|
1 | 1 | import type { Executor, SandboxOptions } from "../types.js"; |
2 | 2 |
|
3 | 3 | /** |
4 | | - * Create an executor using the isolated-vm peer dependency. |
| 4 | + * Detect whether we're running under Bun. On Bun, isolated-vm cannot dlopen |
| 5 | + * (it relies on V8 symbols like `v8::ValueSerializer::Delegate::IsHostObject` |
| 6 | + * that Bun's JavaScriptCore engine does not export), so we prefer the WASM |
| 7 | + * QuickJS backend. |
| 8 | + * |
| 9 | + * Uses Bun's officially documented detection pattern: |
| 10 | + * https://bun.com/docs/guides/util/detect-bun |
| 11 | + * |
| 12 | + * The `typeof process` guard keeps this safe in non-Node-shaped runtimes |
| 13 | + * (Cloudflare Workers, browser) where `process` is undefined. |
| 14 | + */ |
| 15 | +function isBun(): boolean { |
| 16 | + // Cast through globalThis to avoid requiring @types/node just for `process`. |
| 17 | + const proc = (globalThis as { process?: { versions?: { bun?: string } } }).process; |
| 18 | + return !!proc?.versions?.bun; |
| 19 | +} |
| 20 | + |
| 21 | +/** |
| 22 | + * Pick a sandbox runtime automatically. |
| 23 | + * |
| 24 | + * Order of preference: |
| 25 | + * - **Bun** → QuickJS first (isolated-vm cannot load native bindings under |
| 26 | + * JavaScriptCore), fall back to isolated-vm only if QuickJS isn't |
| 27 | + * installed. |
| 28 | + * - **Node** → isolated-vm first (V8 JIT is faster, mature, no upstream |
| 29 | + * async bugs), fall back to QuickJS if isolated-vm isn't installed (e.g. |
| 30 | + * ARM Linux without build tools, or a Node minor without a prebuild). |
| 31 | + * |
| 32 | + * Production deployments on Node should always have `isolated-vm` installed |
| 33 | + * — QuickJS is a compatibility fallback, not a recommended production |
| 34 | + * backend. See `QuickJSExecutor`'s docstring for the upstream |
| 35 | + * `quickjs-emscripten` bugs it inherits. |
| 36 | + * |
| 37 | + * Both `isolated-vm` and `quickjs-emscripten` are optional peer dependencies. |
5 | 38 | */ |
6 | 39 | export async function createExecutor( |
7 | 40 | options: SandboxOptions = {}, |
8 | 41 | ): Promise<Executor> { |
9 | | - try { |
10 | | - // @ts-ignore — optional peer dependency |
11 | | - await import("isolated-vm"); |
12 | | - const { IsolatedVMExecutor } = await import("./isolated-vm.js"); |
13 | | - return new IsolatedVMExecutor(options); |
14 | | - } catch { |
15 | | - // Not available |
| 42 | + const order = isBun() ? (["quickjs", "isolated-vm"] as const) : (["isolated-vm", "quickjs"] as const); |
| 43 | + |
| 44 | + /* oxlint-disable no-await-in-loop */ |
| 45 | + for (const backend of order) { |
| 46 | + if (backend === "isolated-vm") { |
| 47 | + try { |
| 48 | + // @ts-ignore — optional peer dependency |
| 49 | + await import("isolated-vm"); |
| 50 | + const { IsolatedVMExecutor } = await import("./isolated-vm.js"); |
| 51 | + return new IsolatedVMExecutor(options); |
| 52 | + } catch { |
| 53 | + // not available — try the next backend |
| 54 | + } |
| 55 | + } else { |
| 56 | + try { |
| 57 | + // @ts-ignore — optional peer dependency |
| 58 | + await import("quickjs-emscripten"); |
| 59 | + const { QuickJSExecutor } = await import("./quickjs.js"); |
| 60 | + return new QuickJSExecutor(options); |
| 61 | + } catch { |
| 62 | + // not available — try the next backend |
| 63 | + } |
| 64 | + } |
16 | 65 | } |
| 66 | + /* oxlint-enable no-await-in-loop */ |
17 | 67 |
|
18 | 68 | throw new Error( |
19 | | - "No sandbox runtime found. Install isolated-vm:\n" + |
20 | | - " npm install isolated-vm # V8 isolates (Node.js)", |
| 69 | + "No sandbox runtime found. Install one of:\n" + |
| 70 | + " npm install isolated-vm # V8 isolates (Node.js, fastest)\n" + |
| 71 | + " npm install quickjs-emscripten # WASM QuickJS (Bun, Workers, browser)", |
21 | 72 | ); |
22 | 73 | } |
0 commit comments