ErosZy/sablejs

What it solves

Sablejs provides a fast, secure way to execute JavaScript code that is either written by users or generated by AI, without the overhead of an embedded virtual machine. It solves the problem of running untrusted code safely (sandboxing) while maintaining high performance and debuggability through source maps.

How it works

Instead of using a VM, sablejs AOT (Ahead-of-Time) compiles guest JavaScript (ES5.1) into host JavaScript. It uses a "sandbox" mode that recursively copies plain data from the host to the guest, ensuring that mutations within the guest code cannot affect the host's object graph. Host functions are exposed to the guest as "capabilities"—mediated wrappers that sanitize errors and copy arguments/results.

To prevent infinite loops or memory exhaustion, it recommends running compiled programs in a dedicated Web Worker, allowing the host to enforce wall-clock timeouts and terminate the execution agent.

Who it’s for

Developers building applications that need to execute dynamic, user-provided, or AI-generated JavaScript logic (such as plugin systems or rule engines) in Node.js, browsers, or other JS runtimes like Deno and Bun.

Highlights

• AOT Compilation: Compiles guest code to host JS for speed, avoiding the embedded VM approach.

• Secure Sandboxing: Prevents guest code from accessing host objects or platform APIs (like window or fs) by default.

• Capabilities System: Allows the host to explicitly grant narrow, controlled access to host functions.

• Debuggable: Generates Source Map v3 for mapping generated code back to the original guest source.

• Worker Isolation: Includes built-in helpers for running programs in Workers to enforce timeouts.

• High Performance: Outperforms QuickJS-WASM in several benchmarks (e.g., V8 Benchmark Suite 7).