@mastra/isolated-vm 0.0.0 → 0.1.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @mastra/isolated-vm
 
+## 0.1.0
+
+### Minor Changes
+
+- Added `@mastra/isolated-vm`, a new package with `IsolatedVmCodeModeTransport` — a Code Mode transport that runs model-authored programs in an in-process V8 isolate (backed by `isolated-vm`). The isolate is the execution boundary, so no workspace sandbox is required: the program has no filesystem, network, or process access, and its only capabilities are the `external_*` tool functions bridged back to the host. ([#20359](https://github.com/mastra-ai/mastra/pull/20359))
+
+  ```typescript
+  import { createCodeMode } from '@mastra/core/tools';
+  import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
+
+  const { tool, instructions } = createCodeMode({ tools }, new IsolatedVmCodeModeTransport({ memoryLimitMb: 128 }));
+  ```
+
+  Note: `isolated-vm` is a native addon, and on Node.js 20+ the host process must be started with `--no-node-snapshot` (for example `NODE_OPTIONS=--no-node-snapshot`). See the docs for setup details. Resolves https://github.com/mastra-ai/mastra/issues/20329.
+
+### Patch Changes
+
+- Updated dependencies [[`3f472b4`](https://github.com/mastra-ai/mastra/commit/3f472b468892a1ff14ccb43cc0343b86f7d8fd7d), [`ba369f2`](https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac), [`35b929b`](https://github.com/mastra-ai/mastra/commit/35b929b7abc3d20d85c7985880960ac2d04a6c86), [`55c9e24`](https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f), [`dcfed93`](https://github.com/mastra-ai/mastra/commit/dcfed93e1e256c6abfa792cbb7ca836f5d0e8638), [`2876e15`](https://github.com/mastra-ai/mastra/commit/2876e15b4d2f616a3bc1ed3af57d546c268384ce), [`9b3626a`](https://github.com/mastra-ai/mastra/commit/9b3626aeb1d16fcd34b0a8e94c114ddb80a3b240), [`4696963`](https://github.com/mastra-ai/mastra/commit/469696312ac4c618bc8475b0c5ed7949b8a3455e), [`723aa54`](https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73), [`07f5b4b`](https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99), [`723aa54`](https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73), [`723aa54`](https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73), [`598080f`](https://github.com/mastra-ai/mastra/commit/598080f224edb3f0f5b801035b067fac50a56a03)]:
+  - @mastra/core@1.55.0
+
 ## 0.1.0-alpha.0
 
 ### Minor Changes

package/LICENSE.md

@@ -0,0 +1,30 @@
+Portions of this software are licensed as follows:
+
+- All content that resides under any directory named "ee/" within this
+  repository, including but not limited to:
+  - `packages/core/src/auth/ee/`
+  - `packages/server/src/server/auth/ee/`
+    is licensed under the license defined in `ee/LICENSE`.
+
+- All third-party components incorporated into the Mastra Software are
+  licensed under the original license provided by the owner of the
+  applicable component.
+
+- Content outside of the above-mentioned directories or restrictions is
+  available under the "Apache License 2.0" as defined below.
+
+# Apache License 2.0
+
+Copyright (c) 2025 Kepler Software, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/dist/index.cjs

@@ -0,0 +1,325 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let _mastra_core_tools = require("@mastra/core/tools");
+let esbuild = require("esbuild");
+let isolated_vm = require("isolated-vm");
+isolated_vm = __toESM(isolated_vm, 1);
+//#region src/transport.ts
+/**
+* Code Mode — isolated-vm transport
+*
+* Runs the model's TypeScript program inside an in-process V8 isolate
+* (via `isolated-vm`) instead of a WorkspaceSandbox. The isolate is a real
+* security boundary: the guest has no filesystem, network, process, or module
+* access — the only capabilities are the injected `external_*` functions,
+* which call back into the host dispatcher (allow-list enforced host-side).
+*
+* Unlike the stdio/E2B transports there is no process boundary, so the frame
+* protocol (`FRAME_PREFIX`, stdout parsing, stdin writes) is not used. Host
+* calls cross the isolate boundary as JSON strings in both directions, so no
+* host object references are ever exposed to guest code.
+*
+* TypeScript is stripped on the host with esbuild before evaluation (isolates
+* run plain JavaScript).
+*
+* Requirements:
+* - `isolated-vm` is a native addon (prebuilt binaries for common platforms,
+*   compiled from source elsewhere).
+* - On Node 20+ the host process must be started with `--no-node-snapshot`
+*   (e.g. `node --no-node-snapshot server.js` or
+*   `NODE_OPTIONS=--no-node-snapshot`). The constructor fails fast with an
+*   actionable error when the flag is missing.
+*/
+/** Default isolate heap limit, in MiB. */
+const DEFAULT_MEMORY_LIMIT_MB = 128;
+/**
+* On Node 20+, isolated-vm cannot create isolates unless the host process was
+* started with `--no-node-snapshot` — without it, isolate creation crashes the
+* whole process. Detect the documented mechanisms and fail fast instead.
+*/
+function assertNoNodeSnapshot() {
+	if (Number(process.versions.node.split(".")[0]) < 20) return;
+	if (process.execArgv.includes("--no-node-snapshot")) return;
+	if ((process.env.NODE_OPTIONS ?? "").includes("--no-node-snapshot")) return;
+	throw new Error("IsolatedVmCodeModeTransport requires the --no-node-snapshot flag on Node 20+. Start your process with `node --no-node-snapshot ...` or set NODE_OPTIONS=\"--no-node-snapshot\". Without it, creating a V8 isolate crashes the Node process.");
+}
+/**
+* Code Mode transport that executes programs in an in-process V8 isolate.
+*
+* No sandbox is required — the isolate is the execution boundary
+* (`requiresSandbox: false`).
+*
+* @example
+* ```typescript
+* import { createCodeMode } from '@mastra/core/tools';
+* import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
+*
+* const { tool, instructions } = createCodeMode(
+*   { tools: { getWeather, getForecast } },
+*   new IsolatedVmCodeModeTransport({ memoryLimitMb: 128 }),
+* );
+* ```
+*/
+var IsolatedVmCodeModeTransport = class {
+	requiresSandbox = false;
+	#memoryLimitMb;
+	constructor(options = {}) {
+		assertNoNodeSnapshot();
+		this.#memoryLimitMb = options.memoryLimitMb ?? DEFAULT_MEMORY_LIMIT_MB;
+	}
+	async run(opts) {
+		const { program, toolIds, dispatch, timeout, abortSignal, onExternalCall, onExternalResult } = opts;
+		const externals = toolIds.map((toolId) => ({
+			toolId,
+			externalName: (0, _mastra_core_tools.sanitizeToolId)(toolId)
+		}));
+		const allowList = new Set(toolIds);
+		const logs = [];
+		const notifyCall = (tool, args) => {
+			try {
+				onExternalCall?.(tool, args);
+			} catch {}
+		};
+		const notifyResult = (tool, durationMs, error) => {
+			try {
+				onExternalResult?.(tool, durationMs, error);
+			} catch {}
+		};
+		let strippedProgram;
+		try {
+			strippedProgram = (0, esbuild.transformSync)(`(async () => {\n${program}\n})`, {
+				loader: "ts",
+				target: "es2022"
+			}).code;
+		} catch (error) {
+			return {
+				success: false,
+				logs,
+				error: {
+					message: error?.message ?? String(error),
+					name: "SyntaxError"
+				}
+			};
+		}
+		const rpcHost = async (tool, argsJson) => {
+			const started = Date.now();
+			let args;
+			try {
+				args = JSON.parse(argsJson);
+			} catch {
+				args = void 0;
+			}
+			notifyCall(tool, args);
+			if (!allowList.has(tool)) {
+				notifyResult(tool, Date.now() - started, /* @__PURE__ */ new Error("not allowed"));
+				return JSON.stringify({
+					ok: false,
+					error: {
+						message: `Tool "${tool}" is not available in Code Mode`,
+						name: "NotAllowedError"
+					}
+				});
+			}
+			try {
+				const result = await dispatch(tool, args);
+				const json = JSON.stringify({
+					ok: true,
+					result
+				});
+				notifyResult(tool, Date.now() - started);
+				return json;
+			} catch (error) {
+				const err = error;
+				notifyResult(tool, Date.now() - started, error instanceof Error ? error : new Error(String(error)));
+				return JSON.stringify({
+					ok: false,
+					error: {
+						message: err?.message ?? String(error),
+						name: err?.name
+					}
+				});
+			}
+		};
+		const logHost = (message) => {
+			logs.push(message);
+		};
+		const isolate = new isolated_vm.default.Isolate({ memoryLimit: this.#memoryLimitMb });
+		let disposed = false;
+		const disposeIsolate = () => {
+			if (disposed) return;
+			disposed = true;
+			try {
+				isolate.dispose();
+			} catch {}
+		};
+		let timedOut = false;
+		let timer;
+		const onAbort = () => disposeIsolate();
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+		try {
+			if (abortSignal?.aborted) return {
+				success: false,
+				logs,
+				error: {
+					message: "Code Mode execution aborted",
+					name: "AbortError"
+				}
+			};
+			const context = await isolate.createContext();
+			await context.evalClosure(`
+        const __rpc = (tool, args) => {
+          let argsJson;
+          try { argsJson = JSON.stringify(args === undefined ? null : args); } catch (e) {
+            return Promise.reject(new Error('Arguments passed to an external_* function must be JSON-serializable'));
+          }
+          return $0
+            .apply(undefined, [String(tool), argsJson], { result: { promise: true, copy: true } })
+            .then((json) => {
+              const res = JSON.parse(json);
+              if (res.ok) return res.result;
+              const err = new Error((res.error && res.error.message) || 'external tool failed');
+              if (res.error && res.error.name) err.name = res.error.name;
+              throw err;
+            });
+        };
+        const __safeStringify = (value) => {
+          try { return JSON.stringify(value); } catch { return String(value); }
+        };
+        const __log = (level, args) => {
+          const message = args.map((a) => (typeof a === 'string' ? a : __safeStringify(a))).join(' ');
+          $1.applyIgnored(undefined, [message]);
+        };
+        globalThis.console = Object.freeze({
+          log: (...args) => __log('log', args),
+          info: (...args) => __log('info', args),
+          warn: (...args) => __log('warn', args),
+          error: (...args) => __log('error', args),
+        });
+        for (const { externalName, toolId } of ${JSON.stringify(externals)}) {
+          globalThis['external_' + externalName] = (input) => __rpc(toolId, input);
+        }
+        `, [rpcHost, logHost], { arguments: { reference: true } });
+			const evalSource = `
+        (async () => {
+          const __user = ${strippedProgram}
+          try {
+            const __result = await __user();
+            try {
+              const json = JSON.stringify({ ok: true, value: __result });
+              return json === undefined ? '{"ok":true}' : json;
+            } catch {
+              return JSON.stringify({
+                ok: false,
+                error: { message: 'Code Mode result is not JSON-serializable', name: 'TypeError' },
+              });
+            }
+          } catch (e) {
+            return JSON.stringify({
+              ok: false,
+              error: { message: (e && e.message) || String(e), name: e && e.name },
+            });
+          }
+        })()
+      `;
+			const timeoutPromise = new Promise((resolve) => {
+				timer = setTimeout(() => {
+					timedOut = true;
+					resolve("timeout");
+					disposeIsolate();
+				}, timeout);
+			});
+			const evalPromise = context.eval(evalSource, {
+				promise: true,
+				copy: true,
+				timeout
+			});
+			const outcome = await Promise.race([evalPromise.then((json) => ({
+				kind: "done",
+				json,
+				error: void 0
+			}), (error) => ({
+				kind: "error",
+				json: void 0,
+				error
+			})), timeoutPromise.then(() => ({
+				kind: "timeout",
+				json: void 0,
+				error: void 0
+			}))]);
+			if (outcome.kind === "timeout" || timedOut) return {
+				success: false,
+				logs,
+				error: {
+					message: `Code Mode execution timed out after ${timeout}ms`,
+					name: "TimeoutError"
+				}
+			};
+			if (outcome.kind === "error") {
+				const err = outcome.error;
+				if (abortSignal?.aborted) return {
+					success: false,
+					logs,
+					error: {
+						message: "Code Mode execution aborted",
+						name: "AbortError"
+					}
+				};
+				if (/timed out/i.test(err?.message ?? "")) return {
+					success: false,
+					logs,
+					error: {
+						message: `Code Mode execution timed out after ${timeout}ms`,
+						name: "TimeoutError"
+					}
+				};
+				return {
+					success: false,
+					logs,
+					error: {
+						message: err?.message ?? String(outcome.error),
+						name: err?.name
+					}
+				};
+			}
+			const envelope = JSON.parse(outcome.json);
+			return envelope.ok ? {
+				success: true,
+				result: envelope.value,
+				logs
+			} : {
+				success: false,
+				error: envelope.error,
+				logs
+			};
+		} finally {
+			if (timer) clearTimeout(timer);
+			abortSignal?.removeEventListener("abort", onAbort);
+			disposeIsolate();
+		}
+	}
+};
+//#endregion
+exports.IsolatedVmCodeModeTransport = IsolatedVmCodeModeTransport;
+
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["#memoryLimitMb","err","ivm"],"sources":["../src/transport.ts"],"sourcesContent":["/**\n * Code Mode — isolated-vm transport\n *\n * Runs the model's TypeScript program inside an in-process V8 isolate\n * (via `isolated-vm`) instead of a WorkspaceSandbox. The isolate is a real\n * security boundary: the guest has no filesystem, network, process, or module\n * access — the only capabilities are the injected `external_*` functions,\n * which call back into the host dispatcher (allow-list enforced host-side).\n *\n * Unlike the stdio/E2B transports there is no process boundary, so the frame\n * protocol (`FRAME_PREFIX`, stdout parsing, stdin writes) is not used. Host\n * calls cross the isolate boundary as JSON strings in both directions, so no\n * host object references are ever exposed to guest code.\n *\n * TypeScript is stripped on the host with esbuild before evaluation (isolates\n * run plain JavaScript).\n *\n * Requirements:\n * - `isolated-vm` is a native addon (prebuilt binaries for common platforms,\n *   compiled from source elsewhere).\n * - On Node 20+ the host process must be started with `--no-node-snapshot`\n *   (e.g. `node --no-node-snapshot server.js` or\n *   `NODE_OPTIONS=--no-node-snapshot`). The constructor fails fast with an\n *   actionable error when the flag is missing.\n */\n\nimport { sanitizeToolId } from '@mastra/core/tools';\nimport type { CodeModeToolResult, CodeModeTransport } from '@mastra/core/tools';\nimport { transformSync } from 'esbuild';\nimport ivm from 'isolated-vm';\n\n/** Default isolate heap limit, in MiB. */\nconst DEFAULT_MEMORY_LIMIT_MB = 128;\n\nexport interface IsolatedVmCodeModeTransportOptions {\n  /**\n   * V8 isolate heap limit in MiB. Exceeding it terminates the program.\n   * Default: 128.\n   */\n  memoryLimitMb?: number;\n}\n\n/**\n * On Node 20+, isolated-vm cannot create isolates unless the host process was\n * started with `--no-node-snapshot` — without it, isolate creation crashes the\n * whole process. Detect the documented mechanisms and fail fast instead.\n */\nfunction assertNoNodeSnapshot(): void {\n  const major = Number(process.versions.node.split('.')[0]);\n  if (major < 20) return;\n  if (process.execArgv.includes('--no-node-snapshot')) return;\n  if ((process.env.NODE_OPTIONS ?? '').includes('--no-node-snapshot')) return;\n  throw new Error(\n    'IsolatedVmCodeModeTransport requires the --no-node-snapshot flag on Node 20+. ' +\n      'Start your process with `node --no-node-snapshot ...` or set NODE_OPTIONS=\"--no-node-snapshot\". ' +\n      'Without it, creating a V8 isolate crashes the Node process.',\n  );\n}\n\n/** Envelope returned by the guest program eval (as a JSON string). */\ninterface GuestResultEnvelope {\n  ok: boolean;\n  value?: unknown;\n  error?: { message: string; name?: string };\n}\n\n/** Envelope returned by the host RPC handler (as a JSON string). */\ninterface HostRpcEnvelope {\n  ok: boolean;\n  result?: unknown;\n  error?: { message: string; name?: string };\n}\n\n/**\n * Code Mode transport that executes programs in an in-process V8 isolate.\n *\n * No sandbox is required — the isolate is the execution boundary\n * (`requiresSandbox: false`).\n *\n * @example\n * ```typescript\n * import { createCodeMode } from '@mastra/core/tools';\n * import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';\n *\n * const { tool, instructions } = createCodeMode(\n *   { tools: { getWeather, getForecast } },\n *   new IsolatedVmCodeModeTransport({ memoryLimitMb: 128 }),\n * );\n * ```\n */\nexport class IsolatedVmCodeModeTransport implements CodeModeTransport {\n  readonly requiresSandbox = false;\n\n  readonly #memoryLimitMb: number;\n\n  constructor(options: IsolatedVmCodeModeTransportOptions = {}) {\n    assertNoNodeSnapshot();\n    this.#memoryLimitMb = options.memoryLimitMb ?? DEFAULT_MEMORY_LIMIT_MB;\n  }\n\n  async run(opts: Parameters<CodeModeTransport['run']>[0]): Promise<CodeModeToolResult> {\n    const { program, toolIds, dispatch, timeout, abortSignal, onExternalCall, onExternalResult } = opts;\n\n    const externals = toolIds.map(toolId => ({ toolId, externalName: sanitizeToolId(toolId) }));\n    const allowList = new Set(toolIds);\n    const logs: string[] = [];\n\n    // Observer hooks are caller-supplied and best-effort: a throwing hook must\n    // never prevent the RPC from responding, or the matching in-isolate promise\n    // would hang until the timeout.\n    const notifyCall = (tool: string, args: unknown): void => {\n      try {\n        onExternalCall?.(tool, args);\n      } catch {\n        /* observer errors are non-fatal */\n      }\n    };\n    const notifyResult = (tool: string, durationMs: number, error?: Error): void => {\n      try {\n        onExternalResult?.(tool, durationMs, error);\n      } catch {\n        /* observer errors are non-fatal */\n      }\n    };\n\n    // Strip TypeScript on the host; the isolate runs plain JavaScript. Wrapping\n    // in an async arrow makes top-level `return`/`await`/`const` legal, same as\n    // the core runner's program module.\n    let strippedProgram: string;\n    try {\n      strippedProgram = transformSync(`(async () => {\\n${program}\\n})`, { loader: 'ts', target: 'es2022' }).code;\n    } catch (error) {\n      const err = error as { message?: string };\n      return {\n        success: false,\n        logs,\n        error: { message: err?.message ?? String(error), name: 'SyntaxError' },\n      };\n    }\n\n    // Host-side RPC handler. Crosses the boundary as JSON strings in both\n    // directions so no host references or non-JSON values ever leak into the\n    // guest. Errors are returned in the envelope (never thrown) so the guest\n    // can rebuild them with the original error name.\n    const rpcHost = async (tool: string, argsJson: string): Promise<string> => {\n      const started = Date.now();\n      let args: unknown;\n      try {\n        args = JSON.parse(argsJson);\n      } catch {\n        args = undefined;\n      }\n      notifyCall(tool, args);\n      // Allow-list enforcement: never invoke a tool that wasn't exposed.\n      if (!allowList.has(tool)) {\n        notifyResult(tool, Date.now() - started, new Error('not allowed'));\n        return JSON.stringify({\n          ok: false,\n          error: { message: `Tool \"${tool}\" is not available in Code Mode`, name: 'NotAllowedError' },\n        } satisfies HostRpcEnvelope);\n      }\n      try {\n        const result = await dispatch(tool, args);\n        // Serialize before reporting success so a non-serializable result\n        // (circular reference, BigInt) falls through to the error path without\n        // emitting a success event first.\n        const json = JSON.stringify({ ok: true, result } satisfies HostRpcEnvelope);\n        notifyResult(tool, Date.now() - started);\n        return json;\n      } catch (error) {\n        const err = error as { message?: string; name?: string };\n        notifyResult(tool, Date.now() - started, error instanceof Error ? error : new Error(String(error)));\n        return JSON.stringify({\n          ok: false,\n          error: { message: err?.message ?? String(error), name: err?.name },\n        } satisfies HostRpcEnvelope);\n      }\n    };\n\n    const logHost = (message: string): void => {\n      logs.push(message);\n    };\n\n    const isolate = new ivm.Isolate({ memoryLimit: this.#memoryLimitMb });\n    let disposed = false;\n    const disposeIsolate = (): void => {\n      if (disposed) return;\n      disposed = true;\n      try {\n        isolate.dispose();\n      } catch {\n        /* already disposed */\n      }\n    };\n\n    let timedOut = false;\n    let timer: NodeJS.Timeout | undefined;\n    const onAbort = (): void => disposeIsolate();\n    abortSignal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      if (abortSignal?.aborted) {\n        return { success: false, logs, error: { message: 'Code Mode execution aborted', name: 'AbortError' } };\n      }\n\n      const context = await isolate.createContext();\n\n      // Bootstrap: console capture, the RPC bridge, and the `external_*`\n      // globals. `$0`/`$1` are References to the host functions; they stay in\n      // this closure's scope and are never attached to guest-reachable\n      // objects — guest code only sees plain functions that close over them.\n      await context.evalClosure(\n        `\n        const __rpc = (tool, args) => {\n          let argsJson;\n          try { argsJson = JSON.stringify(args === undefined ? null : args); } catch (e) {\n            return Promise.reject(new Error('Arguments passed to an external_* function must be JSON-serializable'));\n          }\n          return $0\n            .apply(undefined, [String(tool), argsJson], { result: { promise: true, copy: true } })\n            .then((json) => {\n              const res = JSON.parse(json);\n              if (res.ok) return res.result;\n              const err = new Error((res.error && res.error.message) || 'external tool failed');\n              if (res.error && res.error.name) err.name = res.error.name;\n              throw err;\n            });\n        };\n        const __safeStringify = (value) => {\n          try { return JSON.stringify(value); } catch { return String(value); }\n        };\n        const __log = (level, args) => {\n          const message = args.map((a) => (typeof a === 'string' ? a : __safeStringify(a))).join(' ');\n          $1.applyIgnored(undefined, [message]);\n        };\n        globalThis.console = Object.freeze({\n          log: (...args) => __log('log', args),\n          info: (...args) => __log('info', args),\n          warn: (...args) => __log('warn', args),\n          error: (...args) => __log('error', args),\n        });\n        for (const { externalName, toolId } of ${JSON.stringify(externals)}) {\n          globalThis['external_' + externalName] = (input) => __rpc(toolId, input);\n        }\n        `,\n        [rpcHost, logHost],\n        { arguments: { reference: true } },\n      );\n\n      // The guest returns a JSON envelope string so results and errors cross\n      // the boundary as data, mirroring the frame protocol's JSON semantics.\n      const evalSource = `\n        (async () => {\n          const __user = ${strippedProgram}\n          try {\n            const __result = await __user();\n            try {\n              const json = JSON.stringify({ ok: true, value: __result });\n              return json === undefined ? '{\"ok\":true}' : json;\n            } catch {\n              return JSON.stringify({\n                ok: false,\n                error: { message: 'Code Mode result is not JSON-serializable', name: 'TypeError' },\n              });\n            }\n          } catch (e) {\n            return JSON.stringify({\n              ok: false,\n              error: { message: (e && e.message) || String(e), name: e && e.name },\n            });\n          }\n        })()\n      `;\n\n      // Two timeout layers: the eval `timeout` interrupts runaway synchronous\n      // code; the host timer covers time spent awaiting (RPC round trips,\n      // guest promises) by disposing the isolate, which rejects the eval.\n      const timeoutPromise = new Promise<'timeout'>(resolve => {\n        timer = setTimeout(() => {\n          timedOut = true;\n          resolve('timeout');\n          disposeIsolate();\n        }, timeout);\n      });\n\n      // isolated-vm types this as a nested promise; `await` flattens it and\n      // `copy: true` guarantees the resolved value is the guest's JSON string.\n      const evalPromise = context.eval(evalSource, {\n        promise: true,\n        copy: true,\n        timeout,\n      }) as unknown as Promise<string>;\n\n      const outcome = await Promise.race([\n        evalPromise.then(\n          json => ({ kind: 'done' as const, json, error: undefined }),\n          error => ({ kind: 'error' as const, json: undefined, error }),\n        ),\n        timeoutPromise.then(() => ({ kind: 'timeout' as const, json: undefined, error: undefined })),\n      ]);\n\n      if (outcome.kind === 'timeout' || timedOut) {\n        return {\n          success: false,\n          logs,\n          error: { message: `Code Mode execution timed out after ${timeout}ms`, name: 'TimeoutError' },\n        };\n      }\n\n      if (outcome.kind === 'error') {\n        const err = outcome.error as { message?: string; name?: string };\n        if (abortSignal?.aborted) {\n          return { success: false, logs, error: { message: 'Code Mode execution aborted', name: 'AbortError' } };\n        }\n        // The eval `timeout` option rejects with \"Script execution timed out\".\n        if (/timed out/i.test(err?.message ?? '')) {\n          return {\n            success: false,\n            logs,\n            error: { message: `Code Mode execution timed out after ${timeout}ms`, name: 'TimeoutError' },\n          };\n        }\n        return {\n          success: false,\n          logs,\n          error: { message: err?.message ?? String(outcome.error), name: err?.name },\n        };\n      }\n\n      const envelope = JSON.parse(outcome.json) as GuestResultEnvelope;\n      return envelope.ok\n        ? { success: true, result: envelope.value, logs }\n        : { success: false, error: envelope.error, logs };\n    } finally {\n      if (timer) clearTimeout(timer);\n      abortSignal?.removeEventListener('abort', onAbort);\n      disposeIsolate();\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,0BAA0B;;;;;;AAehC,SAAS,uBAA6B;CAEpC,IADc,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,EAC9C,IAAI,IAAI;CAChB,IAAI,QAAQ,SAAS,SAAS,oBAAoB,GAAG;CACrD,KAAK,QAAQ,IAAI,gBAAgB,GAAA,CAAI,SAAS,oBAAoB,GAAG;CACrE,MAAM,IAAI,MACR,6OAGF;AACF;;;;;;;;;;;;;;;;;;AAiCA,IAAa,8BAAb,MAAsE;CACpE,kBAA2B;CAE3B;CAEA,YAAY,UAA8C,CAAC,GAAG;EAC5D,qBAAqB;EACrB,KAAKA,iBAAiB,QAAQ,iBAAiB;CACjD;CAEA,MAAM,IAAI,MAA4E;EACpF,MAAM,EAAE,SAAS,SAAS,UAAU,SAAS,aAAa,gBAAgB,qBAAqB;EAE/F,MAAM,YAAY,QAAQ,KAAI,YAAW;GAAE;GAAQ,eAAA,GAAA,mBAAA,eAAA,CAA6B,MAAM;EAAE,EAAE;EAC1F,MAAM,YAAY,IAAI,IAAI,OAAO;EACjC,MAAM,OAAiB,CAAC;EAKxB,MAAM,cAAc,MAAc,SAAwB;GACxD,IAAI;IACF,iBAAiB,MAAM,IAAI;GAC7B,QAAQ,CAER;EACF;EACA,MAAM,gBAAgB,MAAc,YAAoB,UAAwB;GAC9E,IAAI;IACF,mBAAmB,MAAM,YAAY,KAAK;GAC5C,QAAQ,CAER;EACF;EAKA,IAAI;EACJ,IAAI;GACF,mBAAA,GAAA,QAAA,cAAA,CAAgC,mBAAmB,QAAQ,OAAO;IAAE,QAAQ;IAAM,QAAQ;GAAS,CAAC,CAAC,CAAC;EACxG,SAAS,OAAO;GAEd,OAAO;IACL,SAAS;IACT;IACA,OAAO;KAAE,SAASC,OAAK,WAAW,OAAO,KAAK;KAAG,MAAM;IAAc;GACvE;EACF;EAMA,MAAM,UAAU,OAAO,MAAc,aAAsC;GACzE,MAAM,UAAU,KAAK,IAAI;GACzB,IAAI;GACJ,IAAI;IACF,OAAO,KAAK,MAAM,QAAQ;GAC5B,QAAQ;IACN,OAAO,KAAA;GACT;GACA,WAAW,MAAM,IAAI;GAErB,IAAI,CAAC,UAAU,IAAI,IAAI,GAAG;IACxB,aAAa,MAAM,KAAK,IAAI,IAAI,yBAAS,IAAI,MAAM,aAAa,CAAC;IACjE,OAAO,KAAK,UAAU;KACpB,IAAI;KACJ,OAAO;MAAE,SAAS,SAAS,KAAK;MAAkC,MAAM;KAAkB;IAC5F,CAA2B;GAC7B;GACA,IAAI;IACF,MAAM,SAAS,MAAM,SAAS,MAAM,IAAI;IAIxC,MAAM,OAAO,KAAK,UAAU;KAAE,IAAI;KAAM;IAAO,CAA2B;IAC1E,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO;IACvC,OAAO;GACT,SAAS,OAAO;IACd,MAAM,MAAM;IACZ,aAAa,MAAM,KAAK,IAAI,IAAI,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;IAClG,OAAO,KAAK,UAAU;KACpB,IAAI;KACJ,OAAO;MAAE,SAAS,KAAK,WAAW,OAAO,KAAK;MAAG,MAAM,KAAK;KAAK;IACnE,CAA2B;GAC7B;EACF;EAEA,MAAM,WAAW,YAA0B;GACzC,KAAK,KAAK,OAAO;EACnB;EAEA,MAAM,UAAU,IAAIC,YAAAA,QAAI,QAAQ,EAAE,aAAa,KAAKF,eAAe,CAAC;EACpE,IAAI,WAAW;EACf,MAAM,uBAA6B;GACjC,IAAI,UAAU;GACd,WAAW;GACX,IAAI;IACF,QAAQ,QAAQ;GAClB,QAAQ,CAER;EACF;EAEA,IAAI,WAAW;EACf,IAAI;EACJ,MAAM,gBAAsB,eAAe;EAC3C,aAAa,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAE9D,IAAI;GACF,IAAI,aAAa,SACf,OAAO;IAAE,SAAS;IAAO;IAAM,OAAO;KAAE,SAAS;KAA+B,MAAM;IAAa;GAAE;GAGvG,MAAM,UAAU,MAAM,QAAQ,cAAc;GAM5C,MAAM,QAAQ,YACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iDA6ByC,KAAK,UAAU,SAAS,EAAE;;;WAInE,CAAC,SAAS,OAAO,GACjB,EAAE,WAAW,EAAE,WAAW,KAAK,EAAE,CACnC;GAIA,MAAM,aAAa;;2BAEE,gBAAgB;;;;;;;;;;;;;;;;;;;;GAwBrC,MAAM,iBAAiB,IAAI,SAAmB,YAAW;IACvD,QAAQ,iBAAiB;KACvB,WAAW;KACX,QAAQ,SAAS;KACjB,eAAe;IACjB,GAAG,OAAO;GACZ,CAAC;GAID,MAAM,cAAc,QAAQ,KAAK,YAAY;IAC3C,SAAS;IACT,MAAM;IACN;GACF,CAAC;GAED,MAAM,UAAU,MAAM,QAAQ,KAAK,CACjC,YAAY,MACV,UAAS;IAAE,MAAM;IAAiB;IAAM,OAAO,KAAA;GAAU,KACzD,WAAU;IAAE,MAAM;IAAkB,MAAM,KAAA;IAAW;GAAM,EAC7D,GACA,eAAe,YAAY;IAAE,MAAM;IAAoB,MAAM,KAAA;IAAW,OAAO,KAAA;GAAU,EAAE,CAC7F,CAAC;GAED,IAAI,QAAQ,SAAS,aAAa,UAChC,OAAO;IACL,SAAS;IACT;IACA,OAAO;KAAE,SAAS,uCAAuC,QAAQ;KAAK,MAAM;IAAe;GAC7F;GAGF,IAAI,QAAQ,SAAS,SAAS;IAC5B,MAAM,MAAM,QAAQ;IACpB,IAAI,aAAa,SACf,OAAO;KAAE,SAAS;KAAO;KAAM,OAAO;MAAE,SAAS;MAA+B,MAAM;KAAa;IAAE;IAGvG,IAAI,aAAa,KAAK,KAAK,WAAW,EAAE,GACtC,OAAO;KACL,SAAS;KACT;KACA,OAAO;MAAE,SAAS,uCAAuC,QAAQ;MAAK,MAAM;KAAe;IAC7F;IAEF,OAAO;KACL,SAAS;KACT;KACA,OAAO;MAAE,SAAS,KAAK,WAAW,OAAO,QAAQ,KAAK;MAAG,MAAM,KAAK;KAAK;IAC3E;GACF;GAEA,MAAM,WAAW,KAAK,MAAM,QAAQ,IAAI;GACxC,OAAO,SAAS,KACZ;IAAE,SAAS;IAAM,QAAQ,SAAS;IAAO;GAAK,IAC9C;IAAE,SAAS;IAAO,OAAO,SAAS;IAAO;GAAK;EACpD,UAAU;GACR,IAAI,OAAO,aAAa,KAAK;GAC7B,aAAa,oBAAoB,SAAS,OAAO;GACjD,eAAe;EACjB;CACF;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { IsolatedVmCodeModeTransport, type IsolatedVmCodeModeTransportOptions } from './transport.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,KAAK,kCAAkC,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,301 @@
+import { sanitizeToolId } from "@mastra/core/tools";
+import { transformSync } from "esbuild";
+import ivm from "isolated-vm";
+//#region src/transport.ts
+/**
+* Code Mode — isolated-vm transport
+*
+* Runs the model's TypeScript program inside an in-process V8 isolate
+* (via `isolated-vm`) instead of a WorkspaceSandbox. The isolate is a real
+* security boundary: the guest has no filesystem, network, process, or module
+* access — the only capabilities are the injected `external_*` functions,
+* which call back into the host dispatcher (allow-list enforced host-side).
+*
+* Unlike the stdio/E2B transports there is no process boundary, so the frame
+* protocol (`FRAME_PREFIX`, stdout parsing, stdin writes) is not used. Host
+* calls cross the isolate boundary as JSON strings in both directions, so no
+* host object references are ever exposed to guest code.
+*
+* TypeScript is stripped on the host with esbuild before evaluation (isolates
+* run plain JavaScript).
+*
+* Requirements:
+* - `isolated-vm` is a native addon (prebuilt binaries for common platforms,
+*   compiled from source elsewhere).
+* - On Node 20+ the host process must be started with `--no-node-snapshot`
+*   (e.g. `node --no-node-snapshot server.js` or
+*   `NODE_OPTIONS=--no-node-snapshot`). The constructor fails fast with an
+*   actionable error when the flag is missing.
+*/
+/** Default isolate heap limit, in MiB. */
+const DEFAULT_MEMORY_LIMIT_MB = 128;
+/**
+* On Node 20+, isolated-vm cannot create isolates unless the host process was
+* started with `--no-node-snapshot` — without it, isolate creation crashes the
+* whole process. Detect the documented mechanisms and fail fast instead.
+*/
+function assertNoNodeSnapshot() {
+	if (Number(process.versions.node.split(".")[0]) < 20) return;
+	if (process.execArgv.includes("--no-node-snapshot")) return;
+	if ((process.env.NODE_OPTIONS ?? "").includes("--no-node-snapshot")) return;
+	throw new Error("IsolatedVmCodeModeTransport requires the --no-node-snapshot flag on Node 20+. Start your process with `node --no-node-snapshot ...` or set NODE_OPTIONS=\"--no-node-snapshot\". Without it, creating a V8 isolate crashes the Node process.");
+}
+/**
+* Code Mode transport that executes programs in an in-process V8 isolate.
+*
+* No sandbox is required — the isolate is the execution boundary
+* (`requiresSandbox: false`).
+*
+* @example
+* ```typescript
+* import { createCodeMode } from '@mastra/core/tools';
+* import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
+*
+* const { tool, instructions } = createCodeMode(
+*   { tools: { getWeather, getForecast } },
+*   new IsolatedVmCodeModeTransport({ memoryLimitMb: 128 }),
+* );
+* ```
+*/
+var IsolatedVmCodeModeTransport = class {
+	requiresSandbox = false;
+	#memoryLimitMb;
+	constructor(options = {}) {
+		assertNoNodeSnapshot();
+		this.#memoryLimitMb = options.memoryLimitMb ?? DEFAULT_MEMORY_LIMIT_MB;
+	}
+	async run(opts) {
+		const { program, toolIds, dispatch, timeout, abortSignal, onExternalCall, onExternalResult } = opts;
+		const externals = toolIds.map((toolId) => ({
+			toolId,
+			externalName: sanitizeToolId(toolId)
+		}));
+		const allowList = new Set(toolIds);
+		const logs = [];
+		const notifyCall = (tool, args) => {
+			try {
+				onExternalCall?.(tool, args);
+			} catch {}
+		};
+		const notifyResult = (tool, durationMs, error) => {
+			try {
+				onExternalResult?.(tool, durationMs, error);
+			} catch {}
+		};
+		let strippedProgram;
+		try {
+			strippedProgram = transformSync(`(async () => {\n${program}\n})`, {
+				loader: "ts",
+				target: "es2022"
+			}).code;
+		} catch (error) {
+			return {
+				success: false,
+				logs,
+				error: {
+					message: error?.message ?? String(error),
+					name: "SyntaxError"
+				}
+			};
+		}
+		const rpcHost = async (tool, argsJson) => {
+			const started = Date.now();
+			let args;
+			try {
+				args = JSON.parse(argsJson);
+			} catch {
+				args = void 0;
+			}
+			notifyCall(tool, args);
+			if (!allowList.has(tool)) {
+				notifyResult(tool, Date.now() - started, /* @__PURE__ */ new Error("not allowed"));
+				return JSON.stringify({
+					ok: false,
+					error: {
+						message: `Tool "${tool}" is not available in Code Mode`,
+						name: "NotAllowedError"
+					}
+				});
+			}
+			try {
+				const result = await dispatch(tool, args);
+				const json = JSON.stringify({
+					ok: true,
+					result
+				});
+				notifyResult(tool, Date.now() - started);
+				return json;
+			} catch (error) {
+				const err = error;
+				notifyResult(tool, Date.now() - started, error instanceof Error ? error : new Error(String(error)));
+				return JSON.stringify({
+					ok: false,
+					error: {
+						message: err?.message ?? String(error),
+						name: err?.name
+					}
+				});
+			}
+		};
+		const logHost = (message) => {
+			logs.push(message);
+		};
+		const isolate = new ivm.Isolate({ memoryLimit: this.#memoryLimitMb });
+		let disposed = false;
+		const disposeIsolate = () => {
+			if (disposed) return;
+			disposed = true;
+			try {
+				isolate.dispose();
+			} catch {}
+		};
+		let timedOut = false;
+		let timer;
+		const onAbort = () => disposeIsolate();
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+		try {
+			if (abortSignal?.aborted) return {
+				success: false,
+				logs,
+				error: {
+					message: "Code Mode execution aborted",
+					name: "AbortError"
+				}
+			};
+			const context = await isolate.createContext();
+			await context.evalClosure(`
+        const __rpc = (tool, args) => {
+          let argsJson;
+          try { argsJson = JSON.stringify(args === undefined ? null : args); } catch (e) {
+            return Promise.reject(new Error('Arguments passed to an external_* function must be JSON-serializable'));
+          }
+          return $0
+            .apply(undefined, [String(tool), argsJson], { result: { promise: true, copy: true } })
+            .then((json) => {
+              const res = JSON.parse(json);
+              if (res.ok) return res.result;
+              const err = new Error((res.error && res.error.message) || 'external tool failed');
+              if (res.error && res.error.name) err.name = res.error.name;
+              throw err;
+            });
+        };
+        const __safeStringify = (value) => {
+          try { return JSON.stringify(value); } catch { return String(value); }
+        };
+        const __log = (level, args) => {
+          const message = args.map((a) => (typeof a === 'string' ? a : __safeStringify(a))).join(' ');
+          $1.applyIgnored(undefined, [message]);
+        };
+        globalThis.console = Object.freeze({
+          log: (...args) => __log('log', args),
+          info: (...args) => __log('info', args),
+          warn: (...args) => __log('warn', args),
+          error: (...args) => __log('error', args),
+        });
+        for (const { externalName, toolId } of ${JSON.stringify(externals)}) {
+          globalThis['external_' + externalName] = (input) => __rpc(toolId, input);
+        }
+        `, [rpcHost, logHost], { arguments: { reference: true } });
+			const evalSource = `
+        (async () => {
+          const __user = ${strippedProgram}
+          try {
+            const __result = await __user();
+            try {
+              const json = JSON.stringify({ ok: true, value: __result });
+              return json === undefined ? '{"ok":true}' : json;
+            } catch {
+              return JSON.stringify({
+                ok: false,
+                error: { message: 'Code Mode result is not JSON-serializable', name: 'TypeError' },
+              });
+            }
+          } catch (e) {
+            return JSON.stringify({
+              ok: false,
+              error: { message: (e && e.message) || String(e), name: e && e.name },
+            });
+          }
+        })()
+      `;
+			const timeoutPromise = new Promise((resolve) => {
+				timer = setTimeout(() => {
+					timedOut = true;
+					resolve("timeout");
+					disposeIsolate();
+				}, timeout);
+			});
+			const evalPromise = context.eval(evalSource, {
+				promise: true,
+				copy: true,
+				timeout
+			});
+			const outcome = await Promise.race([evalPromise.then((json) => ({
+				kind: "done",
+				json,
+				error: void 0
+			}), (error) => ({
+				kind: "error",
+				json: void 0,
+				error
+			})), timeoutPromise.then(() => ({
+				kind: "timeout",
+				json: void 0,
+				error: void 0
+			}))]);
+			if (outcome.kind === "timeout" || timedOut) return {
+				success: false,
+				logs,
+				error: {
+					message: `Code Mode execution timed out after ${timeout}ms`,
+					name: "TimeoutError"
+				}
+			};
+			if (outcome.kind === "error") {
+				const err = outcome.error;
+				if (abortSignal?.aborted) return {
+					success: false,
+					logs,
+					error: {
+						message: "Code Mode execution aborted",
+						name: "AbortError"
+					}
+				};
+				if (/timed out/i.test(err?.message ?? "")) return {
+					success: false,
+					logs,
+					error: {
+						message: `Code Mode execution timed out after ${timeout}ms`,
+						name: "TimeoutError"
+					}
+				};
+				return {
+					success: false,
+					logs,
+					error: {
+						message: err?.message ?? String(outcome.error),
+						name: err?.name
+					}
+				};
+			}
+			const envelope = JSON.parse(outcome.json);
+			return envelope.ok ? {
+				success: true,
+				result: envelope.value,
+				logs
+			} : {
+				success: false,
+				error: envelope.error,
+				logs
+			};
+		} finally {
+			if (timer) clearTimeout(timer);
+			abortSignal?.removeEventListener("abort", onAbort);
+			disposeIsolate();
+		}
+	}
+};
+//#endregion
+export { IsolatedVmCodeModeTransport };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["#memoryLimitMb","err"],"sources":["../src/transport.ts"],"sourcesContent":["/**\n * Code Mode — isolated-vm transport\n *\n * Runs the model's TypeScript program inside an in-process V8 isolate\n * (via `isolated-vm`) instead of a WorkspaceSandbox. The isolate is a real\n * security boundary: the guest has no filesystem, network, process, or module\n * access — the only capabilities are the injected `external_*` functions,\n * which call back into the host dispatcher (allow-list enforced host-side).\n *\n * Unlike the stdio/E2B transports there is no process boundary, so the frame\n * protocol (`FRAME_PREFIX`, stdout parsing, stdin writes) is not used. Host\n * calls cross the isolate boundary as JSON strings in both directions, so no\n * host object references are ever exposed to guest code.\n *\n * TypeScript is stripped on the host with esbuild before evaluation (isolates\n * run plain JavaScript).\n *\n * Requirements:\n * - `isolated-vm` is a native addon (prebuilt binaries for common platforms,\n *   compiled from source elsewhere).\n * - On Node 20+ the host process must be started with `--no-node-snapshot`\n *   (e.g. `node --no-node-snapshot server.js` or\n *   `NODE_OPTIONS=--no-node-snapshot`). The constructor fails fast with an\n *   actionable error when the flag is missing.\n */\n\nimport { sanitizeToolId } from '@mastra/core/tools';\nimport type { CodeModeToolResult, CodeModeTransport } from '@mastra/core/tools';\nimport { transformSync } from 'esbuild';\nimport ivm from 'isolated-vm';\n\n/** Default isolate heap limit, in MiB. */\nconst DEFAULT_MEMORY_LIMIT_MB = 128;\n\nexport interface IsolatedVmCodeModeTransportOptions {\n  /**\n   * V8 isolate heap limit in MiB. Exceeding it terminates the program.\n   * Default: 128.\n   */\n  memoryLimitMb?: number;\n}\n\n/**\n * On Node 20+, isolated-vm cannot create isolates unless the host process was\n * started with `--no-node-snapshot` — without it, isolate creation crashes the\n * whole process. Detect the documented mechanisms and fail fast instead.\n */\nfunction assertNoNodeSnapshot(): void {\n  const major = Number(process.versions.node.split('.')[0]);\n  if (major < 20) return;\n  if (process.execArgv.includes('--no-node-snapshot')) return;\n  if ((process.env.NODE_OPTIONS ?? '').includes('--no-node-snapshot')) return;\n  throw new Error(\n    'IsolatedVmCodeModeTransport requires the --no-node-snapshot flag on Node 20+. ' +\n      'Start your process with `node --no-node-snapshot ...` or set NODE_OPTIONS=\"--no-node-snapshot\". ' +\n      'Without it, creating a V8 isolate crashes the Node process.',\n  );\n}\n\n/** Envelope returned by the guest program eval (as a JSON string). */\ninterface GuestResultEnvelope {\n  ok: boolean;\n  value?: unknown;\n  error?: { message: string; name?: string };\n}\n\n/** Envelope returned by the host RPC handler (as a JSON string). */\ninterface HostRpcEnvelope {\n  ok: boolean;\n  result?: unknown;\n  error?: { message: string; name?: string };\n}\n\n/**\n * Code Mode transport that executes programs in an in-process V8 isolate.\n *\n * No sandbox is required — the isolate is the execution boundary\n * (`requiresSandbox: false`).\n *\n * @example\n * ```typescript\n * import { createCodeMode } from '@mastra/core/tools';\n * import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';\n *\n * const { tool, instructions } = createCodeMode(\n *   { tools: { getWeather, getForecast } },\n *   new IsolatedVmCodeModeTransport({ memoryLimitMb: 128 }),\n * );\n * ```\n */\nexport class IsolatedVmCodeModeTransport implements CodeModeTransport {\n  readonly requiresSandbox = false;\n\n  readonly #memoryLimitMb: number;\n\n  constructor(options: IsolatedVmCodeModeTransportOptions = {}) {\n    assertNoNodeSnapshot();\n    this.#memoryLimitMb = options.memoryLimitMb ?? DEFAULT_MEMORY_LIMIT_MB;\n  }\n\n  async run(opts: Parameters<CodeModeTransport['run']>[0]): Promise<CodeModeToolResult> {\n    const { program, toolIds, dispatch, timeout, abortSignal, onExternalCall, onExternalResult } = opts;\n\n    const externals = toolIds.map(toolId => ({ toolId, externalName: sanitizeToolId(toolId) }));\n    const allowList = new Set(toolIds);\n    const logs: string[] = [];\n\n    // Observer hooks are caller-supplied and best-effort: a throwing hook must\n    // never prevent the RPC from responding, or the matching in-isolate promise\n    // would hang until the timeout.\n    const notifyCall = (tool: string, args: unknown): void => {\n      try {\n        onExternalCall?.(tool, args);\n      } catch {\n        /* observer errors are non-fatal */\n      }\n    };\n    const notifyResult = (tool: string, durationMs: number, error?: Error): void => {\n      try {\n        onExternalResult?.(tool, durationMs, error);\n      } catch {\n        /* observer errors are non-fatal */\n      }\n    };\n\n    // Strip TypeScript on the host; the isolate runs plain JavaScript. Wrapping\n    // in an async arrow makes top-level `return`/`await`/`const` legal, same as\n    // the core runner's program module.\n    let strippedProgram: string;\n    try {\n      strippedProgram = transformSync(`(async () => {\\n${program}\\n})`, { loader: 'ts', target: 'es2022' }).code;\n    } catch (error) {\n      const err = error as { message?: string };\n      return {\n        success: false,\n        logs,\n        error: { message: err?.message ?? String(error), name: 'SyntaxError' },\n      };\n    }\n\n    // Host-side RPC handler. Crosses the boundary as JSON strings in both\n    // directions so no host references or non-JSON values ever leak into the\n    // guest. Errors are returned in the envelope (never thrown) so the guest\n    // can rebuild them with the original error name.\n    const rpcHost = async (tool: string, argsJson: string): Promise<string> => {\n      const started = Date.now();\n      let args: unknown;\n      try {\n        args = JSON.parse(argsJson);\n      } catch {\n        args = undefined;\n      }\n      notifyCall(tool, args);\n      // Allow-list enforcement: never invoke a tool that wasn't exposed.\n      if (!allowList.has(tool)) {\n        notifyResult(tool, Date.now() - started, new Error('not allowed'));\n        return JSON.stringify({\n          ok: false,\n          error: { message: `Tool \"${tool}\" is not available in Code Mode`, name: 'NotAllowedError' },\n        } satisfies HostRpcEnvelope);\n      }\n      try {\n        const result = await dispatch(tool, args);\n        // Serialize before reporting success so a non-serializable result\n        // (circular reference, BigInt) falls through to the error path without\n        // emitting a success event first.\n        const json = JSON.stringify({ ok: true, result } satisfies HostRpcEnvelope);\n        notifyResult(tool, Date.now() - started);\n        return json;\n      } catch (error) {\n        const err = error as { message?: string; name?: string };\n        notifyResult(tool, Date.now() - started, error instanceof Error ? error : new Error(String(error)));\n        return JSON.stringify({\n          ok: false,\n          error: { message: err?.message ?? String(error), name: err?.name },\n        } satisfies HostRpcEnvelope);\n      }\n    };\n\n    const logHost = (message: string): void => {\n      logs.push(message);\n    };\n\n    const isolate = new ivm.Isolate({ memoryLimit: this.#memoryLimitMb });\n    let disposed = false;\n    const disposeIsolate = (): void => {\n      if (disposed) return;\n      disposed = true;\n      try {\n        isolate.dispose();\n      } catch {\n        /* already disposed */\n      }\n    };\n\n    let timedOut = false;\n    let timer: NodeJS.Timeout | undefined;\n    const onAbort = (): void => disposeIsolate();\n    abortSignal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      if (abortSignal?.aborted) {\n        return { success: false, logs, error: { message: 'Code Mode execution aborted', name: 'AbortError' } };\n      }\n\n      const context = await isolate.createContext();\n\n      // Bootstrap: console capture, the RPC bridge, and the `external_*`\n      // globals. `$0`/`$1` are References to the host functions; they stay in\n      // this closure's scope and are never attached to guest-reachable\n      // objects — guest code only sees plain functions that close over them.\n      await context.evalClosure(\n        `\n        const __rpc = (tool, args) => {\n          let argsJson;\n          try { argsJson = JSON.stringify(args === undefined ? null : args); } catch (e) {\n            return Promise.reject(new Error('Arguments passed to an external_* function must be JSON-serializable'));\n          }\n          return $0\n            .apply(undefined, [String(tool), argsJson], { result: { promise: true, copy: true } })\n            .then((json) => {\n              const res = JSON.parse(json);\n              if (res.ok) return res.result;\n              const err = new Error((res.error && res.error.message) || 'external tool failed');\n              if (res.error && res.error.name) err.name = res.error.name;\n              throw err;\n            });\n        };\n        const __safeStringify = (value) => {\n          try { return JSON.stringify(value); } catch { return String(value); }\n        };\n        const __log = (level, args) => {\n          const message = args.map((a) => (typeof a === 'string' ? a : __safeStringify(a))).join(' ');\n          $1.applyIgnored(undefined, [message]);\n        };\n        globalThis.console = Object.freeze({\n          log: (...args) => __log('log', args),\n          info: (...args) => __log('info', args),\n          warn: (...args) => __log('warn', args),\n          error: (...args) => __log('error', args),\n        });\n        for (const { externalName, toolId } of ${JSON.stringify(externals)}) {\n          globalThis['external_' + externalName] = (input) => __rpc(toolId, input);\n        }\n        `,\n        [rpcHost, logHost],\n        { arguments: { reference: true } },\n      );\n\n      // The guest returns a JSON envelope string so results and errors cross\n      // the boundary as data, mirroring the frame protocol's JSON semantics.\n      const evalSource = `\n        (async () => {\n          const __user = ${strippedProgram}\n          try {\n            const __result = await __user();\n            try {\n              const json = JSON.stringify({ ok: true, value: __result });\n              return json === undefined ? '{\"ok\":true}' : json;\n            } catch {\n              return JSON.stringify({\n                ok: false,\n                error: { message: 'Code Mode result is not JSON-serializable', name: 'TypeError' },\n              });\n            }\n          } catch (e) {\n            return JSON.stringify({\n              ok: false,\n              error: { message: (e && e.message) || String(e), name: e && e.name },\n            });\n          }\n        })()\n      `;\n\n      // Two timeout layers: the eval `timeout` interrupts runaway synchronous\n      // code; the host timer covers time spent awaiting (RPC round trips,\n      // guest promises) by disposing the isolate, which rejects the eval.\n      const timeoutPromise = new Promise<'timeout'>(resolve => {\n        timer = setTimeout(() => {\n          timedOut = true;\n          resolve('timeout');\n          disposeIsolate();\n        }, timeout);\n      });\n\n      // isolated-vm types this as a nested promise; `await` flattens it and\n      // `copy: true` guarantees the resolved value is the guest's JSON string.\n      const evalPromise = context.eval(evalSource, {\n        promise: true,\n        copy: true,\n        timeout,\n      }) as unknown as Promise<string>;\n\n      const outcome = await Promise.race([\n        evalPromise.then(\n          json => ({ kind: 'done' as const, json, error: undefined }),\n          error => ({ kind: 'error' as const, json: undefined, error }),\n        ),\n        timeoutPromise.then(() => ({ kind: 'timeout' as const, json: undefined, error: undefined })),\n      ]);\n\n      if (outcome.kind === 'timeout' || timedOut) {\n        return {\n          success: false,\n          logs,\n          error: { message: `Code Mode execution timed out after ${timeout}ms`, name: 'TimeoutError' },\n        };\n      }\n\n      if (outcome.kind === 'error') {\n        const err = outcome.error as { message?: string; name?: string };\n        if (abortSignal?.aborted) {\n          return { success: false, logs, error: { message: 'Code Mode execution aborted', name: 'AbortError' } };\n        }\n        // The eval `timeout` option rejects with \"Script execution timed out\".\n        if (/timed out/i.test(err?.message ?? '')) {\n          return {\n            success: false,\n            logs,\n            error: { message: `Code Mode execution timed out after ${timeout}ms`, name: 'TimeoutError' },\n          };\n        }\n        return {\n          success: false,\n          logs,\n          error: { message: err?.message ?? String(outcome.error), name: err?.name },\n        };\n      }\n\n      const envelope = JSON.parse(outcome.json) as GuestResultEnvelope;\n      return envelope.ok\n        ? { success: true, result: envelope.value, logs }\n        : { success: false, error: envelope.error, logs };\n    } finally {\n      if (timer) clearTimeout(timer);\n      abortSignal?.removeEventListener('abort', onAbort);\n      disposeIsolate();\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,0BAA0B;;;;;;AAehC,SAAS,uBAA6B;CAEpC,IADc,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,EAC9C,IAAI,IAAI;CAChB,IAAI,QAAQ,SAAS,SAAS,oBAAoB,GAAG;CACrD,KAAK,QAAQ,IAAI,gBAAgB,GAAA,CAAI,SAAS,oBAAoB,GAAG;CACrE,MAAM,IAAI,MACR,6OAGF;AACF;;;;;;;;;;;;;;;;;;AAiCA,IAAa,8BAAb,MAAsE;CACpE,kBAA2B;CAE3B;CAEA,YAAY,UAA8C,CAAC,GAAG;EAC5D,qBAAqB;EACrB,KAAKA,iBAAiB,QAAQ,iBAAiB;CACjD;CAEA,MAAM,IAAI,MAA4E;EACpF,MAAM,EAAE,SAAS,SAAS,UAAU,SAAS,aAAa,gBAAgB,qBAAqB;EAE/F,MAAM,YAAY,QAAQ,KAAI,YAAW;GAAE;GAAQ,cAAc,eAAe,MAAM;EAAE,EAAE;EAC1F,MAAM,YAAY,IAAI,IAAI,OAAO;EACjC,MAAM,OAAiB,CAAC;EAKxB,MAAM,cAAc,MAAc,SAAwB;GACxD,IAAI;IACF,iBAAiB,MAAM,IAAI;GAC7B,QAAQ,CAER;EACF;EACA,MAAM,gBAAgB,MAAc,YAAoB,UAAwB;GAC9E,IAAI;IACF,mBAAmB,MAAM,YAAY,KAAK;GAC5C,QAAQ,CAER;EACF;EAKA,IAAI;EACJ,IAAI;GACF,kBAAkB,cAAc,mBAAmB,QAAQ,OAAO;IAAE,QAAQ;IAAM,QAAQ;GAAS,CAAC,CAAC,CAAC;EACxG,SAAS,OAAO;GAEd,OAAO;IACL,SAAS;IACT;IACA,OAAO;KAAE,SAASC,OAAK,WAAW,OAAO,KAAK;KAAG,MAAM;IAAc;GACvE;EACF;EAMA,MAAM,UAAU,OAAO,MAAc,aAAsC;GACzE,MAAM,UAAU,KAAK,IAAI;GACzB,IAAI;GACJ,IAAI;IACF,OAAO,KAAK,MAAM,QAAQ;GAC5B,QAAQ;IACN,OAAO,KAAA;GACT;GACA,WAAW,MAAM,IAAI;GAErB,IAAI,CAAC,UAAU,IAAI,IAAI,GAAG;IACxB,aAAa,MAAM,KAAK,IAAI,IAAI,yBAAS,IAAI,MAAM,aAAa,CAAC;IACjE,OAAO,KAAK,UAAU;KACpB,IAAI;KACJ,OAAO;MAAE,SAAS,SAAS,KAAK;MAAkC,MAAM;KAAkB;IAC5F,CAA2B;GAC7B;GACA,IAAI;IACF,MAAM,SAAS,MAAM,SAAS,MAAM,IAAI;IAIxC,MAAM,OAAO,KAAK,UAAU;KAAE,IAAI;KAAM;IAAO,CAA2B;IAC1E,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO;IACvC,OAAO;GACT,SAAS,OAAO;IACd,MAAM,MAAM;IACZ,aAAa,MAAM,KAAK,IAAI,IAAI,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;IAClG,OAAO,KAAK,UAAU;KACpB,IAAI;KACJ,OAAO;MAAE,SAAS,KAAK,WAAW,OAAO,KAAK;MAAG,MAAM,KAAK;KAAK;IACnE,CAA2B;GAC7B;EACF;EAEA,MAAM,WAAW,YAA0B;GACzC,KAAK,KAAK,OAAO;EACnB;EAEA,MAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,KAAKD,eAAe,CAAC;EACpE,IAAI,WAAW;EACf,MAAM,uBAA6B;GACjC,IAAI,UAAU;GACd,WAAW;GACX,IAAI;IACF,QAAQ,QAAQ;GAClB,QAAQ,CAER;EACF;EAEA,IAAI,WAAW;EACf,IAAI;EACJ,MAAM,gBAAsB,eAAe;EAC3C,aAAa,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAE9D,IAAI;GACF,IAAI,aAAa,SACf,OAAO;IAAE,SAAS;IAAO;IAAM,OAAO;KAAE,SAAS;KAA+B,MAAM;IAAa;GAAE;GAGvG,MAAM,UAAU,MAAM,QAAQ,cAAc;GAM5C,MAAM,QAAQ,YACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iDA6ByC,KAAK,UAAU,SAAS,EAAE;;;WAInE,CAAC,SAAS,OAAO,GACjB,EAAE,WAAW,EAAE,WAAW,KAAK,EAAE,CACnC;GAIA,MAAM,aAAa;;2BAEE,gBAAgB;;;;;;;;;;;;;;;;;;;;GAwBrC,MAAM,iBAAiB,IAAI,SAAmB,YAAW;IACvD,QAAQ,iBAAiB;KACvB,WAAW;KACX,QAAQ,SAAS;KACjB,eAAe;IACjB,GAAG,OAAO;GACZ,CAAC;GAID,MAAM,cAAc,QAAQ,KAAK,YAAY;IAC3C,SAAS;IACT,MAAM;IACN;GACF,CAAC;GAED,MAAM,UAAU,MAAM,QAAQ,KAAK,CACjC,YAAY,MACV,UAAS;IAAE,MAAM;IAAiB;IAAM,OAAO,KAAA;GAAU,KACzD,WAAU;IAAE,MAAM;IAAkB,MAAM,KAAA;IAAW;GAAM,EAC7D,GACA,eAAe,YAAY;IAAE,MAAM;IAAoB,MAAM,KAAA;IAAW,OAAO,KAAA;GAAU,EAAE,CAC7F,CAAC;GAED,IAAI,QAAQ,SAAS,aAAa,UAChC,OAAO;IACL,SAAS;IACT;IACA,OAAO;KAAE,SAAS,uCAAuC,QAAQ;KAAK,MAAM;IAAe;GAC7F;GAGF,IAAI,QAAQ,SAAS,SAAS;IAC5B,MAAM,MAAM,QAAQ;IACpB,IAAI,aAAa,SACf,OAAO;KAAE,SAAS;KAAO;KAAM,OAAO;MAAE,SAAS;MAA+B,MAAM;KAAa;IAAE;IAGvG,IAAI,aAAa,KAAK,KAAK,WAAW,EAAE,GACtC,OAAO;KACL,SAAS;KACT;KACA,OAAO;MAAE,SAAS,uCAAuC,QAAQ;MAAK,MAAM;KAAe;IAC7F;IAEF,OAAO;KACL,SAAS;KACT;KACA,OAAO;MAAE,SAAS,KAAK,WAAW,OAAO,QAAQ,KAAK;MAAG,MAAM,KAAK;KAAK;IAC3E;GACF;GAEA,MAAM,WAAW,KAAK,MAAM,QAAQ,IAAI;GACxC,OAAO,SAAS,KACZ;IAAE,SAAS;IAAM,QAAQ,SAAS;IAAO;GAAK,IAC9C;IAAE,SAAS;IAAO,OAAO,SAAS;IAAO;GAAK;EACpD,UAAU;GACR,IAAI,OAAO,aAAa,KAAK;GAC7B,aAAa,oBAAoB,SAAS,OAAO;GACjD,eAAe;EACjB;CACF;AACF"}

package/dist/transport.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Code Mode — isolated-vm transport
+ *
+ * Runs the model's TypeScript program inside an in-process V8 isolate
+ * (via `isolated-vm`) instead of a WorkspaceSandbox. The isolate is a real
+ * security boundary: the guest has no filesystem, network, process, or module
+ * access — the only capabilities are the injected `external_*` functions,
+ * which call back into the host dispatcher (allow-list enforced host-side).
+ *
+ * Unlike the stdio/E2B transports there is no process boundary, so the frame
+ * protocol (`FRAME_PREFIX`, stdout parsing, stdin writes) is not used. Host
+ * calls cross the isolate boundary as JSON strings in both directions, so no
+ * host object references are ever exposed to guest code.
+ *
+ * TypeScript is stripped on the host with esbuild before evaluation (isolates
+ * run plain JavaScript).
+ *
+ * Requirements:
+ * - `isolated-vm` is a native addon (prebuilt binaries for common platforms,
+ *   compiled from source elsewhere).
+ * - On Node 20+ the host process must be started with `--no-node-snapshot`
+ *   (e.g. `node --no-node-snapshot server.js` or
+ *   `NODE_OPTIONS=--no-node-snapshot`). The constructor fails fast with an
+ *   actionable error when the flag is missing.
+ */
+import type { CodeModeToolResult, CodeModeTransport } from '@mastra/core/tools';
+export interface IsolatedVmCodeModeTransportOptions {
+    /**
+     * V8 isolate heap limit in MiB. Exceeding it terminates the program.
+     * Default: 128.
+     */
+    memoryLimitMb?: number;
+}
+/**
+ * Code Mode transport that executes programs in an in-process V8 isolate.
+ *
+ * No sandbox is required — the isolate is the execution boundary
+ * (`requiresSandbox: false`).
+ *
+ * @example
+ * ```typescript
+ * import { createCodeMode } from '@mastra/core/tools';
+ * import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
+ *
+ * const { tool, instructions } = createCodeMode(
+ *   { tools: { getWeather, getForecast } },
+ *   new IsolatedVmCodeModeTransport({ memoryLimitMb: 128 }),
+ * );
+ * ```
+ */
+export declare class IsolatedVmCodeModeTransport implements CodeModeTransport {
+    #private;
+    readonly requiresSandbox = false;
+    constructor(options?: IsolatedVmCodeModeTransportOptions);
+    run(opts: Parameters<CodeModeTransport['run']>[0]): Promise<CodeModeToolResult>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAOhF,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAiCD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,2BAA4B,YAAW,iBAAiB;;IACnE,QAAQ,CAAC,eAAe,SAAS;gBAIrB,OAAO,GAAE,kCAAuC;IAKtD,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA+OtF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/isolated-vm",
-  "version": "0.0.0",
+  "version": "0.1.0",
   "description": "In-process V8 isolate Code Mode transport for Mastra, backed by isolated-vm",
   "type": "module",
   "main": "dist/index.js",
@@ -18,31 +18,21 @@
     },
     "./package.json": "./package.json"
   },
-  "scripts": {
-    "build": "tsdown --silent --config tsdown.config.ts",
-    "build:lib": "pnpm build",
-    "build:watch": "pnpm build --watch",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest watch",
-    "lint": "oxlint . && eslint .",
-    "lint:fix": "oxlint --fix . && eslint --fix ."
-  },
   "license": "Apache-2.0",
   "dependencies": {
     "esbuild": "^0.28.0",
     "isolated-vm": "^6.1.2"
   },
   "devDependencies": {
-    "@internal/lint": "workspace:*",
-    "@internal/types-builder": "workspace:*",
-    "@mastra/core": "workspace:*",
     "@types/node": "22.20.1",
-    "@vitest/coverage-v8": "catalog:",
+    "@vitest/coverage-v8": "4.1.10",
     "eslint": "^10.7.0",
     "tsdown": "0.22.9",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
+    "typescript": "^6.0.3",
+    "vitest": "4.1.10",
+    "@internal/lint": "0.0.119",
+    "@internal/types-builder": "0.0.94",
+    "@mastra/core": "1.55.0"
   },
   "peerDependencies": {
     "@mastra/core": ">=1.55.0-0 <2.0.0-0"
@@ -62,5 +52,15 @@
   },
   "engines": {
     "node": ">=22.13.0"
+  },
+  "scripts": {
+    "build": "tsdown --silent --config tsdown.config.ts",
+    "build:lib": "pnpm build",
+    "build:watch": "pnpm build --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "lint": "oxlint . && eslint .",
+    "lint:fix": "oxlint --fix . && eslint --fix ."
   }
-}
+}