@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/src/tests/quickjs-compat.test.ts

@@ -0,0 +1,213 @@
+import { describe, expect, test } from "bun:test";
+import {
+  checkQuickJSCompat,
+  type QuickJSCompatRule,
+  quickJSCompatWarnings,
+} from "../scripts-runtime/quickjs-compat";
+
+const wrap = (body: string) => `export default async (args, ctx) => {\n${body}\n};`;
+
+// One positive (flagged) and one negative (clean, but close) fixture per rule.
+const FIXTURES: Array<{ rule: QuickJSCompatRule; flagged: string; clean: string }> = [
+  {
+    rule: "bunGlobal",
+    flagged: wrap("return Bun.hash('x');"),
+    clean: wrap("const Bun = { hash: (s) => s }; return typeof globalThis.Bun;"),
+  },
+  {
+    rule: "process",
+    flagged: wrap("return process.env.HOME;"),
+    clean: wrap("const config = { process: 1 }; return config.process + args.process;"),
+  },
+  {
+    rule: "fsStdlib",
+    flagged: wrap("return ctx.stdlib.glob('*.ts');"),
+    clean: wrap("return ctx.stdlib.fetchJson('https://example.com');"),
+  },
+  {
+    rule: "require",
+    flagged: wrap("const fs = require('fs'); return fs;"),
+    clean: wrap("const require = (name) => name; return require('fs');"),
+  },
+  {
+    rule: "unsupportedGlobal",
+    flagged: wrap("return Buffer.from('aGk=', 'base64').toString();"),
+    clean: wrap("const bytes: Buffer | null = null; return { Buffer: bytes };"),
+  },
+  {
+    rule: "cryptoSubtle",
+    flagged: wrap("return crypto.subtle.digest('SHA-256', new Uint8Array());"),
+    clean: wrap("return crypto.randomUUID();"),
+  },
+  {
+    rule: "responseBody",
+    flagged: wrap("const res = await fetch('https://example.com'); return res.arrayBuffer();"),
+    clean: wrap("const res = await fetch('https://example.com'); return res.text();"),
+  },
+  {
+    rule: "localeFormat",
+    flagged: wrap("return new Date().toLocaleString('en-GB', { timeZone: 'Europe/Madrid' });"),
+    clean: wrap("return new Date().toISOString();"),
+  },
+  {
+    rule: "hostCredential",
+    flagged: wrap("return ctx.stdlib.Redacted.value(ctx.swarm.config.apiKey);"),
+    clean: wrap("return ctx.stdlib.Redacted.value(ctx.swarm.config.agentId);"),
+  },
+  {
+    rule: "privateHost",
+    flagged: wrap("return ctx.stdlib.fetchJson('http://intranet:8080/status');"),
+    clean: wrap("return ctx.stdlib.fetchJson('https://api.example.com/status');"),
+  },
+];
+
+describe("checkQuickJSCompat", () => {
+  for (const { rule, flagged, clean } of FIXTURES) {
+    test(`${rule}: flags the positive fixture`, () => {
+      const report = checkQuickJSCompat(flagged);
+      expect(report.compatible).toBe(false);
+      expect(report.findings.map((finding) => finding.rule)).toContain(rule);
+    });
+
+    test(`${rule}: passes the negative fixture`, () => {
+      expect(checkQuickJSCompat(clean)).toEqual({ compatible: true, findings: [] });
+    });
+  }
+
+  test("workspaceRw: flags the fsMode, not the source", () => {
+    const source = wrap("return 'workspace-rw';");
+    expect(checkQuickJSCompat(source, { fsMode: "workspace-rw" }).findings).toEqual([
+      { rule: "workspaceRw", message: "fsMode workspace-rw is not available under quickjs" },
+    ]);
+    expect(checkQuickJSCompat(source, { fsMode: "none" }).compatible).toBe(true);
+  });
+
+  test("fsStdlib also catches stdlib imports and destructuring", () => {
+    const imported = `import { glob } from "stdlib";\n${wrap("return glob('*');")}`;
+    const destructured = wrap("const { grep } = ctx.stdlib; return grep('x', '.');");
+    expect(checkQuickJSCompat(imported).findings[0]?.rule).toBe("fsStdlib");
+    expect(checkQuickJSCompat(destructured).findings[0]?.rule).toBe("fsStdlib");
+  });
+
+  test("globals read off globalThis count, typeof feature checks do not", () => {
+    expect(checkQuickJSCompat(wrap("return globalThis.process.env;")).findings[0]?.rule).toBe(
+      "process",
+    );
+    expect(
+      checkQuickJSCompat(wrap("return (globalThis as any).Bun.version;")).findings[0]?.rule,
+    ).toBe("bunGlobal");
+    expect(checkQuickJSCompat(wrap("return typeof process === 'undefined';")).compatible).toBe(
+      true,
+    );
+  });
+
+  test("the shimmed web globals are compatible", () => {
+    const source = wrap(`const url = new URL("/x?a=1", "https://example.com");
+url.searchParams.set("b", "2");
+const bytes = new TextEncoder().encode(url.href);
+const id = setInterval(() => {}, 10);
+clearInterval(id);
+await fetch(url, { method: "POST", body: bytes });
+return [new TextDecoder().decode(bytes), crypto.randomUUID(), crypto.getRandomValues(new Uint8Array(4))];`);
+    expect(checkQuickJSCompat(source)).toEqual({ compatible: true, findings: [] });
+  });
+
+  test("bindings resolve by lexical scope", () => {
+    // A local Buffer parameter in one function does not hide a global Buffer in another.
+    const shadowed = `function decode(Buffer: { from(x: string): string }) { return Buffer.from("x"); }
+export default async () => [decode({ from: (x) => x }), Buffer.from("aGk=", "base64").toString()];`;
+    expect(checkQuickJSCompat(shadowed).findings).toEqual([
+      { rule: "unsupportedGlobal", message: "Buffer is not available under quickjs", line: 2 },
+    ]);
+    // Block scope too, and a shorthand property reads the binding it names.
+    const block = wrap("{ const process = 1; } return { process };");
+    expect(checkQuickJSCompat(block).findings[0]?.rule).toBe("process");
+    // Every use resolves locally: clean.
+    const local = `function decode(Buffer: { from(x: string): string }) { return Buffer.from("x"); }
+export default async () => { const process = { env: {} }; return [decode({ from: (x) => x }), process.env]; };`;
+    expect(checkQuickJSCompat(local)).toEqual({ compatible: true, findings: [] });
+    // A declare-only binding defines nothing at run time, so the global still counts.
+    const ambient = `declare const Buffer: any;\n${wrap("return Buffer.from('x');")}`;
+    expect(checkQuickJSCompat(ambient).findings[0]?.rule).toBe("unsupportedGlobal");
+  });
+
+  test("atob and btoa are shimmed; AbortSignal stays reported", () => {
+    expect(checkQuickJSCompat(wrap("return atob(btoa('hi'));"))).toEqual({
+      compatible: true,
+      findings: [],
+    });
+    expect(
+      checkQuickJSCompat(
+        wrap("return fetch('https://example.com', { signal: AbortSignal.timeout(5) });"),
+      ).findings[0]?.message,
+    ).toBe("AbortSignal is not available under quickjs");
+  });
+
+  test("privateHost: literal fetch URLs to single-label or private hosts", () => {
+    const hosts = (body: string) =>
+      checkQuickJSCompat(wrap(body)).findings.filter((finding) => finding.rule === "privateHost");
+    const flagged = [
+      "fetch('http://api:3013/health')",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "fetch(`http://localhost:8080/${args.path}`)",
+      "globalThis.fetch('http://10.0.0.5/x')",
+      "ctx.stdlib.fetch('http://192.168.1.10/')",
+      "ctx.stdlib.fetchJson('http://[::1]:9000/')",
+      "ctx.stdlib.fetchJson('http://0x7f.1/')",
+      "fetch('http://[fd00::1]/')",
+      "fetch('http://[::ffff:10.1.2.3]/')",
+      "fetch('https://svc.localhost/')",
+      "const { fetchJson } = ctx.stdlib; await fetchJson('http://intranet/')",
+    ];
+    for (const call of flagged) expect(hosts(`return ${call};`)).toHaveLength(1);
+    const clean = [
+      "fetch('https://example.com/x')",
+      "fetch('https://8.8.8.8/')",
+      "fetch('http://[2001:db8::1]/')",
+      "fetch(args.url)",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "fetch(`http://${args.host}/x`)",
+      "fetch('relative/path')",
+      "ctx.api.github.fetch('http://intranet/')",
+      "console.log('http://intranet/')",
+    ];
+    for (const call of clean) expect(hosts(`return ${call};`)).toEqual([]);
+    // A const that holds the base URL fixes the host too; a let or a cut-off name does not.
+    const constBase = [
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "const API = 'http://api:3013'; return fetch(`${API}/health`);",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "const API = 'http://api:3013'; return fetch(`${API}${args.path}`);",
+      "const API = 'http://api:3013'; return ctx.stdlib.fetch(API + '/x');",
+      "const API = `http://10.1.2.3`; return fetch(API);",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "const API = 'http://api:3013'; const rows = `${API}/rows/${args.id}`; return fetch(`${rows}?limit=5`);",
+    ];
+    for (const body of constBase) expect(hosts(body)).toHaveLength(1);
+    const dynamicBase = [
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "let API = 'http://api:3013'; API = args.base; return fetch(`${API}/x`);",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "return fetch(`http://intra${args.suffix}/x`);",
+      "return fetch('http://intra' + args.suffix);",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: script source under test
+      "const API = 'https://api.example.com'; return fetch(`${API}/x`);",
+    ];
+    for (const body of dynamicBase) expect(hosts(body)).toEqual([]);
+    expect(hosts("return fetch('http://api:3013/health');")[0]?.message).toBe(
+      "fetch to api:3013 (single-label host) depends on the egress policy: quickjs refuses private hosts unless the operator allows them",
+    );
+  });
+
+  test("reports each rule and name once, with its first line", () => {
+    const report = checkQuickJSCompat(wrap("Bun.sleep(1);\nBun.sleep(2);\nreturn process.pid;"));
+    expect(report.findings).toEqual([
+      { rule: "bunGlobal", message: "Bun.* is not available under quickjs", line: 2 },
+      { rule: "process", message: "process is not available under quickjs", line: 4 },
+    ]);
+    expect(quickJSCompatWarnings(report, "actions.sync")).toEqual([
+      "actions.sync: quickjs compat (bunGlobal, line 2): Bun.* is not available under quickjs",
+      "actions.sync: quickjs compat (process, line 4): process is not available under quickjs",
+    ]);
+  });
+});

package/src/tests/rbac-engine.test.ts

@@ -107,6 +107,9 @@ const OPERATOR_OR_USER_VERBS: PermissionVerb[] = [
 
 const LEAD_OR_OPERATOR_VERBS: PermissionVerb[] = ["models.catalog.write"];
 
+// The shared API key alone: dashboard users are denied too.
+const API_KEY_OPERATOR_VERBS: PermissionVerb[] = ["models.profiles.write"];
+
 const AGENT_OR_OPERATOR_VERBS: PermissionVerb[] = ["models.harness-support.write"];
 
 const LEAD_OR_RESOURCE_OWNER_VERBS: PermissionVerb[] = [
@@ -211,6 +214,7 @@ describe("verb-group partition", () => {
       ...LEAD_OR_OPERATOR_OR_USER_VERBS,
       ...OPERATOR_OR_USER_VERBS,
       ...LEAD_OR_OPERATOR_VERBS,
+      ...API_KEY_OPERATOR_VERBS,
       ...AGENT_OR_OPERATOR_VERBS,
     ];
     expect(new Set(grouped).size).toBe(grouped.length);
@@ -325,6 +329,23 @@ describe("agent-or-operator verbs", () => {
   }
 });
 
+describe("api-key operator verbs", () => {
+  const expected: Expected = {
+    lead: false,
+    worker: false,
+    ownerWorker: false,
+    creatorWorker: false,
+    userRequester: false,
+    foreignUser: false,
+    operator: true,
+  };
+  for (const verb of API_KEY_OPERATOR_VERBS) {
+    test(`${verb}: only the operator allowed`, () => {
+      expectDecisions(verb, { kind: "none" }, expected);
+    });
+  }
+});
+
 describe("lead-or-operator verbs", () => {
   const expected: Expected = {
     lead: true,

package/src/tests/script-connections.test.ts

@@ -628,6 +628,10 @@ describe("script connections", () => {
       markMigrationApplied(database, "213_script_connections_sql.sql");
       // 215 alters swarm_config, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "215_swarm_config_export_to_env.sql");
+      // 219 rewrites task_context_snapshots, which this fixture does not create.
+      markMigrationApplied(database, "219_relabel_pi_context_compactions.sql");
+      // 220 reads agents and swarm_config, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "220_model_profiles.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/script-executor-conformance.test.ts

@@ -1,4 +1,7 @@
-import { describe, expect, test } from "bun:test";
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { classifyExit, NativeScriptExecutor } from "../scripts-runtime/executors/native";
 import { QuickJSScriptExecutor } from "../scripts-runtime/executors/quickjs";
 import type {
@@ -8,6 +11,7 @@ import type {
 } from "../scripts-runtime/executors/types";
 import { DEFAULT_SCRIPT_RESOURCES } from "../scripts-runtime/executors/types";
 import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+import { CHILD_PROCESS_TEST_BUDGET_MS } from "./test-proc";
 
 const payload = {
   system: {
@@ -132,6 +136,253 @@ conformance("fake", () => new FakeScriptExecutor(), false);
 // Worker threads and WASM, no Bun.spawn: runs even when the spawn probe fails.
 conformance("quickjs", () => new QuickJSScriptExecutor(), false);
 
+// Each probe is plain JavaScript, so the test process (Bun) can evaluate it too:
+// both executors must return exactly what Bun's own web globals return.
+const echoServer = Bun.serve({
+  port: 0,
+  async fetch(req) {
+    const bytes = new Uint8Array(await req.arrayBuffer());
+    return Response.json({
+      contentType: req.headers.get("content-type"),
+      bytes: Array.from(bytes),
+    });
+  },
+});
+afterAll(() => echoServer.stop(true));
+
+const PARITY_PROBES: Record<string, string> = {
+  URL: `async () => {
+  const cases = [
+    ["https://user:pa ss@Example.COM:443/a/./b/../c d?q=1 2&x='y'#frag ment"],
+    ["http://example.com:8080"], ["../x?y#z", "https://a.b/c/d/e"], ["//other.host/p", "https://a.b/c"],
+    ["?new", "https://a.b/c/d?q#h"], ["#h2", "https://a.b/c/d?q#h"], ["mailto:someone@example.com"],
+    ["foo://EXAMPLE.com/a/../b"], ["http://0x7f.1/"], ["http://[0:0:0:0:0:0:0:1]:80/"],
+    ["https://münchen.de/straße"], ["http://a.b/c\\\\d"], ["file:///etc/hosts"], ["http:foo", "http://a.b/c/d"],
+    ["not a url"], ["https://a.b:99999/"], ["http://exa mple.com"], ["http://256.1.1.1/"],
+  ];
+  const keys = ["href", "origin", "protocol", "username", "password", "host", "hostname", "port", "pathname", "search", "hash"];
+  const parsed = cases.map(([url, base]) => {
+    try {
+      const u = new URL(url, base);
+      return Object.fromEntries(keys.map((key) => [key, u[key]]).concat([["params", [...u.searchParams]]]));
+    } catch (error) {
+      return { error: error.name };
+    }
+  });
+  const u = new URL("https://a.b/p?x=1#h");
+  u.searchParams.append("y", "two words");
+  const linked = u.href;
+  u.search = "?z=3";
+  u.pathname = "/new path";
+  u.port = "8443";
+  u.hostname = "C.D";
+  u.hash = "";
+  return { parsed, linked, mutated: u.href, json: JSON.stringify({ u }), canParse: [URL.canParse("x"), URL.canParse("x", "https://a/")] };
+}`,
+  "URL relative state": `async () => {
+  const base = "http://a/b?q#f";
+  const cases = [
+    "http:/x", "http:/", "http:", "http:?y", "http:#g", "http:x/../y", "http:\\\\x", "http://x", "http:///x",
+    "http:/\\\\x", "https:/x", "ws:/x", "foo:/x", "file:/x",
+  ];
+  return cases.map((url) => {
+    try { return new URL(url, base).href; } catch (error) { return error.name; }
+  });
+}`,
+  "URL setters": `async () => {
+  const run = (start, key, values) => values.map((value) => {
+    const u = new URL(start);
+    u[key] = value;
+    return u.href;
+  });
+  return {
+    hostname: run("http://a.b:81/p", "hostname", [
+      "[::1]", "[::1]:90", "example.net:90", "c.d/e", "c.d?x", "user@c.d", "", "exa mple", "C.D", "[::1", "0x7f.1",
+    ]),
+    host: run("http://a.b:81/p", "host", [
+      "[::1]", "[::1]:90", "c.d:90", "c.d:", "c.d:80", "c.d:99999", "c.d:9x", "user@c.d", "user:pw@c.d:9", "", "c.d/e:1", ":90",
+      "user:pw@c.d", "c.d:1:2", "c.d:9/x:1", "c.d:080", "c.d:65536", "c.d:x", "[::1]:80",
+    ]),
+    hostNoPort: run("http://a.b/p", "host", ["c.d:80", "c.d:99999"]),
+    nonSpecialHost: run("foo://a:5/p", "host", ["", "b:1", "[::1]", "b@c", "b:", "b:99999"]),
+    nonSpecialEmptyHost: run("foo://a/p", "host", [""]),
+    nonSpecialHostname: run("foo://u@a:5/p", "hostname", ["", "b"]),
+    protocol: run("http://a.b/p", "protocol", [
+      "https", "https:", "https:foo", "https://x", "ht tps", "https!", "1http", "foo", "ws:", "HTTPS", "\\thttps",
+    ]),
+    fileProtocol: run("file:///p", "protocol", ["http"]),
+    opaqueHost: run("mailto:x@y", "host", ["z"]),
+  };
+}`,
+  URLSearchParams: `async () => {
+  const p = new URLSearchParams("?b=2&a=1&a=3&sp=a+b%20c&uni=%C3%A9&bad=%E0%A4%A");
+  p.append("x y", "ä&=+");
+  p.sort();
+  const sorted = p.toString();
+  const all = p.getAll("a");
+  p.set("a", "9");
+  p.delete("b");
+  return {
+    sorted, all, size: p.size, after: p.toString(), entries: [...p],
+    has: [p.has("a"), p.has("a", "1"), p.has("zz")],
+    fromObject: new URLSearchParams({ q: "hello world", n: 5 }).toString(),
+    fromPairs: new URLSearchParams([["k", "v"], ["k", "w"]]).toString(),
+  };
+}`,
+  "URLSearchParams live traversal": `async () => {
+  const appended = new URLSearchParams("a=1&b=2");
+  const keys = appended.keys();
+  appended.append("c", "3");
+  const keysAfterAppend = [...keys];
+
+  const deleted = new URLSearchParams("a=1&b=2&c=3");
+  const visited = [];
+  deleted.forEach((value, key) => {
+    visited.push(key + value);
+    if (key === "a") deleted.delete("c");
+  });
+
+  const grown = new URLSearchParams("x=1");
+  const grownVisits = [];
+  grown.forEach((value, key) => {
+    grownVisits.push(key);
+    if (grownVisits.length < 3) grown.append("y" + grownVisits.length, value);
+  });
+
+  const shifted = new URLSearchParams("a=1&b=2&c=3");
+  const entries = shifted.entries();
+  const first = entries.next().value;
+  shifted.delete("a");
+  const rest = [...entries];
+
+  const reset = new URLSearchParams("a=1&b=2");
+  const values = reset.values();
+  values.next();
+  reset.set("a", "9");
+  reset.sort();
+  const drained = values.next();
+  reset.append("z", "0");
+  const afterDone = values.next();
+
+  const linked = new URL("https://h/?a=1&b=2");
+  const linkedKeys = linked.searchParams.keys();
+  linked.search = "?c=3&d=4&e=5";
+  const linkedRest = [...linkedKeys];
+
+  return { keysAfterAppend, visited, grownVisits, first, rest, drained, afterDone, linkedRest };
+}`,
+  base64: `async () => {
+  const attempt = (run) => { try { return run(); } catch (error) { return error.name; } };
+  return {
+    encode: ["", "f", "fo", "foo", "foob", "fooba", "foobar", "\\u00ff\\u0000\\u0080", 123, null, undefined].map((value) => btoa(value)),
+    decode: ["", "Zg", "Zg==", "Zm8=", "Zm9v", " Zm 9v\\n", "Zm9vYg", "/+8=", "AP+A"].map((value) => atob(value)),
+    decodeBad: ["Z", "Zg=", "Zg===", "Z=g=", "Zm9v!", "Zm9v=", "===="].map((value) => attempt(() => atob(value))),
+    encodeBad: attempt(() => btoa("é👋")),
+    roundTrip: atob(btoa(String.fromCharCode(...Array.from({ length: 256 }, (_, i) => i)))).length,
+  };
+}`,
+  TextEncoder: `async () => {
+  const encoder = new TextEncoder();
+  const bytes = encoder.encode("héllo 👋 \\uD800x");
+  const decoder = new TextDecoder();
+  const wave = encoder.encode("👋é");
+  const streamed = [decoder.decode(wave.subarray(0, 2), { stream: true }), decoder.decode(wave.subarray(2, 5), { stream: true }), decoder.decode(wave.subarray(5))];
+  let fatal = "accepted";
+  try { new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array([0xc3])); } catch (error) { fatal = error.name; }
+  const target = new Uint8Array(5);
+  return {
+    bytes: Array.from(bytes),
+    roundTrip: decoder.decode(bytes),
+    replaced: decoder.decode(new Uint8Array([0x61, 0xff, 0xe2, 0x82, 0x62, 0xf0, 0x9f, 0x91])),
+    streamed, fatal,
+    bom: decoder.decode(new Uint8Array([0xef, 0xbb, 0xbf, 0x41])),
+    fromBuffer: decoder.decode(new Uint8Array([104, 105]).buffer),
+    encodeInto: [encoder.encodeInto("aé👋", target), Array.from(target)],
+  };
+}`,
+  setInterval: `async () => {
+  let ticks = 0;
+  await new Promise((resolve) => {
+    const id = setInterval((step) => {
+      ticks += step;
+      if (ticks === 3) { clearInterval(id); resolve(); }
+    }, 5, 1);
+  });
+  let crossCleared = 0;
+  const other = setInterval(() => { crossCleared++; }, 5);
+  clearTimeout(other);
+  await new Promise((resolve) => setTimeout(resolve, 40));
+  return { ticks, crossCleared };
+}`,
+  crypto: `async () => {
+  const uuids = [crypto.randomUUID(), crypto.randomUUID()];
+  const words = new Uint32Array(8);
+  const same = crypto.getRandomValues(words) === words;
+  let quota = "accepted";
+  try { crypto.getRandomValues(new Uint8Array(65537)); } catch (error) { quota = error.name; }
+  return {
+    v4: uuids.every((id) => /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(id)),
+    distinct: uuids[0] !== uuids[1],
+    same,
+    filled: words.some((word) => word !== 0),
+    quota,
+  };
+}`,
+  "fetch bodies": `async ({ base }) => {
+  const send = async (body, headers) => (await fetch(base, { method: "POST", body, headers })).json();
+  return {
+    uint8: await send(new Uint8Array([0, 1, 254, 255])),
+    view: await send(new Uint16Array([1, 2]).subarray(1)),
+    buffer: await send(new Uint8Array([7, 8, 9]).buffer, { "content-type": "application/octet-stream" }),
+    form: await send(new URLSearchParams({ a: "1 2", b: "é" })),
+    formTyped: await send(new URLSearchParams("x=1"), { "Content-Type": "text/plain" }),
+  };
+}`,
+};
+
+// Imports the probe as a module, so Bun's own globals compute the expectation.
+async function runInBun(probe: string, args: unknown): Promise<unknown> {
+  const dir = await mkdtemp(join(tmpdir(), "parity-probe-"));
+  try {
+    const file = join(dir, "probe.js");
+    await Bun.write(file, `export default ${probe};`);
+    const mod = (await import(file)) as { default: (args: unknown) => Promise<unknown> };
+    return await mod.default(args);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+describe("quickjs parity shims match native and Bun", () => {
+  const args = { base: `http://127.0.0.1:${echoServer.port}/echo` };
+  const executors: Array<[string, () => ScriptExecutor, boolean]> = [
+    ["native", () => new NativeScriptExecutor(), true],
+    ["quickjs", () => new QuickJSScriptExecutor(), false],
+  ];
+  for (const [name, probe] of Object.entries(PARITY_PROBES)) {
+    for (const [executorName, makeExecutor, spawns] of executors) {
+      // The native case spawns a bun subprocess with a 10s script budget, so
+      // the test timeout must outlast it (runbooks/testing.md hard rule 5).
+      test.skipIf(spawns && SKIP_SANDBOX_SPAWN_TESTS)(
+        `${name} (${executorName})`,
+        async () => {
+          const expected = await runInBun(probe, args);
+          const output = await makeExecutor().run(
+            input({
+              source: `export default ${probe};`,
+              args,
+              resources: { ...DEFAULT_SCRIPT_RESOURCES, memoryMb: 2048, wallClockMs: 10_000 },
+            }),
+          );
+          expect(output.error).toBeUndefined();
+          expect(output.result).toEqual(expected);
+        },
+        CHILD_PROCESS_TEST_BUDGET_MS,
+      );
+    }
+  }
+});
+
 describe("native-only executor behavior", () => {
   test.skipIf(SKIP_SANDBOX_SPAWN_TESTS)("timeout maps to timeout", async () => {
     const output = await new NativeScriptExecutor().run(

package/src/tests/script-executor-quickjs.test.ts

@@ -69,6 +69,9 @@ const server = Bun.serve({
 afterAll(() => server.stop(true));
 
 const baseUrl = `http://127.0.0.1:${server.port}`;
+// The documented binary body caps (scripts-runtime guide).
+const MAX_BINARY_BODY_BYTES = 16 * 1024 * 1024;
+const MAX_PENDING_BINARY_BODY_BYTES = 64 * 1024 * 1024;
 const executor = new QuickJSScriptExecutor();
 
 function input(source: string, overrides: Partial<ExecutorInput> = {}): ExecutorInput {
@@ -294,6 +297,35 @@ export default async (args: T) => explode(args);
     expect(output.runtimeError?.message).toContain("fetch body must be a string");
   });
 
+  // Parity with native lives in script-executor-conformance.test.ts. These
+  // are the documented limits of the shims.
+  test("shims refuse what they do not implement, with a clear error", async () => {
+    const output = await executor.run(
+      input(`export default async () => {
+  const attempt = (run) => { try { run(); return "ok"; } catch (e) { return e.name + ": " + e.message; } };
+  return {
+    latin1: attempt(() => new TextDecoder("latin1")),
+    floatRandom: attempt(() => crypto.getRandomValues(new Float64Array(2))),
+    subtle: typeof crypto.subtle,
+  };
+};`),
+    );
+    expect(output.result).toEqual({
+      latin1: 'RangeError: quickjs executor: TextDecoder supports utf-8 only, not "latin1"',
+      floatRandom: "TypeError: crypto.getRandomValues: the argument must be an integer TypedArray",
+      subtle: "undefined",
+    });
+  });
+
+  test("binary bodies reach the host through ctx.stdlib.fetch too", async () => {
+    const output = await executor.run(
+      input(
+        `export default async (_args, ctx) => (await ctx.stdlib.fetch("${baseUrl}/echo", { method: "POST", body: new TextEncoder().encode("é!") })).json();`,
+      ),
+    );
+    expect(output.result).toMatchObject({ method: "POST", body: "é!" });
+  });
+
   test("user config values stay redacted until unwrapped", async () => {
     const output = await executor.run(
       input(`export default async (_args, ctx) => {
@@ -436,6 +468,70 @@ export default async (args: T) => explode(args);
     expect(output.result).toContain("Too many pending host calls");
   });
 
+  // The sandbox controls bodyBase64, so these call the bridge directly, past
+  // the prelude's own encoding, and check that no request reaches the server.
+  const bridgeSend = `const send = async (bodyBase64: unknown) =>
+    JSON.parse(await (globalThis as any).__host_call("fetch", JSON.stringify([{ url: "${baseUrl}/sink", method: "POST", bodyBase64 }]))).error?.message ?? "sent";`;
+
+  test("rejects a malformed binary body before any fetch starts", async () => {
+    const before = requests.length;
+    const output = await executor.run(
+      input(`export default async () => {
+  ${bridgeSend}
+  return [await send(123), await send({ length: 4 }), await send("!!!!"), await send("AAA"), await send("AA=A")];
+};`),
+    );
+    expect(output.result).toEqual([
+      "fetch bodyBase64 must be a string",
+      "fetch bodyBase64 must be a string",
+      "fetch bodyBase64 is not valid base64",
+      "fetch bodyBase64 is not valid base64",
+      "fetch bodyBase64 is not valid base64",
+    ]);
+    expect(requests.length).toBe(before);
+  });
+
+  test("rejects an oversized binary body before any fetch starts", async () => {
+    const before = requests.length;
+    const encodedLimit = Math.ceil(MAX_BINARY_BODY_BYTES / 3) * 4;
+    const output = await executor.run(
+      input(`export default async () => {
+  ${bridgeSend}
+  return {
+    encoded: await send("A".repeat(${encodedLimit + 4})),
+    decoded: await send("A".repeat(${encodedLimit})),
+    atLimit: await send("A".repeat(${encodedLimit - 4}) + "AA=="),
+  };
+};`),
+    );
+    const tooLarge = `fetch binary body exceeds the ${MAX_BINARY_BODY_BYTES}-byte limit of the quickjs executor`;
+    expect(output.result).toEqual({ encoded: tooLarge, decoded: tooLarge, atLimit: "sent" });
+    // Only the body at the limit reached the server.
+    expect(requests.length).toBe(before + 1);
+  });
+
+  test("caps the binary bodies one run can have pending", async () => {
+    const before = { ...hang };
+    const encodedLimit = Math.ceil(MAX_BINARY_BODY_BYTES / 3) * 4;
+    const output = await executor.run(
+      input(
+        `export default async () => {
+  // Decodes to exactly MAX_BINARY_BODY_BYTES; four fill the per-run budget.
+  const args = JSON.stringify([{ url: "${baseUrl}/hang", method: "POST", bodyBase64: "A".repeat(${encodedLimit - 4}) + "AA==" }]);
+  const call = async () => JSON.parse(await (globalThis as any).__host_call("fetch", args)).error?.message ?? "sent";
+  const held = [call(), call(), call(), call()];
+  return call();
+};`,
+        { resources: { ...DEFAULT_SCRIPT_RESOURCES, memoryMb: 1024, wallClockMs: 10_000 } },
+      ),
+    );
+    expect(output.result).toBe(
+      `Pending fetch binary bodies in one script run exceed ${MAX_PENDING_BINARY_BODY_BYTES} bytes`,
+    );
+    expect(await waitFor(() => hang.started === before.started + 4)).toBe(true);
+    expect(await waitFor(() => hang.aborted === before.aborted + 4)).toBe(true);
+  }, 30_000);
+
   test("queues runs beyond the pool size", async () => {
     const outputs = await Promise.all(
       Array.from({ length: 12 }, (_, i) =>