feat: split sandbox creation from process spawns

packages/cli/src/main.rs

@@ -303,8 +303,14 @@ fn main() -> std::process::ExitCode {
 			Cli::initialize_v8(0);
 			return Cli::command_js(&matches, args);
 		},
-		Command::Sandbox(args) => {
-			return Cli::command_sandbox(args);
+		Command::Sandbox(self::sandbox::Args {
+			command: self::sandbox::Command::Serve(_),
+			..
+		}) => {
+			let Command::Sandbox(args) = args.command else {
+				unreachable!()
+			};
+			return Cli::command_sandbox_sync(args);
 		},
 		Command::Session(args) => {
 			return Cli::command_session(args);
@@ -945,7 +951,7 @@ impl Cli {
 			Command::Js(_) => {
 				unreachable!()
 			},
-			Command::Builtin(_) | Command::Sandbox(_) | Command::Session(_) => {
+			Command::Builtin(_) | Command::Session(_) => {
 				unreachable!()
 			},
 			Command::Archive(args) => self.command_archive(args).boxed(),
@@ -987,6 +993,7 @@ impl Cli {
 			Command::Read(args) => self.command_read(args).boxed(),
 			Command::Remote(args) => self.command_remote(args).boxed(),
 			Command::Run(args) => self.command_run(args).boxed(),
+			Command::Sandbox(args) => self.command_sandbox(args).boxed(),
 			Command::Self_(args) => self.command_tangram(args).boxed(),
 			Command::Shell(args) => self.command_shell(args).boxed(),
 			Command::Serve(args) => self.command_server_run(args).boxed(),

packages/cli/src/process/spawn.rs

@@ -85,15 +85,6 @@ pub struct Options {
 	#[command(flatten)]
 	pub checkin: crate::checkin::Options,
 
-	/// Configure mounts.
-	#[arg(
-		action = clap::ArgAction::Append,
-		long = "mount",
-		num_args = 1,
-		short,
-	)]
-	pub mounts: Vec<tg::Either<tg::process::Mount, tg::command::Mount>>,
-
 	#[command(flatten)]
 	pub local: crate::util::args::Local,
 
@@ -250,7 +241,6 @@ impl Cli {
 				tg::Command::builder(object.host.clone(), object.executable.clone())
 					.args(object.args.clone())
 					.cwd(object.cwd.clone())
-					.mounts(object.mounts.clone())
 					.stdin(object.stdin.clone())
 			},
 
@@ -442,23 +432,16 @@ impl Cli {
 				env.insert(key, value);
 			}
 		}
+		let host = if let Some(host) = options.host {
+			host
+		} else {
+			tg::host().to_owned()
+		};
 		if !env.contains_key("TANGRAM_HOST") {
-			let host = if let Some(host) = options.host {
-				host
-			} else {
-				tg::host().to_owned()
-			};
-			env.insert("TANGRAM_HOST".to_owned(), host.into());
+			env.insert("TANGRAM_HOST".to_owned(), host.clone().into());
 		}
 		command = command.env(env);
 
-		// Set the mounts.
-		for mount in &options.mounts {
-			if let tg::Either::Right(mount) = mount {
-				command = command.mount(mount.clone());
-			}
-		}
-
 		// Create the command and store it.
 		let command = command.build();
 		command
@@ -468,43 +451,30 @@ impl Cli {
 
 		// Determine if the network is enabled.
 		let network = options.network.unwrap_or(!sandbox);
-
+		let sandbox = if network {
+			None
+		} else {
+			Some(tg::Either::Left(tg::sandbox::create::Arg {
+				host,
+				network: false,
+				hostname: None,
+				mounts: Vec::new(),
+				user: None,
+			}))
+		};
 		// Determine the retry.
 		let retry = options.retry;
 
-		// Get the mounts.
-		let mut mounts = Vec::new();
-		if !sandbox {
-			mounts.push(tg::process::data::Mount {
-				source: "/".into(),
-				target: "/".into(),
-				readonly: false,
-			});
-		}
-		for mount in &options.mounts {
-			if let tg::Either::Left(mount) = mount {
-				let source = tokio::fs::canonicalize(&mount.source)
-					.await
-					.map_err(|source| tg::error!(!source, "failed to canonicalize the path"))?;
-				mounts.push(tg::process::data::Mount {
-					source,
-					target: mount.target.clone(),
-					readonly: mount.readonly,
-				});
-			}
-		}
-
 		// Spawn the process.
 		let arg = tg::process::spawn::Arg {
 			cached: options.cached,
 			checksum: options.checksum,
 			command: tg::Referent::with_item(command.id()),
 			local: options.local.local,
-			mounts,
-			network,
 			parent: None,
 			remotes: options.remotes.remotes.clone(),
 			retry,
+			sandbox,
 			stderr,
 			stdin,
 			stdout,

packages/cli/src/run.rs

@@ -7,7 +7,7 @@ use {
 };
 
 mod signal;
-mod stdio;
+pub(crate) mod stdio;
 
 /// Spawn and await an unsandboxed process.
 #[derive(Clone, Debug, clap::Args)]
@@ -281,9 +281,20 @@ impl Cli {
 			.and_then(|remotes| remotes.into_iter().next());
 
 		// Create the stdio.
-		let stdio = stdio::Stdio::new(&handle, remote.clone(), &options)
-			.await
-			.map_err(|source| tg::error!(!source, "failed to create stdio"))?;
+		let tty_enabled = options.spawn.tty.get();
+		let stdio = if options.detach {
+			stdio::Stdio {
+				tty: None,
+				remote: remote.clone(),
+				stdin: None,
+				stdout: None,
+				stderr: None,
+			}
+		} else {
+			stdio::Stdio::new(&handle, remote.clone(), tty_enabled)
+				.await
+				.map_err(|source| tg::error!(!source, "failed to create stdio"))?
+		};
 
 		let local = options.spawn.local.local;
 		let remotes = options.spawn.remotes.remotes.clone();

packages/cli/src/run/stdio.rs

@@ -1,5 +1,4 @@
 use {
-	super::Options,
 	futures::{FutureExt as _, StreamExt as _, TryStreamExt as _, future},
 	std::{
 		io::IsTerminal as _,
@@ -28,7 +27,7 @@ pub struct Tty {
 	pub termios: libc::termios,
 }
 
-pub(super) async fn task<H>(handle: &H, stop: Stop, stdio: Stdio) -> tg::Result<()>
+pub(crate) async fn task<H>(handle: &H, stop: Stop, stdio: Stdio) -> tg::Result<()>
 where
 	H: tg::Handle,
 {
@@ -264,24 +263,13 @@ impl Stdio {
 	pub(crate) async fn new<H>(
 		handle: &H,
 		remote: Option<String>,
-		options: &Options,
+		allow_tty: bool,
 	) -> tg::Result<Self>
 	where
 		H: tg::Handle,
 	{
-		// If the process is detached, then do not create stdio.
-		if options.detach {
-			return Ok(Self {
-				tty: None,
-				remote,
-				stdin: None,
-				stdout: None,
-				stderr: None,
-			});
-		}
-
 		// Create a PTY for stdin if it is a terminal.
-		let (tty, stdin) = if options.spawn.tty.get() && std::io::stdin().is_terminal() {
+		let (tty, stdin) = if allow_tty && std::io::stdin().is_terminal() {
 			let tty = Tty::new()?;
 			let size = tty.get_size()?;
 			let arg = tg::pty::create::Arg {