@cogitator-ai/sandbox 0.4.3 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +72 -41
- package/dist/executors/docker.d.ts.map +1 -1
- package/dist/executors/docker.js +16 -8
- package/dist/executors/docker.js.map +1 -1
- package/dist/executors/wasm-memory.d.ts +9 -0
- package/dist/executors/wasm-memory.d.ts.map +1 -0
- package/dist/executors/wasm-memory.js +91 -0
- package/dist/executors/wasm-memory.js.map +1 -0
- package/dist/executors/wasm.d.ts +2 -1
- package/dist/executors/wasm.d.ts.map +1 -1
- package/dist/executors/wasm.js +13 -6
- package/dist/executors/wasm.js.map +1 -1
- package/dist/pool/container-pool.d.ts +17 -1
- package/dist/pool/container-pool.d.ts.map +1 -1
- package/dist/pool/container-pool.js +57 -42
- package/dist/pool/container-pool.js.map +1 -1
- package/dist/sandbox-manager.d.ts +1 -0
- package/dist/sandbox-manager.d.ts.map +1 -1
- package/dist/sandbox-manager.js +21 -8
- package/dist/sandbox-manager.js.map +1 -1
- package/dist/utils/docker-connection.d.ts +22 -0
- package/dist/utils/docker-connection.d.ts.map +1 -0
- package/dist/utils/docker-connection.js +94 -0
- package/dist/utils/docker-connection.js.map +1 -0
- package/package.json +5 -4
package/README.md
CHANGED
|
@@ -25,15 +25,22 @@ const result = await manager.execute(
|
|
|
25
25
|
{ type: 'docker', image: 'python:3.11-alpine' }
|
|
26
26
|
);
|
|
27
27
|
|
|
28
|
-
|
|
28
|
+
if (result.success) {
|
|
29
|
+
console.log(result.data.stdout); // "Hello!"
|
|
30
|
+
} else {
|
|
31
|
+
console.error(result.error);
|
|
32
|
+
}
|
|
29
33
|
```
|
|
30
34
|
|
|
35
|
+
`execute()` returns a `SandboxResult`: `{ success: true, data }` or `{ success: false, error }`. A command that exits non-zero is still a success; check `data.exitCode`.
|
|
36
|
+
|
|
31
37
|
## Features
|
|
32
38
|
|
|
33
39
|
- **Docker Sandbox** - Full container isolation with dropped capabilities
|
|
34
40
|
- **WASM Sandbox** - Extism-powered WebAssembly execution
|
|
35
|
-
- **Native Fallback** -
|
|
36
|
-
- **Container Pool** -
|
|
41
|
+
- **Native Fallback** - Optional host execution for Docker tools when Docker is unavailable (`allowNativeFallback`)
|
|
42
|
+
- **Container Pool** - A fresh, pre-started container for every execution
|
|
43
|
+
- **Daemon Discovery** - Finds Docker like the `docker` CLI: `DOCKER_HOST`, contexts, Docker Desktop, OrbStack, Colima, Rancher, rootless
|
|
37
44
|
- **Resource Limits** - Memory, CPU, PID limits
|
|
38
45
|
- **Network Isolation** - Disabled by default
|
|
39
46
|
- **Timeout Enforcement** - Kill runaway processes
|
|
@@ -43,15 +50,13 @@ console.log(result.data?.stdout); // "Hello!"
|
|
|
43
50
|
|
|
44
51
|
## Sandbox Manager
|
|
45
52
|
|
|
46
|
-
The `SandboxManager` orchestrates
|
|
53
|
+
The `SandboxManager` orchestrates the execution backends and routes each request to the one its `type` names.
|
|
47
54
|
|
|
48
55
|
```typescript
|
|
49
56
|
import { SandboxManager } from '@cogitator-ai/sandbox';
|
|
50
57
|
|
|
51
58
|
const manager = new SandboxManager({
|
|
52
|
-
|
|
53
|
-
socketPath: '/var/run/docker.sock',
|
|
54
|
-
},
|
|
59
|
+
allowNativeFallback: false,
|
|
55
60
|
pool: {
|
|
56
61
|
maxSize: 10,
|
|
57
62
|
idleTimeoutMs: 120_000,
|
|
@@ -90,9 +95,18 @@ if (result.success) {
|
|
|
90
95
|
|
|
91
96
|
### Fallback and Initialization
|
|
92
97
|
|
|
93
|
-
`initialize()` is idempotent and safe to call concurrently; `execute()` calls it automatically.
|
|
98
|
+
`initialize()` is idempotent and safe to call concurrently; `execute()` calls it automatically.
|
|
99
|
+
|
|
100
|
+
The manager falls back in one case: a `docker` request while Docker is unavailable runs on the host through the native executor, with **no isolation**, and the first such call logs a warning. `allowNativeFallback: false` refuses those requests with `{ success: false, error }` instead; it defaults to `true`. The manager `defaults` apply to the fallback execution as well. A `wasm` request never falls back: without `@extism/extism` it fails with `WASM sandbox unavailable: install @extism/extism to run WASM tools`.
|
|
101
|
+
|
|
102
|
+
### Finding the Docker Daemon
|
|
94
103
|
|
|
95
|
-
|
|
104
|
+
With `docker.socketPath` or `docker.host` (+ `port`) the executor connects there. Otherwise it tries, in order, the first that answers a ping:
|
|
105
|
+
|
|
106
|
+
1. `DOCKER_HOST` when set (handed to Dockerode, nothing else is tried)
|
|
107
|
+
2. The endpoint of the current Docker context (`DOCKER_CONTEXT`, else `currentContext` in `$DOCKER_CONFIG/config.json`, default `~/.docker`)
|
|
108
|
+
3. The sockets that exist among `/var/run/docker.sock`, `~/.docker/run/docker.sock` (Docker Desktop), `~/.orbstack/run/docker.sock` (OrbStack), `~/.colima/default/docker.sock` and `~/.colima/docker.sock` (Colima), `~/.rd/docker.sock` (Rancher Desktop) and `$XDG_RUNTIME_DIR/docker.sock` (rootless Docker)
|
|
109
|
+
4. Dockerode's defaults, when none of the above exists
|
|
96
110
|
|
|
97
111
|
### Availability Checks
|
|
98
112
|
|
|
@@ -166,22 +180,21 @@ await docker.disconnect();
|
|
|
166
180
|
|
|
167
181
|
### Security Features
|
|
168
182
|
|
|
169
|
-
Docker containers
|
|
183
|
+
Docker containers are created with this host configuration:
|
|
170
184
|
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
```
|
|
185
|
+
| Setting | Value |
|
|
186
|
+
| ------------- | --------------------------------------------- |
|
|
187
|
+
| `NetworkMode` | `network.mode`, default `'none'` (no network) |
|
|
188
|
+
| `CapDrop` | `['ALL']` (every capability dropped) |
|
|
189
|
+
| `SecurityOpt` | `['no-new-privileges']` |
|
|
190
|
+
| `PidsLimit` | `resources.pidsLimit`, default `100` |
|
|
191
|
+
| Root FS | Writable (not configurable) |
|
|
192
|
+
| Working dir | `/workspace` |
|
|
193
|
+
| Label | `ai.cogitator.sandbox=true` |
|
|
181
194
|
|
|
182
195
|
- `command` is executed as an argv array (no shell); use `['sh', '-c', '...']` for shell syntax.
|
|
183
196
|
- Output is demultiplexed frame by frame (frames split across network chunks are reassembled) and capped at 50 000 bytes per stream.
|
|
184
|
-
-
|
|
197
|
+
- Every execution gets a container nothing ran in before (see [Container Pool](#container-pool)); timed-out containers are always destroyed.
|
|
185
198
|
- `network.dns` is applied to new containers. `network.allowedHosts` is rejected because Docker cannot enforce an egress allow-list — use `mode: 'none'` or a dedicated network.
|
|
186
199
|
- Containers are labeled `ai.cogitator.sandbox=true` (`SANDBOX_CONTAINER_LABEL`), so leftovers from a crashed process can be removed with `docker rm -f $(docker ps -aq --filter label=ai.cogitator.sandbox)`.
|
|
187
200
|
|
|
@@ -189,7 +202,7 @@ Docker containers run with these security settings:
|
|
|
189
202
|
|
|
190
203
|
## Container Pool
|
|
191
204
|
|
|
192
|
-
|
|
205
|
+
Keeps containers started ahead of executions. By default a released container is destroyed and a fresh one with the same settings is started in its place, so the next execution gets a warm container nothing ran in before — files and processes never carry over between runs or users.
|
|
193
206
|
|
|
194
207
|
```typescript
|
|
195
208
|
import { ContainerPool } from '@cogitator-ai/sandbox';
|
|
@@ -211,14 +224,17 @@ await pool.release(container);
|
|
|
211
224
|
await pool.destroyAll();
|
|
212
225
|
```
|
|
213
226
|
|
|
214
|
-
|
|
227
|
+
A container only serves requests with identical settings (image, resources, network mode, DNS, mounts and user), so a container created with a host mount or network access is never handed to a request that asked for isolation. `release(container, { corrupted: true })` always destroys the container. `destroyAll()` removes every container and closes the pool. The idle-cleanup timer does not keep the Node.js process alive.
|
|
215
228
|
|
|
216
229
|
### Pool Options
|
|
217
230
|
|
|
218
|
-
| Option
|
|
219
|
-
|
|
|
220
|
-
| `maxSize`
|
|
221
|
-
| `idleTimeoutMs`
|
|
231
|
+
| Option | Type | Default | Description |
|
|
232
|
+
| ----------------- | --------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
233
|
+
| `maxSize` | `number` | `5` | Maximum idle and warming containers; no spare is started beyond it |
|
|
234
|
+
| `idleTimeoutMs` | `number` | `60000` | Time before destroying idle containers |
|
|
235
|
+
| `reuseContainers` | `boolean` | `false` | Return released containers to the pool as they are: faster, but what one execution leaves behind is visible to the next, from any run or user |
|
|
236
|
+
|
|
237
|
+
Pass the same options as `pool` to `SandboxManager`, `DockerSandboxExecutor` or `new Cogitator({ sandbox: { pool } })`.
|
|
222
238
|
|
|
223
239
|
---
|
|
224
240
|
|
|
@@ -258,7 +274,7 @@ await wasm.disconnect();
|
|
|
258
274
|
- Local paths, module specifiers and `http(s)` URLs are supported for `wasmModule`.
|
|
259
275
|
- `wasmModule`, `functionName` and `wasi` from the executor options are used when the per-request config omits them.
|
|
260
276
|
- `network.allowedHosts` is forwarded to Extism's HTTP allow-list (empty when `network.mode` is `'none'`).
|
|
261
|
-
- `memoryPages` (default 256 = 16 MB)
|
|
277
|
+
- `memoryPages` (default 256 = 16 MB) caps the module's own memory: its memory section gets that maximum before the module loads, so `memory.grow` past it fails inside the module, and a module that needs more to start is refused. Extism's memory for plugin input, output and vars gets the same limit. Modules from a URL are fetched by the executor so the cap applies to them too.
|
|
262
278
|
|
|
263
279
|
---
|
|
264
280
|
|
|
@@ -282,7 +298,7 @@ const result = await native.execute(
|
|
|
282
298
|
{ type: 'native' }
|
|
283
299
|
);
|
|
284
300
|
|
|
285
|
-
console.log(result.data
|
|
301
|
+
if (result.success) console.log(result.data.stdout);
|
|
286
302
|
```
|
|
287
303
|
|
|
288
304
|
**Warning:** Native execution has no isolation. Use only when Docker is unavailable.
|
|
@@ -339,23 +355,29 @@ Supported formats: `'256B'`, `'256KB'`, `'256MB'`, `'1GB'`, `'1TB'`, Docker-styl
|
|
|
339
355
|
|
|
340
356
|
### CPU
|
|
341
357
|
|
|
358
|
+
`SandboxConfig` is exported as a type (`import type { SandboxConfig } from '@cogitator-ai/sandbox'`).
|
|
359
|
+
|
|
342
360
|
```typescript
|
|
343
|
-
{
|
|
361
|
+
const config: SandboxConfig = {
|
|
362
|
+
type: 'docker',
|
|
363
|
+
image: 'alpine',
|
|
344
364
|
resources: {
|
|
345
365
|
cpus: 0.5,
|
|
346
366
|
cpuShares: 512,
|
|
347
367
|
},
|
|
348
|
-
}
|
|
368
|
+
};
|
|
349
369
|
```
|
|
350
370
|
|
|
351
371
|
### Process Limits
|
|
352
372
|
|
|
353
373
|
```typescript
|
|
354
|
-
{
|
|
374
|
+
const config: SandboxConfig = {
|
|
375
|
+
type: 'docker',
|
|
376
|
+
image: 'alpine',
|
|
355
377
|
resources: {
|
|
356
378
|
pidsLimit: 50,
|
|
357
379
|
},
|
|
358
|
-
}
|
|
380
|
+
};
|
|
359
381
|
```
|
|
360
382
|
|
|
361
383
|
---
|
|
@@ -363,11 +385,13 @@ Supported formats: `'256B'`, `'256KB'`, `'256MB'`, `'1GB'`, `'1TB'`, Docker-styl
|
|
|
363
385
|
## Network Configuration
|
|
364
386
|
|
|
365
387
|
```typescript
|
|
366
|
-
{
|
|
388
|
+
const config: SandboxConfig = {
|
|
389
|
+
type: 'docker',
|
|
390
|
+
image: 'alpine',
|
|
367
391
|
network: {
|
|
368
392
|
mode: 'none',
|
|
369
393
|
},
|
|
370
|
-
}
|
|
394
|
+
};
|
|
371
395
|
```
|
|
372
396
|
|
|
373
397
|
Network modes:
|
|
@@ -383,12 +407,14 @@ Network modes:
|
|
|
383
407
|
Mount host directories into the container:
|
|
384
408
|
|
|
385
409
|
```typescript
|
|
386
|
-
{
|
|
410
|
+
const config: SandboxConfig = {
|
|
411
|
+
type: 'docker',
|
|
412
|
+
image: 'alpine',
|
|
387
413
|
mounts: [
|
|
388
414
|
{ source: '/host/data', target: '/data', readOnly: true },
|
|
389
415
|
{ source: '/host/output', target: '/output', readOnly: false },
|
|
390
416
|
],
|
|
391
|
-
}
|
|
417
|
+
};
|
|
392
418
|
```
|
|
393
419
|
|
|
394
420
|
---
|
|
@@ -463,10 +489,13 @@ const shellTool = tool({
|
|
|
463
489
|
const cog = new Cogitator({
|
|
464
490
|
sandbox: {
|
|
465
491
|
pool: { maxSize: 5 },
|
|
492
|
+
allowNativeFallback: false,
|
|
466
493
|
},
|
|
467
494
|
});
|
|
468
495
|
```
|
|
469
496
|
|
|
497
|
+
The runtime starts a `SandboxManager` from `new Cogitator({ sandbox })` on the first sandboxed tool call. For a Docker tool it does not call `execute`: the sandbox runs the tool's `command` argument with `sh -c` (with optional `cwd` / `env` arguments) and the output becomes the tool result. A WASM tool gets its arguments as JSON on stdin and its JSON stdout is the result. When Docker is unavailable — or this package is missing or fails to start — a Docker tool runs its `execute` unsandboxed on the host with a warning, unless `sandbox.allowNativeFallback: false` turns the call into a tool error. A WASM tool fails when Extism is missing, and runs its own `execute` only when this package is missing or fails to start. See [Sandbox](https://cogitator.app/docs/deployment/sandbox) on the website.
|
|
498
|
+
|
|
470
499
|
---
|
|
471
500
|
|
|
472
501
|
## Examples
|
|
@@ -493,8 +522,10 @@ print(json.dumps(data))
|
|
|
493
522
|
}
|
|
494
523
|
);
|
|
495
524
|
|
|
496
|
-
|
|
497
|
-
|
|
525
|
+
if (result.success) {
|
|
526
|
+
const output = JSON.parse(result.data.stdout);
|
|
527
|
+
console.log(output.sum);
|
|
528
|
+
}
|
|
498
529
|
```
|
|
499
530
|
|
|
500
531
|
### Run Node.js Code
|
|
@@ -535,7 +566,7 @@ const result = await manager.execute(
|
|
|
535
566
|
{ type: 'docker', image: 'alpine', timeout: 5000 }
|
|
536
567
|
);
|
|
537
568
|
|
|
538
|
-
if (result.data
|
|
569
|
+
if (result.success && result.data.timedOut) {
|
|
539
570
|
console.log('Command timed out');
|
|
540
571
|
}
|
|
541
572
|
```
|
|
@@ -548,7 +579,7 @@ const result = await manager.execute(
|
|
|
548
579
|
{ type: 'docker', image: 'alpine' }
|
|
549
580
|
);
|
|
550
581
|
|
|
551
|
-
console.log('Exit code:', result.data
|
|
582
|
+
if (result.success) console.log('Exit code:', result.data.exitCode);
|
|
552
583
|
```
|
|
553
584
|
|
|
554
585
|
---
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAO7C,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAMD,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,IAAI,CAAC,CAAgB;IAC7B,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,GAAE,qBAA0B;IAKzC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IA8BvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAS1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YA6EnC,cAAc;CAgF7B;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,MAAM,CAA2B;gBAGtB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI;IAGnD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAe1B"}
|
package/dist/executors/docker.js
CHANGED
|
@@ -5,6 +5,7 @@ import { BaseSandboxExecutor } from './base.js';
|
|
|
5
5
|
import { ContainerPool } from '../pool/container-pool.js';
|
|
6
6
|
import { parseMemory } from '../utils/parse-resources.js';
|
|
7
7
|
import { OutputCollector } from '../utils/output-collector.js';
|
|
8
|
+
import { dockerConnectionCandidates } from '../utils/docker-connection.js';
|
|
8
9
|
const MAX_OUTPUT_SIZE = 50_000;
|
|
9
10
|
const DEFAULT_TIMEOUT = 30_000;
|
|
10
11
|
const DEFAULT_IMAGE = 'alpine:3.19';
|
|
@@ -20,17 +21,24 @@ export class DockerSandboxExecutor extends BaseSandboxExecutor {
|
|
|
20
21
|
async connect() {
|
|
21
22
|
try {
|
|
22
23
|
const Dockerode = (await import('dockerode')).default;
|
|
23
|
-
|
|
24
|
-
const
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
24
|
+
let lastError;
|
|
25
|
+
for (const options of dockerConnectionCandidates(this.options.docker)) {
|
|
26
|
+
const docker = new Dockerode(options);
|
|
27
|
+
try {
|
|
28
|
+
await docker.ping();
|
|
29
|
+
this.docker = docker;
|
|
30
|
+
break;
|
|
31
|
+
}
|
|
32
|
+
catch (error) {
|
|
33
|
+
lastError = error;
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
if (!this.docker)
|
|
37
|
+
throw lastError;
|
|
31
38
|
this.pool = new ContainerPool(this.docker, {
|
|
32
39
|
maxSize: this.options.pool?.maxSize ?? 5,
|
|
33
40
|
idleTimeoutMs: this.options.pool?.idleTimeoutMs ?? 60_000,
|
|
41
|
+
reuseContainers: this.options.pool?.reuseContainers ?? false,
|
|
34
42
|
});
|
|
35
43
|
return this.success(undefined);
|
|
36
44
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/executors/docker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAQxE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,IAAI,GAAG,QAAQ,CAAC;IACjB,MAAM,CAAU;IAChB,IAAI,CAAiB;IACrB,OAAO,CAAwB;IAEvC,YAAY,UAAiC,EAAE;QAC7C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACtD,IAAI,SAAkB,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,CAAsB,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,SAAS,CAAC;YAElC,IAAI,CAAC,IAAI,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC;gBACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,MAAM;gBACzD,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,IAAI,KAAK;aAC7D,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,CACjB,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;QAE5C,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,CAAC,kCAAkC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,OAAO,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,kBAAkB,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;gBAC/C,MAAM;gBACN,IAAI;gBACJ,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS;gBACtC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,MAAM;gBAC3C,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG;gBACxB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;oBAChC,GAAG,EAAE,OAAO,CAAC,OAAO;oBACpB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnF,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,YAAY;oBACzD,YAAY,EAAE,IAAI;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;iBAC7B,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACvE,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBAE/C,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAAgB,EAChB,KAAyB,EACzB,SAAiB;QAQjB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,mBAAmB,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,MAAM,GAAwB,IAAI,CAAC;QAEvC,MAAM,gBAAgB,GAAG,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBACxB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC;YAEtB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE,CACpC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAE1D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,CAAC;YAED,MAAM,QAAQ,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,KAAK,GAAyC,IAAI,CAAC;QAEvD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,IAAI,MAAM;oBAAE,MAAM,CAAC,GAAG,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,QAAQ;gBACR,QAAQ,EAAE,KAAK;gBACf,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1D,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACxC,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,QAAQ,EAAE,GAAG;oBACb,QAAQ,EAAE,IAAI;oBACd,kBAAkB,EAAE,IAAI;iBACzB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAIX;IACA;IAJX,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzC,YACmB,QAAgC,EAChC,QAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAwB;QAChC,aAAQ,GAAR,QAAQ,CAAwB;IAChD,CAAC;IAEJ,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAErF,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI;gBAAE,MAAM;YAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,IAAI,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The module with every memory it defines capped at `maxPages` (64 KiB
|
|
3
|
+
* pages): a missing or larger maximum becomes `maxPages`, so `memory.grow`
|
|
4
|
+
* past it fails inside the module whatever runtime executes it. Throws when
|
|
5
|
+
* a memory needs more than `maxPages` to start. Imported memories belong to
|
|
6
|
+
* the host and are left as they are.
|
|
7
|
+
*/
|
|
8
|
+
export declare function capModuleMemory(module: Uint8Array, maxPages: number): Uint8Array<ArrayBuffer>;
|
|
9
|
+
//# sourceMappingURL=wasm-memory.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"wasm-memory.d.ts","sourceRoot":"","sources":["../../src/executors/wasm-memory.ts"],"names":[],"mappings":"AAkCA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CA0D7F"}
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
const MEMORY_SECTION = 5;
|
|
2
|
+
const HAS_MAXIMUM = 0x01;
|
|
3
|
+
const PREAMBLE_SIZE = 8;
|
|
4
|
+
function readLeb(bytes, offset) {
|
|
5
|
+
let value = 0n;
|
|
6
|
+
let shift = 0n;
|
|
7
|
+
let position = offset;
|
|
8
|
+
for (;;) {
|
|
9
|
+
if (position >= bytes.length)
|
|
10
|
+
throw new Error('Malformed WASM module: truncated LEB128');
|
|
11
|
+
const byte = bytes[position++];
|
|
12
|
+
value |= BigInt(byte & 0x7f) << shift;
|
|
13
|
+
if ((byte & 0x80) === 0)
|
|
14
|
+
return { value, next: position };
|
|
15
|
+
shift += 7n;
|
|
16
|
+
}
|
|
17
|
+
}
|
|
18
|
+
function writeLeb(value) {
|
|
19
|
+
const out = [];
|
|
20
|
+
let remaining = value;
|
|
21
|
+
do {
|
|
22
|
+
let byte = Number(remaining & 0x7fn);
|
|
23
|
+
remaining >>= 7n;
|
|
24
|
+
if (remaining !== 0n)
|
|
25
|
+
byte |= 0x80;
|
|
26
|
+
out.push(byte);
|
|
27
|
+
} while (remaining !== 0n);
|
|
28
|
+
return out;
|
|
29
|
+
}
|
|
30
|
+
/**
|
|
31
|
+
* The module with every memory it defines capped at `maxPages` (64 KiB
|
|
32
|
+
* pages): a missing or larger maximum becomes `maxPages`, so `memory.grow`
|
|
33
|
+
* past it fails inside the module whatever runtime executes it. Throws when
|
|
34
|
+
* a memory needs more than `maxPages` to start. Imported memories belong to
|
|
35
|
+
* the host and are left as they are.
|
|
36
|
+
*/
|
|
37
|
+
export function capModuleMemory(module, maxPages) {
|
|
38
|
+
if (!Number.isInteger(maxPages) || maxPages < 1) {
|
|
39
|
+
throw new Error(`memoryPages must be a positive integer, got ${maxPages}`);
|
|
40
|
+
}
|
|
41
|
+
if (module.length < PREAMBLE_SIZE || module[0] !== 0x00 || module[1] !== 0x61) {
|
|
42
|
+
throw new Error('Not a WASM module');
|
|
43
|
+
}
|
|
44
|
+
const limit = BigInt(maxPages);
|
|
45
|
+
const parts = [module.subarray(0, PREAMBLE_SIZE)];
|
|
46
|
+
let offset = PREAMBLE_SIZE;
|
|
47
|
+
while (offset < module.length) {
|
|
48
|
+
const id = module[offset];
|
|
49
|
+
const size = readLeb(module, offset + 1);
|
|
50
|
+
const start = size.next;
|
|
51
|
+
const end = start + Number(size.value);
|
|
52
|
+
if (end > module.length)
|
|
53
|
+
throw new Error('Malformed WASM module: section past the end');
|
|
54
|
+
if (id !== MEMORY_SECTION) {
|
|
55
|
+
parts.push(module.subarray(offset, end));
|
|
56
|
+
offset = end;
|
|
57
|
+
continue;
|
|
58
|
+
}
|
|
59
|
+
const count = readLeb(module, start);
|
|
60
|
+
const content = writeLeb(count.value);
|
|
61
|
+
let position = count.next;
|
|
62
|
+
for (let i = 0n; i < count.value; i++) {
|
|
63
|
+
const flags = module[position];
|
|
64
|
+
const minimum = readLeb(module, position + 1);
|
|
65
|
+
if (minimum.value > limit) {
|
|
66
|
+
throw new Error(`WASM module needs ${minimum.value} memory pages to start; memoryPages allows ${maxPages}`);
|
|
67
|
+
}
|
|
68
|
+
let maximum = limit;
|
|
69
|
+
position = minimum.next;
|
|
70
|
+
if (flags & HAS_MAXIMUM) {
|
|
71
|
+
const declared = readLeb(module, position);
|
|
72
|
+
if (declared.value < maximum)
|
|
73
|
+
maximum = declared.value;
|
|
74
|
+
position = declared.next;
|
|
75
|
+
}
|
|
76
|
+
content.push(flags | HAS_MAXIMUM, ...writeLeb(minimum.value), ...writeLeb(maximum));
|
|
77
|
+
}
|
|
78
|
+
if (position !== end)
|
|
79
|
+
throw new Error('Malformed WASM module: memory section size');
|
|
80
|
+
parts.push(Uint8Array.from([id, ...writeLeb(BigInt(content.length)), ...content]));
|
|
81
|
+
offset = end;
|
|
82
|
+
}
|
|
83
|
+
const capped = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
|
|
84
|
+
let cursor = 0;
|
|
85
|
+
for (const part of parts) {
|
|
86
|
+
capped.set(part, cursor);
|
|
87
|
+
cursor += part.length;
|
|
88
|
+
}
|
|
89
|
+
return capped;
|
|
90
|
+
}
|
|
91
|
+
//# sourceMappingURL=wasm-memory.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"wasm-memory.js","sourceRoot":"","sources":["../../src/executors/wasm-memory.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,aAAa,GAAG,CAAC,CAAC;AAOxB,SAAS,OAAO,CAAC,KAAiB,EAAE,MAAc;IAChD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAG,MAAM,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,QAAQ,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/B,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1D,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,CAAC;QACF,IAAI,IAAI,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;QACrC,SAAS,KAAK,EAAE,CAAC;QACjB,IAAI,SAAS,KAAK,EAAE;YAAE,IAAI,IAAI,IAAI,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,QAAQ,SAAS,KAAK,EAAE,EAAE;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,QAAgB;IAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,GAAG,aAAa,CAAC;IAE3B,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAExF,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAa,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,CAAC,KAAK,8CAA8C,QAAQ,EAAE,CAC3F,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;YACxB,IAAI,KAAK,GAAG,WAAW,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,IAAI,QAAQ,CAAC,KAAK,GAAG,OAAO;oBAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;gBACvD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,QAAQ,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAEpF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/dist/executors/wasm.d.ts
CHANGED
|
@@ -25,7 +25,8 @@ export declare class WasmSandboxExecutor extends BaseSandboxExecutor {
|
|
|
25
25
|
private acquire;
|
|
26
26
|
private release;
|
|
27
27
|
private closePlugin;
|
|
28
|
-
|
|
28
|
+
/** The module's bytes, from a URL, a file or an installed package. */
|
|
29
|
+
private loadModule;
|
|
29
30
|
private buildInput;
|
|
30
31
|
private callWithTimeout;
|
|
31
32
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAM7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAqCD,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAElC,OAAO,GAAE,mBAAwB;IAKvC,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAYvC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAU1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQ/B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAuDnC,OAAO;YAwBP,OAAO;YAsBP,WAAW;IAWzB,sEAAsE;YACxD,UAAU;IAsBxB,OAAO,CAAC,UAAU;YAWJ,eAAe;CAiC9B"}
|
package/dist/executors/wasm.js
CHANGED
|
@@ -8,6 +8,7 @@ import { BaseSandboxExecutor } from './base.js';
|
|
|
8
8
|
import { readFile } from 'node:fs/promises';
|
|
9
9
|
import { existsSync } from 'node:fs';
|
|
10
10
|
import { createRequire } from 'node:module';
|
|
11
|
+
import { capModuleMemory } from './wasm-memory.js';
|
|
11
12
|
const DEFAULT_TIMEOUT = 30_000;
|
|
12
13
|
const DEFAULT_FUNCTION = 'run';
|
|
13
14
|
const MAX_OUTPUT_SIZE = 50_000;
|
|
@@ -104,9 +105,10 @@ export class WasmSandboxExecutor extends BaseSandboxExecutor {
|
|
|
104
105
|
this.activePlugins.add(reused);
|
|
105
106
|
return reused;
|
|
106
107
|
}
|
|
108
|
+
const maxPages = this.options.wasm?.memoryPages ?? DEFAULT_MEMORY_PAGES;
|
|
107
109
|
const manifest = {
|
|
108
|
-
|
|
109
|
-
memory: { maxPages
|
|
110
|
+
wasm: [{ data: capModuleMemory(await this.loadModule(spec.module), maxPages) }],
|
|
111
|
+
memory: { maxPages },
|
|
110
112
|
};
|
|
111
113
|
const plugin = await this.createPlugin(manifest, {
|
|
112
114
|
useWasi: spec.useWasi,
|
|
@@ -146,12 +148,17 @@ export class WasmSandboxExecutor extends BaseSandboxExecutor {
|
|
|
146
148
|
console.warn('[wasm] Failed to close plugin:', error instanceof Error ? error.message : String(error));
|
|
147
149
|
}
|
|
148
150
|
}
|
|
149
|
-
|
|
151
|
+
/** The module's bytes, from a URL, a file or an installed package. */
|
|
152
|
+
async loadModule(wasmModule) {
|
|
150
153
|
if (wasmModule.startsWith('http://') || wasmModule.startsWith('https://')) {
|
|
151
|
-
|
|
154
|
+
const response = await fetch(wasmModule);
|
|
155
|
+
if (!response.ok) {
|
|
156
|
+
throw new Error(`Failed to fetch WASM module ${wasmModule}: HTTP ${response.status}`);
|
|
157
|
+
}
|
|
158
|
+
return new Uint8Array(await response.arrayBuffer());
|
|
152
159
|
}
|
|
153
160
|
if (existsSync(wasmModule)) {
|
|
154
|
-
return
|
|
161
|
+
return new Uint8Array(await readFile(wasmModule));
|
|
155
162
|
}
|
|
156
163
|
let resolved;
|
|
157
164
|
try {
|
|
@@ -160,7 +167,7 @@ export class WasmSandboxExecutor extends BaseSandboxExecutor {
|
|
|
160
167
|
catch {
|
|
161
168
|
throw new Error(`WASM module not found: ${wasmModule}`);
|
|
162
169
|
}
|
|
163
|
-
return
|
|
170
|
+
return new Uint8Array(await readFile(resolved));
|
|
164
171
|
}
|
|
165
172
|
buildInput(request) {
|
|
166
173
|
if (request.stdin) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wasm.js","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"wasm.js","sourceRoot":"","sources":["../../src/executors/wasm.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAmCnD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IACjD,IAAI,GAAG,MAAM,CAAC;IACf,YAAY,CAAkB;IACrB,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,aAAa,GAAG,IAAI,GAAG,EAAgB,CAAC;IACjD,SAAS,GAAG,CAAC,CAAC;IACd,UAAU,GAAG,CAAC,CAAC;IACN,OAAO,CAAsB;IAE9C,YAAY,UAA+B,EAAE;QAC3C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC9C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,OAAoC,CAAC;YAChE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACrE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,IAAI,gBAAgB,CAAC;QAEhG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC;QAChE,MAAM,IAAI,GAAe;YACvB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,EAAE,UAAU;YAClB,OAAO;YACP,YAAY;SACb,CAAC;QAEF,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CACxC,MAAM,EACN,YAAY,EACZ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EACxB,OAAO,CACR,CAAC;QAEF,IAAI,OAAO,CAAC,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACvD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAChD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAgB;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,oBAAoB,CAAC;QACxE,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE,EAAE,QAAQ,EAAE;SACrB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAa,CAAC,QAAQ,EAAE;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAAoB;QACrD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,kBAAkB,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAoB;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,gCAAgC,EAChC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,UAAU,CAAC,UAAkB;QACzC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAEO,UAAU,CAAC,OAAgC;QACjD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,YAAY;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,MAAoB,EACpB,YAAoB,EACpB,KAAa,EACb,SAAiB;QAEjB,MAAM,IAAI,GAAG,CAAC,KAAK,IAA0B,EAAE;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;oBAC5B,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,KAAK;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,KAAgD,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;YACnD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;QACzD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,MAAiC,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAClE,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAC9D,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACnE,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC"}
|
|
@@ -16,19 +16,35 @@ export interface ContainerCreateOptions {
|
|
|
16
16
|
export interface ContainerPoolOptions {
|
|
17
17
|
maxSize?: number;
|
|
18
18
|
idleTimeoutMs?: number;
|
|
19
|
+
/** Hand a released container to the next execution with the same settings (see `SandboxPoolConfig.reuseContainers`) */
|
|
20
|
+
reuseContainers?: boolean;
|
|
19
21
|
}
|
|
20
22
|
export declare const SANDBOX_CONTAINER_LABEL = "ai.cogitator.sandbox";
|
|
23
|
+
/**
|
|
24
|
+
* Docker containers for sandboxed executions. By default every execution gets
|
|
25
|
+
* a container no code ran in before: a released container is destroyed and a
|
|
26
|
+
* fresh one with the same settings is started in its place, so the next
|
|
27
|
+
* execution finds it warm. With `reuseContainers` a released container goes
|
|
28
|
+
* back to the pool as it is.
|
|
29
|
+
*/
|
|
21
30
|
export declare class ContainerPool {
|
|
22
31
|
private docker;
|
|
23
|
-
private
|
|
32
|
+
private idle;
|
|
33
|
+
private active;
|
|
34
|
+
private warming;
|
|
24
35
|
private maxSize;
|
|
25
36
|
private idleTimeoutMs;
|
|
37
|
+
private reuseContainers;
|
|
38
|
+
private closed;
|
|
26
39
|
private cleanupInterval?;
|
|
27
40
|
constructor(docker: Docker, options?: ContainerPoolOptions);
|
|
28
41
|
acquire(image: string, options: ContainerCreateOptions): Promise<DockerContainer>;
|
|
29
42
|
release(container: DockerContainer, options?: {
|
|
30
43
|
corrupted?: boolean;
|
|
31
44
|
}): Promise<void>;
|
|
45
|
+
private hasRoom;
|
|
46
|
+
/** Starts a fresh container with these settings for the next execution. */
|
|
47
|
+
private prewarm;
|
|
32
48
|
private createContainer;
|
|
33
49
|
private destroyContainer;
|
|
34
50
|
private cleanup;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"container-pool.d.ts","sourceRoot":"","sources":["../../src/pool/container-pool.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"container-pool.d.ts","sourceRoot":"","sources":["../../src/pool/container-pool.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAW/D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uHAAuH;IACvH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAgB9D;;;;;;GAMG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAyB;IACrC,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAC,CAAiC;gBAE7C,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB;IAUxD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC;IAYjF,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAa3F,OAAO,CAAC,OAAO;IAIf,2EAA2E;IAC3E,OAAO,CAAC,OAAO;YAqBD,eAAe;YAiDf,gBAAgB;YAmBhB,OAAO;IAOf,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAYlC"}
|
|
@@ -16,54 +16,72 @@ function poolKey(image, options) {
|
|
|
16
16
|
options.user ?? null,
|
|
17
17
|
]);
|
|
18
18
|
}
|
|
19
|
+
/**
|
|
20
|
+
* Docker containers for sandboxed executions. By default every execution gets
|
|
21
|
+
* a container no code ran in before: a released container is destroyed and a
|
|
22
|
+
* fresh one with the same settings is started in its place, so the next
|
|
23
|
+
* execution finds it warm. With `reuseContainers` a released container goes
|
|
24
|
+
* back to the pool as it is.
|
|
25
|
+
*/
|
|
19
26
|
export class ContainerPool {
|
|
20
27
|
docker;
|
|
21
|
-
|
|
28
|
+
idle = [];
|
|
29
|
+
active = new Map();
|
|
30
|
+
warming = new Set();
|
|
22
31
|
maxSize;
|
|
23
32
|
idleTimeoutMs;
|
|
33
|
+
reuseContainers;
|
|
34
|
+
closed = false;
|
|
24
35
|
cleanupInterval;
|
|
25
36
|
constructor(docker, options = {}) {
|
|
26
37
|
this.docker = docker;
|
|
27
38
|
this.maxSize = options.maxSize ?? 5;
|
|
28
39
|
this.idleTimeoutMs = options.idleTimeoutMs ?? 60_000;
|
|
40
|
+
this.reuseContainers = options.reuseContainers ?? false;
|
|
29
41
|
this.cleanupInterval = setInterval(() => void this.cleanup(), this.idleTimeoutMs / 2);
|
|
30
42
|
this.cleanupInterval.unref?.();
|
|
31
43
|
}
|
|
32
44
|
async acquire(image, options) {
|
|
33
45
|
const key = poolKey(image, options);
|
|
34
|
-
const
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
const container = await this.createContainer(image, options);
|
|
41
|
-
if (this.containers.length < this.maxSize) {
|
|
42
|
-
this.containers.push({
|
|
43
|
-
container,
|
|
44
|
-
key,
|
|
45
|
-
inUse: true,
|
|
46
|
-
lastUsed: Date.now(),
|
|
47
|
-
});
|
|
48
|
-
}
|
|
49
|
-
return container;
|
|
46
|
+
const index = this.idle.findIndex((c) => c.key === key);
|
|
47
|
+
const pooled = index === -1
|
|
48
|
+
? { container: await this.createContainer(image, options), key, image, options }
|
|
49
|
+
: this.idle.splice(index, 1)[0];
|
|
50
|
+
this.active.set(pooled.container.id, { ...pooled, lastUsed: Date.now() });
|
|
51
|
+
return pooled.container;
|
|
50
52
|
}
|
|
51
53
|
async release(container, options) {
|
|
52
|
-
const pooled = this.
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
}
|
|
57
|
-
await this.destroyContainer(container);
|
|
54
|
+
const pooled = this.active.get(container.id);
|
|
55
|
+
this.active.delete(container.id);
|
|
56
|
+
if (pooled && this.reuseContainers && !options?.corrupted && this.hasRoom()) {
|
|
57
|
+
this.idle.push({ ...pooled, lastUsed: Date.now() });
|
|
58
58
|
return;
|
|
59
59
|
}
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
pooled.
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
60
|
+
await this.destroyContainer(container);
|
|
61
|
+
if (pooled && !this.reuseContainers)
|
|
62
|
+
this.prewarm(pooled.image, pooled.options);
|
|
63
|
+
}
|
|
64
|
+
hasRoom() {
|
|
65
|
+
return !this.closed && this.idle.length + this.warming.size < this.maxSize;
|
|
66
|
+
}
|
|
67
|
+
/** Starts a fresh container with these settings for the next execution. */
|
|
68
|
+
prewarm(image, options) {
|
|
69
|
+
if (!this.hasRoom())
|
|
70
|
+
return;
|
|
71
|
+
const warming = this.createContainer(image, options)
|
|
72
|
+
.then(async (container) => {
|
|
73
|
+
if (this.closed) {
|
|
74
|
+
await this.destroyContainer(container);
|
|
75
|
+
return;
|
|
76
|
+
}
|
|
77
|
+
const key = poolKey(image, options);
|
|
78
|
+
this.idle.push({ container, key, image, options, lastUsed: Date.now() });
|
|
79
|
+
})
|
|
80
|
+
.catch((error) => {
|
|
81
|
+
console.warn('[container-pool] Failed to start a warm container:', error instanceof Error ? error.message : String(error));
|
|
82
|
+
})
|
|
83
|
+
.finally(() => this.warming.delete(warming));
|
|
84
|
+
this.warming.add(warming);
|
|
67
85
|
}
|
|
68
86
|
async createContainer(image, options) {
|
|
69
87
|
try {
|
|
@@ -128,23 +146,20 @@ export class ContainerPool {
|
|
|
128
146
|
}
|
|
129
147
|
async cleanup() {
|
|
130
148
|
const now = Date.now();
|
|
131
|
-
const
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
toRemove.push(pooled);
|
|
135
|
-
}
|
|
136
|
-
}
|
|
137
|
-
for (const pooled of toRemove) {
|
|
138
|
-
this.containers = this.containers.filter((c) => c !== pooled);
|
|
139
|
-
await this.destroyContainer(pooled.container);
|
|
140
|
-
}
|
|
149
|
+
const expired = this.idle.filter((pooled) => now - pooled.lastUsed > this.idleTimeoutMs);
|
|
150
|
+
this.idle = this.idle.filter((pooled) => !expired.includes(pooled));
|
|
151
|
+
await Promise.all(expired.map((pooled) => this.destroyContainer(pooled.container)));
|
|
141
152
|
}
|
|
142
153
|
async destroyAll() {
|
|
154
|
+
this.closed = true;
|
|
143
155
|
if (this.cleanupInterval) {
|
|
144
156
|
clearInterval(this.cleanupInterval);
|
|
145
157
|
}
|
|
146
|
-
await Promise.all(this.
|
|
147
|
-
|
|
158
|
+
await Promise.all([...this.warming]);
|
|
159
|
+
const containers = [...this.idle, ...this.active.values()].map((c) => c.container);
|
|
160
|
+
this.idle = [];
|
|
161
|
+
this.active.clear();
|
|
162
|
+
await Promise.all(containers.map((container) => this.destroyContainer(container)));
|
|
148
163
|
}
|
|
149
164
|
}
|
|
150
165
|
//# sourceMappingURL=container-pool.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"container-pool.js","sourceRoot":"","sources":["../../src/pool/container-pool.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;
|
|
1
|
+
{"version":3,"file":"container-pool.js","sourceRoot":"","sources":["../../src/pool/container-pool.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AA4B1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAE9D,SAAS,OAAO,CAAC,KAAa,EAAE,OAA+B;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK;QACL,OAAO,CAAC,MAAM,IAAI,IAAI;QACtB,OAAO,CAAC,IAAI,IAAI,IAAI;QACpB,OAAO,CAAC,SAAS,IAAI,IAAI;QACzB,OAAO,CAAC,SAAS,IAAI,IAAI;QACzB,OAAO,CAAC,WAAW,IAAI,MAAM;QAC7B,OAAO,CAAC,GAAG,IAAI,EAAE;QACjB,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,IAAI,IAAI;KACrB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IAChB,MAAM,CAAS;IACf,IAAI,GAAsB,EAAE,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,OAAO,CAAS;IAChB,aAAa,CAAS;IACtB,eAAe,CAAU;IACzB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,CAAkC;IAEzD,YAAY,MAAc,EAAE,UAAgC,EAAE;QAC5D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC;QAExD,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAA+B;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GACV,KAAK,KAAK,CAAC,CAAC;YACV,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE;YAChF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAA0B,EAAE,OAAiC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAEjC,IAAI,MAAM,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAClF,CAAC;IAEO,OAAO;QACb,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7E,CAAC;IAED,2EAA2E;IACnE,OAAO,CAAC,KAAa,EAAE,OAA+B;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO;QAC5B,MAAM,OAAO,GAAkB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC;aAChE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,OAAO,CAAC,IAAI,CACV,oDAAoD,EACpD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,KAAa,EACb,OAA+B;QAE/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAiB,EAAE,MAA6B,EAAE,EAAE;oBAC3E,IAAI,GAAG;wBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE;wBACvD,IAAI,WAAW;4BAAE,MAAM,CAAC,WAAW,CAAC,CAAC;;4BAChC,OAAO,EAAE,CAAC;oBACjB,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAE9F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAClD,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE;YAC7C,UAAU,EAAE;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,GAAG;gBACnC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;gBAC1C,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAClD,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,CAAC,mBAAmB,CAAC;gBAClC,OAAO,EAAE,CAAC,KAAK,CAAC;gBAChB,cAAc,EAAE,KAAK;aACtB;YACD,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAA0B;QACvD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,6CAA6C,SAAS,CAAC,EAAE,GAAG,EAC5D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,+CAA+C,SAAS,CAAC,EAAE,GAAG,EAC9D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../src/sandbox-manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,aAAa,EAEd,MAAM,qBAAqB,CAAC;AAM7B,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAC,CAAgB;
|
|
1
|
+
{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../src/sandbox-manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,aAAa,EAEd,MAAM,qBAAqB,CAAC;AAM7B,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,oBAAoB,CAAS;gBAEzB,MAAM,GAAE,oBAAyB;IAI7C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAKb,mBAAmB;IAqC3B,OAAO,CACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IA8C3C,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IAMrC,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAMnC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC"}
|
package/dist/sandbox-manager.js
CHANGED
|
@@ -8,6 +8,7 @@ export class SandboxManager {
|
|
|
8
8
|
executors = new Map();
|
|
9
9
|
config;
|
|
10
10
|
initPromise;
|
|
11
|
+
warnedNativeFallback = false;
|
|
11
12
|
constructor(config = {}) {
|
|
12
13
|
this.config = config;
|
|
13
14
|
}
|
|
@@ -59,15 +60,27 @@ export class SandboxManager {
|
|
|
59
60
|
if (executor) {
|
|
60
61
|
return executor.execute(request, mergedConfig);
|
|
61
62
|
}
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
}
|
|
63
|
+
if (type !== 'docker') {
|
|
64
|
+
return {
|
|
65
|
+
success: false,
|
|
66
|
+
error: type === 'wasm'
|
|
67
|
+
? 'WASM sandbox unavailable: install @extism/extism to run WASM tools'
|
|
68
|
+
: `Sandbox type '${type}' not available`,
|
|
69
|
+
};
|
|
70
|
+
}
|
|
71
|
+
const native = this.executors.get('native');
|
|
72
|
+
if (this.config.allowNativeFallback === false || !native) {
|
|
73
|
+
return {
|
|
74
|
+
success: false,
|
|
75
|
+
error: 'Docker sandbox unavailable and sandbox.allowNativeFallback is false: refusing to run the command on the host',
|
|
76
|
+
};
|
|
77
|
+
}
|
|
78
|
+
if (!this.warnedNativeFallback) {
|
|
79
|
+
this.warnedNativeFallback = true;
|
|
80
|
+
console.warn('[sandbox] Docker is unavailable: Docker-sandboxed commands now run UNSANDBOXED on the host. ' +
|
|
81
|
+
'Set sandbox.allowNativeFallback: false to refuse them instead.');
|
|
69
82
|
}
|
|
70
|
-
return {
|
|
83
|
+
return native.execute(request, { ...mergedConfig, type: 'native' });
|
|
71
84
|
}
|
|
72
85
|
async isDockerAvailable() {
|
|
73
86
|
await this.initialize();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../src/sandbox-manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,OAAO,cAAc;IACjB,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxD,MAAM,CAAuB;IAC7B,WAAW,CAAiB;
|
|
1
|
+
{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../src/sandbox-manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,OAAO,cAAc;IACjB,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxD,MAAM,CAAuB;IAC7B,WAAW,CAAiB;IAC5B,oBAAoB,GAAG,KAAK,CAAC;IAErC,YAAY,SAA+B,EAAE;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,UAAU;QACR,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,yCAAyC,EACzC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC;gBACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,uCAAuC,EACvC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAgC,EAChC,MAAqB;QAErB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAExB,MAAM,YAAY,GAAkB;YAClC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;YACvB,GAAG,MAAM;YACT,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE;YACtE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAChE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;SACrD,CAAC;QAEF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,IAAI,KAAK,MAAM;oBACb,CAAC,CAAC,oEAAoE;oBACtE,CAAC,CAAC,iBAAiB,IAAI,iBAAiB;aAC7C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,8GAA8G;aACjH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8FAA8F;gBAC5F,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
import type { SandboxDockerConfig } from '@cogitator-ai/types';
|
|
2
|
+
export type DockerConnectionOptions = {
|
|
3
|
+
socketPath: string;
|
|
4
|
+
} | {
|
|
5
|
+
host: string;
|
|
6
|
+
port?: number;
|
|
7
|
+
};
|
|
8
|
+
export interface DockerConnectionEnv {
|
|
9
|
+
env: Record<string, string | undefined>;
|
|
10
|
+
home: string;
|
|
11
|
+
exists(path: string): boolean;
|
|
12
|
+
readFile(path: string): string | undefined;
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Where to reach the Docker daemon, in the order to try: the configured
|
|
16
|
+
* socket or host; else what `DOCKER_HOST` says (`undefined`, Dockerode reads
|
|
17
|
+
* it); else the endpoint of the Docker CLI's current context — as `docker`
|
|
18
|
+
* itself does — followed by the sockets Docker Engine, Docker Desktop,
|
|
19
|
+
* OrbStack, Colima, Rancher Desktop and rootless Docker listen on.
|
|
20
|
+
*/
|
|
21
|
+
export declare function dockerConnectionCandidates(config?: SandboxDockerConfig, system?: DockerConnectionEnv): (DockerConnectionOptions | undefined)[];
|
|
22
|
+
//# sourceMappingURL=docker-connection.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"docker-connection.d.ts","sourceRoot":"","sources":["../../src/utils/docker-connection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,MAAM,uBAAuB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAeD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,GAAE,mBAAwB,EAChC,MAAM,GAAE,mBAAkC,GACzC,CAAC,uBAAuB,GAAG,SAAS,CAAC,EAAE,CAwBzC"}
|
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
import { createHash } from 'node:crypto';
|
|
2
|
+
import { existsSync, readFileSync } from 'node:fs';
|
|
3
|
+
import { homedir } from 'node:os';
|
|
4
|
+
import { join } from 'node:path';
|
|
5
|
+
const defaultEnv = () => ({
|
|
6
|
+
env: process.env,
|
|
7
|
+
home: homedir(),
|
|
8
|
+
exists: existsSync,
|
|
9
|
+
readFile: (path) => {
|
|
10
|
+
try {
|
|
11
|
+
return readFileSync(path, 'utf8');
|
|
12
|
+
}
|
|
13
|
+
catch {
|
|
14
|
+
return undefined;
|
|
15
|
+
}
|
|
16
|
+
},
|
|
17
|
+
});
|
|
18
|
+
/**
|
|
19
|
+
* Where to reach the Docker daemon, in the order to try: the configured
|
|
20
|
+
* socket or host; else what `DOCKER_HOST` says (`undefined`, Dockerode reads
|
|
21
|
+
* it); else the endpoint of the Docker CLI's current context — as `docker`
|
|
22
|
+
* itself does — followed by the sockets Docker Engine, Docker Desktop,
|
|
23
|
+
* OrbStack, Colima, Rancher Desktop and rootless Docker listen on.
|
|
24
|
+
*/
|
|
25
|
+
export function dockerConnectionCandidates(config = {}, system = defaultEnv()) {
|
|
26
|
+
if (config.socketPath)
|
|
27
|
+
return [{ socketPath: config.socketPath }];
|
|
28
|
+
if (config.host)
|
|
29
|
+
return [{ host: config.host, port: config.port }];
|
|
30
|
+
if (system.env.DOCKER_HOST)
|
|
31
|
+
return [undefined];
|
|
32
|
+
const candidates = [];
|
|
33
|
+
const context = currentContextEndpoint(system);
|
|
34
|
+
if (context)
|
|
35
|
+
candidates.push(context);
|
|
36
|
+
const sockets = [
|
|
37
|
+
'/var/run/docker.sock',
|
|
38
|
+
join(system.home, '.docker/run/docker.sock'),
|
|
39
|
+
join(system.home, '.orbstack/run/docker.sock'),
|
|
40
|
+
join(system.home, '.colima/default/docker.sock'),
|
|
41
|
+
join(system.home, '.colima/docker.sock'),
|
|
42
|
+
join(system.home, '.rd/docker.sock'),
|
|
43
|
+
...(system.env.XDG_RUNTIME_DIR ? [join(system.env.XDG_RUNTIME_DIR, 'docker.sock')] : []),
|
|
44
|
+
];
|
|
45
|
+
for (const socketPath of sockets) {
|
|
46
|
+
const known = candidates.some((c) => 'socketPath' in c && c.socketPath === socketPath);
|
|
47
|
+
if (!known && system.exists(socketPath))
|
|
48
|
+
candidates.push({ socketPath });
|
|
49
|
+
}
|
|
50
|
+
return candidates.length > 0 ? candidates : [undefined];
|
|
51
|
+
}
|
|
52
|
+
function currentContextEndpoint(system) {
|
|
53
|
+
const configDir = system.env.DOCKER_CONFIG ?? join(system.home, '.docker');
|
|
54
|
+
const name = system.env.DOCKER_CONTEXT ?? readCurrentContext(system, configDir);
|
|
55
|
+
if (!name || name === 'default')
|
|
56
|
+
return undefined;
|
|
57
|
+
const id = createHash('sha256').update(name).digest('hex');
|
|
58
|
+
const meta = parseJson(system.readFile(join(configDir, 'contexts/meta', id, 'meta.json')));
|
|
59
|
+
const host = endpointHost(meta);
|
|
60
|
+
return host ? parseDockerHost(host) : undefined;
|
|
61
|
+
}
|
|
62
|
+
function readCurrentContext(system, configDir) {
|
|
63
|
+
const config = parseJson(system.readFile(join(configDir, 'config.json')));
|
|
64
|
+
const name = isRecord(config) ? config.currentContext : undefined;
|
|
65
|
+
return typeof name === 'string' ? name : undefined;
|
|
66
|
+
}
|
|
67
|
+
function endpointHost(meta) {
|
|
68
|
+
if (!isRecord(meta) || !isRecord(meta.Endpoints))
|
|
69
|
+
return undefined;
|
|
70
|
+
const docker = meta.Endpoints.docker;
|
|
71
|
+
return isRecord(docker) && typeof docker.Host === 'string' ? docker.Host : undefined;
|
|
72
|
+
}
|
|
73
|
+
function parseDockerHost(host) {
|
|
74
|
+
if (host.startsWith('unix://'))
|
|
75
|
+
return { socketPath: host.slice('unix://'.length) };
|
|
76
|
+
const tcp = /^tcp:\/\/([^:/]+)(?::(\d+))?/.exec(host);
|
|
77
|
+
if (!tcp)
|
|
78
|
+
return undefined;
|
|
79
|
+
return { host: tcp[1], ...(tcp[2] && { port: Number(tcp[2]) }) };
|
|
80
|
+
}
|
|
81
|
+
function parseJson(text) {
|
|
82
|
+
if (text === undefined)
|
|
83
|
+
return undefined;
|
|
84
|
+
try {
|
|
85
|
+
return JSON.parse(text);
|
|
86
|
+
}
|
|
87
|
+
catch {
|
|
88
|
+
return undefined;
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
function isRecord(value) {
|
|
92
|
+
return typeof value === 'object' && value !== null;
|
|
93
|
+
}
|
|
94
|
+
//# sourceMappingURL=docker-connection.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"docker-connection.js","sourceRoot":"","sources":["../../src/utils/docker-connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,MAAM,UAAU,GAAG,GAAwB,EAAE,CAAC,CAAC;IAC7C,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,IAAI,EAAE,OAAO,EAAE;IACf,MAAM,EAAE,UAAU;IAClB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAA8B,EAAE,EAChC,SAA8B,UAAU,EAAE;IAE1C,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/C,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG;QACd,sBAAsB;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA2B;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2B,EAAE,SAAiB;IACxE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACpF,MAAM,GAAG,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cogitator-ai/sandbox",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"description": "Sandbox execution for Cogitator agents (Docker and WASM)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
"node": ">=22.12.0"
|
|
19
19
|
},
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@cogitator-ai/types": "0.
|
|
21
|
+
"@cogitator-ai/types": "0.29.0"
|
|
22
22
|
},
|
|
23
23
|
"optionalDependencies": {
|
|
24
24
|
"@extism/extism": "^2.0.0-rc13",
|
|
@@ -55,8 +55,9 @@
|
|
|
55
55
|
"build": "tsc && tsx ../../scripts/fix-esm-imports.ts .",
|
|
56
56
|
"dev": "tsc --watch",
|
|
57
57
|
"clean": "rm -rf dist",
|
|
58
|
-
"typecheck": "tsc --noEmit",
|
|
58
|
+
"typecheck": "tsc --noEmit -p tsconfig.test.json",
|
|
59
59
|
"test": "vitest run",
|
|
60
|
-
"test:watch": "vitest"
|
|
60
|
+
"test:watch": "vitest",
|
|
61
|
+
"bench": "SANDBOX_BENCHMARK=1 vitest run benchmark"
|
|
61
62
|
}
|
|
62
63
|
}
|