Initial Commit

openspec/archive/2026-05-25-enterprise-sandbox/tasks.md

@@ -0,0 +1,47 @@
+# Tasks — enterprise-sandbox
+
+1. Scaffold package skeleton (`package.json`, `vite.config.ts`,
+   `vitest.config.ts`, `tsconfig.lib.json`, `README.md`, `src/index.ts`).
+2. Author `types/sandbox.types.ts` with `SandboxConfig`, `SandboxResult`,
+   `SandboxOptions`, `SandboxModule`, `ExecutionContext`, `AuditLogEntry`,
+   `AuditStatistics`, `Clock`, `ProcessSpawner`, `CommandResult`,
+   `DEFAULT_CONFIG`.
+3. Author `error-codes/error-codes.ts` — `SANDBOX_CODES` via `defineCodes` +
+   `SandboxError` class. Sibling docs + tests.
+4. Author `schemas/schemas.ts` — Zod schemas for config, options, module.
+   Sibling docs + tests.
+5. Author `telemetry/telemetry.ts` — OTel counters + histogram + record fns.
+   Sibling docs + tests.
+6. Author `audit-logger/audit-logger.ts` — SHA-256 hash, filter, statistics,
+   `onAuditLog`. Sibling docs + tests.
+7. Author `resource-limiter/resource-limiter.ts` — sliding-window limiter with
+   injectable `Clock`, output truncation. Sibling docs + tests.
+8. Author `module-resolver/module-resolver.ts` — denylist + allowlist + builtin
+   resolver. Sibling docs + tests.
+9. Author `code-transformer/code-transformer.ts` — eleven built-in rules,
+   custom-rule slot, `wouldBlock`. Sibling docs + tests.
+10. Author `vm-engine/vm-engine.ts` — real `node:vm` sandbox with frozen
+    intrinsics, captured console, heap stats. Sibling docs + tests.
+11. Author `worker-engine/worker-engine.ts` — real `node:worker_threads`
+    sandbox, postMessage IPC, timeout via `worker.terminate()`. Sibling docs
+    + tests.
+12. Author `spawn-engine/spawn-engine.ts` + `runner.ts` — real
+    `node:child_process` runner with sanitised env, JSON IPC, timeout race.
+    Sibling docs + tests.
+13. Author `isolate-engine/isolate-engine.ts` — structural `isolated-vm`
+    contract with `IsolateFactory` seam. Sibling docs + tests.
+14. Author `pool/pool.ts` — pre-warmed pool with injectable `Clock`,
+    cleanup, recycle-on-N. Sibling docs + tests.
+15. Author `result-streamer/result-streamer.ts` — subscribe / push / flush /
+    complete / destroy. Sibling docs + tests.
+16. Author `sandbox/sandbox.ts` — `createSandbox` facade composing every
+    feature, engine selection, audit-log integration. Sibling docs + tests.
+17. Wire `src/index.ts` barrel + every subpath export in `package.json`.
+18. Run pre-publish gate: `bunx turbo lint typecheck test build --filter=@suaveplan/sandbox`
+    + `bunx turbo test:coverage --filter=@suaveplan/sandbox` — all green at
+    100/100/100/100.
+19. Refresh `MANIFEST.md` via `bun scripts/folder-reorg/generate-manifest.ts`.
+20. Flip `@suaveplan/sandbox` row in `STATUS.md` from `–` to `✅`.
+21. Fold `specs/sandbox/spec.md` into `openspec/specs/sandbox/spec.md`.
+22. Archive `openspec/changes/enterprise-sandbox/` to
+    `openspec/archive/2026-05-25-enterprise-sandbox/`.