Fix escaped quotes in file write operations (#70)

* Fix escaped quotes in file write operations

Remove unnecessary quote escaping when using quoted heredoc delimiter.
The quoted delimiter 'SANDBOX_EOF' treats content literally, making
the escaping redundant and causing escaped quotes to appear in output.

* Add changeset

* Fix type errors

Author: ghostwriternr

.changeset/six-seas-go.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/sandbox": patch
+---
+
+Fix escaped quotes in file write operations

packages/sandbox/container_src/handler/exec.ts

@@ -1,5 +1,5 @@
-import { SessionManager } from "../isolation";
-import { SessionExecRequest } from "../types";
+import type { SessionManager } from "../isolation";
+import type { SessionExecRequest } from "../types";
 
 export async function handleExecuteRequest(
   req: Request,

packages/sandbox/container_src/handler/session.ts

@@ -1,5 +1,5 @@
-import { SessionManager } from "../isolation";
-import { CreateSessionRequest } from "../types";
+import type { SessionManager } from "../isolation";
+import type { CreateSessionRequest } from "../types";
 
 export async function handleCreateSession(
   req: Request,

packages/sandbox/container_src/isolation.ts

@@ -423,12 +423,11 @@ export class Session {
 
   // File Operations - Execute as shell commands to inherit session context
   async writeFileOperation(path: string, content: string, encoding: string = 'utf-8'): Promise<{ success: boolean; exitCode: number; path: string }> {
-    // Escape content for safe heredoc usage
-    const safeContent = content.replace(/'/g, "'\\''");
-    
     // Create parent directory if needed, then write file using heredoc
+    // Note: The quoted heredoc delimiter 'SANDBOX_EOF' prevents variable expansion
+    // and treats the content literally, so no escaping is required
     const command = `mkdir -p "$(dirname "${path}")" && cat > "${path}" << 'SANDBOX_EOF'
-${safeContent}
+${content}
 SANDBOX_EOF`;
 
     const result = await this.exec(command);