Function sandbox_sync_down

crates/openshell-cli/src/ssh.rs:1136–1154

Pull a path from a sandbox to a local destination using tar-over-SSH. Follows `cp`-style semantics for the destination: - If the source is a single file: - When `dest` ends with `/` or already exists as a directory on the host, the file lands at ` / `. - Otherwise `dest` is taken to be the exact file path to write. - If the source is a directory, its contents are extracted i

(
    server: &str,
    name: &str,
    sandbox_path: &str,
    dest: &str,
    tls: &TlsOptions,
)

/// before any SSH command is issued; paths that lexically resolve outside
/// `/sandbox` are refused.
pub async fn sandbox_sync_down(
    server: &str,
    name: &str,
    sandbox_path: &str,
    dest: &str,
    tls: &TlsOptions,
) -> Result<()> {
    let sandbox_path = validate_sandbox_source_path(sandbox_path)?;
    let session = ssh_session_config(server, name, tls).await?;
    let sandbox_path = resolve_sandbox_source_path(&session, &sandbox_path).await?;
    let kind = probe_sandbox_source_kind(&session, &sandbox_path).await?;

    match kind {
        SandboxSourceKind::File => sandbox_sync_down_file(&session, &sandbox_path, dest).await,
        SandboxSourceKind::Directory => {
            sandbox_sync_down_directory(&session, &sandbox_path, dest).await
        }
    }
}

/// Stream a tar archive from the sandbox and extract it into a fresh
/// destination directory. The source is always wrapped on the sandbox side so