isol8 0.10.1 → 0.10.2

package/README.md

@@ -183,11 +183,42 @@ const result = await isol8.execute({
 
 console.log(result.stdout);  // "Hello from isol8!"
 console.log(result.exitCode); // 0
-console.log(result.durationMs); // ~38-69ms (warm pool)
+console.log(result.durationMs); // ~120-140ms (warm pool)
 
 await isol8.stop();
 ```
 
+### Pool Strategy
+
+isol8 supports two pool strategies for container reuse:
+
+```typescript
+// Fast mode (default) - best performance
+// Uses dual-pool system: clean pool + dirty pool
+// Instant acquire from clean pool, immediate cleanup on acquire if needed
+// Background cleanup runs every 5 seconds
+const fastEngine = new DockerIsol8({
+  network: "none",
+  poolStrategy: "fast",
+  poolSize: { clean: 2, dirty: 2 },  // 2 ready, 2 being cleaned
+});
+
+// Secure mode - cleanup in acquire
+// Slower but ensures container is always clean before use
+const secureEngine = new DockerIsol8({
+  network: "none",
+  poolStrategy: "secure",
+  poolSize: 2,  // 2 warm containers
+});
+```
+
+**Fast mode details:**
+- Maintains two pools: `clean` (ready to use) and `dirty` (need cleanup)
+- `acquire()` returns instantly from clean pool if available
+- If clean pool is empty but dirty has containers, tries immediate cleanup
+- Background cleanup runs every 5 seconds to process dirty containers
+- Best performance with minimal memory overhead
+
 ### Persistent Sessions
 
 ```typescript
@@ -328,7 +359,7 @@ Full schema: [`schema/isol8.config.schema.json`](./schema/isol8.config.schema.js
 
 ## Benchmarks
 
-Execution latency for a "hello world" script per runtime. Measured on Apple Silicon (Docker Desktop), averaged across multiple runs. Results will vary by machine.
+Execution latency for a "hello world" script per runtime. Measured on Apple Silicon (OrbStack), averaged across multiple runs. Results will vary by machine.
 
 ### Cold Start (fresh engine per run)
 
@@ -336,11 +367,11 @@ Each run creates a new `DockerIsol8` instance, executes, and tears down.
 
 | Runtime | Min | Median | Max | Avg |
 |---------|-----|--------|-----|-----|
-| Python | 111ms | 120ms | 188ms | 140ms |
-| Node.js | 114ms | 126ms | 178ms | 130ms |
-| Bun | 104ms | 121ms | 196ms | 139ms |
-| Deno | 112ms | 122ms | 199ms | 139ms |
-| Bash | 104ms | 114ms | 152ms | 121ms |
+| Python | 220ms | 280ms | 350ms | 280ms |
+| Node.js | 200ms | 250ms | 320ms | 260ms |
+| Bun | 180ms | 230ms | 300ms | 230ms |
+| Deno | 210ms | 270ms | 340ms | 270ms |
+| Bash | 180ms | 220ms | 280ms | 220ms |
 
 ### Warm Pool (reused engine)
 
@@ -348,11 +379,11 @@ A single `DockerIsol8` instance reused across 5 runs. The first run is cold (poo
 
 | Runtime | Cold | Warm Avg | Warm Min | Speedup |
 |---------|------|----------|----------|---------|
-| Python | 198ms | 56ms | 49ms | 4.1x |
-| Node.js | 145ms | 69ms | 60ms | 2.4x |
-| Bun | 152ms | 51ms | 45ms | 3.4x |
-| Deno | 128ms | 62ms | 54ms | 2.4x |
-| Bash | 124ms | 43ms | 38ms | 3.3x |
+| Python | 300ms | 160ms | 130ms | 2.3x |
+| Node.js | 280ms | 170ms | 140ms | 2.0x |
+| Bun | 250ms | 155ms | 130ms | 1.9x |
+| Deno | 270ms | 160ms | 140ms | 1.9x |
+| Bash | 230ms | 145ms | 125ms | 1.8x |
 
 ### Execution Phase Breakdown
 

package/dist/cli.js

@@ -55213,47 +55213,129 @@ class Semaphore {
 // src/engine/pool.ts
 class ContainerPool {
   docker;
-  poolSize;
+  poolStrategy;
+  cleanPoolSize;
+  dirtyPoolSize;
   createOptions;
+  networkMode;
+  securityMode;
   pools = new Map;
   replenishing = new Set;
   pendingReplenishments = new Set;
+  cleaningInterval = null;
   constructor(options) {
     this.docker = options.docker;
-    this.poolSize = options.poolSize ?? 2;
+    this.poolStrategy = options.poolStrategy ?? "fast";
     this.createOptions = options.createOptions;
+    this.networkMode = options.networkMode;
+    this.securityMode = options.securityMode;
+    if (typeof options.poolSize === "number") {
+      this.cleanPoolSize = options.poolSize;
+      this.dirtyPoolSize = options.poolSize;
+    } else if (options.poolSize) {
+      this.cleanPoolSize = options.poolSize.clean ?? 1;
+      this.dirtyPoolSize = options.poolSize.dirty ?? 1;
+    } else {
+      this.cleanPoolSize = 1;
+      this.dirtyPoolSize = 1;
+    }
+    if (this.poolStrategy === "fast") {
+      this.startBackgroundCleaning();
+    }
   }
   async acquire(image) {
-    const pool = this.pools.get(image);
-    if (pool && pool.length > 0) {
-      const entry = pool.shift();
+    const pool = this.pools.get(image) ?? { clean: [], dirty: [] };
+    if (this.poolStrategy === "fast") {
+      if (pool.clean.length > 0) {
+        const entry = pool.clean.shift();
+        this.pools.set(image, pool);
+        this.replenish(image);
+        return entry.container;
+      }
+      if (pool.dirty.length > 0 && pool.clean.length < this.cleanPoolSize) {
+        await this.cleanDirtyImmediate(image);
+        const updatedPool = this.pools.get(image);
+        if (updatedPool && updatedPool.clean.length > 0) {
+          const entry = updatedPool.clean.shift();
+          this.pools.set(image, updatedPool);
+          this.replenish(image);
+          return entry.container;
+        }
+      }
+      return this.createContainer(image);
+    }
+    if (pool.clean && pool.clean.length > 0) {
+      const entry = pool.clean.shift();
+      this.pools.set(image, { clean: pool.clean, dirty: [] });
+      await this.cleanupContainer(entry.container);
       this.replenish(image);
       return entry.container;
     }
     return this.createContainer(image);
   }
   async release(container, image) {
-    const pool = this.pools.get(image) ?? [];
-    if (pool.length >= this.poolSize) {
-      await container.remove({ force: true }).catch(() => {});
+    let pool = this.pools.get(image);
+    if (!pool) {
+      pool = { clean: [], dirty: [] };
+      this.pools.set(image, pool);
+    }
+    if (this.poolStrategy === "fast") {
+      if (pool.dirty.length >= this.dirtyPoolSize) {
+        await container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      pool.dirty.push({ container, createdAt: Date.now() });
+    } else {
+      if (pool.clean.length >= this.cleanPoolSize) {
+        await container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      if (!pool.clean) {
+        pool.clean = [];
+      }
+      pool.clean.push({ container, createdAt: Date.now() });
+    }
+  }
+  startBackgroundCleaning() {
+    this.cleaningInterval = setInterval(async () => {
+      for (const [_image, pool] of this.pools) {
+        for (let i = 0;i < this.dirtyPoolSize; i++) {
+          if (pool.dirty.length > 0 && pool.clean.length < this.cleanPoolSize) {
+            const entry = pool.dirty.shift();
+            try {
+              await this.cleanupContainer(entry.container);
+              pool.clean.push(entry);
+            } catch {
+              entry.container.remove({ force: true }).catch(() => {});
+            }
+          }
+        }
+      }
+    }, 5000);
+  }
+  async cleanDirtyImmediate(image) {
+    const pool = this.pools.get(image);
+    if (!pool || pool.dirty.length === 0 || pool.clean.length >= this.cleanPoolSize) {
       return;
     }
+    const entry = pool.dirty.shift();
     try {
-      const killExec = await container.exec({
-        Cmd: [
-          "sh",
-          "-c",
-          "pkill -9 -u sandbox 2>/dev/null; /usr/sbin/iptables -F OUTPUT 2>/dev/null; true"
-        ]
-      });
-      await killExec.start({ Detach: true });
-      let killInfo = await killExec.inspect();
-      while (killInfo.Running) {
-        await new Promise((r) => setTimeout(r, 5));
-        killInfo = await killExec.inspect();
-      }
+      await this.cleanupContainer(entry.container);
+      pool.clean.push(entry);
+    } catch {
+      entry.container.remove({ force: true }).catch(() => {});
+    }
+  }
+  async cleanupContainer(container) {
+    const needsCleanup = this.securityMode === "strict";
+    const needsIptables = this.networkMode === "filtered" && needsCleanup;
+    if (!needsCleanup) {
+      return;
+    }
+    try {
+      const cleanupCmd = needsIptables ? "pkill -9 -u sandbox 2>/dev/null; /usr/sbin/iptables -F OUTPUT 2>/dev/null; rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true" : "pkill -9 -u sandbox 2>/dev/null; rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true";
       const cleanExec = await container.exec({
-        Cmd: ["sh", "-c", "rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true"]
+        Cmd: ["sh", "-c", cleanupCmd]
       });
       await cleanExec.start({ Detach: true });
       let info2 = await cleanExec.inspect();
@@ -55261,29 +55343,45 @@ class ContainerPool {
         await new Promise((r) => setTimeout(r, 5));
         info2 = await cleanExec.inspect();
       }
-      pool.push({ container, createdAt: Date.now() });
-      this.pools.set(image, pool);
-    } catch {
-      await container.remove({ force: true }).catch(() => {});
-    }
+    } catch {}
   }
   async warm(image) {
-    const pool = this.pools.get(image) ?? [];
+    const pool = this.pools.get(image) ?? { clean: [], dirty: [] };
     this.pools.set(image, pool);
-    const needed = this.poolSize - pool.length;
+    const needed = this.poolStrategy === "fast" ? this.cleanPoolSize - pool.clean.length : this.cleanPoolSize - (pool.clean?.length ?? 0);
+    if (needed <= 0) {
+      return;
+    }
     const promises = [];
     for (let i = 0;i < needed; i++) {
       promises.push(this.createContainer(image).then((container) => {
-        pool.push({ container, createdAt: Date.now() });
+        if (this.poolStrategy === "fast") {
+          pool.clean.push({ container, createdAt: Date.now() });
+        } else {
+          if (!pool.clean) {
+            pool.clean = [];
+          }
+          pool.clean.push({ container, createdAt: Date.now() });
+        }
       }));
     }
     await Promise.all(promises);
   }
+  async stop() {
+    return this.drain();
+  }
   async drain() {
+    if (this.cleaningInterval) {
+      clearInterval(this.cleaningInterval);
+      this.cleaningInterval = null;
+    }
     await Promise.all(this.pendingReplenishments);
     const promises = [];
     for (const [, pool] of this.pools) {
-      for (const entry of pool) {
+      for (const entry of pool.clean ?? []) {
+        promises.push(entry.container.remove({ force: true }).catch(() => {}));
+      }
+      for (const entry of pool.dirty) {
         promises.push(entry.container.remove({ force: true }).catch(() => {}));
       }
     }
@@ -55302,30 +55400,46 @@ class ContainerPool {
   }
   replenish(image) {
     if (this.replenishing.has(image)) {
-      logger.debug(`[Pool] Replenishment for ${image} already in progress`);
-      return;
-    }
-    this.replenishing.add(image);
-    logger.debug(`[Pool] Starting background replenishment for image: ${image}`);
-    const promise = this.createContainer(image).then((container) => {
-      const pool = this.pools.get(image) ?? [];
-      if (pool.length < this.poolSize) {
-        pool.push({ container, createdAt: Date.now() });
-        this.pools.set(image, pool);
-        logger.debug(`[Pool] Replenished container ${container.id} added to pool for ${image}. Pool size: ${pool.length}`);
-      } else {
-        logger.debug(`[Pool] Replenished container ${container.id} not needed (pool for ${image} is full), destroying`);
-        container.remove({ force: true }).catch((err) => {
-          logger.error(`[Pool] Error destroying unneeded replenished container ${container.id}:`, err);
-        });
+      if (this.replenishing.has(image)) {
+        return;
       }
-    }).catch((err) => {
-      logger.error(`[Pool] Error during replenishment for ${image}:`, err);
-    }).finally(() => {
-      this.replenishing.delete(image);
-      this.pendingReplenishments.delete(promise);
-    });
-    this.pendingReplenishments.add(promise);
+      const pool = this.pools.get(image);
+      const currentSize = pool ? this.poolStrategy === "fast" ? pool.clean.length : pool.clean?.length ?? 0 : 0;
+      const targetSize = this.poolStrategy === "fast" ? this.cleanPoolSize : this.cleanPoolSize;
+      if (currentSize >= targetSize) {
+        return;
+      }
+      this.replenishing.add(image);
+      const promise = this.createContainer(image).then((container) => {
+        const p = this.pools.get(image);
+        if (!p) {
+          container.remove({ force: true }).catch(() => {});
+          return;
+        }
+        if (this.poolStrategy === "fast") {
+          if (p.clean.length < this.cleanPoolSize) {
+            p.clean.push({ container, createdAt: Date.now() });
+          } else {
+            container.remove({ force: true }).catch(() => {});
+          }
+        } else {
+          if (!p.clean) {
+            p.clean = [];
+          }
+          if (p.clean.length < this.cleanPoolSize) {
+            p.clean.push({ container, createdAt: Date.now() });
+          } else {
+            container.remove({ force: true }).catch(() => {});
+          }
+        }
+      }).catch((err) => {
+        logger.error(`[Pool] Error during replenishment for ${image}:`, err);
+      }).finally(() => {
+        this.replenishing.delete(image);
+        this.pendingReplenishments.delete(promise);
+      });
+      this.pendingReplenishments.add(promise);
+    }
   }
 }
 var init_pool = __esm(() => {
@@ -55487,31 +55601,52 @@ var exports_docker = {};
 __export(exports_docker, {
   DockerIsol8: () => DockerIsol8
 });
-import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
 import { PassThrough } from "node:stream";
 async function writeFileViaExec(container, filePath, content) {
   const data = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
-  return new Promise((resolve2, reject) => {
-    const child = spawn2("docker", ["exec", "-i", "-u", "sandbox", container.id, "sh", "-c", `cat > ${filePath}`], {
-      stdio: ["pipe", "ignore", "pipe"]
-    });
-    child.on("error", (err) => {
-      reject(new Error(`Failed to spawn docker exec: ${err.message}`));
+  const b64 = data.toString("base64");
+  if (b64.length < 20000) {
+    const exec = await container.exec({
+      Cmd: ["sh", "-c", `printf '%s' '${b64}' | base64 -d > ${filePath}`],
+      User: "sandbox"
     });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => stderr += chunk.toString());
-    child.stdin.write(data);
-    child.stdin.end();
-    child.on("close", (code) => {
-      if (code !== 0) {
-        reject(new Error(`Failed to write file ${filePath}: ${stderr} (exit code ${code})`));
-      } else {
-        resolve2();
-      }
+    await exec.start({ Detach: true });
+    let info3 = await exec.inspect();
+    while (info3.Running) {
+      await new Promise((r) => setTimeout(r, 5));
+      info3 = await exec.inspect();
+    }
+    if (info3.ExitCode !== 0) {
+      throw new Error(`Failed to write file ${filePath} in container (exit code ${info3.ExitCode})`);
+    }
+    return;
+  }
+  const tempPath = `/tmp/b64_${Date.now()}.tmp`;
+  const chunkSize = 8000;
+  for (let i = 0;i < b64.length; i += chunkSize) {
+    const chunk = b64.slice(i, i + chunkSize);
+    const exec = await container.exec({
+      Cmd: ["sh", "-c", `printf '%s' '${chunk}' >> ${tempPath}`],
+      User: "sandbox"
     });
+    await exec.start({ Detach: true });
+    await exec.inspect();
+  }
+  const decodeExec = await container.exec({
+    Cmd: ["sh", "-c", `base64 -d ${tempPath} > ${filePath} && rm ${tempPath}`],
+    User: "sandbox"
   });
+  await decodeExec.start({ Detach: true });
+  let info2 = await decodeExec.inspect();
+  while (info2.Running) {
+    await new Promise((r) => setTimeout(r, 5));
+    info2 = await decodeExec.inspect();
+  }
+  if (info2.ExitCode !== 0) {
+    throw new Error(`Failed to write file ${filePath} in container (exit code ${info2.ExitCode})`);
+  }
 }
 async function readFileViaExec(container, filePath) {
   const exec = await container.exec({
@@ -55681,10 +55816,13 @@ class DockerIsol8 {
   security;
   persist;
   logNetwork;
+  poolStrategy;
+  poolSize;
   auditLogger;
   container = null;
   persistentRuntime = null;
   pool = null;
+  imageCache = new Map;
   constructor(options = {}, maxConcurrent = 10) {
     this.docker = options.docker ?? new import_dockerode.default;
     this.mode = options.mode ?? "ephemeral";
@@ -55704,6 +55842,8 @@ class DockerIsol8 {
     this.persist = options.persist ?? false;
     this.security = options.security ?? { seccomp: "strict" };
     this.logNetwork = options.logNetwork ?? false;
+    this.poolStrategy = options.poolStrategy ?? "fast";
+    this.poolSize = options.poolSize ?? { clean: 1, dirty: 1 };
     if (options.audit) {
       this.auditLogger = new AuditLogger(options.audit);
     }
@@ -55953,13 +56093,21 @@ class DockerIsol8 {
     if (this.overrideImage) {
       return this.overrideImage;
     }
+    const cacheKey = adapter.image;
+    const cached = this.imageCache.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
     const customTag = `${adapter.image}-custom`;
+    let resolvedImage;
     try {
       await this.docker.getImage(customTag).inspect();
-      return customTag;
+      resolvedImage = customTag;
     } catch {
-      return adapter.image;
+      resolvedImage = adapter.image;
     }
+    this.imageCache.set(cacheKey, resolvedImage);
+    return resolvedImage;
   }
   async executeEphemeral(req, startTime) {
     const adapter = this.getAdapter(req.runtime);
@@ -55968,7 +56116,10 @@ class DockerIsol8 {
     if (!this.pool) {
       this.pool = new ContainerPool({
         docker: this.docker,
-        poolSize: 2,
+        poolStrategy: this.poolStrategy,
+        poolSize: this.poolSize,
+        networkMode: this.network,
+        securityMode: this.security.seccomp ?? "strict",
         createOptions: {
           Cmd: ["sleep", "infinity"],
           WorkingDir: SANDBOX_WORKDIR,
@@ -56070,7 +56221,10 @@ class DockerIsol8 {
       if (this.persist) {
         logger.debug(`[Persist] Leaving container running for inspection: ${container.id}`);
       } else {
-        await this.pool.release(container, image);
+        this.pool.release(container, image).catch((err) => {
+          logger.debug(`[Pool] release failed: ${err}`);
+          container.remove({ force: true }).catch(() => {});
+        });
       }
     }
   }
@@ -56483,7 +56637,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "isol8",
-    version: "0.10.0",
+    version: "0.10.1",
     description: "Secure code execution engine for AI agents",
     author: "Illusion47586",
     license: "MIT",
@@ -62020,7 +62174,7 @@ program2.command("setup").description("Check Docker and build isol8 images").opt
   console.log(`
 [DONE] Setup complete!`);
 });
-program2.command("run").description("Execute code in isol8").argument("[file]", "Script file to execute").option("-e, --eval <code>", "Execute inline code string").option("-r, --runtime <name>", "Force runtime (python, node, bun, deno, bash)").option("--net <mode>", "Network mode: none, host, filtered", "none").option("--allow <regex>", "Whitelist regex for filtered mode (repeatable)", collect, []).option("--deny <regex>", "Blacklist regex for filtered mode (repeatable)", collect, []).option("--out <file>", "Write output to file").option("--persistent", "Use persistent container").option("--timeout <ms>", "Execution timeout in milliseconds").option("--memory <limit>", "Memory limit (e.g. 512m, 1g)").option("--cpu <limit>", "CPU limit as fraction (e.g. 0.5, 2.0)").option("--image <name>", "Override Docker image").option("--pids-limit <n>", "Maximum number of processes").option("--writable", "Disable read-only root filesystem").option("--max-output <bytes>", "Maximum output size in bytes").option("--secret <KEY=VALUE>", "Secret env var (repeatable, values masked)", collect, []).option("--sandbox-size <size>", "Sandbox tmpfs size (e.g. 128m)").option("--tmp-size <size>", "Tmp tmpfs size (e.g. 256m, 512m)").option("--stdin <data>", "Data to pipe to stdin").option("--install <package>", "Install package for runtime (repeatable)", collect, []).option("--host <url>", "Execute on remote server").option("--key <key>", "API key for remote server").option("--no-stream", "Disable real-time output streaming").option("--debug", "Enable debug logging").option("--persist", "Keep container running after execution for inspection").option("--log-network", "Log all network requests (requires --net filtered)").action(async (file, opts) => {
+program2.command("run").description("Execute code in isol8").argument("[file]", "Script file to execute").option("-e, --eval <code>", "Execute inline code string").option("-r, --runtime <name>", "Force runtime (python, node, bun, deno, bash)").option("--net <mode>", "Network mode: none, host, filtered", "none").option("--allow <regex>", "Whitelist regex for filtered mode (repeatable)", collect, []).option("--deny <regex>", "Blacklist regex for filtered mode (repeatable)", collect, []).option("--out <file>", "Write output to file").option("--persistent", "Use persistent container").option("--timeout <ms>", "Execution timeout in milliseconds").option("--memory <limit>", "Memory limit (e.g. 512m, 1g)").option("--cpu <limit>", "CPU limit as fraction (e.g. 0.5, 2.0)").option("--image <name>", "Override Docker image").option("--pids-limit <n>", "Maximum number of processes").option("--writable", "Disable read-only root filesystem").option("--max-output <bytes>", "Maximum output size in bytes").option("--secret <KEY=VALUE>", "Secret env var (repeatable, values masked)", collect, []).option("--sandbox-size <size>", "Sandbox tmpfs size (e.g. 128m, 512m)").option("--tmp-size <size>", "Tmp tmpfs size (e.g. 256m, 512m)").option("--stdin <data>", "Data to pipe to stdin").option("--install <package>", "Install package for runtime (repeatable)", collect, []).option("--host <url>", "Execute on remote server").option("--key <key>", "API key for remote server").option("--no-stream", "Disable real-time output streaming").option("--debug", "Enable debug logging").option("--persist", "Keep container running after execution for inspection").option("--log-network", "Log all network requests (requires --net filtered)").option("--pool-strategy <mode>", "Pool strategy: fast (default) or secure", "fast").option("--pool-size <size>", "Pool size (number or 'clean,dirty' for fast mode)", "1,1").action(async (file, opts) => {
   const { code, runtime, engineOptions, engine, stdinData, fileExtension } = await resolveRunInput(file, opts);
   logger.debug(`[Run] Runtime: ${runtime}, mode: ${engineOptions.mode}`);
   logger.debug(`[Run] Network: ${engineOptions.network}, timeout: ${engineOptions.timeoutMs}ms`);
@@ -62457,7 +62611,12 @@ async function resolveRunInput(file, opts) {
     ...opts.tmpSize ? { tmpSize: opts.tmpSize } : {},
     debug: opts.debug ?? config.debug,
     persist: opts.persist ?? false,
-    ...opts.logNetwork ? { logNetwork: true } : {}
+    ...opts.logNetwork ? { logNetwork: true } : {},
+    poolStrategy: opts.poolStrategy === "secure" ? "secure" : "fast",
+    poolSize: opts.poolSize ? opts.poolSize.includes(",") ? {
+      clean: Number.parseInt(opts.poolSize.split(",")[0], 10),
+      dirty: Number.parseInt(opts.poolSize.split(",")[1], 10)
+    } : Number.parseInt(opts.poolSize, 10) : { clean: 1, dirty: 1 }
   };
   logger.debug(`[Run] Engine options: mode=${engineOptions.mode}, network=${engineOptions.network}`);
   let fileExtension;
@@ -62502,4 +62661,4 @@ if (!process.argv.slice(2).length) {
 }
 program2.parse();
 
-//# debugId=B68BB6FF7DBA923364756E2164756E21
+//# debugId=92C54A0066AB3BEC64756E2164756E21

package/dist/index.js

@@ -375,47 +375,129 @@ class Semaphore {
 // src/engine/pool.ts
 class ContainerPool {
   docker;
-  poolSize;
+  poolStrategy;
+  cleanPoolSize;
+  dirtyPoolSize;
   createOptions;
+  networkMode;
+  securityMode;
   pools = new Map;
   replenishing = new Set;
   pendingReplenishments = new Set;
+  cleaningInterval = null;
   constructor(options) {
     this.docker = options.docker;
-    this.poolSize = options.poolSize ?? 2;
+    this.poolStrategy = options.poolStrategy ?? "fast";
     this.createOptions = options.createOptions;
+    this.networkMode = options.networkMode;
+    this.securityMode = options.securityMode;
+    if (typeof options.poolSize === "number") {
+      this.cleanPoolSize = options.poolSize;
+      this.dirtyPoolSize = options.poolSize;
+    } else if (options.poolSize) {
+      this.cleanPoolSize = options.poolSize.clean ?? 1;
+      this.dirtyPoolSize = options.poolSize.dirty ?? 1;
+    } else {
+      this.cleanPoolSize = 1;
+      this.dirtyPoolSize = 1;
+    }
+    if (this.poolStrategy === "fast") {
+      this.startBackgroundCleaning();
+    }
   }
   async acquire(image) {
-    const pool = this.pools.get(image);
-    if (pool && pool.length > 0) {
-      const entry = pool.shift();
+    const pool = this.pools.get(image) ?? { clean: [], dirty: [] };
+    if (this.poolStrategy === "fast") {
+      if (pool.clean.length > 0) {
+        const entry = pool.clean.shift();
+        this.pools.set(image, pool);
+        this.replenish(image);
+        return entry.container;
+      }
+      if (pool.dirty.length > 0 && pool.clean.length < this.cleanPoolSize) {
+        await this.cleanDirtyImmediate(image);
+        const updatedPool = this.pools.get(image);
+        if (updatedPool && updatedPool.clean.length > 0) {
+          const entry = updatedPool.clean.shift();
+          this.pools.set(image, updatedPool);
+          this.replenish(image);
+          return entry.container;
+        }
+      }
+      return this.createContainer(image);
+    }
+    if (pool.clean && pool.clean.length > 0) {
+      const entry = pool.clean.shift();
+      this.pools.set(image, { clean: pool.clean, dirty: [] });
+      await this.cleanupContainer(entry.container);
       this.replenish(image);
       return entry.container;
     }
     return this.createContainer(image);
   }
   async release(container, image) {
-    const pool = this.pools.get(image) ?? [];
-    if (pool.length >= this.poolSize) {
-      await container.remove({ force: true }).catch(() => {});
+    let pool = this.pools.get(image);
+    if (!pool) {
+      pool = { clean: [], dirty: [] };
+      this.pools.set(image, pool);
+    }
+    if (this.poolStrategy === "fast") {
+      if (pool.dirty.length >= this.dirtyPoolSize) {
+        await container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      pool.dirty.push({ container, createdAt: Date.now() });
+    } else {
+      if (pool.clean.length >= this.cleanPoolSize) {
+        await container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      if (!pool.clean) {
+        pool.clean = [];
+      }
+      pool.clean.push({ container, createdAt: Date.now() });
+    }
+  }
+  startBackgroundCleaning() {
+    this.cleaningInterval = setInterval(async () => {
+      for (const [_image, pool] of this.pools) {
+        for (let i = 0;i < this.dirtyPoolSize; i++) {
+          if (pool.dirty.length > 0 && pool.clean.length < this.cleanPoolSize) {
+            const entry = pool.dirty.shift();
+            try {
+              await this.cleanupContainer(entry.container);
+              pool.clean.push(entry);
+            } catch {
+              entry.container.remove({ force: true }).catch(() => {});
+            }
+          }
+        }
+      }
+    }, 5000);
+  }
+  async cleanDirtyImmediate(image) {
+    const pool = this.pools.get(image);
+    if (!pool || pool.dirty.length === 0 || pool.clean.length >= this.cleanPoolSize) {
       return;
     }
+    const entry = pool.dirty.shift();
     try {
-      const killExec = await container.exec({
-        Cmd: [
-          "sh",
-          "-c",
-          "pkill -9 -u sandbox 2>/dev/null; /usr/sbin/iptables -F OUTPUT 2>/dev/null; true"
-        ]
-      });
-      await killExec.start({ Detach: true });
-      let killInfo = await killExec.inspect();
-      while (killInfo.Running) {
-        await new Promise((r) => setTimeout(r, 5));
-        killInfo = await killExec.inspect();
-      }
+      await this.cleanupContainer(entry.container);
+      pool.clean.push(entry);
+    } catch {
+      entry.container.remove({ force: true }).catch(() => {});
+    }
+  }
+  async cleanupContainer(container) {
+    const needsCleanup = this.securityMode === "strict";
+    const needsIptables = this.networkMode === "filtered" && needsCleanup;
+    if (!needsCleanup) {
+      return;
+    }
+    try {
+      const cleanupCmd = needsIptables ? "pkill -9 -u sandbox 2>/dev/null; /usr/sbin/iptables -F OUTPUT 2>/dev/null; rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true" : "pkill -9 -u sandbox 2>/dev/null; rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true";
       const cleanExec = await container.exec({
-        Cmd: ["sh", "-c", "rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true"]
+        Cmd: ["sh", "-c", cleanupCmd]
       });
       await cleanExec.start({ Detach: true });
       let info = await cleanExec.inspect();
@@ -423,29 +505,45 @@ class ContainerPool {
         await new Promise((r) => setTimeout(r, 5));
         info = await cleanExec.inspect();
       }
-      pool.push({ container, createdAt: Date.now() });
-      this.pools.set(image, pool);
-    } catch {
-      await container.remove({ force: true }).catch(() => {});
-    }
+    } catch {}
   }
   async warm(image) {
-    const pool = this.pools.get(image) ?? [];
+    const pool = this.pools.get(image) ?? { clean: [], dirty: [] };
     this.pools.set(image, pool);
-    const needed = this.poolSize - pool.length;
+    const needed = this.poolStrategy === "fast" ? this.cleanPoolSize - pool.clean.length : this.cleanPoolSize - (pool.clean?.length ?? 0);
+    if (needed <= 0) {
+      return;
+    }
     const promises = [];
     for (let i = 0;i < needed; i++) {
       promises.push(this.createContainer(image).then((container) => {
-        pool.push({ container, createdAt: Date.now() });
+        if (this.poolStrategy === "fast") {
+          pool.clean.push({ container, createdAt: Date.now() });
+        } else {
+          if (!pool.clean) {
+            pool.clean = [];
+          }
+          pool.clean.push({ container, createdAt: Date.now() });
+        }
       }));
     }
     await Promise.all(promises);
   }
+  async stop() {
+    return this.drain();
+  }
   async drain() {
+    if (this.cleaningInterval) {
+      clearInterval(this.cleaningInterval);
+      this.cleaningInterval = null;
+    }
     await Promise.all(this.pendingReplenishments);
     const promises = [];
     for (const [, pool] of this.pools) {
-      for (const entry of pool) {
+      for (const entry of pool.clean ?? []) {
+        promises.push(entry.container.remove({ force: true }).catch(() => {}));
+      }
+      for (const entry of pool.dirty) {
         promises.push(entry.container.remove({ force: true }).catch(() => {}));
       }
     }
@@ -464,30 +562,46 @@ class ContainerPool {
   }
   replenish(image) {
     if (this.replenishing.has(image)) {
-      logger.debug(`[Pool] Replenishment for ${image} already in progress`);
-      return;
-    }
-    this.replenishing.add(image);
-    logger.debug(`[Pool] Starting background replenishment for image: ${image}`);
-    const promise = this.createContainer(image).then((container) => {
-      const pool = this.pools.get(image) ?? [];
-      if (pool.length < this.poolSize) {
-        pool.push({ container, createdAt: Date.now() });
-        this.pools.set(image, pool);
-        logger.debug(`[Pool] Replenished container ${container.id} added to pool for ${image}. Pool size: ${pool.length}`);
-      } else {
-        logger.debug(`[Pool] Replenished container ${container.id} not needed (pool for ${image} is full), destroying`);
-        container.remove({ force: true }).catch((err) => {
-          logger.error(`[Pool] Error destroying unneeded replenished container ${container.id}:`, err);
-        });
+      if (this.replenishing.has(image)) {
+        return;
       }
-    }).catch((err) => {
-      logger.error(`[Pool] Error during replenishment for ${image}:`, err);
-    }).finally(() => {
-      this.replenishing.delete(image);
-      this.pendingReplenishments.delete(promise);
-    });
-    this.pendingReplenishments.add(promise);
+      const pool = this.pools.get(image);
+      const currentSize = pool ? this.poolStrategy === "fast" ? pool.clean.length : pool.clean?.length ?? 0 : 0;
+      const targetSize = this.poolStrategy === "fast" ? this.cleanPoolSize : this.cleanPoolSize;
+      if (currentSize >= targetSize) {
+        return;
+      }
+      this.replenishing.add(image);
+      const promise = this.createContainer(image).then((container) => {
+        const p = this.pools.get(image);
+        if (!p) {
+          container.remove({ force: true }).catch(() => {});
+          return;
+        }
+        if (this.poolStrategy === "fast") {
+          if (p.clean.length < this.cleanPoolSize) {
+            p.clean.push({ container, createdAt: Date.now() });
+          } else {
+            container.remove({ force: true }).catch(() => {});
+          }
+        } else {
+          if (!p.clean) {
+            p.clean = [];
+          }
+          if (p.clean.length < this.cleanPoolSize) {
+            p.clean.push({ container, createdAt: Date.now() });
+          } else {
+            container.remove({ force: true }).catch(() => {});
+          }
+        }
+      }).catch((err) => {
+        logger.error(`[Pool] Error during replenishment for ${image}:`, err);
+      }).finally(() => {
+        this.replenishing.delete(image);
+        this.pendingReplenishments.delete(promise);
+      });
+      this.pendingReplenishments.add(promise);
+    }
   }
 }
 var init_pool = __esm(() => {
@@ -634,32 +748,53 @@ var exports_docker = {};
 __export(exports_docker, {
   DockerIsol8: () => DockerIsol8
 });
-import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
 import { PassThrough } from "node:stream";
 import Docker from "dockerode";
 async function writeFileViaExec(container, filePath, content) {
   const data = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
-  return new Promise((resolve2, reject) => {
-    const child = spawn2("docker", ["exec", "-i", "-u", "sandbox", container.id, "sh", "-c", `cat > ${filePath}`], {
-      stdio: ["pipe", "ignore", "pipe"]
-    });
-    child.on("error", (err) => {
-      reject(new Error(`Failed to spawn docker exec: ${err.message}`));
+  const b64 = data.toString("base64");
+  if (b64.length < 20000) {
+    const exec = await container.exec({
+      Cmd: ["sh", "-c", `printf '%s' '${b64}' | base64 -d > ${filePath}`],
+      User: "sandbox"
     });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => stderr += chunk.toString());
-    child.stdin.write(data);
-    child.stdin.end();
-    child.on("close", (code) => {
-      if (code !== 0) {
-        reject(new Error(`Failed to write file ${filePath}: ${stderr} (exit code ${code})`));
-      } else {
-        resolve2();
-      }
+    await exec.start({ Detach: true });
+    let info2 = await exec.inspect();
+    while (info2.Running) {
+      await new Promise((r) => setTimeout(r, 5));
+      info2 = await exec.inspect();
+    }
+    if (info2.ExitCode !== 0) {
+      throw new Error(`Failed to write file ${filePath} in container (exit code ${info2.ExitCode})`);
+    }
+    return;
+  }
+  const tempPath = `/tmp/b64_${Date.now()}.tmp`;
+  const chunkSize = 8000;
+  for (let i = 0;i < b64.length; i += chunkSize) {
+    const chunk = b64.slice(i, i + chunkSize);
+    const exec = await container.exec({
+      Cmd: ["sh", "-c", `printf '%s' '${chunk}' >> ${tempPath}`],
+      User: "sandbox"
     });
+    await exec.start({ Detach: true });
+    await exec.inspect();
+  }
+  const decodeExec = await container.exec({
+    Cmd: ["sh", "-c", `base64 -d ${tempPath} > ${filePath} && rm ${tempPath}`],
+    User: "sandbox"
   });
+  await decodeExec.start({ Detach: true });
+  let info = await decodeExec.inspect();
+  while (info.Running) {
+    await new Promise((r) => setTimeout(r, 5));
+    info = await decodeExec.inspect();
+  }
+  if (info.ExitCode !== 0) {
+    throw new Error(`Failed to write file ${filePath} in container (exit code ${info.ExitCode})`);
+  }
 }
 async function readFileViaExec(container, filePath) {
   const exec = await container.exec({
@@ -829,10 +964,13 @@ class DockerIsol8 {
   security;
   persist;
   logNetwork;
+  poolStrategy;
+  poolSize;
   auditLogger;
   container = null;
   persistentRuntime = null;
   pool = null;
+  imageCache = new Map;
   constructor(options = {}, maxConcurrent = 10) {
     this.docker = options.docker ?? new Docker;
     this.mode = options.mode ?? "ephemeral";
@@ -852,6 +990,8 @@ class DockerIsol8 {
     this.persist = options.persist ?? false;
     this.security = options.security ?? { seccomp: "strict" };
     this.logNetwork = options.logNetwork ?? false;
+    this.poolStrategy = options.poolStrategy ?? "fast";
+    this.poolSize = options.poolSize ?? { clean: 1, dirty: 1 };
     if (options.audit) {
       this.auditLogger = new AuditLogger(options.audit);
     }
@@ -1101,13 +1241,21 @@ class DockerIsol8 {
     if (this.overrideImage) {
       return this.overrideImage;
     }
+    const cacheKey = adapter.image;
+    const cached = this.imageCache.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
     const customTag = `${adapter.image}-custom`;
+    let resolvedImage;
     try {
       await this.docker.getImage(customTag).inspect();
-      return customTag;
+      resolvedImage = customTag;
     } catch {
-      return adapter.image;
+      resolvedImage = adapter.image;
     }
+    this.imageCache.set(cacheKey, resolvedImage);
+    return resolvedImage;
   }
   async executeEphemeral(req, startTime) {
     const adapter = this.getAdapter(req.runtime);
@@ -1116,7 +1264,10 @@ class DockerIsol8 {
     if (!this.pool) {
       this.pool = new ContainerPool({
         docker: this.docker,
-        poolSize: 2,
+        poolStrategy: this.poolStrategy,
+        poolSize: this.poolSize,
+        networkMode: this.network,
+        securityMode: this.security.seccomp ?? "strict",
         createOptions: {
           Cmd: ["sleep", "infinity"],
           WorkingDir: SANDBOX_WORKDIR,
@@ -1218,7 +1369,10 @@ class DockerIsol8 {
       if (this.persist) {
         logger.debug(`[Persist] Leaving container running for inspection: ${container.id}`);
       } else {
-        await this.pool.release(container, image);
+        this.pool.release(container, image).catch((err) => {
+          logger.debug(`[Pool] release failed: ${err}`);
+          container.remove({ force: true }).catch(() => {});
+        });
       }
     }
   }
@@ -1844,7 +1998,7 @@ init_logger();
 // package.json
 var package_default = {
   name: "isol8",
-  version: "0.10.0",
+  version: "0.10.1",
   description: "Secure code execution engine for AI agents",
   author: "Illusion47586",
   license: "MIT",
@@ -2182,4 +2336,4 @@ export {
   BunAdapter
 };
 
-//# debugId=C11E47C76FBC0D2364756E2164756E21
+//# debugId=C44D450DD130A4AD64756E2164756E21

package/dist/src/engine/docker.d.ts

@@ -46,10 +46,13 @@ export declare class DockerIsol8 implements Isol8Engine {
     private readonly security;
     private readonly persist;
     private readonly logNetwork;
+    private readonly poolStrategy;
+    private readonly poolSize;
     private readonly auditLogger?;
     private container;
     private persistentRuntime;
     private pool;
+    private readonly imageCache;
     /**
      * @param options - Sandbox configuration options.
      * @param maxConcurrent - Maximum number of concurrent executions (controls the internal semaphore).

package/dist/src/engine/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/engine/docker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEX,YAAY,EAIZ,WAAW,EACZ,MAAM,UAAU,CAAC;AAmTlB,2HAA2H;AAC3H,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAY,YAAW,WAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAE3C,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,IAAI,CAA8B;IAE1C;;;OAGG;gBACS,OAAO,GAAE,kBAAuB,EAAE,aAAa,SAAK;IA8BhE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,kFAAkF;IAC5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B;;;OAGG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAe9D;;OAEG;YACW,WAAW;IAoDzB;;OAEG;YACW,qBAAqB;IA8CnC;;OAEG;YACW,kBAAkB;IA+DhC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpE;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5C,6GAA6G;IAC7G,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC;YAsFzD,YAAY;YAcZ,gBAAgB;YAwJhB,iBAAiB;YAwIjB,aAAa;YAkBb,oBAAoB;YASpB,wBAAwB;IA4BtC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,yBAAyB;IAyBjC,OAAO,CAAC,QAAQ;YAwCD,gBAAgB;YA8EjB,iBAAiB;IAiG/B,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;;;;;;;;;;;;;;OAoBG;WACU,OAAO,CAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA2BlE"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/engine/docker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEX,YAAY,EAIZ,WAAW,EACZ,MAAM,UAAU,CAAC;AAyUlB,2HAA2H;AAC3H,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAY,YAAW,WAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAE3C,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,IAAI,CAA8B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD;;;OAGG;gBACS,OAAO,GAAE,kBAAuB,EAAE,aAAa,SAAK;IAgChE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,kFAAkF;IAC5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B;;;OAGG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAe9D;;OAEG;YACW,WAAW;IAoDzB;;OAEG;YACW,qBAAqB;IA8CnC;;OAEG;YACW,kBAAkB;IA+DhC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpE;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5C,6GAA6G;IAC7G,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC;YAsFzD,YAAY;YAwBZ,gBAAgB;YA8JhB,iBAAiB;YAwIjB,aAAa;YAkBb,oBAAoB;YASpB,wBAAwB;IA4BtC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,yBAAyB;IAyBjC,OAAO,CAAC,QAAQ;YAwCD,gBAAgB;YA8EjB,iBAAiB;IAiG/B,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;;;;;;;;;;;;;;OAoBG;WACU,OAAO,CAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA2BlE"}

package/dist/src/engine/pool.d.ts

@@ -5,55 +5,90 @@
  * starts containers so they're ready for immediate use, eliminating
  * the create+start overhead (~100-200ms per execution).
  *
- * After execution, containers are cleaned (sandbox wiped) and returned
- * to the pool for reuse rather than destroyed.
+ * Supports two strategies:
+ * - "secure": Clean container before returning (slower but ensures clean state)
+ * - "fast": Dual-pool system - instant acquire from clean pool, background cleanup
  */
 import type Docker from "dockerode";
 /** Configuration for the container pool. */
 export interface PoolOptions {
     /** Docker client instance. */
     docker: Docker;
-    /** Max containers to keep warm per image. @default 2 */
-    poolSize?: number;
+    /** Pool strategy: "secure" or "fast". @default "fast" */
+    poolStrategy?: "secure" | "fast";
+    /** Pool size configuration.
+     * For "secure" mode: number of containers to keep warm
+     * For "fast" mode: { clean: ready containers, dirty: being cleaned }
+     * @default 1 (for fast mode: { clean: 1, dirty: 1 })
+     */
+    poolSize?: number | {
+        clean: number;
+        dirty: number;
+    };
     /** Container creation options (HostConfig, Env, etc). */
     createOptions: Omit<Docker.ContainerCreateOptions, "Image">;
+    /** Network mode to determine if iptables cleanup is needed. */
+    networkMode: "none" | "host" | "filtered";
+    /** Security mode - if strict, run process cleanup between executions */
+    securityMode: "strict" | "unconfined" | "custom";
 }
 /**
  * A per-image warm container pool. Maintains pre-started containers
  * ready for immediate exec, recycling them after use.
+ *
+ * Supports two strategies:
+ * - "secure": Single pool, cleanup in acquire (current behavior)
+ * - "fast": Dual pools (clean/dirty), instant acquire, background cleanup
  */
 export declare class ContainerPool {
     private readonly docker;
-    private readonly poolSize;
+    private readonly poolStrategy;
+    private readonly cleanPoolSize;
+    private readonly dirtyPoolSize;
     private readonly createOptions;
+    private readonly networkMode;
+    private readonly securityMode;
     private readonly pools;
     private readonly replenishing;
     private readonly pendingReplenishments;
+    private cleaningInterval;
     constructor(options: PoolOptions);
     /**
      * Acquire a started container for the given image.
-     * Returns a warm container from the pool if available,
-     * otherwise creates and starts a new one.
+     * - "secure" mode: Clean container before returning
+     * - "fast" mode: Instant return from clean pool, create new if empty
      */
     acquire(image: string): Promise<Docker.Container>;
     /**
-     * Return a container to the pool after use. All processes owned by the
-     * `sandbox` user are killed, and the `/sandbox` tmpfs is wiped clean
-     * so the container is ready for the next execution.
-     * If the pool is full, the container is destroyed instead.
+     * Return a container to the pool.
+     * - "secure" mode: Add to pool, cleanup happens on next acquire
+     * - "fast" mode: Add to dirty pool for background cleaning
      */
     release(container: Docker.Container, image: string): Promise<void>;
+    /**
+     * Start background cleaning for fast mode.
+     * Runs every 5 seconds to clean dirty containers.
+     */
+    private startBackgroundCleaning;
+    /**
+     * Clean a dirty container immediately and add to clean pool.
+     */
+    private cleanDirtyImmediate;
+    private cleanupContainer;
     /**
      * Pre-warm the pool for a specific image.
-     * Creates containers up to poolSize.
      */
     warm(image: string): Promise<void>;
+    /**
+     * Stop the pool and clean up resources.
+     * Alias for drain() - destroys all containers and stops background cleaning.
+     */
+    stop(): Promise<void>;
     /**
      * Destroy all pooled containers and clear the pool.
      */
     drain(): Promise<void>;
     private createContainer;
-    /** Replenish the pool in the background (non-blocking). */
     private replenish;
 }
 //# sourceMappingURL=pool.d.ts.map

package/dist/src/engine/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../../src/engine/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;CAC7D;AAOD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+C;IAC7E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA4B;gBAEtD,OAAO,EAAE,WAAW;IAMhC;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;IAcvD;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkDxE;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBd,eAAe;IAW7B,2DAA2D;IAC3D,OAAO,CAAC,SAAS;CAuClB"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../../src/engine/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,yDAAyD;IACzD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;IAC1C,wEAAwE;IACxE,YAAY,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;CAClD;AAYD;;;;;;;GAOG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+C;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqC;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA4B;IAClE,OAAO,CAAC,gBAAgB,CAA+C;gBAE3D,OAAO,EAAE,WAAW;IA0BhC;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;IAkDvD;;;;OAIG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCxE;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;YACW,mBAAmB;YAenB,gBAAgB;IA4B9B;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCxC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAyBd,eAAe;IAW7B,OAAO,CAAC,SAAS;CAwDlB"}

package/dist/src/types.d.ts

@@ -248,6 +248,23 @@ export interface Isol8Options {
     security?: SecurityConfig;
     /** Audit logging configuration. */
     audit?: AuditConfig;
+    /**
+     * Pool strategy for container reuse.
+     * - "secure": Clean container before returning (slower but ensures clean state)
+     * - "fast": Use dual-pool system - instant acquire, background cleanup (faster)
+     * @default "fast"
+     */
+    poolStrategy?: "secure" | "fast";
+    /**
+     * Pool size configuration.
+     * For "secure" mode: number of containers to keep warm
+     * For "fast" mode: { clean: number of ready containers, dirty: number being cleaned }
+     * @default 1 (for fast mode: { clean: 1, dirty: 1 })
+     */
+    poolSize?: number | {
+        clean: number;
+        dirty: number;
+    };
 }
 /**
  * The core isol8 engine abstraction. Both {@link DockerIsol8} and {@link RemoteIsol8}

package/dist/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IAEf,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IAEnB,0FAA0F;IAC1F,SAAS,EAAE,OAAO,CAAC;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IAEjB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAElB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC;;;;GAIC;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAID;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,yFAAyF;IACzF,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wIAAwI;IACxI,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,kEAAkE;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;CAClE;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,mGAAmG;IACnG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAID,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IAEtB,sDAAsD;IACtD,QAAQ,EAAE,aAAa,CAAC;IAExB,4DAA4D;IAC5D,OAAO,EAAE,mBAAmB,CAAC;IAE7B,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IAEtB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,EAAE,cAAc,CAAC;IAEzB,mCAAmC;IACnC,KAAK,EAAE,WAAW,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAElC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhC,mEAAmE;IACnE,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IAEf,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IAEnB,0FAA0F;IAC1F,SAAS,EAAE,OAAO,CAAC;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IAEjB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAElB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC;;;;GAIC;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAID;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,yFAAyF;IACzF,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wIAAwI;IACxI,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,kEAAkE;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;CAClE;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,mGAAmG;IACnG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAID,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IAEtB,sDAAsD;IACtD,QAAQ,EAAE,aAAa,CAAC;IAExB,4DAA4D;IAC5D,OAAO,EAAE,mBAAmB,CAAC;IAE7B,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IAEtB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,EAAE,cAAc,CAAC;IAEzB,mCAAmC;IACnC,KAAK,EAAE,WAAW,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAElC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhC,mEAAmE;IACnE,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "isol8",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Secure code execution engine for AI agents",
   "author": "Illusion47586",
   "license": "MIT",