. Operations in one Container take a lock and run one at a time. The package replaces the grant with one that denies everything before it closes the shim's stdin, which releases the lock, so an ending operation cannot revoke the next one's grant. An abort closes stdin instead of killing the shim. The shim reads EOF at once, also when the Durable Object goes away, and removes its partial restore before it exits. Restores resolve paths with openat2 and fall back to opening one name at a time without following symlinks where a seccomp filter hides openat2. backup-workspace now uses the module, and no longer needs git in its image to apply .gitignore rules.

Carry over the OpenAI Agents API template The docs deploy the OpenAI Agents API executor from tree/main/openai/agents-api, and main's basic example lives beside it. This branch replaces main and had no openai/ directory, so those links would break when it lands. Copy openai/agents-api from main as a standalone package with its own lockfile, like devin/. It keeps its own tests and toolchain, so the root format, lint, test, and knip runs skip it, and a workflow runs its type check and tests. The local setup installs inside the template, because the root workspace no longer includes it.

Keep restores from deleting files in mounts restore() swapped the restored directory in with RENAME_EXCHANGE and then removed the old tree with remove_dir_all. The exchange carries any mount inside the target along with the old tree, and remove_dir_all descends into mounts. Restoring a directory that held an S3Mounts mount deleted the bucket's objects through s3fs and left the mount under a hidden sibling directory. restore() now fails with EBUSY when the mount table lists a mount inside the target. It checks before taking the lock and again just before the swap, because a mount can appear while the backup downloads. Removing a replaced or leftover tree never enters another mount and never follows a symlink. On kernels that report no mount ID, a bind mount from the same filesystem has the parent's device number, so the tree is kept whenever the mount table lists a mount at or inside it. Mounting needs a privileged container, so the tests that mount skip in the Docker build. npm run test:shim-mounts reruns the shim's tests with mounts allowed, and test:release runs it.

Reject bad Files options and report a missing cwd Files passed its whole options object to exec(). A JavaScript caller moving from 0.12 who wrote readDirectory(path, { recursive: true }) got a shallow listing with no error, and any other key, such as env, reached exec() unchecked. user: "1000" ran the shim as root, because exec() treats a user ID without a group ID that way. A cwd that did not exist made exec() fail to start the process, with the same error as a missing shim binary, which sends people to debug their image. Each method now rejects options it does not accept, and options of the wrong type, with TypeError before the shim starts. user must be a numeric uid:gid pair. Each method's option rules are typed against its options type, so an option added to the type without a rule fails to compile. Files now joins a relative path onto cwd and sends the shim only absolute paths, and exec() receives only user and signal. Linux resolves the joined path as it would a relative path after entering cwd, including .. after a symlink, so a missing cwd rejects with SandboxFileError ENOENT for the path. An absolute path now ignores cwd instead of requiring it to exist. The shim and its protocol are unchanged.

Keep canceled restores from replacing the target restore() promised that a canceled restore leaves the target as it was. An abort closed the shim's stdin and rejected at once, but the shim checked for an abort only while extracting. One canceled after its last check still applied metadata, swapped, and deleted the old tree, so the call rejected with the abort reason while the target was replaced, and anything the application wrote into the target after canceling was deleted with the old tree. The shim now reports verified once the download has passed its checks and the metadata is applied, and swaps only after a second acknowledgement. The package sends it only if the signal has not aborted, then stops following the signal, so the call reports the swap's outcome. A rejection with the abort reason, SandboxFileError, or SandboxBackupError means the target was not replaced. A connection lost after the acknowledgement leaves the outcome unknown, as a Durable Object restart always has.

Add a Devin Outposts template The Devin template on main saves suspended sessions to R2 through an outbound-interception proxy, because Container snapshots were not available. The 1.0 branch has no Devin template, so the docs Deploy button would break once this branch replaces main. Add devin/ as a standalone project with its own package.json for the Deploy button and create cloudflare. A cron-triggered Worker polls the Devin API every 10 seconds and gives each session a Durable Object that controls a Container Instance. When the Devin CLI exits, the entrypoint writes a marker and stays up; the Durable Object snapshots the Container, stores the snapshot ID, and destroys it. A resumed session starts from that snapshot, and a terminated one forgets it. The Devin API calls, status map, and image match main.

Fix stable release promotion flow (#869) Publish current npm releases directly to latest only after the other artifacts are complete. This keeps stable publishing tokenless because npm trusted publishing cannot authenticate a separate dist-tag update. Let current-version reconciliation create the promotion PR so recovery runs finish repository reference updates as well.

Carry backup failures inside I/O errors The archive moves through zstd and tar, which only pass io::Error. A rejected part, a missing object, or an unreadable source file was therefore recorded on the side, in a different shared slot for each of the upload pipeline, the download pipeline, and the capture walk. Callers turned the generic error back into the real failure with closures that were threaded through capture and extraction. Failure now implements Error and travels as the payload of the io::Error itself. zstd and tar pass inner errors through unchanged, so the one boundary that sees an error takes the failure back out, falling back to a corrupt archive when reading and a transfer failure when writing. Once stdin has closed, the session reports nothing, whatever the failure, as the closures did before. Tests send a rejected part through zstd, a missing object through zstd, and an unreadable file through tar, because the design depends on those crates not wrapping the errors.

Move the gateway HTTP client into its own module transfer.rs held both the directory backup pipelines and a small HTTP/1.1 client for reaching the gateway: the request head, the response head, and bodies framed by length, chunks, or the connection closing. The client knows nothing about backups. It now lives in src/http.rs, beside the other shared modules, and transfer.rs keeps the upload and download pipelines and the requests they make. The caller connects and registers the socket with the lifeline before handing it over, so an abort still unblocks a read. Tests cover the three body framings; the backup tests used only Content-Length, so a body that ends when the connection closes was not covered before.

[miniflare] Support Container image selection (#15672)