@tinysandbox/tinysandbox 0.3.0

package/index.d.ts

@@ -0,0 +1,132 @@
+import type {
+  CommandTiming,
+  DirEntryJs,
+  ExecResult,
+  FileStat,
+  NativeSandbox,
+  OpenModeJs,
+  SandboxFs,
+  SandboxStats,
+  VfsStatsJs
+} from './native'
+
+export {
+  CommandTiming,
+  DirEntryJs,
+  ExecResult,
+  FileStat,
+  NativeSandbox,
+  OpenModeJs,
+  SandboxFs,
+  SandboxStats,
+  VfsStatsJs
+}
+
+export declare class Sandbox extends NativeSandbox {
+  constructor(options?: SandboxOptions | null)
+  override get fs(): SandboxFs
+  override stats(): Promise<SandboxStats>
+}
+
+export interface SandboxOptions {
+  limits?: LimitsOptions
+  env?: Record<string, string>
+  cwd?: string
+  persistSession?: boolean
+  commands?: Record<string, JsCommand>
+  vfs?: JsVfs
+}
+
+export interface LimitsOptions {
+  /** Milliseconds; must be finite and non-negative. */
+  wallTimeMs?: number
+  /** Byte counts must be non-negative integers at or below Number.MAX_SAFE_INTEGER. */
+  stdoutBytes?: number
+  stderrBytes?: number
+  maxCommands?: number
+  sortInputBytes?: number
+  wasmMemoryBytes?: number
+}
+
+export type JsCommand = (call: CommandCall) => Promise<CommandOutput> | CommandOutput
+
+export interface CommandCall {
+  args: Array<string>
+  env: Record<string, string>
+  cwd: string
+  stdin: Buffer
+}
+
+export interface CommandOutput {
+  exitCode?: number
+  stdout?: Buffer | Uint8Array | string
+  stderr?: Buffer | Uint8Array | string
+}
+
+export interface JsVfs {
+  stat(request: VfsRequest): Promise<VfsResponse> | VfsResponse
+  readdir(request: VfsRequest): Promise<Array<DirEntryJs> | VfsResponse> | Array<DirEntryJs> | VfsResponse
+  mkdir(request: VfsRequest): Promise<VfsResponse | void> | VfsResponse | void
+  rename(request: VfsRequest): Promise<VfsResponse | void> | VfsResponse | void
+  unlink(request: VfsRequest): Promise<VfsResponse | void> | VfsResponse | void
+  rmdir(request: VfsRequest): Promise<VfsResponse | void> | VfsResponse | void
+  open(request: VfsRequest): Promise<number | VfsResponse> | number | VfsResponse
+  readAt(request: VfsRequest): Promise<Buffer | VfsResponse> | Buffer | VfsResponse
+  writeAt(request: VfsRequest): Promise<number | VfsResponse> | number | VfsResponse
+  truncate(request: VfsRequest): Promise<VfsResponse | void> | VfsResponse | void
+  close(request: VfsRequest): Promise<VfsResponse | void> | VfsResponse | void
+  stats?(request: VfsRequest): Promise<VfsResponse> | VfsResponse
+}
+
+export interface VfsRequest {
+  path?: string
+  from?: string
+  to?: string
+  mode?: OpenModeJs
+  handle?: number
+  /** Handle, offset, and len values must be safe JS integers. */
+  offset?: number
+  len?: number
+  data?: Buffer
+}
+
+export interface VfsResponse {
+  fileType?: 'file' | 'directory'
+  len?: number
+  entries?: Array<DirEntryJs>
+  handle?: number
+  bytesRead?: number
+  bytesWritten?: number
+  data?: Buffer
+  usedBytes?: number
+  fileCount?: number
+  error?: VfsCallbackError
+}
+
+export interface VfsCallbackError {
+  /** Unknown codes are treated as EINVAL by the native adapter. */
+  code?: VfsErrno
+  message?: string
+}
+
+export type VfsErrno =
+  | 'EBADF'
+  | 'EBUSY'
+  | 'EACCES'
+  | 'EEXIST'
+  | 'EINVAL'
+  | 'EISDIR'
+  | 'ENOENT'
+  | 'ENOSPC'
+  | 'ENOTDIR'
+  | 'ENOTEMPTY'
+
+export declare function runConformance(
+  vfsFactory: (quota: VfsQuota) => JsVfs | Promise<JsVfs>
+): Promise<{ ok: true; snapshots: 'unsupported' }>
+
+export interface VfsQuota {
+  maxBytes: number
+  maxFiles: number
+  maxFileSize: number
+}

package/index.js

@@ -0,0 +1,225 @@
+const native = require('./native.cjs')
+
+class Sandbox extends native.NativeSandbox {
+  constructor(options = undefined) {
+    super(normalizeOptions(options))
+    this._fs = undefined
+  }
+
+  get fs() {
+    this._fs ??= new SandboxFs(super.fs)
+    return this._fs
+  }
+}
+
+async function runConformance(vfsFactory) {
+  return native.runConformance(async (quota) => native.createJsVfs(wrapVfs(await vfsFactory(firstArgument(quota)))))
+}
+
+function normalizeOptions(options) {
+  if (!options) return options
+  const normalized = { ...options }
+  if (options.commands) normalized.commands = wrapCommands(options.commands)
+  else delete normalized.commands
+  if (options.vfs) normalized.vfs = wrapVfs(options.vfs)
+  else delete normalized.vfs
+  return normalized
+}
+
+function wrapCommands(commands) {
+  return Object.fromEntries(
+    Object.entries(commands).map(([name, command]) => [
+      name,
+      async (call) => {
+        try {
+          const payload = firstArgument(call)
+          return normalizeCommandOutput(await command(payload))
+        } catch (err) {
+          return {
+            exitCode: 1,
+            stderr: Buffer.from(`${err?.message ?? err}\n`)
+          }
+        }
+      }
+    ])
+  )
+}
+
+function wrapVfs(vfs) {
+  return Object.fromEntries(
+    vfsOperations.map((name) => [
+      name,
+      async (request) => {
+        try {
+          return normalizeVfsResponse(name, await vfs[name](normalizeVfsRequest(request)))
+        } catch (err) {
+          return { error: errorPayload(err) }
+        }
+      }
+    ]).concat(
+      typeof vfs.stats === 'function'
+        ? [[
+            'stats',
+            async (request) => {
+              try {
+                return normalizeVfsResponse('stats', await vfs.stats(normalizeVfsRequest(request)))
+              } catch (err) {
+                return { error: errorPayload(err) }
+              }
+            }
+          ]]
+        : []
+    )
+  )
+}
+
+function normalizeVfsRequest(request) {
+  return firstArgument(request)
+}
+
+function firstArgument(value) {
+  // napi-rs TSFN callbacks marshal tuple arguments as an object with numeric
+  // keys, while direct wrapper calls already pass the request object.
+  return value && typeof value === 'object' && Object.hasOwn(value, '0') ? value[0] : value
+}
+
+function normalizeCommandOutput(output = {}) {
+  return {
+    exitCode: output.exitCode ?? 0,
+    stdout: output.stdout ? Buffer.from(output.stdout) : undefined,
+    stderr: output.stderr ? Buffer.from(output.stderr) : undefined
+  }
+}
+
+function normalizeVfsResponse(name, response) {
+  if (response === undefined || response === null) return {}
+  if (response.error) return response
+  if (Buffer.isBuffer(response)) return { data: response, bytesRead: response.length }
+  if (Array.isArray(response)) return { entries: response }
+  if (typeof response === 'number') {
+    if (name === 'open') return { handle: response }
+    if (name === 'writeAt') return { bytesWritten: response }
+  }
+  return response
+}
+
+function errorPayload(err) {
+  return {
+    code: normalizeErrnoCode(err?.code),
+    message: err?.message ?? String(err)
+  }
+}
+
+function normalizeErrnoCode(code) {
+  return errnos.includes(code) ? code : 'EINVAL'
+}
+
+const vfsOperations = [
+  'stat',
+  'readdir',
+  'mkdir',
+  'rename',
+  'unlink',
+  'rmdir',
+  'open',
+  'readAt',
+  'writeAt',
+  'truncate',
+  'close'
+]
+
+const errnos = [
+  'EBADF',
+  'EBUSY',
+  'EACCES',
+  'EEXIST',
+  'EINVAL',
+  'EISDIR',
+  'ENOENT',
+  'ENOSPC',
+  'ENOTDIR',
+  'ENOTEMPTY'
+]
+
+class SandboxFs {
+  constructor(inner) {
+    this.inner = inner
+  }
+
+  stat(path) {
+    return decorateFsPromise(this.inner.stat(path))
+  }
+
+  readdir(path) {
+    return decorateFsPromise(this.inner.readdir(path))
+  }
+
+  mkdir(path) {
+    return decorateFsPromise(this.inner.mkdir(path))
+  }
+
+  rename(from, to) {
+    return decorateFsPromise(this.inner.rename(from, to))
+  }
+
+  unlink(path) {
+    return decorateFsPromise(this.inner.unlink(path))
+  }
+
+  rmdir(path) {
+    return decorateFsPromise(this.inner.rmdir(path))
+  }
+
+  readFile(path) {
+    return decorateFsPromise(this.inner.readFile(path))
+  }
+
+  writeFile(path, data) {
+    return decorateFsPromise(this.inner.writeFile(path, data))
+  }
+
+  appendFile(path, data) {
+    return decorateFsPromise(this.inner.appendFile(path, data))
+  }
+
+  open(path, mode) {
+    return decorateFsPromise(this.inner.open(path, mode))
+  }
+
+  readAt(handle, offset, len) {
+    return decorateFsPromise(this.inner.readAt(handle, offset, len))
+  }
+
+  writeAt(handle, offset, data) {
+    return decorateFsPromise(this.inner.writeAt(handle, offset, data))
+  }
+
+  truncate(handle, len) {
+    return decorateFsPromise(this.inner.truncate(handle, len))
+  }
+
+  close(handle) {
+    return decorateFsPromise(this.inner.close(handle))
+  }
+}
+
+async function decorateFsPromise(promise) {
+  try {
+    return await promise
+  } catch (err) {
+    if (!err || typeof err !== 'object') throw err
+    err.code = normalizeNativeErrno(err)
+    throw err
+  }
+}
+
+function normalizeNativeErrno(err) {
+  if (errnos.includes(err.code)) return err.code
+  const [prefix] = String(err.message ?? '').split(':', 1)
+  return errnos.includes(prefix) ? prefix : 'EINVAL'
+}
+
+exports.NativeSandbox = native.NativeSandbox
+exports.SandboxFs = SandboxFs
+exports.Sandbox = Sandbox
+exports.runConformance = runConformance

package/native.cjs

@@ -0,0 +1,594 @@
+// prettier-ignore
+/* eslint-disable */
+// @ts-nocheck
+/* auto-generated by NAPI-RS */
+
+const { readFileSync } = require('fs')
+let nativeBinding = null
+const loadErrors = []
+
+const isMusl = () => {
+  let musl = false
+  if (process.platform === 'linux') {
+    musl = isMuslFromFilesystem()
+    if (musl === null) {
+      musl = isMuslFromReport()
+    }
+    if (musl === null) {
+      musl = isMuslFromChildProcess()
+    }
+  }
+  return musl
+}
+
+const isFileMusl = (f) => f.includes('libc.musl-') || f.includes('ld-musl-')
+
+const isMuslFromFilesystem = () => {
+  try {
+    return readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {
+    return null
+  }
+}
+
+const isMuslFromReport = () => {
+  let report = null
+  if (process.report && typeof process.report.getReport === 'function') {
+    process.report.excludeNetwork = true
+    report = process.report.getReport()
+  }
+  if (!report) {
+    return null
+  }
+  if (report.header && report.header.glibcVersionRuntime) {
+    return false
+  }
+  if (Array.isArray(report.sharedObjects)) {
+    if (report.sharedObjects.some(isFileMusl)) {
+      return true
+    }
+  }
+  return false
+}
+
+const isMuslFromChildProcess = () => {
+  try {
+    return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')
+  } catch (e) {
+    // If we reach this case, we don't know if the system is musl or not, so is better to just fallback to false
+    return false
+  }
+}
+
+function requireNative() {
+  if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {
+    try {
+      return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);
+    } catch (err) {
+      loadErrors.push(err)
+    }
+  } else if (process.platform === 'android') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./tinysandbox-node.android-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-android-arm64')
+        const bindingPackageVersion = require('tinysandbox-android-arm64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./tinysandbox-node.android-arm-eabi.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-android-arm-eabi')
+        const bindingPackageVersion = require('tinysandbox-android-arm-eabi/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Android ${process.arch}`))
+    }
+  } else if (process.platform === 'win32') {
+    if (process.arch === 'x64') {
+      if ((process.config && process.config.variables && process.config.variables.shlib_suffix === 'dll.a') || (process.config && process.config.variables && process.config.variables.node_target_type === 'shared_library')) {
+        try {
+        return require('./tinysandbox-node.win32-x64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-win32-x64-gnu')
+        const bindingPackageVersion = require('tinysandbox-win32-x64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      } else {
+        try {
+        return require('./tinysandbox-node.win32-x64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-win32-x64-msvc')
+        const bindingPackageVersion = require('tinysandbox-win32-x64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      }
+    } else if (process.arch === 'ia32') {
+      try {
+        return require('./tinysandbox-node.win32-ia32-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-win32-ia32-msvc')
+        const bindingPackageVersion = require('tinysandbox-win32-ia32-msvc/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./tinysandbox-node.win32-arm64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-win32-arm64-msvc')
+        const bindingPackageVersion = require('tinysandbox-win32-arm64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Windows: ${process.arch}`))
+    }
+  } else if (process.platform === 'darwin') {
+    try {
+      return require('./tinysandbox-node.darwin-universal.node')
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    try {
+      const binding = require('tinysandbox-darwin-universal')
+      const bindingPackageVersion = require('tinysandbox-darwin-universal/package.json').version
+      if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      }
+      return binding
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    if (process.arch === 'x64') {
+      try {
+        return require('./tinysandbox-node.darwin-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-darwin-x64')
+        const bindingPackageVersion = require('tinysandbox-darwin-x64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./tinysandbox-node.darwin-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-darwin-arm64')
+        const bindingPackageVersion = require('tinysandbox-darwin-arm64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on macOS: ${process.arch}`))
+    }
+  } else if (process.platform === 'freebsd') {
+    if (process.arch === 'x64') {
+      try {
+        return require('./tinysandbox-node.freebsd-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-freebsd-x64')
+        const bindingPackageVersion = require('tinysandbox-freebsd-x64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./tinysandbox-node.freebsd-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-freebsd-arm64')
+        const bindingPackageVersion = require('tinysandbox-freebsd-arm64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on FreeBSD: ${process.arch}`))
+    }
+  } else if (process.platform === 'linux') {
+    if (process.arch === 'x64') {
+      if (isMusl()) {
+        try {
+          return require('./tinysandbox-node.linux-x64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-x64-musl')
+          const bindingPackageVersion = require('tinysandbox-linux-x64-musl/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./tinysandbox-node.linux-x64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-x64-gnu')
+          const bindingPackageVersion = require('tinysandbox-linux-x64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm64') {
+      if (isMusl()) {
+        try {
+          return require('./tinysandbox-node.linux-arm64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-arm64-musl')
+          const bindingPackageVersion = require('tinysandbox-linux-arm64-musl/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./tinysandbox-node.linux-arm64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-arm64-gnu')
+          const bindingPackageVersion = require('tinysandbox-linux-arm64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm') {
+      if (isMusl()) {
+        try {
+          return require('./tinysandbox-node.linux-arm-musleabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-arm-musleabihf')
+          const bindingPackageVersion = require('tinysandbox-linux-arm-musleabihf/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./tinysandbox-node.linux-arm-gnueabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-arm-gnueabihf')
+          const bindingPackageVersion = require('tinysandbox-linux-arm-gnueabihf/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'loong64') {
+      if (isMusl()) {
+        try {
+          return require('./tinysandbox-node.linux-loong64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-loong64-musl')
+          const bindingPackageVersion = require('tinysandbox-linux-loong64-musl/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./tinysandbox-node.linux-loong64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-loong64-gnu')
+          const bindingPackageVersion = require('tinysandbox-linux-loong64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'riscv64') {
+      if (isMusl()) {
+        try {
+          return require('./tinysandbox-node.linux-riscv64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-riscv64-musl')
+          const bindingPackageVersion = require('tinysandbox-linux-riscv64-musl/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./tinysandbox-node.linux-riscv64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('tinysandbox-linux-riscv64-gnu')
+          const bindingPackageVersion = require('tinysandbox-linux-riscv64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'ppc64') {
+      try {
+        return require('./tinysandbox-node.linux-ppc64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-linux-ppc64-gnu')
+        const bindingPackageVersion = require('tinysandbox-linux-ppc64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 's390x') {
+      try {
+        return require('./tinysandbox-node.linux-s390x-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-linux-s390x-gnu')
+        const bindingPackageVersion = require('tinysandbox-linux-s390x-gnu/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Linux: ${process.arch}`))
+    }
+  } else if (process.platform === 'openharmony') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./tinysandbox-node.openharmony-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-openharmony-arm64')
+        const bindingPackageVersion = require('tinysandbox-openharmony-arm64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'x64') {
+      try {
+        return require('./tinysandbox-node.openharmony-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-openharmony-x64')
+        const bindingPackageVersion = require('tinysandbox-openharmony-x64/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./tinysandbox-node.openharmony-arm.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('tinysandbox-openharmony-arm')
+        const bindingPackageVersion = require('tinysandbox-openharmony-arm/package.json').version
+        if (bindingPackageVersion !== '0.3.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.3.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on OpenHarmony: ${process.arch}`))
+    }
+  } else {
+    loadErrors.push(new Error(`Unsupported OS: ${process.platform}, architecture: ${process.arch}`))
+  }
+}
+
+nativeBinding = requireNative()
+
+// NAPI_RS_FORCE_WASI is a tri-state flag:
+//   unset / any other value → native binding preferred, WASI is only a fallback
+//   'true'                   → force WASI fallback even if native loaded
+//   'error'                  → force WASI and throw if no WASI binding is found
+// Treating any non-empty string as truthy (the historical behavior) meant
+// NAPI_RS_FORCE_WASI=false, NAPI_RS_FORCE_WASI=0, etc. inadvertently triggered
+// the WASI path, causing ENOENT for packages shipped without a .wasi.cjs file.
+const forceWasi =
+  process.env.NAPI_RS_FORCE_WASI === 'true' || process.env.NAPI_RS_FORCE_WASI === 'error'
+
+if (!nativeBinding || forceWasi) {
+  let wasiBinding = null
+  let wasiBindingError = null
+  try {
+    wasiBinding = require('./tinysandbox-node.wasi.cjs')
+    nativeBinding = wasiBinding
+  } catch (err) {
+    if (forceWasi) {
+      wasiBindingError = err
+    }
+  }
+  if (!nativeBinding || forceWasi) {
+    try {
+      wasiBinding = require('tinysandbox-wasm32-wasi')
+      nativeBinding = wasiBinding
+    } catch (err) {
+      if (forceWasi) {
+        if (!wasiBindingError) {
+          wasiBindingError = err
+        } else {
+          wasiBindingError.cause = err
+        }
+        loadErrors.push(err)
+      }
+    }
+  }
+  if (process.env.NAPI_RS_FORCE_WASI === 'error' && !wasiBinding) {
+    const error = new Error('WASI binding not found and NAPI_RS_FORCE_WASI is set to error')
+    error.cause = wasiBindingError
+    throw error
+  }
+}
+
+if (!nativeBinding) {
+  if (loadErrors.length > 0) {
+    const error = new Error(
+      `Cannot find native binding. ` +
+        `npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). ` +
+        'Please try `npm i` again after removing both package-lock.json and node_modules directory.',
+    )
+    // assign instead of the `new Error(message, { cause })` options form,
+    // which Node < 16.9 silently ignores
+    error.cause = loadErrors.reduce((err, cur) => {
+      cur.cause = err
+      return cur
+    })
+    throw error
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+module.exports = nativeBinding
+module.exports.NativeSandbox = nativeBinding.NativeSandbox
+module.exports.Sandbox = nativeBinding.Sandbox
+module.exports.SandboxFs = nativeBinding.SandboxFs
+module.exports.createJsVfs = nativeBinding.createJsVfs
+module.exports.runConformance = nativeBinding.runConformance

package/native.d.ts

@@ -0,0 +1,140 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+
+export declare class ExternalObject<T> {
+  readonly '': {
+    readonly '': unique symbol
+    [K: symbol]: T
+  }
+}
+export declare class NativeSandbox {
+  constructor(options?: object | undefined | null)
+  exec(script: string): Promise<ExecResult>
+  get fs(): SandboxFs
+  stats(): Promise<SandboxStats>
+}
+export type Sandbox = NativeSandbox
+
+export declare class SandboxFs {
+  stat(path: string): Promise<FileStat>
+  readdir(path: string): Promise<Array<DirEntryJs>>
+  mkdir(path: string): Promise<void>
+  rename(from: string, to: string): Promise<void>
+  unlink(path: string): Promise<void>
+  rmdir(path: string): Promise<void>
+  readFile(path: string): Promise<Buffer>
+  writeFile(path: string, data: Buffer): Promise<void>
+  appendFile(path: string, data: Buffer): Promise<void>
+  open(path: string, mode: OpenModeJs): Promise<number>
+  readAt(handle: number, offset: number, len: number): Promise<Buffer>
+  writeAt(handle: number, offset: number, data: Buffer): Promise<number>
+  truncate(handle: number, len: number): Promise<void>
+  close(handle: number): Promise<void>
+}
+
+export interface CommandCall {
+  args: Array<string>
+  env: Record<string, string>
+  cwd: string
+  stdin: Buffer
+}
+
+export interface CommandOutput {
+  exitCode?: number
+  stdout?: Buffer
+  stderr?: Buffer
+}
+
+export interface CommandTiming {
+  name: string
+  durationMs: number
+  exitCode: number
+}
+
+export interface ConformanceResult {
+  ok: boolean
+  snapshots: string
+}
+
+export declare function createJsVfs(vfs: object): ExternalObject<JsVfsExternal>
+
+export interface DirEntryJs {
+  name: string
+  fileType: string
+  len: number
+}
+
+export interface ExecResult {
+  stdout: string
+  stderr: string
+  exitCode: number
+  wallTimeMs: number
+  stdoutTruncated: boolean
+  stderrTruncated: boolean
+  pipeBytes: Array<number>
+  commands: Array<CommandTiming>
+  peakWasmMemoryBytes?: number
+}
+
+export interface FileStat {
+  fileType: string
+  len: number
+  isFile: boolean
+  isDir: boolean
+}
+
+export interface OpenModeJs {
+  read?: boolean
+  write?: boolean
+  create?: boolean
+  createNew?: boolean
+  truncate?: boolean
+  append?: boolean
+}
+
+export declare function runConformance(factory: (arg: [VfsQuotaJs]) => Promise<JsVfsHandle>): Promise<unknown>
+
+export interface SandboxStats {
+  commandsRun: number
+  vfs?: VfsStatsJs
+}
+
+export interface VfsCallbackError {
+  code?: string
+  message?: string
+}
+
+export interface VfsQuotaJs {
+  maxBytes: number
+  maxFiles: number
+  maxFileSize: number
+}
+
+export interface VfsRequest {
+  path?: string
+  from?: string
+  to?: string
+  mode?: OpenModeJs
+  handle?: number
+  offset?: number
+  len?: number
+  data?: Buffer
+}
+
+export interface VfsResponse {
+  fileType?: string
+  len?: number
+  entries?: Array<DirEntryJs>
+  handle?: number
+  bytesRead?: number
+  bytesWritten?: number
+  data?: Buffer
+  usedBytes?: number
+  fileCount?: number
+  error?: VfsCallbackError
+}
+
+export interface VfsStatsJs {
+  usedBytes: number
+  fileCount: number
+}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@tinysandbox/tinysandbox",
+  "version": "0.3.0",
+  "description": "Node.js bindings for the tinysandbox in-process AI agent sandbox",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "build": "napi build --platform --release --js native.cjs --dts native.d.ts",
+    "test": "npm run build && node --import tsx --test __test__/*.mjs",
+    "examples": "tsx examples/quickstart.ts && tsx examples/custom_command.ts && tsx examples/js_scripts.ts && tsx examples/js_vfs.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/danthegoodman1/tinysandbox.git",
+    "directory": "tinysandbox-node"
+  },
+  "keywords": [
+    "sandbox",
+    "agent",
+    "shell",
+    "vfs",
+    "quickjs"
+  ],
+  "author": "Dan Goodman",
+  "license": "MIT OR Apache-2.0",
+  "engines": {
+    "node": ">=20"
+  },
+  "bugs": {
+    "url": "https://github.com/danthegoodman1/tinysandbox/issues"
+  },
+  "homepage": "https://github.com/danthegoodman1/tinysandbox#readme",
+  "devDependencies": {
+    "@napi-rs/cli": "^3.7.2",
+    "@types/node": "^26.1.0",
+    "tsx": "^4.23.0"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "native.cjs",
+    "native.d.ts",
+    "*.node"
+  ],
+  "napi": {
+    "binaryName": "tinysandbox-node",
+    "packageName": "tinysandbox"
+  }
+}