kern-sandbox 0.1.7 → 0.1.9

package/README.md

@@ -1,10 +1,15 @@
 # kern-sandbox (Node.js / TypeScript)
 
-Run LLM/agent-generated code in a fast, **local**, daemonless kernel sandbox, straight from Node.
+**[kern](https://github.com/getkern/kern)** is a fast, rootless, daemonless Linux sandbox runtime: a real,
+kernel-enforced box that starts in **~2 ms**, from one **~1.6 MB** binary, with no daemon. **kern-sandbox**
+is its Node / TypeScript binding: run untrusted or agent-generated code in a fresh, isolated box, from Node.
+
+On npm: [`npm install kern-sandbox`](https://www.npmjs.com/package/kern-sandbox). For Python, the same
+package is on PyPI: [`kern-sandbox`](https://pypi.org/project/kern-sandbox/).
 
 It is a thin, dependency-free wrapper around the [`kern`](https://github.com/getkern/kern) binary:
 a fresh, isolated box per call, network off by default, hard resource caps, and a timeout the binding
-itself enforces. E2B/Firecracker territory, but local and about 1.6 MB, with no cloud, no account, no VM.
+itself enforces. Kernel-enforced isolation (namespaces, cgroups v2, seccomp), local, about 1.6 MB, with no cloud, no account, no VM.
 
 ```js
 const kern = require("kern-sandbox");
@@ -32,8 +37,8 @@ You also need the `kern` binary on `PATH` (or point `$KERN_BIN` at it). One line
 curl -fsSL https://raw.githubusercontent.com/getkern/kern/main/install.sh | sh
 ```
 
-kern needs a Linux kernel with unprivileged user namespaces + cgroup v2. On Windows it runs under WSL2;
-on macOS, inside a Linux VM. Node 18+.
+kern needs a Linux kernel with unprivileged user namespaces + cgroup v2. On Windows it runs under WSL2.
+Node 18+.
 
 ## A session: files persist, processes are ephemeral
 
@@ -76,6 +81,7 @@ const r = await kern.runCode("console.log([1,2,3].map(x => x * x))", {
 |---|---|
 | `stdout`, `stderr` | captured output (each capped at `maxOutputBytes`) |
 | `exitCode` | the process exit code |
+| `durationMs` | wall-clock duration of the call, in ms |
 | `success` | `true` iff `exitCode === 0` **and** no sandbox fault |
 | `fault` | a sandbox event, or `null`. `{ type, message }` |
 | `files` | files created/modified in the workspace this call |
@@ -147,7 +153,7 @@ Desktop / Cursor) ships in the Python package `kern-sandbox` (`pip install kern-
 ## Charts, rich results, live output, and checkpoints
 
 **Rich results (the "code interpreter" pattern).** `runCode` runs Python by default, and like a
-Jupyter/E2B cell it captures rich, mime-typed values into `result.results` (a list of `Result`) with
+Jupyter cell it captures rich, mime-typed values into `result.results` (a list of `Result`) with
 **no Jupyter kernel**: the value of the code's **last bare expression**, every **`display(obj)`** call,
 and **every open matplotlib figure automatically** (no `savefig`). Accessors: `.png`/`.jpeg` (Buffer),
 `.html`, `.svg`, `.markdown`, `.json`, `.text`.
@@ -167,7 +173,7 @@ Capture never touches `stdout`/`stderr`/`exitCode`; a statement returning `None`
 can still WRITE an artifact to the workspace and `readFile` it if you prefer.
 
 **Warm kernel (kill the interpreter boot).** Each `runCode` starts a **fresh** interpreter, paying the
-CPython boot (~10 ms) every call. When you run many cells that share state (a REPL, a notebook, an
+CPython boot (~12 ms) every call. When you run many cells that share state (a REPL, a notebook, an
 agent's tool loop), open a `kernel()`: ONE warm interpreter in a long-lived box, fed cells over a pipe.
 In-memory state persists across cells and the per-cell cost drops from ~16 ms to **sub-millisecond**
 (~300x). Same rich `results` capture as `runCode`.
@@ -205,8 +211,9 @@ clear error otherwise). The Python binding uses the stdlib `tarfile` and has no
 
 kern is a **kernel-boundary** sandbox for **your own or semi-trusted** code (CI, dev, edge, your
 agents' code). Its seccomp filter is a **denylist**: right for semi-trusted agent code, **not** a hard
-boundary against deliberately hostile multi-tenant code. For that, reach for a microVM (Firecracker) or
-gVisor. See the project's [SECURITY.md](https://github.com/getkern/kern/blob/main/SECURITY.md).
+boundary against deliberately hostile multi-tenant code. For that, reach for a microVM (Firecracker /
+Kata) or gVisor. A deny-by-default allowlist mode is on the roadmap. See the project's
+[SECURITY.md](https://github.com/getkern/kern/blob/main/SECURITY.md).
 
 ## License
 

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.1.7";
+const VERSION = "0.1.8";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kern-sandbox",
-  "version": "0.1.7",
-  "description": "A fast, local, daemonless code-interpreter sandbox for agent/LLM code: run Python/JS/Bash, get rich results (charts, tables), no cloud/account/VM. A thin, dependency-free wrapper around the kern binary.",
+  "version": "0.1.9",
+  "description": "kern is a fast, rootless, daemonless Linux sandbox runtime; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box, ~2 ms, no cloud, no account, no VM.",
   "keywords": [
     "sandbox",
     "kern",