suaveplan/openspec/archive/2026-05-25-enterprise-sandbox/tasks.md

Tasks — enterprise-sandbox

1. Scaffold package skeleton (package.json, vite.config.ts, vitest.config.ts, tsconfig.lib.json, README.md, src/index.ts).
2. Author types/sandbox.types.ts with SandboxConfig, SandboxResult, SandboxOptions, SandboxModule, ExecutionContext, AuditLogEntry, AuditStatistics, Clock, ProcessSpawner, CommandResult, DEFAULT_CONFIG.
3. Author error-codes/error-codes.ts — SANDBOX_CODES via defineCodes + SandboxError class. Sibling docs + tests.
4. Author schemas/schemas.ts — Zod schemas for config, options, module. Sibling docs + tests.
5. Author telemetry/telemetry.ts — OTel counters + histogram + record fns. Sibling docs + tests.
6. Author audit-logger/audit-logger.ts — SHA-256 hash, filter, statistics, onAuditLog. Sibling docs + tests.
7. Author resource-limiter/resource-limiter.ts — sliding-window limiter with injectable Clock, output truncation. Sibling docs + tests.
8. Author module-resolver/module-resolver.ts — denylist + allowlist + builtin resolver. Sibling docs + tests.
9. Author code-transformer/code-transformer.ts — eleven built-in rules, custom-rule slot, wouldBlock. Sibling docs + tests.
10. Author vm-engine/vm-engine.ts — real node:vm sandbox with frozen intrinsics, captured console, heap stats. Sibling docs + tests.
11. Author worker-engine/worker-engine.ts — real node:worker_threads sandbox, postMessage IPC, timeout via worker.terminate(). Sibling docs
    • tests.
12. Author spawn-engine/spawn-engine.ts + runner.ts — real node:child_process runner with sanitised env, JSON IPC, timeout race. Sibling docs + tests.
13. Author isolate-engine/isolate-engine.ts — structural isolated-vm contract with IsolateFactory seam. Sibling docs + tests.
14. Author pool/pool.ts — pre-warmed pool with injectable Clock, cleanup, recycle-on-N. Sibling docs + tests.
15. Author result-streamer/result-streamer.ts — subscribe / push / flush / complete / destroy. Sibling docs + tests.
16. Author sandbox/sandbox.ts — createSandbox facade composing every feature, engine selection, audit-log integration. Sibling docs + tests.
17. Wire src/index.ts barrel + every subpath export in package.json.
18. Run pre-publish gate: bunx turbo lint typecheck test build --filter=@suaveplan/sandbox
    • bunx turbo test:coverage --filter=@suaveplan/sandbox — all green at 100/100/100/100.
19. Refresh MANIFEST.md via bun scripts/folder-reorg/generate-manifest.ts.
20. Flip @suaveplan/sandbox row in STATUS.md from – to ✅.
21. Fold specs/sandbox/spec.md into openspec/specs/sandbox/spec.md.
22. Archive openspec/changes/enterprise-sandbox/ to openspec/archive/2026-05-25-enterprise-sandbox/.