spb/sp-wallet

1// V7 research runtime — how the API runs the laboratory on anything that comes from a research job.2//3// A submitted strategy is code written by an AI agent. Before the owner has approved it, the API executes it only through4// this module. Since v8 it is a thin layer over agents/lab.ts — the same OS sandbox as EVERY process that runs strategy code5// (signals, backtests): no network of any kind, no fork, read access limited to the laboratory and the listed data, write6// access to one scratch directory, no database URL. FAIL CLOSED: without a working sandbox nothing runs (`code: null`, the7// evaluation is refused) unless the explicit development switch SPW_LAB_SANDBOX=off is set, and the result then says8// `sandbox: 'none'` (the UI shows a warning).9import { dropScratch, labExec, labStatus, lastLine, scratchDir } from '../agents/lab.ts';1011export interface LabResult { code: number | null; out: string; err: string; sandbox: 'sandbox-exec' | 'none' }12export const labSandboxAvailable = async (): Promise<boolean> => (await labStatus()).ok;1314/** Run `python -m <args>` of the laboratory. `scratch` is the only writable directory (and the cwd); `readable` are extra15 *  read-only paths (the job's data, a staging directory); `strategyDir` the one strategy directory it may read. Never throws. */16export function labRun(args: string[], o: { timeoutMs: number; scratch: string; readable?: string[]; strategyDir?: string }): Promise<LabResult> {17  return labExec(args, o).then((r) => ({ code: r.killed ? null : r.code, out: r.out, err: r.killed ? `${r.err}\nkilled: ${r.killed}` : r.err, sandbox: r.sandbox }),18    (e: Error) => ({ code: null, out: '', err: `could not start: ${e.message}`, sandbox: process.env.SPW_LAB_SANDBOX === 'off' ? 'none' as const : 'sandbox-exec' as const }));19}2021export { dropScratch, lastLine, scratchDir };22