Execute shell or JavaScript

Endpoint

POST /v1/disks/{disk}/exec

Query parameter	Default	Meaning
`kind`	`bash`	`bash` or `js`.
`script`	Absent	Source text in a URL-encoded query value. The body becomes stdin.
`path`	Absent	Virtual JS source-file path; requires `kind=js`. The body becomes stdin.

Select one source: body, script, or path. Supplying both script and path is invalid. Source is UTF-8 and at most 64 KiB with the default server limits.

Send source in the body

curl --fail-with-body --no-buffer \
  "https://api.wabe.sh/v1/disks/demo/exec?kind=bash" \
  -H "Authorization: Bearer YOUR_PROJECT_API_KEY" \
  --data-binary "printf 'Hello\n'"

curl --fail-with-body --no-buffer \
  "https://api.wabe.sh/v1/disks/demo/exec?kind=js" \
  -H "Authorization: Bearer YOUR_PROJECT_API_KEY" \
  --data-binary "print('Hello'); return {value:42};"

JS source is an async function body. The server exposes the documented runtime APIs.

Send stdin with separate source

The query contains the encoded source grep -n TODO; the body contains input data:

printf 'TODO: write docs\ndone\n' | curl --fail-with-body --no-buffer \
  "https://api.wabe.sh/v1/disks/demo/exec?kind=bash&script=grep%20-n%20TODO" \
  -H "Authorization: Bearer YOUR_PROJECT_API_KEY" \
  --data-binary @-

For a stored JS source file:

curl --fail-with-body --no-buffer \
  "https://api.wabe.sh/v1/disks/demo/exec?kind=js&path=/app.js" \
  -H "Authorization: Bearer YOUR_PROJECT_API_KEY" \
  --data-binary @./input.bin

Response

200, Content-Type: application/x-ndjson. Output chunk boundaries can vary.

{"type":"stdout","data":"SGVsbG8K"}
{"type":"result","value":{"value":42}}
{"type":"exit","code":0}

Record	Fields	Meaning
`stdout`	`data`	Standard-base64 bytes written to stdout.
`stderr`	`data`	Standard-base64 bytes written to stderr.
`result`	`value`	JSON return value from direct JS execution, on success.
`exit`	`code`	Terminal integer status. Zero means success.

Shell commands preserve their supported statuses. Command errors normally produce status 1; execution/runtime errors are reported with stderr and terminal status 2. A missing terminal record means the response is incomplete. qjs invoked through the shell prints its streams and reports its status; its return value is not a direct HTTP JS result.

Errors

Invalid query/source selection, oversized source, invalid UTF-8 and unsupported shell syntax return 400 before execution. Authentication failures return 401. Storage failures while loading a script can return 404 or 500. JS syntax errors, timeouts and failures after streaming starts appear in stderr and the exit record.

Default execution timeout is 30 seconds. Closing the response cancels the invocation. Previously published writes remain visible. Read durability and retry behavior before retrying a mutation.

Add one optional branch=NAME, commit=UUID or label=NAME to execute against that filesystem view. Direct JS and nested Bash/qjs inherit it. Historical views reject filesystem writes; KV remains disk-wide. See versioning.