docker/execd/v1.0.19

## What's New

### ✨ Features

- **PTY session takeover for device handoff.** New `?takeover=1` query parameter on `GET /pty/:sessionId/ws` lets a second client reclaim a live PTY session instead of getting `409 ALREADY_CONNECTED`. The existing holder is evicted with close code `4001` (`TAKEN_OVER`), the shell process keeps running untouched, and the new client can replay scrollback via `?since=<offset>` for seamless screen restore. Enables desktop ⇄ mobile session handoff without restarting the shell. Fully backward compatible — without the flag, behavior is unchanged. (#997)

- **PTY custom command execution.** `POST /pty` now accepts an optional `command` field. When set, the PTY session runs `bash -c <command>` for one-shot terminal I/O instead of an interactive shell. When omitted, behavior is unchanged (interactive bash). (#1032)

- **Directory listing endpoint.** New `GET /directories/list` endpoint with `depth`-controlled directory traversal (default `depth=1` for immediate children). Also adds a `type` field (`file`, `directory`, `symlink`, `other`) to `FileInfo` responses — `/files/info` now uses `Lstat` so symlinks are reported as symlinks instead of being resolved to their target type. Supported across all five SDKs. (#1001)

- **Line-based file reading.** `GET /files/download` now supports `offset` (1-based line number) and `limit` (line count) query parameters for line-based reads, mutually exclusive with the existing `Range` header. Uses streaming `bufio.Reader` without buffering the entire file. Updated across OpenAPI spec and all SDKs. (#1030)

- **Replace file content feedback.** `POST /files/replace` now returns a `replacedCount` per file, so callers can detect no-match (`replacedCount=0`) and multi-match scenarios. Response going from empty body to JSON is non-breaking; old SDKs ignoring the body continue to work. Updated across all SDKs and MCP server. (#991)

- **OTLP endpoint auto-discovery.** When neither `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` nor `OTEL_EXPORTER_OTLP_ENDPOINT` is set, execd now resolves the node IP from `HOST_IP` env var or `/etc/hostinfo` and points the OTLP/HTTP exporter at `<node-ip>:4318`. Eliminates the need for callers to template the full endpoint URL. (#963)

- **Supervisor binary in container image.** The `opensandbox-supervisor` binary (built from `components/internal/cmd/supervisor`) is now included in the execd runtime image for future process management use. (#1056)

### 🐛 Bug Fixes

- **`GET /files/info` now returns 404 for missing paths** instead of 500. Two cooperating bugs — `fmt.Errorf` using `%s` instead of `%w` (stripping the `os.ErrNotExist` sentinel) and `os.IsNotExist` not walking wrapped errors — made the 404 branch in `handleFileError` unreachable. Both fixed. (#1026)

- **`POST /files/mv` now returns 404 for missing source** instead of 500. Same sentinel-stripping pattern as #1026 in `RenameFile` — `%s` → `%w` fixes the error chain so `handleFileError` reaches its 404 branch. (#1028)

- **`MakeDir` no longer chmod/chown pre-existing directories.** Previously `MakeDir` applied `ChmodFile` unconditionally, which could change permissions on directories that already existed. Now checks existence first and only applies permissions to newly created dirs. `SetFileOwnership` also returns nil when both owner and group are empty. (#1025)

### 📦 Misc

- Modernize all `os.IsNotExist` calls to `errors.Is(err, fs.ErrNotExist)` across 7 callsites in 5 files, matching Go's recommended idiom. Also fixes a pre-emptive `%s` → `%w` sentinel loss in `ValidateWorkingDir`. (#1029)

## 👥 Contributors

Thanks to these contributors ❤️

- @andrewjamesbrown
- @asiudgufgbukbsa
- @ferponse
- @Pangjiping
- @504097723

---
- Docker Hub: opensandbox/execd:v1.0.19
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.19