Documentation
¶
Overview ¶
Package scriptwrap executes user-authored inline script handlers (Python, Node) inside the workspace sandbox. The handler defines a `handler(input) -> dict` function; this package generates a thin per-language wrapper that imports the handler, feeds it JSON via stdin, and serializes the return value to stdout.
SECURITY: Execute MUST only be called inside a workspace pod. The handler source is user-authored and runs with the workspace user's full privileges (filesystem, git, network egress, materialized secrets). Calling Execute outside the workspace sandbox is RCE-as-a-service. The package performs no handler-source validation, no CPU/memory limits, and no output-size cap — those concerns are the caller's responsibility.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Execute ¶
func Execute(ctx context.Context, language Language, handlerSource string, input any) (output json.RawMessage, stderr string, exitCode int, err error)
Execute runs the handler in the given language with the JSON-marshaled input on stdin and returns the wrapper's stdout. The caller is responsible for validating that stdout is a JSON object (dict) — Execute does not enforce dict returns; a handler returning a string, number, or array will succeed.
On non-zero exit, returns the captured stderr and exitCode alongside err. On context cancellation, the child process is killed (SIGKILL via exec.CommandContext) and err wraps ctx.Err(). Note: only the direct child is killed; grandchildren spawned by the handler (subprocess.Popen, child_process.spawn) may leak. v2 may add process-group killing.
Source Files