Run Python code inside an isolated Wasmer sandbox and get back its output.

Use it to execute code you do not want touching this machine: untrusted snippets, experiments, quick calculations, anything with side effects you would rather contain. code is passed to python -c, so print what you want to see. Set network=true only when the code must reach the internet — that routes to a second sandbox with the host's network and its own separate state. Returns exit_code, stdout, stderr, reason and duration_ms; a non-zero exit_code is a normal result, not an error.

The sandbox is long-lived: files written and packages installed by earlier calls are still there, and anything this code writes stays for the next one. Call reset_sandbox when you want a clean slate.

Run any command available inside the Wasmer sandbox, with arguments.

Use it for non-Python work in the sandbox — a shell utility, or a binary that install_sandbox_package added. command is the command name, and args its arguments as a list (not a shell string: there is no shell splitting, quoting or piping). Returns the same result shape as run_python.

The sandbox is long-lived, so this command sees files and packages left by earlier calls, and its own side effects persist until reset_sandbox.

Write a text file inside the sandbox, creating parent directories as needed.

Use it to put a script, a fixture or input data where sandboxed code can read it — run_python and run_command in the same sandbox see the same filesystem. Use an absolute path such as /tmp/input.json. The network flag selects which sandbox, and the two do not share a filesystem: write and read with the same value. Overwrites an existing file without asking. Returns the path and the number of bytes written.

Read a text file from inside the sandbox.

Use it to collect a file that sandboxed code produced, or to check what an earlier write_sandbox_file left behind. Long files come back capped as head + tail with the elision marked, and truncated: true says so. network selects which sandbox, and a file written to one is not visible in the other.

List the contents of a directory inside the sandbox.

Use it to find out what is actually there before reading or running something — especially after install_sandbox_package, or when a read_sandbox_file came back not_found. Returns each entry's name, kind and size.

Install a Wasmer registry package into the sandbox and report the commands it adds.

Use it to get a tool the sandbox does not already have — the guest starts with only Python. package is a registry name like wasmer/edgejs or wasmer/edgejs@0.2.0. The returned commands are exactly the names run_command can then call. The install persists for the life of the sandbox, so it survives later calls until reset_sandbox.

Report whether the sandboxes are warm, and what they are running.

Use it when a call came back warming, when one was unexpectedly slow, or before a long task. There are two sandboxes, one per network policy (off and host), warmed independently; warm: false means the first call for that policy pays the ~26 s download-and-compile cost.

Throw away the sandbox's accumulated state and start a fresh one.

Use it when earlier files, installed packages or environment changes are getting in the way, or when a sandbox is behaving oddly. Pass network as "off" or "host" to reset just that one; omit it to reset both. The replacement warms in the background, so the next call may answer warming — that is expected.