justbash() backend can't enable just-bash's bundled Python (capability passthrough)

[arimxyer]

Summary

The justbash() sandbox backend cannot enable just-bash's bundled interpreters (Python, and by the same mechanism sqlite3 / js-exec). python3 returns exit 127 under the just-bash backend even though the CPython-WASM runtime ships inside the just-bash package.

Details

just-bash (3.0.2) bundles CPython-WASM at vendor/cpython-emscripten/python.wasm and exposes it through a typed constructor flag — BashOptions.python: boolean ("Enable python3/python commands. Python is disabled by default as it introduces additional security surface…"). Likewise it has flags/config for sqlite3, js-exec (QuickJS), and network.

But eve's justbash() backend (eve 0.17.1) constructs the interpreter with filesystem / network / env / cwd options only and never sets python, and JustBashSandboxCreateOptions exposes only autoInstall. There is no passthrough for the capability flags, so python stays at its default (off).

Result: the bundled runtime is present but unreachable — python3 is "command not found".

Reproduction

1. Author a sandbox that pins the backend:

   // agent/sandbox/sandbox.ts
   import { defineSandbox } from "eve/sandbox";
   import { justbash } from "eve/sandbox/just-bash";
   export default defineSandbox({ backend: justbash() });

2. Have the agent run any Python in the sandbox, e.g. python3 -c "print(1+1)".

3. Observed: sandbox command finished (exit 127) (command not found).
   Expected: 2.

Impact

just-bash is uniquely valuable as the zero-dependency, no-daemon, no-VM backend — the natural choice for KVM-less CI and lightweight local runs. But any agent that computes in-sandbox (a Python/sqlite/js helper) silently fails on just-bash and must fall back to Docker or microsandbox, defeating that purpose. In our case we fell back to microsandbox solely because just-bash couldn't run a stdlib-only Python helper.

Request

Let justbash({ ... }) pass through just-bash's capability options — at minimum python, and ideally the relevant BashOptions subset (sqlite, js-exec, network) — so callers can opt in, with the security caveat surfaced in the docs (it's off-by-default in just-bash for a reason).

Related

#239 ("vercel() sandbox backend ignores the runtime option and always runs vercel/eve:latest") looks like the same class of issue: a backend factory not forwarding an author-supplied option to the underlying runtime. May be worth addressing as a consistent "backends forward their options" pass.

Versions

eve 0.17.1, just-bash 3.0.2.

[arimxyer]

Root-caused this. The premise above (just-bash exposes a python flag eve just needs to
forward) is half right: the flag exists, but not on the type eve passes.

just-bash has two option surfaces:

• BashOptions (new Bash(...)) — where the capability flags live: python,
  javascript (js-exec), commands, customCommands, fetch.
• SandboxOptions (Sandbox.create(...)) — what eve actually calls. Its full field
  set is cwd, env, timeoutMs, fs, overlayRoot, maxCallDepth, maxCommandCount, maxLoopIterations, network, defenseInDepth. No python/javascript/commands/
  customCommands/fetch.

And Sandbox.create builds its internal Bash without forwarding the capability
flags (verified in the published source and bundle, identical in 3.0.1 and 3.0.2):

// just-bash/src/sandbox/Sandbox.ts
const bashEnv = new Bash({
  env: opts?.env,
  cwd: opts?.cwd,
  fs,
  maxCallDepth: opts?.maxCallDepth,
  maxCommandCount: opts?.maxCommandCount,
  maxLoopIterations: opts?.maxLoopIterations,
  network: opts?.network,
  defenseInDepth: opts?.defenseInDepth,
});

So python (and js-exec/sqlite/custom-commands) is unreachable through the API eve
uses — the bundled CPython is present but the Sandbox factory drops the flag one layer
below eve. No amount of option plumbing in eve's justbash() backend can reach it.

The real fix is upstream in just-bash, not eve: have SandboxOptions accept the
capability flags and forward them into the internal Bash. Filed:
vercel-labs/just-bash#283 (with a draft PR: vercel-labs/just-bash#284).

Once that lands, the eve side is a trivial follow-up: thread the new options from
justbash(opts) → Sandbox.create({...}). I have that eve-side passthrough staged and
will open it against this issue when the upstream change is released.

(Separately, eve can already forward the SandboxOptions fields it currently hardcodes
or omits — timeoutMs, the execution limits, defenseInDepth — but that's the #239-class
"backends forward their options" generalization and does not deliver Python, which is
what this issue is about.)