@cogitator-ai/sandbox 0.2.29 → 0.4.0

package/README.md

@@ -88,6 +88,12 @@ if (result.success) {
 }
 ```
 
+### Fallback and Initialization
+
+`initialize()` is idempotent and safe to call concurrently; `execute()` calls it automatically. When the requested backend is unavailable the manager falls back (`wasm` → `docker` → `native`, `docker` → `native`) with a warning, and the manager `defaults` are applied to the fallback execution as well. The native fallback has **no isolation** — check `isDockerAvailable()` / `isWasmAvailable()` first if untrusted code must never reach the host.
+
+When no `docker` connection options are given, Dockerode's defaults are used, so `DOCKER_HOST` is respected.
+
 ### Availability Checks
 
 ```typescript
@@ -169,9 +175,16 @@ Docker containers run with these security settings:
   SecurityOpt: ['no-new-privileges'],  // No privilege escalation
   PidsLimit: 100,               // Limit process count
   ReadonlyRootfs: false,        // Writable (can enable true)
+  Labels: { 'ai.cogitator.sandbox': 'true' },
 }
 ```
 
+- `command` is executed as an argv array (no shell); use `['sh', '-c', '...']` for shell syntax.
+- Output is demultiplexed frame by frame (frames split across network chunks are reassembled) and capped at 50 000 bytes per stream.
+- Timed-out containers are destroyed instead of being returned to the pool.
+- `network.dns` is applied to new containers. `network.allowedHosts` is rejected because Docker cannot enforce an egress allow-list — use `mode: 'none'` or a dedicated network.
+- Containers are labeled `ai.cogitator.sandbox=true` (`SANDBOX_CONTAINER_LABEL`), so leftovers from a crashed process can be removed with `docker rm -f $(docker ps -aq --filter label=ai.cogitator.sandbox)`.
+
 ---
 
 ## Container Pool
@@ -198,6 +211,8 @@ await pool.release(container);
 await pool.destroyAll();
 ```
 
+Containers are only reused for requests with identical settings (image, resources, network mode, DNS, mounts and user), so a container created with a host mount or network access is never handed to a request that asked for isolation. The idle-cleanup timer does not keep the Node.js process alive.
+
 ### Pool Options
 
 | Option          | Type     | Default | Description                            |
@@ -209,7 +224,7 @@ await pool.destroyAll();
 
 ## WASM Executor
 
-Execute WebAssembly modules via Extism.
+Execute WebAssembly modules via Extism. Each plugin runs in its own worker thread, so a timeout terminates a runaway module instead of blocking the event loop. Idle plugins are pooled per module / WASI / allowed-host combination (up to `cacheSize`); concurrent executions use separate plugin instances.
 
 ```typescript
 import { WasmSandboxExecutor } from '@cogitator-ai/sandbox';
@@ -240,6 +255,11 @@ const result = await wasm.execute(
 await wasm.disconnect();
 ```
 
+- Local paths, module specifiers and `http(s)` URLs are supported for `wasmModule`.
+- `wasmModule`, `functionName` and `wasi` from the executor options are used when the per-request config omits them.
+- `network.allowedHosts` is forwarded to Extism's HTTP allow-list (empty when `network.mode` is `'none'`).
+- `memoryPages` (default 256 = 16 MB) is passed to Extism as `memory.maxPages`. It caps the memory Extism allocates for plugin input, output and vars; the module's own linear memory is not limited by it.
+
 ---
 
 ## Native Executor
@@ -267,6 +287,12 @@ console.log(result.data?.stdout);
 
 **Warning:** Native execution has no isolation. Use only when Docker is unavailable.
 
+- A single-element command (`['ls -la | wc -l']`) runs through the system shell; longer commands are executed directly with exact argv (no shell), like Docker.
+- `stdin` is piped to the process.
+- Only `PATH`, `HOME`, temp-dir, locale and Windows system variables are inherited from the host environment; secrets in `process.env` are not passed to executed code. Add variables explicitly via `env`.
+- On timeout the whole process group is killed (`SIGKILL`) and the result is returned immediately with exit code `124`.
+- Output is capped at 50 000 bytes per stream while the process is still drained.
+
 ---
 
 ## Execution Request
@@ -309,7 +335,7 @@ const result = await manager.execute(request, {
 });
 ```
 
-Supported formats: `'256B'`, `'256KB'`, `'256MB'`, `'256GB'`
+Supported formats: `'256B'`, `'256KB'`, `'256MB'`, `'1GB'`, `'1TB'`, Docker-style `'512m'` / `'2g'` and binary `'1GiB'` (all binary multiples, case-insensitive). Zero or negative memory and CPU limits are rejected instead of silently running unlimited.
 
 ### CPU
 

package/dist/executors/docker.d.ts

@@ -19,4 +19,14 @@ export declare class DockerSandboxExecutor extends BaseSandboxExecutor {
     execute(request: SandboxExecutionRequest, config: SandboxConfig): Promise<SandboxResult<SandboxExecutionResult>>;
     private runWithTimeout;
 }
+/**
+ * Decodes Docker's multiplexed attach stream, buffering frames split across chunks.
+ */
+export declare class DockerStreamDemuxer {
+    private readonly onStdout;
+    private readonly onStderr;
+    private buffer;
+    constructor(onStdout: (data: Buffer) => void, onStderr: (data: Buffer) => void);
+    push(chunk: Buffer): void;
+}
 //# sourceMappingURL=docker.d.ts.map

package/dist/executors/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAK7C,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAMD,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,IAAI,CAAC,CAAgB;IAC7B,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,GAAE,qBAA0B;IAKzC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAyBvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAS1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAwDnC,cAAc;CA0F7B"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAM7C,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAMD,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,IAAI,CAAC,CAAgB;IAC7B,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,GAAE,qBAA0B;IAKzC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IA2BvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAS1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YA6EnC,cAAc;CAgF7B;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,MAAM,CAA2B;gBAGtB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI;IAGnD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAe1B"}

package/dist/executors/docker.js

@@ -4,6 +4,7 @@
 import { BaseSandboxExecutor } from './base.js';
 import { ContainerPool } from '../pool/container-pool.js';
 import { parseMemory } from '../utils/parse-resources.js';
+import { OutputCollector } from '../utils/output-collector.js';
 const MAX_OUTPUT_SIZE = 50_000;
 const DEFAULT_TIMEOUT = 30_000;
 const DEFAULT_IMAGE = 'alpine:3.19';
@@ -19,11 +20,13 @@ export class DockerSandboxExecutor extends BaseSandboxExecutor {
     async connect() {
         try {
             const Dockerode = (await import('dockerode')).default;
-            this.docker = new Dockerode({
-                socketPath: this.options.docker?.socketPath ?? '/var/run/docker.sock',
-                host: this.options.docker?.host,
-                port: this.options.docker?.port,
-            });
+            const connection = this.options.docker ?? {};
+            const dockerOptions = connection.socketPath
+                ? { socketPath: connection.socketPath }
+                : connection.host
+                    ? { host: connection.host, port: connection.port }
+                    : undefined;
+            this.docker = new Dockerode(dockerOptions);
             await this.docker.ping();
             this.pool = new ContainerPool(this.docker, {
                 maxSize: this.options.pool?.maxSize ?? 5,
@@ -61,17 +64,35 @@ export class DockerSandboxExecutor extends BaseSandboxExecutor {
         if (!request.command || request.command.length === 0) {
             return this.failure('Command array is empty');
         }
+        if (config.network?.allowedHosts?.length) {
+            return this.failure('network.allowedHosts is not supported by the Docker executor; use network.mode instead');
+        }
         const startTime = Date.now();
         const timeout = request.timeout ?? config.timeout ?? DEFAULT_TIMEOUT;
         const image = config.image ?? DEFAULT_IMAGE;
+        let memory;
+        try {
+            memory = config.resources?.memory ? parseMemory(config.resources.memory) : undefined;
+        }
+        catch (error) {
+            return this.failure(error instanceof Error ? error.message : String(error));
+        }
+        if (memory !== undefined && memory <= 0) {
+            return this.failure(`Memory limit must be positive: ${config.resources?.memory}`);
+        }
+        const cpus = config.resources?.cpus;
+        if (cpus !== undefined && (!Number.isFinite(cpus) || cpus <= 0)) {
+            return this.failure(`CPU limit must be a positive number: ${cpus}`);
+        }
         let containerCorrupted = true;
         try {
             const container = await this.pool.acquire(image, {
-                memory: config.resources?.memory ? parseMemory(config.resources.memory) : undefined,
-                cpus: config.resources?.cpus,
+                memory,
+                cpus,
                 cpuShares: config.resources?.cpuShares,
                 pidsLimit: config.resources?.pidsLimit,
                 networkMode: config.network?.mode ?? 'none',
+                dns: config.network?.dns,
                 mounts: config.mounts,
                 user: config.user,
             });
@@ -103,41 +124,27 @@ export class DockerSandboxExecutor extends BaseSandboxExecutor {
         }
     }
     async runWithTimeout(exec, stdin, timeoutMs) {
-        let stdout = '';
-        let stderr = '';
+        const stdout = new OutputCollector(MAX_OUTPUT_SIZE);
+        const stderr = new OutputCollector(MAX_OUTPUT_SIZE);
+        const demuxer = new DockerStreamDemuxer((data) => stdout.push(data), (data) => stderr.push(data));
         let stream = null;
         const executionPromise = (async () => {
             stream = await exec.start({
                 hijack: true,
                 stdin: !!stdin,
             });
-            stream.on('data', (chunk) => {
-                let offset = 0;
-                while (offset < chunk.length) {
-                    if (offset + 8 > chunk.length)
-                        break;
-                    const type = chunk[offset];
-                    const size = (chunk[offset + 4] << 24) |
-                        (chunk[offset + 5] << 16) |
-                        (chunk[offset + 6] << 8) |
-                        chunk[offset + 7];
-                    if (offset + 8 + size > chunk.length)
-                        break;
-                    const data = chunk.slice(offset + 8, offset + 8 + size).toString('utf-8');
-                    if (type === 1) {
-                        stdout += data;
-                    }
-                    else if (type === 2) {
-                        stderr += data;
-                    }
-                    offset += 8 + size;
-                }
+            const active = stream;
+            const finished = new Promise((resolve, reject) => {
+                active.on('end', () => resolve());
+                active.on('close', () => resolve());
+                active.on('error', (error) => reject(error instanceof Error ? error : new Error(String(error))));
             });
+            active.on('data', (chunk) => demuxer.push(chunk));
             if (stdin) {
-                stream.write(stdin);
-                stream.end();
+                active.write(stdin);
+                active.end();
             }
-            await new Promise((res) => stream.on('end', res));
+            await finished;
             const inspection = await exec.inspect();
             return inspection.ExitCode ?? 1;
         })();
@@ -151,11 +158,9 @@ export class DockerSandboxExecutor extends BaseSandboxExecutor {
         });
         try {
             const exitCode = await Promise.race([executionPromise, timeoutPromise]);
-            if (timer)
-                clearTimeout(timer);
             return {
-                stdout: stdout.slice(0, MAX_OUTPUT_SIZE),
-                stderr: stderr.slice(0, MAX_OUTPUT_SIZE),
+                stdout: stdout.toString(),
+                stderr: stderr.toString(),
                 exitCode,
                 timedOut: false,
                 containerCorrupted: false,
@@ -163,17 +168,47 @@ export class DockerSandboxExecutor extends BaseSandboxExecutor {
         }
         catch (error) {
             if (error instanceof Error && error.message === 'TIMEOUT') {
+                executionPromise.catch(() => undefined);
                 return {
-                    stdout: stdout.slice(0, MAX_OUTPUT_SIZE),
-                    stderr: stderr.slice(0, MAX_OUTPUT_SIZE),
+                    stdout: stdout.toString(),
+                    stderr: stderr.toString(),
                     exitCode: 124,
                     timedOut: true,
                     containerCorrupted: true,
                 };
             }
+            throw error;
+        }
+        finally {
             if (timer)
                 clearTimeout(timer);
-            throw error;
+        }
+    }
+}
+/**
+ * Decodes Docker's multiplexed attach stream, buffering frames split across chunks.
+ */
+export class DockerStreamDemuxer {
+    onStdout;
+    onStderr;
+    buffer = Buffer.alloc(0);
+    constructor(onStdout, onStderr) {
+        this.onStdout = onStdout;
+        this.onStderr = onStderr;
+    }
+    push(chunk) {
+        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        while (this.buffer.length >= 8) {
+            const type = this.buffer[0];
+            const size = this.buffer.readUInt32BE(4);
+            if (this.buffer.length < 8 + size)
+                break;
+            const payload = this.buffer.subarray(8, 8 + size);
+            if (type === 1)
+                this.onStdout(payload);
+            else if (type === 2)
+                this.onStderr(payload);
+            this.buffer = this.buffer.subarray(8 + size);
         }
     }
 }

package/dist/executors/docker.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQvD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IACjB,MAAM,CAAU;IAChB,IAAI,CAAiB;IACrB,OAAO,CAAwB;IAEvC,YAAY,UAAiC,EAAE;QAC7C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YAEtD,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC;gBAC1B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,sBAAsB;gBACrE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI;gBAC/B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI;aAChC,CAAsB,CAAC;YAExB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAEzB,IAAI,CAAC,IAAI,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC;gBACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,MAAM;aAC1D,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;QAE5C,IAAI,kBAAkB,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;gBAC/C,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI;gBAC5B,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,MAAM;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;oBAChC,GAAG,EAAE,OAAO,CAAC,OAAO;oBACpB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnF,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,YAAY;oBACzD,YAAY,EAAE,IAAI;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;iBAC7B,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACvE,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBAE/C,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAAgB,EAChB,KAAyB,EACzB,SAAiB;QAQjB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAwB,IAAI,CAAC;QAEvC,MAAM,gBAAgB,GAAG,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBACxB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;wBAAE,MAAM;oBAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC3B,MAAM,IAAI,GACR,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;wBACxB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAEpB,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM;wBAAE,MAAM;oBAE5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAE1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACf,MAAM,IAAI,IAAI,CAAC;oBACjB,CAAC;yBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACtB,MAAM,IAAI,IAAI,CAAC;oBACjB,CAAC;oBAED,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,CAAC;YAED,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,KAAK,GAAyC,IAAI,CAAC;QAEvD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,IAAI,MAAM;oBAAE,MAAM,CAAC,GAAG,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACxC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACxC,QAAQ;gBACR,QAAQ,EAAE,KAAK;gBACf,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;oBACxC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;oBACxC,QAAQ,EAAE,GAAG;oBACb,QAAQ,EAAE,IAAI;oBACd,kBAAkB,EAAE,IAAI;iBACzB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAQ5D,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IACjB,MAAM,CAAU;IAChB,IAAI,CAAiB;IACrB,OAAO,CAAwB;IAEvC,YAAY,UAAiC,EAAE;QAC7C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU;gBACzC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE;gBACvC,CAAC,CAAC,UAAU,CAAC,IAAI;oBACf,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;oBAClD,CAAC,CAAC,SAAS,CAAC;YAEhB,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,aAAa,CAAsB,CAAC;YAEhE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAEzB,IAAI,CAAC,IAAI,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC;gBACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,MAAM;aAC1D,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,CACjB,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;QAE5C,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,CAAC,kCAAkC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,OAAO,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,kBAAkB,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;gBAC/C,MAAM;gBACN,IAAI;gBACJ,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,MAAM;gBAC3C,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG;gBACxB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;oBAChC,GAAG,EAAE,OAAO,CAAC,OAAO;oBACpB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnF,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,YAAY;oBACzD,YAAY,EAAE,IAAI;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;iBAC7B,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACvE,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBAE/C,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAAgB,EAChB,KAAyB,EACzB,SAAiB;QAQjB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,mBAAmB,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,MAAM,GAAwB,IAAI,CAAC;QAEvC,MAAM,gBAAgB,GAAG,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBACxB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC;YAEtB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE,CACpC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAE1D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,CAAC;YAED,MAAM,QAAQ,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,KAAK,GAAyC,IAAI,CAAC;QAEvD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,IAAI,MAAM;oBAAE,MAAM,CAAC,GAAG,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,QAAQ;gBACR,QAAQ,EAAE,KAAK;gBACf,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1D,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACxC,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,QAAQ,EAAE,GAAG;oBACb,QAAQ,EAAE,IAAI;oBACd,kBAAkB,EAAE,IAAI;iBACzB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAIX;IACA;IAJX,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzC,YACmB,QAAgC,EAChC,QAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAwB;QAChC,aAAQ,GAAR,QAAQ,CAAwB;IAChD,CAAC;IAEJ,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAErF,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI;gBAAE,MAAM;YAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,IAAI,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF"}

package/dist/executors/native.d.ts

@@ -1,6 +1,9 @@
 /**
  * Native sandbox executor - no isolation, runs directly on host.
  * Used as fallback when Docker is unavailable.
+ *
+ * A single-element command is run through the system shell; longer commands are
+ * executed directly with exact argv (no shell), matching the Docker executor.
  */
 import type { SandboxConfig, SandboxExecutionRequest, SandboxExecutionResult, SandboxResult } from '@cogitator-ai/types';
 import { BaseSandboxExecutor } from './base.js';

package/dist/executors/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/executors/native.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAO7C,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IAEnB,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAIvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAI1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAmDlD"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/executors/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AA+B7C,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IAEnB,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAIvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAI1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;CA4ElD"}

package/dist/executors/native.js

@@ -1,13 +1,39 @@
 /**
  * Native sandbox executor - no isolation, runs directly on host.
  * Used as fallback when Docker is unavailable.
+ *
+ * A single-element command is run through the system shell; longer commands are
+ * executed directly with exact argv (no shell), matching the Docker executor.
  */
-import { exec as execCallback } from 'node:child_process';
-import { promisify } from 'node:util';
+import { spawn } from 'node:child_process';
 import { BaseSandboxExecutor } from './base.js';
-const execPromise = promisify(execCallback);
+import { OutputCollector } from '../utils/output-collector.js';
+const DEFAULT_TIMEOUT = 30_000;
 const MAX_OUTPUT_SIZE = 50_000;
-const MAX_BUFFER = 10 * 1024 * 1024;
+const INHERITED_ENV_KEYS = [
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'LANG',
+    'LC_ALL',
+    'TZ',
+    'SystemRoot',
+    'SYSTEMROOT',
+    'ComSpec',
+    'PATHEXT',
+    'WINDIR',
+];
+function baseEnvironment() {
+    const env = {};
+    for (const key of INHERITED_ENV_KEYS) {
+        const value = process.env[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    return env;
+}
 export class NativeSandboxExecutor extends BaseSandboxExecutor {
     type = 'native';
     async connect() {
@@ -23,43 +49,83 @@ export class NativeSandboxExecutor extends BaseSandboxExecutor {
         if (!request.command || request.command.length === 0) {
             return this.failure('Command array is empty');
         }
+        const [file, ...args] = request.command;
+        const useShell = request.command.length === 1;
         const startTime = Date.now();
-        const timeout = request.timeout ?? config.timeout ?? 30_000;
-        try {
-            const command = request.command.join(' ');
-            const { stdout, stderr } = await execPromise(command, {
+        const timeout = request.timeout ?? config.timeout ?? DEFAULT_TIMEOUT;
+        const stdout = new OutputCollector(MAX_OUTPUT_SIZE);
+        const stderr = new OutputCollector(MAX_OUTPUT_SIZE);
+        return new Promise((resolve) => {
+            let timedOut = false;
+            let settled = false;
+            const finish = (exitCode, extraStderr) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                if (extraStderr)
+                    stderr.push(extraStderr);
+                resolve(this.success({
+                    stdout: stdout.toString(),
+                    stderr: timedOut
+                        ? stderr.toString() || `Command timed out after ${timeout}ms`
+                        : stderr.toString(),
+                    exitCode: timedOut ? 124 : exitCode,
+                    timedOut,
+                    duration: Date.now() - startTime,
+                }));
+            };
+            const useProcessGroup = process.platform !== 'win32';
+            const child = spawn(file, args, {
                 cwd: request.cwd ?? config.workdir,
-                timeout,
-                env: { ...process.env, ...config.env, ...request.env },
-                maxBuffer: MAX_BUFFER,
+                env: { ...baseEnvironment(), ...config.env, ...request.env },
+                stdio: ['pipe', 'pipe', 'pipe'],
+                windowsHide: true,
+                detached: useProcessGroup,
+                shell: useShell,
             });
-            return this.success({
-                stdout: stdout.slice(0, MAX_OUTPUT_SIZE),
-                stderr: stderr.slice(0, MAX_OUTPUT_SIZE),
-                exitCode: 0,
-                timedOut: false,
-                duration: Date.now() - startTime,
+            const timer = setTimeout(() => {
+                timedOut = true;
+                try {
+                    if (useProcessGroup && child.pid !== undefined) {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    else {
+                        child.kill('SIGKILL');
+                    }
+                }
+                catch {
+                    child.kill('SIGKILL');
+                }
+                child.stdout.destroy();
+                child.stderr.destroy();
+                finish(124);
+            }, timeout);
+            child.stdout.on('data', (chunk) => stdout.push(chunk));
+            child.stderr.on('data', (chunk) => stderr.push(chunk));
+            child.on('error', (error) => {
+                const exitCode = error.code === 'ENOENT' ? 127 : error.code === 'EACCES' ? 126 : 1;
+                finish(exitCode, error.message);
             });
-        }
-        catch (err) {
-            const error = err;
-            if (error.killed) {
-                return this.success({
-                    stdout: '',
-                    stderr: `Command timed out after ${timeout.toString()}ms`,
-                    exitCode: 124,
-                    timedOut: true,
-                    duration: Date.now() - startTime,
-                });
-            }
-            return this.success({
-                stdout: (error.stdout ?? '').slice(0, MAX_OUTPUT_SIZE),
-                stderr: (error.stderr ?? error.message).slice(0, MAX_OUTPUT_SIZE),
-                exitCode: error.code ?? 1,
-                timedOut: false,
-                duration: Date.now() - startTime,
+            child.on('close', (code, signal) => {
+                finish(code ?? (signal ? 128 + signalNumber(signal) : 1));
             });
-        }
+            child.stdin.on('error', () => undefined);
+            child.stdin.end(request.stdin ?? '');
+        });
     }
 }
+function signalNumber(signal) {
+    const numbers = {
+        SIGHUP: 1,
+        SIGINT: 2,
+        SIGQUIT: 3,
+        SIGABRT: 6,
+        SIGKILL: 9,
+        SIGSEGV: 11,
+        SIGPIPE: 13,
+        SIGTERM: 15,
+    };
+    return numbers[signal] ?? 0;
+}
 //# sourceMappingURL=native.js.map

package/dist/executors/native.js.map

@@ -1 +1 @@
-{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/executors/native.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AAE5C,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpC,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IAEzB,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QAE5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE;gBACpD,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;gBAClC,OAAO;gBACP,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACtD,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACxC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACxC,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAKb,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,2BAA2B,OAAO,CAAC,QAAQ,EAAE,IAAI;oBACzD,QAAQ,EAAE,GAAG;oBACb,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACtD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBACjE,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;gBACzB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/executors/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAO3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,kBAAkB,GAAG;IACzB,MAAM;IACN,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,SAAS;IACT,QAAQ;CACT,CAAC;AAEF,SAAS,eAAe;IACtB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IAEzB,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAEpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,WAAoB,EAAE,EAAE;gBACxD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,WAAW;oBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1C,OAAO,CACL,IAAI,CAAC,OAAO,CAAC;oBACX,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,QAAQ;wBACd,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,2BAA2B,OAAO,IAAI;wBAC7D,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;oBACrB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ;oBACnC,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;gBAC9B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;gBAClC,GAAG,EAAE,EAAE,GAAG,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBAC5D,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC;oBACH,IAAI,eAAe,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;wBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACtC,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAE/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;gBACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnF,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;gBACvE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,YAAY,CAAC,MAAsB;IAC1C,MAAM,OAAO,GAA4C;QACvD,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;KACZ,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/executors/wasm.d.ts

@@ -2,8 +2,7 @@
  * WASM sandbox executor - isolated execution via Extism
  *
  * Provides fast, memory-safe execution of WASM modules.
- * Cold start: 1-10ms (vs Docker 1-5s)
- * Memory: 1-10MB per plugin (vs Docker 50-200MB)
+ * Every plugin runs in its own worker thread so timeouts can terminate runaway modules.
  */
 import type { SandboxConfig, SandboxExecutionRequest, SandboxExecutionResult, SandboxResult, SandboxWasmConfig } from '@cogitator-ai/types';
 import { BaseSandboxExecutor } from './base.js';
@@ -13,17 +12,21 @@ export interface WasmExecutorOptions {
 export declare class WasmSandboxExecutor extends BaseSandboxExecutor {
     readonly type = "wasm";
     private createPlugin?;
-    private pluginCache;
-    private options;
-    private cacheOrder;
+    private readonly idlePlugins;
+    private readonly activePlugins;
+    private idleCount;
+    private generation;
+    private readonly options;
     constructor(options?: WasmExecutorOptions);
     connect(): Promise<SandboxResult<void>>;
     disconnect(): Promise<SandboxResult<void>>;
     isAvailable(): Promise<boolean>;
     execute(request: SandboxExecutionRequest, config: SandboxConfig): Promise<SandboxResult<SandboxExecutionResult>>;
-    private getOrCreatePlugin;
-    private loadWasmSource;
+    private acquire;
+    private release;
+    private closePlugin;
+    private loadManifest;
     private buildInput;
-    private executeWithTimeout;
+    private callWithTimeout;
 }
 //# sourceMappingURL=wasm.d.ts.map

package/dist/executors/wasm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAK7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAiBD,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,UAAU,CAAgB;gBAEtB,OAAO,GAAE,mBAAwB;IAKvC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAYvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAgB1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQ/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAkCnC,iBAAiB;YAkCjB,cAAc;IAoB5B,OAAO,CAAC,UAAU;YAWJ,kBAAkB;CA+DjC"}
+{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAK7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAqCD,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAElC,OAAO,GAAE,mBAAwB;IAKvC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAYvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAU1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQ/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAuDnC,OAAO;YAuBP,OAAO;YAsBP,WAAW;YAWX,YAAY;IAkB1B,OAAO,CAAC,UAAU;YAWJ,eAAe;CAiC9B"}