ijfw-compute

Compute over read. When data is large or repetitive, run a sandboxed script and surface only the result. The four trees below decide which lever to pull. ## Compute tree -- run a sandboxed script Use when the input is bigger than the answer: log files, CSV/JSON dumps, file-tree walks, repeated string transforms, aggregate stats, deduping. Call `ijfw_run compute:python "<script>"` for pandas / numpy / stdlib parsing. Call `ijfw_run compute:js "<script>"` for JSON shape-checks, regex sweeps, quick numeric work. Sandbox is allowlist filesystem (cwd + project root) + best-effort OS-level network deny; opt-in with `IJFW_COMPUTE_NET=1` if the script needs egress. Default timeout 30s, hard cap 300s via `IJFW_COMPUTE_TIMEOUT_MS`. Output cap 100MB; overflow lands in the on-disk log. Example: a 40MB nginx log. Instead of reading 200k lines into context, run `ijfw_run compute:python "import collections,sys;c=collections.Counter();[c.update([l.split()[8]]) for l in open('access.log')];print(c.most_common(10))"` and surface the top-10 status-code summary. ## Read tree -- skip compute, just read Use when the file is small (<2k lines), the task is a code edit or config tweak, or the agent needs to reason about structure rather than aggregate content. Direct Read is cheaper than spinning a subprocess; compute has fixed startup overhead. Example: editing a single function in `mcp-server/src/server.js`. Read the file, edit it, move on. No compute call needed. ## Index tree -- write find...