Function withPiSandbox

apps/sim/lib/execution/e2b.ts:433–476

(fn: (runner: PiSandboxRunner) => Promise<T>)

 * so secrets handed to one command never leak into the next.
 */
export async function withPiSandbox<T>(fn: (runner: PiSandboxRunner) => Promise<T>): Promise<T> {
  const sandbox = await createE2BSandbox('pi')
  const sandboxId = sandbox.sandboxId
  logger.info('Started Pi sandbox', { sandboxId })

  const runner: PiSandboxRunner = {
    run: async (command, options) => {
      try {
        const result = await sandbox.commands.run(command, {
          envs: { ...(options.envs ?? {}), PATH: PI_SANDBOX_PATH },
          timeoutMs: options.timeoutMs,
          user: 'root',
          onStdout: options.onStdout,
          onStderr: options.onStderr,
        })
        return { stdout: result.stdout, stderr: result.stderr, exitCode: result.exitCode }
      } catch (error) {
        const failure = error as {
          stdout?: string
          stderr?: string
          message?: string
          exitCode?: number
        }
        return {
          stdout: failure.stdout ?? '',
          stderr: failure.stderr ?? failure.message ?? getErrorMessage(error),
          exitCode: failure.exitCode ?? 1,
        }
      }
    },
    readFile: (path) => sandbox.files.read(path),
    writeFile: async (path, content) => {
      await sandbox.files.write(path, content)
    },
  }

  try {
    return await fn(runner)
  } finally {
    try {
      await sandbox.kill()
    } catch {}
  }
}