feat(cloud): implement secure agent execution engine with VM2 sandboxing #273
+2,071
−3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit implements a complete cloud-native agent execution system for apps/cloud that safely runs external user code with proper security isolation. - Safely parses Lightfast agent bundles without code execution - Uses @babel/parser and @babel/traverse for AST analysis - Extracts agent configurations, tools, and metadata - Supports both createAgent() and createLightfast() patterns - VM2-based sandboxing for tool execution with 30s timeout limits - Blocks filesystem, network, and child process access - Captures console output and provides detailed error reporting - Forces Node.js runtime for VM2 compatibility - Creates Lightfast ToolFactory functions that proxy to secure execution - Converts JSON Schema parameters to Zod validation - Injects runtime context (sessionId, resourceId) properly - Handles tool execution errors with helpful messages - Fetches and parses agent bundles via HTTP - Creates real Lightfast agents with proxied tools - Uses fetchRequestHandler for native AI SDK streaming - Implements proper error handling and logging - ✅ Zero code execution during bundle parsing (AST-only analysis) - ✅ Sandboxed tool execution in isolated VM2 environment - ✅ Network and filesystem access restrictions - ✅ Resource limits with execution timeouts - ✅ Vercel-only deployment with full Node.js capabilities - ✅ No external services required - @babel/parser: ^7.28.4 - JavaScript AST parsing - @babel/traverse: ^7.28.4 - AST traversal - @babel/types: ^7.28.4 - AST node types - vm2: ^3.9.19 - Secure JavaScript sandbox - isolated-vm: ^6.0.1 - Alternative sandbox (kept for future use) The system has been tested end-to-end with a sample weather agent bundle that includes tools with both safe and potentially unsafe operations. All security restrictions work as expected. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
4 Skipped Deployments
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Implements a complete cloud-native agent execution system for
apps/cloudthat safely runs external user code with proper security isolation.This PR preserves important foundational work from the
feat/cloud-agent-execution-enginebranch that was developed earlier but never merged to main.Key Components
1. AST-Based Bundle Parser (
src/lib/bundle-parser.ts)@babel/parserand@babel/traversefor AST analysiscreateAgent()andcreateLightfast()patterns2. Secure Tool Execution (
src/app/api/tool/route.ts)3. Tool Proxying System (
src/lib/tool-proxy.ts)ToolFactoryfunctions that proxy to secure execution4. Agent Execution Engine (
src/app/api/execute/route.ts)fetchRequestHandlerfor native AI SDK streaming5. Test Interface (
test-executor/page.tsx)Security Features
Documentation
This PR includes comprehensive architecture documentation:
Dependencies Added
{ "@babel/parser": "^7.28.4", "@babel/traverse": "^7.28.4", "@babel/types": "^7.28.4", "vm2": "^3.9.19", "isolated-vm": "^6.0.1", "lightfast": "workspace:^" }Testing
The system has been tested end-to-end with sample weather agent bundles that include tools with both safe and potentially unsafe operations. All security restrictions work as expected.
Future Work
This implementation provides a foundation for:
execution-service-plan.md)Related
feat/cloud-agent-execution-engine🤖 Generated with Claude Code