@mongoosejs/studio 0.5.13 → 0.5.14

package/AGENTS.md

@@ -0,0 +1,7 @@
+# Repository guidance
+
+The Mongoose connection passed to Studio is owned by the host application.
+Do not change connection-level settings, options, configuration, models, middleware, plugins, collection objects, or methods on the application connection to implement Studio behavior.
+Apply Studio-specific behavior to individual operations whenever possible.
+When isolation requires a derived connection, copy any Mongoose state that `useDb()` shares with its source before changing the derived connection.
+Sandbox wrappers must remain confined to sandbox-owned models and collections.

package/CLAUDE.md

@@ -0,0 +1,7 @@
+# Repository guidance
+
+The Mongoose connection passed to Studio is owned by the host application.
+Do not change connection-level settings, options, configuration, models, middleware, plugins, collection objects, or methods on the application connection to implement Studio behavior.
+Apply Studio-specific behavior to individual operations whenever possible.
+When isolation requires a derived connection, copy any Mongoose state that `useDb()` shares with its source before changing the derived connection.
+Sandbox wrappers must remain confined to sandbox-owned models and collections.

package/README.md

@@ -39,6 +39,9 @@ opts.model = 'gpt-4o-mini';
 opts.openAIAPIKey = process.env.OPENAI_API_KEY;
 opts.anthropicAPIKey = process.env.ANTHROPIC_API_KEY;
 opts.googleGeminiAPIKey = process.env.GOOGLE_GEMINI_API_KEY;
+// Apply a maximum execution time to all read operations, including reads in scripts.
+// MongoDB does not support maxTimeMS for inserts and index operations.
+opts.maxTimeMS = 10000;
 
 // Mount Mongoose Studio on '/studio'
 app.use('/studio', await studio('/studio/api', mongoose, opts));

package/backend/actions/ChatMessage/executeScript.js

@@ -4,6 +4,7 @@ const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const createSandbox = require('../../sandbox/createSandbox');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const ExecuteScriptParams = new Archetype({
   initiatedById: {
@@ -24,24 +25,25 @@ const ExecuteScriptParams = new Archetype({
   }
 }).compile('ExecuteScriptParams');
 
-module.exports = ({ db, studioConnection }) => async function executeScript(params) {
+module.exports = ({ db, studioConnection, options }) => async function executeScript(params) {
   const { initiatedById, chatMessageId, script, dryRun, roles } = new ExecuteScriptParams(params);
   const ChatThread = studioConnection.model('__Studio_ChatThread');
   const ChatMessage = studioConnection.model('__Studio_ChatMessage');
 
   await authorize('ChatMessage.executeScript', roles);
 
-  const chatMessage = await ChatMessage.findById(chatMessageId);
+  const operationOptions = omitNullish({ maxTimeMS: options?.maxTimeMS });
+  const chatMessage = await ChatMessage.findById(chatMessageId).setOptions(operationOptions);
   if (!chatMessage) {
     throw new Error('Chat message not found');
   }
-  const chatThread = await ChatThread.findById(chatMessage.chatThreadId).orFail();
+  const chatThread = await ChatThread.findById(chatMessage.chatThreadId).setOptions(operationOptions).orFail();
 
   if (initiatedById && chatThread.userId?.toString() !== initiatedById.toString()) {
     throw new Error('Unauthorized');
   }
 
-  const sandbox = createSandbox({ db });
+  const sandbox = createSandbox({ db, maxTimeMS: options?.maxTimeMS });
 
   let output;
   let error;
@@ -74,7 +76,7 @@ module.exports = ({ db, studioConnection }) => async function executeScript(para
           dryRun: !!dryRun
         }
       }
-    );
+    ).setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }));
 
     throw new Error(`Script execution failed: ${error}`);
   } finally {

package/backend/actions/ChatThread/createChatMessage.js

@@ -8,6 +8,7 @@ const callLLM = require('../../integrations/callLLM');
 const getAgentTools = require('../../chatAgent/getAgentTools');
 const getModelDescriptions = require('../../helpers/getModelDescriptions');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const CreateChatMessageParams = new Archetype({
   chatThreadId: {
@@ -36,7 +37,8 @@ module.exports = ({ db, studioConnection, options }) => async function createCha
   await authorize('ChatThread.createChatMessage', roles);
 
   // Check that the user owns the thread
-  const chatThread = await ChatThread.findOne({ _id: chatThreadId });
+  const operationOptions = omitNullish({ maxTimeMS: options?.maxTimeMS });
+  const chatThread = await ChatThread.findOne({ _id: chatThreadId }).setOptions(operationOptions);
   if (!chatThread) {
     throw new Error('Chat thread not found');
   }
@@ -44,7 +46,7 @@ module.exports = ({ db, studioConnection, options }) => async function createCha
     throw new Error('Not authorized');
   }
 
-  const messages = await ChatMessage.find({ chatThreadId }).sort({ createdAt: 1 });
+  const messages = await ChatMessage.find({ chatThreadId }).setOptions(operationOptions).sort({ createdAt: 1 });
   const llmMessages = messages.map(m => ({
     role: m.role,
     content: [{

package/backend/actions/ChatThread/getChatThread.js

@@ -3,6 +3,7 @@
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const GetChatThreadParams = new Archetype({
   chatThreadId: {
@@ -19,14 +20,15 @@ const GetChatThreadParams = new Archetype({
   }
 }).compile('GetChatThreadParams');
 
-module.exports = ({ db, studioConnection }) => async function getChatThread(params) {
+module.exports = ({ db, studioConnection, options }) => async function getChatThread(params) {
   const { chatThreadId, initiatedById, roles, $workspaceId } = new GetChatThreadParams(params);
   const ChatThread = studioConnection.model('__Studio_ChatThread');
   const ChatMessage = studioConnection.model('__Studio_ChatMessage');
 
   await authorize('ChatThread.getChatThread', roles);
 
-  const chatThread = await ChatThread.findById(chatThreadId);
+  const operationOptions = omitNullish({ maxTimeMS: options?.maxTimeMS });
+  const chatThread = await ChatThread.findById(chatThreadId).setOptions(operationOptions);
 
   if (!chatThread) {
     throw new Error('Chat thread not found');
@@ -39,6 +41,7 @@ module.exports = ({ db, studioConnection }) => async function getChatThread(para
   }
 
   const chatMessages = await ChatMessage.find({ chatThreadId })
+    .setOptions(operationOptions)
     .sort({ createdAt: -1 });
 
   return {

package/backend/actions/ChatThread/listChatThreads.js

@@ -3,6 +3,7 @@
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const ListChatThreadsParams = new Archetype({
   initiatedById: {
@@ -13,7 +14,7 @@ const ListChatThreadsParams = new Archetype({
   }
 }).compile('ListChatThreadsParams');
 
-module.exports = ({ db, studioConnection }) => async function listChatThreads(params) {
+module.exports = ({ db, studioConnection, options }) => async function listChatThreads(params) {
   // Validate the params object
   const { initiatedById, roles } = new ListChatThreadsParams(params);
   const ChatThread = studioConnection.model('__Studio_ChatThread');
@@ -24,6 +25,7 @@ module.exports = ({ db, studioConnection }) => async function listChatThreads(pa
 
   // Get all chat threads
   const chatThreads = await ChatThread.find(query)
+    .setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }))
     .sort({ updatedAt: -1 }); // Sort by most recently updated
 
   return {

package/backend/actions/ChatThread/shareChatThread.js

@@ -3,6 +3,7 @@
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const ShareChatThreadParams = new Archetype({
   chatThreadId: {
@@ -22,13 +23,15 @@ const ShareChatThreadParams = new Archetype({
   }
 }).compile('ShareChatThreadParams');
 
-module.exports = ({ studioConnection }) => async function shareChatThread(params) {
+module.exports = ({ studioConnection, options }) => async function shareChatThread(params) {
   const { chatThreadId, share, initiatedById, roles, $workspaceId } = new ShareChatThreadParams(params);
   const ChatThread = studioConnection.model('__Studio_ChatThread');
 
   await authorize('ChatThread.shareChatThread', roles);
 
-  const chatThread = await ChatThread.findById(chatThreadId).orFail();
+  const chatThread = await ChatThread.findById(chatThreadId).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })).
+    orFail();
   if (initiatedById != null && chatThread.userId?.toString() !== initiatedById.toString()) {
     throw new Error('Not authorized');
   }

package/backend/actions/ChatThread/streamChatMessage.js

@@ -8,6 +8,7 @@ const runChatAgent = require('../../chatAgent/runChatAgent');
 const streamLLM = require('../../integrations/streamLLM');
 const getModelDescriptions = require('../../helpers/getModelDescriptions');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const CreateChatMessageParams = new Archetype({
   chatThreadId: {
@@ -36,7 +37,8 @@ module.exports = ({ db, studioConnection, options }) => async function* streamCh
   await authorize('ChatThread.createChatMessage', roles);
 
   // Check that the user owns the thread
-  const chatThread = await ChatThread.findOne({ _id: chatThreadId });
+  const operationOptions = omitNullish({ maxTimeMS: options?.maxTimeMS });
+  const chatThread = await ChatThread.findOne({ _id: chatThreadId }).setOptions(operationOptions);
   if (!chatThread) {
     throw new Error('Chat thread not found');
   }
@@ -44,7 +46,7 @@ module.exports = ({ db, studioConnection, options }) => async function* streamCh
     throw new Error('Not authorized');
   }
 
-  const messages = await ChatMessage.find({ chatThreadId }).sort({ createdAt: 1 });
+  const messages = await ChatMessage.find({ chatThreadId }).setOptions(operationOptions).sort({ createdAt: 1 });
   const llmMessages = messages.map(m => ({
     role: m.role,
     content: [{

package/backend/actions/ChatThread/toggleAgentMode.js

@@ -3,6 +3,7 @@
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 
 const ToggleAgentModeParams = new Archetype({
   chatThreadId: {
@@ -19,13 +20,15 @@ const ToggleAgentModeParams = new Archetype({
   }
 }).compile('ToggleAgentModeParams');
 
-module.exports = ({ studioConnection }) => async function toggleAgentMode(params) {
+module.exports = ({ studioConnection, options }) => async function toggleAgentMode(params) {
   const { chatThreadId, agentMode, initiatedById, roles } = new ToggleAgentModeParams(params);
   const ChatThread = studioConnection.model('__Studio_ChatThread');
 
   await authorize('ChatThread.toggleAgentMode', roles);
 
-  const chatThread = await ChatThread.findById(chatThreadId).orFail();
+  const chatThread = await ChatThread.findById(chatThreadId).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })).
+    orFail();
   if (initiatedById != null && chatThread.userId?.toString() !== initiatedById.toString()) {
     throw new Error('Not authorized');
   }

package/backend/actions/Dashboard/deleteDashboard.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const DeleteDashboardParams = new Archetype({
   dashboardId: {
@@ -13,14 +14,17 @@ const DeleteDashboardParams = new Archetype({
   }
 }).compile('DeleteDashboardParams');
 
-module.exports = ({ studioConnection }) => async function deleteDashboard(params) {
+module.exports = ({ studioConnection, options }) => async function deleteDashboard(params) {
   const { dashboardId, roles } = new DeleteDashboardParams(params);
   const Dashboard = studioConnection.model('__Studio_Dashboard');
   const DashboardResult = studioConnection.model('__Studio_DashboardResult');
 
   await authorize('Dashboard.deleteDashboard', roles);
 
-  const result = await Dashboard.deleteOne({ _id: dashboardId }).orFail();
-  await DashboardResult.deleteMany({ dashboardId });
+  const result = await Dashboard.deleteOne({ _id: dashboardId }).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })).
+    orFail();
+  await DashboardResult.deleteMany({ dashboardId }).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }));
   return { result };
 };

package/backend/actions/Dashboard/getDashboard.js

@@ -4,6 +4,7 @@ const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const createSandbox = require('../../sandbox/createSandbox');
 const mongoose = require('mongoose');
+const omitNullish = require('../../helpers/omitNullish');
 const { defaultMothershipURL } = require('../../../constants');
 
 const GetDashboardParams = new Archetype({
@@ -36,10 +37,11 @@ module.exports = ({ db, studioConnection, options }) => async function getDashbo
 
   await authorize('Dashboard.getDashboard', roles);
 
-  const dashboard = await Dashboard.findOne({ _id: dashboardId });
+  const dashboard = await Dashboard.findOne({ _id: dashboardId }).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }));
   if (evaluate) {
     let result = null;
-    const sandbox = createSandbox({ db });
+    const sandbox = createSandbox({ db, maxTimeMS: options?.maxTimeMS });
     const startExec = startDashboardEvaluate(DashboardResult, dashboardId, $workspaceId, userId);
     startExec.catch(() => {}); // Avoid unhandled promise rejections - we will handle this error later.
     try {
@@ -56,7 +58,8 @@ module.exports = ({ db, studioConnection, options }) => async function getDashbo
           dashboardResult._id,
           null,
           { message: error.message },
-          'failed'
+          'failed',
+          options
         );
       });
       return { dashboard, dashboardResult, error: { message: error.message } };
@@ -79,7 +82,8 @@ module.exports = ({ db, studioConnection, options }) => async function getDashbo
           dashboardResult._id,
           result,
           undefined,
-          'completed'
+          'completed',
+          options
         );
       });
 
@@ -93,21 +97,25 @@ module.exports = ({ db, studioConnection, options }) => async function getDashbo
       dashboardId,
       $workspaceId,
       authorization,
-      mothershipUrl
+      mothershipUrl,
+      options
     );
     return { dashboard, dashboardResults };
   }
 };
 
-async function completeDashboardEvaluate(Dashboard, DashboardResult, dashboardResultId, result, error, status) {
-  const dashboardResult = await DashboardResult.findById(dashboardResultId).orFail();
+async function completeDashboardEvaluate(Dashboard, DashboardResult, dashboardResultId, result, error, status, options) {
+  const dashboardResult = await DashboardResult.findById(dashboardResultId).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })).
+    orFail();
   const finishedEvaluatingAt = new Date();
   dashboardResult.finishedEvaluatingAt = finishedEvaluatingAt;
   dashboardResult.result = result;
   dashboardResult.error = error;
   dashboardResult.status = status;
   await dashboardResult.save();
-  await Dashboard.updateOne({ _id: dashboardResult.dashboardId }, { $set: { lastEvaluatedAt: finishedEvaluatingAt } });
+  await Dashboard.updateOne({ _id: dashboardResult.dashboardId }, { $set: { lastEvaluatedAt: finishedEvaluatingAt } }).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }));
   return { dashboardResult };
 }
 
@@ -123,14 +131,17 @@ async function startDashboardEvaluate(DashboardResult, dashboardId, workspaceId,
   return { dashboardResult };
 }
 
-async function getDashboardResults(DashboardResult, dashboardId, workspaceId, authorization, mothershipUrl) {
+async function getDashboardResults(DashboardResult, dashboardId, workspaceId, authorization, mothershipUrl, options) {
   const filter = { dashboardId };
   if (workspaceId != null) {
     filter.workspaceId = workspaceId;
   }
 
   const [localResultsRes, remoteResultsRes] = await Promise.allSettled([
-    DashboardResult.find(filter).sort({ _id: -1 }).limit(10),
+    DashboardResult.find(filter).
+      sort({ _id: -1 }).
+      limit(10).
+      setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })),
     getMothershipDashboardResults(dashboardId, workspaceId, authorization, mothershipUrl)
   ]);
 

package/backend/actions/Dashboard/getDashboards.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const GetDashboardParams = new Archetype({
   roles: {
@@ -9,7 +10,7 @@ const GetDashboardParams = new Archetype({
   }
 }).compile('GetDashboardParams');
 
-module.exports = ({ studioConnection }) => async function getDashboards(params) {
+module.exports = ({ studioConnection, options }) => async function getDashboards(params) {
   const Dashboard = studioConnection.model('__Studio_Dashboard');
   const { roles } = new GetDashboardParams(params);
 
@@ -17,6 +18,7 @@ module.exports = ({ studioConnection }) => async function getDashboards(params)
 
   const dashboards = await Dashboard
     .find()
+    .setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }))
     .sort({ isPinned: -1, createdAt: -1, _id: -1 });
 
   return { dashboards };

package/backend/actions/Dashboard/updateDashboard.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const UpdateDashboardParams = new Archetype({
   dashboardId: {
@@ -25,7 +26,7 @@ const UpdateDashboardParams = new Archetype({
   }
 }).compile('UpdateDashboardParams');
 
-module.exports = ({ studioConnection }) => async function updateDashboard(params) {
+module.exports = ({ studioConnection, options }) => async function updateDashboard(params) {
   const { dashboardId, code, title, description, isPinned, roles, evaluate } = new UpdateDashboardParams(params);
 
   const Dashboard = studioConnection.models['__Studio_Dashboard'];
@@ -54,7 +55,7 @@ module.exports = ({ studioConnection }) => async function updateDashboard(params
     dashboardId,
     updateObj,
     { sanitizeFilter: true, returnDocument: 'after' }
-  );
+  ).setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }));
 
   return { doc };
 };

package/backend/actions/Model/addField.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const AddFieldParams = new Archetype({
   model: {
@@ -25,7 +26,7 @@ const AddFieldParams = new Archetype({
   }
 }).compile('AddFieldParams');
 
-module.exports = ({ db }) => async function addField(params) {
+module.exports = ({ db, options }) => async function addField(params) {
   const { model, _id, fieldName, fieldValue, roles } = new AddFieldParams(params);
 
   await authorize('Model.updateDocument', roles);
@@ -48,7 +49,7 @@ module.exports = ({ db }) => async function addField(params) {
       runValidators: false,
       strict: false
     }
-  );
+  ).setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS }));
 
   return { doc };
 };

package/backend/actions/Model/analyzeSchema.js

@@ -3,6 +3,7 @@
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
 const { Buffer } = require('buffer');
+const omitNullish = require('../../helpers/omitNullish');
 const validateDocumentWithTimeout = require('../../helpers/validateDocumentWithTimeout');
 
 const SAMPLE_SIZE = 1000;
@@ -18,7 +19,7 @@ const AnalyzeSchemaParams = new Archetype({
   }
 }).compile('AnalyzeSchemaParams');
 
-module.exports = ({ db }) => async function analyzeSchema(params) {
+module.exports = ({ db, options }) => async function analyzeSchema(params) {
   const { model, roles } = new AnalyzeSchemaParams(params);
 
   await authorize('Model.analyzeSchema', roles);
@@ -28,10 +29,11 @@ module.exports = ({ db }) => async function analyzeSchema(params) {
     throw new Error(`Model ${model} not found`);
   }
 
-  const documentCount = await Model.collection.countDocuments();
+  const operationOptions = omitNullish({ maxTimeMS: options?.maxTimeMS });
+  const documentCount = await Model.collection.countDocuments({}, operationOptions);
   const rawDocs = documentCount > SAMPLE_SIZE ?
-    await Model.collection.aggregate([{ $sample: { size: SAMPLE_SIZE } }]).toArray() :
-    await Model.collection.find({}).toArray();
+    await Model.collection.aggregate([{ $sample: { size: SAMPLE_SIZE } }], operationOptions).toArray() :
+    await Model.collection.find({}, operationOptions).toArray();
 
   const paths = getSchemaPaths(Model.schema);
   const pathTypeCounts = {};

package/backend/actions/Model/deleteDocument.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const DeleteDocumentParams = new Archetype({
   model: {
@@ -17,7 +18,7 @@ const DeleteDocumentParams = new Archetype({
   }
 }).compile('DeleteDocumentParams');
 
-module.exports = ({ db }) => async function DeleteDocument(params) {
+module.exports = ({ db, options }) => async function DeleteDocument(params) {
   const { model, documentId, roles } = new DeleteDocumentParams(params);
 
   const Model = db.models[model];
@@ -30,9 +31,8 @@ module.exports = ({ db }) => async function DeleteDocument(params) {
 
   const doc = await Model.
     deleteOne({ _id: documentId }).
-    setOptions({ sanitizeFilter: true }).
+    setOptions(omitNullish({ sanitizeFilter: true, maxTimeMS: options?.maxTimeMS })).
     orFail();
-  console.log('what is doc', doc);
 
   return { doc };
 };

package/backend/actions/Model/deleteDocuments.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const DeleteDocumentsParams = new Archetype({
   model: {
@@ -17,7 +18,7 @@ const DeleteDocumentsParams = new Archetype({
   }
 }).compile('DeleteDocumentsParams');
 
-module.exports = ({ db }) => async function DeleteDocuments(params) {
+module.exports = ({ db, options }) => async function DeleteDocuments(params) {
   const { model, documentIds, roles } = new DeleteDocumentsParams(params);
 
   const Model = db.models[model];
@@ -30,6 +31,7 @@ module.exports = ({ db }) => async function DeleteDocuments(params) {
 
   await Model.
     deleteMany({ _id: { $in: documentIds } }).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })).
     orFail();
 
   return { };

package/backend/actions/Model/executeDocumentScript.js

@@ -2,9 +2,8 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
-const mongoose = require('mongoose');
-const util = require('util');
-const vm = require('vm');
+const createSandbox = require('../../sandbox/createSandbox');
+const omitNullish = require('../../helpers/omitNullish');
 
 const ExecuteDocumentScriptParams = new Archetype({
   model: {
@@ -24,38 +23,35 @@ const ExecuteDocumentScriptParams = new Archetype({
   }
 }).compile('ExecuteDocumentScriptParams');
 
-module.exports = ({ db }) => async function executeDocumentScript(params) {
+module.exports = ({ db, options }) => async function executeDocumentScript(params) {
   const { model, documentId, script, roles } = new ExecuteDocumentScriptParams(params);
 
   await authorize('Model.executeDocumentScript', roles);
 
-  const Model = db.models[model];
-  if (Model == null) {
+  if (db.models[model] == null) {
     throw new Error(`Model ${model} not found`);
   }
 
-  const doc = await Model.findById(documentId).setOptions({ sanitizeFilter: true }).orFail();
-
-  const logs = [];
-  if (!db.Types) {
-    db.Types = mongoose.Types;
+  const sandbox = createSandbox({ db, maxTimeMS: options?.maxTimeMS });
+
+  try {
+    const Model = sandbox.db.models[model];
+    const doc = await Model.findById(documentId).
+      setOptions(omitNullish({ sanitizeFilter: true, maxTimeMS: options?.maxTimeMS })).
+      orFail();
+    sandbox.context.doc = doc;
+
+    const result = await sandbox.runScript({ script });
+
+    return {
+      result,
+      logs: sandbox.getLogs()
+    };
+  } finally {
+    try {
+      await sandbox.close();
+    } catch (_) {
+      // Ignore sandbox cleanup errors so they do not mask the primary result.
+    }
   }
-  const sandbox = { db, mongoose, doc, console: {}, ObjectId: mongoose.Types.ObjectId };
-
-  sandbox.console.log = function() {
-    const args = Array.from(arguments);
-    logs.push(args.map(arg => typeof arg === 'object' ? util.inspect(arg) : arg).join(' '));
-  };
-
-  const context = vm.createContext(sandbox);
-  const result = await vm.runInContext(wrappedScript(script), context);
-
-  return {
-    result,
-    logs: logs.join('\n')
-  };
 };
-
-const wrappedScript = script => `(async () => {
-  ${script}
-})()`;

package/backend/actions/Model/exportQueryResults.js

@@ -5,6 +5,7 @@ const mongoose = require('mongoose');
 const { stringify } = require('csv-stringify/sync');
 const authorize = require('../../authorize');
 const evaluateFilter = require('../../helpers/evaluateFilter');
+const omitNullish = require('../../helpers/omitNullish');
 
 const GetDocumentsParams = new Archetype({
   model: {
@@ -29,7 +30,7 @@ const GetDocumentsParams = new Archetype({
   }
 }).compile('GetDocumentsParams');
 
-module.exports = ({ db }) => async function exportQueryResults(params, req, res) {
+module.exports = ({ db, options }) => async function exportQueryResults(params, req, res) {
   params = new GetDocumentsParams(params);
   const { model, propertiesToInclude, roles, searchText } = params;
 
@@ -45,6 +46,7 @@ module.exports = ({ db }) => async function exportQueryResults(params, req, res)
 
   const docs = await Model.
     find(filter).
+    setOptions(omitNullish({ maxTimeMS: options?.maxTimeMS })).
     sort({ _id: -1 });
 
   const rows = [propertiesToInclude];

package/backend/actions/Model/getCollectionInfo.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const omitNullish = require('../../helpers/omitNullish');
 
 const GetCollectionInfoParams = new Archetype({
   model: {
@@ -13,7 +14,7 @@ const GetCollectionInfoParams = new Archetype({
   }
 }).compile('GetCollectionInfoParams');
 
-module.exports = ({ db }) => async function getCollectionInfo(params) {
+module.exports = ({ db, options }) => async function getCollectionInfo(params) {
   const { model, roles } = new GetCollectionInfoParams(params);
 
   await authorize('Model.getCollectionInfo', roles);
@@ -23,8 +24,9 @@ module.exports = ({ db }) => async function getCollectionInfo(params) {
     throw new Error(`Model ${model} not found`);
   }
 
+  const operationOptions = omitNullish({ maxTimeMS: options?.maxTimeMS });
   const [collectionOptions, stats] = await Promise.all([
-    Model.collection.options(),
+    Model.collection.options(operationOptions),
     Model.aggregate([
       {
         $collStats: {
@@ -32,7 +34,7 @@ module.exports = ({ db }) => async function getCollectionInfo(params) {
           count: {}
         }
       }
-    ]).then(res => res[0] ?? {})
+    ]).option(operationOptions).then(res => res[0] ?? {})
   ]);
 
   return {