Modules
OpenAPI search-and-execute for LLM agents, Cloudflare-codemode style.
Per-API registration config. Everything the spec cannot know.
The ingestion output: sandbox spec payload plus the proxy's operation index.
Host-implemented credential resolution, library-implemented attachment.
The sandbox contract — the entire interface a TS execution environment must satisfy. Deliberately minimal: run code with globals and callbacks, return the value and console output.
Subprocess Deno executor. Resurrects ele's Exile-bridge design
(ele-core a2a52478f) over a raw Port with three properties the original
lacked: no temp files (data-URL import), concurrent callback dispatch,
and child reaping on every path this module can reach — we record the
OS pid at spawn and kill exactly that pid (never a pattern) both from
the worker's own after clause and, if the worker itself dies or
overruns, from run/3's backstop, which is why the worker reports the
pid to run/3 the moment the port is open.
Test executor: the "sandbox" is an Elixir function you set per test. Exercises the plumbing (globals in, callbacks out, results back) without a JS runtime.
In-process executor on ex_safejs,
the QuickJS-NG engine embedded as a Rustler NIF (our hard fork of
lpgauth/quicksand). Like Executor.ZapCode it's a pure dependency with
precompiled binaries — no runtime binary in the image, no subprocess — but
unlike zapcode it enforces a genuine hard memory cap (QuickJS's own
allocator is the sole memory authority, so even typed-array/ArrayBuffer
allocations are bounded, the vector that escapes V8's heap limit) and runs
a mature, correct engine with O(1) container access (no O(n²) spec scans).
In-process executor on ex_zapcode, a pure-Rust TypeScript-subset interpreter shipped as a NIF. No subprocess, no runtime binary in the image, no container config — a hex dependency is the whole deployment story, and the engine enforces a hard cap on live guest memory (the blocker that ruled Deno out for some hosts).
Pure pipeline: raw spec source -> OapiCodemode.Artifact.
Resolves all same-document $refs inline so sandbox code never chases references.
Extracts a flat operation list from a dereferenced spec, deriving stable
readable ids where operationId is missing (the oaskit cards_freeze_ALTIJVI
lesson: never trust upstream ids to exist or be usable).
Parses raw YAML/JSON into a map and checks it is an OpenAPI 3.x document.
One HTTP operation extracted from a spec, ready for matching and validation.
The validating, credential-injecting request pipeline: match -> policy -> validate -> credentials -> execute -> normalize.
Matches an intercepted (method, path) against the operation index. On failure, suggests the nearest operations so the model can self-correct without another search round-trip.
Serializes query parameters honoring the spec's style/explode declarations (the ele lesson: default serializers silently mismatch backend expectations). Supported: form (explode true/false), deepObject, spaceDelimited, pipeDelimited. Anything else falls back to form+explode.
Validates an intercepted request against the operation's dereferenced schema.
Holds ingested artifacts and per-API config in ETS. No persistence: hosts re-register at boot from wherever they keep specs.
Emits the two codemode tools as data plus handlers. Transport-agnostic: hosts wrap these into their own tool layers (gentility's CloudLoop.Tool, ele's UserMCP.Tool, or a gen_mcp server).
Assembles search/execute tool descriptions from registry state. The description IS the documentation — every global the sandbox actually receives must be declared here, with real names, or the model has to guess at them.
JSON-encodes tool results with a budget cap and an instructive trailer.