@effect-agent/sandbox-local 0.1.0-beta.42 → 0.1.0-beta.45

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/local-sandbox.ts"],"sourcesContent":["import {\n  SANDBOX_DIAGNOSTIC_MAX_LENGTH,\n  Sandbox,\n  SandboxExited,\n  SandboxExitError,\n  SandboxImplementation,\n  SandboxOutput,\n  SandboxOutputLimitError,\n  SandboxResourceUse,\n  SandboxSpawnError,\n  SandboxStarted,\n  SandboxTimeoutError,\n  SandboxUnsupportedRequestError,\n  type SandboxEvent,\n  type SandboxExecute,\n  type SandboxRequest,\n} from \"@effect-agent/sandbox\";\nimport { NodeServices } from \"@effect/platform-node\";\nimport { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from \"effect\";\nimport { ChildProcess } from \"effect/unstable/process\";\nimport { ChildProcessSpawner } from \"effect/unstable/process/ChildProcessSpawner\";\n\n/**\n * The only implementation identity produced by this package. It deliberately states that local\n * process execution is unisolated development tooling, not a security sandbox.\n */\nexport const unisolatedImplementation = SandboxImplementation.make({\n  isolation: \"unisolated\",\n  identity: \"local-process\",\n});\n\ntype OutputStream = \"stdout\" | \"stderr\";\ntype OutputCounts = Readonly<Record<OutputStream, number>>;\n\nconst zeroOutput: OutputCounts = { stdout: 0, stderr: 0 };\n\nconst boundedDiagnostic = (message: string): string =>\n  message.slice(0, SANDBOX_DIAGNOSTIC_MAX_LENGTH);\n\nconst unsupported = (\n  feature: Parameters<typeof SandboxUnsupportedRequestError.make>[0][\"feature\"],\n  message: string,\n) =>\n  SandboxUnsupportedRequestError.make({\n    implementation: unisolatedImplementation,\n    feature,\n    message: boundedDiagnostic(message),\n  });\n\nconst validateRequest = Effect.fn(\"LocalSandbox.validateRequest\")(function* (\n  request: SandboxRequest,\n) {\n  if (\n    request.runtime.kind !== \"unisolated-process\" ||\n    request.runtime.identity !== unisolatedImplementation.identity\n  ) {\n    return yield* unsupported(\n      \"runtime\",\n      \"The local process runner only accepts runtime kind 'unisolated-process' with identity 'local-process'.\",\n    );\n  }\n  if (request.mounts.length > 0) {\n    return yield* unsupported(\n      \"mounts\",\n      \"The unisolated local process runner cannot enforce mount access modes.\",\n    );\n  }\n  if (request.network._tag !== \"NetworkDisabled\") {\n    return yield* unsupported(\n      \"network\",\n      \"The unisolated local process runner cannot enforce workload network policy.\",\n    );\n  }\n  if (request.limits.cpuCores !== undefined) {\n    return yield* unsupported(\n      \"cpu-limit\",\n      \"The unisolated local process runner cannot enforce CPU limits.\",\n    );\n  }\n  if (request.limits.memoryBytes !== undefined) {\n    return yield* unsupported(\n      \"memory-limit\",\n      \"The unisolated local process runner cannot enforce memory limits.\",\n    );\n  }\n  if (request.secretHandles.length > 0) {\n    return yield* unsupported(\n      \"secret-handles\",\n      \"The unisolated local process runner does not resolve secret handles into an environment.\",\n    );\n  }\n  if (request.artifactRules.length > 0) {\n    return yield* unsupported(\n      \"artifacts\",\n      \"The unisolated local process runner does not collect artifacts.\",\n    );\n  }\n});\n\nconst spawnError = (request: SandboxRequest, message: string, cause?: unknown) =>\n  SandboxSpawnError.make({\n    implementation: unisolatedImplementation,\n    command: request.command,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst exitError = (message: string, cause?: unknown, exitCode = -1) =>\n  SandboxExitError.make({\n    implementation: unisolatedImplementation,\n    exitCode,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst environmentFromAllowlist = Effect.fn(\"LocalSandbox.environmentFromAllowlist\")(function* (\n  request: SandboxRequest,\n) {\n  const environment: Record<string, string> = {};\n  for (const name of request.environment.allow) {\n    const value = yield* Config.option(Config.string(name)).pipe(\n      Effect.mapError((error) =>\n        spawnError(\n          request,\n          `Could not read allowed environment variable '${name}': ${error.message}`,\n          error,\n        ),\n      ),\n    );\n    if (Option.isSome(value)) {\n      environment[name] = value.value;\n    }\n  }\n  return environment;\n});\n\nconst outputEvent = (\n  counts: Ref.Ref<OutputCounts>,\n  stream: OutputStream,\n  bytes: Uint8Array,\n  decoder: TextDecoder,\n  limit: number,\n): Effect.Effect<SandboxOutput, SandboxOutputLimitError> =>\n  Ref.modify(counts, (current) => {\n    const streamBytes = current[stream] + bytes.byteLength;\n    const next = { ...current, [stream]: streamBytes };\n    return [next.stdout + next.stderr, next] as const;\n  }).pipe(\n    Effect.flatMap((observed) =>\n      observed > limit\n        ? Effect.fail(\n            SandboxOutputLimitError.make({\n              implementation: unisolatedImplementation,\n              stream,\n              limit,\n              observed,\n            }),\n          )\n        : Effect.succeed(\n            SandboxOutput.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              stream,\n              text: decoder.decode(bytes, { stream: true }),\n              bytes: bytes.byteLength,\n            }),\n          ),\n    ),\n  );\n\n/**\n * Emits any text the streaming decoder still holds once its source stream ends. The final decode\n * must run at end-of-stream, not at pipeline construction, so the flush is suspended; a trailing\n * incomplete UTF-8 sequence surfaces as replacement text. Its raw bytes were already counted when\n * the chunk arrived, so the flush event carries zero bytes.\n */\nconst flushDecoder = (stream: OutputStream, decoder: TextDecoder): Stream.Stream<SandboxOutput> =>\n  Stream.suspend(() => {\n    const text = decoder.decode();\n    return text.length === 0\n      ? Stream.empty\n      : Stream.succeed(\n          SandboxOutput.make({\n            eventVersion: 1,\n            implementation: unisolatedImplementation,\n            stream,\n            text,\n            bytes: 0,\n          }),\n        );\n  });\n\nconst makeExecute =\n  (spawner: ChildProcessSpawner[\"Service\"]): SandboxExecute =>\n  (request) =>\n    Stream.unwrap(\n      Effect.gen(function* () {\n        yield* validateRequest(request);\n        const startedAt = yield* Clock.currentTimeMillis;\n        const counts = yield* Ref.make(zeroOutput);\n        const stdoutDecoder = new TextDecoder();\n        const stderrDecoder = new TextDecoder();\n        const environment = yield* environmentFromAllowlist(request);\n        const command = ChildProcess.make(request.command, request.args, {\n          cwd: request.cwd,\n          env: environment,\n          extendEnv: false,\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n        });\n        const child = yield* spawner\n          .spawn(command)\n          .pipe(Effect.mapError((error) => spawnError(request, error.message, error)));\n\n        const streamOutput = (stream: OutputStream, decoder: TextDecoder) => {\n          const source = stream === \"stdout\" ? child.stdout : child.stderr;\n          return source.pipe(\n            Stream.mapError((error) => exitError(error.message, error)),\n            Stream.mapEffect((bytes) =>\n              outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes),\n            ),\n            Stream.concat(flushDecoder(stream, decoder)),\n          );\n        };\n\n        const terminal = Stream.unwrap(\n          Effect.gen(function* () {\n            const exitCode = yield* child.exitCode.pipe(\n              Effect.mapError((error) => exitError(error.message, error)),\n            );\n            const endedAt = yield* Clock.currentTimeMillis;\n            const output = yield* Ref.get(counts);\n            const resourceUse = SandboxResourceUse.make({\n              wallTime: Duration.millis(endedAt - startedAt),\n              stdoutBytes: output.stdout,\n              stderrBytes: output.stderr,\n            });\n            const exited = SandboxExited.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              exitCode,\n              resourceUse,\n              artifacts: [],\n            });\n            return exitCode === 0\n              ? Stream.succeed<SandboxEvent>(exited)\n              : Stream.concat(\n                  Stream.succeed<SandboxEvent>(exited),\n                  Stream.fail(\n                    exitError(\n                      `Unisolated local process exited with code ${exitCode}.`,\n                      undefined,\n                      exitCode,\n                    ),\n                  ),\n                );\n          }),\n        );\n\n        const execution = Stream.concat(\n          Stream.succeed<SandboxEvent>(\n            SandboxStarted.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              runtime: request.runtime,\n            }),\n          ),\n          Stream.concat(\n            Stream.merge(\n              streamOutput(\"stdout\", stdoutDecoder),\n              streamOutput(\"stderr\", stderrDecoder),\n            ),\n            terminal,\n          ),\n        );\n\n        return execution.pipe(\n          Stream.interruptWhen(\n            Effect.sleep(request.limits.maxWallTime).pipe(\n              Effect.andThen(\n                Effect.fail(\n                  SandboxTimeoutError.make({\n                    implementation: unisolatedImplementation,\n                    maxWallTime: request.limits.maxWallTime,\n                  }),\n                ),\n              ),\n            ),\n          ),\n        );\n      }),\n    ).pipe(Stream.withSpan(\"LocalSandbox.execute\"));\n\n/**\n * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible\n * so composition roots and tests can inject a spawner double. It is unisolated and must never be\n * used as a security boundary for untrusted code or commands.\n */\nexport const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner> = Layer.effect(Sandbox)(\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner;\n    return Sandbox.of({ execute: makeExecute(spawner) });\n  }),\n);\n\n/** A scoped Node process implementation whose events are always labeled `unisolated`. */\nexport const layer: Layer.Layer<Sandbox> = sandboxLayer.pipe(Layer.provide(NodeServices.layer));\n"],"mappings":";;;;;;;;;;AA0BA,MAAa,2BAA2B,sBAAsB,KAAK;CACjE,WAAW;CACX,UAAU;AACZ,CAAC;AAKD,MAAM,aAA2B;CAAE,QAAQ;CAAG,QAAQ;AAAE;AAExD,MAAM,qBAAqB,YACzB,QAAQ,MAAM,GAAG,6BAA6B;AAEhD,MAAM,eACJ,SACA,YAEA,+BAA+B,KAAK;CAClC,gBAAgB;CAChB;CACA,SAAS,kBAAkB,OAAO;AACpC,CAAC;AAEH,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA;CACA,IACE,QAAQ,QAAQ,SAAS,wBACzB,QAAQ,QAAQ,aAAa,yBAAyB,UAEtD,OAAO,OAAO,YACZ,WACA,wGACF;CAEF,IAAI,QAAQ,OAAO,SAAS,GAC1B,OAAO,OAAO,YACZ,UACA,wEACF;CAEF,IAAI,QAAQ,QAAQ,SAAS,mBAC3B,OAAO,OAAO,YACZ,WACA,6EACF;CAEF,IAAI,QAAQ,OAAO,aAAa,KAAA,GAC9B,OAAO,OAAO,YACZ,aACA,gEACF;CAEF,IAAI,QAAQ,OAAO,gBAAgB,KAAA,GACjC,OAAO,OAAO,YACZ,gBACA,mEACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,YACZ,kBACA,0FACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,YACZ,aACA,iEACF;AAEJ,CAAC;AAED,MAAM,cAAc,SAAyB,SAAiB,UAC5D,kBAAkB,KAAK;CACrB,gBAAgB;CAChB,SAAS,QAAQ;CACjB,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,aAAa,SAAiB,OAAiB,WAAW,OAC9D,iBAAiB,KAAK;CACpB,gBAAgB;CAChB;CACA,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,2BAA2B,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,cAAsC,CAAC;CAC7C,KAAK,MAAM,QAAQ,QAAQ,YAAY,OAAO;EAC5C,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,KACtD,OAAO,UAAU,UACf,WACE,SACA,gDAAgD,KAAK,KAAK,MAAM,WAChE,KACF,CACF,CACF;EACA,IAAI,OAAO,OAAO,KAAK,GACrB,YAAY,QAAQ,MAAM;CAE9B;CACA,OAAO;AACT,CAAC;AAED,MAAM,eACJ,QACA,QACA,OACA,SACA,UAEA,IAAI,OAAO,SAAS,YAAY;CAC9B,MAAM,cAAc,QAAQ,UAAU,MAAM;CAC5C,MAAM,OAAO;EAAE,GAAG;GAAU,SAAS;CAAY;CACjD,OAAO,CAAC,KAAK,SAAS,KAAK,QAAQ,IAAI;AACzC,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,aACd,WAAW,QACP,OAAO,KACL,wBAAwB,KAAK;CAC3B,gBAAgB;CAChB;CACA;CACA;AACF,CAAC,CACH,IACA,OAAO,QACL,cAAc,KAAK;CACjB,cAAc;CACd,gBAAgB;CAChB;CACA,MAAM,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;CAC5C,OAAO,MAAM;AACf,CAAC,CACH,CACN,CACF;;;;;;;AAQF,MAAM,gBAAgB,QAAsB,YAC1C,OAAO,cAAc;CACnB,MAAM,OAAO,QAAQ,OAAO;CAC5B,OAAO,KAAK,WAAW,IACnB,OAAO,QACP,OAAO,QACL,cAAc,KAAK;EACjB,cAAc;EACd,gBAAgB;EAChB;EACA;EACA,OAAO;CACT,CAAC,CACH;AACN,CAAC;AAEH,MAAM,eACH,aACA,YACC,OAAO,OACL,OAAO,IAAI,aAAa;CACtB,OAAO,gBAAgB,OAAO;CAC9B,MAAM,YAAY,OAAO,MAAM;CAC/B,MAAM,SAAS,OAAO,IAAI,KAAK,UAAU;CACzC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,cAAc,OAAO,yBAAyB,OAAO;CAC3D,MAAM,UAAU,aAAa,KAAK,QAAQ,SAAS,QAAQ,MAAM;EAC/D,KAAK,QAAQ;EACb,KAAK;EACL,WAAW;EACX,QAAQ;EACR,QAAQ;CACV,CAAC;CACD,MAAM,QAAQ,OAAO,QAClB,MAAM,OAAO,CAAC,CACd,KAAK,OAAO,UAAU,UAAU,WAAW,SAAS,MAAM,SAAS,KAAK,CAAC,CAAC;CAE7E,MAAM,gBAAgB,QAAsB,YAAyB;EAEnE,QADe,WAAW,WAAW,MAAM,SAAS,MAAM,OAAA,CAC5C,KACZ,OAAO,UAAU,UAAU,UAAU,MAAM,SAAS,KAAK,CAAC,GAC1D,OAAO,WAAW,UAChB,YAAY,QAAQ,QAAQ,OAAO,SAAS,QAAQ,OAAO,cAAc,CAC3E,GACA,OAAO,OAAO,aAAa,QAAQ,OAAO,CAAC,CAC7C;CACF;CAEA,MAAM,WAAW,OAAO,OACtB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,MAAM,SAAS,KACrC,OAAO,UAAU,UAAU,UAAU,MAAM,SAAS,KAAK,CAAC,CAC5D;EACA,MAAM,UAAU,OAAO,MAAM;EAC7B,MAAM,SAAS,OAAO,IAAI,IAAI,MAAM;EACpC,MAAM,cAAc,mBAAmB,KAAK;GAC1C,UAAU,SAAS,OAAO,UAAU,SAAS;GAC7C,aAAa,OAAO;GACpB,aAAa,OAAO;EACtB,CAAC;EACD,MAAM,SAAS,cAAc,KAAK;GAChC,cAAc;GACd,gBAAgB;GAChB;GACA;GACA,WAAW,CAAC;EACd,CAAC;EACD,OAAO,aAAa,IAChB,OAAO,QAAsB,MAAM,IACnC,OAAO,OACL,OAAO,QAAsB,MAAM,GACnC,OAAO,KACL,UACE,6CAA6C,SAAS,IACtD,KAAA,GACA,QACF,CACF,CACF;CACN,CAAC,CACH;CAmBA,OAjBkB,OAAO,OACvB,OAAO,QACL,eAAe,KAAK;EAClB,cAAc;EACd,gBAAgB;EAChB,SAAS,QAAQ;CACnB,CAAC,CACH,GACA,OAAO,OACL,OAAO,MACL,aAAa,UAAU,aAAa,GACpC,aAAa,UAAU,aAAa,CACtC,GACA,QACF,CAGa,CAAC,CAAC,KACf,OAAO,cACL,OAAO,MAAM,QAAQ,OAAO,WAAW,CAAC,CAAC,KACvC,OAAO,QACL,OAAO,KACL,oBAAoB,KAAK;EACvB,gBAAgB;EAChB,aAAa,QAAQ,OAAO;CAC9B,CAAC,CACH,CACF,CACF,CACF,CACF;AACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,sBAAsB,CAAC;;;;;;AAOlD,MAAa,eAAiE,MAAM,OAAO,OAAO,CAAC,CACjG,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO;CACvB,OAAO,QAAQ,GAAG,EAAE,SAAS,YAAY,OAAO,EAAE,CAAC;AACrD,CAAC,CACH;;AAGA,MAAa,QAA8B,aAAa,KAAK,MAAM,QAAQ,aAAa,KAAK,CAAC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/local-sandbox.ts"],"sourcesContent":["import {\n  SANDBOX_DIAGNOSTIC_MAX_LENGTH,\n  Sandbox,\n  SandboxExited,\n  SandboxExitError,\n  SandboxImplementation,\n  SandboxOutput,\n  SandboxOutputLimitError,\n  SandboxResourceUse,\n  SandboxSpawnError,\n  SandboxStarted,\n  SandboxTimeoutError,\n  SandboxUnsupportedRequestError,\n  type SandboxEvent,\n  type SandboxExecute,\n  type SandboxRequest,\n} from \"@effect-agent/sandbox\";\nimport { NodeServices } from \"@effect/platform-node\";\nimport { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from \"effect\";\nimport { ChildProcess } from \"effect/unstable/process\";\nimport { ChildProcessSpawner } from \"effect/unstable/process/ChildProcessSpawner\";\n\n/**\n * The only implementation identity produced by this package. It deliberately states that local\n * process execution is unisolated development tooling, not a security sandbox.\n */\nexport const unisolatedImplementation = SandboxImplementation.make({\n  isolation: \"unisolated\",\n  identity: \"local-process\",\n});\n\ntype OutputStream = \"stdout\" | \"stderr\";\ntype OutputCounts = Readonly<Record<OutputStream, number>>;\n\nconst zeroOutput: OutputCounts = { stdout: 0, stderr: 0 };\n\nconst boundedDiagnostic = (message: string): string =>\n  message.slice(0, SANDBOX_DIAGNOSTIC_MAX_LENGTH);\n\nconst unsupported = (\n  feature: Parameters<typeof SandboxUnsupportedRequestError.make>[0][\"feature\"],\n  message: string,\n) =>\n  SandboxUnsupportedRequestError.make({\n    implementation: unisolatedImplementation,\n    feature,\n    message: boundedDiagnostic(message),\n  });\n\nconst validateRequest = Effect.fn(\"LocalSandbox.validateRequest\")(function* (\n  request: SandboxRequest,\n) {\n  if (\n    request.runtime.kind !== \"unisolated-process\" ||\n    request.runtime.identity !== unisolatedImplementation.identity\n  ) {\n    return yield* unsupported(\n      \"runtime\",\n      \"The local process runner only accepts runtime kind 'unisolated-process' with identity 'local-process'.\",\n    );\n  }\n  if (request.mounts.length > 0) {\n    return yield* unsupported(\n      \"mounts\",\n      \"The unisolated local process runner cannot enforce mount access modes.\",\n    );\n  }\n  if (request.network._tag !== \"NetworkDisabled\") {\n    return yield* unsupported(\n      \"network\",\n      \"The unisolated local process runner cannot enforce workload network policy.\",\n    );\n  }\n  if (request.limits.cpuCores !== undefined) {\n    return yield* unsupported(\n      \"cpu-limit\",\n      \"The unisolated local process runner cannot enforce CPU limits.\",\n    );\n  }\n  if (request.limits.memoryBytes !== undefined) {\n    return yield* unsupported(\n      \"memory-limit\",\n      \"The unisolated local process runner cannot enforce memory limits.\",\n    );\n  }\n  if (request.secretHandles.length > 0) {\n    return yield* unsupported(\n      \"secret-handles\",\n      \"The unisolated local process runner does not resolve secret handles into an environment.\",\n    );\n  }\n  if (request.artifactRules.length > 0) {\n    return yield* unsupported(\n      \"artifacts\",\n      \"The unisolated local process runner does not collect artifacts.\",\n    );\n  }\n});\n\nconst spawnError = (request: SandboxRequest, message: string, cause?: unknown) =>\n  SandboxSpawnError.make({\n    implementation: unisolatedImplementation,\n    command: request.command,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst exitError = (message: string, cause?: unknown, exitCode = -1) =>\n  SandboxExitError.make({\n    implementation: unisolatedImplementation,\n    exitCode,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst environmentFromAllowlist = Effect.fn(\"LocalSandbox.environmentFromAllowlist\")(function* (\n  request: SandboxRequest,\n) {\n  const environment: Record<string, string> = {};\n\n  for (const name of request.environment.allow) {\n    const value = yield* Config.option(Config.string(name)).pipe(\n      Effect.mapError((error) =>\n        spawnError(\n          request,\n          `Could not read allowed environment variable '${name}': ${error.message}`,\n          error,\n        ),\n      ),\n    );\n\n    if (Option.isSome(value)) {\n      environment[name] = value.value;\n    }\n  }\n\n  return environment;\n});\n\nconst outputEvent = (\n  counts: Ref.Ref<OutputCounts>,\n  stream: OutputStream,\n  bytes: Uint8Array,\n  decoder: TextDecoder,\n  limit: number,\n): Effect.Effect<SandboxOutput, SandboxOutputLimitError> =>\n  Ref.modify(counts, (current) => {\n    const streamBytes = current[stream] + bytes.byteLength;\n    const next = { ...current, [stream]: streamBytes };\n\n    return [next.stdout + next.stderr, next] as const;\n  }).pipe(\n    Effect.flatMap((observed) =>\n      observed > limit\n        ? Effect.fail(\n            SandboxOutputLimitError.make({\n              implementation: unisolatedImplementation,\n              stream,\n              limit,\n              observed,\n            }),\n          )\n        : Effect.succeed(\n            SandboxOutput.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              stream,\n              text: decoder.decode(bytes, { stream: true }),\n              bytes: bytes.byteLength,\n            }),\n          ),\n    ),\n  );\n\n/**\n * Emits any text the streaming decoder still holds once its source stream ends. The final decode\n * must run at end-of-stream, not at pipeline construction, so the flush is suspended; a trailing\n * incomplete UTF-8 sequence surfaces as replacement text. Its raw bytes were already counted when\n * the chunk arrived, so the flush event carries zero bytes.\n */\nconst flushDecoder = (stream: OutputStream, decoder: TextDecoder): Stream.Stream<SandboxOutput> =>\n  Stream.suspend(() => {\n    const text = decoder.decode();\n\n    return text.length === 0\n      ? Stream.empty\n      : Stream.succeed(\n          SandboxOutput.make({\n            eventVersion: 1,\n            implementation: unisolatedImplementation,\n            stream,\n            text,\n            bytes: 0,\n          }),\n        );\n  });\n\nconst makeExecute =\n  (spawner: ChildProcessSpawner[\"Service\"]): SandboxExecute =>\n  (request) =>\n    Stream.unwrap(\n      Effect.gen(function* () {\n        yield* validateRequest(request);\n        const startedAt = yield* Clock.currentTimeMillis;\n        const counts = yield* Ref.make(zeroOutput);\n        const stdoutDecoder = new TextDecoder();\n        const stderrDecoder = new TextDecoder();\n        const environment = yield* environmentFromAllowlist(request);\n\n        const command = ChildProcess.make(request.command, request.args, {\n          cwd: request.cwd,\n          env: environment,\n          extendEnv: false,\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n        });\n\n        const child = yield* spawner\n          .spawn(command)\n          .pipe(Effect.mapError((error) => spawnError(request, error.message, error)));\n\n        const streamOutput = (stream: OutputStream, decoder: TextDecoder) => {\n          const source = stream === \"stdout\" ? child.stdout : child.stderr;\n\n          return source.pipe(\n            Stream.mapError((error) => exitError(error.message, error)),\n            Stream.mapEffect((bytes) =>\n              outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes),\n            ),\n            Stream.concat(flushDecoder(stream, decoder)),\n          );\n        };\n\n        const terminal = Stream.unwrap(\n          Effect.gen(function* () {\n            const exitCode = yield* child.exitCode.pipe(\n              Effect.mapError((error) => exitError(error.message, error)),\n            );\n\n            const endedAt = yield* Clock.currentTimeMillis;\n            const output = yield* Ref.get(counts);\n\n            const resourceUse = SandboxResourceUse.make({\n              wallTime: Duration.millis(endedAt - startedAt),\n              stdoutBytes: output.stdout,\n              stderrBytes: output.stderr,\n            });\n\n            const exited = SandboxExited.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              exitCode,\n              resourceUse,\n              artifacts: [],\n            });\n\n            return exitCode === 0\n              ? Stream.succeed<SandboxEvent>(exited)\n              : Stream.concat(\n                  Stream.succeed<SandboxEvent>(exited),\n                  Stream.fail(\n                    exitError(\n                      `Unisolated local process exited with code ${exitCode}.`,\n                      undefined,\n                      exitCode,\n                    ),\n                  ),\n                );\n          }),\n        );\n\n        const execution = Stream.concat(\n          Stream.succeed<SandboxEvent>(\n            SandboxStarted.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              runtime: request.runtime,\n            }),\n          ),\n          Stream.concat(\n            Stream.merge(\n              streamOutput(\"stdout\", stdoutDecoder),\n              streamOutput(\"stderr\", stderrDecoder),\n            ),\n            terminal,\n          ),\n        );\n\n        return execution.pipe(\n          Stream.interruptWhen(\n            Effect.sleep(request.limits.maxWallTime).pipe(\n              Effect.andThen(\n                Effect.fail(\n                  SandboxTimeoutError.make({\n                    implementation: unisolatedImplementation,\n                    maxWallTime: request.limits.maxWallTime,\n                  }),\n                ),\n              ),\n            ),\n          ),\n        );\n      }),\n    ).pipe(Stream.withSpan(\"LocalSandbox.execute\"));\n\n/**\n * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible\n * so composition roots and tests can inject a spawner double. It is unisolated and must never be\n * used as a security boundary for untrusted code or commands.\n */\nexport const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner> = Layer.effect(Sandbox)(\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner;\n\n    return Sandbox.of({ execute: makeExecute(spawner) });\n  }),\n);\n\n/** A scoped Node process implementation whose events are always labeled `unisolated`. */\nexport const layer: Layer.Layer<Sandbox> = sandboxLayer.pipe(Layer.provide(NodeServices.layer));\n"],"mappings":";;;;;;;;;;AA0BA,MAAa,2BAA2B,sBAAsB,KAAK;CACjE,WAAW;CACX,UAAU;AACZ,CAAC;AAKD,MAAM,aAA2B;CAAE,QAAQ;CAAG,QAAQ;AAAE;AAExD,MAAM,qBAAqB,YACzB,QAAQ,MAAM,GAAG,6BAA6B;AAEhD,MAAM,eACJ,SACA,YAEA,+BAA+B,KAAK;CAClC,gBAAgB;CAChB;CACA,SAAS,kBAAkB,OAAO;AACpC,CAAC;AAEH,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA;CACA,IACE,QAAQ,QAAQ,SAAS,wBACzB,QAAQ,QAAQ,aAAa,yBAAyB,UAEtD,OAAO,OAAO,YACZ,WACA,wGACF;CAEF,IAAI,QAAQ,OAAO,SAAS,GAC1B,OAAO,OAAO,YACZ,UACA,wEACF;CAEF,IAAI,QAAQ,QAAQ,SAAS,mBAC3B,OAAO,OAAO,YACZ,WACA,6EACF;CAEF,IAAI,QAAQ,OAAO,aAAa,KAAA,GAC9B,OAAO,OAAO,YACZ,aACA,gEACF;CAEF,IAAI,QAAQ,OAAO,gBAAgB,KAAA,GACjC,OAAO,OAAO,YACZ,gBACA,mEACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,YACZ,kBACA,0FACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,YACZ,aACA,iEACF;AAEJ,CAAC;AAED,MAAM,cAAc,SAAyB,SAAiB,UAC5D,kBAAkB,KAAK;CACrB,gBAAgB;CAChB,SAAS,QAAQ;CACjB,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,aAAa,SAAiB,OAAiB,WAAW,OAC9D,iBAAiB,KAAK;CACpB,gBAAgB;CAChB;CACA,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,2BAA2B,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,cAAsC,CAAC;CAE7C,KAAK,MAAM,QAAQ,QAAQ,YAAY,OAAO;EAC5C,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,KACtD,OAAO,UAAU,UACf,WACE,SACA,gDAAgD,KAAK,KAAK,MAAM,WAChE,KACF,CACF,CACF;EAEA,IAAI,OAAO,OAAO,KAAK,GACrB,YAAY,QAAQ,MAAM;CAE9B;CAEA,OAAO;AACT,CAAC;AAED,MAAM,eACJ,QACA,QACA,OACA,SACA,UAEA,IAAI,OAAO,SAAS,YAAY;CAC9B,MAAM,cAAc,QAAQ,UAAU,MAAM;CAC5C,MAAM,OAAO;EAAE,GAAG;GAAU,SAAS;CAAY;CAEjD,OAAO,CAAC,KAAK,SAAS,KAAK,QAAQ,IAAI;AACzC,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,aACd,WAAW,QACP,OAAO,KACL,wBAAwB,KAAK;CAC3B,gBAAgB;CAChB;CACA;CACA;AACF,CAAC,CACH,IACA,OAAO,QACL,cAAc,KAAK;CACjB,cAAc;CACd,gBAAgB;CAChB;CACA,MAAM,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;CAC5C,OAAO,MAAM;AACf,CAAC,CACH,CACN,CACF;;;;;;;AAQF,MAAM,gBAAgB,QAAsB,YAC1C,OAAO,cAAc;CACnB,MAAM,OAAO,QAAQ,OAAO;CAE5B,OAAO,KAAK,WAAW,IACnB,OAAO,QACP,OAAO,QACL,cAAc,KAAK;EACjB,cAAc;EACd,gBAAgB;EAChB;EACA;EACA,OAAO;CACT,CAAC,CACH;AACN,CAAC;AAEH,MAAM,eACH,aACA,YACC,OAAO,OACL,OAAO,IAAI,aAAa;CACtB,OAAO,gBAAgB,OAAO;CAC9B,MAAM,YAAY,OAAO,MAAM;CAC/B,MAAM,SAAS,OAAO,IAAI,KAAK,UAAU;CACzC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,cAAc,OAAO,yBAAyB,OAAO;CAE3D,MAAM,UAAU,aAAa,KAAK,QAAQ,SAAS,QAAQ,MAAM;EAC/D,KAAK,QAAQ;EACb,KAAK;EACL,WAAW;EACX,QAAQ;EACR,QAAQ;CACV,CAAC;CAED,MAAM,QAAQ,OAAO,QAClB,MAAM,OAAO,CAAC,CACd,KAAK,OAAO,UAAU,UAAU,WAAW,SAAS,MAAM,SAAS,KAAK,CAAC,CAAC;CAE7E,MAAM,gBAAgB,QAAsB,YAAyB;EAGnE,QAFe,WAAW,WAAW,MAAM,SAAS,MAAM,OAAA,CAE5C,KACZ,OAAO,UAAU,UAAU,UAAU,MAAM,SAAS,KAAK,CAAC,GAC1D,OAAO,WAAW,UAChB,YAAY,QAAQ,QAAQ,OAAO,SAAS,QAAQ,OAAO,cAAc,CAC3E,GACA,OAAO,OAAO,aAAa,QAAQ,OAAO,CAAC,CAC7C;CACF;CAEA,MAAM,WAAW,OAAO,OACtB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,MAAM,SAAS,KACrC,OAAO,UAAU,UAAU,UAAU,MAAM,SAAS,KAAK,CAAC,CAC5D;EAEA,MAAM,UAAU,OAAO,MAAM;EAC7B,MAAM,SAAS,OAAO,IAAI,IAAI,MAAM;EAEpC,MAAM,cAAc,mBAAmB,KAAK;GAC1C,UAAU,SAAS,OAAO,UAAU,SAAS;GAC7C,aAAa,OAAO;GACpB,aAAa,OAAO;EACtB,CAAC;EAED,MAAM,SAAS,cAAc,KAAK;GAChC,cAAc;GACd,gBAAgB;GAChB;GACA;GACA,WAAW,CAAC;EACd,CAAC;EAED,OAAO,aAAa,IAChB,OAAO,QAAsB,MAAM,IACnC,OAAO,OACL,OAAO,QAAsB,MAAM,GACnC,OAAO,KACL,UACE,6CAA6C,SAAS,IACtD,KAAA,GACA,QACF,CACF,CACF;CACN,CAAC,CACH;CAmBA,OAjBkB,OAAO,OACvB,OAAO,QACL,eAAe,KAAK;EAClB,cAAc;EACd,gBAAgB;EAChB,SAAS,QAAQ;CACnB,CAAC,CACH,GACA,OAAO,OACL,OAAO,MACL,aAAa,UAAU,aAAa,GACpC,aAAa,UAAU,aAAa,CACtC,GACA,QACF,CAGa,CAAC,CAAC,KACf,OAAO,cACL,OAAO,MAAM,QAAQ,OAAO,WAAW,CAAC,CAAC,KACvC,OAAO,QACL,OAAO,KACL,oBAAoB,KAAK;EACvB,gBAAgB;EAChB,aAAa,QAAQ,OAAO;CAC9B,CAAC,CACH,CACF,CACF,CACF,CACF;AACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,sBAAsB,CAAC;;;;;;AAOlD,MAAa,eAAiE,MAAM,OAAO,OAAO,CAAC,CACjG,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO;CAEvB,OAAO,QAAQ,GAAG,EAAE,SAAS,YAAY,OAAO,EAAE,CAAC;AACrD,CAAC,CACH;;AAGA,MAAa,QAA8B,aAAa,KAAK,MAAM,QAAQ,aAAa,KAAK,CAAC"}

package/package.json

@@ -1,44 +1 @@
-{
-  "name": "@effect-agent/sandbox-local",
-  "version": "0.1.0-beta.42",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.mts",
-      "default": "./dist/index.mjs"
-    }
-  },
-  "dependencies": {
-    "@effect-agent/sandbox": "0.1.0-beta.42",
-    "@effect/platform-node": "4.0.0-rc.111"
-  },
-  "peerDependencies": {
-    "effect": "^4.0.0-rc.111"
-  },
-  "description": "Node-local child-process Sandbox adapter for Effect Agent; honestly labeled unisolated development tooling, not a security boundary.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/danieljvdm/effect-agent.git",
-    "directory": "packages/sandbox-local"
-  },
-  "files": [
-    "dist",
-    "src"
-  ],
-  "type": "module",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "vp pack",
-    "check": "tsc --noEmit -p tsconfig.json",
-    "test": "vp test --passWithNoTests"
-  },
-  "devDependencies": {
-    "@effect/vitest": "4.0.0-rc.111",
-    "@types/node": "26.1.2",
-    "effect": "4.0.0-rc.111",
-    "typescript": "7.0.2",
-    "vite-plus": "0.3.0"
-  }
-}
+{"name":"@effect-agent/sandbox-local","version":"0.1.0-beta.45","dependencies":{"@effect-agent/sandbox":"0.1.0-beta.45","@effect/platform-node":"4.0.0-rc.112"},"devDependencies":{"@effect/vitest":"4.0.0-rc.112","@types/node":"26.1.2","effect":"4.0.0-rc.112","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"effect":"^4.0.0-rc.112"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"}},"description":"Node-local child-process Sandbox adapter for Effect Agent; honestly labeled unisolated development tooling, not a security boundary.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/sandbox-local"},"files":["dist","src"],"type":"module","publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}

package/src/local-sandbox.ts

@@ -117,6 +117,7 @@ const environmentFromAllowlist = Effect.fn("LocalSandbox.environmentFromAllowlis
   request: SandboxRequest,
 ) {
   const environment: Record<string, string> = {};
+
   for (const name of request.environment.allow) {
     const value = yield* Config.option(Config.string(name)).pipe(
       Effect.mapError((error) =>
@@ -127,10 +128,12 @@ const environmentFromAllowlist = Effect.fn("LocalSandbox.environmentFromAllowlis
         ),
       ),
     );
+
     if (Option.isSome(value)) {
       environment[name] = value.value;
     }
   }
+
   return environment;
 });
 
@@ -144,6 +147,7 @@ const outputEvent = (
   Ref.modify(counts, (current) => {
     const streamBytes = current[stream] + bytes.byteLength;
     const next = { ...current, [stream]: streamBytes };
+
     return [next.stdout + next.stderr, next] as const;
   }).pipe(
     Effect.flatMap((observed) =>
@@ -177,6 +181,7 @@ const outputEvent = (
 const flushDecoder = (stream: OutputStream, decoder: TextDecoder): Stream.Stream<SandboxOutput> =>
   Stream.suspend(() => {
     const text = decoder.decode();
+
     return text.length === 0
       ? Stream.empty
       : Stream.succeed(
@@ -201,6 +206,7 @@ const makeExecute =
         const stdoutDecoder = new TextDecoder();
         const stderrDecoder = new TextDecoder();
         const environment = yield* environmentFromAllowlist(request);
+
         const command = ChildProcess.make(request.command, request.args, {
           cwd: request.cwd,
           env: environment,
@@ -208,12 +214,14 @@ const makeExecute =
           stdout: "pipe",
           stderr: "pipe",
         });
+
         const child = yield* spawner
           .spawn(command)
           .pipe(Effect.mapError((error) => spawnError(request, error.message, error)));
 
         const streamOutput = (stream: OutputStream, decoder: TextDecoder) => {
           const source = stream === "stdout" ? child.stdout : child.stderr;
+
           return source.pipe(
             Stream.mapError((error) => exitError(error.message, error)),
             Stream.mapEffect((bytes) =>
@@ -228,13 +236,16 @@ const makeExecute =
             const exitCode = yield* child.exitCode.pipe(
               Effect.mapError((error) => exitError(error.message, error)),
             );
+
             const endedAt = yield* Clock.currentTimeMillis;
             const output = yield* Ref.get(counts);
+
             const resourceUse = SandboxResourceUse.make({
               wallTime: Duration.millis(endedAt - startedAt),
               stdoutBytes: output.stdout,
               stderrBytes: output.stderr,
             });
+
             const exited = SandboxExited.make({
               eventVersion: 1,
               implementation: unisolatedImplementation,
@@ -242,6 +253,7 @@ const makeExecute =
               resourceUse,
               artifacts: [],
             });
+
             return exitCode === 0
               ? Stream.succeed<SandboxEvent>(exited)
               : Stream.concat(
@@ -299,6 +311,7 @@ const makeExecute =
 export const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner> = Layer.effect(Sandbox)(
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner;
+
     return Sandbox.of({ execute: makeExecute(spawner) });
   }),
 );