fix: multiple cp improvements

- Add receivedFinal flag to detect incomplete transfers
- Pass Dialer to recursive directory copy
- Append to existing base URL path in buildWsURL
- Handle root directory edge case in sanitizePath

Author: rgarcia

lib/cp.go

@@ -201,7 +201,7 @@ func CpToInstance(ctx context.Context, cfg CpConfig, opts CpToInstanceOptions) e
 	}
 
 	if srcInfo.IsDir() {
-		return copyDirToWs(ctx, cfg, ws, opts.SrcPath, opts.DstPath, opts.InstanceID, opts.Archive, opts.FollowLinks, opts.Callbacks)
+		return copyDirToWs(ctx, cfg, ws, opts.SrcPath, opts.DstPath, opts.InstanceID, opts.Archive, opts.FollowLinks, opts.Dialer, opts.Callbacks)
 	}
 	return copyFileToWs(ws, opts.SrcPath, srcInfo.Size(), opts.Callbacks)
 }
@@ -271,7 +271,7 @@ func copyFileToWs(ws WsConn, srcPath string, size int64, callbacks *CpCallbacks)
 }
 
 // copyDirToWs copies a directory to the WebSocket
-func copyDirToWs(ctx context.Context, cfg CpConfig, ws WsConn, srcPath, dstPath, instanceID string, archive, followLinks bool, callbacks *CpCallbacks) error {
+func copyDirToWs(ctx context.Context, cfg CpConfig, ws WsConn, srcPath, dstPath, instanceID string, archive, followLinks bool, dialer WsDialer, callbacks *CpCallbacks) error {
 	// For directory copy, we just send the end marker
 	// The server will create the directory
 	endMsg, _ := json.Marshal(map[string]string{"type": "end"})
@@ -326,6 +326,7 @@ func copyDirToWs(ctx context.Context, cfg CpConfig, ws WsConn, srcPath, dstPath,
 			Mode:        info.Mode().Perm(),
 			Archive:     archive,
 			FollowLinks: followLinks,
+			Dialer:      dialer,
 			Callbacks:   callbacks,
 		})
 	})
@@ -383,6 +384,7 @@ func CpFromInstance(ctx context.Context, cfg CpConfig, opts CpFromInstanceOption
 	var currentFile *os.File
 	var currentHeader *cpFileHeader
 	var bytesReceived int64
+	var receivedFinal bool
 
 	// Ensure any open file is closed on function exit (fixes file handle leak)
 	defer func() {
@@ -493,6 +495,7 @@ func CpFromInstance(ctx context.Context, cfg CpConfig, opts CpFromInstanceOption
 				}
 
 				if endMarker.Final {
+					receivedFinal = true
 					return nil
 				}
 
@@ -524,6 +527,10 @@ func CpFromInstance(ctx context.Context, cfg CpConfig, opts CpFromInstanceOption
 		}
 	}
 
+	// If connection closed without receiving final marker, the transfer was incomplete
+	if !receivedFinal {
+		return fmt.Errorf("copy stream ended without completion marker")
+	}
 	return nil
 }
 
@@ -555,7 +562,9 @@ func sanitizePath(base, path string) (string, error) {
 	}
 
 	// Ensure the result is under the base directory
-	if !strings.HasPrefix(absResult, absBase+string(filepath.Separator)) && absResult != absBase {
+	// Special case: if base is root ("/"), everything under it is valid
+	isRoot := absBase == "/" || absBase == string(filepath.Separator)
+	if !isRoot && !strings.HasPrefix(absResult, absBase+string(filepath.Separator)) && absResult != absBase {
 		return "", fmt.Errorf("invalid path: path escapes destination: %s", path)
 	}
 
@@ -569,7 +578,9 @@ func buildWsURL(baseURL, instanceID string) (string, error) {
 		return "", fmt.Errorf("invalid base URL: %w", err)
 	}
 
-	u.Path = fmt.Sprintf("/instances/%s/cp", instanceID)
+	// Append to existing path (preserves any path prefix like /api)
+	// Use path.Join to handle trailing slashes and ensure clean paths
+	u.Path = path.Join(u.Path, "instances", instanceID, "cp")
 
 	switch u.Scheme {
 	case "https":