@larkup/sandbox 0.1.1

package/.turbo/turbo-build.log

@@ -0,0 +1,6 @@
+(node:18200) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+
+> @larkup/sandbox@0.1.0 build /Users/abdelrahmanabounida/Desktop/my-ai-startup/larkup/larkup/packages/sandbox
+> tsc --outDir dist
+

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @larkup/sandbox
+
+## 0.1.1
+
+### Patch Changes
+
+- 4e54939: feat: add doc-editor tool and canvas preview

package/Dockerfile

@@ -0,0 +1,30 @@
+FROM python:3.12-slim
+
+LABEL maintainer="larkup" \
+      description="Larkup sandbox for data analysis code execution"
+
+# Install data analysis libraries
+RUN pip install --no-cache-dir \
+    pandas==2.2.3 \
+    numpy==2.2.6 \
+    matplotlib==3.10.3 \
+    openpyxl==3.1.5 \
+    scipy==1.15.3 \
+    scikit-learn==1.7.0 \
+    seaborn==0.13.2 \
+    xlrd==2.0.1 \
+    pypdf==5.1.0 \
+    python-docx==1.1.2 \
+    python-pptx==1.0.2 \
+    Pillow==11.1.0
+
+# Matplotlib non-interactive backend (no display needed)
+ENV MPLBACKEND=Agg
+
+WORKDIR /sandbox
+
+# Non-root user for security
+RUN useradd -m -s /bin/bash sandboxuser
+USER sandboxuser
+
+ENTRYPOINT ["python3", "-c"]

package/LICENSE

@@ -0,0 +1,176 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/dist/docker-runner.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Docker-based sandbox runner.
+ *
+ * Uses `dockerode` to manage ephemeral containers for code execution.
+ * Each execution spins up a container, runs the code, captures output +
+ * generated files, then auto-removes the container.
+ */
+import type { DockerConfig, ExecutionRequest, ExecutionResult, SandboxHealthCheck } from './types.js';
+export declare function checkDockerHealth(): Promise<SandboxHealthCheck>;
+export declare function buildSandboxImage(onProgress?: (msg: string) => void): Promise<void>;
+export declare function ensureImage(): Promise<boolean>;
+export declare function executeInDocker(request: ExecutionRequest, config: DockerConfig): Promise<ExecutionResult>;

package/dist/docker-runner.js

@@ -0,0 +1,438 @@
+/**
+ * Docker-based sandbox runner.
+ *
+ * Uses `dockerode` to manage ephemeral containers for code execution.
+ * Each execution spins up a container, runs the code, captures output +
+ * generated files, then auto-removes the container.
+ */
+import Docker from 'dockerode';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+const SANDBOX_IMAGE = 'larkup-sandbox:latest';
+const OUTPUT_DIR = '/sandbox/output';
+const INPUT_DIR = '/sandbox/input';
+const DOCKERFILE_DIR = path.join(import.meta.dirname ?? __dirname, '..');
+let dockerInstance = null;
+function getDocker() {
+    if (!dockerInstance) {
+        dockerInstance = new Docker();
+    }
+    return dockerInstance;
+}
+/* ------------------------------------------------------------------ */
+/* Health check                                                        */
+/* ------------------------------------------------------------------ */
+export async function checkDockerHealth() {
+    const docker = getDocker();
+    try {
+        const info = await docker.version();
+        const images = await docker.listImages({
+            filters: { reference: [SANDBOX_IMAGE] },
+        });
+        return {
+            status: images.length > 0 ? 'ready' : 'image-not-found',
+            backend: 'docker',
+            dockerVersion: info.Version,
+            imageReady: images.length > 0,
+        };
+    }
+    catch (err) {
+        return {
+            status: 'docker-not-found',
+            backend: 'docker',
+            error: err.message ?? 'Docker daemon not available',
+        };
+    }
+}
+/* ------------------------------------------------------------------ */
+/* Image management                                                    */
+/* ------------------------------------------------------------------ */
+export async function buildSandboxImage(onProgress) {
+    const docker = getDocker();
+    const dockerfilePath = path.join(DOCKERFILE_DIR, 'Dockerfile');
+    // Check if Dockerfile exists in the package
+    try {
+        await fs.access(dockerfilePath);
+    }
+    catch {
+        throw new Error(`Sandbox Dockerfile not found at ${dockerfilePath}. ` +
+            `Ensure the @larkup/sandbox package is properly installed.`);
+    }
+    onProgress?.('Building sandbox image…');
+    const stream = await docker.buildImage({ context: DOCKERFILE_DIR, src: ['Dockerfile'] }, { t: SANDBOX_IMAGE });
+    // Follow the build stream to completion
+    await new Promise((resolve, reject) => {
+        docker.modem.followProgress(stream, (err) => {
+            if (err)
+                reject(err);
+            else
+                resolve();
+        }, (event) => {
+            if (event.stream) {
+                onProgress?.(event.stream.trim());
+            }
+        });
+    });
+    onProgress?.('Sandbox image built successfully ✓');
+}
+export async function ensureImage() {
+    const docker = getDocker();
+    const images = await docker.listImages({
+        filters: { reference: [SANDBOX_IMAGE] },
+    });
+    if (images.length > 0)
+        return true;
+    try {
+        await buildSandboxImage();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/* ------------------------------------------------------------------ */
+/* Code execution                                                      */
+/* ------------------------------------------------------------------ */
+/**
+ * Build the Python wrapper script that:
+ * 1. Sets up pandas compatibility shims to handle deprecated APIs
+ * 2. Auto-imports common data analysis modules
+ * 3. Runs the user code with robust error handling
+ * 4. Saves any matplotlib figures to /sandbox/output/
+ * 5. Lists generated artifacts
+ */
+function wrapPythonCode(code) {
+    return `
+import sys, os, json, traceback
+
+# Ensure output directory exists
+os.makedirs("${OUTPUT_DIR}", exist_ok=True)
+
+# ============================================================
+# SAFETY PREAMBLE: Suppress warnings & patch deprecated APIs
+# ============================================================
+import warnings
+warnings.filterwarnings('ignore', category=FutureWarning)
+warnings.filterwarnings('ignore', category=DeprecationWarning)
+warnings.filterwarnings('ignore', category=UserWarning)
+
+# Auto-import common data analysis modules
+import numpy as np
+
+try:
+    import pandas as pd
+
+    # --- Patch 1: DataFrame.append() was removed in pandas 2.0 ---
+    if not hasattr(pd.DataFrame, 'append'):
+        def _df_append(self, other, ignore_index=False, verify_integrity=False, sort=False, **kwargs):
+            """Backwards-compatible append using pd.concat."""
+            if isinstance(other, (list, tuple)):
+                to_concat = [self] + list(other)
+            elif isinstance(other, dict):
+                to_concat = [self, pd.DataFrame([other])]
+            else:
+                to_concat = [self, other]
+            return pd.concat(to_concat, ignore_index=ignore_index, verify_integrity=verify_integrity, sort=sort)
+        pd.DataFrame.append = _df_append
+
+    # --- Patch 2: Series.append() was removed in pandas 2.0 ---
+    if not hasattr(pd.Series, 'append'):
+        def _series_append(self, to_append, ignore_index=False, verify_integrity=False):
+            """Backwards-compatible Series.append using pd.concat."""
+            if isinstance(to_append, (list, tuple)):
+                to_concat = [self] + list(to_append)
+            else:
+                to_concat = [self, to_append]
+            return pd.concat(to_concat, ignore_index=ignore_index, verify_integrity=verify_integrity)
+        pd.Series.append = _series_append
+
+    # --- Patch 3: Fix deprecated resample frequency aliases ---
+    # "M" -> "ME", "Q" -> "QE", "Y" -> "YE", "H" -> "h", "T" -> "min", "S" -> "s"
+    _original_resample = pd.DataFrame.resample
+    _FREQ_ALIAS_MAP = {
+        'M': 'ME', 'Q': 'QE', 'Y': 'YE', 'A': 'YE',
+        'BM': 'BME', 'BQ': 'BQE', 'BA': 'BYE', 'BY': 'BYE',
+        'BMS': 'BMS', 'QS': 'QS', 'AS': 'YS', 'BAS': 'BYS',
+        'H': 'h', 'T': 'min', 'S': 's', 'L': 'ms', 'U': 'us', 'N': 'ns',
+    }
+    def _patched_resample(self, rule, *args, **kwargs):
+        if isinstance(rule, str) and rule in _FREQ_ALIAS_MAP:
+            rule = _FREQ_ALIAS_MAP[rule]
+        return _original_resample(self, rule, *args, **kwargs)
+    pd.DataFrame.resample = _patched_resample
+
+    # Also patch Series.resample
+    _original_series_resample = pd.Series.resample
+    def _patched_series_resample(self, rule, *args, **kwargs):
+        if isinstance(rule, str) and rule in _FREQ_ALIAS_MAP:
+            rule = _FREQ_ALIAS_MAP[rule]
+        return _original_series_resample(self, rule, *args, **kwargs)
+    pd.Series.resample = _patched_series_resample
+
+    # --- Patch 4: Fix pd.Grouper freq aliases ---
+    _original_grouper = pd.Grouper
+    class _PatchedGrouper(_original_grouper):
+        def __init__(self, *args, **kwargs):
+            if 'freq' in kwargs and isinstance(kwargs['freq'], str):
+                kwargs['freq'] = _FREQ_ALIAS_MAP.get(kwargs['freq'], kwargs['freq'])
+            super().__init__(*args, **kwargs)
+    pd.Grouper = _PatchedGrouper
+
+except ImportError:
+    pass
+
+# ============================================================
+# Patch matplotlib to auto-save figures
+# ============================================================
+_figure_count = [0]
+try:
+    import matplotlib
+    matplotlib.use("Agg")
+    import matplotlib.pyplot as plt
+
+    _original_show = plt.show
+    def _patched_show(*args, **kwargs):
+        for fig_num in plt.get_fignums():
+            fig = plt.figure(fig_num)
+            fname = f"${OUTPUT_DIR}/chart_{_figure_count[0]}.png"
+            fig.savefig(fname, dpi=150, bbox_inches="tight", facecolor="white")
+            _figure_count[0] += 1
+        plt.close("all")
+    plt.show = _patched_show
+except ImportError:
+    pass
+
+# ============================================================
+# Execute user code with robust error handling
+# ============================================================
+try:
+    exec(${JSON.stringify(code)})
+    
+    # Auto-save any remaining matplotlib figures
+    try:
+        import matplotlib.pyplot as plt
+        if plt.get_fignums():
+            plt.show()
+    except (ImportError, Exception):
+        pass
+except SystemExit as e:
+    # Let explicit sys.exit() calls through
+    if e.code != 0:
+        sys.exit(e.code)
+except Exception as e:
+    # Print a clean, user-readable error instead of raw traceback
+    error_type = type(e).__name__
+    error_msg = str(e)
+    print(f"Error ({error_type}): {error_msg}", file=sys.stderr)
+    # Also print the relevant part of the traceback for debugging
+    tb = traceback.extract_tb(sys.exc_info()[2])
+    # Filter to only show the exec'd code frames (skip wrapper frames)
+    user_frames = [f for f in tb if f.filename == '<string>']
+    if user_frames:
+        last = user_frames[-1]
+        print(f"  at line {last.lineno}: {last.line}", file=sys.stderr)
+    sys.exit(1)
+
+# List generated artifacts
+artifacts = []
+if os.path.isdir("${OUTPUT_DIR}"):
+    for f in sorted(os.listdir("${OUTPUT_DIR}")):
+        fp = os.path.join("${OUTPUT_DIR}", f)
+        if os.path.isfile(fp):
+            artifacts.append(f)
+if artifacts:
+    print("\\n__ARTIFACTS__:" + json.dumps(artifacts))
+`;
+}
+export async function executeInDocker(request, config) {
+    const docker = getDocker();
+    const startTime = Date.now();
+    // Create a temporary directory for input files
+    const tmpDir = path.join(os.tmpdir(), `larkup-sandbox-${randomUUID()}`);
+    const inputDir = path.join(tmpDir, 'input');
+    const outputDir = path.join(tmpDir, 'output');
+    await fs.mkdir(inputDir, { recursive: true });
+    await fs.mkdir(outputDir, { recursive: true });
+    // Write input files
+    if (request.files) {
+        for (const file of request.files) {
+            const filePath = path.join(inputDir, file.name);
+            if (file.isBase64) {
+                await fs.writeFile(filePath, Buffer.from(file.content, 'base64'));
+            }
+            else {
+                await fs.writeFile(filePath, file.content, 'utf8');
+            }
+        }
+    }
+    // Prepare the execution code
+    let execCode;
+    let cmd;
+    if (request.language === 'python') {
+        execCode = wrapPythonCode(request.code);
+        const scriptPath = path.join(tmpDir, 'run.py');
+        await fs.writeFile(scriptPath, execCode, 'utf8');
+        cmd = ['python3', '/sandbox/run.py'];
+    }
+    else {
+        // JavaScript/TypeScript (future)
+        const scriptPath = path.join(tmpDir, 'run.js');
+        await fs.writeFile(scriptPath, request.code, 'utf8');
+        cmd = ['node', '/sandbox/run.js'];
+    }
+    const timeout = request.timeout ?? config.timeoutMs;
+    let container = null;
+    try {
+        container = await docker.createContainer({
+            Image: config.imageName,
+            Cmd: cmd,
+            Entrypoint: [],
+            WorkingDir: '/sandbox/input',
+            HostConfig: {
+                AutoRemove: false,
+                Memory: config.memoryMB * 1024 * 1024,
+                CpuShares: config.cpuShares,
+                NetworkMode: config.networkDisabled ? 'none' : 'bridge',
+                Binds: [
+                    `${inputDir}:${INPUT_DIR}:ro`,
+                    `${outputDir}:${OUTPUT_DIR}:rw`,
+                    `${tmpDir}/run.py:/sandbox/run.py:ro`,
+                ],
+                ReadonlyRootfs: false,
+            },
+            Tty: false,
+            AttachStdout: true,
+            AttachStderr: true,
+        });
+        await container.start();
+        // Wait for completion with timeout
+        const waitPromise = container.wait();
+        const timeoutPromise = new Promise((_, reject) => {
+            setTimeout(async () => {
+                try {
+                    await container?.kill();
+                }
+                catch {
+                    /* container may have already stopped */
+                }
+                reject(new Error(`Execution timed out after ${timeout}ms`));
+            }, timeout);
+        });
+        const result = await Promise.race([waitPromise, timeoutPromise]);
+        // Capture logs
+        const logs = await container.logs({
+            stdout: true,
+            stderr: true,
+            follow: false,
+        });
+        const logStr = demuxDockerStream(logs);
+        // Collect artifacts from output directory
+        const artifacts = [];
+        try {
+            const files = await fs.readdir(outputDir);
+            for (const file of files) {
+                const filePath = path.join(outputDir, file);
+                const content = await fs.readFile(filePath);
+                const ext = path.extname(file).toLowerCase();
+                const mimeType = getMimeType(ext);
+                artifacts.push({
+                    name: file,
+                    mimeType,
+                    data: content.toString('base64'),
+                });
+            }
+        }
+        catch {
+            /* output dir may not exist */
+        }
+        // Parse stdout/stderr from demuxed logs
+        const { stdout, stderr } = logStr;
+        return {
+            stdout: cleanArtifactMarkers(stdout),
+            stderr,
+            exitCode: result.StatusCode ?? 1,
+            artifacts,
+            executionTimeMs: Date.now() - startTime,
+        };
+    }
+    catch (err) {
+        return {
+            stdout: '',
+            stderr: err.message ?? 'Execution failed',
+            exitCode: 1,
+            artifacts: [],
+            executionTimeMs: Date.now() - startTime,
+        };
+    }
+    finally {
+        // Cleanup
+        if (container) {
+            try {
+                await container.remove({ force: true });
+            }
+            catch {
+                /* already removed */
+            }
+        }
+        try {
+            await fs.rm(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+/* ------------------------------------------------------------------ */
+/* Helpers                                                             */
+/* ------------------------------------------------------------------ */
+/**
+ * Docker multiplexes stdout/stderr into a single stream with 8-byte headers.
+ * Header format: [type(1)][0(3)][size(4)] where type: 1=stdout, 2=stderr
+ */
+function demuxDockerStream(buffer) {
+    let stdout = '';
+    let stderr = '';
+    if (typeof buffer === 'string') {
+        return { stdout: buffer, stderr: '' };
+    }
+    let offset = 0;
+    while (offset < buffer.length) {
+        if (offset + 8 > buffer.length)
+            break;
+        const type = buffer.readUInt8(offset);
+        const size = buffer.readUInt32BE(offset + 4);
+        offset += 8;
+        if (offset + size > buffer.length)
+            break;
+        const payload = buffer.subarray(offset, offset + size).toString('utf8');
+        if (type === 1)
+            stdout += payload;
+        else if (type === 2)
+            stderr += payload;
+        offset += size;
+    }
+    if (!stdout && !stderr && buffer.length > 0) {
+        stdout = buffer.toString('utf8');
+    }
+    return { stdout, stderr };
+}
+function cleanArtifactMarkers(stdout) {
+    return stdout.replace(/\n__ARTIFACTS__:.*$/m, '').trimEnd();
+}
+function getMimeType(ext) {
+    const map = {
+        '.png': 'image/png',
+        '.jpg': 'image/jpeg',
+        '.jpeg': 'image/jpeg',
+        '.svg': 'image/svg+xml',
+        '.gif': 'image/gif',
+        '.csv': 'text/csv',
+        '.json': 'application/json',
+        '.txt': 'text/plain',
+        '.html': 'text/html',
+        '.pdf': 'application/pdf',
+    };
+    return map[ext] ?? 'application/octet-stream';
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @larkup/sandbox — Main entry point.
+ *
+ * Re-exports the public API for the sandbox package.
+ */
+export { SandboxManager } from './sandbox-manager.js';
+export { checkDockerHealth, buildSandboxImage, ensureImage, executeInDocker, } from './docker-runner.js';
+export type { SandboxBackend, SandboxConfig, DockerConfig, RemoteConfig, SandboxLanguage, SandboxFile, ExecutionRequest, ExecutionResult, ExecutionArtifact, SandboxStatus, SandboxHealthCheck, } from './types.js';