kern-sandbox 0.2.34 → 0.2.35

package/README.md

@@ -10,7 +10,9 @@ runtime's own are in [BENCHMARKS.md](https://github.com/getkern/kern/blob/main/B
 `kern-sandbox` is the Node and TypeScript binding for **[kern](https://getkern.dev)**: a rootless,
 kernel-enforced sandbox out of one static binary, with no daemon, no VM and no cloud. An agent's
 tool-call, a model's generated snippet, a CI step: code that runs before anyone reads it gets its own
-box, and the box is thrown away after.
+box, and the box is thrown away after. A hundred calls are a hundred boxes and 1.4 s in total, with
+nothing left behind, and when state has to carry across them there is
+[a session](#a-session-files-persist-processes-are-ephemeral) and a warm interpreter.
 
 Network off, memory and PID caps the kernel enforces **where your host delegates them**,
 capabilities dropped, a deny-by-default seccomp allowlist, and a wall-clock deadline the binding

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.34";
+const VERSION = "0.2.35";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
@@ -1070,6 +1070,15 @@ function isKernDiagnostic(line) {
   return KERN_DIAGNOSTICS.some((p) => s.startsWith(p));
 }
 
+/** Why the box did not start: kern's stderr with its warning and note lines dropped, capped at 500.
+ * kern writes those BEFORE the error, and inside a container (the shape Google Colab has) a ~430-
+ * character warning pushed `error: sandbox: unprivileged user namespaces are unavailable` to character
+ * 557, past a plain first-500 cut. Mirrors `_startup_failure_message` in the Python binding. */
+function startupFailureMessage(stderr) {
+  const kept = stderr.split("\n").filter((l) => !isKernDiagnostic(l)).join("\n").trim();
+  return (kept || stderr.trim()).slice(0, 500);
+}
+
 /** The sentence kern prints when it has READ the kernel's OOM counter for this box's own cgroup. A
  * contract between two programs: if kern rewords it, this stops recognising a real OOM and starts
  * reporting `killed` - wrong in the safe direction, still wrong. Mirrors `_KERN_OOM_MARKER`. */
@@ -2061,7 +2070,7 @@ class Sandbox {
     // exits 125 ITSELF (the code ran and chose 125) is NOT mislabeled. `finish` REJECTS only on rc===125;
     // a non-125 startup_failed (an older kern's 127, or a forged marker) is returned as DATA, not thrown.
     if (rc !== 0 && looksLikeStartupFailure(stderr))
-      return sandboxFault("startup_failed", stderr.trim().slice(0, 500));
+      return sandboxFault("startup_failed", startupFailureMessage(stderr));
     // Any other non-zero exit (incl. 139 SIGSEGV) is the USER's code failing - a normal Result.
     return null;
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.34",
-  "description": "Run LLM-generated code in a real Linux container, one per call, on your own machine. No daemon, no VM, no cloud, no account. A kernel boundary, not a microVM: for deliberately hostile code, use one.",
+  "version": "0.2.35",
+  "description": "Your model writes the code. This runs it where it can't touch your machine: a rootless Linux container, no daemon, no VM, no cloud, no account. A kernel boundary, not a microVM: for deliberately hostile code, use one.",
   "keywords": [
     "sandbox",
     "kern",