agent-nuvira 1.14.0

package/dist/sandbox/images.js

@@ -0,0 +1,129 @@
+/**
+ * Sandbox images — Pre-defined Docker images for common programming languages.
+ *
+ * These are used as base images for sandbox containers. Each image definition
+ * includes the Docker image name, language/runtime details, and default
+ * install/test commands.
+ *
+ * Images are pulled on first use if not present locally.
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Pre-defined sandbox images for common runtimes.
+ */
+export const BUILTIN_SANDBOX_IMAGES = [
+    // ── Node.js ────────────────────────────────────────────────────────────
+    {
+        image: 'node:20-slim',
+        label: 'Node.js 20 (slim)',
+        runtimes: ['node', 'npm', 'npx'],
+        installCommand: 'npm install',
+        testCommand: 'npm test',
+        shell: '/bin/bash',
+    },
+    {
+        image: 'node:20',
+        label: 'Node.js 20 (full)',
+        runtimes: ['node', 'npm', 'npx'],
+        installCommand: 'npm install',
+        testCommand: 'npm test',
+        shell: '/bin/bash',
+    },
+    {
+        image: 'node:18-slim',
+        label: 'Node.js 18 (slim)',
+        runtimes: ['node', 'npm', 'npx'],
+        installCommand: 'npm install',
+        testCommand: 'npm test',
+        shell: '/bin/bash',
+    },
+    // ── Python ─────────────────────────────────────────────────────────────
+    {
+        image: 'python:3.12-slim',
+        label: 'Python 3.12 (slim)',
+        runtimes: ['python3', 'pip3'],
+        installCommand: 'pip install -r requirements.txt 2>/dev/null; pip install pytest 2>/dev/null',
+        testCommand: 'python -m pytest -v 2>&1 || python -m unittest discover 2>&1',
+        shell: '/bin/bash',
+    },
+    {
+        image: 'python:3.11-slim',
+        label: 'Python 3.11 (slim)',
+        runtimes: ['python3', 'pip3'],
+        installCommand: 'pip install -r requirements.txt 2>/dev/null; pip install pytest 2>/dev/null',
+        testCommand: 'python -m pytest -v 2>&1 || python -m unittest discover 2>&1',
+        shell: '/bin/bash',
+    },
+    // ── Go ─────────────────────────────────────────────────────────────────
+    {
+        image: 'golang:1.22',
+        label: 'Go 1.22',
+        runtimes: ['go'],
+        installCommand: 'go mod download 2>/dev/null',
+        testCommand: 'go test ./... 2>&1',
+        shell: '/bin/bash',
+    },
+    // ── Rust ───────────────────────────────────────────────────────────────
+    {
+        image: 'rust:1.77-slim',
+        label: 'Rust 1.77 (slim)',
+        runtimes: ['cargo', 'rustc'],
+        installCommand: 'cargo fetch 2>/dev/null',
+        testCommand: 'cargo test 2>&1',
+        shell: '/bin/bash',
+    },
+    // ── Universal (multi-runtime) ──────────────────────────────────────────
+    {
+        image: 'ubuntu:22.04',
+        label: 'Ubuntu 22.04 (universal)',
+        runtimes: ['bash', 'sh', 'apt-get'],
+        installCommand: 'apt-get update -qq && apt-get install -y -qq curl wget git 2>/dev/null',
+        testCommand: 'echo "No default test command for universal image"',
+        shell: '/bin/bash',
+    },
+];
+/**
+ * Find a built-in sandbox image by language/runtime name (case-insensitive).
+ *
+ * Examples:
+ *   resolveSandboxImage('node')        → node:20-slim
+ *   resolveSandboxImage('python')      → python:3.12-slim
+ *   resolveSandboxImage('go')          → golang:1.22
+ *   resolveSandboxImage('golang')      → golang:1.22
+ *   resolveSandboxImage('rust')        → rust:1.77-slim
+ */
+export function resolveSandboxImage(runtime) {
+    const normalized = runtime.toLowerCase().trim();
+    // Exact match on label
+    const byLabel = BUILTIN_SANDBOX_IMAGES.find((img) => img.label.toLowerCase().includes(normalized));
+    if (byLabel)
+        return byLabel;
+    // Match on runtimes
+    const byRuntime = BUILTIN_SANDBOX_IMAGES.find((img) => img.runtimes.some((r) => r.includes(normalized)));
+    if (byRuntime)
+        return byRuntime;
+    // Match on image name
+    const byImage = BUILTIN_SANDBOX_IMAGES.find((img) => img.image.toLowerCase().includes(normalized));
+    if (byImage)
+        return byImage;
+    return undefined;
+}
+/**
+ * Get the default sandbox image based on detected project type.
+ * Checks for common project files to determine runtime.
+ */
+export function detectProjectImage(projectDir) {
+    // Check for common project files
+    if (existsSync(join(projectDir, 'package.json')))
+        return BUILTIN_SANDBOX_IMAGES[0]; // node:20-slim
+    if (existsSync(join(projectDir, 'requirements.txt')) || existsSync(join(projectDir, 'setup.py')) || existsSync(join(projectDir, 'Pipfile')))
+        return BUILTIN_SANDBOX_IMAGES[3]; // python:3.12-slim
+    if (existsSync(join(projectDir, 'go.mod')))
+        return BUILTIN_SANDBOX_IMAGES[5]; // golang:1.22
+    if (existsSync(join(projectDir, 'Cargo.toml')))
+        return BUILTIN_SANDBOX_IMAGES[6]; // rust:1.77-slim
+    // Fall back to Node.js (most common for agent-nuvira)
+    return BUILTIN_SANDBOX_IMAGES[0];
+}
+//# sourceMappingURL=images.js.map

package/dist/sandbox/images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.js","sourceRoot":"","sources":["../../src/sandbox/images.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,0EAA0E;IAC1E;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAChC,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,WAAW;KACnB;IACD;QACE,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAChC,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,WAAW;KACnB;IACD;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAChC,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,WAAW;KACnB;IAED,0EAA0E;IAC1E;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,6EAA6E;QAC7F,WAAW,EAAE,8DAA8D;QAC3E,KAAK,EAAE,WAAW;KACnB;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,6EAA6E;QAC7F,WAAW,EAAE,8DAA8D;QAC3E,KAAK,EAAE,WAAW;KACnB;IAED,0EAA0E;IAC1E;QACE,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,CAAC,IAAI,CAAC;QAChB,cAAc,EAAE,6BAA6B;QAC7C,WAAW,EAAE,oBAAoB;QACjC,KAAK,EAAE,WAAW;KACnB;IAED,0EAA0E;IAC1E;QACE,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,cAAc,EAAE,yBAAyB;QACzC,WAAW,EAAE,iBAAiB;QAC9B,KAAK,EAAE,WAAW;KACnB;IAED,0EAA0E;IAC1E;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;QACnC,cAAc,EAAE,wEAAwE;QACxF,WAAW,EAAE,oDAAoD;QACjE,KAAK,EAAE,WAAW;KACnB;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,uBAAuB;IACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtD,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,oBAAoB;IACpB,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,sBAAsB;IACtB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtD,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,iCAAiC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;IACnG,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAClM,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;IAC5F,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;IAEnG,sDAAsD;IACtD,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/sandbox/manager.d.ts

@@ -0,0 +1,134 @@
+/**
+ * SandboxManager — Docker-based sandbox isolation for code execution.
+ *
+ * Provides:
+ * - Container lifecycle management (create, exec, destroy)
+ * - Resource limits (CPU, memory, disk, PIDs, network)
+ * - Volume/project mounting
+ * - Command execution with timeout enforcement
+ * - Non-root user execution
+ *
+ * Usage:
+ * ```ts
+ * const manager = new SandboxManager();
+ *
+ * // Check if Docker is available
+ * const available = await manager.isDockerAvailable();
+ *
+ * // Create a sandbox
+ * const containerId = await manager.createContainer('node:20-slim', {
+ *   memoryLimit: '512m',
+ *   cpuLimit: 1,
+ *   networkAccess: false,
+ * });
+ *
+ * // Copy project, run commands
+ * await manager.copyProjectToContainer(containerId, '/path/to/project');
+ * const result = await manager.runCommand(containerId, 'npm test');
+ *
+ * // Always clean up
+ * await manager.destroyContainer(containerId);
+ * ```
+ */
+import type { ResourceLimits, SandboxConfig, SandboxExecResult, ManagedContainer, ContainerStatus } from './types.js';
+export declare class SandboxManager {
+    private config;
+    /** Managed containers tracked by this manager instance */
+    private containers;
+    /** Whether Docker availability has been checked */
+    private dockerChecked;
+    /** Cached result of Docker availability check */
+    private dockerAvailable;
+    /** Cached error message from Docker check */
+    private dockerError;
+    constructor(config?: SandboxConfig);
+    /**
+     * Check if Docker is installed and the daemon is running.
+     * Caches the result so repeated calls are instant.
+     */
+    isDockerAvailable(): Promise<boolean>;
+    /**
+     * Get the error message from the last Docker availability check.
+     */
+    getDockerError(): string;
+    /**
+     * Force re-check Docker availability on the next call.
+     */
+    resetDockerCheck(): void;
+    /**
+     * Create a Docker sandbox container with the given image and resource limits.
+     *
+     * @param image - Docker image to use (e.g., 'node:20-slim')
+     * @param limits - Resource limit overrides
+     * @param workDir - Working directory inside the container
+     * @returns The container ID
+     */
+    createContainer(image?: string, limits?: Partial<ResourceLimits>, workDir?: string): Promise<string>;
+    /**
+     * Copy project files (or a specific directory) into the sandbox container.
+     *
+     * Uses `docker cp` to copy files into the container's working directory.
+     *
+     * @param containerId - Container ID
+     * @param sourceDir - Source directory on the host
+     * @param targetDir - Target directory inside container (defaults to workDir)
+     */
+    copyProjectToContainer(containerId: string, sourceDir: string, targetDir?: string): Promise<void>;
+    /**
+     * Execute a command inside the sandbox container with timeout enforcement.
+     *
+     * @param containerId - Container ID
+     * @param command - Command to execute (as a string, passed to /bin/sh -c)
+     * @param timeoutMs - Timeout in milliseconds (default: config timeout)
+     * @returns Execution result with stdout, stderr, exit code
+     */
+    runCommand(containerId: string, command: string, timeoutMs?: number): Promise<SandboxExecResult>;
+    /**
+     * Run a command and stream its stdout output (for long-running commands).
+     * Calls onChunk for each line of stdout.
+     */
+    runCommandWithOutput(containerId: string, command: string, onChunk?: (chunk: string) => void, timeoutMs?: number): Promise<SandboxExecResult>;
+    /**
+     * Get the status of a managed container.
+     */
+    getContainerStatus(containerId: string): Promise<ContainerStatus>;
+    /**
+     * Stop and remove a sandbox container.
+     */
+    destroyContainer(containerId: string): Promise<void>;
+    /**
+     * Destroy all managed containers.
+     */
+    destroyAll(): Promise<void>;
+    /**
+     * Get information about all managed containers.
+     */
+    getManagedContainers(): ManagedContainer[];
+    /**
+     * Ensure a container ID is tracked and still exists.
+     */
+    private ensureContainer;
+    /**
+     * Run a command on the host machine (not inside a container).
+     * Used for docker CLI operations.
+     */
+    private execHostCommand;
+    /**
+     * Execute a command inside a container using docker exec.
+     * Used internally for setup operations like mkdir.
+     */
+    private execInContainer;
+    /**
+     * Remove containers that have been managed for more than 30 minutes.
+     */
+    private cleanupStaleContainers;
+}
+/**
+ * Get or create the default SandboxManager singleton.
+ */
+export declare function getSandboxManager(): SandboxManager;
+/**
+ * Reset the default SandboxManager singleton (useful for testing).
+ */
+export declare function resetSandboxManager(): void;
+//# sourceMappingURL=manager.d.ts.map

package/dist/sandbox/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AASH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAkBpB,qBAAa,cAAc;IAUb,OAAO,CAAC,MAAM;IAT1B,0DAA0D;IAC1D,OAAO,CAAC,UAAU,CAA4C;IAC9D,mDAAmD;IACnD,OAAO,CAAC,aAAa,CAAS;IAC9B,iDAAiD;IACjD,OAAO,CAAC,eAAe,CAAS;IAChC,6CAA6C;IAC7C,OAAO,CAAC,WAAW,CAAM;gBAEL,MAAM,GAAE,aAAkC;IAI9D;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IAgB3C;;OAEG;IACH,cAAc,IAAI,MAAM;IAIxB;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAMxB;;;;;;;OAOG;IACG,eAAe,CACnB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAChC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAkGlB;;;;;;;;OAQG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IA+ChB;;;;;;;OAOG;IACG,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC;IA6C7B;;;OAGG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EACjC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC;IAmE7B;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAoBvE;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B1D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;OAEG;IACH,oBAAoB,IAAI,gBAAgB,EAAE;IAM1C;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;;OAGG;YACW,eAAe;IAoC7B;;;OAGG;YACW,eAAe;IAW7B;;OAEG;YACW,sBAAsB;CAcrC;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAKlD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}