48 lines
2.8 KiB
Markdown
48 lines
2.8 KiB
Markdown
# Tasks — enterprise-sandbox
|
||
|
||
1. Scaffold package skeleton (`package.json`, `vite.config.ts`,
|
||
`vitest.config.ts`, `tsconfig.lib.json`, `README.md`, `src/index.ts`).
|
||
2. Author `types/sandbox.types.ts` with `SandboxConfig`, `SandboxResult`,
|
||
`SandboxOptions`, `SandboxModule`, `ExecutionContext`, `AuditLogEntry`,
|
||
`AuditStatistics`, `Clock`, `ProcessSpawner`, `CommandResult`,
|
||
`DEFAULT_CONFIG`.
|
||
3. Author `error-codes/error-codes.ts` — `SANDBOX_CODES` via `defineCodes` +
|
||
`SandboxError` class. Sibling docs + tests.
|
||
4. Author `schemas/schemas.ts` — Zod schemas for config, options, module.
|
||
Sibling docs + tests.
|
||
5. Author `telemetry/telemetry.ts` — OTel counters + histogram + record fns.
|
||
Sibling docs + tests.
|
||
6. Author `audit-logger/audit-logger.ts` — SHA-256 hash, filter, statistics,
|
||
`onAuditLog`. Sibling docs + tests.
|
||
7. Author `resource-limiter/resource-limiter.ts` — sliding-window limiter with
|
||
injectable `Clock`, output truncation. Sibling docs + tests.
|
||
8. Author `module-resolver/module-resolver.ts` — denylist + allowlist + builtin
|
||
resolver. Sibling docs + tests.
|
||
9. Author `code-transformer/code-transformer.ts` — eleven built-in rules,
|
||
custom-rule slot, `wouldBlock`. Sibling docs + tests.
|
||
10. Author `vm-engine/vm-engine.ts` — real `node:vm` sandbox with frozen
|
||
intrinsics, captured console, heap stats. Sibling docs + tests.
|
||
11. Author `worker-engine/worker-engine.ts` — real `node:worker_threads`
|
||
sandbox, postMessage IPC, timeout via `worker.terminate()`. Sibling docs
|
||
+ tests.
|
||
12. Author `spawn-engine/spawn-engine.ts` + `runner.ts` — real
|
||
`node:child_process` runner with sanitised env, JSON IPC, timeout race.
|
||
Sibling docs + tests.
|
||
13. Author `isolate-engine/isolate-engine.ts` — structural `isolated-vm`
|
||
contract with `IsolateFactory` seam. Sibling docs + tests.
|
||
14. Author `pool/pool.ts` — pre-warmed pool with injectable `Clock`,
|
||
cleanup, recycle-on-N. Sibling docs + tests.
|
||
15. Author `result-streamer/result-streamer.ts` — subscribe / push / flush /
|
||
complete / destroy. Sibling docs + tests.
|
||
16. Author `sandbox/sandbox.ts` — `createSandbox` facade composing every
|
||
feature, engine selection, audit-log integration. Sibling docs + tests.
|
||
17. Wire `src/index.ts` barrel + every subpath export in `package.json`.
|
||
18. Run pre-publish gate: `bunx turbo lint typecheck test build --filter=@suaveplan/sandbox`
|
||
+ `bunx turbo test:coverage --filter=@suaveplan/sandbox` — all green at
|
||
100/100/100/100.
|
||
19. Refresh `MANIFEST.md` via `bun scripts/folder-reorg/generate-manifest.ts`.
|
||
20. Flip `@suaveplan/sandbox` row in `STATUS.md` from `–` to `✅`.
|
||
21. Fold `specs/sandbox/spec.md` into `openspec/specs/sandbox/spec.md`.
|
||
22. Archive `openspec/changes/enterprise-sandbox/` to
|
||
`openspec/archive/2026-05-25-enterprise-sandbox/`.
|