@effect-agent/sandbox-local 0.1.0-beta.8 → 0.1.0-beta.81

package/dist/LocalSandbox.d.mts

@@ -0,0 +1,22 @@
+import { Sandbox, SandboxImplementation } from "@effect-agent/sandbox/Sandbox";
+import { Layer } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+declare namespace LocalSandbox_d_exports {
+  export { layer, sandboxLayer, unisolatedImplementation };
+}
+/**
+ * The only implementation identity produced by this package. It deliberately states that local
+ * process execution is unisolated development tooling, not a security sandbox.
+ */
+declare const unisolatedImplementation: SandboxImplementation;
+/**
+ * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible
+ * so composition roots and tests can inject a spawner double. It is unisolated and must never be
+ * used as a security boundary for untrusted code or commands.
+ */
+declare const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner>;
+/** A scoped Node process implementation whose events are always labeled `unisolated`. */
+declare const layer: Layer.Layer<Sandbox>;
+//#endregion
+export { layer, sandboxLayer, LocalSandbox_d_exports as t, unisolatedImplementation };
+//# sourceMappingURL=LocalSandbox.d.mts.map

package/dist/LocalSandbox.mjs

@@ -0,0 +1,157 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { SANDBOX_DIAGNOSTIC_MAX_LENGTH, Sandbox, SandboxExitError, SandboxExited, SandboxImplementation, SandboxOutput, SandboxOutputLimitError, SandboxResourceUse, SandboxSpawnError, SandboxStarted, SandboxTimeoutError, SandboxUnsupportedRequestError } from "@effect-agent/sandbox/Sandbox";
+import { NodeServices } from "@effect/platform-node";
+import { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from "effect";
+import { ChildProcess } from "effect/unstable/process";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+//#region src/LocalSandbox.ts
+var LocalSandbox_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer,
+	sandboxLayer: () => sandboxLayer,
+	unisolatedImplementation: () => unisolatedImplementation
+});
+/**
+* The only implementation identity produced by this package. It deliberately states that local
+* process execution is unisolated development tooling, not a security sandbox.
+*/
+const unisolatedImplementation = SandboxImplementation.make({
+	isolation: "unisolated",
+	identity: "local-process"
+});
+const zeroOutput = {
+	stdout: 0,
+	stderr: 0
+};
+const boundedDiagnostic = (message) => message.slice(0, SANDBOX_DIAGNOSTIC_MAX_LENGTH);
+const unsupported = (feature, message) => SandboxUnsupportedRequestError.make({
+	implementation: unisolatedImplementation,
+	feature,
+	message: boundedDiagnostic(message)
+});
+const validateRequest = Effect.fn("LocalSandbox.validateRequest")(function* (request) {
+	if (request.runtime.kind !== "unisolated-process" || request.runtime.identity !== unisolatedImplementation.identity) return yield* unsupported("runtime", "The local process runner only accepts runtime kind 'unisolated-process' with identity 'local-process'.");
+	if (request.mounts.length > 0) return yield* unsupported("mounts", "The unisolated local process runner cannot enforce mount access modes.");
+	if (request.network._tag !== "NetworkDisabled") return yield* unsupported("network", "The unisolated local process runner cannot enforce workload network policy.");
+	if (request.limits.cpuCores !== void 0) return yield* unsupported("cpu-limit", "The unisolated local process runner cannot enforce CPU limits.");
+	if (request.limits.memoryBytes !== void 0) return yield* unsupported("memory-limit", "The unisolated local process runner cannot enforce memory limits.");
+	if (request.secretHandles.length > 0) return yield* unsupported("secret-handles", "The unisolated local process runner does not resolve secret handles into an environment.");
+	if (request.artifactRules.length > 0) return yield* unsupported("artifacts", "The unisolated local process runner does not collect artifacts.");
+});
+const spawnError = (request, message, cause) => SandboxSpawnError.make({
+	implementation: unisolatedImplementation,
+	command: request.command,
+	message: boundedDiagnostic(message),
+	...cause === void 0 ? {} : { cause }
+});
+const exitError = (message, cause, exitCode = -1) => SandboxExitError.make({
+	implementation: unisolatedImplementation,
+	exitCode,
+	message: boundedDiagnostic(message),
+	...cause === void 0 ? {} : { cause }
+});
+const environmentFromAllowlist = Effect.fn("LocalSandbox.environmentFromAllowlist")(function* (request) {
+	const environment = {};
+	for (const name of request.environment.allow) {
+		const value = yield* Config.option(Config.string(name)).pipe(Effect.mapError((error) => spawnError(request, `Could not read allowed environment variable '${name}': ${error.message}`, error)));
+		if (Option.isSome(value)) environment[name] = value.value;
+	}
+	return environment;
+});
+const outputEvent = (counts, stream, bytes, decoder, limit) => Ref.modify(counts, (current) => {
+	const streamBytes = current[stream] + bytes.byteLength;
+	const next = {
+		...current,
+		[stream]: streamBytes
+	};
+	return [next.stdout + next.stderr, next];
+}).pipe(Effect.flatMap((observed) => observed > limit ? Effect.fail(SandboxOutputLimitError.make({
+	implementation: unisolatedImplementation,
+	stream,
+	limit,
+	observed
+})) : Effect.succeed(SandboxOutput.make({
+	eventVersion: 1,
+	implementation: unisolatedImplementation,
+	stream,
+	text: decoder.decode(bytes, { stream: true }),
+	bytes: bytes.byteLength
+}))));
+/**
+* Emits any text the streaming decoder still holds once its source stream ends. The final decode
+* must run at end-of-stream, not at pipeline construction, so the flush is suspended; a trailing
+* incomplete UTF-8 sequence surfaces as replacement text. Its raw bytes were already counted when
+* the chunk arrived, so the flush event carries zero bytes.
+*/
+const flushDecoder = (stream, decoder) => Stream.suspend(() => {
+	const text = decoder.decode();
+	return text.length === 0 ? Stream.empty : Stream.succeed(SandboxOutput.make({
+		eventVersion: 1,
+		implementation: unisolatedImplementation,
+		stream,
+		text,
+		bytes: 0
+	}));
+});
+const makeExecute = (spawner) => (request) => Stream.unwrap(Effect.gen(function* () {
+	yield* validateRequest(request);
+	const startedAt = yield* Clock.currentTimeMillis;
+	const counts = yield* Ref.make(zeroOutput);
+	const stdoutDecoder = new TextDecoder();
+	const stderrDecoder = new TextDecoder();
+	const environment = yield* environmentFromAllowlist(request);
+	const command = ChildProcess.make(request.command, request.args, {
+		cwd: request.cwd,
+		env: environment,
+		extendEnv: false,
+		stdout: "pipe",
+		stderr: "pipe"
+	});
+	const child = yield* spawner.spawn(command).pipe(Effect.mapError((error) => spawnError(request, error.message, error)));
+	const streamOutput = (stream, decoder) => {
+		return (stream === "stdout" ? child.stdout : child.stderr).pipe(Stream.mapError((error) => exitError(error.message, error)), Stream.mapEffect((bytes) => outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes)), Stream.concat(flushDecoder(stream, decoder)));
+	};
+	const terminal = Stream.unwrap(Effect.gen(function* () {
+		const exitCode = yield* child.exitCode.pipe(Effect.mapError((error) => exitError(error.message, error)));
+		const endedAt = yield* Clock.currentTimeMillis;
+		const output = yield* Ref.get(counts);
+		const resourceUse = SandboxResourceUse.make({
+			wallTime: Duration.millis(endedAt - startedAt),
+			stdoutBytes: output.stdout,
+			stderrBytes: output.stderr
+		});
+		const exited = SandboxExited.make({
+			eventVersion: 1,
+			implementation: unisolatedImplementation,
+			exitCode,
+			resourceUse,
+			artifacts: []
+		});
+		return exitCode === 0 ? Stream.succeed(exited) : Stream.concat(Stream.succeed(exited), Stream.fail(exitError(`Unisolated local process exited with code ${exitCode}.`, void 0, exitCode)));
+	}));
+	return Stream.concat(Stream.succeed(SandboxStarted.make({
+		eventVersion: 1,
+		implementation: unisolatedImplementation,
+		runtime: request.runtime
+	})), Stream.concat(Stream.merge(streamOutput("stdout", stdoutDecoder), streamOutput("stderr", stderrDecoder)), terminal));
+})).pipe(Stream.interruptWhen(Effect.gen(function* () {
+	yield* Effect.sleep(request.limits.maxWallTime);
+	return yield* SandboxTimeoutError.make({
+		implementation: unisolatedImplementation,
+		maxWallTime: request.limits.maxWallTime
+	});
+})), Stream.withSpan("LocalSandbox.execute"));
+/**
+* Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible
+* so composition roots and tests can inject a spawner double. It is unisolated and must never be
+* used as a security boundary for untrusted code or commands.
+*/
+const sandboxLayer = Layer.effect(Sandbox)(Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner;
+	return Sandbox.of({ execute: makeExecute(spawner) });
+}));
+/** A scoped Node process implementation whose events are always labeled `unisolated`. */
+const layer = sandboxLayer.pipe(Layer.provide(NodeServices.layer));
+//#endregion
+export { layer, sandboxLayer, LocalSandbox_exports as t, unisolatedImplementation };
+
+//# sourceMappingURL=LocalSandbox.mjs.map

package/dist/LocalSandbox.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalSandbox.mjs","names":[],"sources":["../src/LocalSandbox.ts"],"sourcesContent":["import {\n  SANDBOX_DIAGNOSTIC_MAX_LENGTH,\n  Sandbox,\n  SandboxExited,\n  SandboxExitError,\n  SandboxImplementation,\n  SandboxOutput,\n  SandboxOutputLimitError,\n  SandboxResourceUse,\n  SandboxSpawnError,\n  SandboxStarted,\n  SandboxTimeoutError,\n  SandboxUnsupportedRequestError,\n  type SandboxEvent,\n  type SandboxExecute,\n  type SandboxRequest,\n} from \"@effect-agent/sandbox/Sandbox\";\nimport { NodeServices } from \"@effect/platform-node\";\nimport { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from \"effect\";\nimport { ChildProcess } from \"effect/unstable/process\";\nimport { ChildProcessSpawner } from \"effect/unstable/process/ChildProcessSpawner\";\n\n/**\n * The only implementation identity produced by this package. It deliberately states that local\n * process execution is unisolated development tooling, not a security sandbox.\n */\nexport const unisolatedImplementation = SandboxImplementation.make({\n  isolation: \"unisolated\",\n  identity: \"local-process\",\n});\n\ntype OutputStream = \"stdout\" | \"stderr\";\ntype OutputCounts = Readonly<Record<OutputStream, number>>;\n\nconst zeroOutput: OutputCounts = { stdout: 0, stderr: 0 };\n\nconst boundedDiagnostic = (message: string): string =>\n  message.slice(0, SANDBOX_DIAGNOSTIC_MAX_LENGTH);\n\nconst unsupported = (\n  feature: Parameters<typeof SandboxUnsupportedRequestError.make>[0][\"feature\"],\n  message: string,\n) =>\n  SandboxUnsupportedRequestError.make({\n    implementation: unisolatedImplementation,\n    feature,\n    message: boundedDiagnostic(message),\n  });\n\nconst validateRequest = Effect.fn(\"LocalSandbox.validateRequest\")(function* (\n  request: SandboxRequest,\n) {\n  if (\n    request.runtime.kind !== \"unisolated-process\" ||\n    request.runtime.identity !== unisolatedImplementation.identity\n  ) {\n    return yield* unsupported(\n      \"runtime\",\n      \"The local process runner only accepts runtime kind 'unisolated-process' with identity 'local-process'.\",\n    );\n  }\n  if (request.mounts.length > 0) {\n    return yield* unsupported(\n      \"mounts\",\n      \"The unisolated local process runner cannot enforce mount access modes.\",\n    );\n  }\n  if (request.network._tag !== \"NetworkDisabled\") {\n    return yield* unsupported(\n      \"network\",\n      \"The unisolated local process runner cannot enforce workload network policy.\",\n    );\n  }\n  if (request.limits.cpuCores !== undefined) {\n    return yield* unsupported(\n      \"cpu-limit\",\n      \"The unisolated local process runner cannot enforce CPU limits.\",\n    );\n  }\n  if (request.limits.memoryBytes !== undefined) {\n    return yield* unsupported(\n      \"memory-limit\",\n      \"The unisolated local process runner cannot enforce memory limits.\",\n    );\n  }\n  if (request.secretHandles.length > 0) {\n    return yield* unsupported(\n      \"secret-handles\",\n      \"The unisolated local process runner does not resolve secret handles into an environment.\",\n    );\n  }\n  if (request.artifactRules.length > 0) {\n    return yield* unsupported(\n      \"artifacts\",\n      \"The unisolated local process runner does not collect artifacts.\",\n    );\n  }\n});\n\nconst spawnError = (request: SandboxRequest, message: string, cause?: unknown) =>\n  SandboxSpawnError.make({\n    implementation: unisolatedImplementation,\n    command: request.command,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst exitError = (message: string, cause?: unknown, exitCode = -1) =>\n  SandboxExitError.make({\n    implementation: unisolatedImplementation,\n    exitCode,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst environmentFromAllowlist = Effect.fn(\"LocalSandbox.environmentFromAllowlist\")(function* (\n  request: SandboxRequest,\n) {\n  const environment: Record<string, string> = {};\n\n  for (const name of request.environment.allow) {\n    const value = yield* Config.option(Config.string(name)).pipe(\n      Effect.mapError((error) =>\n        spawnError(\n          request,\n          `Could not read allowed environment variable '${name}': ${error.message}`,\n          error,\n        ),\n      ),\n    );\n\n    if (Option.isSome(value)) {\n      environment[name] = value.value;\n    }\n  }\n\n  return environment;\n});\n\nconst outputEvent = (\n  counts: Ref.Ref<OutputCounts>,\n  stream: OutputStream,\n  bytes: Uint8Array,\n  decoder: TextDecoder,\n  limit: number,\n): Effect.Effect<SandboxOutput, SandboxOutputLimitError> =>\n  Ref.modify(counts, (current) => {\n    const streamBytes = current[stream] + bytes.byteLength;\n    const next = { ...current, [stream]: streamBytes };\n\n    return [next.stdout + next.stderr, next] as const;\n  }).pipe(\n    Effect.flatMap((observed) =>\n      observed > limit\n        ? Effect.fail(\n            SandboxOutputLimitError.make({\n              implementation: unisolatedImplementation,\n              stream,\n              limit,\n              observed,\n            }),\n          )\n        : Effect.succeed(\n            SandboxOutput.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              stream,\n              text: decoder.decode(bytes, { stream: true }),\n              bytes: bytes.byteLength,\n            }),\n          ),\n    ),\n  );\n\n/**\n * Emits any text the streaming decoder still holds once its source stream ends. The final decode\n * must run at end-of-stream, not at pipeline construction, so the flush is suspended; a trailing\n * incomplete UTF-8 sequence surfaces as replacement text. Its raw bytes were already counted when\n * the chunk arrived, so the flush event carries zero bytes.\n */\nconst flushDecoder = (stream: OutputStream, decoder: TextDecoder): Stream.Stream<SandboxOutput> =>\n  Stream.suspend(() => {\n    const text = decoder.decode();\n\n    return text.length === 0\n      ? Stream.empty\n      : Stream.succeed(\n          SandboxOutput.make({\n            eventVersion: 1,\n            implementation: unisolatedImplementation,\n            stream,\n            text,\n            bytes: 0,\n          }),\n        );\n  });\n\nconst makeExecute =\n  (spawner: ChildProcessSpawner[\"Service\"]): SandboxExecute =>\n  (request) =>\n    Stream.unwrap(\n      Effect.gen(function* () {\n        yield* validateRequest(request);\n        const startedAt = yield* Clock.currentTimeMillis;\n        const counts = yield* Ref.make(zeroOutput);\n        const stdoutDecoder = new TextDecoder();\n        const stderrDecoder = new TextDecoder();\n        const environment = yield* environmentFromAllowlist(request);\n\n        const command = ChildProcess.make(request.command, request.args, {\n          cwd: request.cwd,\n          env: environment,\n          extendEnv: false,\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n        });\n\n        const child = yield* spawner\n          .spawn(command)\n          .pipe(Effect.mapError((error) => spawnError(request, error.message, error)));\n\n        const streamOutput = (stream: OutputStream, decoder: TextDecoder) => {\n          const source = stream === \"stdout\" ? child.stdout : child.stderr;\n\n          return source.pipe(\n            Stream.mapError((error) => exitError(error.message, error)),\n            Stream.mapEffect((bytes) =>\n              outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes),\n            ),\n            Stream.concat(flushDecoder(stream, decoder)),\n          );\n        };\n\n        const terminal = Stream.unwrap(\n          Effect.gen(function* () {\n            const exitCode = yield* child.exitCode.pipe(\n              Effect.mapError((error) => exitError(error.message, error)),\n            );\n\n            const endedAt = yield* Clock.currentTimeMillis;\n            const output = yield* Ref.get(counts);\n\n            const resourceUse = SandboxResourceUse.make({\n              wallTime: Duration.millis(endedAt - startedAt),\n              stdoutBytes: output.stdout,\n              stderrBytes: output.stderr,\n            });\n\n            const exited = SandboxExited.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              exitCode,\n              resourceUse,\n              artifacts: [],\n            });\n\n            return exitCode === 0\n              ? Stream.succeed<SandboxEvent>(exited)\n              : Stream.concat(\n                  Stream.succeed<SandboxEvent>(exited),\n                  Stream.fail(\n                    exitError(\n                      `Unisolated local process exited with code ${exitCode}.`,\n                      undefined,\n                      exitCode,\n                    ),\n                  ),\n                );\n          }),\n        );\n\n        return Stream.concat(\n          Stream.succeed<SandboxEvent>(\n            SandboxStarted.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              runtime: request.runtime,\n            }),\n          ),\n          Stream.concat(\n            Stream.merge(\n              streamOutput(\"stdout\", stdoutDecoder),\n              streamOutput(\"stderr\", stderrDecoder),\n            ),\n            terminal,\n          ),\n        );\n      }),\n    ).pipe(\n      Stream.interruptWhen(\n        Effect.gen(function* () {\n          yield* Effect.sleep(request.limits.maxWallTime);\n\n          return yield* SandboxTimeoutError.make({\n            implementation: unisolatedImplementation,\n            maxWallTime: request.limits.maxWallTime,\n          });\n        }),\n      ),\n      Stream.withSpan(\"LocalSandbox.execute\"),\n    );\n\n/**\n * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible\n * so composition roots and tests can inject a spawner double. It is unisolated and must never be\n * used as a security boundary for untrusted code or commands.\n */\nexport const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner> = Layer.effect(Sandbox)(\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner;\n\n    return Sandbox.of({ execute: makeExecute(spawner) });\n  }),\n);\n\n/** A scoped Node process implementation whose events are always labeled `unisolated`. */\nexport const layer: Layer.Layer<Sandbox> = sandboxLayer.pipe(Layer.provide(NodeServices.layer));\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,MAAa,2BAA2B,sBAAsB,KAAK;CACjE,WAAW;CACX,UAAU;AACZ,CAAC;AAKD,MAAM,aAA2B;CAAE,QAAQ;CAAG,QAAQ;AAAE;AAExD,MAAM,qBAAqB,YACzB,QAAQ,MAAM,GAAG,6BAA6B;AAEhD,MAAM,eACJ,SACA,YAEA,+BAA+B,KAAK;CAClC,gBAAgB;CAChB;CACA,SAAS,kBAAkB,OAAO;AACpC,CAAC;AAEH,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA;CACA,IACE,QAAQ,QAAQ,SAAS,wBACzB,QAAQ,QAAQ,aAAa,yBAAyB,UAEtD,OAAO,OAAO,YACZ,WACA,wGACF;CAEF,IAAI,QAAQ,OAAO,SAAS,GAC1B,OAAO,OAAO,YACZ,UACA,wEACF;CAEF,IAAI,QAAQ,QAAQ,SAAS,mBAC3B,OAAO,OAAO,YACZ,WACA,6EACF;CAEF,IAAI,QAAQ,OAAO,aAAa,KAAA,GAC9B,OAAO,OAAO,YACZ,aACA,gEACF;CAEF,IAAI,QAAQ,OAAO,gBAAgB,KAAA,GACjC,OAAO,OAAO,YACZ,gBACA,mEACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,YACZ,kBACA,0FACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,YACZ,aACA,iEACF;AAEJ,CAAC;AAED,MAAM,cAAc,SAAyB,SAAiB,UAC5D,kBAAkB,KAAK;CACrB,gBAAgB;CAChB,SAAS,QAAQ;CACjB,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,aAAa,SAAiB,OAAiB,WAAW,OAC9D,iBAAiB,KAAK;CACpB,gBAAgB;CAChB;CACA,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,2BAA2B,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,cAAsC,CAAC;CAE7C,KAAK,MAAM,QAAQ,QAAQ,YAAY,OAAO;EAC5C,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,KACtD,OAAO,UAAU,UACf,WACE,SACA,gDAAgD,KAAK,KAAK,MAAM,WAChE,KACF,CACF,CACF;EAEA,IAAI,OAAO,OAAO,KAAK,GACrB,YAAY,QAAQ,MAAM;CAE9B;CAEA,OAAO;AACT,CAAC;AAED,MAAM,eACJ,QACA,QACA,OACA,SACA,UAEA,IAAI,OAAO,SAAS,YAAY;CAC9B,MAAM,cAAc,QAAQ,UAAU,MAAM;CAC5C,MAAM,OAAO;EAAE,GAAG;GAAU,SAAS;CAAY;CAEjD,OAAO,CAAC,KAAK,SAAS,KAAK,QAAQ,IAAI;AACzC,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,aACd,WAAW,QACP,OAAO,KACL,wBAAwB,KAAK;CAC3B,gBAAgB;CAChB;CACA;CACA;AACF,CAAC,CACH,IACA,OAAO,QACL,cAAc,KAAK;CACjB,cAAc;CACd,gBAAgB;CAChB;CACA,MAAM,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;CAC5C,OAAO,MAAM;AACf,CAAC,CACH,CACN,CACF;;;;;;;AAQF,MAAM,gBAAgB,QAAsB,YAC1C,OAAO,cAAc;CACnB,MAAM,OAAO,QAAQ,OAAO;CAE5B,OAAO,KAAK,WAAW,IACnB,OAAO,QACP,OAAO,QACL,cAAc,KAAK;EACjB,cAAc;EACd,gBAAgB;EAChB;EACA;EACA,OAAO;CACT,CAAC,CACH;AACN,CAAC;AAEH,MAAM,eACH,aACA,YACC,OAAO,OACL,OAAO,IAAI,aAAa;CACtB,OAAO,gBAAgB,OAAO;CAC9B,MAAM,YAAY,OAAO,MAAM;CAC/B,MAAM,SAAS,OAAO,IAAI,KAAK,UAAU;CACzC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,cAAc,OAAO,yBAAyB,OAAO;CAE3D,MAAM,UAAU,aAAa,KAAK,QAAQ,SAAS,QAAQ,MAAM;EAC/D,KAAK,QAAQ;EACb,KAAK;EACL,WAAW;EACX,QAAQ;EACR,QAAQ;CACV,CAAC;CAED,MAAM,QAAQ,OAAO,QAClB,MAAM,OAAO,CAAC,CACd,KAAK,OAAO,UAAU,UAAU,WAAW,SAAS,MAAM,SAAS,KAAK,CAAC,CAAC;CAE7E,MAAM,gBAAgB,QAAsB,YAAyB;EAGnE,QAFe,WAAW,WAAW,MAAM,SAAS,MAAM,OAAA,CAE5C,KACZ,OAAO,UAAU,UAAU,UAAU,MAAM,SAAS,KAAK,CAAC,GAC1D,OAAO,WAAW,UAChB,YAAY,QAAQ,QAAQ,OAAO,SAAS,QAAQ,OAAO,cAAc,CAC3E,GACA,OAAO,OAAO,aAAa,QAAQ,OAAO,CAAC,CAC7C;CACF;CAEA,MAAM,WAAW,OAAO,OACtB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,MAAM,SAAS,KACrC,OAAO,UAAU,UAAU,UAAU,MAAM,SAAS,KAAK,CAAC,CAC5D;EAEA,MAAM,UAAU,OAAO,MAAM;EAC7B,MAAM,SAAS,OAAO,IAAI,IAAI,MAAM;EAEpC,MAAM,cAAc,mBAAmB,KAAK;GAC1C,UAAU,SAAS,OAAO,UAAU,SAAS;GAC7C,aAAa,OAAO;GACpB,aAAa,OAAO;EACtB,CAAC;EAED,MAAM,SAAS,cAAc,KAAK;GAChC,cAAc;GACd,gBAAgB;GAChB;GACA;GACA,WAAW,CAAC;EACd,CAAC;EAED,OAAO,aAAa,IAChB,OAAO,QAAsB,MAAM,IACnC,OAAO,OACL,OAAO,QAAsB,MAAM,GACnC,OAAO,KACL,UACE,6CAA6C,SAAS,IACtD,KAAA,GACA,QACF,CACF,CACF;CACN,CAAC,CACH;CAEA,OAAO,OAAO,OACZ,OAAO,QACL,eAAe,KAAK;EAClB,cAAc;EACd,gBAAgB;EAChB,SAAS,QAAQ;CACnB,CAAC,CACH,GACA,OAAO,OACL,OAAO,MACL,aAAa,UAAU,aAAa,GACpC,aAAa,UAAU,aAAa,CACtC,GACA,QACF,CACF;AACF,CAAC,CACH,CAAC,CAAC,KACA,OAAO,cACL,OAAO,IAAI,aAAa;CACtB,OAAO,OAAO,MAAM,QAAQ,OAAO,WAAW;CAE9C,OAAO,OAAO,oBAAoB,KAAK;EACrC,gBAAgB;EAChB,aAAa,QAAQ,OAAO;CAC9B,CAAC;AACH,CAAC,CACH,GACA,OAAO,SAAS,sBAAsB,CACxC;;;;;;AAOJ,MAAa,eAAiE,MAAM,OAAO,OAAO,CAAC,CACjG,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO;CAEvB,OAAO,QAAQ,GAAG,EAAE,SAAS,YAAY,OAAO,EAAE,CAAC;AACrD,CAAC,CACH;;AAGA,MAAa,QAA8B,aAAa,KAAK,MAAM,QAAQ,aAAa,KAAK,CAAC"}

package/dist/index.d.mts

@@ -1,20 +1,2 @@
-import { Sandbox, SandboxImplementation } from "@effect-agent/sandbox";
-import { Layer } from "effect";
-import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
-//#region src/local-sandbox.d.ts
-/**
- * The only implementation identity produced by this package. It deliberately states that local
- * process execution is unisolated development tooling, not a security sandbox.
- */
-declare const unisolatedImplementation: SandboxImplementation;
-/**
- * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible
- * so composition roots and tests can inject a spawner double. It is unisolated and must never be
- * used as a security boundary for untrusted code or commands.
- */
-declare const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner>;
-/** A scoped Node process implementation whose events are always labeled `unisolated`. */
-declare const layer: Layer.Layer<Sandbox>;
-//#endregion
-export { layer, sandboxLayer, unisolatedImplementation };
-//# sourceMappingURL=index.d.mts.map
+import { t as LocalSandbox_d_exports } from "./LocalSandbox.mjs";
+export { LocalSandbox_d_exports as LocalSandbox };

package/dist/index.mjs

@@ -1,151 +1,2 @@
-import { Sandbox, SandboxExitError, SandboxExited, SandboxImplementation, SandboxOutput, SandboxOutputLimitError, SandboxResourceUse, SandboxSpawnError, SandboxStarted, SandboxTimeoutError, SandboxUnsupportedRequestError } from "@effect-agent/sandbox";
-import { NodeServices } from "@effect/platform-node";
-import { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from "effect";
-import { ChildProcess } from "effect/unstable/process";
-import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
-//#region src/local-sandbox.ts
-/**
-* The only implementation identity produced by this package. It deliberately states that local
-* process execution is unisolated development tooling, not a security sandbox.
-*/
-const unisolatedImplementation = SandboxImplementation.make({
-	isolation: "unisolated",
-	identity: "local-process"
-});
-const zeroOutput = {
-	stdout: 0,
-	stderr: 0
-};
-const unsupported = (feature, message) => SandboxUnsupportedRequestError.make({
-	implementation: unisolatedImplementation,
-	feature,
-	message
-});
-const validateRequest = (request) => {
-	if (request.runtime.kind !== "unisolated-process") return Effect.fail(unsupported("runtime", "The local process runner only accepts runtime.kind 'unisolated-process'."));
-	if (request.mounts.length > 0) return Effect.fail(unsupported("mounts", "The unisolated local process runner cannot enforce mount access modes."));
-	if (request.network._tag !== "NetworkDisabled") return Effect.fail(unsupported("network", "The unisolated local process runner cannot enforce workload network policy."));
-	if (request.limits.cpuCores !== void 0) return Effect.fail(unsupported("cpu-limit", "The unisolated local process runner cannot enforce CPU limits."));
-	if (request.limits.memoryBytes !== void 0) return Effect.fail(unsupported("memory-limit", "The unisolated local process runner cannot enforce memory limits."));
-	if (request.secretHandles.length > 0) return Effect.fail(unsupported("secret-handles", "The unisolated local process runner does not resolve secret handles into an environment."));
-	if (request.artifactRules.length > 0) return Effect.fail(unsupported("artifacts", "The unisolated local process runner does not collect artifacts."));
-	return Effect.void;
-};
-const spawnError = (request, message, cause) => SandboxSpawnError.make({
-	implementation: unisolatedImplementation,
-	command: request.command,
-	message,
-	...cause === void 0 ? {} : { cause }
-});
-const environmentFromAllowlist = Effect.fn("LocalSandbox.environmentFromAllowlist")(function* (request) {
-	const environment = {};
-	for (const name of request.environment.allow) {
-		const value = yield* Config.option(Config.string(name)).pipe(Effect.mapError((error) => spawnError(request, `Could not read allowed environment variable '${name}': ${error.message}`, error)));
-		if (Option.isSome(value)) environment[name] = value.value;
-	}
-	return environment;
-});
-const outputEvent = (counts, stream, bytes, decoder, limit) => Ref.modify(counts, (current) => {
-	const streamBytes = current[stream] + bytes.byteLength;
-	const next = {
-		...current,
-		[stream]: streamBytes
-	};
-	return [next.stdout + next.stderr, next];
-}).pipe(Effect.flatMap((observed) => observed > limit ? Effect.fail(SandboxOutputLimitError.make({
-	implementation: unisolatedImplementation,
-	stream,
-	limit,
-	observed
-})) : Effect.succeed(SandboxOutput.make({
-	eventVersion: 1,
-	implementation: unisolatedImplementation,
-	stream,
-	text: decoder.decode(bytes, { stream: true }),
-	bytes: bytes.byteLength
-}))));
-/**
-* Emits any text the streaming decoder still holds once its source stream ends. The final decode
-* must run at end-of-stream, not at pipeline construction, so the flush is suspended; a trailing
-* incomplete UTF-8 sequence surfaces as replacement text. Its raw bytes were already counted when
-* the chunk arrived, so the flush event carries zero bytes.
-*/
-const flushDecoder = (stream, decoder) => Stream.suspend(() => {
-	const text = decoder.decode();
-	return text.length === 0 ? Stream.empty : Stream.succeed(SandboxOutput.make({
-		eventVersion: 1,
-		implementation: unisolatedImplementation,
-		stream,
-		text,
-		bytes: 0
-	}));
-});
-const makeExecute = (spawner) => (request) => Stream.unwrap(Effect.gen(function* () {
-	yield* validateRequest(request);
-	const startedAt = yield* Clock.currentTimeMillis;
-	const counts = yield* Ref.make(zeroOutput);
-	const stdoutDecoder = new TextDecoder();
-	const stderrDecoder = new TextDecoder();
-	const environment = yield* environmentFromAllowlist(request);
-	const command = ChildProcess.make(request.command, request.args, {
-		cwd: request.cwd,
-		env: environment,
-		extendEnv: false,
-		stdout: "pipe",
-		stderr: "pipe"
-	});
-	const child = yield* spawner.spawn(command).pipe(Effect.mapError((error) => spawnError(request, error.message, error)));
-	const streamOutput = (stream, decoder) => {
-		return (stream === "stdout" ? child.stdout : child.stderr).pipe(Stream.mapError((error) => spawnError(request, error.message, error)), Stream.mapEffect((bytes) => outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes)), Stream.concat(flushDecoder(stream, decoder)));
-	};
-	const terminal = Stream.unwrap(Effect.gen(function* () {
-		const exitCode = yield* child.exitCode.pipe(Effect.mapError((error) => SandboxExitError.make({
-			cause: error,
-			implementation: unisolatedImplementation,
-			exitCode: -1,
-			message: error.message
-		})));
-		const endedAt = yield* Clock.currentTimeMillis;
-		const output = yield* Ref.get(counts);
-		const resourceUse = SandboxResourceUse.make({
-			wallTime: Duration.millis(endedAt - startedAt),
-			stdoutBytes: output.stdout,
-			stderrBytes: output.stderr
-		});
-		const exited = SandboxExited.make({
-			eventVersion: 1,
-			implementation: unisolatedImplementation,
-			exitCode,
-			resourceUse,
-			artifacts: []
-		});
-		return exitCode === 0 ? Stream.succeed(exited) : Stream.concat(Stream.succeed(exited), Stream.fail(SandboxExitError.make({
-			implementation: unisolatedImplementation,
-			exitCode,
-			message: `Unisolated local process exited with code ${exitCode}.`
-		})));
-	}));
-	return Stream.concat(Stream.succeed(SandboxStarted.make({
-		eventVersion: 1,
-		implementation: unisolatedImplementation,
-		runtime: request.runtime
-	})), Stream.concat(Stream.merge(streamOutput("stdout", stdoutDecoder), streamOutput("stderr", stderrDecoder)), terminal)).pipe(Stream.interruptWhen(Effect.sleep(request.limits.maxWallTime).pipe(Effect.andThen(Effect.fail(SandboxTimeoutError.make({
-		implementation: unisolatedImplementation,
-		maxWallTime: request.limits.maxWallTime
-	}))))));
-})).pipe(Stream.withSpan("LocalSandbox.execute"));
-/**
-* Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible
-* so composition roots and tests can inject a spawner double. It is unisolated and must never be
-* used as a security boundary for untrusted code or commands.
-*/
-const sandboxLayer = Layer.effect(Sandbox)(Effect.gen(function* () {
-	const spawner = yield* ChildProcessSpawner;
-	return Sandbox.of({ execute: makeExecute(spawner) });
-}));
-/** A scoped Node process implementation whose events are always labeled `unisolated`. */
-const layer = sandboxLayer.pipe(Layer.provide(NodeServices.layer));
-//#endregion
-export { layer, sandboxLayer, unisolatedImplementation };
-
-//# sourceMappingURL=index.mjs.map
+import { t as LocalSandbox_exports } from "./LocalSandbox.mjs";
+export { LocalSandbox_exports as LocalSandbox };

package/dist/rolldown-runtime-D7D4PA-g.mjs

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll as t };

package/package.json

@@ -1,41 +1 @@
-{
-  "name": "@effect-agent/sandbox-local",
-  "version": "0.1.0-beta.8",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.mts",
-      "default": "./dist/index.mjs"
-    }
-  },
-  "dependencies": {
-    "@effect-agent/sandbox": "0.1.0-beta.8",
-    "@effect/platform-node": "4.0.0-beta.107",
-    "effect": "4.0.0-beta.107"
-  },
-  "description": "Node-local child-process Sandbox adapter for Effect Agent; honestly labeled unisolated development tooling, not a security boundary.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/danieljvdm/effect-agent.git",
-    "directory": "packages/sandbox-local"
-  },
-  "files": [
-    "dist",
-    "src"
-  ],
-  "type": "module",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "vp pack",
-    "check": "tsc --noEmit -p tsconfig.json",
-    "test": "vp test --passWithNoTests"
-  },
-  "devDependencies": {
-    "@effect/vitest": "4.0.0-beta.107",
-    "@types/node": "26.1.2",
-    "typescript": "7.0.2",
-    "vite-plus": "0.2.6"
-  }
-}
+{"name":"@effect-agent/sandbox-local","version":"0.1.0-beta.81","dependencies":{"@effect-agent/sandbox":"0.1.0-beta.81","@effect/platform-node":"4.0.0-rc.112"},"devDependencies":{"@effect/vitest":"4.0.0-rc.112","@types/node":"26.1.2","effect":"4.0.0-rc.112","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"effect":"^4.0.0-rc.112"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./LocalSandbox":{"types":"./dist/LocalSandbox.d.mts","default":"./dist/LocalSandbox.mjs"}},"description":"Node-local child-process Sandbox adapter for Effect Agent; honestly labeled unisolated development tooling, not a security boundary.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/sandbox-local"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}

package/src/{local-sandbox.ts → LocalSandbox.ts}

@@ -1,4 +1,5 @@
 import {
+  SANDBOX_DIAGNOSTIC_MAX_LENGTH,
   Sandbox,
   SandboxExited,
   SandboxExitError,
@@ -10,11 +11,10 @@ import {
   SandboxStarted,
   SandboxTimeoutError,
   SandboxUnsupportedRequestError,
-  type SandboxError,
   type SandboxEvent,
   type SandboxExecute,
   type SandboxRequest,
-} from "@effect-agent/sandbox";
+} from "@effect-agent/sandbox/Sandbox";
 import { NodeServices } from "@effect/platform-node";
 import { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from "effect";
 import { ChildProcess } from "effect/unstable/process";
@@ -34,6 +34,9 @@ type OutputCounts = Readonly<Record<OutputStream, number>>;
 
 const zeroOutput: OutputCounts = { stdout: 0, stderr: 0 };
 
+const boundedDiagnostic = (message: string): string =>
+  message.slice(0, SANDBOX_DIAGNOSTIC_MAX_LENGTH);
+
 const unsupported = (
   feature: Parameters<typeof SandboxUnsupportedRequestError.make>[0]["feature"],
   message: string,
@@ -41,68 +44,72 @@ const unsupported = (
   SandboxUnsupportedRequestError.make({
     implementation: unisolatedImplementation,
     feature,
-    message,
+    message: boundedDiagnostic(message),
   });
 
-const validateRequest = (request: SandboxRequest): Effect.Effect<void, SandboxError> => {
-  if (request.runtime.kind !== "unisolated-process") {
-    return Effect.fail(
-      unsupported(
-        "runtime",
-        "The local process runner only accepts runtime.kind 'unisolated-process'.",
-      ),
+const validateRequest = Effect.fn("LocalSandbox.validateRequest")(function* (
+  request: SandboxRequest,
+) {
+  if (
+    request.runtime.kind !== "unisolated-process" ||
+    request.runtime.identity !== unisolatedImplementation.identity
+  ) {
+    return yield* unsupported(
+      "runtime",
+      "The local process runner only accepts runtime kind 'unisolated-process' with identity 'local-process'.",
     );
   }
   if (request.mounts.length > 0) {
-    return Effect.fail(
-      unsupported(
-        "mounts",
-        "The unisolated local process runner cannot enforce mount access modes.",
-      ),
+    return yield* unsupported(
+      "mounts",
+      "The unisolated local process runner cannot enforce mount access modes.",
     );
   }
   if (request.network._tag !== "NetworkDisabled") {
-    return Effect.fail(
-      unsupported(
-        "network",
-        "The unisolated local process runner cannot enforce workload network policy.",
-      ),
+    return yield* unsupported(
+      "network",
+      "The unisolated local process runner cannot enforce workload network policy.",
     );
   }
   if (request.limits.cpuCores !== undefined) {
-    return Effect.fail(
-      unsupported("cpu-limit", "The unisolated local process runner cannot enforce CPU limits."),
+    return yield* unsupported(
+      "cpu-limit",
+      "The unisolated local process runner cannot enforce CPU limits.",
     );
   }
   if (request.limits.memoryBytes !== undefined) {
-    return Effect.fail(
-      unsupported(
-        "memory-limit",
-        "The unisolated local process runner cannot enforce memory limits.",
-      ),
+    return yield* unsupported(
+      "memory-limit",
+      "The unisolated local process runner cannot enforce memory limits.",
     );
   }
   if (request.secretHandles.length > 0) {
-    return Effect.fail(
-      unsupported(
-        "secret-handles",
-        "The unisolated local process runner does not resolve secret handles into an environment.",
-      ),
+    return yield* unsupported(
+      "secret-handles",
+      "The unisolated local process runner does not resolve secret handles into an environment.",
     );
   }
   if (request.artifactRules.length > 0) {
-    return Effect.fail(
-      unsupported("artifacts", "The unisolated local process runner does not collect artifacts."),
+    return yield* unsupported(
+      "artifacts",
+      "The unisolated local process runner does not collect artifacts.",
     );
   }
-  return Effect.void;
-};
+});
 
 const spawnError = (request: SandboxRequest, message: string, cause?: unknown) =>
   SandboxSpawnError.make({
     implementation: unisolatedImplementation,
     command: request.command,
-    message,
+    message: boundedDiagnostic(message),
+    ...(cause === undefined ? {} : { cause }),
+  });
+
+const exitError = (message: string, cause?: unknown, exitCode = -1) =>
+  SandboxExitError.make({
+    implementation: unisolatedImplementation,
+    exitCode,
+    message: boundedDiagnostic(message),
     ...(cause === undefined ? {} : { cause }),
   });
 
@@ -110,6 +117,7 @@ const environmentFromAllowlist = Effect.fn("LocalSandbox.environmentFromAllowlis
   request: SandboxRequest,
 ) {
   const environment: Record<string, string> = {};
+
   for (const name of request.environment.allow) {
     const value = yield* Config.option(Config.string(name)).pipe(
       Effect.mapError((error) =>
@@ -120,10 +128,12 @@ const environmentFromAllowlist = Effect.fn("LocalSandbox.environmentFromAllowlis
         ),
       ),
     );
+
     if (Option.isSome(value)) {
       environment[name] = value.value;
     }
   }
+
   return environment;
 });
 
@@ -137,6 +147,7 @@ const outputEvent = (
   Ref.modify(counts, (current) => {
     const streamBytes = current[stream] + bytes.byteLength;
     const next = { ...current, [stream]: streamBytes };
+
     return [next.stdout + next.stderr, next] as const;
   }).pipe(
     Effect.flatMap((observed) =>
@@ -170,6 +181,7 @@ const outputEvent = (
 const flushDecoder = (stream: OutputStream, decoder: TextDecoder): Stream.Stream<SandboxOutput> =>
   Stream.suspend(() => {
     const text = decoder.decode();
+
     return text.length === 0
       ? Stream.empty
       : Stream.succeed(
@@ -194,6 +206,7 @@ const makeExecute =
         const stdoutDecoder = new TextDecoder();
         const stderrDecoder = new TextDecoder();
         const environment = yield* environmentFromAllowlist(request);
+
         const command = ChildProcess.make(request.command, request.args, {
           cwd: request.cwd,
           env: environment,
@@ -201,14 +214,16 @@ const makeExecute =
           stdout: "pipe",
           stderr: "pipe",
         });
+
         const child = yield* spawner
           .spawn(command)
           .pipe(Effect.mapError((error) => spawnError(request, error.message, error)));
 
         const streamOutput = (stream: OutputStream, decoder: TextDecoder) => {
           const source = stream === "stdout" ? child.stdout : child.stderr;
+
           return source.pipe(
-            Stream.mapError((error) => spawnError(request, error.message, error)),
+            Stream.mapError((error) => exitError(error.message, error)),
             Stream.mapEffect((bytes) =>
               outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes),
             ),
@@ -219,22 +234,18 @@ const makeExecute =
         const terminal = Stream.unwrap(
           Effect.gen(function* () {
             const exitCode = yield* child.exitCode.pipe(
-              Effect.mapError((error) =>
-                SandboxExitError.make({
-                  cause: error,
-                  implementation: unisolatedImplementation,
-                  exitCode: -1,
-                  message: error.message,
-                }),
-              ),
+              Effect.mapError((error) => exitError(error.message, error)),
             );
+
             const endedAt = yield* Clock.currentTimeMillis;
             const output = yield* Ref.get(counts);
+
             const resourceUse = SandboxResourceUse.make({
               wallTime: Duration.millis(endedAt - startedAt),
               stdoutBytes: output.stdout,
               stderrBytes: output.stderr,
             });
+
             const exited = SandboxExited.make({
               eventVersion: 1,
               implementation: unisolatedImplementation,
@@ -242,22 +253,23 @@ const makeExecute =
               resourceUse,
               artifacts: [],
             });
+
             return exitCode === 0
               ? Stream.succeed<SandboxEvent>(exited)
               : Stream.concat(
                   Stream.succeed<SandboxEvent>(exited),
                   Stream.fail(
-                    SandboxExitError.make({
-                      implementation: unisolatedImplementation,
+                    exitError(
+                      `Unisolated local process exited with code ${exitCode}.`,
+                      undefined,
                       exitCode,
-                      message: `Unisolated local process exited with code ${exitCode}.`,
-                    }),
+                    ),
                   ),
                 );
           }),
         );
 
-        const execution = Stream.concat(
+        return Stream.concat(
           Stream.succeed<SandboxEvent>(
             SandboxStarted.make({
               eventVersion: 1,
@@ -273,23 +285,20 @@ const makeExecute =
             terminal,
           ),
         );
-
-        return execution.pipe(
-          Stream.interruptWhen(
-            Effect.sleep(request.limits.maxWallTime).pipe(
-              Effect.andThen(
-                Effect.fail(
-                  SandboxTimeoutError.make({
-                    implementation: unisolatedImplementation,
-                    maxWallTime: request.limits.maxWallTime,
-                  }),
-                ),
-              ),
-            ),
-          ),
-        );
       }),
-    ).pipe(Stream.withSpan("LocalSandbox.execute"));
+    ).pipe(
+      Stream.interruptWhen(
+        Effect.gen(function* () {
+          yield* Effect.sleep(request.limits.maxWallTime);
+
+          return yield* SandboxTimeoutError.make({
+            implementation: unisolatedImplementation,
+            maxWallTime: request.limits.maxWallTime,
+          });
+        }),
+      ),
+      Stream.withSpan("LocalSandbox.execute"),
+    );
 
 /**
  * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible
@@ -299,6 +308,7 @@ const makeExecute =
 export const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner> = Layer.effect(Sandbox)(
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner;
+
     return Sandbox.of({ execute: makeExecute(spawner) });
   }),
 );

package/src/index.ts

@@ -1 +1 @@
-export * from "./local-sandbox.ts";
+export * as LocalSandbox from "./LocalSandbox.ts";

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/local-sandbox.ts"],"sourcesContent":["import {\n  Sandbox,\n  SandboxExited,\n  SandboxExitError,\n  SandboxImplementation,\n  SandboxOutput,\n  SandboxOutputLimitError,\n  SandboxResourceUse,\n  SandboxSpawnError,\n  SandboxStarted,\n  SandboxTimeoutError,\n  SandboxUnsupportedRequestError,\n  type SandboxError,\n  type SandboxEvent,\n  type SandboxExecute,\n  type SandboxRequest,\n} from \"@effect-agent/sandbox\";\nimport { NodeServices } from \"@effect/platform-node\";\nimport { Clock, Config, Duration, Effect, Layer, Option, Ref, Stream } from \"effect\";\nimport { ChildProcess } from \"effect/unstable/process\";\nimport { ChildProcessSpawner } from \"effect/unstable/process/ChildProcessSpawner\";\n\n/**\n * The only implementation identity produced by this package. It deliberately states that local\n * process execution is unisolated development tooling, not a security sandbox.\n */\nexport const unisolatedImplementation = SandboxImplementation.make({\n  isolation: \"unisolated\",\n  identity: \"local-process\",\n});\n\ntype OutputStream = \"stdout\" | \"stderr\";\ntype OutputCounts = Readonly<Record<OutputStream, number>>;\n\nconst zeroOutput: OutputCounts = { stdout: 0, stderr: 0 };\n\nconst unsupported = (\n  feature: Parameters<typeof SandboxUnsupportedRequestError.make>[0][\"feature\"],\n  message: string,\n) =>\n  SandboxUnsupportedRequestError.make({\n    implementation: unisolatedImplementation,\n    feature,\n    message,\n  });\n\nconst validateRequest = (request: SandboxRequest): Effect.Effect<void, SandboxError> => {\n  if (request.runtime.kind !== \"unisolated-process\") {\n    return Effect.fail(\n      unsupported(\n        \"runtime\",\n        \"The local process runner only accepts runtime.kind 'unisolated-process'.\",\n      ),\n    );\n  }\n  if (request.mounts.length > 0) {\n    return Effect.fail(\n      unsupported(\n        \"mounts\",\n        \"The unisolated local process runner cannot enforce mount access modes.\",\n      ),\n    );\n  }\n  if (request.network._tag !== \"NetworkDisabled\") {\n    return Effect.fail(\n      unsupported(\n        \"network\",\n        \"The unisolated local process runner cannot enforce workload network policy.\",\n      ),\n    );\n  }\n  if (request.limits.cpuCores !== undefined) {\n    return Effect.fail(\n      unsupported(\"cpu-limit\", \"The unisolated local process runner cannot enforce CPU limits.\"),\n    );\n  }\n  if (request.limits.memoryBytes !== undefined) {\n    return Effect.fail(\n      unsupported(\n        \"memory-limit\",\n        \"The unisolated local process runner cannot enforce memory limits.\",\n      ),\n    );\n  }\n  if (request.secretHandles.length > 0) {\n    return Effect.fail(\n      unsupported(\n        \"secret-handles\",\n        \"The unisolated local process runner does not resolve secret handles into an environment.\",\n      ),\n    );\n  }\n  if (request.artifactRules.length > 0) {\n    return Effect.fail(\n      unsupported(\"artifacts\", \"The unisolated local process runner does not collect artifacts.\"),\n    );\n  }\n  return Effect.void;\n};\n\nconst spawnError = (request: SandboxRequest, message: string, cause?: unknown) =>\n  SandboxSpawnError.make({\n    implementation: unisolatedImplementation,\n    command: request.command,\n    message,\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst environmentFromAllowlist = Effect.fn(\"LocalSandbox.environmentFromAllowlist\")(function* (\n  request: SandboxRequest,\n) {\n  const environment: Record<string, string> = {};\n  for (const name of request.environment.allow) {\n    const value = yield* Config.option(Config.string(name)).pipe(\n      Effect.mapError((error) =>\n        spawnError(\n          request,\n          `Could not read allowed environment variable '${name}': ${error.message}`,\n          error,\n        ),\n      ),\n    );\n    if (Option.isSome(value)) {\n      environment[name] = value.value;\n    }\n  }\n  return environment;\n});\n\nconst outputEvent = (\n  counts: Ref.Ref<OutputCounts>,\n  stream: OutputStream,\n  bytes: Uint8Array,\n  decoder: TextDecoder,\n  limit: number,\n): Effect.Effect<SandboxOutput, SandboxOutputLimitError> =>\n  Ref.modify(counts, (current) => {\n    const streamBytes = current[stream] + bytes.byteLength;\n    const next = { ...current, [stream]: streamBytes };\n    return [next.stdout + next.stderr, next] as const;\n  }).pipe(\n    Effect.flatMap((observed) =>\n      observed > limit\n        ? Effect.fail(\n            SandboxOutputLimitError.make({\n              implementation: unisolatedImplementation,\n              stream,\n              limit,\n              observed,\n            }),\n          )\n        : Effect.succeed(\n            SandboxOutput.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              stream,\n              text: decoder.decode(bytes, { stream: true }),\n              bytes: bytes.byteLength,\n            }),\n          ),\n    ),\n  );\n\n/**\n * Emits any text the streaming decoder still holds once its source stream ends. The final decode\n * must run at end-of-stream, not at pipeline construction, so the flush is suspended; a trailing\n * incomplete UTF-8 sequence surfaces as replacement text. Its raw bytes were already counted when\n * the chunk arrived, so the flush event carries zero bytes.\n */\nconst flushDecoder = (stream: OutputStream, decoder: TextDecoder): Stream.Stream<SandboxOutput> =>\n  Stream.suspend(() => {\n    const text = decoder.decode();\n    return text.length === 0\n      ? Stream.empty\n      : Stream.succeed(\n          SandboxOutput.make({\n            eventVersion: 1,\n            implementation: unisolatedImplementation,\n            stream,\n            text,\n            bytes: 0,\n          }),\n        );\n  });\n\nconst makeExecute =\n  (spawner: ChildProcessSpawner[\"Service\"]): SandboxExecute =>\n  (request) =>\n    Stream.unwrap(\n      Effect.gen(function* () {\n        yield* validateRequest(request);\n        const startedAt = yield* Clock.currentTimeMillis;\n        const counts = yield* Ref.make(zeroOutput);\n        const stdoutDecoder = new TextDecoder();\n        const stderrDecoder = new TextDecoder();\n        const environment = yield* environmentFromAllowlist(request);\n        const command = ChildProcess.make(request.command, request.args, {\n          cwd: request.cwd,\n          env: environment,\n          extendEnv: false,\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n        });\n        const child = yield* spawner\n          .spawn(command)\n          .pipe(Effect.mapError((error) => spawnError(request, error.message, error)));\n\n        const streamOutput = (stream: OutputStream, decoder: TextDecoder) => {\n          const source = stream === \"stdout\" ? child.stdout : child.stderr;\n          return source.pipe(\n            Stream.mapError((error) => spawnError(request, error.message, error)),\n            Stream.mapEffect((bytes) =>\n              outputEvent(counts, stream, bytes, decoder, request.limits.maxOutputBytes),\n            ),\n            Stream.concat(flushDecoder(stream, decoder)),\n          );\n        };\n\n        const terminal = Stream.unwrap(\n          Effect.gen(function* () {\n            const exitCode = yield* child.exitCode.pipe(\n              Effect.mapError((error) =>\n                SandboxExitError.make({\n                  cause: error,\n                  implementation: unisolatedImplementation,\n                  exitCode: -1,\n                  message: error.message,\n                }),\n              ),\n            );\n            const endedAt = yield* Clock.currentTimeMillis;\n            const output = yield* Ref.get(counts);\n            const resourceUse = SandboxResourceUse.make({\n              wallTime: Duration.millis(endedAt - startedAt),\n              stdoutBytes: output.stdout,\n              stderrBytes: output.stderr,\n            });\n            const exited = SandboxExited.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              exitCode,\n              resourceUse,\n              artifacts: [],\n            });\n            return exitCode === 0\n              ? Stream.succeed<SandboxEvent>(exited)\n              : Stream.concat(\n                  Stream.succeed<SandboxEvent>(exited),\n                  Stream.fail(\n                    SandboxExitError.make({\n                      implementation: unisolatedImplementation,\n                      exitCode,\n                      message: `Unisolated local process exited with code ${exitCode}.`,\n                    }),\n                  ),\n                );\n          }),\n        );\n\n        const execution = Stream.concat(\n          Stream.succeed<SandboxEvent>(\n            SandboxStarted.make({\n              eventVersion: 1,\n              implementation: unisolatedImplementation,\n              runtime: request.runtime,\n            }),\n          ),\n          Stream.concat(\n            Stream.merge(\n              streamOutput(\"stdout\", stdoutDecoder),\n              streamOutput(\"stderr\", stderrDecoder),\n            ),\n            terminal,\n          ),\n        );\n\n        return execution.pipe(\n          Stream.interruptWhen(\n            Effect.sleep(request.limits.maxWallTime).pipe(\n              Effect.andThen(\n                Effect.fail(\n                  SandboxTimeoutError.make({\n                    implementation: unisolatedImplementation,\n                    maxWallTime: request.limits.maxWallTime,\n                  }),\n                ),\n              ),\n            ),\n          ),\n        );\n      }),\n    ).pipe(Stream.withSpan(\"LocalSandbox.execute\"));\n\n/**\n * Development-only local process adapter with its `ChildProcessSpawner` requirement kept visible\n * so composition roots and tests can inject a spawner double. It is unisolated and must never be\n * used as a security boundary for untrusted code or commands.\n */\nexport const sandboxLayer: Layer.Layer<Sandbox, never, ChildProcessSpawner> = Layer.effect(Sandbox)(\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner;\n    return Sandbox.of({ execute: makeExecute(spawner) });\n  }),\n);\n\n/** A scoped Node process implementation whose events are always labeled `unisolated`. */\nexport const layer: Layer.Layer<Sandbox> = sandboxLayer.pipe(Layer.provide(NodeServices.layer));\n"],"mappings":";;;;;;;;;;AA0BA,MAAa,2BAA2B,sBAAsB,KAAK;CACjE,WAAW;CACX,UAAU;AACZ,CAAC;AAKD,MAAM,aAA2B;CAAE,QAAQ;CAAG,QAAQ;AAAE;AAExD,MAAM,eACJ,SACA,YAEA,+BAA+B,KAAK;CAClC,gBAAgB;CAChB;CACA;AACF,CAAC;AAEH,MAAM,mBAAmB,YAA+D;CACtF,IAAI,QAAQ,QAAQ,SAAS,sBAC3B,OAAO,OAAO,KACZ,YACE,WACA,0EACF,CACF;CAEF,IAAI,QAAQ,OAAO,SAAS,GAC1B,OAAO,OAAO,KACZ,YACE,UACA,wEACF,CACF;CAEF,IAAI,QAAQ,QAAQ,SAAS,mBAC3B,OAAO,OAAO,KACZ,YACE,WACA,6EACF,CACF;CAEF,IAAI,QAAQ,OAAO,aAAa,KAAA,GAC9B,OAAO,OAAO,KACZ,YAAY,aAAa,gEAAgE,CAC3F;CAEF,IAAI,QAAQ,OAAO,gBAAgB,KAAA,GACjC,OAAO,OAAO,KACZ,YACE,gBACA,mEACF,CACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,KACZ,YACE,kBACA,0FACF,CACF;CAEF,IAAI,QAAQ,cAAc,SAAS,GACjC,OAAO,OAAO,KACZ,YAAY,aAAa,iEAAiE,CAC5F;CAEF,OAAO,OAAO;AAChB;AAEA,MAAM,cAAc,SAAyB,SAAiB,UAC5D,kBAAkB,KAAK;CACrB,gBAAgB;CAChB,SAAS,QAAQ;CACjB;CACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,2BAA2B,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,cAAsC,CAAC;CAC7C,KAAK,MAAM,QAAQ,QAAQ,YAAY,OAAO;EAC5C,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,KACtD,OAAO,UAAU,UACf,WACE,SACA,gDAAgD,KAAK,KAAK,MAAM,WAChE,KACF,CACF,CACF;EACA,IAAI,OAAO,OAAO,KAAK,GACrB,YAAY,QAAQ,MAAM;CAE9B;CACA,OAAO;AACT,CAAC;AAED,MAAM,eACJ,QACA,QACA,OACA,SACA,UAEA,IAAI,OAAO,SAAS,YAAY;CAC9B,MAAM,cAAc,QAAQ,UAAU,MAAM;CAC5C,MAAM,OAAO;EAAE,GAAG;GAAU,SAAS;CAAY;CACjD,OAAO,CAAC,KAAK,SAAS,KAAK,QAAQ,IAAI;AACzC,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,aACd,WAAW,QACP,OAAO,KACL,wBAAwB,KAAK;CAC3B,gBAAgB;CAChB;CACA;CACA;AACF,CAAC,CACH,IACA,OAAO,QACL,cAAc,KAAK;CACjB,cAAc;CACd,gBAAgB;CAChB;CACA,MAAM,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;CAC5C,OAAO,MAAM;AACf,CAAC,CACH,CACN,CACF;;;;;;;AAQF,MAAM,gBAAgB,QAAsB,YAC1C,OAAO,cAAc;CACnB,MAAM,OAAO,QAAQ,OAAO;CAC5B,OAAO,KAAK,WAAW,IACnB,OAAO,QACP,OAAO,QACL,cAAc,KAAK;EACjB,cAAc;EACd,gBAAgB;EAChB;EACA;EACA,OAAO;CACT,CAAC,CACH;AACN,CAAC;AAEH,MAAM,eACH,aACA,YACC,OAAO,OACL,OAAO,IAAI,aAAa;CACtB,OAAO,gBAAgB,OAAO;CAC9B,MAAM,YAAY,OAAO,MAAM;CAC/B,MAAM,SAAS,OAAO,IAAI,KAAK,UAAU;CACzC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,gBAAgB,IAAI,YAAY;CACtC,MAAM,cAAc,OAAO,yBAAyB,OAAO;CAC3D,MAAM,UAAU,aAAa,KAAK,QAAQ,SAAS,QAAQ,MAAM;EAC/D,KAAK,QAAQ;EACb,KAAK;EACL,WAAW;EACX,QAAQ;EACR,QAAQ;CACV,CAAC;CACD,MAAM,QAAQ,OAAO,QAClB,MAAM,OAAO,CAAC,CACd,KAAK,OAAO,UAAU,UAAU,WAAW,SAAS,MAAM,SAAS,KAAK,CAAC,CAAC;CAE7E,MAAM,gBAAgB,QAAsB,YAAyB;EAEnE,QADe,WAAW,WAAW,MAAM,SAAS,MAAM,OAAA,CAC5C,KACZ,OAAO,UAAU,UAAU,WAAW,SAAS,MAAM,SAAS,KAAK,CAAC,GACpE,OAAO,WAAW,UAChB,YAAY,QAAQ,QAAQ,OAAO,SAAS,QAAQ,OAAO,cAAc,CAC3E,GACA,OAAO,OAAO,aAAa,QAAQ,OAAO,CAAC,CAC7C;CACF;CAEA,MAAM,WAAW,OAAO,OACtB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,MAAM,SAAS,KACrC,OAAO,UAAU,UACf,iBAAiB,KAAK;GACpB,OAAO;GACP,gBAAgB;GAChB,UAAU;GACV,SAAS,MAAM;EACjB,CAAC,CACH,CACF;EACA,MAAM,UAAU,OAAO,MAAM;EAC7B,MAAM,SAAS,OAAO,IAAI,IAAI,MAAM;EACpC,MAAM,cAAc,mBAAmB,KAAK;GAC1C,UAAU,SAAS,OAAO,UAAU,SAAS;GAC7C,aAAa,OAAO;GACpB,aAAa,OAAO;EACtB,CAAC;EACD,MAAM,SAAS,cAAc,KAAK;GAChC,cAAc;GACd,gBAAgB;GAChB;GACA;GACA,WAAW,CAAC;EACd,CAAC;EACD,OAAO,aAAa,IAChB,OAAO,QAAsB,MAAM,IACnC,OAAO,OACL,OAAO,QAAsB,MAAM,GACnC,OAAO,KACL,iBAAiB,KAAK;GACpB,gBAAgB;GAChB;GACA,SAAS,6CAA6C,SAAS;EACjE,CAAC,CACH,CACF;CACN,CAAC,CACH;CAmBA,OAjBkB,OAAO,OACvB,OAAO,QACL,eAAe,KAAK;EAClB,cAAc;EACd,gBAAgB;EAChB,SAAS,QAAQ;CACnB,CAAC,CACH,GACA,OAAO,OACL,OAAO,MACL,aAAa,UAAU,aAAa,GACpC,aAAa,UAAU,aAAa,CACtC,GACA,QACF,CAGa,CAAC,CAAC,KACf,OAAO,cACL,OAAO,MAAM,QAAQ,OAAO,WAAW,CAAC,CAAC,KACvC,OAAO,QACL,OAAO,KACL,oBAAoB,KAAK;EACvB,gBAAgB;EAChB,aAAa,QAAQ,OAAO;CAC9B,CAAC,CACH,CACF,CACF,CACF,CACF;AACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,sBAAsB,CAAC;;;;;;AAOlD,MAAa,eAAiE,MAAM,OAAO,OAAO,CAAC,CACjG,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO;CACvB,OAAO,QAAQ,GAAG,EAAE,SAAS,YAAY,OAAO,EAAE,CAAC;AACrD,CAAC,CACH;;AAGA,MAAa,QAA8B,aAAa,KAAK,MAAM,QAAQ,aAAa,KAAK,CAAC"}