isol8 0.10.3 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -0
- package/dist/cli.js +465 -48
- package/dist/index.js +256 -17
- package/dist/src/config.d.ts.map +1 -1
- package/dist/src/engine/code-fetcher.d.ts +21 -0
- package/dist/src/engine/code-fetcher.d.ts.map +1 -0
- package/dist/src/engine/docker.d.ts +2 -0
- package/dist/src/engine/docker.d.ts.map +1 -1
- package/dist/src/engine/image-builder.d.ts +12 -2
- package/dist/src/engine/image-builder.d.ts.map +1 -1
- package/dist/src/index.d.ts +1 -1
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/server/index.d.ts.map +1 -1
- package/dist/src/types.d.ts +44 -2
- package/dist/src/types.d.ts.map +1 -1
- package/package.json +1 -1
- package/schema/isol8.config.schema.json +59 -0
package/dist/index.js
CHANGED
|
@@ -336,6 +336,180 @@ var init_audit = __esm(() => {
|
|
|
336
336
|
init_logger();
|
|
337
337
|
});
|
|
338
338
|
|
|
339
|
+
// src/engine/code-fetcher.ts
|
|
340
|
+
import { createHash } from "node:crypto";
|
|
341
|
+
import { lookup as dnsLookup } from "node:dns/promises";
|
|
342
|
+
import { isIP } from "node:net";
|
|
343
|
+
function sha256Hex(input) {
|
|
344
|
+
return createHash("sha256").update(input, "utf-8").digest("hex");
|
|
345
|
+
}
|
|
346
|
+
function normalizeScheme(url) {
|
|
347
|
+
return url.protocol.replace(/:$/, "").toLowerCase();
|
|
348
|
+
}
|
|
349
|
+
function isBlockedByPattern(host, patterns) {
|
|
350
|
+
return patterns.some((pattern) => new RegExp(pattern, "i").test(host));
|
|
351
|
+
}
|
|
352
|
+
function isAllowedByPattern(host, patterns) {
|
|
353
|
+
if (patterns.length === 0) {
|
|
354
|
+
return true;
|
|
355
|
+
}
|
|
356
|
+
return patterns.some((pattern) => new RegExp(pattern, "i").test(host));
|
|
357
|
+
}
|
|
358
|
+
function isPrivateIpv4(ip) {
|
|
359
|
+
const parts = ip.split(IPV4_SEPARATOR).map((v) => Number.parseInt(v, 10));
|
|
360
|
+
if (parts.length !== 4 || parts.some((p) => Number.isNaN(p))) {
|
|
361
|
+
return false;
|
|
362
|
+
}
|
|
363
|
+
const a = parts[0];
|
|
364
|
+
const b = parts[1];
|
|
365
|
+
if (a === 10 || a === 127 || a === 0) {
|
|
366
|
+
return true;
|
|
367
|
+
}
|
|
368
|
+
if (a === 169 && b === 254) {
|
|
369
|
+
return true;
|
|
370
|
+
}
|
|
371
|
+
if (a === 172 && b >= 16 && b <= 31) {
|
|
372
|
+
return true;
|
|
373
|
+
}
|
|
374
|
+
if (a === 192 && b === 168) {
|
|
375
|
+
return true;
|
|
376
|
+
}
|
|
377
|
+
if (a === 100 && b >= 64 && b <= 127) {
|
|
378
|
+
return true;
|
|
379
|
+
}
|
|
380
|
+
return false;
|
|
381
|
+
}
|
|
382
|
+
function isPrivateIpv6(ip) {
|
|
383
|
+
const normalized = ip.toLowerCase();
|
|
384
|
+
if (normalized === IPV6_LOOPBACK) {
|
|
385
|
+
return true;
|
|
386
|
+
}
|
|
387
|
+
return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb");
|
|
388
|
+
}
|
|
389
|
+
function isPrivateIp(ip) {
|
|
390
|
+
const family = isIP(ip);
|
|
391
|
+
if (family === 4) {
|
|
392
|
+
return isPrivateIpv4(ip);
|
|
393
|
+
}
|
|
394
|
+
if (family === 6) {
|
|
395
|
+
return isPrivateIpv6(ip);
|
|
396
|
+
}
|
|
397
|
+
return false;
|
|
398
|
+
}
|
|
399
|
+
async function assertHostResolvesPublic(host, lookupFn) {
|
|
400
|
+
if (isIP(host) && isPrivateIp(host)) {
|
|
401
|
+
throw new Error(`Blocked code URL host: ${host}`);
|
|
402
|
+
}
|
|
403
|
+
try {
|
|
404
|
+
const records = await lookupFn(host);
|
|
405
|
+
for (const record of records) {
|
|
406
|
+
if (isPrivateIp(record.address)) {
|
|
407
|
+
throw new Error(`Blocked code URL host: ${host}`);
|
|
408
|
+
}
|
|
409
|
+
}
|
|
410
|
+
} catch (err) {
|
|
411
|
+
if (err instanceof Error && err.message.startsWith("Blocked code URL host:")) {
|
|
412
|
+
throw err;
|
|
413
|
+
}
|
|
414
|
+
throw new Error(`Failed to resolve code URL host: ${host}`);
|
|
415
|
+
}
|
|
416
|
+
}
|
|
417
|
+
function decodeUtf8(content) {
|
|
418
|
+
const decoder = new TextDecoder("utf-8", { fatal: true });
|
|
419
|
+
const text = decoder.decode(content);
|
|
420
|
+
if (text.includes("\x00")) {
|
|
421
|
+
throw new Error("Fetched code appears to be binary content");
|
|
422
|
+
}
|
|
423
|
+
return text;
|
|
424
|
+
}
|
|
425
|
+
async function fetchRemoteCode(request, policy, deps = {}) {
|
|
426
|
+
if (!policy.enabled) {
|
|
427
|
+
throw new Error("Remote code fetching is disabled. Set remoteCode.enabled=true to allow it.");
|
|
428
|
+
}
|
|
429
|
+
const fetchFn = deps.fetchFn ?? globalThis.fetch;
|
|
430
|
+
const lookupFn = deps.lookupFn ?? (async (hostname) => {
|
|
431
|
+
const records = await dnsLookup(hostname, { all: true, verbatim: true });
|
|
432
|
+
return records;
|
|
433
|
+
});
|
|
434
|
+
if (!request.codeUrl) {
|
|
435
|
+
throw new Error("codeUrl is required for remote code fetching");
|
|
436
|
+
}
|
|
437
|
+
const url = new URL(request.codeUrl);
|
|
438
|
+
const scheme = normalizeScheme(url);
|
|
439
|
+
if (scheme === "http" && !request.allowInsecureCodeUrl) {
|
|
440
|
+
throw new Error("Insecure code URL blocked. Use allowInsecureCodeUrl=true to allow HTTP.");
|
|
441
|
+
}
|
|
442
|
+
if (!policy.allowedSchemes.map((s) => s.toLowerCase()).includes(scheme)) {
|
|
443
|
+
throw new Error(`URL scheme not allowed: ${scheme}`);
|
|
444
|
+
}
|
|
445
|
+
const host = url.hostname.toLowerCase();
|
|
446
|
+
if (!isAllowedByPattern(host, policy.allowedHosts) || isBlockedByPattern(host, policy.blockedHosts)) {
|
|
447
|
+
throw new Error(`Blocked code URL host: ${host}`);
|
|
448
|
+
}
|
|
449
|
+
await assertHostResolvesPublic(host, lookupFn);
|
|
450
|
+
if (policy.requireHash && !request.codeHash) {
|
|
451
|
+
throw new Error("Hash verification required: provide codeHash for remote code execution.");
|
|
452
|
+
}
|
|
453
|
+
const controller = new AbortController;
|
|
454
|
+
const timeout = setTimeout(() => controller.abort(), policy.fetchTimeoutMs);
|
|
455
|
+
let response;
|
|
456
|
+
try {
|
|
457
|
+
response = await fetchFn(url.toString(), {
|
|
458
|
+
method: "GET",
|
|
459
|
+
redirect: "follow",
|
|
460
|
+
signal: controller.signal
|
|
461
|
+
});
|
|
462
|
+
} catch (err) {
|
|
463
|
+
throw new Error(err instanceof Error && err.name === "AbortError" ? `Remote code fetch timed out after ${policy.fetchTimeoutMs}ms` : `Failed to fetch remote code: ${err instanceof Error ? err.message : String(err)}`);
|
|
464
|
+
} finally {
|
|
465
|
+
clearTimeout(timeout);
|
|
466
|
+
}
|
|
467
|
+
if (!response.ok) {
|
|
468
|
+
throw new Error(`Failed to fetch remote code: HTTP ${response.status}`);
|
|
469
|
+
}
|
|
470
|
+
const contentLengthHeader = response.headers.get("content-length");
|
|
471
|
+
if (contentLengthHeader) {
|
|
472
|
+
const parsedLength = Number.parseInt(contentLengthHeader, 10);
|
|
473
|
+
if (!Number.isNaN(parsedLength) && parsedLength > policy.maxCodeSize) {
|
|
474
|
+
throw new Error(`Remote code exceeds maxCodeSize (${policy.maxCodeSize} bytes): ${parsedLength} bytes`);
|
|
475
|
+
}
|
|
476
|
+
}
|
|
477
|
+
if (!response.body) {
|
|
478
|
+
throw new Error("Remote code response body is empty");
|
|
479
|
+
}
|
|
480
|
+
const reader = response.body.getReader();
|
|
481
|
+
const chunks = [];
|
|
482
|
+
let totalBytes = 0;
|
|
483
|
+
while (true) {
|
|
484
|
+
const { done, value } = await reader.read();
|
|
485
|
+
if (done) {
|
|
486
|
+
break;
|
|
487
|
+
}
|
|
488
|
+
if (!value) {
|
|
489
|
+
continue;
|
|
490
|
+
}
|
|
491
|
+
totalBytes += value.byteLength;
|
|
492
|
+
if (totalBytes > policy.maxCodeSize) {
|
|
493
|
+
throw new Error(`Remote code exceeds maxCodeSize (${policy.maxCodeSize} bytes)`);
|
|
494
|
+
}
|
|
495
|
+
chunks.push(value);
|
|
496
|
+
}
|
|
497
|
+
const buffer = new Uint8Array(totalBytes);
|
|
498
|
+
let offset = 0;
|
|
499
|
+
for (const chunk of chunks) {
|
|
500
|
+
buffer.set(chunk, offset);
|
|
501
|
+
offset += chunk.byteLength;
|
|
502
|
+
}
|
|
503
|
+
const code = decodeUtf8(buffer);
|
|
504
|
+
const hash = sha256Hex(code);
|
|
505
|
+
if (request.codeHash && hash.toLowerCase() !== request.codeHash.toLowerCase()) {
|
|
506
|
+
throw new Error("Remote code hash mismatch");
|
|
507
|
+
}
|
|
508
|
+
return { code, url: url.toString(), hash };
|
|
509
|
+
}
|
|
510
|
+
var IPV4_SEPARATOR = ".", IPV6_LOOPBACK = "::1";
|
|
511
|
+
var init_code_fetcher = () => {};
|
|
512
|
+
|
|
339
513
|
// src/engine/concurrency.ts
|
|
340
514
|
class Semaphore {
|
|
341
515
|
max;
|
|
@@ -967,10 +1141,30 @@ class DockerIsol8 {
|
|
|
967
1141
|
poolStrategy;
|
|
968
1142
|
poolSize;
|
|
969
1143
|
auditLogger;
|
|
1144
|
+
remoteCodePolicy;
|
|
970
1145
|
container = null;
|
|
971
1146
|
persistentRuntime = null;
|
|
972
1147
|
pool = null;
|
|
973
1148
|
imageCache = new Map;
|
|
1149
|
+
async resolveExecutionRequest(req) {
|
|
1150
|
+
const inlineCode = req.code?.trim();
|
|
1151
|
+
const codeUrl = req.codeUrl?.trim();
|
|
1152
|
+
if (inlineCode && codeUrl) {
|
|
1153
|
+
throw new Error("ExecutionRequest.code and ExecutionRequest.codeUrl are mutually exclusive.");
|
|
1154
|
+
}
|
|
1155
|
+
if (!(inlineCode || codeUrl)) {
|
|
1156
|
+
throw new Error("ExecutionRequest must include either code or codeUrl.");
|
|
1157
|
+
}
|
|
1158
|
+
if (inlineCode) {
|
|
1159
|
+
return { ...req, code: req.code };
|
|
1160
|
+
}
|
|
1161
|
+
const fetched = await fetchRemoteCode({
|
|
1162
|
+
codeUrl,
|
|
1163
|
+
codeHash: req.codeHash,
|
|
1164
|
+
allowInsecureCodeUrl: req.allowInsecureCodeUrl
|
|
1165
|
+
}, this.remoteCodePolicy);
|
|
1166
|
+
return { ...req, code: fetched.code };
|
|
1167
|
+
}
|
|
974
1168
|
constructor(options = {}, maxConcurrent = 10) {
|
|
975
1169
|
this.docker = options.docker ?? new Docker;
|
|
976
1170
|
this.mode = options.mode ?? "ephemeral";
|
|
@@ -992,6 +1186,17 @@ class DockerIsol8 {
|
|
|
992
1186
|
this.logNetwork = options.logNetwork ?? false;
|
|
993
1187
|
this.poolStrategy = options.poolStrategy ?? "fast";
|
|
994
1188
|
this.poolSize = options.poolSize ?? { clean: 1, dirty: 1 };
|
|
1189
|
+
this.remoteCodePolicy = options.remoteCode ?? {
|
|
1190
|
+
enabled: false,
|
|
1191
|
+
allowedSchemes: ["https"],
|
|
1192
|
+
allowedHosts: [],
|
|
1193
|
+
blockedHosts: [],
|
|
1194
|
+
maxCodeSize: 10 * 1024 * 1024,
|
|
1195
|
+
fetchTimeoutMs: 30000,
|
|
1196
|
+
requireHash: false,
|
|
1197
|
+
enableCache: true,
|
|
1198
|
+
cacheTtl: 3600
|
|
1199
|
+
};
|
|
995
1200
|
if (options.audit) {
|
|
996
1201
|
this.auditLogger = new AuditLogger(options.audit);
|
|
997
1202
|
}
|
|
@@ -1020,7 +1225,8 @@ class DockerIsol8 {
|
|
|
1020
1225
|
await this.semaphore.acquire();
|
|
1021
1226
|
const startTime = Date.now();
|
|
1022
1227
|
try {
|
|
1023
|
-
const
|
|
1228
|
+
const request = await this.resolveExecutionRequest(req);
|
|
1229
|
+
const result = this.mode === "persistent" ? await this.executePersistent(request, startTime) : await this.executeEphemeral(request, startTime);
|
|
1024
1230
|
return result;
|
|
1025
1231
|
} finally {
|
|
1026
1232
|
this.semaphore.release();
|
|
@@ -1174,8 +1380,9 @@ class DockerIsol8 {
|
|
|
1174
1380
|
async* executeStream(req) {
|
|
1175
1381
|
await this.semaphore.acquire();
|
|
1176
1382
|
try {
|
|
1177
|
-
const
|
|
1178
|
-
const
|
|
1383
|
+
const request = await this.resolveExecutionRequest(req);
|
|
1384
|
+
const adapter = this.getAdapter(request.runtime);
|
|
1385
|
+
const timeoutMs = request.timeoutMs ?? this.defaultTimeoutMs;
|
|
1179
1386
|
const image = await this.resolveImage(adapter);
|
|
1180
1387
|
const container = await this.docker.createContainer({
|
|
1181
1388
|
Image: image,
|
|
@@ -1192,23 +1399,23 @@ class DockerIsol8 {
|
|
|
1192
1399
|
await startProxy(container, this.networkFilter);
|
|
1193
1400
|
await setupIptables(container);
|
|
1194
1401
|
}
|
|
1195
|
-
const ext =
|
|
1402
|
+
const ext = request.fileExtension ?? adapter.getFileExtension();
|
|
1196
1403
|
const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
|
|
1197
|
-
await writeFileViaExec(container, filePath,
|
|
1198
|
-
if (
|
|
1199
|
-
await installPackages(container,
|
|
1404
|
+
await writeFileViaExec(container, filePath, request.code);
|
|
1405
|
+
if (request.installPackages?.length) {
|
|
1406
|
+
await installPackages(container, request.runtime, request.installPackages);
|
|
1200
1407
|
}
|
|
1201
|
-
if (
|
|
1202
|
-
for (const [fPath, fContent] of Object.entries(
|
|
1408
|
+
if (request.files) {
|
|
1409
|
+
for (const [fPath, fContent] of Object.entries(request.files)) {
|
|
1203
1410
|
await writeFileViaExec(container, fPath, fContent);
|
|
1204
1411
|
}
|
|
1205
1412
|
}
|
|
1206
|
-
const rawCmd = adapter.getCommand(
|
|
1413
|
+
const rawCmd = adapter.getCommand(request.code, filePath);
|
|
1207
1414
|
const timeoutSec = Math.ceil(timeoutMs / 1000);
|
|
1208
1415
|
let cmd;
|
|
1209
|
-
if (
|
|
1416
|
+
if (request.stdin) {
|
|
1210
1417
|
const stdinPath = `${SANDBOX_WORKDIR}/_stdin`;
|
|
1211
|
-
await writeFileViaExec(container, stdinPath,
|
|
1418
|
+
await writeFileViaExec(container, stdinPath, request.stdin);
|
|
1212
1419
|
const cmdStr = rawCmd.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
|
|
1213
1420
|
cmd = wrapWithTimeout(["sh", "-c", `cat ${stdinPath} | ${cmdStr}`], timeoutSec);
|
|
1214
1421
|
} else {
|
|
@@ -1216,7 +1423,7 @@ class DockerIsol8 {
|
|
|
1216
1423
|
}
|
|
1217
1424
|
const exec = await container.exec({
|
|
1218
1425
|
Cmd: cmd,
|
|
1219
|
-
Env: this.buildEnv(
|
|
1426
|
+
Env: this.buildEnv(request.env),
|
|
1220
1427
|
AttachStdout: true,
|
|
1221
1428
|
AttachStderr: true,
|
|
1222
1429
|
WorkingDir: SANDBOX_WORKDIR,
|
|
@@ -1775,6 +1982,7 @@ var init_docker = __esm(() => {
|
|
|
1775
1982
|
init_runtime();
|
|
1776
1983
|
init_logger();
|
|
1777
1984
|
init_audit();
|
|
1985
|
+
init_code_fetcher();
|
|
1778
1986
|
init_pool();
|
|
1779
1987
|
MAX_OUTPUT_BYTES = 1024 * 1024;
|
|
1780
1988
|
});
|
|
@@ -1931,6 +2139,28 @@ var DEFAULT_CONFIG = {
|
|
|
1931
2139
|
security: {
|
|
1932
2140
|
seccomp: "strict"
|
|
1933
2141
|
},
|
|
2142
|
+
remoteCode: {
|
|
2143
|
+
enabled: false,
|
|
2144
|
+
allowedSchemes: ["https"],
|
|
2145
|
+
allowedHosts: [],
|
|
2146
|
+
blockedHosts: [
|
|
2147
|
+
"^localhost$",
|
|
2148
|
+
"^127(?:\\.[0-9]{1,3}){3}$",
|
|
2149
|
+
"^\\[::1\\]$",
|
|
2150
|
+
"^::1$",
|
|
2151
|
+
"^10(?:\\.[0-9]{1,3}){3}$",
|
|
2152
|
+
"^172\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\.[0-9]{1,3}){2}$",
|
|
2153
|
+
"^192\\.168(?:\\.[0-9]{1,3}){2}$",
|
|
2154
|
+
"^169\\.254(?:\\.[0-9]{1,3}){2}$",
|
|
2155
|
+
"^metadata\\.google\\.internal$",
|
|
2156
|
+
"^169\\.254\\.169\\.254$"
|
|
2157
|
+
],
|
|
2158
|
+
maxCodeSize: 10 * 1024 * 1024,
|
|
2159
|
+
fetchTimeoutMs: 30000,
|
|
2160
|
+
requireHash: false,
|
|
2161
|
+
enableCache: true,
|
|
2162
|
+
cacheTtl: 3600
|
|
2163
|
+
},
|
|
1934
2164
|
audit: {
|
|
1935
2165
|
enabled: false,
|
|
1936
2166
|
destination: "filesystem",
|
|
@@ -1980,6 +2210,13 @@ function mergeConfig(defaults, overrides) {
|
|
|
1980
2210
|
seccomp: overrides.security?.seccomp ?? defaults.security.seccomp,
|
|
1981
2211
|
customProfilePath: overrides.security?.customProfilePath ?? defaults.security.customProfilePath
|
|
1982
2212
|
},
|
|
2213
|
+
remoteCode: {
|
|
2214
|
+
...defaults.remoteCode,
|
|
2215
|
+
...overrides.remoteCode,
|
|
2216
|
+
allowedSchemes: overrides.remoteCode?.allowedSchemes ?? defaults.remoteCode.allowedSchemes,
|
|
2217
|
+
allowedHosts: overrides.remoteCode?.allowedHosts ?? defaults.remoteCode.allowedHosts,
|
|
2218
|
+
blockedHosts: overrides.remoteCode?.blockedHosts ?? defaults.remoteCode.blockedHosts
|
|
2219
|
+
},
|
|
1983
2220
|
audit: {
|
|
1984
2221
|
...defaults.audit,
|
|
1985
2222
|
...overrides.audit
|
|
@@ -1998,7 +2235,7 @@ init_logger();
|
|
|
1998
2235
|
// package.json
|
|
1999
2236
|
var package_default = {
|
|
2000
2237
|
name: "isol8",
|
|
2001
|
-
version: "0.10.
|
|
2238
|
+
version: "0.10.3",
|
|
2002
2239
|
description: "Secure code execution engine for AI agents",
|
|
2003
2240
|
author: "Illusion47586",
|
|
2004
2241
|
license: "MIT",
|
|
@@ -2153,7 +2390,7 @@ async function createServer(options) {
|
|
|
2153
2390
|
app.post("/execute", async (c) => {
|
|
2154
2391
|
const body = await c.req.json();
|
|
2155
2392
|
logger.debug(`[Server] POST /execute runtime=${body.request.runtime} sessionId=${body.sessionId ?? "ephemeral"}`);
|
|
2156
|
-
logger.debug(`[Server] Code
|
|
2393
|
+
logger.debug(`[Server] Code source: ${body.request.codeUrl ? `url=${body.request.codeUrl}` : `inline (${body.request.code?.length ?? 0} chars)`}`);
|
|
2157
2394
|
const engineOptions = {
|
|
2158
2395
|
network: config.defaults.network,
|
|
2159
2396
|
memoryLimit: config.defaults.memoryLimit,
|
|
@@ -2161,6 +2398,7 @@ async function createServer(options) {
|
|
|
2161
2398
|
timeoutMs: config.defaults.timeoutMs,
|
|
2162
2399
|
sandboxSize: config.defaults.sandboxSize,
|
|
2163
2400
|
tmpSize: config.defaults.tmpSize,
|
|
2401
|
+
remoteCode: config.remoteCode,
|
|
2164
2402
|
...body.options,
|
|
2165
2403
|
mode: body.sessionId ? "persistent" : "ephemeral",
|
|
2166
2404
|
audit: config.audit
|
|
@@ -2214,7 +2452,7 @@ async function createServer(options) {
|
|
|
2214
2452
|
app.post("/execute/stream", async (c) => {
|
|
2215
2453
|
const body = await c.req.json();
|
|
2216
2454
|
logger.debug(`[Server] POST /execute/stream runtime=${body.request.runtime}`);
|
|
2217
|
-
logger.debug(`[Server] Code
|
|
2455
|
+
logger.debug(`[Server] Code source: ${body.request.codeUrl ? `url=${body.request.codeUrl}` : `inline (${body.request.code?.length ?? 0} chars)`}`);
|
|
2218
2456
|
const engineOptions = {
|
|
2219
2457
|
network: config.defaults.network,
|
|
2220
2458
|
memoryLimit: config.defaults.memoryLimit,
|
|
@@ -2222,6 +2460,7 @@ async function createServer(options) {
|
|
|
2222
2460
|
timeoutMs: config.defaults.timeoutMs,
|
|
2223
2461
|
sandboxSize: config.defaults.sandboxSize,
|
|
2224
2462
|
tmpSize: config.defaults.tmpSize,
|
|
2463
|
+
remoteCode: config.remoteCode,
|
|
2225
2464
|
...body.options,
|
|
2226
2465
|
mode: "ephemeral"
|
|
2227
2466
|
};
|
|
@@ -2346,4 +2585,4 @@ export {
|
|
|
2346
2585
|
BunAdapter
|
|
2347
2586
|
};
|
|
2348
2587
|
|
|
2349
|
-
//# debugId=
|
|
2588
|
+
//# debugId=67CAC3EDCF50B21864756E2164756E21
|
package/dist/src/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;GAGG;AACH,QAAA,MAAM,cAAc,EAAE,
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;GAGG;AACH,QAAA,MAAM,cAAc,EAAE,WAuDrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAepD;AA8CD,OAAO,EAAE,cAAc,EAAE,CAAC"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
import type { RemoteCodePolicy } from "../types";
|
|
2
|
+
export interface FetchCodeRequest {
|
|
3
|
+
codeUrl: string;
|
|
4
|
+
codeHash?: string;
|
|
5
|
+
allowInsecureCodeUrl?: boolean;
|
|
6
|
+
}
|
|
7
|
+
export interface FetchCodeResult {
|
|
8
|
+
code: string;
|
|
9
|
+
url: string;
|
|
10
|
+
hash: string;
|
|
11
|
+
}
|
|
12
|
+
interface CodeFetcherDeps {
|
|
13
|
+
fetchFn?: (input: string, init?: RequestInit) => Promise<Response>;
|
|
14
|
+
lookupFn?: (hostname: string) => Promise<Array<{
|
|
15
|
+
address: string;
|
|
16
|
+
family: number;
|
|
17
|
+
}>>;
|
|
18
|
+
}
|
|
19
|
+
export declare function fetchRemoteCode(request: FetchCodeRequest, policy: RemoteCodePolicy, deps?: CodeFetcherDeps): Promise<FetchCodeResult>;
|
|
20
|
+
export {};
|
|
21
|
+
//# sourceMappingURL=code-fetcher.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"code-fetcher.d.ts","sourceRoot":"","sources":["../../../src/engine/code-fetcher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACtF;AA2GD,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,eAAe,CAAC,CAkH1B"}
|
|
@@ -49,10 +49,12 @@ export declare class DockerIsol8 implements Isol8Engine {
|
|
|
49
49
|
private readonly poolStrategy;
|
|
50
50
|
private readonly poolSize;
|
|
51
51
|
private readonly auditLogger?;
|
|
52
|
+
private readonly remoteCodePolicy;
|
|
52
53
|
private container;
|
|
53
54
|
private persistentRuntime;
|
|
54
55
|
private pool;
|
|
55
56
|
private readonly imageCache;
|
|
57
|
+
private resolveExecutionRequest;
|
|
56
58
|
/**
|
|
57
59
|
* @param options - Sandbox configuration options.
|
|
58
60
|
* @param maxConcurrent - Maximum number of concurrent executions (controls the internal semaphore).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/engine/docker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEX,YAAY,
|
|
1
|
+
{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/engine/docker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEX,YAAY,EAKZ,WAAW,EACZ,MAAM,UAAU,CAAC;AA0UlB,2HAA2H;AAC3H,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAY,YAAW,WAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IAEpD,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,IAAI,CAA8B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;YAE1C,uBAAuB;IA6BrC;;;OAGG;gBACS,OAAO,GAAE,kBAAuB,EAAE,aAAa,SAAK;IA2ChE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,kFAAkF;IAC5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B;;;OAGG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgB9D;;OAEG;YACW,WAAW;IAoDzB;;OAEG;YACW,qBAAqB;IA8CnC;;OAEG;YACW,kBAAkB;IA+DhC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpE;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5C,6GAA6G;IAC7G,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC;YAuFzD,YAAY;YAwBZ,gBAAgB;YA8JhB,iBAAiB;YAwIjB,aAAa;YAkBb,oBAAoB;YASpB,wBAAwB;IA4BtC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,yBAAyB;IAyBjC,OAAO,CAAC,QAAQ;YAwCD,gBAAgB;YA8EjB,iBAAiB;IAiG/B,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;;;;;;;;;;;;;;OAoBG;WACU,OAAO,CAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA2BlE"}
|
|
@@ -21,19 +21,29 @@ type ProgressCallback = (progress: BuildProgress) => void;
|
|
|
21
21
|
* Builds the base `isol8:<runtime>` images for all registered runtimes.
|
|
22
22
|
* Each image is built from the multi-stage Dockerfile in `docker/`.
|
|
23
23
|
*
|
|
24
|
+
* Uses smart build logic: computes a hash of the docker directory contents
|
|
25
|
+
* and skips builds if the image already exists with matching hash.
|
|
26
|
+
* Cleans up dangling images after rebuilding.
|
|
27
|
+
*
|
|
24
28
|
* @param docker - Dockerode instance.
|
|
25
29
|
* @param onProgress - Optional callback for build progress updates.
|
|
30
|
+
* @param force - If true, always rebuild even if image is up to date.
|
|
26
31
|
*/
|
|
27
|
-
export declare function buildBaseImages(docker: Docker, onProgress?: ProgressCallback): Promise<void>;
|
|
32
|
+
export declare function buildBaseImages(docker: Docker, onProgress?: ProgressCallback, force?: boolean): Promise<void>;
|
|
28
33
|
/**
|
|
29
34
|
* Builds custom images with user-specified dependencies layered on top of
|
|
30
35
|
* the base images. Reads package lists from the config's `dependencies` field.
|
|
31
36
|
*
|
|
37
|
+
* Uses smart build logic: computes a hash of the dependency list and
|
|
38
|
+
* skips builds if the image already exists with matching hash.
|
|
39
|
+
* Cleans up dangling images after rebuilding.
|
|
40
|
+
*
|
|
32
41
|
* @param docker - Dockerode instance.
|
|
33
42
|
* @param config - Resolved isol8 configuration.
|
|
34
43
|
* @param onProgress - Optional callback for build progress updates.
|
|
44
|
+
* @param force - If true, always rebuild even if image is up to date.
|
|
35
45
|
*/
|
|
36
|
-
export declare function buildCustomImages(docker: Docker, config: Isol8Config, onProgress?: ProgressCallback): Promise<void>;
|
|
46
|
+
export declare function buildCustomImages(docker: Docker, config: Isol8Config, onProgress?: ProgressCallback, force?: boolean): Promise<void>;
|
|
37
47
|
/**
|
|
38
48
|
* Checks if an image exists locally.
|
|
39
49
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"image-builder.d.ts","sourceRoot":"","sources":["../../../src/engine/image-builder.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"image-builder.d.ts","sourceRoot":"","sources":["../../../src/engine/image-builder.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAmG5C,mDAAmD;AACnD,UAAU,aAAa;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACtC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,gBAAgB,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAoEf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAkBf;AAgGD;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOrF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F"}
|
package/dist/src/index.d.ts
CHANGED
|
@@ -12,6 +12,6 @@ export { DockerIsol8 } from "./engine/docker";
|
|
|
12
12
|
export { BunAdapter, bashAdapter, DenoAdapter, NodeAdapter, PythonAdapter, RuntimeRegistry, } from "./runtime";
|
|
13
13
|
export type { RuntimeAdapter } from "./runtime/adapter";
|
|
14
14
|
export { createServer } from "./server/index";
|
|
15
|
-
export type { ExecutionRequest, ExecutionResult, Isol8Config, Isol8Engine, Isol8Mode, Isol8Options, NetworkFilterConfig, NetworkMode, Runtime, StreamEvent, } from "./types";
|
|
15
|
+
export type { ExecutionRequest, ExecutionResult, Isol8Config, Isol8Engine, Isol8Mode, Isol8Options, NetworkFilterConfig, NetworkMode, RemoteCodePolicy, Runtime, StreamEvent, } from "./types";
|
|
16
16
|
export { VERSION } from "./version";
|
|
17
17
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/src/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EACL,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,OAAO,EACP,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EACL,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,OAAO,EACP,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa;;;;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa;;;;GAiQxD"}
|
package/dist/src/types.d.ts
CHANGED
|
@@ -27,8 +27,23 @@ export type NetworkMode = "none" | "host" | "filtered";
|
|
|
27
27
|
* A request to execute code inside isol8.
|
|
28
28
|
*/
|
|
29
29
|
export interface ExecutionRequest {
|
|
30
|
-
/**
|
|
31
|
-
|
|
30
|
+
/**
|
|
31
|
+
* Source code to execute.
|
|
32
|
+
* Mutually exclusive with {@link codeUrl}.
|
|
33
|
+
*/
|
|
34
|
+
code?: string;
|
|
35
|
+
/**
|
|
36
|
+
* Remote URL to fetch source code from before execution.
|
|
37
|
+
* Mutually exclusive with {@link code}.
|
|
38
|
+
*/
|
|
39
|
+
codeUrl?: string;
|
|
40
|
+
/** Expected SHA-256 hash (hex) of the fetched source code. */
|
|
41
|
+
codeHash?: string;
|
|
42
|
+
/**
|
|
43
|
+
* Allow `http://` code URLs for this request.
|
|
44
|
+
* By default, only `https://` is allowed.
|
|
45
|
+
*/
|
|
46
|
+
allowInsecureCodeUrl?: boolean;
|
|
32
47
|
/** Target runtime. Must match a registered {@link RuntimeAdapter}. */
|
|
33
48
|
runtime: Runtime;
|
|
34
49
|
/**
|
|
@@ -248,6 +263,8 @@ export interface Isol8Options {
|
|
|
248
263
|
security?: SecurityConfig;
|
|
249
264
|
/** Audit logging configuration. */
|
|
250
265
|
audit?: AuditConfig;
|
|
266
|
+
/** Remote code fetching policy. */
|
|
267
|
+
remoteCode?: RemoteCodePolicy;
|
|
251
268
|
/**
|
|
252
269
|
* Pool strategy for container reuse.
|
|
253
270
|
* - "secure": Clean container before returning (slower but ensures clean state)
|
|
@@ -316,6 +333,27 @@ export interface NetworkFilterConfig {
|
|
|
316
333
|
/** Regex patterns for blocked hostnames. Matching hosts are always denied, even if whitelisted. */
|
|
317
334
|
blacklist: string[];
|
|
318
335
|
}
|
|
336
|
+
/** Policy for fetching remote source code. */
|
|
337
|
+
export interface RemoteCodePolicy {
|
|
338
|
+
/** Enable URL-based source fetching. @default false */
|
|
339
|
+
enabled: boolean;
|
|
340
|
+
/** Allowed URL schemes. @default ["https"] */
|
|
341
|
+
allowedSchemes: string[];
|
|
342
|
+
/** Allowed hostname regex patterns. Empty means allow all (subject to blocklist). */
|
|
343
|
+
allowedHosts: string[];
|
|
344
|
+
/** Blocked hostname regex patterns. */
|
|
345
|
+
blockedHosts: string[];
|
|
346
|
+
/** Max fetched source size in bytes. @default 10485760 (10MB) */
|
|
347
|
+
maxCodeSize: number;
|
|
348
|
+
/** Fetch timeout in milliseconds. @default 30000 */
|
|
349
|
+
fetchTimeoutMs: number;
|
|
350
|
+
/** Require `ExecutionRequest.codeHash` for URL-based execution. @default false */
|
|
351
|
+
requireHash: boolean;
|
|
352
|
+
/** Cache support toggle for future use. @default true */
|
|
353
|
+
enableCache: boolean;
|
|
354
|
+
/** Cache TTL in seconds for future use. @default 3600 */
|
|
355
|
+
cacheTtl: number;
|
|
356
|
+
}
|
|
319
357
|
/** Configuration for default execution settings. */
|
|
320
358
|
export interface Isol8Defaults {
|
|
321
359
|
/** Default timeout in milliseconds. @default 30000 */
|
|
@@ -409,6 +447,8 @@ export interface Isol8Config {
|
|
|
409
447
|
dependencies: Isol8Dependencies;
|
|
410
448
|
/** Security settings. */
|
|
411
449
|
security: SecurityConfig;
|
|
450
|
+
/** Remote code fetching policy. */
|
|
451
|
+
remoteCode: RemoteCodePolicy;
|
|
412
452
|
/** Audit logging configuration. */
|
|
413
453
|
audit: AuditConfig;
|
|
414
454
|
/** Enable debug logging. @default false */
|
|
@@ -435,6 +475,8 @@ export interface Isol8UserConfig {
|
|
|
435
475
|
dependencies?: Isol8Dependencies;
|
|
436
476
|
/** Security settings. */
|
|
437
477
|
security?: SecurityConfig;
|
|
478
|
+
/** Remote code fetching policy. (Partial override allowed). */
|
|
479
|
+
remoteCode?: Partial<RemoteCodePolicy>;
|
|
438
480
|
/** Audit logging configuration. */
|
|
439
481
|
audit?: Partial<AuditConfig>;
|
|
440
482
|
}
|
package/dist/src/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IAEf,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IAEnB,0FAA0F;IAC1F,SAAS,EAAE,OAAO,CAAC;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IAEjB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAElB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC;;;;GAIC;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAID;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,yFAAyF;IACzF,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wIAAwI;IACxI,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB,mCAAmC;IACnC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,kEAAkE;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;CAClE;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,mGAAmG;IACnG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qFAAqF;IACrF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IAEtB,sDAAsD;IACtD,QAAQ,EAAE,aAAa,CAAC;IAExB,4DAA4D;IAC5D,OAAO,EAAE,mBAAmB,CAAC;IAE7B,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IAEtB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,EAAE,cAAc,CAAC;IAEzB,mCAAmC;IACnC,UAAU,EAAE,gBAAgB,CAAC;IAE7B,mCAAmC;IACnC,KAAK,EAAE,WAAW,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAElC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhC,mEAAmE;IACnE,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvC,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9B"}
|