secure-exec 0.2.20 → 0.2.21

package/README.md

@@ -3,7 +3,7 @@
 </p>
 
 <p align="center">
-  Secure Node.js execution without a sandbox.<br/>Run untrusted JavaScript and TypeScript in an isolated VM with real Node.js APIs, npm packages, and a virtual filesystem.<br/>Powered by <a href="https://rivet.dev/agentos">agentOS</a>.
+  Secure Node.js execution without a sandbox.<br/>Run untrusted JavaScript and TypeScript in an isolated VM with real Node.js APIs, npm packages, and a virtual filesystem.
 </p>
 
 <p align="center">
@@ -46,8 +46,8 @@ other than `succeeded` carries an `error`, and guest stack traces arrive on
 ## Configure the VM
 
 VM options go on the call: `permissions`, `limits`, `mounts`, and the rest of
-the agentOS VM options. The network is denied unless you allow it, and a policy
-is merged over the defaults.
+the agentOS VM options. External network access is denied unless you allow it,
+and a policy is merged over the defaults.
 
 ```ts
 await evaluate(
@@ -60,24 +60,74 @@ await evaluate(
 );
 ```
 
-## Keep state with a context
+## Keep things with a VM
 
-A context is a dedicated VM that keeps variables, imports, files, and installed
-packages between calls. JavaScript and TypeScript share the same state.
+The functions above are one-shot conveniences. When files, installed packages,
+or a running server should outlast one call, create a VM. It is an agentOS VM
+with Secure Exec's defaults.
 
 ```ts
-import { createContext, execute } from "secure-exec";
-import { evaluate } from "secure-exec/typescript";
+import { createVm } from "secure-exec";
+
+const vm = await createVm({ permissions: { network: "allow" } });
+try {
+  await vm.npm.install(["zod"]);
+  await vm.filesystem.writeFile("/workspace/data.json", JSON.stringify({ n: 40 }));
+
+  const result = await vm.javascript.evaluate<number>(
+    `import("node:fs").then((fs) => JSON.parse(fs.readFileSync("/workspace/data.json", "utf8")).n + 2)`,
+  );
+
+  const server = await vm.javascript.spawn(`/* long-running code */`);
+  await vm.process.kill(server.pid);
+} finally {
+  await vm.dispose();
+}
+```
+
+`vm.javascript`, `vm.typescript`, `vm.npm`, `vm.filesystem`, `vm.network`, and
+`vm.process` behave exactly as they do in agentOS.
+
+## Keep variables with a context
 
-await using context = await createContext({ permissions: { network: "allow" } });
+Each call on a VM starts with fresh JavaScript memory. A context keeps it, like a
+REPL, and several contexts run in parallel in one VM.
 
-await execute("globalThis.total = 40", { context });
-const result = await evaluate<number>("(globalThis.total as number) + 2", { context });
+```ts
+const context = await vm.createContext();
+
+await context.execute("globalThis.total = 40");
+const result = await context.evaluate<number>("total + 2");
 
-await context.reset(); // clear state, keep the VM
+await context.reset();   // clear state
+await context.dispose(); // delete the context, keep the VM
 ```
 
-Without `await using`, call `context.dispose()` when you are done.
+## Host functions
+
+Give the code your own functions without giving it your credentials. Each
+collection is a global inside the VM, and each function is async.
+
+```ts
+import { evaluate, hostFunction, hostFunctions } from "secure-exec";
+import { z } from "zod";
+
+const orders = hostFunctions({
+  name: "orders",
+  description: "Look up customer orders.",
+  functions: {
+    list: hostFunction({
+      description: "List a customer's orders.",
+      inputSchema: z.object({ customer: z.string() }),
+      execute: ({ customer }) => db.orders.findMany({ customer }),
+    }),
+  },
+});
+
+await evaluate(`orders.list({ customer: "c_123" }).then((rows) => rows.length)`, {
+  hostFunctions: [orders],
+});
+```
 
 ## TypeScript
 
@@ -92,40 +142,24 @@ const checked = await check(`const total: number = "nope";`);
 for (const diagnostic of checked.diagnostics) console.log(diagnostic.message);
 ```
 
-## npm
-
-`secure-exec/npm` installs packages into a context's VM.
-
-```ts
-import { createContext, evaluate } from "secure-exec";
-import { install } from "secure-exec/npm";
-
-await using context = await createContext({ permissions: { network: "allow" } });
-await install(["zod"], { context });
-
-// Packages install into /workspace. Inline code resolves imports from
-// `filePath`, so place it next to node_modules.
-await evaluate(`import("zod").then(({ z }) => z.string().parse("ok"))`, {
-  context,
-  filePath: "/workspace/main.mjs",
-});
-```
-
-`runScript` and `runPackage` work like `npm run` and `npx`.
-
-## Warm up
+## Lifecycle
 
 The first call starts a shared sidecar process. Call `init()` at startup to pay
-that cost ahead of time.
+that cost ahead of time, and `shutdown()` to stop it, for example in a test
+teardown hook.
 
 ```ts
-import { init } from "secure-exec";
+import { init, shutdown } from "secure-exec";
 
 await init();
+// ...
+await shutdown();
 ```
 
 ## More
 
-For processes, filesystem access, Python, and agent sessions, use
+Need Python? Use the [agentOS Python execution API](https://rivet.dev/agentos/docs/python), which has the same `execute` and `evaluate` shape.
+
+For processes, filesystem access, and agent sessions, use
 [`@rivet-dev/agentos-core`](https://rivet.dev/agentos) directly. Read the [documentation](https://rivet.dev/secure-exec/docs), or browse the examples in
 [`secure-exec/examples`](https://github.com/rivet-dev/agentos/tree/main/secure-exec/examples).

package/dist/context.d.ts

@@ -0,0 +1,17 @@
+import type { AgentOs, CodeEvaluationResult, CodeExecutionResult, JavaScriptEvaluationOptions, JavaScriptExecutionOptions, JsonValue } from "@rivet-dev/agentos-core";
+/**
+ * Retained JavaScript state in a VM: variables and imports survive between
+ * calls. A context runs one call at a time. For TypeScript in the same state,
+ * pass `contextId` to `vm.typescript`.
+ */
+export interface Context extends AsyncDisposable {
+    readonly contextId: string;
+    execute(source: string, options?: Omit<JavaScriptExecutionOptions, "contextId">): Promise<CodeExecutionResult>;
+    evaluate<T = JsonValue>(source: string, options?: Omit<JavaScriptEvaluationOptions, "contextId">): Promise<CodeEvaluationResult<T>>;
+    /** Clear the retained state and keep the context. */
+    reset(): Promise<void>;
+    /** Delete the context. The VM is left running. */
+    dispose(): Promise<void>;
+}
+/** Create a context in `vm`. A VM can hold many, and they run in parallel. */
+export declare function createContext(vm: AgentOs): Promise<Context>;

package/dist/context.js

@@ -0,0 +1,15 @@
+import { randomUUID } from "node:crypto";
+/** Create a context in `vm`. A VM can hold many, and they run in parallel. */
+export async function createContext(vm) {
+    const contextId = randomUUID();
+    await vm.createContext(contextId);
+    const dispose = () => vm.contexts.delete(contextId);
+    return {
+        contextId,
+        execute: (source, options) => vm.javascript.execute(source, { ...options, contextId }),
+        evaluate: (source, options) => vm.javascript.evaluate(source, { ...options, contextId }),
+        reset: () => vm.contexts.reset(contextId),
+        dispose,
+        [Symbol.asyncDispose]: dispose,
+    };
+}

package/dist/index.d.ts

@@ -1,11 +1,15 @@
-import type { CodeEvaluationResult, CodeExecutionResult, JavaScriptEvaluationOptions, JavaScriptExecutionOptions, JsonValue } from "@rivet-dev/agentos-core";
-import { type Target } from "./runtime.js";
-export type { CodeEvaluationResult, CodeExecutionResult, ExecutionErrorData, ExecutionOutputOptions, JsonValue, LimitWarning, MountConfig, OutputCapture, Permissions, } from "@rivet-dev/agentos-core";
-export { createHostDirBackend, nodeModulesMount, } from "@rivet-dev/agentos-core";
-export { type Context, createContext, init, type Target, type VmOptions, } from "./runtime.js";
-export type ExecuteOptions = Omit<JavaScriptExecutionOptions, "contextId"> & Target;
-export type EvaluateOptions = Omit<JavaScriptEvaluationOptions, "contextId"> & Target;
+import type { CodeEvaluationResult, CodeExecutionResult, HostFunctionSchemas, JavaScriptEvaluationOptions, JavaScriptExecutionOptions, JsonValue, LanguageExecutionOptions } from "@rivet-dev/agentos-core";
+import { type OneShot } from "./runtime.js";
+export type { CodeEvaluationResult, CodeExecutionResult, ExecutionErrorData, ExecutionOutputOptions, HostFunction, HostFunctionCollection, HostFunctionCollections, HttpRequest, HttpResponse, JsonValue, LimitWarning, MountConfig, OutputCapture, Permissions, ProcessDescriptor, ProcessExit, SidecarRejectionDetail, } from "@rivet-dev/agentos-core";
+export { createHostDirBackend, hostDirMount, KernelError, nodeModulesMount, SidecarProcessError, SidecarProcessExited, SidecarRejectedError, SidecarSilenceTimeout, } from "@rivet-dev/agentos-core";
+export type { Context } from "./context.js";
+export { createVm, init, shutdown, type Vm, type VmOptions, } from "./runtime.js";
+export type ExecuteOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<JavaScriptExecutionOptions, HOST_FUNCTIONS>;
+export type EvaluateOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<JavaScriptEvaluationOptions, HOST_FUNCTIONS>;
+export type ExecuteFileOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<LanguageExecutionOptions, HOST_FUNCTIONS>;
 /** Run JavaScript for its side effects and captured output. */
-export declare function execute(source: string, options?: ExecuteOptions): Promise<CodeExecutionResult>;
+export declare function execute<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(source: string, options?: ExecuteOptions<HOST_FUNCTIONS>): Promise<CodeExecutionResult>;
 /** Evaluate one JavaScript expression and return its JSON value. */
-export declare function evaluate<T = JsonValue>(source: string, options?: EvaluateOptions): Promise<CodeEvaluationResult<T>>;
+export declare function evaluate<T = JsonValue, HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(source: string, options?: EvaluateOptions<HOST_FUNCTIONS>): Promise<CodeEvaluationResult<T>>;
+/** Run a JavaScript file from a mount, by its path inside the VM. */
+export declare function executeFile<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(path: string, options?: ExecuteFileOptions<HOST_FUNCTIONS>): Promise<CodeExecutionResult>;

package/dist/index.js

@@ -1,6 +1,6 @@
 import { run } from "./runtime.js";
-export { createHostDirBackend, nodeModulesMount, } from "@rivet-dev/agentos-core";
-export { createContext, init, } from "./runtime.js";
+export { createHostDirBackend, hostDirMount, KernelError, nodeModulesMount, SidecarProcessError, SidecarProcessExited, SidecarRejectedError, SidecarSilenceTimeout, } from "@rivet-dev/agentos-core";
+export { createVm, init, shutdown, } from "./runtime.js";
 /** Run JavaScript for its side effects and captured output. */
 export function execute(source, options) {
     return run(options, (vm, operationOptions) => vm.javascript.execute(source, operationOptions));
@@ -9,3 +9,7 @@ export function execute(source, options) {
 export function evaluate(source, options) {
     return run(options, (vm, operationOptions) => vm.javascript.evaluate(source, operationOptions));
 }
+/** Run a JavaScript file from a mount, by its path inside the VM. */
+export function executeFile(path, options) {
+    return run(options, (vm, operationOptions) => vm.javascript.executeFile(path, operationOptions));
+}

package/dist/runtime.d.ts

@@ -1,33 +1,39 @@
-import { AgentOs, type AgentOsOptions } from "@rivet-dev/agentos-core";
-/** Options for the VM that runs the code: permissions, limits, mounts, and so on. */
-export type VmOptions = AgentOsOptions;
+import { AgentOs, type AgentOsOptions, type HostFunctionSchemas } from "@rivet-dev/agentos-core";
+import { type Context } from "./context.js";
 /**
- * Retained language state inside a dedicated VM. Pass it as `context` to run
- * code against that state; dispose it to release the VM.
+ * Options for the VM that runs the code: permissions, limits, mounts, and so on.
+ *
+ * The type parameter exists only so each host function's `execute` infers its
+ * input from its own `inputSchema`; callers never write it.
  */
-export interface Context extends AsyncDisposable {
-    readonly contextId: string;
-    /** Clear the retained state. The VM and its filesystem are kept. */
-    reset(): Promise<void>;
-    /** Dispose the VM that backs this context. */
-    dispose(): Promise<void>;
-}
+export type VmOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = AgentOsOptions<HOST_FUNCTIONS>;
 /**
- * Where an operation runs: in an existing context, or, when `context` is
- * omitted, in a fresh VM configured by these options and disposed afterwards.
+ * A VM that lives until you dispose it. Files, installed packages, and
+ * background processes persist across the calls you make on it. Every namespace
+ * is the agentOS one, unchanged, so the agentOS docs describe its behavior.
  */
-export type Target = ({
-    context: Context;
-} & {
-    [K in keyof VmOptions]?: never;
-}) | ({
-    context?: never;
-} & VmOptions);
+export interface Vm extends AsyncDisposable {
+    readonly javascript: Omit<AgentOs["javascript"], "npm">;
+    readonly typescript: AgentOs["typescript"];
+    readonly npm: AgentOs["javascript"]["npm"];
+    readonly filesystem: AgentOs["filesystem"];
+    readonly network: AgentOs["network"];
+    readonly process: AgentOs["process"];
+    /** Create a context: JavaScript state that survives between calls. */
+    createContext(): Promise<Context>;
+    /** Dispose the VM and everything in it. */
+    dispose(): Promise<void>;
+}
+export declare function createVm<HOST_FUNCTIONS extends HostFunctionSchemas>(options?: VmOptions<HOST_FUNCTIONS>): Promise<Vm>;
+/** Options for a one-shot call: the operation's own options plus VM options. */
+export type OneShot<O, HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = Omit<O, "contextId"> & VmOptions<HOST_FUNCTIONS>;
 /** Start the shared sidecar process now so the first operation does not pay for it. */
 export declare function init(): Promise<void>;
-export declare function createContext(options?: VmOptions): Promise<Context>;
-export declare function contextVm(context: Context): AgentOs;
-/** Run `operation` in the target's context VM, or in a fresh VM disposed afterwards. */
-export declare function run<O extends object, R>(options: (O & Target) | undefined, operation: (vm: AgentOs, options: O & {
-    contextId?: string;
-}) => Promise<R>): Promise<R>;
+/**
+ * Stop the shared sidecar process and every VM still running in it. Call it when
+ * your process should exit while work may be in flight, such as at the end of a
+ * test run. The next call starts a new sidecar.
+ */
+export declare function shutdown(): Promise<void>;
+/** Run `operation` in a fresh VM built from the VM options, then dispose it. */
+export declare function run<O extends object, R, HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(options: (O & VmOptions<HOST_FUNCTIONS>) | undefined, operation: (vm: Vm, options: O) => Promise<R>): Promise<R>;

package/dist/runtime.js

@@ -1,4 +1,5 @@
 import { AgentOs, } from "@rivet-dev/agentos-core";
+import { createContext } from "./context.js";
 // Keep in sync with `AgentOsOptions`. The record type makes a missing or
 // unknown key a compile error.
 const VM_OPTION_KEYS = Object.keys({
@@ -13,7 +14,7 @@ const VM_OPTION_KEYS = Object.keys({
     mounts: true,
     sandbox: true,
     scheduleDriver: true,
-    bindings: true,
+    hostFunctions: true,
     permissions: true,
     sidecar: true,
     limits: true,
@@ -21,58 +22,38 @@ const VM_OPTION_KEYS = Object.keys({
     onAgentExit: true,
     onLimitWarning: true,
 });
-// The documented agentOS baseline: everything virtualized is allowed, the
-// network is denied, and a caller's policy is merged over it. The Rust client
-// applies this itself; the TypeScript core client instead allows everything
-// when `permissions` is omitted and denies every scope a partial policy leaves
-// out, so apply it here until core matches.
-const BASE_PERMISSIONS = {
-    fs: "allow",
-    network: "deny",
-    childProcess: "allow",
-    process: "allow",
-    env: "allow",
-    binding: "allow",
-};
-function createVm(options = {}) {
-    return AgentOs.create({
-        ...options,
-        permissions: { ...BASE_PERMISSIONS, ...options.permissions },
-    });
+export async function createVm(options = {}) {
+    const vm = await AgentOs.create(options);
+    const { npm, ...javascript } = vm.javascript;
+    const dispose = () => vm.dispose();
+    return {
+        javascript,
+        typescript: vm.typescript,
+        npm,
+        filesystem: vm.filesystem,
+        network: vm.network,
+        process: vm.process,
+        createContext: () => createContext(vm),
+        dispose,
+        [Symbol.asyncDispose]: dispose,
+    };
 }
-const contextVms = new WeakMap();
 /** Start the shared sidecar process now so the first operation does not pay for it. */
 export async function init() {
     // A bare VM is enough to start the sidecar; skip projecting default software.
     const vm = await createVm({ defaultSoftware: false });
     await vm.dispose();
 }
-export async function createContext(options) {
-    const vm = await createVm(options);
-    const contextId = crypto.randomUUID();
-    try {
-        await vm.createContext(contextId);
-    }
-    catch (error) {
-        throw await disposeAfterFailure(vm, error);
-    }
-    const context = {
-        contextId,
-        reset: () => vm.contexts.reset(contextId),
-        dispose: () => vm.dispose(),
-        [Symbol.asyncDispose]: () => vm.dispose(),
-    };
-    contextVms.set(context, vm);
-    return context;
-}
-export function contextVm(context) {
-    const vm = contextVms.get(context);
-    if (!vm) {
-        throw new TypeError("context must be created by createContext()");
-    }
-    return vm;
+/**
+ * Stop the shared sidecar process and every VM still running in it. Call it when
+ * your process should exit while work may be in flight, such as at the end of a
+ * test run. The next call starts a new sidecar.
+ */
+export async function shutdown() {
+    const sidecar = await AgentOs.getSharedSidecar();
+    await sidecar.dispose();
 }
-/** Run `operation` in the target's context VM, or in a fresh VM disposed afterwards. */
+/** Run `operation` in a fresh VM built from the VM options, then dispose it. */
 export async function run(options, operation) {
     const vmOptions = {};
     const operationOptions = {};
@@ -80,21 +61,10 @@ export async function run(options, operation) {
         const isVmOption = VM_OPTION_KEYS.includes(key);
         (isVmOption ? vmOptions : operationOptions)[key] = value;
     }
-    const { context, ...rest } = operationOptions;
-    if (context) {
-        const configured = Object.keys(vmOptions);
-        if (configured.length > 0) {
-            throw new TypeError(`${configured.join(", ")} cannot be combined with context; pass VM options to createContext()`);
-        }
-        return operation(contextVm(context), {
-            ...rest,
-            contextId: context.contextId,
-        });
-    }
     const vm = await createVm(vmOptions);
     let result;
     try {
-        result = await operation(vm, rest);
+        result = await operation(vm, operationOptions);
     }
     catch (error) {
         throw await disposeAfterFailure(vm, error);

package/dist/typescript.d.ts

@@ -1,12 +1,15 @@
-import type { CodeEvaluationResult, CodeExecutionResult, JsonValue, TypeScriptCheckOptions, TypeScriptCheckResult, TypeScriptEvaluationOptions, TypeScriptExecutionOptions } from "@rivet-dev/agentos-core";
-import { type Target } from "./runtime.js";
+import type { CodeEvaluationResult, CodeExecutionResult, HostFunctionSchemas, JsonValue, TypeScriptCheckOptions, TypeScriptCheckResult, TypeScriptEvaluationOptions, TypeScriptExecutionOptions, TypeScriptFileExecutionOptions } from "@rivet-dev/agentos-core";
+import { type OneShot } from "./runtime.js";
 export type { TypeScriptCheckResult, TypeScriptDiagnostic, } from "@rivet-dev/agentos-core";
-export type ExecuteOptions = Omit<TypeScriptExecutionOptions, "contextId"> & Target;
-export type EvaluateOptions = Omit<TypeScriptEvaluationOptions, "contextId"> & Target;
-export type CheckOptions = Omit<TypeScriptCheckOptions, "contextId"> & Target;
+export type ExecuteOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<TypeScriptExecutionOptions, HOST_FUNCTIONS>;
+export type EvaluateOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<TypeScriptEvaluationOptions, HOST_FUNCTIONS>;
+export type ExecuteFileOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<TypeScriptFileExecutionOptions, HOST_FUNCTIONS>;
+export type CheckOptions<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas> = OneShot<TypeScriptCheckOptions, HOST_FUNCTIONS>;
 /** Run TypeScript for its side effects and captured output. Types are stripped, not checked. */
-export declare function execute(source: string, options?: ExecuteOptions): Promise<CodeExecutionResult>;
+export declare function execute<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(source: string, options?: ExecuteOptions<HOST_FUNCTIONS>): Promise<CodeExecutionResult>;
 /** Evaluate one TypeScript expression and return its JSON value. Types are stripped, not checked. */
-export declare function evaluate<T = JsonValue>(source: string, options?: EvaluateOptions): Promise<CodeEvaluationResult<T>>;
+export declare function evaluate<T = JsonValue, HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(source: string, options?: EvaluateOptions<HOST_FUNCTIONS>): Promise<CodeEvaluationResult<T>>;
+/** Run a TypeScript file from a mount, by its path inside the VM. Types are stripped, not checked. */
+export declare function executeFile<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(path: string, options?: ExecuteFileOptions<HOST_FUNCTIONS>): Promise<CodeExecutionResult>;
 /** Type-check TypeScript without running it. */
-export declare function check(source: string, options?: CheckOptions): Promise<TypeScriptCheckResult>;
+export declare function check<HOST_FUNCTIONS extends HostFunctionSchemas = HostFunctionSchemas>(source: string, options?: CheckOptions<HOST_FUNCTIONS>): Promise<TypeScriptCheckResult>;

package/dist/typescript.js

@@ -7,6 +7,10 @@ export function execute(source, options) {
 export function evaluate(source, options) {
     return run(options, (vm, operationOptions) => vm.typescript.evaluate(source, operationOptions));
 }
+/** Run a TypeScript file from a mount, by its path inside the VM. Types are stripped, not checked. */
+export function executeFile(path, options) {
+    return run(options, (vm, operationOptions) => vm.typescript.executeFile(path, operationOptions));
+}
 /** Type-check TypeScript without running it. */
 export function check(source, options) {
     return run(options, (vm, operationOptions) => vm.typescript.check(source, operationOptions));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "secure-exec",
-	"version": "0.2.20",
+	"version": "0.2.21",
 	"description": "Secure Node.js execution for AI agents: run untrusted JavaScript and TypeScript in an isolated VM.",
 	"license": "Apache-2.0",
 	"type": "module",
@@ -10,26 +10,19 @@
 	"exports": {
 		".": {
 			"types": "./dist/index.d.ts",
-			"import": "./dist/index.js"
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
 		},
 		"./typescript": {
 			"types": "./dist/typescript.d.ts",
-			"import": "./dist/typescript.js"
-		},
-		"./npm": {
-			"types": "./dist/npm.d.ts",
-			"import": "./dist/npm.js"
+			"import": "./dist/typescript.js",
+			"default": "./dist/typescript.js"
 		}
 	},
 	"files": [
 		"dist",
 		"README.md"
 	],
-	"repository": {
-		"type": "git",
-		"url": "https://github.com/rivet-dev/agentos.git",
-		"directory": "packages/secure-exec"
-	},
 	"homepage": "https://rivet.dev/secure-exec",
 	"engines": {
 		"node": ">=22.0.0"
@@ -43,11 +36,17 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@rivet-dev/agentos-core": "0.2.20"
+		"@rivet-dev/agentos-core": "0.2.21"
 	},
 	"devDependencies": {
-		"@types/node": "^22.19.15",
-		"typescript": "^5.7.3",
-		"vitest": "^2.1.8"
+		"@types/node": "^22.10.2",
+		"typescript": "^5.7.2",
+		"vitest": "^2.1.8",
+		"zod": "^4.1.11"
+	},
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/rivet-dev/agentos.git",
+		"directory": "secure-exec"
 	}
 }

package/dist/npm.d.ts

@@ -1,20 +0,0 @@
-import type { CodeExecutionResult, LanguageExecutionOptions, NpmPackageInstallOptions, NpmProjectInstallOptions } from "@rivet-dev/agentos-core";
-import { type Context } from "./runtime.js";
-type InContext<O> = Omit<O, "contextId"> & {
-    context: Context;
-};
-export type InstallProjectOptions = InContext<NpmProjectInstallOptions>;
-export type InstallPackagesOptions = InContext<NpmPackageInstallOptions>;
-export type RunScriptOptions = InContext<LanguageExecutionOptions>;
-export type RunPackageOptions = InContext<LanguageExecutionOptions & {
-    binary?: string;
-}>;
-/** Install the dependencies of the `package.json` in the context's working directory. */
-export declare function install(options: InstallProjectOptions): Promise<CodeExecutionResult>;
-/** Install packages into the context's VM. */
-export declare function install(packages: string | string[], options: InstallPackagesOptions): Promise<CodeExecutionResult>;
-/** Run a `package.json` script, like `npm run`. */
-export declare function runScript(script: string, options: RunScriptOptions): Promise<CodeExecutionResult>;
-/** Run a package's binary, like `npx`. */
-export declare function runPackage(packageSpec: string, options: RunPackageOptions): Promise<CodeExecutionResult>;
-export {};

package/dist/npm.js

@@ -1,26 +0,0 @@
-import { contextVm } from "./runtime.js";
-export function install(packagesOrOptions, packageOptions) {
-    if (typeof packagesOrOptions === "string" ||
-        Array.isArray(packagesOrOptions)) {
-        const { context, ...options } = requireContext(packageOptions);
-        return contextVm(context).javascript.npm.install(packagesOrOptions, options);
-    }
-    const { context, ...options } = requireContext(packagesOrOptions);
-    return contextVm(context).javascript.npm.install(options);
-}
-/** Run a `package.json` script, like `npm run`. */
-export function runScript(script, options) {
-    const { context, ...rest } = requireContext(options);
-    return contextVm(context).javascript.npm.runScript(script, rest);
-}
-/** Run a package's binary, like `npx`. */
-export function runPackage(packageSpec, options) {
-    const { context, ...rest } = requireContext(options);
-    return contextVm(context).javascript.npm.runPackage(packageSpec, rest);
-}
-function requireContext(options) {
-    if (!options?.context) {
-        throw new TypeError("npm operations require a context; create one with createContext()");
-    }
-    return options;
-}