Evidence & the Sandbox — Under the Hood

What tailoring and compiling cost

The design consequence: the 15-second compile timeout is only meaningful because cache warm-up is guaranteed not to happen inside it. Look at latex.ts:103 — local dev self-warms in a separate, generously-timed step precisely so the tight timeout stays a true statement about compilation, not about network luck. Separating "expensive setup" from "bounded steady-state" is the same move as connection pooling or JIT warm-up: measure and budget the two phases separately.

Escape-order subtlety worth study (escape.ts): backslash must be handled in the same single pass as the other specials. A naive two-pass version — escape backslashes, then escape braces — would re-escape the braces its own first pass introduced (\{ → \textbackslash{}\{…). The single regex with a lookup table makes the order problem structurally impossible. Then control characters are stripped so nothing can smuggle line-based directives. Small function, textbook lesson: escaping is a compiler problem, not a string problem.

The decisions: structural truth, and Tectonic over everything else

The long-term security posture is worth quoting from escape.ts's header: "users submit structured resume data, never raw .tex." The endgame isn't sandboxing user templates harder — it's making templates first-party code and reducing user input to escaped strings. The sandbox then becomes defense-in-depth around trusted code, which is where you want your sandbox to be.

Where it actually broke — and where it still can

• Every compile outcome is a value: CompileResult enumerates template_not_found, shell_escape_blocked, timeout, cache_miss, tectonic_failed, pdf_missing. Note pdf_missing: exit code 0 with no PDF on disk is a real Tectonic edge — the code checks the artifact, not just the exit status. Trust outputs, not statuses.
• Stuck-state prevention: if queuing the background compile fails (TRIGGER_SECRET_KEY missing, network down), the action marks the version compile_start_failed rather than leaving it "queued" forever. Every async workflow needs an answer to "what if the handoff itself fails?"
• Cleanup discipline: each run gets a UUID-named temp dir, removed in finally blocks; the compile task also cleans after upload. SIGKILL on timeout means no graceful cleanup by the child — the parent owns deletion. Orphaned dirs under OS tmp are the accepted residue of the crash-during-cleanup window.
• Concurrent compiles of the same version: two triggers for one resumeVersionId would both compile and both upload — to the same deterministic R2 key? No: buildResumePdfKey includes a random UUID, so the loser's PDF becomes an unreferenced orphan object; the winner's key lands in the row. Harmless waste, no corruption — idempotency by last-write-wins on the pointer, not the blob.
• The blocklist is not the sandbox: the regex catches \write18-family primitives, but obfuscated TeX (catcode tricks) could theoretically evade a static pattern. That's fine because the regex is layer two of four — the design assumes it can be beaten and makes the prize worthless (no secrets, no network).

Make it yours