feat: add default lodash package to Node-TypeScript runtime

Add lodash and its @types/lodash declarations to the pre-installed
node_modules and bind-mount it read-only into /sandbox on the run step
(in addition to the existing compile-step mount), so compiled JS
resolves require('lodash') at run time and tsc type-checks the import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: koki-develop

e2e/tests/runtime/node-typescript.yml

@@ -498,3 +498,38 @@ tests:
               status: "OK"
               signal: null
               duration_ms: "/^[0-9]+$/"
+
+  - name: "pre-installed package lodash with types"
+    requests:
+      - input:
+          runtime: node-typescript
+          files:
+            - name: index.ts
+              type: plain
+              content: |
+                import _ from "lodash";
+
+                // Verify the pre-installed default package is importable, its
+                // @types/lodash declarations type-check (chunk returns T[][]),
+                // and it resolves at run time via the node_modules bind mount.
+                const result: number[][] = _.chunk([1, 2, 3, 4, 5], 2);
+                console.log(JSON.stringify(result));
+        output:
+          status: 200
+          body:
+            compile:
+              stdout: ""
+              stderr: ""
+              output: ""
+              exit_code: 0
+              status: "OK"
+              signal: null
+              duration_ms: "/^[0-9]+$/"
+            run:
+              stdout: "[[1,2],[3,4],[5]]\n"
+              stderr: ""
+              output: "[[1,2],[3,4],[5]]\n"
+              exit_code: 0
+              status: "OK"
+              signal: null
+              duration_ms: "/^[0-9]+$/"

e2e/tests/security/filesystem.yml

@@ -250,6 +250,36 @@ tests:
               signal: null
               duration_ms: "/^[0-9]+$/"
 
+  - name: "node-typescript node_modules is read-only"
+    requests:
+      - input:
+          runtime: node-typescript
+          files:
+            - name: index.ts
+              type: plain
+              content: |
+                import * as fs from "fs";
+                fs.writeFileSync("/sandbox/node_modules/lodash/evil.js", "x");
+        output:
+          status: 200
+          body:
+            compile:
+              stdout: ""
+              stderr: ""
+              output: ""
+              exit_code: 0
+              status: "OK"
+              signal: null
+              duration_ms: "/^[0-9]+$/"
+            run:
+              stdout: ""
+              stderr: "/^node:fs:\\d+\\n[\\s\\S]*Error: EROFS: read-only file system, open '/sandbox/node_modules/lodash/evil.js'[\\s\\S]*Node\\.js v[\\d.]+\\n$/"
+              output: "/^node:fs:\\d+\\n[\\s\\S]*Error: EROFS: read-only file system, open '/sandbox/node_modules/lodash/evil.js'[\\s\\S]*Node\\.js v[\\d.]+\\n$/"
+              exit_code: 1
+              status: "OK"
+              signal: null
+              duration_ms: "/^[0-9]+$/"
+
   - name: "ruby runtime directory is read-only"
     requests:
       - input:

internal/sandbox/CLAUDE.md

@@ -9,7 +9,7 @@ Core sandbox execution engine, split across three files:
 - **configs/seccomp.kafel** — Seccomp-BPF syscall filtering policy written in Kafel. Uses a blacklist approach (DEFAULT ALLOW) blocking dangerous syscalls (io_uring, bpf, userfaultfd, mount, ptrace, etc.) as a defense-in-depth layer. Referenced from nsjail.cfg via `seccomp_policy_file` and copied to `/etc/nsjail/seccomp.kafel` in Docker.
 - **defaults/go/** — Embedded `go.mod.tmpl` and `go.sum.tmpl` templates applied as default files for Go runtime execution.
 - **defaults/node/** — Embedded `package.json` and `package-lock.json` applied as default files for Node runtime execution. Pins the default packages (currently `lodash`) pre-installed at `/mise/node-modules/node_modules` (bind-mounted read-only into `/sandbox/node_modules` during the run step). Regenerate the lockfile with `npm install --package-lock-only`; never edit by hand.
-- **defaults/node-typescript/** — Embedded `package.json`, `package-lock.json`, and `tsconfig.json` applied as default files for Node-TypeScript runtime execution.
+- **defaults/node-typescript/** — Embedded `package.json`, `package-lock.json`, and `tsconfig.json` applied as default files for Node-TypeScript runtime execution. Beyond `typescript` and `@types/node`, ships the default packages (currently `lodash` plus its `@types/lodash` declarations) pre-installed at `/mise/ts-node-modules/node_modules`, bind-mounted read-only into `/sandbox/node_modules` on both the compile step (so `tsc` resolves the types) and the run step (so the compiled JS resolves `require()`). Regenerate the lockfile with `npm install --package-lock-only`; never edit by hand.
 - **defaults/ruby/** — Embedded `Gemfile` and `Gemfile.lock` applied as default files for Ruby runtime execution. The lockfile is generated via Bundler CLI (`bundle install` + `bundle lock --add-platform x86_64-linux aarch64-linux` + `bundle lock --add-checksums`); never edit by hand. The `CHECKSUMS` section pins each gem's SHA-256 so `bundle install` at Docker build time refuses to proceed if a fetched gem differs from the locked hash (supply-chain protection).
 
 Go runtime rejects user-submitted `go.mod`, `go.sum`, and `main` files (HTTP 400) to enforce use of defaults and prevent overwriting the compiled binary.

internal/sandbox/defaults/node-typescript/package-lock.json

@@ -1,6 +1,10 @@
 {
   "private": true,
+  "dependencies": {
+    "lodash": "4.18.1"
+  },
   "devDependencies": {
+    "@types/lodash": "4.17.24",
     "@types/node": "24.12.2",
     "typescript": "5.9.3"
   }

internal/sandbox/defaults/node-typescript/package.json

@@ -576,7 +576,10 @@ func (nodeTypeScriptRuntime) Command(entryFile string) []string {
 }
 
 func (nodeTypeScriptRuntime) BindMounts() []BindMount {
-	return []BindMount{{Src: "/mise/installs/node/current", Dst: "/mise/installs/node/current"}}
+	return []BindMount{
+		{Src: "/mise/installs/node/current", Dst: "/mise/installs/node/current"},
+		{Src: "/mise/ts-node-modules/node_modules", Dst: "/sandbox/node_modules"}, // pre-installed default packages (read-only); the compiled JS resolves require() against this at run time
+	}
 }
 
 func (nodeTypeScriptRuntime) Env() []string {
@@ -590,7 +593,7 @@ func (nodeTypeScriptRuntime) CompileCommand() []string {
 func (nodeTypeScriptRuntime) CompileBindMounts() []BindMount {
 	return []BindMount{
 		{Src: "/mise/installs/node/current", Dst: "/mise/installs/node/current"},
-		{Src: "/mise/ts-node-modules/node_modules", Dst: "/sandbox/node_modules"}, // pre-installed typescript and @types/node (read-only)
+		{Src: "/mise/ts-node-modules/node_modules", Dst: "/sandbox/node_modules"}, // pre-installed typescript, type definitions, and default packages such as lodash (read-only)
 	}
 }
 
@@ -658,7 +661,8 @@ func (nodeTypeScriptRuntime) Limits() Limits {
 
 // RestrictedFiles prevents users from overriding package.json and
 // package-lock.json, which must match the pre-installed node_modules
-// bind mount (contains typescript and @types/node).
+// bind mount (contains typescript, type definitions, and default
+// packages such as lodash).
 func (nodeTypeScriptRuntime) RestrictedFiles() []string {
 	return []string{"package.json", "package-lock.json"}
 }

internal/sandbox/runtime.go

@@ -310,6 +310,7 @@ func Test_readDefaultFiles(t *testing.T) {
 		assert.Equal(t, "package-lock.json", files[0].Name)
 		assert.Equal(t, "package.json", files[1].Name)
 		assert.Contains(t, string(files[1].Content), `"@types/node"`)
+		assert.Contains(t, string(files[1].Content), `"lodash"`)
 		assert.Equal(t, "tsconfig.json", files[2].Name)
 		assert.Contains(t, string(files[2].Content), `"skipLibCheck": true`)
 	})