isol8 0.4.2 → 0.4.3

package/README.md

@@ -11,8 +11,9 @@ Secure code execution engine for AI agents. Run untrusted Python, Node.js, Bun,
 - **Security first** — read-only rootfs, `no-new-privileges`, PID/memory/CPU limits
 - **Network control** — `none` (default), `host`, or `filtered` (HTTP/HTTPS proxy with regex whitelist/blacklist)
 - **File I/O** — upload files into and download files from sandboxes
-- **Runtime packages** — install pip/npm/bun packages on-the-fly via `installPackages`
-- **Secret masking** — environment variables are scrubbed from output
+-   **Runtime packages** — install pip/npm/bun packages on-the-fly (`--install`)
+-   **Modern Node.js** — defaults to ESM (`.mjs`), supports CommonJS (`.cjs`)
+-   **Secret masking** — environment variables are scrubbed from output
 - **Output truncation** — prevents runaway stdout (default 1MB cap)
 - **Remote mode** — run an HTTP server and execute from anywhere
 - **Embeddable** — use as a TypeScript library in your own project

package/dist/cli.js

@@ -6929,6 +6929,11 @@ var require_utils2 = __commonJS((exports, module) => {
   };
 });
 
+// node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
+var require_sshcrypto = __commonJS((exports, module) => {
+  module.exports = __require("./sshcrypto-0209sx47.node");
+});
+
 // node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/isol8/isol8/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/isol8/isol8/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -7415,7 +7420,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
+    binding = require_sshcrypto();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -54826,9 +54831,12 @@ var init_adapter = __esm(() => {
   adapters = new Map;
   extensionMap = new Map;
   RuntimeRegistry = {
-    register(adapter) {
+    register(adapter, aliases = []) {
       adapters.set(adapter.name, adapter);
       extensionMap.set(adapter.getFileExtension(), adapter);
+      for (const ext of aliases) {
+        extensionMap.set(ext, adapter);
+      }
     },
     get(name) {
       const adapter = adapters.get(name);
@@ -54926,7 +54934,7 @@ var init_node = __esm(() => {
       return ["node", "-e", code];
     },
     getFileExtension() {
-      return ".js";
+      return ".mjs";
     }
   };
 });
@@ -54964,7 +54972,7 @@ var init_runtime = __esm(() => {
   init_node();
   init_python();
   RuntimeRegistry.register(PythonAdapter);
-  RuntimeRegistry.register(NodeAdapter);
+  RuntimeRegistry.register(NodeAdapter, [".js", ".cjs"]);
   RuntimeRegistry.register(BunAdapter);
   RuntimeRegistry.register(bashAdapter);
   RuntimeRegistry.register(DenoAdapter);
@@ -55459,7 +55467,8 @@ class DockerIsol8 {
         if (this.network === "filtered") {
           await startProxy(container, this.networkFilter);
         }
-        const filePath = `${SANDBOX_WORKDIR}/main${adapter.getFileExtension()}`;
+        const ext = req.fileExtension ?? adapter.getFileExtension();
+        const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
         await writeFileViaExec(container, filePath, req.code);
         if (req.installPackages?.length) {
           await installPackages(container, req.runtime, req.installPackages);
@@ -55533,7 +55542,8 @@ class DockerIsol8 {
       if (this.network === "filtered") {
         await startProxy(container, this.networkFilter);
       }
-      const filePath = `${SANDBOX_WORKDIR}/main${adapter.getFileExtension()}`;
+      const ext = req.fileExtension ?? adapter.getFileExtension();
+      const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
       await writeFileViaExec(container, filePath, req.code);
       if (req.installPackages?.length) {
         await installPackages(container, req.runtime, req.installPackages);
@@ -55590,7 +55600,8 @@ class DockerIsol8 {
     } else if (this.persistentRuntime?.name !== adapter.name) {
       throw new Error(`Cannot switch runtime from "${this.persistentRuntime?.name}" to "${adapter.name}". Each persistent container supports a single runtime. Create a new Isol8 instance for a different runtime.`);
     }
-    const filePath = `${SANDBOX_WORKDIR}/exec_${Date.now()}${adapter.getFileExtension()}`;
+    const ext = req.fileExtension ?? adapter.getFileExtension();
+    const filePath = `${SANDBOX_WORKDIR}/exec_${Date.now()}${ext}`;
     if (this.readonlyRootFs) {
       await writeFileViaExec(this.container, filePath, req.code);
     } else {
@@ -61221,7 +61232,7 @@ program2.command("setup").description("Check Docker and build isol8 images").opt
 [DONE] Setup complete!`);
 });
 program2.command("run").description("Execute code in isol8").argument("[file]", "Script file to execute").option("-e, --eval <code>", "Execute inline code string").option("-r, --runtime <name>", "Force runtime (python, node, bun, deno, bash)").option("--net <mode>", "Network mode: none, host, filtered", "none").option("--allow <regex>", "Whitelist regex for filtered mode (repeatable)", collect, []).option("--deny <regex>", "Blacklist regex for filtered mode (repeatable)", collect, []).option("--out <file>", "Write output to file").option("--persistent", "Use persistent container").option("--timeout <ms>", "Execution timeout in milliseconds").option("--memory <limit>", "Memory limit (e.g. 512m, 1g)").option("--cpu <limit>", "CPU limit as fraction (e.g. 0.5, 2.0)").option("--image <name>", "Override Docker image").option("--pids-limit <n>", "Maximum number of processes").option("--writable", "Disable read-only root filesystem").option("--max-output <bytes>", "Maximum output size in bytes").option("--secret <KEY=VALUE>", "Secret env var (repeatable, values masked)", collect, []).option("--sandbox-size <size>", "Sandbox tmpfs size (e.g. 128m)").option("--tmp-size <size>", "Tmp tmpfs size (e.g. 256m, 512m)").option("--stdin <data>", "Data to pipe to stdin").option("--install <package>", "Install package for runtime (repeatable)", collect, []).option("--host <url>", "Execute on remote server").option("--key <key>", "API key for remote server").option("--no-stream", "Disable real-time output streaming").action(async (file, opts) => {
-  const { code, runtime, engineOptions, engine, stdinData } = await resolveRunInput(file, opts);
+  const { code, runtime, engineOptions, engine, stdinData, fileExtension } = await resolveRunInput(file, opts);
   const cleanup = async () => {
     await engine.stop();
     process.exit(0);
@@ -61238,7 +61249,8 @@ program2.command("run").description("Execute code in isol8").argument("[file]",
       runtime,
       timeoutMs: engineOptions.timeoutMs,
       ...stdinData ? { stdin: stdinData } : {},
-      ...opts.install.length > 0 ? { installPackages: opts.install } : {}
+      ...opts.install.length > 0 ? { installPackages: opts.install } : {},
+      fileExtension
     };
     if (opts.stream !== false) {
       spinner.stop();
@@ -61480,9 +61492,15 @@ async function resolveRunInput(file, opts) {
     ...opts.pidsLimit ? { pidsLimit: Number.parseInt(opts.pidsLimit, 10) } : {},
     ...opts.writable ? { readonlyRootFs: false } : {},
     ...opts.maxOutput ? { maxOutputSize: Number.parseInt(opts.maxOutput, 10) } : {},
-    ...opts.sandboxSize ? { sandboxSize: opts.sandboxSize } : {},
     ...opts.tmpSize ? { tmpSize: opts.tmpSize } : {}
   };
+  let fileExtension;
+  if (file) {
+    const ext = file.substring(file.lastIndexOf("."));
+    if (ext) {
+      fileExtension = ext;
+    }
+  }
   const secrets = {};
   for (const s of opts.secret ?? []) {
     const idx = s.indexOf("=");
@@ -61505,7 +61523,7 @@ async function resolveRunInput(file, opts) {
   } else {
     engine = new DockerIsol8(engineOptions, config.maxConcurrent);
   }
-  return { code, runtime, engineOptions, engine, stdinData };
+  return { code, runtime, engineOptions, engine, stdinData, fileExtension };
 }
 function collect(value, previous) {
   return previous.concat([value]);
@@ -61516,4 +61534,4 @@ if (!process.argv.slice(2).length) {
 }
 program2.parse();
 
-//# debugId=56782BF23191267E64756E2164756E21
+//# debugId=E455279A70D3A2C764756E2164756E21