Build a coding agent runner

import { WorkerEntrypoint } from "cloudflare:workers";

const gatewayHost = "gateway.ai.cloudflare.com";

export class Outbound extends WorkerEntrypoint {
	async fetch(request) {
		const url = new URL(request.url);
		const gatewayPath = `/v1/${this.env.AI_GATEWAY_ACCOUNT_ID}/${this.env.AI_GATEWAY_ID}`;

		if (url.protocol !== "https:") {
			return new Response(`${url.hostname} is reachable only over HTTPS\n`, {
				status: 403,
			});
		}

		if (
			url.hostname === gatewayHost &&
			(url.pathname === gatewayPath ||
				url.pathname.startsWith(`${gatewayPath}/`))
		) {
			const headers = new Headers(request.headers);
			headers.delete("x-api-key");
			headers.set(
				"cf-aig-authorization",
				`Bearer ${this.env.AI_GATEWAY_TOKEN}`,
			);
			return fetch(new Request(request, { headers }));
		}

		if (url.hostname === "github.com") {
			return fetch(request);
		}

		return new Response(
			`${url.hostname} is not reachable from this sandbox\n`,
			{ status: 403 },
		);
	}
}

import { WorkerEntrypoint } from "cloudflare:workers";

const gatewayHost = "gateway.ai.cloudflare.com";

export class Outbound extends WorkerEntrypoint<Env> {
	async fetch(request: Request): Promise<Response> {
		const url = new URL(request.url);
		const gatewayPath = `/v1/${this.env.AI_GATEWAY_ACCOUNT_ID}/${this.env.AI_GATEWAY_ID}`;

		if (url.protocol !== "https:") {
			return new Response(`${url.hostname} is reachable only over HTTPS\n`, {
				status: 403,
			});
		}

		if (
			url.hostname === gatewayHost &&
			(url.pathname === gatewayPath ||
				url.pathname.startsWith(`${gatewayPath}/`))
		) {
			const headers = new Headers(request.headers);
			headers.delete("x-api-key");
			headers.set(
				"cf-aig-authorization",
				`Bearer ${this.env.AI_GATEWAY_TOKEN}`,
			);
			return fetch(new Request(request, { headers }));
		}

		if (url.hostname === "github.com") {
			return fetch(request);
		}

		return new Response(
			`${url.hostname} is not reachable from this sandbox\n`,
			{ status: 403 },
		);
	}
}

import { Files, SandboxFileError } from "@cloudflare/sandbox";
import { DurableObject } from "cloudflare:workers";
import { z } from "zod";

const repositoryDirectory = "/workspace/repo";
const taskDirectory = "/workspace/task";
const eventsPath = `${taskDirectory}/stdout.log`;
const stderrPath = `${taskDirectory}/stderr.log`;
const exitCodePath = `${taskDirectory}/exit-code`;
const pidPath = `${taskDirectory}/pid`;
const inactivityTimeout = 30 * 60 * 1000;
const taskCheckInterval = 60 * 1000;
const taskKey = "task";

const caPath = "/etc/cloudflare/certs/cloudflare-containers-ca.crt";
// The CA alone replaces the system trust store. This works because
// Outbound intercepts every HTTPS request from the container.
const trustEnv = {
	NODE_EXTRA_CA_CERTS: caPath,
	GIT_SSL_CAINFO: caPath,
	CURL_CA_BUNDLE: caPath,
	SSL_CERT_FILE: caPath,
};

// Runs the command in its own process group. Records its process ID when
// it starts and its exit code when it ends.
const taskScript = `dir=$1; shift
setsid sh -c 'echo "$$ $(cat /proc/sys/kernel/random/boot_id)" >"$0/pid"; exec "$@"' \\
	"$dir" "$@" >"$dir/stdout.log" 2>"$dir/stderr.log"
echo "$?" >"$dir/exit-code.tmp" && mv "$dir/exit-code.tmp" "$dir/exit-code"`;

// Succeeds while the process in the file runs and started in this instance.
const taskRunningScript = `read -r pid boot <"$1" &&
	[ "$boot" = "$(cat /proc/sys/kernel/random/boot_id)" ] &&
	kill -0 "$pid"`;

const ResultEvent = z.object({
	type: z.literal("result"),
	subtype: z.string(),
	is_error: z.boolean(),
	result: z.string().optional(),
});

export class AgentSandbox extends DurableObject {
	container;
	files;
	setup;

	constructor(ctx, env) {
		super(ctx, env);

		const container = ctx.container;

		if (!container) {
			throw new Error("The container binding is not configured");
		}

		this.container = container;
		this.files = new Files(container);

		if (container.running) {
			void ctx.blockConcurrencyWhile(() =>
				container.setInactivityTimeout(inactivityTimeout),
			);
		}
	}

	async cloneRepository(repository, ref) {
		await this.startSandbox();
		const branch = ref === undefined ? [] : ["--branch", ref];

		return this.run(
			[
				"git",
				"clone",
				"--depth",
				"1",
				...branch,
				"--",
				repository,
				repositoryDirectory,
			],
			"/workspace",
			trustEnv,
		);
	}

	startTask(prompt) {
		return this.ctx.blockConcurrencyWhile(async () => {
			await this.startSandbox();

			if ((await this.taskStatus()).state === "running") {
				return "busy";
			}

			await this.files.remove(taskDirectory, { recursive: true, force: true });
			await this.files.mkdir(taskDirectory);

			await this.container.exec(
				[
					"/bin/sh",
					"-c",
					taskScript,
					"agent",
					taskDirectory,
					...this.agentCommand(prompt),
				],
				{
					cwd: repositoryDirectory,
					env: { ...trustEnv, ...this.agentEnv() },
					stdout: "ignore",
					stderr: "ignore",
				},
			);

			this.ctx.storage.kv.put(taskKey, "started");
			await this.ctx.storage.setAlarm(Date.now() + taskCheckInterval);
			return "started";
		});
	}

	async alarm() {
		if (!this.container.running) {
			return;
		}

		if ((await this.taskStatus()).state === "running") {
			await this.ctx.storage.setAlarm(Date.now() + taskCheckInterval);
			return;
		}

		this.ctx.storage.kv.delete(taskKey);
	}

	async readTask() {
		if (!this.container.running) {
			return this.ctx.storage.kv.get(taskKey) === undefined
				? { state: "none" }
				: { state: "lost" };
		}

		return this.taskStatus();
	}

	async readDiff() {
		await this.startSandbox();

		return this.run(
			["/bin/sh", "-c", "git add --intent-to-add . && git diff"],
			repositoryDirectory,
			{},
		);
	}

	agentCommand(prompt) {
		return [
			"claude",
			"--print",
			"--output-format",
			"stream-json",
			"--verbose",
			"--dangerously-skip-permissions",
			"--no-session-persistence",
			"--model",
			this.env.MODEL,
			"--",
			prompt,
		];
	}

	agentEnv() {
		return {
			ANTHROPIC_BASE_URL: `https://gateway.ai.cloudflare.com/v1/${this.env.AI_GATEWAY_ACCOUNT_ID}/${this.env.AI_GATEWAY_ID}/anthropic`,
			ANTHROPIC_API_KEY: "provided-by-worker",
			CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
			IS_SANDBOX: "1",
		};
	}

	async startSandbox() {
		// Set up each new container, and a running container
		// after this Durable Object restarts.
		if (this.setup === undefined || !this.container.running) {
			this.setup = this.setUpSandbox().catch((error) => {
				this.setup = undefined;
				throw error;
			});
		}

		await this.setup;
	}

	async setUpSandbox() {
		if (!this.container.running) {
			this.ctx.storage.kv.delete(taskKey);
			this.container.start({
				image: this.container.images.agent,
				instance: "standard-1",
				enableInternet: false,
			});
		}

		try {
			await this.container.interceptAllOutboundHttp(this.ctx.exports.Outbound);
			await this.container.interceptOutboundHttps(
				"*",
				this.ctx.exports.Outbound,
			);
			await this.container.setInactivityTimeout(inactivityTimeout);
		} catch (error) {
			// The next request starts a new container.
			await this.container.destroy();
			throw error;
		}
	}

	async taskStatus() {
		const exitCode = await this.readOptionalText(exitCodePath);

		if (exitCode !== undefined) {
			return this.outcome(Number.parseInt(exitCode, 10));
		}

		const pid = await this.readOptionalText(pidPath);

		if (pid === undefined) {
			// The task writes its process ID right after it starts.
			return this.ctx.storage.kv.get(taskKey) === undefined
				? { state: "none" }
				: { state: "running" };
		}

		const probe = await this.run(
			["/bin/sh", "-c", taskRunningScript, "probe", pidPath],
			"/",
			{},
		);

		if (probe.exitCode === 0) {
			return { state: "running" };
		}

		// The task can finish after the first read, so read the exit code
		// again.
		const lateExitCode = await this.readOptionalText(exitCodePath);

		if (lateExitCode !== undefined) {
			return this.outcome(Number.parseInt(lateExitCode, 10));
		}

		return { state: "lost" };
	}

	async outcome(exitCode) {
		let result;
		const events = await this.files.readFile(eventsPath);

		for await (const line of readLines(events.body)) {
			const parsed = ResultEvent.safeParse(parseJson(line));

			if (parsed.success) {
				result = parsed.data;
			}
		}

		if (result === undefined) {
			const stderr = (await this.readOptionalText(stderrPath)) ?? "";
			return {
				state: "failed",
				error: `claude exited with ${exitCode}: ${stderr.slice(-2000)}`,
			};
		}

		if (result.is_error) {
			return { state: "failed", error: result.result ?? result.subtype };
		}

		return { state: "succeeded", result: result.result ?? "" };
	}

	async readOptionalText(path) {
		try {
			return await (await this.files.readFile(path)).text();
		} catch (error) {
			if (SandboxFileError.is(error) && error.code === "ENOENT") {
				return undefined;
			}

			throw error;
		}
	}

	async run(command, cwd, env) {
		const process = await this.container.exec(command, { cwd, env });
		const output = await process.output();
		const decoder = new TextDecoder();

		return {
			exitCode: output.exitCode,
			stdout: decoder.decode(output.stdout),
			stderr: decoder.decode(output.stderr),
		};
	}
}

function parseJson(line) {
	try {
		return JSON.parse(line);
	} catch {
		return undefined;
	}
}

async function* readLines(body) {
	if (body === null) {
		return;
	}

	const decoder = new TextDecoder();
	let buffered = "";

	for await (const chunk of body) {
		buffered += decoder.decode(chunk, { stream: true });
		const lines = buffered.split("\n");
		buffered = lines.pop() ?? "";
		yield* lines;
	}

	buffered += decoder.decode();

	if (buffered !== "") {
		yield buffered;
	}
}

import { Files, SandboxFileError } from "@cloudflare/sandbox";
import { DurableObject } from "cloudflare:workers";
import { z } from "zod";

const repositoryDirectory = "/workspace/repo";
const taskDirectory = "/workspace/task";
const eventsPath = `${taskDirectory}/stdout.log`;
const stderrPath = `${taskDirectory}/stderr.log`;
const exitCodePath = `${taskDirectory}/exit-code`;
const pidPath = `${taskDirectory}/pid`;
const inactivityTimeout = 30 * 60 * 1000;
const taskCheckInterval = 60 * 1000;
const taskKey = "task";

const caPath = "/etc/cloudflare/certs/cloudflare-containers-ca.crt";
// The CA alone replaces the system trust store. This works because
// Outbound intercepts every HTTPS request from the container.
const trustEnv = {
	NODE_EXTRA_CA_CERTS: caPath,
	GIT_SSL_CAINFO: caPath,
	CURL_CA_BUNDLE: caPath,
	SSL_CERT_FILE: caPath,
};

// Runs the command in its own process group. Records its process ID when
// it starts and its exit code when it ends.
const taskScript = `dir=$1; shift
setsid sh -c 'echo "$$ $(cat /proc/sys/kernel/random/boot_id)" >"$0/pid"; exec "$@"' \\
	"$dir" "$@" >"$dir/stdout.log" 2>"$dir/stderr.log"
echo "$?" >"$dir/exit-code.tmp" && mv "$dir/exit-code.tmp" "$dir/exit-code"`;

// Succeeds while the process in the file runs and started in this instance.
const taskRunningScript = `read -r pid boot <"$1" &&
	[ "$boot" = "$(cat /proc/sys/kernel/random/boot_id)" ] &&
	kill -0 "$pid"`;

const ResultEvent = z.object({
	type: z.literal("result"),
	subtype: z.string(),
	is_error: z.boolean(),
	result: z.string().optional(),
});

export type TaskStatus =
	| { state: "none" }
	| { state: "running" }
	| { state: "lost" }
	| { state: "succeeded"; result: string }
	| { state: "failed"; error: string };

export type CommandResult = {
	exitCode: number;
	stdout: string;
	stderr: string;
};

export class AgentSandbox extends DurableObject<Env> {
	private readonly container: Container;
	private readonly files: Files;
	private setup: Promise<void> | undefined;

	constructor(ctx: DurableObjectState, env: Env) {
		super(ctx, env);

		const container = ctx.container;

		if (!container) {
			throw new Error("The container binding is not configured");
		}

		this.container = container;
		this.files = new Files(container);

		if (container.running) {
			void ctx.blockConcurrencyWhile(() =>
				container.setInactivityTimeout(inactivityTimeout),
			);
		}
	}

	async cloneRepository(
		repository: string,
		ref: string | undefined,
	): Promise<CommandResult> {
		await this.startSandbox();
		const branch = ref === undefined ? [] : ["--branch", ref];

		return this.run(
			[
				"git",
				"clone",
				"--depth",
				"1",
				...branch,
				"--",
				repository,
				repositoryDirectory,
			],
			"/workspace",
			trustEnv,
		);
	}

	startTask(prompt: string): Promise<"started" | "busy"> {
		return this.ctx.blockConcurrencyWhile(async () => {
			await this.startSandbox();

			if ((await this.taskStatus()).state === "running") {
				return "busy";
			}

			await this.files.remove(taskDirectory, { recursive: true, force: true });
			await this.files.mkdir(taskDirectory);

			await this.container.exec(
				[
					"/bin/sh",
					"-c",
					taskScript,
					"agent",
					taskDirectory,
					...this.agentCommand(prompt),
				],
				{
					cwd: repositoryDirectory,
					env: { ...trustEnv, ...this.agentEnv() },
					stdout: "ignore",
					stderr: "ignore",
				},
			);

			this.ctx.storage.kv.put(taskKey, "started");
			await this.ctx.storage.setAlarm(Date.now() + taskCheckInterval);
			return "started";
		});
	}

	async alarm(): Promise<void> {
		if (!this.container.running) {
			return;
		}

		if ((await this.taskStatus()).state === "running") {
			await this.ctx.storage.setAlarm(Date.now() + taskCheckInterval);
			return;
		}

		this.ctx.storage.kv.delete(taskKey);
	}

	async readTask(): Promise<TaskStatus> {
		if (!this.container.running) {
			return this.ctx.storage.kv.get(taskKey) === undefined
				? { state: "none" }
				: { state: "lost" };
		}

		return this.taskStatus();
	}

	async readDiff(): Promise<CommandResult> {
		await this.startSandbox();

		return this.run(
			["/bin/sh", "-c", "git add --intent-to-add . && git diff"],
			repositoryDirectory,
			{},
		);
	}

	private agentCommand(prompt: string): string[] {
		return [
			"claude",
			"--print",
			"--output-format",
			"stream-json",
			"--verbose",
			"--dangerously-skip-permissions",
			"--no-session-persistence",
			"--model",
			this.env.MODEL,
			"--",
			prompt,
		];
	}

	private agentEnv(): Record<string, string> {
		return {
			ANTHROPIC_BASE_URL: `https://gateway.ai.cloudflare.com/v1/${this.env.AI_GATEWAY_ACCOUNT_ID}/${this.env.AI_GATEWAY_ID}/anthropic`,
			ANTHROPIC_API_KEY: "provided-by-worker",
			CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
			IS_SANDBOX: "1",
		};
	}

	private async startSandbox(): Promise<void> {
		// Set up each new container, and a running container
		// after this Durable Object restarts.
		if (this.setup === undefined || !this.container.running) {
			this.setup = this.setUpSandbox().catch((error) => {
				this.setup = undefined;
				throw error;
			});
		}

		await this.setup;
	}

	private async setUpSandbox(): Promise<void> {
		if (!this.container.running) {
			this.ctx.storage.kv.delete(taskKey);
			this.container.start({
				image: this.container.images.agent,
				instance: "standard-1",
				enableInternet: false,
			});
		}

		try {
			await this.container.interceptAllOutboundHttp(this.ctx.exports.Outbound);
			await this.container.interceptOutboundHttps(
				"*",
				this.ctx.exports.Outbound,
			);
			await this.container.setInactivityTimeout(inactivityTimeout);
		} catch (error) {
			// The next request starts a new container.
			await this.container.destroy();
			throw error;
		}
	}

	private async taskStatus(): Promise<TaskStatus> {
		const exitCode = await this.readOptionalText(exitCodePath);

		if (exitCode !== undefined) {
			return this.outcome(Number.parseInt(exitCode, 10));
		}

		const pid = await this.readOptionalText(pidPath);

		if (pid === undefined) {
			// The task writes its process ID right after it starts.
			return this.ctx.storage.kv.get(taskKey) === undefined
				? { state: "none" }
				: { state: "running" };
		}

		const probe = await this.run(
			["/bin/sh", "-c", taskRunningScript, "probe", pidPath],
			"/",
			{},
		);

		if (probe.exitCode === 0) {
			return { state: "running" };
		}

		// The task can finish after the first read, so read the exit code
		// again.
		const lateExitCode = await this.readOptionalText(exitCodePath);

		if (lateExitCode !== undefined) {
			return this.outcome(Number.parseInt(lateExitCode, 10));
		}

		return { state: "lost" };
	}

	private async outcome(exitCode: number): Promise<TaskStatus> {
		let result: z.infer<typeof ResultEvent> | undefined;
		const events = await this.files.readFile(eventsPath);

		for await (const line of readLines(events.body)) {
			const parsed = ResultEvent.safeParse(parseJson(line));

			if (parsed.success) {
				result = parsed.data;
			}
		}

		if (result === undefined) {
			const stderr = (await this.readOptionalText(stderrPath)) ?? "";
			return {
				state: "failed",
				error: `claude exited with ${exitCode}: ${stderr.slice(-2000)}`,
			};
		}

		if (result.is_error) {
			return { state: "failed", error: result.result ?? result.subtype };
		}

		return { state: "succeeded", result: result.result ?? "" };
	}

	private async readOptionalText(path: string): Promise<string | undefined> {
		try {
			return await (await this.files.readFile(path)).text();
		} catch (error) {
			if (SandboxFileError.is(error) && error.code === "ENOENT") {
				return undefined;
			}

			throw error;
		}
	}

	private async run(
		command: string[],
		cwd: string,
		env: Record<string, string>,
	): Promise<CommandResult> {
		const process = await this.container.exec(command, { cwd, env });
		const output = await process.output();
		const decoder = new TextDecoder();

		return {
			exitCode: output.exitCode,
			stdout: decoder.decode(output.stdout),
			stderr: decoder.decode(output.stderr),
		};
	}
}

function parseJson(line: string): unknown {
	try {
		return JSON.parse(line);
	} catch {
		return undefined;
	}
}

async function* readLines(
	body: ReadableStream<Uint8Array> | null,
): AsyncGenerator<string> {
	if (body === null) {
		return;
	}

	const decoder = new TextDecoder();
	let buffered = "";

	for await (const chunk of body) {
		buffered += decoder.decode(chunk, { stream: true });
		const lines = buffered.split("\n");
		buffered = lines.pop() ?? "";
		yield* lines;
	}

	buffered += decoder.decode();

	if (buffered !== "") {
		yield buffered;
	}
}

import { z } from "zod";

export { Outbound } from "./outbound";
export { AgentSandbox } from "./sandbox";

const sandboxName = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;

// Linux rejects a command argument of 128 KiB or more, including its NUL byte.
const maxPromptBytes = 128 * 1024 - 1;

const RepositoryRequest = z.object({
	url: z.url({ protocol: /^https$/, hostname: /^github\.com$/ }),
	ref: z.string().min(1).optional(),
});

export default {
	async fetch(request, env) {
		const url = new URL(request.url);
		const match = /^\/sandboxes\/([^/]+)\/(repository|task|diff)$/.exec(
			url.pathname,
		);

		if (!match) {
			return new Response("Not found", { status: 404 });
		}

		const [, name, resource] = match;

		if (!sandboxName.test(name)) {
			return new Response(
				"The sandbox name must be 1-63 lowercase letters, digits, or hyphens, with no hyphen at either end",
				{ status: 400 },
			);
		}

		const sandbox = env.SANDBOX.getByName(name);

		try {
			if (resource === "repository" && request.method === "POST") {
				const body = RepositoryRequest.safeParse(
					await request.json().catch(() => null),
				);

				if (!body.success) {
					return new Response(
						'Send {"url": "https://github.com/OWNER/REPOSITORY"}',
						{ status: 400 },
					);
				}

				const result = await sandbox.cloneRepository(
					body.data.url,
					body.data.ref,
				);
				return Response.json(result, {
					status: result.exitCode === 0 ? 200 : 502,
				});
			}

			if (resource === "task" && request.method === "POST") {
				const prompt = await request.text();

				if (prompt.trim() === "") {
					return new Response("Send a prompt", { status: 400 });
				}

				if (new TextEncoder().encode(prompt).byteLength > maxPromptBytes) {
					return new Response("Send a prompt smaller than 128 KiB", {
						status: 413,
					});
				}

				if ((await sandbox.startTask(prompt)) === "busy") {
					return new Response("A task is already running", { status: 409 });
				}

				return Response.json({ state: "running" }, { status: 202 });
			}

			if (resource === "task" && request.method === "GET") {
				return Response.json(await sandbox.readTask());
			}

			if (resource === "diff" && request.method === "GET") {
				const result = await sandbox.readDiff();

				if (result.exitCode !== 0) {
					return Response.json(result, { status: 502 });
				}

				return new Response(result.stdout, {
					headers: { "content-type": "text/plain" },
				});
			}

			return new Response("Method not allowed", { status: 405 });
		} catch (error) {
			console.error("Sandbox request failed", error);
			return new Response("Sandbox request failed", { status: 500 });
		}
	},
};

import { z } from "zod";

export { Outbound } from "./outbound";
export { AgentSandbox } from "./sandbox";

const sandboxName = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;

// Linux rejects a command argument of 128 KiB or more, including its NUL byte.
const maxPromptBytes = 128 * 1024 - 1;

const RepositoryRequest = z.object({
	url: z.url({ protocol: /^https$/, hostname: /^github\.com$/ }),
	ref: z.string().min(1).optional(),
});

export default {
	async fetch(request: Request, env: Env): Promise<Response> {
		const url = new URL(request.url);
		const match = /^\/sandboxes\/([^/]+)\/(repository|task|diff)$/.exec(
			url.pathname,
		);

		if (!match) {
			return new Response("Not found", { status: 404 });
		}

		const [, name, resource] = match;

		if (!sandboxName.test(name)) {
			return new Response(
				"The sandbox name must be 1-63 lowercase letters, digits, or hyphens, with no hyphen at either end",
				{ status: 400 },
			);
		}

		const sandbox = env.SANDBOX.getByName(name);

		try {
			if (resource === "repository" && request.method === "POST") {
				const body = RepositoryRequest.safeParse(
					await request.json().catch(() => null),
				);

				if (!body.success) {
					return new Response(
						'Send {"url": "https://github.com/OWNER/REPOSITORY"}',
						{ status: 400 },
					);
				}

				const result = await sandbox.cloneRepository(
					body.data.url,
					body.data.ref,
				);
				return Response.json(result, {
					status: result.exitCode === 0 ? 200 : 502,
				});
			}

			if (resource === "task" && request.method === "POST") {
				const prompt = await request.text();

				if (prompt.trim() === "") {
					return new Response("Send a prompt", { status: 400 });
				}

				if (new TextEncoder().encode(prompt).byteLength > maxPromptBytes) {
					return new Response("Send a prompt smaller than 128 KiB", {
						status: 413,
					});
				}

				if ((await sandbox.startTask(prompt)) === "busy") {
					return new Response("A task is already running", { status: 409 });
				}

				return Response.json({ state: "running" }, { status: 202 });
			}

			if (resource === "task" && request.method === "GET") {
				return Response.json(await sandbox.readTask());
			}

			if (resource === "diff" && request.method === "GET") {
				const result = await sandbox.readDiff();

				if (result.exitCode !== 0) {
					return Response.json(result, { status: 502 });
				}

				return new Response(result.stdout, {
					headers: { "content-type": "text/plain" },
				});
			}

			return new Response("Method not allowed", { status: 405 });
		} catch (error) {
			console.error("Sandbox request failed", error);
			return new Response("Sandbox request failed", { status: 500 });
		}
	},
} satisfies ExportedHandler<Env>;