Add plumbing for TS/PY snippets in Sandboxes

[jpwilliams]

Summary

Add the plumbing for TypeScript and Python snippets to unlock higher-level APIs for running code. These allow submitted code to be within an existing process with some controlled globals etc which allow us to influence the environment enough to produce some nice future sugar.

This is the foundation that will allow for functionality such as:

const stats = await step.sandbox.python(
  "stats",
  `import statistics
return {"mean": statistics.mean(values)}`,
  { input: { values: [1, 2, 3, 4] } },
);

Checklist

• Added a docs PR that references this PR N/A internal
• Added unit/integration tests
• Added changesets if applicable

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4443b03

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

🟡 Changes recommended

Result framing, cyclic validation, and TypeScript transformation have correctness gaps.

4 open findings

• Fixed stdout marker can misparse failed or incomplete runs · New
• Default TypeScript mode rejects syntax requiring transformation · New
• Recursive validation fails to detect cyclic object references · New
• Trailing stdout corrupts parsing of the returned result · New

What changed in this PR

Adds internal sandbox plumbing to execute TypeScript and Python snippets with JSON inputs and parsed results.

Changes:

• Builds inline or file-backed runner commands.
• Validates JSON inputs and global names.
• Adds execution and parsing tests for both languages.

File	Description
runnerScripts.ts	Implements snippet runners, validation, and result parsing.
runnerScripts.test.ts	Tests execution, payload handling, validation, and parsing.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] Adds sandbox execution for TypeScript and Python snippets.

Fix result parsing before merging; successful snippets can fail when they print after returning.

Findings

1.  Later logs break results ▶
2.  Cyclic inputs exhaust the stack ▶
3.  Empty array slots change ▶

Fix with agent prompt

### Issue 1
packages/inngest/src/components/sandbox/runnerScripts.ts:224-228
`parseRunnerOutput` treats everything after the result marker as JSON. A valid TypeScript snippet such as `setTimeout(() => console.log('later'), 10); return 1` prints its result before the timer fires. The command succeeds, but parsing `1\nlater` throws and loses the result. Read only the result's line and preserve later output in `stdout`, or write results separately from logs.

### Issue 2
packages/inngest/src/components/sandbox/runnerScripts.ts:156-157
`assertJson` follows nested objects and arrays without checking for cycles. Passing a self-referencing object through `input` exhausts the call stack and throws `RangeError` instead of `SandboxValidationError`. Track objects on the current recursion path and reject cycles with the same error used for other invalid JSON values.

### Issue 3
packages/inngest/src/components/sandbox/runnerScripts.ts:146-148
`assertJson` uses `forEach`, which skips empty array slots. An input such as `[1, , 3]` therefore passes, although an explicit `undefined` element is rejected. `JSON.stringify` then replaces the empty slot with `null`, silently changing the value the snippet sees. Check every array index and reject empty slots too.

```suggestion
    for (let index = 0; index < value.length; index++) {
      assertJson(
        Object.hasOwn(value, index) ? value[index] : undefined,
        `${path}[${index}]`,
      );
    }
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds internal helpers for running TypeScript and Python snippets in sandboxes.

• TypeScript and Python snippets can return values from async code.
• Snippet inputs must use valid names and JSON values.

Later logs can break result parsing. Input checks also miss cycles and empty array slots.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Snippet and input] --> B[Check input]
  B --> C{Payload size}
  C -->|Small| D[Command argument]
  C -->|Large| E[Upload file]
  D --> F[Run language wrapper]
  E --> F
  F --> G[Logs and marked result]
  G --> H[Split logs from result]

Loading

_{Reviews (1) · Last reviewed commit: "feat(sandbox): add runner script builder..." · Reviewed by Greptile}