NodeRuntime nodeModules does not resolve external packages in v0.3.0

Hi! We are testing [email protected] as a replacement for our current code-execution sandbox.

Simple code execution works, but we could not get external package imports working through NodeRuntime.create({ nodeModules }).

This blocks a use case that worked in our previous poc with 0.2.1, our poc was able to run user code locally on macOS and import prepared libraries. After upgrading to 0.3.0, simple execution still works on Linux x64, but external package resolution fails.

Environment

• secure-exec: 0.3.0
• Platform: Linux x64
• Node.js: v22.x
• Package manager: pnpm/npm
• Running inside Docker

Reproduction

import { NodeRuntime } from "secure-exec"

const runtime = await NodeRuntime.create({
  nodeModules: "/app/node_modules",
  permissions: {
    fs: "allow",
    env: "allow",
    network: "allow",
    childProcess: "allow",
    process: "allow",
  },
})

try {
  const result = await runtime.exec(`
    import { z } from "zod"

    console.log(z.string().parse("ok"))
  `)

  console.log(result)
} finally {
  await runtime.dispose()
}

zod is installed and available at /app/node_modules.

Actual behavior

The execution fails with:

_resolveModule returned non-string for 'zod'

We also saw the same kind of failure with relative imports:

import foo from "./foo.js"

And with createRequire:

import { createRequire } from "node:module"

const require = createRequire(import.meta.url)
const zod = require("zod")

Built-in modules worked, but external packages did not.

Expected behavior

Based on the current module loading docs, passing nodeModules should allow guest code to resolve packages from the provided host node_modules tree.

For our use case, this is required because user code can import libraries that were installed/prepared before execution.

Notes

• [email protected] worked for our previous PoC with prepared libraries.
• [email protected] works for simple code execution on Linux x64.
• The failure seems specific to package/relative module resolution through the new NodeRuntime/sidecar path.

Question

Is this expected in 0.3.0, or is package resolution through nodeModules currently broken in the published npm release?

Should we wait for a newer release/canary, or is there a different API/configuration we should use?