@ny4n/codemode 0.0.0-stage → 1.0.1

package/dist/runtime/execution.js

@@ -0,0 +1,371 @@
+/**
+ * Host side of an execution, shared by every place a VM can run.
+ *
+ * The host owns everything the script must not influence: the tool table, call records, output,
+ * the deadline, the caller's abort signal, and the decoding of what the VM reports. The VM itself
+ * runs somewhere a {@link VmLauncher} decides: a worker thread (`CodemodeSandbox`), the calling
+ * thread (`InlineCodemodeSandbox`), or another isolate reached over RPC (`RemoteCodemodeSandbox`).
+ * The two sides only exchange the messages in `protocol.ts`, so the launchers differ in transport
+ * and termination, not in behavior.
+ *
+ * Lifecycle of one execution:
+ * 1. The constructor arms the deadline and abort listener, then asks the launcher for a channel.
+ * 2. Messages from the VM arrive through {@link VmEvents.message}; tool calls run here and their
+ *    results go back through {@link VmChannel.post}. Replies produced before the launcher has
+ *    returned its channel are queued and flushed when it arrives.
+ * 3. The first terminal event wins: `done`, `crash`, a launcher failure, the deadline, or an abort.
+ *    `finish()` aborts pending tool calls, stops the channel, and resolves the result once the
+ *    channel reports it stopped. Later events are ignored.
+ *
+ * The launcher, not this class, is responsible for actually stopping a running VM: a worker is
+ * terminated, an in-thread VM is interrupted and disposed, and a remote VM is told to stop at its
+ * next exchange.
+ */
+import { toCodemodeIdentifier } from "../identifier.js";
+import { isWorkerToHostMessage, } from "./protocol.js";
+const DEFAULT_TIMEOUT_MS = 300_000;
+const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const RESERVED_GLOBALS = new Set([
+    "tools",
+    "ALL_TOOLS",
+    "console",
+    "text",
+    "image",
+    "exit",
+    "globalThis",
+    "store",
+    "load",
+]);
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function serializeStore(store) {
+    const serialized = {};
+    for (const [key, value] of Object.entries(store ?? {})) {
+        const json = JSON.stringify(value);
+        if (json !== undefined)
+            serialized[key] = json;
+    }
+    return serialized;
+}
+/**
+ * The prelude that serializes values for the host runs in the same VM as the script, so a script
+ * that patches built-ins (for example `Array.prototype.toJSON`) can make it send malformed data.
+ * Payloads that do not decode throw this error, and the execution fails as a sandbox error.
+ */
+class BridgeError extends Error {
+}
+function parseBridgeJson(json, what) {
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        throw new BridgeError(`${what} is not valid JSON`);
+    }
+}
+function parseStoreWrites(json) {
+    const entries = parseBridgeJson(json, "store writes");
+    if (!Array.isArray(entries))
+        throw new BridgeError("store writes are not an array");
+    const writes = { set: {}, delete: [] };
+    for (const entry of entries) {
+        if (!Array.isArray(entry) ||
+            typeof entry[0] !== "string" ||
+            (entry.length === 2 ? typeof entry[1] !== "string" : entry.length !== 1)) {
+            throw new BridgeError("store writes contain a malformed entry");
+        }
+        const [key, value] = entry;
+        if (value === undefined)
+            writes.delete.push(key);
+        else
+            writes.set[key] = parseBridgeJson(value, `store value for ${JSON.stringify(key)}`);
+    }
+    return writes;
+}
+function parseScriptError(json) {
+    const parsed = parseBridgeJson(json, "script error");
+    if (typeof parsed !== "object" || parsed === null)
+        throw new BridgeError("script error is not an object");
+    const { name, message, stack } = parsed;
+    if (typeof message !== "string" ||
+        (name !== undefined && typeof name !== "string") ||
+        (stack !== undefined && typeof stack !== "string")) {
+        throw new BridgeError("script error is malformed");
+    }
+    return { kind: "script", name, message, stack };
+}
+/** One script run in its own VM. */
+class Execution {
+    promise;
+    resolveResult;
+    channel;
+    /** Replies produced before the launcher returned the channel. */
+    unsent = [];
+    tools;
+    globals;
+    signal;
+    timer;
+    output = [];
+    calls = [];
+    pending = new Map();
+    finished = false;
+    constructor(options) {
+        this.promise = new Promise((resolve) => {
+            this.resolveResult = resolve;
+        });
+        this.tools = options.tools;
+        this.globals = options.globals;
+        this.signal = options.signal;
+        if (Number.isFinite(options.timeoutMs)) {
+            this.timer = setTimeout(() => {
+                this.finish({ kind: "timeout", message: `Execution timed out after ${options.timeoutMs} ms` });
+            }, options.timeoutMs);
+        }
+        if (options.signal) {
+            if (options.signal.aborted) {
+                this.onAbort();
+            }
+            else {
+                options.signal.addEventListener("abort", this.onAbort, { once: true });
+            }
+        }
+        if (this.finished)
+            return;
+        const data = {
+            code: options.code,
+            tools: [...options.tools.values()].map((tool) => ({
+                name: tool.name,
+                jsName: toCodemodeIdentifier(tool.name),
+                description: tool.description ?? "",
+            })),
+            globals: [...options.globals.values()].map((global) => ({
+                name: global.name,
+                spread: global.spread === true,
+            })),
+            memoryLimitBytes: options.memoryLimitBytes,
+            store: options.store,
+        };
+        const events = {
+            message: (message) => this.receive(message),
+            failure: (error) => this.finish(error),
+        };
+        new Promise((resolve) => resolve(options.launch(data, events))).then((channel) => {
+            if (this.finished) {
+                void channel.stop().catch(() => undefined);
+                return;
+            }
+            this.channel = channel;
+            for (const message of this.unsent.splice(0))
+                channel.post(message);
+        }, (error) => {
+            this.finish({ kind: "sandbox", message: errorMessage(error) });
+        });
+    }
+    abort(message) {
+        this.finish({ kind: "aborted", message });
+        return this.promise;
+    }
+    onAbort = () => {
+        const reason = this.signal?.reason;
+        this.finish({ kind: "aborted", message: reason instanceof Error ? reason.message : "Execution aborted" });
+    };
+    post(message) {
+        if (this.channel)
+            this.channel.post(message);
+        else
+            this.unsent.push(message);
+    }
+    /** An exception here would escape into the launcher's transport and leave the execution unsettled. */
+    receive(message) {
+        try {
+            this.handleMessage(message);
+        }
+        catch (error) {
+            this.finish({
+                kind: "sandbox",
+                message: error instanceof BridgeError
+                    ? `Sandbox bridge broken: ${error.message}. The script may have modified built-ins such as a prototype's toJSON.`
+                    : `Sandbox host failed: ${errorMessage(error)}`,
+            });
+        }
+    }
+    handleMessage(message) {
+        if (this.finished)
+            return;
+        if (!isWorkerToHostMessage(message))
+            throw new BridgeError("unknown message from the worker");
+        switch (message.type) {
+            case "output":
+                this.output.push(message.item);
+                break;
+            case "call":
+                if (this.pending.has(message.id))
+                    throw new BridgeError(`duplicate call id ${message.id}`);
+                void this.handleCall(message);
+                break;
+            case "done":
+                this.handleDone(message);
+                break;
+            case "crash":
+                this.finish({ kind: "sandbox", message: message.message });
+                break;
+        }
+    }
+    handleDone(message) {
+        // Decode everything before finish(), which must not throw once it starts.
+        if (!message.ok) {
+            this.finish(parseScriptError(message.error));
+            return;
+        }
+        const value = message.value === undefined ? undefined : parseBridgeJson(message.value, "return value");
+        this.finish(undefined, value, parseStoreWrites(message.writes));
+    }
+    async handleCall(message) {
+        const { id, name } = message;
+        const isTool = message.target === "tool";
+        const record = isTool ? { name, status: "cancelled", durationMs: 0 } : undefined;
+        if (record)
+            this.calls.push(record);
+        const pending = { record, startedAt: performance.now(), controller: new AbortController() };
+        this.pending.set(id, pending);
+        let status;
+        let reply;
+        try {
+            const tool = (isTool ? this.tools : this.globals).get(name);
+            if (!tool)
+                throw new Error(`Unknown ${isTool ? "tool" : "global"} "${name}"`);
+            const args = message.args === undefined ? undefined : JSON.parse(message.args);
+            const value = await tool.execute(args, { signal: pending.controller.signal });
+            reply = { type: "result", id, ok: true, payload: value === undefined ? undefined : JSON.stringify(value) };
+            status = "ok";
+        }
+        catch (error) {
+            reply = { type: "result", id, ok: false, payload: errorMessage(error) };
+            status = "error";
+        }
+        // Already cancelled by finish(): the record keeps "cancelled" and the
+        // VM is gone or going.
+        if (!this.pending.delete(id))
+            return;
+        if (record) {
+            record.status = status;
+            record.durationMs = performance.now() - pending.startedAt;
+        }
+        this.post(reply);
+    }
+    finish(error, value, writes) {
+        if (this.finished)
+            return;
+        this.finished = true;
+        clearTimeout(this.timer);
+        this.signal?.removeEventListener("abort", this.onAbort);
+        const now = performance.now();
+        for (const pending of this.pending.values()) {
+            if (pending.record)
+                pending.record.durationMs = now - pending.startedAt;
+            pending.controller.abort();
+        }
+        this.pending.clear();
+        this.unsent = [];
+        const result = error
+            ? { ok: false, error, output: this.output, calls: this.calls }
+            : {
+                ok: true,
+                value,
+                output: this.output,
+                calls: this.calls,
+                storeWrites: writes ?? { set: {}, delete: [] },
+            };
+        if (!this.channel) {
+            this.resolveResult(result);
+            return;
+        }
+        this.channel
+            .stop()
+            .catch(() => undefined)
+            .then(() => this.resolveResult(result));
+    }
+}
+/**
+ * Tool table, defaults, and in-flight executions; the behavior every sandbox shares. Subclasses
+ * only choose where the VM runs by passing a {@link VmLauncher}.
+ *
+ * The script sees `tools.<name>(args)` for every registered tool, `ALL_TOOLS`, the output helpers
+ * `text`, `image`, `exit`, and `console.*`, `store`/`load`, and the configured globals; nothing
+ * else (no timers, `fetch`, `process`, `require`, modules). Each `execute()` gets its own VM; the
+ * sandbox only holds the tool table and defaults. `close()` aborts in-flight executions.
+ */
+export class CodemodeSandboxBase {
+    toolsByName = new Map();
+    globalsByName = new Map();
+    timeoutMs;
+    memoryLimitBytes;
+    launch;
+    running = new Set();
+    closed = false;
+    constructor(options, launch) {
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.memoryLimitBytes = options.memoryLimitBytes;
+        this.launch = launch;
+        for (const tool of options.tools ?? [])
+            this.registerTool(tool);
+        const namespaces = new Set();
+        for (const global of options.globals ?? []) {
+            const parts = global.name.split(".");
+            if (parts.length > 2 || !parts.every((part) => IDENTIFIER.test(part)) || RESERVED_GLOBALS.has(parts[0])) {
+                throw new Error(`Invalid global name "${global.name}"`);
+            }
+            if (this.globalsByName.has(global.name))
+                throw new Error(`Global "${global.name}" is already registered`);
+            if (parts.length === 2)
+                namespaces.add(parts[0]);
+            this.globalsByName.set(global.name, global);
+        }
+        for (const name of namespaces) {
+            if (this.globalsByName.has(name))
+                throw new Error(`Global "${name}" conflicts with the namespace "${name}"`);
+        }
+    }
+    /** Throws if a tool with the same name is already registered. */
+    registerTool(tool) {
+        if (this.toolsByName.has(tool.name))
+            throw new Error(`Tool "${tool.name}" is already registered`);
+        this.toolsByName.set(tool.name, tool);
+    }
+    unregisterTool(name) {
+        return this.toolsByName.delete(name);
+    }
+    get tools() {
+        return [...this.toolsByName.values()];
+    }
+    get globals() {
+        return [...this.globalsByName.values()];
+    }
+    /**
+     * `code` is an async function body: `return` and top-level `await` work.
+     * Never rejects for script failures; those come back as `{ ok: false }`.
+     * The script can use `store(key, value)` and `load(key)` on `options.store`.
+     */
+    execute(code, options = {}) {
+        if (this.closed)
+            return Promise.reject(new Error("Sandbox is closed"));
+        const execution = new Execution({
+            code,
+            tools: new Map(this.toolsByName),
+            globals: this.globalsByName,
+            timeoutMs: options.timeoutMs ?? this.timeoutMs,
+            signal: options.signal,
+            memoryLimitBytes: this.memoryLimitBytes,
+            store: serializeStore(options.store),
+            launch: this.launch,
+        });
+        this.running.add(execution);
+        return execution.promise.finally(() => this.running.delete(execution));
+    }
+    /** Aborts in-flight executions (they resolve with `kind: "aborted"`) and rejects new ones. */
+    async close() {
+        this.closed = true;
+        await Promise.all([...this.running].map((execution) => execution.abort("Sandbox closed")));
+    }
+}
+//# sourceMappingURL=execution.js.map

package/dist/runtime/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../src/runtime/execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAYxD,OAAO,EAEN,qBAAqB,GAGrB,MAAM,eAAe,CAAC;AAEvB,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACrD,OAAO;IACP,WAAW;IACX,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ,OAAO;IACP,MAAM;CACN,CAAC,CAAC;AAuBH,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,KAAoD;IAC3E,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAY,SAAQ,KAAK;CAAG;AAElC,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IAClD,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACpD,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACpF,MAAM,MAAM,GAAwB,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAC5B,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EACvE,CAAC;YACF,MAAM,IAAI,WAAW,CAAC,wCAAwC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,KAA0B,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAC1G,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAiC,CAAC;IACnE,IACC,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QAChD,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAmBD,oCAAoC;AACpC,MAAM,SAAS;IACL,OAAO,CAA0B;IAClC,aAAa,CAAoC;IACjD,OAAO,CAAwB;IACvC,iEAAiE;IACzD,MAAM,GAA0B,EAAE,CAAC;IAC1B,KAAK,CAAoC;IACzC,OAAO,CAAoC;IAC3C,MAAM,CAA0B;IAChC,KAAK,CAA4C;IACjD,MAAM,GAAyB,EAAE,CAAC;IAClC,KAAK,GAAmB,EAAE,CAAC;IAC3B,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,OAAyB;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;YACtD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;YAChG,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;QACF,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,MAAM,IAAI,GAAgB;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;aACnC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI;aAC9B,CAAC,CAAC;YACH,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;SACpB,CAAC;QACF,MAAM,MAAM,GAAa;YACxB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;SACtC,CAAC;QACF,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9E,CAAC,OAAO,EAAE,EAAE;YACX,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAe;QACpB,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAEgB,OAAO,GAAG,GAAS,EAAE;QACrC,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC;IAEM,IAAI,CAAC,OAA4B;QACxC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,sGAAsG;IAC9F,OAAO,CAAC,OAAgB;QAC/B,IAAI,CAAC;YACJ,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC;gBACX,IAAI,EAAE,SAAS;gBACf,OAAO,EACN,KAAK,YAAY,WAAW;oBAC3B,CAAC,CAAC,0BAA0B,KAAK,CAAC,OAAO,wEAAwE;oBACjH,CAAC,CAAC,wBAAwB,YAAY,CAAC,KAAK,CAAC,EAAE;aACjD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEO,aAAa,CAAC,OAAgB;QACrC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,iCAAiC,CAAC,CAAC;QAC9F,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,QAAQ;gBACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM;YACP,KAAK,MAAM;gBACV,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3F,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM;YACP,KAAK,MAAM;gBACV,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACzB,MAAM;YACP,KAAK,OAAO;gBACX,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,MAAM;QACR,CAAC;IACF,CAAC;IAEO,UAAU,CAAC,OAAuD;QACzE,0EAA0E;QAC1E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7C,OAAO;QACR,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAAuD;QAC/E,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QACzC,MAAM,MAAM,GAA6B,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,eAAe,EAAE,EAAE,CAAC;QACzG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAE9B,IAAI,MAA0B,CAAC;QAC/B,IAAI,KAA0B,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAY,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3G,MAAM,GAAG,IAAI,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,sEAAsE;QACtE,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO;QACrC,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAEO,MAAM,CAAC,KAAgC,EAAE,KAAe,EAAE,MAA4B;QAC7F,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YACxE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjB,MAAM,MAAM,GAAmB,KAAK;YACnC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC9D,CAAC,CAAC;gBACA,EAAE,EAAE,IAAI;gBACR,KAAK;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,MAAM,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;aAC9C,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,IAAI,CAAC,OAAO;aACV,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACd,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,SAAS,CAAS;IAClB,gBAAgB,CAAqB;IACrC,MAAM,CAAa;IACnB,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACxC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAAmC,EAAE,MAAkB;QAClE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzG,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mCAAmC,IAAI,GAAG,CAAC,CAAC;QAC9G,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,YAAY,CAAC,IAAkB;QAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,yBAAyB,CAAC,CAAC;QAClG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,cAAc,CAAC,IAAY;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,KAAK;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,OAAO;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAY,EAAE,OAAO,GAA2B,EAAE;QACzD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC;YAC/B,IAAI;YACJ,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,aAAa;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAK;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;CACD","sourcesContent":["/**\n * Host side of an execution, shared by every place a VM can run.\n *\n * The host owns everything the script must not influence: the tool table, call records, output,\n * the deadline, the caller's abort signal, and the decoding of what the VM reports. The VM itself\n * runs somewhere a {@link VmLauncher} decides: a worker thread (`CodemodeSandbox`), the calling\n * thread (`InlineCodemodeSandbox`), or another isolate reached over RPC (`RemoteCodemodeSandbox`).\n * The two sides only exchange the messages in `protocol.ts`, so the launchers differ in transport\n * and termination, not in behavior.\n *\n * Lifecycle of one execution:\n * 1. The constructor arms the deadline and abort listener, then asks the launcher for a channel.\n * 2. Messages from the VM arrive through {@link VmEvents.message}; tool calls run here and their\n *    results go back through {@link VmChannel.post}. Replies produced before the launcher has\n *    returned its channel are queued and flushed when it arrives.\n * 3. The first terminal event wins: `done`, `crash`, a launcher failure, the deadline, or an abort.\n *    `finish()` aborts pending tool calls, stops the channel, and resolves the result once the\n *    channel reports it stopped. Later events are ignored.\n *\n * The launcher, not this class, is responsible for actually stopping a running VM: a worker is\n * terminated, an in-thread VM is interrupted and disposed, and a remote VM is told to stop at its\n * next exchange.\n */\nimport { toCodemodeIdentifier } from \"../identifier.ts\";\nimport type {\n\tCodemodeCall,\n\tCodemodeCallStatus,\n\tCodemodeError,\n\tCodemodeExecuteOptions,\n\tCodemodeOutputItem,\n\tCodemodeResult,\n\tCodemodeSandboxBaseOptions,\n\tCodemodeStoreWrites,\n\tCodemodeTool,\n} from \"../types.ts\";\nimport {\n\ttype HostToWorkerMessage,\n\tisWorkerToHostMessage,\n\ttype VmStartData,\n\ttype WorkerToHostMessage,\n} from \"./protocol.ts\";\n\nconst DEFAULT_TIMEOUT_MS = 300_000;\nconst IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst RESERVED_GLOBALS: ReadonlySet<string> = new Set([\n\t\"tools\",\n\t\"ALL_TOOLS\",\n\t\"console\",\n\t\"text\",\n\t\"image\",\n\t\"exit\",\n\t\"globalThis\",\n\t\"store\",\n\t\"load\",\n]);\n\n/** Callbacks a launcher uses to report what its VM does. */\nexport interface VmEvents {\n\t/** A message from the VM. Validated here, so launchers can pass through anything they receive. */\n\tmessage(message: unknown): void;\n\t/** The VM failed or stopped outside the bridge, for example a worker exit or a remote error. */\n\tfailure(error: CodemodeError): void;\n}\n\n/** The host's handle on a running VM. */\nexport interface VmChannel {\n\tpost(message: HostToWorkerMessage): void;\n\t/** Stops the VM. Called once, after the execution has its result. */\n\tstop(): Promise<void>;\n}\n\n/**\n * Starts a VM for one execution. Rejections become `sandbox` errors with the rejection's message.\n * The VM may start reporting messages before the returned promise settles.\n */\nexport type VmLauncher = (data: VmStartData, events: VmEvents) => VmChannel | Promise<VmChannel>;\n\nexport function errorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction serializeStore(store: Readonly<Record<string, unknown>> | undefined): Record<string, string> {\n\tconst serialized: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(store ?? {})) {\n\t\tconst json = JSON.stringify(value);\n\t\tif (json !== undefined) serialized[key] = json;\n\t}\n\treturn serialized;\n}\n\n/**\n * The prelude that serializes values for the host runs in the same VM as the script, so a script\n * that patches built-ins (for example `Array.prototype.toJSON`) can make it send malformed data.\n * Payloads that do not decode throw this error, and the execution fails as a sandbox error.\n */\nclass BridgeError extends Error {}\n\nfunction parseBridgeJson(json: string, what: string): unknown {\n\ttry {\n\t\treturn JSON.parse(json);\n\t} catch {\n\t\tthrow new BridgeError(`${what} is not valid JSON`);\n\t}\n}\n\nfunction parseStoreWrites(json: string): CodemodeStoreWrites {\n\tconst entries = parseBridgeJson(json, \"store writes\");\n\tif (!Array.isArray(entries)) throw new BridgeError(\"store writes are not an array\");\n\tconst writes: CodemodeStoreWrites = { set: {}, delete: [] };\n\tfor (const entry of entries) {\n\t\tif (\n\t\t\t!Array.isArray(entry) ||\n\t\t\ttypeof entry[0] !== \"string\" ||\n\t\t\t(entry.length === 2 ? typeof entry[1] !== \"string\" : entry.length !== 1)\n\t\t) {\n\t\t\tthrow new BridgeError(\"store writes contain a malformed entry\");\n\t\t}\n\t\tconst [key, value] = entry as [string, string?];\n\t\tif (value === undefined) writes.delete.push(key);\n\t\telse writes.set[key] = parseBridgeJson(value, `store value for ${JSON.stringify(key)}`);\n\t}\n\treturn writes;\n}\n\nfunction parseScriptError(json: string): CodemodeError {\n\tconst parsed = parseBridgeJson(json, \"script error\");\n\tif (typeof parsed !== \"object\" || parsed === null) throw new BridgeError(\"script error is not an object\");\n\tconst { name, message, stack } = parsed as Record<string, unknown>;\n\tif (\n\t\ttypeof message !== \"string\" ||\n\t\t(name !== undefined && typeof name !== \"string\") ||\n\t\t(stack !== undefined && typeof stack !== \"string\")\n\t) {\n\t\tthrow new BridgeError(\"script error is malformed\");\n\t}\n\treturn { kind: \"script\", name, message, stack };\n}\n\ninterface PendingCall {\n\trecord: CodemodeCall | undefined;\n\tstartedAt: number;\n\tcontroller: AbortController;\n}\n\ninterface ExecutionOptions {\n\tcode: string;\n\ttools: ReadonlyMap<string, CodemodeTool>;\n\tglobals: ReadonlyMap<string, CodemodeTool>;\n\ttimeoutMs: number;\n\tsignal: AbortSignal | undefined;\n\tmemoryLimitBytes: number | undefined;\n\tstore: Record<string, string>;\n\tlaunch: VmLauncher;\n}\n\n/** One script run in its own VM. */\nclass Execution {\n\treadonly promise: Promise<CodemodeResult>;\n\tprivate resolveResult!: (result: CodemodeResult) => void;\n\tprivate channel: VmChannel | undefined;\n\t/** Replies produced before the launcher returned the channel. */\n\tprivate unsent: HostToWorkerMessage[] = [];\n\tprivate readonly tools: ReadonlyMap<string, CodemodeTool>;\n\tprivate readonly globals: ReadonlyMap<string, CodemodeTool>;\n\tprivate readonly signal: AbortSignal | undefined;\n\tprivate readonly timer: ReturnType<typeof setTimeout> | undefined;\n\tprivate readonly output: CodemodeOutputItem[] = [];\n\tprivate readonly calls: CodemodeCall[] = [];\n\tprivate readonly pending = new Map<number, PendingCall>();\n\tprivate finished = false;\n\n\tconstructor(options: ExecutionOptions) {\n\t\tthis.promise = new Promise<CodemodeResult>((resolve) => {\n\t\t\tthis.resolveResult = resolve;\n\t\t});\n\t\tthis.tools = options.tools;\n\t\tthis.globals = options.globals;\n\t\tthis.signal = options.signal;\n\n\t\tif (Number.isFinite(options.timeoutMs)) {\n\t\t\tthis.timer = setTimeout(() => {\n\t\t\t\tthis.finish({ kind: \"timeout\", message: `Execution timed out after ${options.timeoutMs} ms` });\n\t\t\t}, options.timeoutMs);\n\t\t}\n\n\t\tif (options.signal) {\n\t\t\tif (options.signal.aborted) {\n\t\t\t\tthis.onAbort();\n\t\t\t} else {\n\t\t\t\toptions.signal.addEventListener(\"abort\", this.onAbort, { once: true });\n\t\t\t}\n\t\t}\n\t\tif (this.finished) return;\n\n\t\tconst data: VmStartData = {\n\t\t\tcode: options.code,\n\t\t\ttools: [...options.tools.values()].map((tool) => ({\n\t\t\t\tname: tool.name,\n\t\t\t\tjsName: toCodemodeIdentifier(tool.name),\n\t\t\t\tdescription: tool.description ?? \"\",\n\t\t\t})),\n\t\t\tglobals: [...options.globals.values()].map((global) => ({\n\t\t\t\tname: global.name,\n\t\t\t\tspread: global.spread === true,\n\t\t\t})),\n\t\t\tmemoryLimitBytes: options.memoryLimitBytes,\n\t\t\tstore: options.store,\n\t\t};\n\t\tconst events: VmEvents = {\n\t\t\tmessage: (message) => this.receive(message),\n\t\t\tfailure: (error) => this.finish(error),\n\t\t};\n\t\tnew Promise<VmChannel>((resolve) => resolve(options.launch(data, events))).then(\n\t\t\t(channel) => {\n\t\t\t\tif (this.finished) {\n\t\t\t\t\tvoid channel.stop().catch(() => undefined);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tthis.channel = channel;\n\t\t\t\tfor (const message of this.unsent.splice(0)) channel.post(message);\n\t\t\t},\n\t\t\t(error: unknown) => {\n\t\t\t\tthis.finish({ kind: \"sandbox\", message: errorMessage(error) });\n\t\t\t},\n\t\t);\n\t}\n\n\tabort(message: string): Promise<CodemodeResult> {\n\t\tthis.finish({ kind: \"aborted\", message });\n\t\treturn this.promise;\n\t}\n\n\tprivate readonly onAbort = (): void => {\n\t\tconst reason: unknown = this.signal?.reason;\n\t\tthis.finish({ kind: \"aborted\", message: reason instanceof Error ? reason.message : \"Execution aborted\" });\n\t};\n\n\tprivate post(message: HostToWorkerMessage): void {\n\t\tif (this.channel) this.channel.post(message);\n\t\telse this.unsent.push(message);\n\t}\n\n\t/** An exception here would escape into the launcher's transport and leave the execution unsettled. */\n\tprivate receive(message: unknown): void {\n\t\ttry {\n\t\t\tthis.handleMessage(message);\n\t\t} catch (error) {\n\t\t\tthis.finish({\n\t\t\t\tkind: \"sandbox\",\n\t\t\t\tmessage:\n\t\t\t\t\terror instanceof BridgeError\n\t\t\t\t\t\t? `Sandbox bridge broken: ${error.message}. The script may have modified built-ins such as a prototype's toJSON.`\n\t\t\t\t\t\t: `Sandbox host failed: ${errorMessage(error)}`,\n\t\t\t});\n\t\t}\n\t}\n\n\tprivate handleMessage(message: unknown): void {\n\t\tif (this.finished) return;\n\t\tif (!isWorkerToHostMessage(message)) throw new BridgeError(\"unknown message from the worker\");\n\t\tswitch (message.type) {\n\t\t\tcase \"output\":\n\t\t\t\tthis.output.push(message.item);\n\t\t\t\tbreak;\n\t\t\tcase \"call\":\n\t\t\t\tif (this.pending.has(message.id)) throw new BridgeError(`duplicate call id ${message.id}`);\n\t\t\t\tvoid this.handleCall(message);\n\t\t\t\tbreak;\n\t\t\tcase \"done\":\n\t\t\t\tthis.handleDone(message);\n\t\t\t\tbreak;\n\t\t\tcase \"crash\":\n\t\t\t\tthis.finish({ kind: \"sandbox\", message: message.message });\n\t\t\t\tbreak;\n\t\t}\n\t}\n\n\tprivate handleDone(message: Extract<WorkerToHostMessage, { type: \"done\" }>): void {\n\t\t// Decode everything before finish(), which must not throw once it starts.\n\t\tif (!message.ok) {\n\t\t\tthis.finish(parseScriptError(message.error));\n\t\t\treturn;\n\t\t}\n\t\tconst value = message.value === undefined ? undefined : parseBridgeJson(message.value, \"return value\");\n\t\tthis.finish(undefined, value, parseStoreWrites(message.writes));\n\t}\n\n\tprivate async handleCall(message: Extract<WorkerToHostMessage, { type: \"call\" }>): Promise<void> {\n\t\tconst { id, name } = message;\n\t\tconst isTool = message.target === \"tool\";\n\t\tconst record: CodemodeCall | undefined = isTool ? { name, status: \"cancelled\", durationMs: 0 } : undefined;\n\t\tif (record) this.calls.push(record);\n\t\tconst pending: PendingCall = { record, startedAt: performance.now(), controller: new AbortController() };\n\t\tthis.pending.set(id, pending);\n\n\t\tlet status: CodemodeCallStatus;\n\t\tlet reply: HostToWorkerMessage;\n\t\ttry {\n\t\t\tconst tool = (isTool ? this.tools : this.globals).get(name);\n\t\t\tif (!tool) throw new Error(`Unknown ${isTool ? \"tool\" : \"global\"} \"${name}\"`);\n\t\t\tconst args: unknown = message.args === undefined ? undefined : JSON.parse(message.args);\n\t\t\tconst value = await tool.execute(args, { signal: pending.controller.signal });\n\t\t\treply = { type: \"result\", id, ok: true, payload: value === undefined ? undefined : JSON.stringify(value) };\n\t\t\tstatus = \"ok\";\n\t\t} catch (error) {\n\t\t\treply = { type: \"result\", id, ok: false, payload: errorMessage(error) };\n\t\t\tstatus = \"error\";\n\t\t}\n\n\t\t// Already cancelled by finish(): the record keeps \"cancelled\" and the\n\t\t// VM is gone or going.\n\t\tif (!this.pending.delete(id)) return;\n\t\tif (record) {\n\t\t\trecord.status = status;\n\t\t\trecord.durationMs = performance.now() - pending.startedAt;\n\t\t}\n\t\tthis.post(reply);\n\t}\n\n\tprivate finish(error: CodemodeError | undefined, value?: unknown, writes?: CodemodeStoreWrites): void {\n\t\tif (this.finished) return;\n\t\tthis.finished = true;\n\t\tclearTimeout(this.timer);\n\t\tthis.signal?.removeEventListener(\"abort\", this.onAbort);\n\n\t\tconst now = performance.now();\n\t\tfor (const pending of this.pending.values()) {\n\t\t\tif (pending.record) pending.record.durationMs = now - pending.startedAt;\n\t\t\tpending.controller.abort();\n\t\t}\n\t\tthis.pending.clear();\n\t\tthis.unsent = [];\n\n\t\tconst result: CodemodeResult = error\n\t\t\t? { ok: false, error, output: this.output, calls: this.calls }\n\t\t\t: {\n\t\t\t\t\tok: true,\n\t\t\t\t\tvalue,\n\t\t\t\t\toutput: this.output,\n\t\t\t\t\tcalls: this.calls,\n\t\t\t\t\tstoreWrites: writes ?? { set: {}, delete: [] },\n\t\t\t\t};\n\t\tif (!this.channel) {\n\t\t\tthis.resolveResult(result);\n\t\t\treturn;\n\t\t}\n\t\tthis.channel\n\t\t\t.stop()\n\t\t\t.catch(() => undefined)\n\t\t\t.then(() => this.resolveResult(result));\n\t}\n}\n\n/**\n * Tool table, defaults, and in-flight executions; the behavior every sandbox shares. Subclasses\n * only choose where the VM runs by passing a {@link VmLauncher}.\n *\n * The script sees `tools.<name>(args)` for every registered tool, `ALL_TOOLS`, the output helpers\n * `text`, `image`, `exit`, and `console.*`, `store`/`load`, and the configured globals; nothing\n * else (no timers, `fetch`, `process`, `require`, modules). Each `execute()` gets its own VM; the\n * sandbox only holds the tool table and defaults. `close()` aborts in-flight executions.\n */\nexport class CodemodeSandboxBase {\n\tprivate readonly toolsByName = new Map<string, CodemodeTool>();\n\tprivate readonly globalsByName = new Map<string, CodemodeTool>();\n\tprivate readonly timeoutMs: number;\n\tprivate readonly memoryLimitBytes: number | undefined;\n\tprivate readonly launch: VmLauncher;\n\tprivate readonly running = new Set<Execution>();\n\tprivate closed = false;\n\n\tconstructor(options: CodemodeSandboxBaseOptions, launch: VmLauncher) {\n\t\tthis.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\t\tthis.memoryLimitBytes = options.memoryLimitBytes;\n\t\tthis.launch = launch;\n\t\tfor (const tool of options.tools ?? []) this.registerTool(tool);\n\t\tconst namespaces = new Set<string>();\n\t\tfor (const global of options.globals ?? []) {\n\t\t\tconst parts = global.name.split(\".\");\n\t\t\tif (parts.length > 2 || !parts.every((part) => IDENTIFIER.test(part)) || RESERVED_GLOBALS.has(parts[0])) {\n\t\t\t\tthrow new Error(`Invalid global name \"${global.name}\"`);\n\t\t\t}\n\t\t\tif (this.globalsByName.has(global.name)) throw new Error(`Global \"${global.name}\" is already registered`);\n\t\t\tif (parts.length === 2) namespaces.add(parts[0]);\n\t\t\tthis.globalsByName.set(global.name, global);\n\t\t}\n\t\tfor (const name of namespaces) {\n\t\t\tif (this.globalsByName.has(name)) throw new Error(`Global \"${name}\" conflicts with the namespace \"${name}\"`);\n\t\t}\n\t}\n\n\t/** Throws if a tool with the same name is already registered. */\n\tregisterTool(tool: CodemodeTool): void {\n\t\tif (this.toolsByName.has(tool.name)) throw new Error(`Tool \"${tool.name}\" is already registered`);\n\t\tthis.toolsByName.set(tool.name, tool);\n\t}\n\n\tunregisterTool(name: string): boolean {\n\t\treturn this.toolsByName.delete(name);\n\t}\n\n\tget tools(): CodemodeTool[] {\n\t\treturn [...this.toolsByName.values()];\n\t}\n\n\tget globals(): CodemodeTool[] {\n\t\treturn [...this.globalsByName.values()];\n\t}\n\n\t/**\n\t * `code` is an async function body: `return` and top-level `await` work.\n\t * Never rejects for script failures; those come back as `{ ok: false }`.\n\t * The script can use `store(key, value)` and `load(key)` on `options.store`.\n\t */\n\texecute(code: string, options: CodemodeExecuteOptions = {}): Promise<CodemodeResult> {\n\t\tif (this.closed) return Promise.reject(new Error(\"Sandbox is closed\"));\n\t\tconst execution = new Execution({\n\t\t\tcode,\n\t\t\ttools: new Map(this.toolsByName),\n\t\t\tglobals: this.globalsByName,\n\t\t\ttimeoutMs: options.timeoutMs ?? this.timeoutMs,\n\t\t\tsignal: options.signal,\n\t\t\tmemoryLimitBytes: this.memoryLimitBytes,\n\t\t\tstore: serializeStore(options.store),\n\t\t\tlaunch: this.launch,\n\t\t});\n\t\tthis.running.add(execution);\n\t\treturn execution.promise.finally(() => this.running.delete(execution));\n\t}\n\n\t/** Aborts in-flight executions (they resolve with `kind: \"aborted\"`) and rejects new ones. */\n\tasync close(): Promise<void> {\n\t\tthis.closed = true;\n\t\tawait Promise.all([...this.running].map((execution) => execution.abort(\"Sandbox closed\")));\n\t}\n}\n"]}

package/dist/runtime/host.d.ts

@@ -0,0 +1,13 @@
+import type { CodemodeSandboxOptions } from "../types.ts";
+import { CodemodeSandboxBase } from "./execution.ts";
+/**
+ * Runs JavaScript in a QuickJS VM (a separate wasm instance) inside a worker thread. The worker
+ * keeps script execution off the host thread: QuickJS runs synchronously, so a spinning script on
+ * the host thread would block its event loop. Requires `node:worker_threads` (Node or Bun); see
+ * `InlineCodemodeSandbox` and `RemoteCodemodeSandbox` in `@ny4n/codemode/portable`
+ * for other runtimes.
+ */
+export declare class CodemodeSandbox extends CodemodeSandboxBase {
+    constructor(options?: CodemodeSandboxOptions);
+}
+//# sourceMappingURL=host.d.ts.map

package/dist/runtime/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/runtime/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAiC,MAAM,gBAAgB,CAAC;AAgEpF;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,mBAAmB;IACvD,YAAY,OAAO,GAAE,sBAA2B,EAE/C;CACD"}

package/dist/runtime/host.js

@@ -0,0 +1,72 @@
+import { Worker } from "node:worker_threads";
+import { loadQuickJSWasm } from "../wasm.js";
+import { CodemodeSandboxBase, errorMessage } from "./execution.js";
+function defaultWorkerUrl() {
+    // `.ts` when running from source (tests, tsx), `.js` from the published dist.
+    return new URL(import.meta.url.endsWith(".ts") ? "./worker.ts" : "./worker.js", import.meta.url);
+}
+/**
+ * Each execution gets its own worker thread and QuickJS VM. A fresh worker per run keeps
+ * termination simple: a runaway script, including one that only spins the microtask queue, is
+ * killed with `terminate()` and cannot poison a later run. Before terminating, the host sets a
+ * shared interrupt flag that the VM polls, because Bun's `terminate()` cannot stop a thread that
+ * is spinning in wasm.
+ */
+function workerLauncher(wasm, workerUrl) {
+    return async (data, events) => {
+        let module;
+        try {
+            module = await (wasm ?? loadQuickJSWasm());
+        }
+        catch (error) {
+            throw new Error(`Failed to load QuickJS: ${errorMessage(error)}`);
+        }
+        const interrupt = new SharedArrayBuffer(4);
+        const workerData = { ...data, wasm: module, interrupt };
+        let worker;
+        try {
+            worker = new Worker(workerUrl, { workerData });
+        }
+        catch (error) {
+            throw new Error(`Failed to start worker: ${errorMessage(error)}`);
+        }
+        worker.on("message", (message) => {
+            // Node 24/26 --watch leaks dependency reports onto the worker channel (nodejs/node#65044).
+            if (typeof message === "object" &&
+                message !== null &&
+                ("watch:import" in message || "watch:require" in message))
+                return;
+            events.message(message);
+        });
+        worker.on("error", (error) => {
+            events.failure({
+                kind: "sandbox",
+                name: error instanceof Error ? error.name : undefined,
+                message: errorMessage(error),
+            });
+        });
+        worker.on("exit", (code) => {
+            events.failure({ kind: "sandbox", message: `Worker exited with code ${code} before the script settled` });
+        });
+        return {
+            post: (message) => worker.postMessage(message),
+            stop: async () => {
+                Atomics.store(new Int32Array(interrupt), 0, 1);
+                await worker.terminate().catch(() => undefined);
+            },
+        };
+    };
+}
+/**
+ * Runs JavaScript in a QuickJS VM (a separate wasm instance) inside a worker thread. The worker
+ * keeps script execution off the host thread: QuickJS runs synchronously, so a spinning script on
+ * the host thread would block its event loop. Requires `node:worker_threads` (Node or Bun); see
+ * `InlineCodemodeSandbox` and `RemoteCodemodeSandbox` in `@ny4n/codemode/portable`
+ * for other runtimes.
+ */
+export class CodemodeSandbox extends CodemodeSandboxBase {
+    constructor(options = {}) {
+        super(options, workerLauncher(options.wasm, options.workerUrl ?? defaultWorkerUrl()));
+    }
+}
+//# sourceMappingURL=host.js.map

package/dist/runtime/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/runtime/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAA2B,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAmB,MAAM,gBAAgB,CAAC;AAGpF,SAAS,gBAAgB;IACxB,8EAA8E;IAC9E,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACtB,IAAkE,EAClE,SAAuB;IAEvB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAC7B,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAe,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE;YACzC,2FAA2F;YAC3F,IACC,OAAO,OAAO,KAAK,QAAQ;gBAC3B,OAAO,KAAK,IAAI;gBAChB,CAAC,cAAc,IAAI,OAAO,IAAI,eAAe,IAAI,OAAO,CAAC;gBAEzD,OAAO;YACR,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;YACrC,MAAM,CAAC,OAAO,CAAC;gBACd,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACrD,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,IAAI,4BAA4B,EAAE,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;QACH,OAAO;YACN,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;YAC9C,IAAI,EAAE,KAAK,IAAI,EAAE;gBAChB,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/C,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjD,CAAC;SACD,CAAC;IACH,CAAC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACvD,YAAY,OAAO,GAA2B,EAAE;QAC/C,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;CACD","sourcesContent":["import { Worker } from \"node:worker_threads\";\nimport type { CodemodeSandboxOptions } from \"../types.ts\";\nimport { type CodemodeWasmModule, loadQuickJSWasm } from \"../wasm.ts\";\nimport { CodemodeSandboxBase, errorMessage, type VmLauncher } from \"./execution.ts\";\nimport type { WorkerData } from \"./protocol.ts\";\n\nfunction defaultWorkerUrl(): URL {\n\t// `.ts` when running from source (tests, tsx), `.js` from the published dist.\n\treturn new URL(import.meta.url.endsWith(\".ts\") ? \"./worker.ts\" : \"./worker.js\", import.meta.url);\n}\n\n/**\n * Each execution gets its own worker thread and QuickJS VM. A fresh worker per run keeps\n * termination simple: a runaway script, including one that only spins the microtask queue, is\n * killed with `terminate()` and cannot poison a later run. Before terminating, the host sets a\n * shared interrupt flag that the VM polls, because Bun's `terminate()` cannot stop a thread that\n * is spinning in wasm.\n */\nfunction workerLauncher(\n\twasm: CodemodeWasmModule | Promise<CodemodeWasmModule> | undefined,\n\tworkerUrl: string | URL,\n): VmLauncher {\n\treturn async (data, events) => {\n\t\tlet module: CodemodeWasmModule;\n\t\ttry {\n\t\t\tmodule = await (wasm ?? loadQuickJSWasm());\n\t\t} catch (error) {\n\t\t\tthrow new Error(`Failed to load QuickJS: ${errorMessage(error)}`);\n\t\t}\n\t\tconst interrupt = new SharedArrayBuffer(4);\n\t\tconst workerData: WorkerData = { ...data, wasm: module, interrupt };\n\t\tlet worker: Worker;\n\t\ttry {\n\t\t\tworker = new Worker(workerUrl, { workerData });\n\t\t} catch (error) {\n\t\t\tthrow new Error(`Failed to start worker: ${errorMessage(error)}`);\n\t\t}\n\t\tworker.on(\"message\", (message: unknown) => {\n\t\t\t// Node 24/26 --watch leaks dependency reports onto the worker channel (nodejs/node#65044).\n\t\t\tif (\n\t\t\t\ttypeof message === \"object\" &&\n\t\t\t\tmessage !== null &&\n\t\t\t\t(\"watch:import\" in message || \"watch:require\" in message)\n\t\t\t)\n\t\t\t\treturn;\n\t\t\tevents.message(message);\n\t\t});\n\t\tworker.on(\"error\", (error: unknown) => {\n\t\t\tevents.failure({\n\t\t\t\tkind: \"sandbox\",\n\t\t\t\tname: error instanceof Error ? error.name : undefined,\n\t\t\t\tmessage: errorMessage(error),\n\t\t\t});\n\t\t});\n\t\tworker.on(\"exit\", (code) => {\n\t\t\tevents.failure({ kind: \"sandbox\", message: `Worker exited with code ${code} before the script settled` });\n\t\t});\n\t\treturn {\n\t\t\tpost: (message) => worker.postMessage(message),\n\t\t\tstop: async () => {\n\t\t\t\tAtomics.store(new Int32Array(interrupt), 0, 1);\n\t\t\t\tawait worker.terminate().catch(() => undefined);\n\t\t\t},\n\t\t};\n\t};\n}\n\n/**\n * Runs JavaScript in a QuickJS VM (a separate wasm instance) inside a worker thread. The worker\n * keeps script execution off the host thread: QuickJS runs synchronously, so a spinning script on\n * the host thread would block its event loop. Requires `node:worker_threads` (Node or Bun); see\n * `InlineCodemodeSandbox` and `RemoteCodemodeSandbox` in `@ny4n/codemode/portable`\n * for other runtimes.\n */\nexport class CodemodeSandbox extends CodemodeSandboxBase {\n\tconstructor(options: CodemodeSandboxOptions = {}) {\n\t\tsuper(options, workerLauncher(options.wasm, options.workerUrl ?? defaultWorkerUrl()));\n\t}\n}\n"]}

package/dist/runtime/inline.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Runs the VM on the calling thread, for runtimes without worker threads (Cloudflare Workers and
+ * Durable Objects, browsers) and for the server side of `RemoteCodemodeSandbox`.
+ *
+ * Problem: QuickJS runs synchronously. While a script computes, the host's event loop does not
+ * run, so neither the deadline timer nor an abort signal can fire. On Workers even `Date.now()` is
+ * frozen during synchronous execution, so the VM cannot check a clock either. Example: with a
+ * worker thread, `while (true) {}` is stopped by the host's 200 ms timer; on the calling thread
+ * that timer never gets a chance to run.
+ *
+ * Solution: an interrupt budget. QuickJS polls its interrupt handler periodically while a script
+ * runs; this launcher counts the polls across the whole execution and interrupts the script once
+ * the count passes the budget. The execution then fails with `kind: "timeout"`. The deadline and
+ * abort signal still work whenever the script waits on a tool, since the event loop runs then.
+ *
+ * The rate of polls depends on the code and the machine. Measured with a tight loop: about 50,000
+ * per second of CPU on an Apple M-series laptop and about 10,000 per second on Cloudflare Durable
+ * Objects (October 2026). The default of 100,000 allows roughly 2 to 10 seconds of uninterrupted
+ * computation; keep it well below the platform's own CPU limit, because hitting that limit resets
+ * a Durable Object instead of failing one script.
+ *
+ * Once the VM reports `done` or `crash`, the result is decided, so the VM is interrupted at the
+ * next poll instead of running on until the host stops it. Example: a script that keeps printing in
+ * a `for (;;)` loop after its output limit was reached would otherwise run until the budget ran out
+ * and be reported as a timeout.
+ *
+ * Stack: the VM runs on the caller's stack, which is smaller than a worker thread's (about 1 MB
+ * on Node's main thread), so QuickJS's stack guard is set to {@link INLINE_MAX_STACK_SIZE}.
+ *
+ * Reentrancy: VM callbacks run inside QuickJS. Messages from the VM are delivered to the host in
+ * a microtask, after the VM has returned, so host code (tool calls, `finish()`, disposal) never
+ * runs inside a VM callback and never re-enters the VM.
+ */
+import type { CodemodeSandboxBaseOptions } from "../types.ts";
+import type { CodemodeWasmModule } from "../wasm.ts";
+import { CodemodeSandboxBase, type VmLauncher } from "./execution.ts";
+export declare const DEFAULT_INTERRUPT_BUDGET = 100000;
+/** Allows recursion about 1,000 calls deep and trips well before a 1 MB host stack overflows. */
+export declare const INLINE_MAX_STACK_SIZE: number;
+export interface InlineCodemodeSandboxOptions extends CodemodeSandboxBaseOptions {
+    /**
+     * Compiled `quickjs-wasi/quickjs.wasm`. On Cloudflare, import it with Wrangler's `CompiledWasm`
+     * rule (`@ny4n/codemode/cloudflare` does this); on Node, `loadQuickJSWasm()`.
+     */
+    wasm: CodemodeWasmModule | Promise<CodemodeWasmModule>;
+    /**
+     * Interrupt polls an execution may use before it fails with `kind: "timeout"`. The only limit on
+     * a script that computes without awaiting a tool. Default: {@link DEFAULT_INTERRUPT_BUDGET}.
+     */
+    interruptBudget?: number;
+}
+export declare function inlineLauncher(wasm: CodemodeWasmModule | Promise<CodemodeWasmModule>, interruptBudget?: number): VmLauncher;
+/**
+ * Runs each execution's QuickJS VM on the calling thread. Works in any runtime with WebAssembly
+ * and microtasks; needs no worker threads, files, or Node built-ins. A script that computes
+ * blocks the caller's thread until it awaits a tool or uses up its interrupt budget, so prefer
+ * `CodemodeSandbox` where worker threads exist, and `RemoteCodemodeSandbox` to keep scripts off a
+ * thread that must stay responsive (such as a Durable Object that serves a session).
+ */
+export declare class InlineCodemodeSandbox extends CodemodeSandboxBase {
+    constructor(options: InlineCodemodeSandboxOptions);
+}
+//# sourceMappingURL=inline.d.ts.map

package/dist/runtime/inline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.d.ts","sourceRoot":"","sources":["../../src/runtime/inline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAgB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGpF,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAEhD,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD,MAAM,WAAW,4BAA6B,SAAQ,0BAA0B;IAC/E;;;OAGG;IACH,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,cAAc,CAC7B,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,EACtD,eAAe,GAAE,MAAiC,GAChD,UAAU,CAoDZ;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC7D,YAAY,OAAO,EAAE,4BAA4B,EAEhD;CACD"}