@hoardodile/host 0.0.0

package/src/sandbox/fixtures/hostile-plugin.mjs

@@ -0,0 +1,13 @@
+// Hostile fixture: static `node:` imports must be denied by the module
+// policy gate before the bundle ever runs — load yields a failing plugin.
+
+import { execSync } from "node:child_process"
+import { readFileSync } from "node:fs"
+
+export default {
+	detect: async () => {
+		readFileSync("C:/outside.txt")
+		execSync("whoami")
+		return { ok: true }
+	},
+}

package/src/sandbox/fixtures/huge-result-plugin.mjs

@@ -0,0 +1,8 @@
+// Well-behaved fixture: detect returns a huge buffer to prove the
+// per-hook result cap turns oversized payloads into hook errors instead of
+// cloning them into the host.
+export default {
+	detect: async () => {
+		return new Uint8Array(64 * 1024)
+	},
+}

package/src/sandbox/fixtures/logging-plugin.mjs

@@ -0,0 +1,9 @@
+/** Fixture: emits one log line per level so the host-side sink is observable. */
+export default {
+	async detect(api) {
+		api.logInfo("hello", { i: 1 })
+		api.logWarn("careful")
+		api.logError("bad news")
+		return { ok: true }
+	},
+}

package/src/sandbox/fixtures/range-plugin.mjs

@@ -0,0 +1,9 @@
+// Fixture plugin that reads a byte range — asserts the range argument
+// crosses the sandbox RPC boundary intact.
+export default {
+	detect: async () => ({ ok: true }),
+	sourceMeta: async (api) => {
+		const bytes = await api.readFile("blob.bin", { start: 1, end: 4 })
+		return { bytes: Array.from(bytes) }
+	},
+}

package/src/sandbox/fixtures/slow-api-plugin.mjs

@@ -0,0 +1,11 @@
+/**
+ * Fixture: detect() awaits a single host-side API call. Paired with a slow
+ * host readFile stub and a short watchdog, it proves the watchdog tolerates
+ * host work that outlasts the activity window.
+ */
+export default {
+	async detect(api) {
+		const bytes = await api.readFile("big.bin")
+		return { ok: bytes.length > 0 }
+	},
+}

package/src/sandbox/fixtures/spin-plugin.mjs

@@ -0,0 +1,9 @@
+// Fixture plugin with a synchronous infinite loop: never yields to the event
+// loop and never calls the API — the watchdog must kill it.
+export default {
+	detect: async () => {
+		for (;;) {
+			// spin
+		}
+	},
+}

package/src/sandbox/fixtures/stuck-plugin.mjs

@@ -0,0 +1,12 @@
+// Fixture plugin that keeps logging (watchdog activity) but never returns —
+// only the hard timeout can stop it.
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+
+export default {
+	detect: async (api) => {
+		for (;;) {
+			api.logInfo("still alive")
+			await sleep(50)
+		}
+	},
+}

package/src/sandbox/fixtures/thrower-plugin.mjs

@@ -0,0 +1,7 @@
+// Fixture plugin that throws inside a hook — the error must cross the
+// boundary with its message intact.
+export default {
+	detect: async () => {
+		throw new Error("hook exploded")
+	},
+}