@cogitator-ai/sandbox 0.1.0

package/dist/__tests__/sandbox-manager.test.js

@@ -0,0 +1,115 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { SandboxManager } from '../sandbox-manager';
+function assertSuccess(result) {
+    if (!result.success) {
+        throw new Error(`Expected success but got error: ${result.error}`);
+    }
+}
+describe('SandboxManager', () => {
+    let manager;
+    beforeEach(() => {
+        manager = new SandboxManager();
+    });
+    afterEach(async () => {
+        await manager.shutdown();
+    });
+    describe('initialization', () => {
+        it('initializes successfully', async () => {
+            await manager.initialize();
+        });
+        it('only initializes once', async () => {
+            await manager.initialize();
+            await manager.initialize();
+        });
+    });
+    describe('native execution', () => {
+        it('executes command with native sandbox', async () => {
+            const request = {
+                command: ['echo', 'hello from sandbox'],
+            };
+            const config = {
+                type: 'native',
+            };
+            const result = await manager.execute(request, config);
+            assertSuccess(result);
+            expect(result.data.stdout.trim()).toBe('hello from sandbox');
+            expect(result.data.exitCode).toBe(0);
+        });
+        it('handles command failure', async () => {
+            const request = {
+                command: ['exit 1'],
+            };
+            const config = {
+                type: 'native',
+            };
+            const result = await manager.execute(request, config);
+            assertSuccess(result);
+            expect(result.data.exitCode).toBe(1);
+        });
+        it('handles timeout', async () => {
+            const request = {
+                command: ['sleep', '10'],
+                timeout: 100,
+            };
+            const config = {
+                type: 'native',
+            };
+            const result = await manager.execute(request, config);
+            assertSuccess(result);
+            expect(result.data.timedOut).toBe(true);
+        });
+    });
+    describe('config merging', () => {
+        it('merges default config with request config', async () => {
+            const managerWithDefaults = new SandboxManager({
+                defaults: {
+                    type: 'native',
+                    timeout: 5000,
+                    env: { DEFAULT_VAR: 'default' },
+                },
+            });
+            const request = {
+                command: ['echo $DEFAULT_VAR $EXTRA_VAR'],
+            };
+            const config = {
+                type: 'native',
+                env: { EXTRA_VAR: 'extra' },
+            };
+            const result = await managerWithDefaults.execute(request, config);
+            assertSuccess(result);
+            expect(result.data.stdout.trim()).toBe('default extra');
+            await managerWithDefaults.shutdown();
+        });
+    });
+    describe('docker fallback', () => {
+        it('falls back to native when docker unavailable', async () => {
+            const request = {
+                command: ['echo', 'fallback test'],
+            };
+            const config = {
+                type: 'docker',
+                image: 'alpine:3.19',
+            };
+            const result = await manager.execute(request, config);
+            assertSuccess(result);
+            expect(result.data.stdout.trim()).toBe('fallback test');
+        });
+    });
+    describe('isDockerAvailable', () => {
+        it('returns boolean for docker availability', async () => {
+            const available = await manager.isDockerAvailable();
+            expect(typeof available).toBe('boolean');
+        });
+    });
+    describe('shutdown', () => {
+        it('shuts down cleanly', async () => {
+            await manager.initialize();
+            await manager.shutdown();
+            await manager.initialize();
+        });
+        it('can shutdown without initialization', async () => {
+            await manager.shutdown();
+        });
+    });
+});
+//# sourceMappingURL=sandbox-manager.test.js.map

package/dist/__tests__/sandbox-manager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-manager.test.js","sourceRoot":"","sources":["../../src/__tests__/sandbox-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQpD,SAAS,aAAa,CACpB,MAA6C;IAE7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,OAAuB,CAAC;IAE5B,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,OAAO,GAA4B;gBACvC,OAAO,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;aACxC,CAAC;YAEF,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,QAAQ;aACf,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACvC,MAAM,OAAO,GAA4B;gBACvC,OAAO,EAAE,CAAC,QAAQ,CAAC;aACpB,CAAC;YAEF,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,QAAQ;aACf,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,OAAO,GAA4B;gBACvC,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC;gBACxB,OAAO,EAAE,GAAG;aACb,CAAC;YAEF,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,QAAQ;aACf,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,mBAAmB,GAAG,IAAI,cAAc,CAAC;gBAC7C,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,IAAI;oBACb,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;iBAChC;aACF,CAAC,CAAC;YAEH,MAAM,OAAO,GAA4B;gBACvC,OAAO,EAAE,CAAC,8BAA8B,CAAC;aAC1C,CAAC;YAEF,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;aAC5B,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClE,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAExD,MAAM,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAA4B;gBACvC,OAAO,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;aACnC,CAAC;YAEF,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,aAAa;aACrB,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpD,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QACxB,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/docker-types.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Docker types for sandbox execution
+ * These are minimal interfaces to avoid requiring @types/dockerode at compile time
+ */
+export interface DockerStream {
+    on(event: 'data', listener: (chunk: Buffer) => void): this;
+    on(event: 'end', listener: () => void): this;
+    on(event: string, listener: (...args: unknown[]) => void): this;
+    write(data: string | Buffer): boolean;
+    end(): void;
+}
+export interface DockerExec {
+    start(options: {
+        hijack?: boolean;
+        stdin?: boolean;
+    }): Promise<DockerStream>;
+    inspect(): Promise<{
+        ExitCode: number | null;
+    }>;
+}
+export interface DockerContainer {
+    id: string;
+    start(): Promise<void>;
+    stop(options?: {
+        t?: number;
+    }): Promise<void>;
+    remove(options?: {
+        force?: boolean;
+    }): Promise<void>;
+    exec(options: {
+        Cmd: string[];
+        Env?: string[];
+        WorkingDir?: string;
+        AttachStdout?: boolean;
+        AttachStderr?: boolean;
+        AttachStdin?: boolean;
+    }): Promise<DockerExec>;
+}
+export interface DockerImage {
+    inspect(): Promise<unknown>;
+}
+export interface Docker {
+    ping(): Promise<string>;
+    createContainer(options: Record<string, unknown>): Promise<DockerContainer>;
+    getImage(name: string): DockerImage;
+    pull(image: string, callback: (err: Error | null, stream: NodeJS.ReadableStream) => void): void;
+    modem: {
+        followProgress(stream: NodeJS.ReadableStream, callback: (err: Error | null, output: unknown[]) => void): void;
+    };
+}
+//# sourceMappingURL=docker-types.d.ts.map

package/dist/docker-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-types.d.ts","sourceRoot":"","sources":["../src/docker-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3D,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC7C,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAChE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACtC,GAAG,IAAI,IAAI,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE;QACZ,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IACpC,IAAI,CACF,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,GACnE,IAAI,CAAC;IACR,KAAK,EAAE;QACL,cAAc,CACZ,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,GACvD,IAAI,CAAC;KACT,CAAC;CACH"}

package/dist/docker-types.js

@@ -0,0 +1,6 @@
+/**
+ * Docker types for sandbox execution
+ * These are minimal interfaces to avoid requiring @types/dockerode at compile time
+ */
+export {};
+//# sourceMappingURL=docker-types.js.map

package/dist/docker-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-types.js","sourceRoot":"","sources":["../src/docker-types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/executors/base.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Base sandbox executor interface
+ */
+import type { SandboxConfig, SandboxExecutionRequest, SandboxExecutionResult, SandboxResult } from '@cogitator-ai/types';
+export declare abstract class BaseSandboxExecutor {
+    abstract readonly type: string;
+    abstract execute(request: SandboxExecutionRequest, config: SandboxConfig): Promise<SandboxResult<SandboxExecutionResult>>;
+    abstract connect(): Promise<SandboxResult<void>>;
+    abstract disconnect(): Promise<SandboxResult<void>>;
+    abstract isAvailable(): Promise<boolean>;
+    protected success<T>(data: T): SandboxResult<T>;
+    protected failure(error: string): SandboxResult<never>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/executors/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/executors/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAE7B,8BAAsB,mBAAmB;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,OAAO,CACd,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAEjD,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IAI/C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;CAGvD"}

package/dist/executors/base.js

@@ -0,0 +1,12 @@
+/**
+ * Base sandbox executor interface
+ */
+export class BaseSandboxExecutor {
+    success(data) {
+        return { success: true, data };
+    }
+    failure(error) {
+        return { success: false, error };
+    }
+}
+//# sourceMappingURL=base.js.map

package/dist/executors/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/executors/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAgB,mBAAmB;IAY7B,OAAO,CAAI,IAAO;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAES,OAAO,CAAC,KAAa;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/executors/docker.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Docker sandbox executor - isolated execution in containers
+ */
+import type { SandboxConfig, SandboxExecutionRequest, SandboxExecutionResult, SandboxResult, SandboxDockerConfig, SandboxPoolConfig } from '@cogitator-ai/types';
+import { BaseSandboxExecutor } from './base';
+export interface DockerExecutorOptions {
+    docker?: SandboxDockerConfig;
+    pool?: SandboxPoolConfig;
+}
+export declare class DockerSandboxExecutor extends BaseSandboxExecutor {
+    readonly type = "docker";
+    private docker?;
+    private pool?;
+    private options;
+    constructor(options?: DockerExecutorOptions);
+    connect(): Promise<SandboxResult<void>>;
+    disconnect(): Promise<SandboxResult<void>>;
+    isAvailable(): Promise<boolean>;
+    execute(request: SandboxExecutionRequest, config: SandboxConfig): Promise<SandboxResult<SandboxExecutionResult>>;
+    private runWithTimeout;
+}
+//# sourceMappingURL=docker.d.ts.map

package/dist/executors/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAK7C,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAMD,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,IAAI,CAAC,CAAgB;IAC7B,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,GAAE,qBAA0B;IAKzC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAyBvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAS1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAqDnC,cAAc;CA2E7B"}

package/dist/executors/docker.js

@@ -0,0 +1,160 @@
+/**
+ * Docker sandbox executor - isolated execution in containers
+ */
+import { BaseSandboxExecutor } from './base';
+import { ContainerPool } from '../pool/container-pool';
+import { parseMemory } from '../utils/parse-resources';
+const MAX_OUTPUT_SIZE = 50_000;
+const DEFAULT_TIMEOUT = 30_000;
+const DEFAULT_IMAGE = 'alpine:3.19';
+export class DockerSandboxExecutor extends BaseSandboxExecutor {
+    type = 'docker';
+    docker;
+    pool;
+    options;
+    constructor(options = {}) {
+        super();
+        this.options = options;
+    }
+    async connect() {
+        try {
+            const Dockerode = (await import('dockerode')).default;
+            this.docker = new Dockerode({
+                socketPath: this.options.docker?.socketPath ?? '/var/run/docker.sock',
+                host: this.options.docker?.host,
+                port: this.options.docker?.port,
+            });
+            await this.docker.ping();
+            this.pool = new ContainerPool(this.docker, {
+                maxSize: this.options.pool?.maxSize ?? 5,
+                idleTimeoutMs: this.options.pool?.idleTimeoutMs ?? 60_000,
+            });
+            return this.success(undefined);
+        }
+        catch (error) {
+            return this.failure(`Failed to connect to Docker: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    async disconnect() {
+        if (this.pool) {
+            await this.pool.destroyAll();
+        }
+        this.docker = undefined;
+        this.pool = undefined;
+        return this.success(undefined);
+    }
+    async isAvailable() {
+        if (!this.docker)
+            return false;
+        try {
+            await this.docker.ping();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async execute(request, config) {
+        if (!this.docker || !this.pool) {
+            return this.failure('Docker executor not connected');
+        }
+        const startTime = Date.now();
+        const timeout = request.timeout ?? config.timeout ?? DEFAULT_TIMEOUT;
+        const image = config.image ?? DEFAULT_IMAGE;
+        try {
+            const container = await this.pool.acquire(image, {
+                memory: config.resources?.memory
+                    ? parseMemory(config.resources.memory)
+                    : undefined,
+                cpus: config.resources?.cpus,
+                cpuShares: config.resources?.cpuShares,
+                pidsLimit: config.resources?.pidsLimit,
+                networkMode: config.network?.mode ?? 'none',
+                mounts: config.mounts,
+                user: config.user,
+            });
+            try {
+                const exec = await container.exec({
+                    Cmd: request.command,
+                    Env: Object.entries({ ...config.env, ...request.env }).map(([k, v]) => `${k}=${v}`),
+                    WorkingDir: request.cwd ?? config.workdir ?? '/workspace',
+                    AttachStdout: true,
+                    AttachStderr: true,
+                    AttachStdin: !!request.stdin,
+                });
+                const result = await this.runWithTimeout(exec, request.stdin, timeout);
+                return this.success({
+                    stdout: result.stdout,
+                    stderr: result.stderr,
+                    exitCode: result.exitCode,
+                    timedOut: result.timedOut,
+                    duration: Date.now() - startTime,
+                });
+            }
+            finally {
+                await this.pool.release(container);
+            }
+        }
+        catch (error) {
+            return this.failure(`Execution failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    async runWithTimeout(exec, stdin, timeoutMs) {
+        return new Promise((resolve, reject) => {
+            let timedOut = false;
+            const timer = setTimeout(() => {
+                timedOut = true;
+            }, timeoutMs);
+            void (async () => {
+                try {
+                    const stream = await exec.start({
+                        hijack: true,
+                        stdin: !!stdin,
+                    });
+                    let stdout = '';
+                    let stderr = '';
+                    stream.on('data', (chunk) => {
+                        let offset = 0;
+                        while (offset < chunk.length) {
+                            if (offset + 8 > chunk.length)
+                                break;
+                            const type = chunk[offset];
+                            const size = (chunk[offset + 4] << 24) |
+                                (chunk[offset + 5] << 16) |
+                                (chunk[offset + 6] << 8) |
+                                chunk[offset + 7];
+                            if (offset + 8 + size > chunk.length)
+                                break;
+                            const data = chunk.slice(offset + 8, offset + 8 + size).toString('utf-8');
+                            if (type === 1) {
+                                stdout += data;
+                            }
+                            else if (type === 2) {
+                                stderr += data;
+                            }
+                            offset += 8 + size;
+                        }
+                    });
+                    if (stdin) {
+                        stream.write(stdin);
+                        stream.end();
+                    }
+                    await new Promise((res) => stream.on('end', res));
+                    clearTimeout(timer);
+                    const inspection = await exec.inspect();
+                    resolve({
+                        stdout: stdout.slice(0, MAX_OUTPUT_SIZE),
+                        stderr: stderr.slice(0, MAX_OUTPUT_SIZE),
+                        exitCode: inspection.ExitCode ?? 1,
+                        timedOut,
+                    });
+                }
+                catch (error) {
+                    clearTimeout(timer);
+                    reject(error instanceof Error ? error : new Error(String(error)));
+                }
+            })();
+        });
+    }
+}
+//# sourceMappingURL=docker.js.map

package/dist/executors/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQvD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IACjB,MAAM,CAAU;IAChB,IAAI,CAAiB;IACrB,OAAO,CAAwB;IAEvC,YAAY,UAAiC,EAAE;QAC7C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YAEtD,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC;gBAC1B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,sBAAsB;gBACrE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI;gBAC/B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI;aAChC,CAAsB,CAAC;YAExB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAEzB,IAAI,CAAC,IAAI,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC;gBACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,MAAM;aAC1D,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;gBAC/C,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM;oBAC9B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;oBACtC,CAAC,CAAC,SAAS;gBACb,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI;gBAC5B,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,MAAM;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;oBAChC,GAAG,EAAE,OAAO,CAAC,OAAO;oBACpB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CACxD,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACxB;oBACD,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,YAAY;oBACzD,YAAY,EAAE,IAAI;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;iBAC7B,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAEvE,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAAgB,EAChB,KAAyB,EACzB,SAAiB;QAOjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;wBAC9B,MAAM,EAAE,IAAI;wBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;qBACf,CAAC,CAAC;oBAEH,IAAI,MAAM,GAAG,EAAE,CAAC;oBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;oBAEhB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;wBAClC,IAAI,MAAM,GAAG,CAAC,CAAC;wBACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;4BAC7B,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;gCAAE,MAAM;4BAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;4BAC3B,MAAM,IAAI,GACR,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gCACzB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gCACzB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;gCACxB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;4BAEpB,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM;gCAAE,MAAM;4BAE5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;4BAE1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gCACf,MAAM,IAAI,IAAI,CAAC;4BACjB,CAAC;iCAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gCACtB,MAAM,IAAI,IAAI,CAAC;4BACjB,CAAC;4BAED,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;wBACrB,CAAC;oBACH,CAAC,CAAC,CAAC;oBAEH,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACpB,MAAM,CAAC,GAAG,EAAE,CAAC;oBACf,CAAC;oBAED,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;oBACxD,YAAY,CAAC,KAAK,CAAC,CAAC;oBAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBAExC,OAAO,CAAC;wBACN,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;wBACxC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;wBACxC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,CAAC;wBAClC,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/executors/index.d.ts

@@ -0,0 +1,5 @@
+export { BaseSandboxExecutor } from './base';
+export { NativeSandboxExecutor } from './native';
+export { DockerSandboxExecutor, type DockerExecutorOptions } from './docker';
+export { WasmSandboxExecutor, type WasmExecutorOptions } from './wasm';
+//# sourceMappingURL=index.d.ts.map

package/dist/executors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/executors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,QAAQ,CAAC"}

package/dist/executors/index.js

@@ -0,0 +1,5 @@
+export { BaseSandboxExecutor } from './base';
+export { NativeSandboxExecutor } from './native';
+export { DockerSandboxExecutor } from './docker';
+export { WasmSandboxExecutor } from './wasm';
+//# sourceMappingURL=index.js.map

package/dist/executors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/executors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAA8B,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAA4B,MAAM,QAAQ,CAAC"}

package/dist/executors/native.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Native sandbox executor - no isolation, runs directly on host.
+ * Used as fallback when Docker is unavailable.
+ */
+import type { SandboxConfig, SandboxExecutionRequest, SandboxExecutionResult, SandboxResult } from '@cogitator-ai/types';
+import { BaseSandboxExecutor } from './base';
+export declare class NativeSandboxExecutor extends BaseSandboxExecutor {
+    readonly type = "native";
+    connect(): Promise<SandboxResult<void>>;
+    disconnect(): Promise<SandboxResult<void>>;
+    isAvailable(): Promise<boolean>;
+    execute(request: SandboxExecutionRequest, config: SandboxConfig): Promise<SandboxResult<SandboxExecutionResult>>;
+}
+//# sourceMappingURL=native.d.ts.map

package/dist/executors/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/executors/native.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAO7C,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IAEnB,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAIvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAI1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;CA+ClD"}

package/dist/executors/native.js

@@ -0,0 +1,62 @@
+/**
+ * Native sandbox executor - no isolation, runs directly on host.
+ * Used as fallback when Docker is unavailable.
+ */
+import { exec as execCallback } from 'node:child_process';
+import { promisify } from 'node:util';
+import { BaseSandboxExecutor } from './base';
+const execPromise = promisify(execCallback);
+const MAX_OUTPUT_SIZE = 50_000;
+const MAX_BUFFER = 10 * 1024 * 1024;
+export class NativeSandboxExecutor extends BaseSandboxExecutor {
+    type = 'native';
+    async connect() {
+        return this.success(undefined);
+    }
+    async disconnect() {
+        return this.success(undefined);
+    }
+    async isAvailable() {
+        return true;
+    }
+    async execute(request, config) {
+        const startTime = Date.now();
+        const timeout = request.timeout ?? config.timeout ?? 30_000;
+        try {
+            const command = request.command.join(' ');
+            const { stdout, stderr } = await execPromise(command, {
+                cwd: request.cwd ?? config.workdir,
+                timeout,
+                env: { ...process.env, ...config.env, ...request.env },
+                maxBuffer: MAX_BUFFER,
+            });
+            return this.success({
+                stdout: stdout.slice(0, MAX_OUTPUT_SIZE),
+                stderr: stderr.slice(0, MAX_OUTPUT_SIZE),
+                exitCode: 0,
+                timedOut: false,
+                duration: Date.now() - startTime,
+            });
+        }
+        catch (err) {
+            const error = err;
+            if (error.killed) {
+                return this.success({
+                    stdout: '',
+                    stderr: `Command timed out after ${timeout.toString()}ms`,
+                    exitCode: 124,
+                    timedOut: true,
+                    duration: Date.now() - startTime,
+                });
+            }
+            return this.success({
+                stdout: (error.stdout ?? '').slice(0, MAX_OUTPUT_SIZE),
+                stderr: (error.stderr ?? error.message).slice(0, MAX_OUTPUT_SIZE),
+                exitCode: error.code ?? 1,
+                timedOut: false,
+                duration: Date.now() - startTime,
+            });
+        }
+    }
+}
+//# sourceMappingURL=native.js.map

package/dist/executors/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/executors/native.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AAE5C,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpC,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IAEzB,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QAE5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE;gBACpD,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;gBAClC,OAAO;gBACP,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACtD,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACxC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACxC,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAKb,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,2BAA2B,OAAO,CAAC,QAAQ,EAAE,IAAI;oBACzD,QAAQ,EAAE,GAAG;oBACb,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACtD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACjE,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;gBACzB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/executors/wasm.d.ts

@@ -0,0 +1,29 @@
+/**
+ * WASM sandbox executor - isolated execution via Extism
+ *
+ * Provides fast, memory-safe execution of WASM modules.
+ * Cold start: 1-10ms (vs Docker 1-5s)
+ * Memory: 1-10MB per plugin (vs Docker 50-200MB)
+ */
+import type { SandboxConfig, SandboxExecutionRequest, SandboxExecutionResult, SandboxResult, SandboxWasmConfig } from '@cogitator-ai/types';
+import { BaseSandboxExecutor } from './base';
+export interface WasmExecutorOptions {
+    wasm?: SandboxWasmConfig;
+}
+export declare class WasmSandboxExecutor extends BaseSandboxExecutor {
+    readonly type = "wasm";
+    private createPlugin?;
+    private pluginCache;
+    private options;
+    private cacheOrder;
+    constructor(options?: WasmExecutorOptions);
+    connect(): Promise<SandboxResult<void>>;
+    disconnect(): Promise<SandboxResult<void>>;
+    isAvailable(): Promise<boolean>;
+    execute(request: SandboxExecutionRequest, config: SandboxConfig): Promise<SandboxResult<SandboxExecutionResult>>;
+    private getOrCreatePlugin;
+    private loadWasmSource;
+    private buildInput;
+    private executeWithTimeout;
+}
+//# sourceMappingURL=wasm.d.ts.map

package/dist/executors/wasm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAI7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAiBD,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,UAAU,CAAgB;gBAEtB,OAAO,GAAE,mBAAwB;IAKvC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAYvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAY1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQ/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAkCnC,iBAAiB;YA6BjB,cAAc;IAiB5B,OAAO,CAAC,UAAU;YAWJ,kBAAkB;CA4DjC"}