@crewhaus/sandbox-image-rust 0.1.4 → 0.1.6

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { type SandboxImageEntry } from "@crewhaus/sandbox-image-registry";
+/**
+ * Catalog R8 `sandbox-image-rust` — Section 36 polyglot Rust sandbox image.
+ *
+ * Registers a curated Rust stable image into `@crewhaus/sandbox-image-registry`
+ * so polyglot agents can `lookupSandboxImage("rust")` and route a snippet
+ * through `tool-code-execution`'s sandbox path.
+ *
+ * Snippet mode (default entrypoint): `rustc - -o /tmp/snippet && /tmp/snippet`
+ * is the cargo-script-style pattern. Advanced callers who mount a project
+ * exec their own compiled binary path. We keep the registered entrypoint
+ * short — `["rustc", "-"]` — and let `tool-code-execution` extend it with
+ * the snippet text + post-compile exec at call time.
+ *
+ * Cold-start budget: ≤2s for the compiled-language warm pool. Rust's
+ * `rustc --version` healthcheck is a single binary invocation and stays
+ * well under the budget. The actual compile-and-run round-trip can take
+ * longer; tool-code-execution callers may pass a higher timeoutMs.
+ *
+ * Layer R8.
+ */
+export declare const RUST_IMAGE_ID = "rust";
+export declare const RUST_IMAGE_REF = "rust:1-alpine";
+export declare const RUST_DEFAULT_ENTRYPOINT: ReadonlyArray<string>;
+export declare const RUST_HEALTHCHECK_ARGV: ReadonlyArray<string>;
+/** Cold-start budget for the warm pool (ms). T7 layer asserts this. */
+export declare const RUST_COLD_START_BUDGET_MS = 2000;
+/** Idempotent — calling twice throws via the registry's duplicate-id refusal. */
+export declare function registerRustSandboxImage(): SandboxImageEntry;

package/{src/index.ts → dist/index.js}

@@ -1,5 +1,4 @@
-import { type SandboxImageEntry, registerSandboxImage } from "@crewhaus/sandbox-image-registry";
-
+import { registerSandboxImage } from "@crewhaus/sandbox-image-registry";
 /**
  * Catalog R8 `sandbox-image-rust` — Section 36 polyglot Rust sandbox image.
  *
@@ -20,27 +19,23 @@ import { type SandboxImageEntry, registerSandboxImage } from "@crewhaus/sandbox-
  *
  * Layer R8.
  */
-
 export const RUST_IMAGE_ID = "rust";
 export const RUST_IMAGE_REF = "rust:1-alpine";
-export const RUST_DEFAULT_ENTRYPOINT: ReadonlyArray<string> = ["rustc", "-"];
-export const RUST_HEALTHCHECK_ARGV: ReadonlyArray<string> = ["rustc", "--version"];
-
+export const RUST_DEFAULT_ENTRYPOINT = ["rustc", "-"];
+export const RUST_HEALTHCHECK_ARGV = ["rustc", "--version"];
 /** Cold-start budget for the warm pool (ms). T7 layer asserts this. */
 export const RUST_COLD_START_BUDGET_MS = 2_000;
-
 /** Idempotent — calling twice throws via the registry's duplicate-id refusal. */
-export function registerRustSandboxImage(): SandboxImageEntry {
-  return registerSandboxImage({
-    id: RUST_IMAGE_ID,
-    image: RUST_IMAGE_REF,
-    defaultEntrypoint: RUST_DEFAULT_ENTRYPOINT,
-    healthcheck: {
-      command: RUST_HEALTHCHECK_ARGV,
-      expectedExitCode: 0,
-      timeoutMs: RUST_COLD_START_BUDGET_MS,
-    },
-    description:
-      "Rust stable on alpine — snippet mode via `rustc -`; compiled-binary mode for mounted crates.",
-  });
+export function registerRustSandboxImage() {
+    return registerSandboxImage({
+        id: RUST_IMAGE_ID,
+        image: RUST_IMAGE_REF,
+        defaultEntrypoint: RUST_DEFAULT_ENTRYPOINT,
+        healthcheck: {
+            command: RUST_HEALTHCHECK_ARGV,
+            expectedExitCode: 0,
+            timeoutMs: RUST_COLD_START_BUDGET_MS,
+        },
+        description: "Rust stable on alpine — snippet mode via `rustc -`; compiled-binary mode for mounted crates.",
+    });
 }

package/package.json

@@ -1,20 +1,23 @@
 {
   "name": "@crewhaus/sandbox-image-rust",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "Rust stable polyglot sandbox image: registry registration + multi-stage Dockerfile + T2/T7/T8 contract tests (Section 36)",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.4",
-    "@crewhaus/sandbox": "0.1.4",
-    "@crewhaus/sandbox-image-registry": "0.1.4"
+    "@crewhaus/errors": "0.1.6",
+    "@crewhaus/sandbox": "0.1.6",
+    "@crewhaus/sandbox-image-registry": "0.1.6"
   },
   "license": "Apache-2.0",
   "author": {
@@ -34,5 +37,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["src", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -1,157 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createSandbox } from "@crewhaus/sandbox";
-import {
-  ImageRegistrationError,
-  _resetSandboxImageRegistry,
-  hasSandboxImage,
-  listAllowedImageRefs,
-  lookupSandboxImage,
-  registerSandboxImage,
-} from "@crewhaus/sandbox-image-registry";
-import {
-  RUST_COLD_START_BUDGET_MS,
-  RUST_DEFAULT_ENTRYPOINT,
-  RUST_HEALTHCHECK_ARGV,
-  RUST_IMAGE_ID,
-  RUST_IMAGE_REF,
-  registerRustSandboxImage,
-} from "./index";
-
-describe("registerRustSandboxImage (T1 + T2)", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("constants match the kickoff prompt's spec", () => {
-    expect(RUST_IMAGE_ID).toBe("rust");
-    expect(RUST_IMAGE_REF).toBe("rust:1-alpine");
-    expect(RUST_DEFAULT_ENTRYPOINT).toEqual(["rustc", "-"]);
-    expect(RUST_HEALTHCHECK_ARGV).toEqual(["rustc", "--version"]);
-  });
-
-  test("registerRustSandboxImage() registers an image with the right shape", () => {
-    const entry = registerRustSandboxImage();
-    expect(entry.id).toBe("rust");
-    expect(entry.image).toBe("rust:1-alpine");
-    expect(entry.defaultEntrypoint).toEqual(["rustc", "-"]);
-    expect(entry.healthcheck.command).toEqual(["rustc", "--version"]);
-    expect(entry.healthcheck.expectedExitCode).toBe(0);
-    expect(entry.healthcheck.timeoutMs).toBe(RUST_COLD_START_BUDGET_MS);
-    expect(entry.description).toMatch(/Rust/);
-  });
-
-  test("lookupSandboxImage('rust') returns the registered entry", () => {
-    registerRustSandboxImage();
-    expect(hasSandboxImage("rust")).toBe(true);
-    expect(lookupSandboxImage("rust").image).toBe("rust:1-alpine");
-  });
-
-  test("listAllowedImageRefs includes rust:1-alpine after registration", () => {
-    registerRustSandboxImage();
-    const refs = listAllowedImageRefs();
-    expect(refs).toContain("rust:1-alpine");
-    expect(refs).toContain("python:3.13-slim");
-  });
-});
-
-describe("Rust-shape T2 contract — round-trip via noop sandbox", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("noop sandbox accepts rust:1-alpine when registered", async () => {
-    registerRustSandboxImage();
-    const sandbox = createSandbox({
-      backend: "noop",
-      allowedImages: listAllowedImageRefs(),
-    });
-    const result = await sandbox.exec({
-      image: RUST_IMAGE_REF,
-      argv: ["printf", "hello-from-rust"],
-    });
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout).toBe("hello-from-rust");
-    await sandbox.close();
-  });
-
-  test("noop sandbox refuses rust:1-alpine when NOT registered", async () => {
-    const trioRefs = ["python:3.13-slim", "node:22-alpine", "alpine:3.19"];
-    const sandbox = createSandbox({ backend: "noop", allowedImages: trioRefs });
-    await expect(sandbox.exec({ image: RUST_IMAGE_REF, argv: ["printf", "x"] })).rejects.toThrow(
-      /not on the allowlist/,
-    );
-    await sandbox.close();
-  });
-});
-
-describe("Rust-shape T7 — cold-start budget", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("healthcheck timeoutMs is within the compiled-language budget (≤2s)", () => {
-    const entry = registerRustSandboxImage();
-    expect(entry.healthcheck.timeoutMs).toBeLessThanOrEqual(2_000);
-    expect(entry.healthcheck.timeoutMs).toBeGreaterThan(0);
-  });
-});
-
-describe("Rust-shape T8 — escape-attempt suite (reuses §18 corpus shape)", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("Rust image registration is idempotent-then-rejected", () => {
-    registerRustSandboxImage();
-    expect(() => registerRustSandboxImage()).toThrow(/already registered/);
-  });
-
-  test("Rust entry's image string passes registry validation", () => {
-    expect(RUST_IMAGE_REF.startsWith("-")).toBe(false);
-    expect(/\s/.test(RUST_IMAGE_REF)).toBe(false);
-    expect(RUST_IMAGE_REF.includes("\n")).toBe(false);
-  });
-
-  test("Rust defaultEntrypoint contains no shell-meta", () => {
-    for (const arg of RUST_DEFAULT_ENTRYPOINT) {
-      expect(/[;&|<>$`(){}]/.test(arg)).toBe(false);
-      expect(arg.includes("\n")).toBe(false);
-    }
-  });
-
-  test("Rust healthcheck argv contains no shell-meta", () => {
-    for (const arg of RUST_HEALTHCHECK_ARGV) {
-      expect(/[;&|<>$`(){}]/.test(arg)).toBe(false);
-      expect(arg.includes("\n")).toBe(false);
-    }
-  });
-
-  test("attempted CLI-flag-injection registration via Rust id is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "rust",
-        image: "--privileged",
-        defaultEntrypoint: ["rustc", "-"],
-        healthcheck: { command: ["rustc", "--version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(ImageRegistrationError);
-  });
-
-  test("attempted whitespace-tampered Rust image is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "rust",
-        image: "rust:1-alpine --privileged",
-        defaultEntrypoint: ["rustc", "-"],
-        healthcheck: { command: ["rustc", "--version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(/whitespace/);
-  });
-
-  test("attempted shell-meta-tagged Rust image is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "rust",
-        image: "rust:$(id)",
-        defaultEntrypoint: ["rustc", "-"],
-        healthcheck: { command: ["rustc", "--version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(/valid registry/);
-  });
-});