Struct Sandbox 

pub struct Sandbox { /* private fields */ }

Executes modules in an isolated subprocess for security isolation.

When enabled is false, execution is performed in-process (no sandbox). When enabled is true, a child process running _sandbox_runner handles the execution and communicates results via JSON over stdin/stdout.

Implementations

impl Sandbox

pub fn new(enabled: bool, timeout_ms: u64) -> Self

Create a new Sandbox.

Arguments

• enabled — enable subprocess isolation
• timeout_ms — subprocess timeout in milliseconds (0 = use default 300 s)

pub fn is_enabled(&self) -> bool

Return true when subprocess isolation is enabled.

pub async fn execute( &self, module_id: &str, input_data: Value, ) -> Result<Value, ModuleExecutionError>

Execute a module, optionally in an isolated subprocess.

Arguments

• module_id — identifier of the module to execute
• input_data — JSON input for the module

Returns the module output as a serde_json::Value.

Errors

Returns ModuleExecutionError on timeout, non-zero exit, or parse failure.