@markii/host 0.17.0-next.2 → 0.17.0-next.3

package/dist/node.d.ts

@@ -1,5 +1,6 @@
 export type { SpawnRunOptions } from './run/run-host.js';
-export { defaultWorkerPath, spawnRunInThread, workerThreadIsolate, } from './run/node-isolate.js';
+export type { NodeHostIsolateOptions } from './run/node-isolate.js';
+export { createNodeHostIsolate, workerThreadIsolate, } from './run/node-isolate.js';
 export { createNetProvider } from './run/net-provider.js';
 export { createNodeArchiveExtractFs, createNodeDirectoryLister, createNodeFileReader, createNodePackDiscoveryIo, createNodeReader as createNodePackScriptsReader, } from './node-fs.js';
 export { createHtmlExportEngine } from './html-engine.js';

package/dist/node.js

@@ -7,7 +7,7 @@
 // - the `@markii/html`-backed static export engine;
 //
 // A Node host imports from both entries. No browser bundle imports this one.
-export { defaultWorkerPath, spawnRunInThread, workerThreadIsolate, } from './run/node-isolate.js';
+export { createNodeHostIsolate, workerThreadIsolate, } from './run/node-isolate.js';
 export { createNetProvider } from './run/net-provider.js';
 export { createNodeArchiveExtractFs, createNodeDirectoryLister, createNodeFileReader, createNodePackDiscoveryIo, createNodeReader as createNodePackScriptsReader, } from './node-fs.js';
 export { createHtmlExportEngine } from './html-engine.js';

package/dist/packs/discover.js

@@ -131,7 +131,7 @@ async function tryLoadPackAt(folder, readFile) {
  */
 /**
  * When a `ManifestAttempt` succeeded (`kind: 'found'`) but the manifest's
- * `engine` does not match `supportedEngine` (batch 7 #46), downgrades it to
+ * `engine` does not match `supportedEngine`, downgrades it to
  * a `SkippedPackFolder` instead of a `DiscoveredPack` — same effect
  * `@markii/react`'s `loadPack` already has for an unsupported engine
  * (nothing registered for that namespace, unknown-component fallback for

package/dist/packs/pack-diagnostics.d.ts

@@ -34,7 +34,7 @@ export interface PackDiagnosticsContext {
     /**
      * One entry per validated, non-colliding pack whose declared engine
      * `@markii/react`'s `loadPack` cannot run (`./pack-render-registry.ts`'s
-     * `BuildRenderRegistryResult.droppedEngines`, batch 7 #46). Omitted (or
+     * `BuildRenderRegistryResult.droppedEngines`). Omitted (or
      * empty) contributes nothing — the ordinary case where every registered
      * pack's engine is supported.
      */
@@ -62,13 +62,11 @@ export declare function skippedPackCount(context: {
 }): number;
 /**
  * One informational line for a pack whose prebuilt `webview.js` shadows
- * component sources still present in the same folder — survey finding A9:
- * `apps/vscode/src/packs/pack-diagnostics.ts` and
- * `apps/obsidian/src/packs/pack-diagnostics.ts` each defined this exact
- * sentence shape, differing only in the tail clause naming how a user
- * would rebuild the prebuilt artifact from those sources (VS Code's own
- * Export Pack command versus, from Obsidian, VS Code's Export Pack command
- * by name, since Obsidian has no build command of its own).
+ * component sources still present in the same folder.
+ * The tail clause names how a user would rebuild the prebuilt artifact
+ * from those sources: VS Code's own Export Pack command, or, from
+ * Obsidian, VS Code's Export Pack command by name, since Obsidian has no
+ * build command of its own.
  *
  * Never a failure: shipping both the built artifact and its sources is a
  * supported distribution shape. `rebuildInstruction` is the one thing that

package/dist/packs/pack-diagnostics.js

@@ -53,7 +53,7 @@ function duplicateComposedNameLines(context) {
     const duplicates = context.duplicateComposedNames ?? [];
     return duplicates.map((duplicate) => `Pack "${duplicate.skippedPack}"'s component composed to the directive name "${duplicate.composedName}", already claimed by pack "${duplicate.keptPack}"; the later component was skipped.`);
 }
-/** One line per pack dropped because this renderer cannot run its declared engine (batch 7 #46) — `[]` when there was none. */
+/** One line per pack dropped because this renderer cannot run its declared engine — `[]` when there was none. */
 function droppedEngineLines(context) {
     const dropped = context.droppedEngines ?? [];
     return dropped.map((entry) => `Pack "${entry.name}" declares engine "${entry.engine}", which this renderer cannot run; it installed with zero components (every directive under its namespace falls back to the unknown-component box).`);
@@ -87,13 +87,11 @@ export function skippedPackCount(context) {
 }
 /**
  * One informational line for a pack whose prebuilt `webview.js` shadows
- * component sources still present in the same folder — survey finding A9:
- * `apps/vscode/src/packs/pack-diagnostics.ts` and
- * `apps/obsidian/src/packs/pack-diagnostics.ts` each defined this exact
- * sentence shape, differing only in the tail clause naming how a user
- * would rebuild the prebuilt artifact from those sources (VS Code's own
- * Export Pack command versus, from Obsidian, VS Code's Export Pack command
- * by name, since Obsidian has no build command of its own).
+ * component sources still present in the same folder.
+ * The tail clause names how a user would rebuild the prebuilt artifact
+ * from those sources: VS Code's own Export Pack command, or, from
+ * Obsidian, VS Code's Export Pack command by name, since Obsidian has no
+ * build command of its own.
  *
  * Never a failure: shipping both the built artifact and its sources is a
  * supported distribution shape. `rebuildInstruction` is the one thing that

package/dist/packs/pack-paths.js

@@ -12,8 +12,7 @@
  * host concern — reading the setting itself, and naming what "relative"
  * means in a diagnostic message, stays in each host's own app code.
  *
- * DECISION (per orchestrator direction, carried over from the original VS
- * Code module this was hoisted from): a relative entry is resolved against
+ * DECISION: a relative entry is resolved against
  * `baseDir` as given by the caller; an absolute entry is used as-is. This
  * matches how a user reads the setting's own description: "this pack
  * folder, relative to my project/vault".

package/dist/packs/pack-render-registry.d.ts

@@ -1,21 +1,20 @@
 import type { PackManifest } from '@markii/pack';
-import type { Registry, RegistryEntry } from '@markii/react';
 /**
  * The renderer-specific half of building a pack-aware registry: the
  * renderer's own `loadPack`, `createRegistry` and `mergeRegistries`. A
  * React host passes `@markii/react`'s `reactPackEngine`; the host layer
  * itself names no renderer.
  */
-export interface PackRegistryEngine {
-    loadPack(manifest: PackManifest, componentModules: Record<string, RegistryEntry>): {
-        registry: Registry;
+export interface PackRegistryEngine<TRegistry extends object = object, TEntry = unknown> {
+    loadPack(manifest: PackManifest, componentModules: Record<string, TEntry>): {
+        registry: TRegistry;
         dropped?: {
             name: string;
             engine: string;
         };
     };
-    createRegistry(entries?: Record<string, RegistryEntry>): Registry;
-    mergeRegistries(...registries: Registry[]): Registry;
+    createRegistry(entries?: Record<string, TEntry>): TRegistry;
+    mergeRegistries(...registries: TRegistry[]): TRegistry;
 }
 /** One registration a compiled pack script queued by calling `window.__markiiRegisterPack(manifestJson, componentModules)` (see `./pack-build.ts`'s top doc comment for the full registration convention). Structurally identical across every host that satisfies the convention. */
 export interface QueuedPackRegistration {
@@ -42,8 +41,8 @@ export interface DuplicateComposedName {
     readonly skippedPack: string;
 }
 /** What `buildRenderRegistry` reports alongside the merged registry — developer-facing diagnostics for a caller to fold into its own surface, never shown as page content. */
-export interface BuildRenderRegistryResult {
-    readonly registry: Registry;
+export interface BuildRenderRegistryResult<TRegistry extends object = object> {
+    readonly registry: TRegistry;
     /** One line per malformed registration, dropped rather than installed. */
     readonly invalidReasons: readonly string[];
     /** Non-empty only when two or more validated registrations shared a namespace — the WHOLE install was then rejected (docs/packs.md's install-time rejection rule) and `registry` falls back to `defaultRegistry` alone. */
@@ -52,7 +51,7 @@ export interface BuildRenderRegistryResult {
     readonly duplicateComposedNames: readonly DuplicateComposedName[];
     /**
      * One entry per validated, non-colliding pack whose manifest declares an
-     * engine `@markii/react`'s `loadPack` cannot run (batch 7 #46). Before
+     * engine `@markii/react`'s `loadPack` cannot run. Before
      * this field existed, such a pack installed as an empty contribution
      * with no record anywhere that it had even been attempted — every
      * directive under its namespace fell through to the ordinary
@@ -80,4 +79,4 @@ export interface BuildRenderRegistryResult {
  *   (see `DuplicateComposedName`) drops only the later claimant's
  *   component, not the whole pack.
  */
-export declare function buildRenderRegistry(queued: readonly QueuedPackRegistration[], defaultRegistry: Registry, engine: PackRegistryEngine): BuildRenderRegistryResult;
+export declare function buildRenderRegistry<TRegistry extends object, TEntry>(queued: readonly QueuedPackRegistration[], defaultRegistry: TRegistry, engine: PackRegistryEngine<TRegistry, TEntry>): BuildRenderRegistryResult<TRegistry>;

package/dist/run/browser-isolate.d.ts

@@ -13,10 +13,10 @@
  * there is no `__dirname` inside a worker to find it beside the bundle.
  *
  * Network is served by the HOST, not the worker: `serveNetRequests` wires
- * every `markii:net-request` to the caller's own `NetProvider`, which is
- * the same pinned one a worker-thread isolate runs. The isolate has no
- * network stack of its own, so the allowlist cannot be bypassed from
- * inside it.
+ * every `markii:net-request` to the caller's own `NetProvider`. Lua cannot
+ * reach JavaScript, and the worker entry removes its own network globals
+ * before the first script runs (`./worker-entry-browser.ts`), so the
+ * provider's allowlist is the only path to the network.
  *
  * What this CANNOT do, stated plainly because it is a real difference: a
  * Web Worker takes no `maxOldGenerationSizeMb`, so `options`'s heap cap is
@@ -37,7 +37,7 @@ export interface BrowserIsolateOptions {
     /** Creates the worker. Injected so a test never needs a real one, and so a host can decide how it mints the URL. */
     createWorker: (entryPath: string) => WorkerLike;
     /** The host's own pinned provider. Every `net.*` call the script makes is answered by this, in the host, never in the isolate. */
-    netProvider: (netAllowlist: string[], maxFetchBytes: number, netPolicy: unknown) => NetProvider;
+    netProvider: (netAllowlist: string[], maxFetchBytes: number, netPolicy: unknown, signal?: AbortSignal) => NetProvider;
     /** Where the worker should fetch wasmoon's `glue.wasm`; sent along with the job. */
     wasmUri?: string;
 }

package/dist/run/browser-isolate.js

@@ -19,6 +19,9 @@ export function createBrowserIsolate(options) {
         const worker = options.createWorker(spawn.entryPath);
         let provider;
         let alive = true;
+        // Aborted by `kill()`: a request still in flight when the run ends is
+        // cancelled rather than left running in the host.
+        const requests = new AbortController();
         const messageListeners = [];
         const errorListeners = [];
         worker.addEventListener('message', (event) => {
@@ -52,7 +55,7 @@ export function createBrowserIsolate(options) {
         return {
             send: (job) => {
                 const { allowlist, maxFetchBytes, policy } = netArgsFrom(job);
-                provider = options.netProvider(allowlist, maxFetchBytes, policy);
+                provider = options.netProvider(allowlist, maxFetchBytes, policy, requests.signal);
                 worker.postMessage({
                     ...job,
                     ...(options.wasmUri !== undefined
@@ -64,6 +67,7 @@ export function createBrowserIsolate(options) {
                 if (!alive)
                     return;
                 alive = false;
+                requests.abort();
                 worker.terminate();
             },
             onMessage: (listener) => {

package/dist/run/isolate.d.ts

@@ -46,10 +46,12 @@ export interface RunIsolate {
     onExit(listener: (code: number | null) => void): void;
 }
 export interface SpawnIsolateOptions {
-    /** The entry the isolate loads — resolved by the host, never guessed here (see `./run-host.ts`'s `defaultWorkerPath`). */
+    /** The entry the isolate loads — resolved by the host, never guessed here (`createNodeHostIsolate` supplies the packaged one). */
     entryPath: string;
     /** Node `execArgv` for a worker-thread isolate; meaningless to a Web Worker, which ignores it. */
     execArgv?: string[];
+    /** Environment for a worker-thread isolate; a Web Worker ignores it. */
+    env?: Record<string, string | undefined>;
     /** V8 old-space cap in MB. A worker thread honors it; a Web Worker cannot, and says so in its own doc comment. */
     maxOldGenerationSizeMb: number;
 }

package/dist/run/net-bridge.d.ts

@@ -8,11 +8,11 @@
  * host to perform it, and the host, which still has Node, runs exactly the
  * same `createNetProvider` the worker-thread isolate always used.
  *
- * This is a security improvement, not a compromise. The allowlist and the
- * pinning policy now live somewhere the sandboxed code cannot reach at
- * all: an isolate with no network stack has nothing to bypass them with.
- * What the worker can do is ask, and every ask is answered by the host's
- * own provider, against the host's own allowlist.
+ * The allowlist and the pinning policy live somewhere the sandboxed code
+ * cannot reach: Lua has no path to JavaScript, and the worker entry removes
+ * its network globals after startup (`./worker-entry-browser.ts`). What the
+ * worker can do is ask, and every ask is answered by the host's own
+ * provider, against the host's own allowlist.
  *
  * This file is the protocol and the HOST half. The worker half lives in
  * `./net-bridge-worker.ts` because it needs `@markii/lua`'s denial brand,

package/dist/run/net-provider.d.ts

@@ -59,7 +59,9 @@ export declare function createNetProvider(allowlist: readonly string[], maxFetch
  * host marks every refusal on the wire (`./net-bridge.ts`'s `denied`
  * flag) and the worker rebuilds a properly branded error on arrival.
  */
-denial: (message: string) => Error, lookup?: HostLookup): NetProvider;
+denial: (message: string) => Error, lookup?: HostLookup, 
+/** Aborted when the run ends: an in-flight request is destroyed and no further hop is made. */
+signal?: AbortSignal): NetProvider;
 /**
  * An in-memory `CacheProvider` (`@markii/lua`) seeded from `snapshot` at
  * construction and readable back out afterward via `.snapshot()` — the

package/dist/run/net-provider.js

@@ -14,9 +14,9 @@
  * import from `@markii/lua` — the brand that marks a policy refusal — is
  * injected as `denial` instead. Types are `import type` and erase.
  *
- * The security properties are unchanged by the move, and one improves: an
- * isolate that has no network stack cannot bypass the allowlist enforced
- * here, because it has nothing to bypass it with.
+ * A Web Worker isolate asks this provider through the net bridge. The
+ * worker entry removes its own network globals after startup, so the
+ * allowlist enforced here is the only path to the network.
  */
 import * as http from 'node:http';
 import * as https from 'node:https';
@@ -80,7 +80,7 @@ function bareHostname(hostname) {
  */
 function issueRequest(url, method, body, pinned, maxFetchBytes, 
 /** See `createNetProvider`'s own `denial` parameter — injected for the same reason. */
-denial) {
+denial, signal) {
     return new Promise((resolve, reject) => {
         const mod = url.protocol === 'https:' ? https : http;
         const bodyBuffer = body !== undefined ? Buffer.from(body, 'utf8') : undefined;
@@ -163,6 +163,16 @@ denial) {
         req.on('error', (err) => {
             settleReject(denial(`request failed: ${describeThrown(err)}`));
         });
+        if (signal !== undefined) {
+            const onAbort = () => {
+                req.destroy();
+                settleReject(denial('the run has ended'));
+            };
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
         if (bodyBuffer)
             req.write(bodyBuffer);
         req.end();
@@ -227,7 +237,9 @@ export function createNetProvider(allowlist, maxFetchBytes, policy,
  * host marks every refusal on the wire (`./net-bridge.ts`'s `denied`
  * flag) and the worker rebuilds a properly branded error on arrival.
  */
-denial, lookup = defaultHostLookup) {
+denial, lookup = defaultHostLookup, 
+/** Aborted when the run ends: an in-flight request is destroyed and no further hop is made. */
+signal) {
     const allowed = new Set(allowlist.map((host) => host.toLowerCase()));
     async function fetchAllowed(startUrl, method, body) {
         let currentUrl = startUrl;
@@ -246,6 +258,8 @@ denial, lookup = defaultHostLookup) {
             if (parsed.username !== '' || parsed.password !== '') {
                 throw denial(`URL "${currentUrl}" embeds credentials, which is not allowed`);
             }
+            if (signal?.aborted)
+                throw denial('the run has ended');
             const host = parsed.hostname.toLowerCase();
             if (!allowed.has(host)) {
                 throw denial(`host "${host}" is not on the run's allowlist`);
@@ -256,7 +270,7 @@ denial, lookup = defaultHostLookup) {
             if (!pinResult.ok) {
                 throw denial(pinResult.reason);
             }
-            const response = await issueRequest(parsed, method, body, pinResult.pinned, maxFetchBytes, denial);
+            const response = await issueRequest(parsed, method, body, pinResult.pinned, maxFetchBytes, denial, signal);
             if (response.status >= 300 && response.status < 400) {
                 if (!response.location) {
                     throw denial('redirect response carried no Location header');

package/dist/run/node-isolate.d.ts

@@ -1,30 +1,22 @@
+import type { HostIsolate } from '../host/adapter.js';
 import type { IsolateSpawner } from './isolate.js';
-import type { SpawnRunOptions } from './run-host.js';
-import type { RunResult } from './worker-entry.js';
-/**
- * The ONLY fallback this shared package supplies for an unset `workerPath`:
- * the sibling `worker-entry.ts`, run straight from source via `tsx`
- * (`TSX_DEV_EXEC_ARGV`, above). That is correct for this package's own
- * dev/Vitest runs — `__dirname` at that point is this real source
- * directory — but it says nothing about where a packaged host's bundled
- * worker lives, because this package does not know that host's `dist/`
- * layout. A packaged host (e.g. `apps/vscode`) MUST resolve its own bundled
- * worker path itself and pass it as `SpawnRunOptions.workerPath`; see
- * `apps/vscode/src/worker-path.ts` for that host's resolution and
- * `apps/vscode/esbuild.config.mjs`'s worker build for where it bundles to.
- */
-export declare function defaultWorkerPath(): string;
 /**
  * The default isolate: a `node:worker_threads` worker, which is what every
- * Node host (the VS Code extension host, this package's own tests) uses. It
- * is the only kind that accepts `resourceLimits`, so it is also the only
+ * Node host uses. It is the only kind that accepts `resourceLimits`, so it is also the only
  * kind whose V8 heap is bounded — see `./isolate.ts` for why a host might
  * still have to supply the other one.
  */
 export declare const workerThreadIsolate: IsolateSpawner;
+export interface NodeHostIsolateOptions {
+    /** The worker entry on disk. Defaults to `node-worker.js` in the package's `dist/`. */
+    workerPath?: string;
+}
 /**
- * `spawnRun` with the Node defaults filled in: the worker-thread isolate and
- * the dev/Vitest worker entry. For this package's own tests and any Node
- * caller that wants them; a packaged host passes its own `workerPath`.
+ * A `HostIsolate` of kind `node`: each run starts a `worker_threads` worker
+ * from the packaged, self-contained `node-worker.js`. A host that bundles
+ * the worker itself passes its own `workerPath`. The default is resolved
+ * when a run asks for it, so constructing the isolate never throws.
  */
-export declare function spawnRunInThread(options: Omit<SpawnRunOptions, 'spawnIsolate' | 'workerPath'> & Partial<Pick<SpawnRunOptions, 'spawnIsolate' | 'workerPath'>>): Promise<RunResult>;
+export declare function createNodeHostIsolate(options?: NodeHostIsolateOptions): Extract<HostIsolate, {
+    kind: 'node';
+}>;

package/dist/run/node-isolate.js

@@ -1,81 +1,23 @@
 /**
  * The Node half of the Run path's isolate seam: a `node:worker_threads`
- * worker, plus the dev/Vitest worker-entry fallback. Split out of
- * `./run-host.ts` so the watchdog, the exactly-once settlement and the
- * never-rejects contract stay in a module with no `node:*` import and run
- * unchanged for every host kind. Reached only through `@markii/host/node`.
+ * worker. Split out of `./run-host.ts` so the watchdog, the exactly-once
+ * settlement and the never-rejects contract stay in a module with no
+ * `node:*` import and run unchanged for every host kind. Reached only
+ * through `@markii/host/node`.
  */
 import { Worker } from 'node:worker_threads';
 import { existsSync } from 'node:fs';
-import * as path from 'node:path';
-import { spawnRun } from './run-host.js';
-/** `execArgv` needed to run a `.ts` worker entry directly (dev/Vitest only) — see `./worker-entry.ts`'s doc comment on why a plain `node` `.ts` import can't resolve this repo's `@markii/*` bare specifiers or its `./foo.js` -> `./foo.ts` import convention on its own. `--require tsx/cjs` (rather than `tsx/esm`) is deliberate: empirically, the ESM loader hook deadlocks Node's CJS/ESM interop translator for a worker thread requiring `.js`-suffixed relative imports that resolve to `.ts` files (this repo's convention throughout `@markii/*`), while the CJS `require` hook has no such issue. */
-const TSX_DEV_EXEC_ARGV = ['--require', 'tsx/cjs'];
-/**
- * The ONLY fallback this shared package supplies for an unset `workerPath`:
- * the sibling `worker-entry.ts`, run straight from source via `tsx`
- * (`TSX_DEV_EXEC_ARGV`, above). That is correct for this package's own
- * dev/Vitest runs — `__dirname` at that point is this real source
- * directory — but it says nothing about where a packaged host's bundled
- * worker lives, because this package does not know that host's `dist/`
- * layout. A packaged host (e.g. `apps/vscode`) MUST resolve its own bundled
- * worker path itself and pass it as `SpawnRunOptions.workerPath`; see
- * `apps/vscode/src/worker-path.ts` for that host's resolution and
- * `apps/vscode/esbuild.config.mjs`'s worker build for where it bundles to.
- */
-export function defaultWorkerPath() {
-    // The built package is ESM, where `__dirname` does not exist: a packaged
-    // host always passes its own bundled worker, so say so instead of
-    // throwing a ReferenceError.
-    const devSource = typeof __dirname === 'undefined'
-        ? undefined
-        : path.join(__dirname, 'worker-entry.ts');
-    if (devSource !== undefined && existsSync(devSource))
-        return devSource;
-    throw new Error('spawnRun: could not resolve the worker entry file (looked for ' +
-        `${devSource ?? 'worker-entry.ts beside the package source'}) — pass workerPath explicitly`);
-}
-function execArgvFor(workerPath) {
-    return workerPath.endsWith('.ts') ? TSX_DEV_EXEC_ARGV : undefined;
-}
-/**
- * Dev/Vitest only: point `tsx` at the repo's `tsconfig.dev.json` so a
- * `.ts` worker entry resolves `@markii/*` to each package's SOURCE.
- *
- * Without this the worker is a plain Node resolution: a bare `@markii/lua`
- * goes through `node_modules` to that package's `exports`, which name the
- * built `dist/`. `npm run build` only type-checks (`tsc --noEmit`); the
- * emitting script is `build:dist`, which runs at release. So `dist/` is
- * whatever a past release left behind, and a real-isolate probe would
- * silently exercise that stale code instead of the source it is written to
- * test. A capability added since the last `build:dist` simply would not
- * exist inside the worker.
- *
- * Gated on a `.ts` entry, the same signal `execArgvFor` already uses for
- * the tsx hook, so a packaged host passing its own bundled `.js` worker is
- * never touched by this.
- */
-function devTsconfigEnv(entryPath) {
-    if (!entryPath.endsWith('.ts') || typeof __dirname === 'undefined') {
-        return undefined;
-    }
-    const tsconfig = path.resolve(__dirname, '../../../..', 'tsconfig.dev.json');
-    if (!existsSync(tsconfig))
-        return undefined;
-    return { env: { ...process.env, TSX_TSCONFIG_PATH: tsconfig } };
-}
+import { fileURLToPath } from 'node:url';
 /**
  * The default isolate: a `node:worker_threads` worker, which is what every
- * Node host (the VS Code extension host, this package's own tests) uses. It
- * is the only kind that accepts `resourceLimits`, so it is also the only
+ * Node host uses. It is the only kind that accepts `resourceLimits`, so it is also the only
  * kind whose V8 heap is bounded — see `./isolate.ts` for why a host might
  * still have to supply the other one.
  */
 export const workerThreadIsolate = (options) => {
-    const execArgv = options.execArgv ?? execArgvFor(options.entryPath);
     const worker = new Worker(options.entryPath, {
-        ...(execArgv ? { execArgv } : {}),
-        ...(devTsconfigEnv(options.entryPath) ?? {}),
+        ...(options.execArgv ? { execArgv: options.execArgv } : {}),
+        ...(options.env ? { env: options.env } : {}),
         resourceLimits: {
             maxOldGenerationSizeMb: options.maxOldGenerationSizeMb,
         },
@@ -88,11 +30,11 @@ export const workerThreadIsolate = (options) => {
             void worker.terminate();
         },
         onMessage: (listener) => {
-            // `on`, not `once`: a run now sends one progress message per script
-            // (GitHub issue #35) ahead of its single result message, and
-            // `spawnRun` is what tells the two apart. Messages arriving after
-            // the run settles are harmless — `settled` guards every path — and
-            // the worker is terminated on settle anyway.
+            // `on`, not `once`: a run sends one progress message per script
+            // ahead of its single result message, and `spawnRun` tells the two
+            // apart. Messages arriving after the run settles are harmless
+            // (`settled` guards every path) and the worker is terminated on
+            // settle anyway.
             worker.on('message', listener);
         },
         onError: (listener) => {
@@ -104,14 +46,23 @@ export const workerThreadIsolate = (options) => {
     };
 };
 /**
- * `spawnRun` with the Node defaults filled in: the worker-thread isolate and
- * the dev/Vitest worker entry. For this package's own tests and any Node
- * caller that wants them; a packaged host passes its own `workerPath`.
+ * A `HostIsolate` of kind `node`: each run starts a `worker_threads` worker
+ * from the packaged, self-contained `node-worker.js`. A host that bundles
+ * the worker itself passes its own `workerPath`. The default is resolved
+ * when a run asks for it, so constructing the isolate never throws.
  */
-export function spawnRunInThread(options) {
-    return spawnRun({
-        ...options,
-        workerPath: options.workerPath ?? defaultWorkerPath(),
-        spawnIsolate: options.spawnIsolate ?? workerThreadIsolate,
-    });
+export function createNodeHostIsolate(options = {}) {
+    return {
+        kind: 'node',
+        workerPath: () => {
+            if (options.workerPath !== undefined)
+                return options.workerPath;
+            const packaged = fileURLToPath(new URL('../node-worker.js', import.meta.url));
+            if (!existsSync(packaged)) {
+                throw new Error(`the packaged worker was not found at ${packaged}: pass workerPath`);
+            }
+            return packaged;
+        },
+        spawnIsolate: workerThreadIsolate,
+    };
 }

package/dist/run/run-flow.d.ts

@@ -163,8 +163,7 @@ export interface RunOnceResult {
     /**
      * Consent unification (SECURITY-RELEVANT): lines describing any mismatch
      * between what is DECLARED (a bundle manifest's `permissions.net`, and/or
-     * an individual script's own `permissions` fence attribute — batch 7
-     * #47) and the hosts this run's scripts actually reach, from
+     * an individual script's own `permissions` fence attribute) and the hosts this run's scripts actually reach, from
      * `./bundle-run.ts`'s `netDeclarationDiagnostics`. `[]` when there is
      * nothing to compare against (no bundle manifest and no script declares
      * `permissions`) or every declared host agrees with the scan. For the

package/dist/run/run-host.d.ts

@@ -85,9 +85,9 @@ export interface SpawnRunOptions {
     /**
      * The entry the isolate loads. This package cannot know how a given host
      * bundles or lays out its own `dist/` (see e.g.
-     * `apps/vscode/src/worker-path.ts`), so the host always passes it. The
-     * Node-only dev/Vitest fallback lives in `@markii/host/node`
-     * (`defaultWorkerPath`).
+     * `apps/vscode/src/worker-path.ts`), so the host always passes it.
+     * `createNodeHostIsolate` from `@markii/host/node` supplies the packaged
+     * worker's path.
      */
     workerPath: string;
 }

package/dist/run/worker-entry-browser.d.ts

@@ -10,10 +10,11 @@
  * the failure classification cannot drift between hosts. This file supplies
  * only the two things a Web Worker has to do differently:
  *
- *   1. Network goes through `./net-bridge.ts` to the host, which still has
- *      Node and runs the same pinned provider as before. The isolate itself
- *      has no network stack, which makes the allowlist unbypassable from
- *      inside it.
+ *   1. Network goes through `./net-bridge.ts` to the host, which runs the
+ *      same pinned provider as before. A Web Worker does have network
+ *      globals, so `lockdownWorkerGlobals` (below) removes them before any
+ *      script runs. Lua cannot reach JavaScript at all; the removal is a
+ *      second wall for the case where an interpreter escape does.
  *   2. wasmoon's `glue.wasm` arrives as a URL on the job, because there is
  *      no `__dirname` here to find it beside the bundle.
  *
@@ -29,6 +30,25 @@ interface WorkerGlobal {
         data: unknown;
     }) => void) => void;
 }
+/**
+ * Removes the worker's own ways to reach a network, once, before the first
+ * script runs.
+ *
+ * - Every name in `REMOVED_GLOBALS` (the connection and storage
+ *   constructors, and `Worker`, which would start an unlocked scope) is
+ *   shadowed with `undefined`.
+ * - `importScripts` becomes a function that throws. It stays a function
+ *   because the Lua engine's start-up detects a worker by
+ *   `typeof importScripts`.
+ * - `fetch` keeps working for exactly one URL, the `glue.wasm` the job
+ *   named, because the engine loads its WebAssembly through it for every
+ *   script. Any other URL is refused.
+ *
+ * Net traffic is unaffected: it goes to the host with `postMessage`.
+ * Idempotent. Covered by `worker-entry-browser.test.ts` and, in a real
+ * browser, by the e2e suite.
+ */
+export declare function lockdownWorkerGlobals(scope: object, wasmUri: string | undefined): void;
 /**
  * A job for this entry additionally carries where `glue.wasm` can be
  * fetched from — a blob URL the host minted from the file on disk. Absent,