zerobox 0.1.1 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +238 -0
- package/dist/bin.js +10 -5
- package/dist/bin.js.map +1 -1
- package/dist/binary.js +1 -1
- package/dist/binary.js.map +1 -1
- package/package.json +7 -7
package/README.md
ADDED
|
@@ -0,0 +1,238 @@
|
|
|
1
|
+
<div align="center">
|
|
2
|
+
<h1>🫙 zerobox</h1>
|
|
3
|
+
<p><strong>Run any command in a sandbox. Control what it can read, write, and connect to.</strong></p>
|
|
4
|
+
<p>
|
|
5
|
+
<a href="https://crates.io/crates/zerobox" target="_blank">
|
|
6
|
+
<img src="https://img.shields.io/crates/v/zerobox?style=for-the-badge&labelColor=000000" alt="crates.io version" />
|
|
7
|
+
</a>
|
|
8
|
+
<a href="https://www.npmjs.com/package/zerobox" target="_blank">
|
|
9
|
+
<img src="https://img.shields.io/npm/v/zerobox?style=for-the-badge&labelColor=000000" alt="npm version" />
|
|
10
|
+
</a>
|
|
11
|
+
<a href="https://github.com/afshinm/zerobox/blob/main/LICENSE" target="_blank">
|
|
12
|
+
<img src="https://img.shields.io/github/license/afshinm/zerobox?style=for-the-badge&labelColor=000000" alt="license" />
|
|
13
|
+
</a>
|
|
14
|
+
<a href="https://github.com/afshinm/zerobox/actions/workflows/ci.yml" target="_blank">
|
|
15
|
+
<img src="https://img.shields.io/github/actions/workflow/status/afshinm/zerobox/ci.yml?style=for-the-badge&labelColor=000000&label=CI" alt="CI status" />
|
|
16
|
+
</a>
|
|
17
|
+
</p>
|
|
18
|
+
</div>
|
|
19
|
+
|
|
20
|
+
## Overview
|
|
21
|
+
|
|
22
|
+
Cross-platform process sandboxing powered by [OpenAI Codex](https://github.com/openai/codex)'s production sandbox runtime. Uses seatbelt on macOS and bubblewrap + seccomp on Linux.
|
|
23
|
+
|
|
24
|
+
- 🔒 **Deny by default.** Writes and network are blocked unless you allow them.
|
|
25
|
+
- 📁 **File access control.** Allow or deny reads and writes to specific paths.
|
|
26
|
+
- 🌐 **Network filtering.** Allow or deny by domain, powered by a real HTTP/SOCKS proxy.
|
|
27
|
+
- 🧩 **TypeScript SDK.** `import { Sandbox } from "zerobox"` with a Deno-style API.
|
|
28
|
+
- 🖥️ **Cross-platform.** macOS, Linux, and Windows.
|
|
29
|
+
- 📦 **Single binary.** No runtime dependencies, no Docker, no VMs.
|
|
30
|
+
|
|
31
|
+
## Install
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
# npm (recommended)
|
|
35
|
+
npm install -g zerobox
|
|
36
|
+
|
|
37
|
+
# From source
|
|
38
|
+
git clone https://github.com/afshinm/zerobox && cd zerobox
|
|
39
|
+
./scripts/sync.sh && cargo build --release -p zerobox
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
## Quick start
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
# Writes and network are blocked by default
|
|
46
|
+
zerobox -- node -e "console.log('hello')"
|
|
47
|
+
|
|
48
|
+
# Allow writes to a directory
|
|
49
|
+
zerobox --allow-write=. -- node script.js
|
|
50
|
+
|
|
51
|
+
# Allow network to specific domains
|
|
52
|
+
zerobox --allow-net=api.openai.com -- node agent.js
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
## Examples
|
|
56
|
+
|
|
57
|
+
### Run AI-generated code safely
|
|
58
|
+
|
|
59
|
+
An LLM generates code. You need to execute it without risking file corruption, data exfiltration, or network abuse.
|
|
60
|
+
|
|
61
|
+
```bash
|
|
62
|
+
# LLM writes code to /tmp/task.py. Run it with no writes, no network.
|
|
63
|
+
zerobox -- python3 /tmp/task.py
|
|
64
|
+
|
|
65
|
+
# Allow writes only to an output directory
|
|
66
|
+
zerobox --allow-write=/tmp/output -- python3 /tmp/task.py
|
|
67
|
+
|
|
68
|
+
# Allow the script to call a specific API
|
|
69
|
+
zerobox --allow-write=/tmp/output --allow-net=api.openai.com -- python3 /tmp/task.py
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
Or via the TypeScript SDK:
|
|
73
|
+
|
|
74
|
+
```ts
|
|
75
|
+
import { Sandbox } from "zerobox";
|
|
76
|
+
|
|
77
|
+
const sandbox = Sandbox.create({
|
|
78
|
+
allowWrite: ["/tmp/output"],
|
|
79
|
+
allowNet: ["api.openai.com"],
|
|
80
|
+
});
|
|
81
|
+
|
|
82
|
+
const result = await sandbox.sh`python3 /tmp/task.py`.output();
|
|
83
|
+
console.log(result.code, result.stdout);
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
### Sandbox a browser agent
|
|
87
|
+
|
|
88
|
+
Use [LightPanda](https://lightpanda.io), a headless browser, for fully sandboxed web browsing. The agent can only reach the domains you allow.
|
|
89
|
+
|
|
90
|
+
```bash
|
|
91
|
+
# Fetch a page as markdown (only example.com is reachable)
|
|
92
|
+
zerobox --allow-net=example.com -- lightpanda fetch --dump markdown https://example.com
|
|
93
|
+
|
|
94
|
+
# Allow write access for saving results
|
|
95
|
+
zerobox --allow-net=example.com --allow-write=/tmp -- lightpanda fetch --dump html https://example.com
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
> **Note:** GUI browsers like Chrome and Firefox cannot run inside the sandbox. They require macOS WindowServer access and Unix socket IPC that the sandbox blocks by design. Use a headless engine like LightPanda, or run the browser outside the sandbox and connect via CDP.
|
|
99
|
+
|
|
100
|
+
### Restrict LLM tool calls
|
|
101
|
+
|
|
102
|
+
Each tool call can be sandboxed individually. The agent runs normally. Only the dangerous operations are sandboxed.
|
|
103
|
+
|
|
104
|
+
```ts
|
|
105
|
+
import { Sandbox } from "zerobox";
|
|
106
|
+
|
|
107
|
+
// Each tool gets its own sandbox with minimum permissions.
|
|
108
|
+
const reader = Sandbox.create(); // read-only
|
|
109
|
+
const writer = Sandbox.create({ allowWrite: ["/tmp"] }); // writes to /tmp
|
|
110
|
+
const fetcher = Sandbox.create({ allowNet: ["example.com"] }); // one domain
|
|
111
|
+
|
|
112
|
+
// Read a file inside the sandbox
|
|
113
|
+
const data = await reader.js`
|
|
114
|
+
const content = require("fs").readFileSync("/tmp/input.txt", "utf8");
|
|
115
|
+
console.log(JSON.stringify({ content }));
|
|
116
|
+
`.json();
|
|
117
|
+
|
|
118
|
+
// Write a file (only /tmp is writable)
|
|
119
|
+
await writer.js`
|
|
120
|
+
require("fs").writeFileSync("/tmp/output.txt", "result");
|
|
121
|
+
console.log("ok");
|
|
122
|
+
`.text();
|
|
123
|
+
|
|
124
|
+
// Fetch a URL (only example.com is reachable)
|
|
125
|
+
const result = await fetcher.js`
|
|
126
|
+
const res = await fetch("https://example.com");
|
|
127
|
+
console.log(JSON.stringify({ status: res.status }));
|
|
128
|
+
`.json();
|
|
129
|
+
```
|
|
130
|
+
|
|
131
|
+
Full working examples:
|
|
132
|
+
- [`examples/ai-agent`](examples/ai-agent) -- Vercel AI SDK with sandboxed tools
|
|
133
|
+
- [`examples/workflow`](examples/workflow) -- [Vercel Workflow](https://useworkflow.dev/) with sandboxed durable steps
|
|
134
|
+
|
|
135
|
+
### Protect your repo during builds
|
|
136
|
+
|
|
137
|
+
Run package installs and build scripts without risking your `.git` history or config files.
|
|
138
|
+
|
|
139
|
+
```bash
|
|
140
|
+
# npm install can write to node_modules but not .git or .env
|
|
141
|
+
zerobox --allow-write=./node_modules,./package-lock.json --deny-write=./.git,./.env -- npm install
|
|
142
|
+
|
|
143
|
+
# Run a build script with network access for downloading deps
|
|
144
|
+
zerobox --allow-write=./dist --allow-net -- npm run build
|
|
145
|
+
|
|
146
|
+
# Run tests with no network (catch accidental external calls)
|
|
147
|
+
zerobox --allow-write=/tmp -- npm test
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
## SDK (TypeScript)
|
|
151
|
+
|
|
152
|
+
```bash
|
|
153
|
+
npm install zerobox
|
|
154
|
+
```
|
|
155
|
+
|
|
156
|
+
```ts
|
|
157
|
+
import { Sandbox } from "zerobox";
|
|
158
|
+
|
|
159
|
+
const sandbox = Sandbox.create({
|
|
160
|
+
allowWrite: ["/tmp"],
|
|
161
|
+
allowNet: ["example.com"],
|
|
162
|
+
});
|
|
163
|
+
|
|
164
|
+
// Shell commands via tagged template
|
|
165
|
+
const output = await sandbox.sh`echo hello`.text();
|
|
166
|
+
|
|
167
|
+
// Parse JSON output
|
|
168
|
+
const data = await sandbox.sh`cat data.json`.json();
|
|
169
|
+
|
|
170
|
+
// Raw output (doesn't throw on non-zero exit)
|
|
171
|
+
const result = await sandbox.sh`exit 42`.output();
|
|
172
|
+
// { code: 42, stdout: "", stderr: "" }
|
|
173
|
+
|
|
174
|
+
// Explicit command + args
|
|
175
|
+
await sandbox.exec("node", ["-e", "console.log('hi')"]).text();
|
|
176
|
+
|
|
177
|
+
// Cancellation
|
|
178
|
+
const controller = new AbortController();
|
|
179
|
+
await sandbox.sh`sleep 60`.text({ signal: controller.signal });
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
Non-zero exit codes throw `SandboxCommandError`:
|
|
183
|
+
|
|
184
|
+
```ts
|
|
185
|
+
import { Sandbox, SandboxCommandError } from "zerobox";
|
|
186
|
+
|
|
187
|
+
const sandbox = Sandbox.create();
|
|
188
|
+
try {
|
|
189
|
+
await sandbox.sh`exit 1`.text();
|
|
190
|
+
} catch (e) {
|
|
191
|
+
if (e instanceof SandboxCommandError) {
|
|
192
|
+
console.log(e.code); // 1
|
|
193
|
+
console.log(e.stderr); // error output
|
|
194
|
+
}
|
|
195
|
+
}
|
|
196
|
+
```
|
|
197
|
+
|
|
198
|
+
## Performance
|
|
199
|
+
|
|
200
|
+
Sandbox overhead is minimal, typically ~10ms and ~7MB:
|
|
201
|
+
|
|
202
|
+
| Command | Bare | Sandboxed | Overhead | Bare Mem | Sandbox Mem |
|
|
203
|
+
|---------|------|-----------|----------|----------|-------------|
|
|
204
|
+
| `echo hello` | <1ms | 10ms | +10ms | 1.2 MB | 8.4 MB |
|
|
205
|
+
| `node -e '...'` | 10ms | 20ms | +10ms | 39.3 MB | 39.1 MB |
|
|
206
|
+
| `python3 -c '...'` | 10ms | 20ms | +10ms | 12.9 MB | 13.0 MB |
|
|
207
|
+
| `cat 10MB file` | <1ms | 10ms | +10ms | 1.9 MB | 8.4 MB |
|
|
208
|
+
| `curl https://...` | 50ms | 60ms | +10ms | 7.2 MB | 8.4 MB |
|
|
209
|
+
|
|
210
|
+
<sub>Best of 10 runs with warmup, Apple M5 Pro. The ~7MB memory overhead is the sandbox-exec process. For runtimes like Node/Python, the runtime itself dominates memory. Run `./bench/run.sh` to reproduce.</sub>
|
|
211
|
+
|
|
212
|
+
## Platform support
|
|
213
|
+
|
|
214
|
+
| Platform | Backend | Status |
|
|
215
|
+
|----------|---------|--------|
|
|
216
|
+
| macOS | Seatbelt (`sandbox-exec`) | Fully supported |
|
|
217
|
+
| Linux | Bubblewrap + Seccomp + Namespaces | Fully supported |
|
|
218
|
+
| Windows | Restricted Tokens + ACLs + Firewall | Supported (not yet tested in CI) |
|
|
219
|
+
|
|
220
|
+
## CLI reference
|
|
221
|
+
|
|
222
|
+
| Flag | Example | Description |
|
|
223
|
+
|------|---------|-------------|
|
|
224
|
+
| `--allow-read <paths>` | `--allow-read=/tmp,/data` | Restrict readable user data to listed paths. System libraries remain accessible. Default: all reads allowed. |
|
|
225
|
+
| `--deny-read <paths>` | `--deny-read=/secret` | Block reading from these paths. Takes precedence over `--allow-read`. |
|
|
226
|
+
| `--allow-write [paths]` | `--allow-write=.` | Allow writing to these paths. Without a value, allows writing everywhere. Default: no writes. |
|
|
227
|
+
| `--deny-write <paths>` | `--deny-write=./.git` | Block writing to these paths. Takes precedence over `--allow-write`. |
|
|
228
|
+
| `--allow-net [domains]` | `--allow-net=example.com` | Allow outbound network. Without a value, allows all domains. Default: no network. |
|
|
229
|
+
| `--deny-net <domains>` | `--deny-net=evil.com` | Block network to these domains. Takes precedence over `--allow-net`. |
|
|
230
|
+
| `-A`, `--allow-all` | `-A` | Grant all permissions. No sandbox enforcement. |
|
|
231
|
+
| `--no-sandbox` | `--no-sandbox` | Disable the sandbox entirely. |
|
|
232
|
+
| `-C <dir>` | `-C /workspace` | Set working directory for the sandboxed command. |
|
|
233
|
+
| `-V`, `--version` | `--version` | Print version. |
|
|
234
|
+
| `-h`, `--help` | `--help` | Print help. |
|
|
235
|
+
|
|
236
|
+
## License
|
|
237
|
+
|
|
238
|
+
Apache-2.0
|
package/dist/bin.js
CHANGED
|
@@ -54,9 +54,10 @@ function resolveBinary() {
|
|
|
54
54
|
}
|
|
55
55
|
}
|
|
56
56
|
console.error("error: zerobox binary not found.\n\n" +
|
|
57
|
-
"Install
|
|
58
|
-
"
|
|
59
|
-
"
|
|
57
|
+
"Install the package to get the binary:\n" +
|
|
58
|
+
" npm install zerobox\n\n" +
|
|
59
|
+
"Or set the path manually:\n" +
|
|
60
|
+
" export ZEROBOX_BIN=/path/to/zerobox\n");
|
|
60
61
|
process.exit(1);
|
|
61
62
|
}
|
|
62
63
|
/** Check if a file starts with a Node.js shebang without reading the whole file. */
|
|
@@ -83,7 +84,11 @@ try {
|
|
|
83
84
|
});
|
|
84
85
|
}
|
|
85
86
|
catch (e) {
|
|
86
|
-
const
|
|
87
|
-
|
|
87
|
+
const err = e;
|
|
88
|
+
if (err.status != null) {
|
|
89
|
+
process.exit(err.status);
|
|
90
|
+
}
|
|
91
|
+
console.error(`error: ${err.message ?? e}`);
|
|
92
|
+
process.exit(1);
|
|
88
93
|
}
|
|
89
94
|
//# sourceMappingURL=bin.js.map
|
package/dist/bin.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAElD,SAAS,aAAa;IACpB,wBAAwB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAChD,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,YAAY,CAAC,SAAS,CAAC;gBAAE,SAAS;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CACX,sCAAsC;QACpC,
|
|
1
|
+
{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAElD,SAAS,aAAa;IACpB,wBAAwB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAChD,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,YAAY,CAAC,SAAS,CAAC;gBAAE,SAAS;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CACX,sCAAsC;QACpC,0CAA0C;QAC1C,2BAA2B;QAC3B,6BAA6B;QAC7B,yCAAyC,CAC5C,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,IAAI,CAAC;IACH,YAAY,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACnD,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAAC,OAAO,CAAU,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,CAA0C,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
|
package/dist/binary.js
CHANGED
|
@@ -39,7 +39,7 @@ export function verifyBinary() {
|
|
|
39
39
|
}
|
|
40
40
|
catch (e) {
|
|
41
41
|
if (e.code === "ENOENT") {
|
|
42
|
-
throw new Error(`zerobox binary not found at "${bin}". Install
|
|
42
|
+
throw new Error(`zerobox binary not found at "${bin}". Install the package (npm install zerobox) or set ZEROBOX_BIN.`);
|
|
43
43
|
}
|
|
44
44
|
// Binary exists but --help failed -- still usable.
|
|
45
45
|
}
|
package/dist/binary.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"binary.js","sourceRoot":"","sources":["../src/binary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,
|
|
1
|
+
{"version":3,"file":"binary.js","sourceRoot":"","sources":["../src/binary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,kEAAkE,CACtG,CAAC;QACJ,CAAC;QACD,mDAAmD;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "zerobox",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.3",
|
|
4
4
|
"description": "Run any command in a sandbox with file and network restrictions.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -32,12 +32,12 @@
|
|
|
32
32
|
"dist/"
|
|
33
33
|
],
|
|
34
34
|
"optionalDependencies": {
|
|
35
|
-
"@zerobox/cli-darwin-arm64": "0.1.
|
|
36
|
-
"@zerobox/cli-darwin-x64": "0.1.
|
|
37
|
-
"@zerobox/cli-linux-
|
|
38
|
-
"@zerobox/cli-linux-
|
|
39
|
-
"@zerobox/cli-linux-arm64
|
|
40
|
-
"@zerobox/cli-linux-x64-musl": "0.1.
|
|
35
|
+
"@zerobox/cli-darwin-arm64": "0.1.3",
|
|
36
|
+
"@zerobox/cli-darwin-x64": "0.1.3",
|
|
37
|
+
"@zerobox/cli-linux-arm64-musl": "0.1.3",
|
|
38
|
+
"@zerobox/cli-linux-x64": "0.1.3",
|
|
39
|
+
"@zerobox/cli-linux-arm64": "0.1.3",
|
|
40
|
+
"@zerobox/cli-linux-x64-musl": "0.1.3"
|
|
41
41
|
},
|
|
42
42
|
"devDependencies": {
|
|
43
43
|
"@types/node": "^22.0.0",
|