/** * Isolated VM Sandbox - True V8 Isolate Isolation * * Uses isolated-vm to create a completely separate V8 isolate: * - No shared memory with main process * - True memory limits enforced by V8 * - Same technology as Cloudflare Workers * - Cannot access Node.js APIs by design * * This is the most secure sandbox option available in Node.js. * * Note: isolated-vm requires V8 and won't work on: * - Bun (uses JavaScriptCore) * - Node.js 25+ (V8 API changes) */ /** * Tool definition for the sandbox */ export interface IsolatedVMTool { name: string; description: string; inputSchema?: Record; } /** * Result of code execution */ export interface IsolatedVMExecutionResult { result: unknown; logs: string[]; error?: string; duration: number; } /** * Configuration for the isolated-vm sandbox */ export interface IsolatedVMSandboxConfig { /** Maximum execution time in milliseconds (default: 30000) */ timeout: number; /** Maximum memory in MB (default: 128) */ memoryLimit: number; /** Inspector support for debugging (default: false) */ inspector: boolean; } /** * Isolated VM Sandbox implementation using isolated-vm * * Security properties: * - Completely separate V8 isolate (no shared memory) * - Memory limits enforced at V8 level * - No access to Node.js APIs * - No access to file system, network, or process * - Tool calls go through explicit callbacks */ export declare class IsolatedVMSandbox { private config; private isolate; constructor(config?: Partial); /** * Execute code in isolated V8 context * * @param code - Code to execute * @param tools - Available tools * @param toolExecutor - Function to execute tool calls * @returns Execution result */ execute(code: string, tools: IsolatedVMTool[], toolExecutor: (toolName: string, params: unknown) => Promise): Promise; /** * Set up logging in the isolated context */ private setupLogging; /** * Set up tool callbacks in the isolated context */ private setupToolCallbacks; /** * Set up basic utilities in the isolated context */ private setupUtilities; /** * Wrap user code in async IIFE */ private wrapCode; /** * Dispose of the isolate and free memory */ dispose(): void; /** * Check if the sandbox is available (isolated-vm is installed and working) * * Returns false in cases where isolated-vm won't work: * - Node.js 25+ (V8 API changes cause "Cannot read properties of undefined (reading 'length')") * - Bun runtime (uses JavaScriptCore, not V8) * - Environment variable NCP_DISABLE_ISOLATED_VM=true * - Module load failures */ static isAvailable(): boolean; /** * Get memory usage of the current isolate */ getHeapStatistics(): any | null; } /** * Create an isolated-vm sandbox instance */ export declare function createIsolatedVMSandbox(config?: Partial): IsolatedVMSandbox; //# sourceMappingURL=isolated-vm-sandbox.d.ts.map