Skip to main content
This page documents all configuration options for @enclave-vm/core.

Quick Example

Core Options

Console

Without a consoleHandler, console is allowed only at PERMISSIVE and writes to the host process console. With one, scripts may use console at every security level and each call reaches the handler instead:
  • level is 'log' | 'info' | 'warn' | 'error' | 'debug' (ConsoleLevel); message is the formatted line: arguments joined by spaces, objects JSON-serialized.
  • maxConsoleCalls and maxConsoleOutputBytes are checked before the handler runs. Past a limit, the script’s call throws and the handler is not called.
  • The handler’s return value is ignored, and anything it throws or rejects with is swallowed: the script sees neither.
  • The script’s console is a frozen, null-prototype object built inside the sandbox. It holds no reference the script can reach to the handler or to any host object.
  • Supported by the double VM (default), the vm adapter and the worker_threads adapter. A custom sandbox adapter receives the handler as context.consoleHandler; the built-in InterpreterAdapter has no console, so a script that uses it fails there ('__safe_console' is not defined). @enclave-vm/browser has its own options and is unchanged.
  • A consoleHandler cannot be combined with a console entry in globals (the constructor throws a TypeError).

Memory Tracking

Reference Sidecar

Double VM Layer

AI Scoring Gate

Worker Pool Adapter

Custom Sandbox Adapter

@enclave-vm/core runs scripts with node:vm. Where that is not available (a browser worker, an edge runtime), run() fails with @enclave-vm/core needs node:vm, ...; pass a sandboxAdapter to run scripts another way. It replaces the double VM and the adapter option.
The enclave still validates and transforms every script before calling execute, but isolation is then the adapter’s job: it receives the ExecutionContext (limits, tool handler, stats, abort signal) and must enforce it. The caller owns the adapter: enclave.dispose() does not dispose it, so one adapter can serve several enclaves. In a browser, @enclave-vm/browser is usually the better fit.

Security Options

Execution Result

The run() method returns:

Error Codes