@markii/host 0.17.0-next.2 → 0.17.0-next.3

package/dist/run/worker-entry-browser.js

@@ -10,10 +10,11 @@
  * the failure classification cannot drift between hosts. This file supplies
  * only the two things a Web Worker has to do differently:
  *
- *   1. Network goes through `./net-bridge.ts` to the host, which still has
- *      Node and runs the same pinned provider as before. The isolate itself
- *      has no network stack, which makes the allowlist unbypassable from
- *      inside it.
+ *   1. Network goes through `./net-bridge.ts` to the host, which runs the
+ *      same pinned provider as before. A Web Worker does have network
+ *      globals, so `lockdownWorkerGlobals` (below) removes them before any
+ *      script runs. Lua cannot reach JavaScript at all; the removal is a
+ *      second wall for the case where an interpreter escape does.
  *   2. wasmoon's `glue.wasm` arrives as a URL on the job, because there is
  *      no `__dirname` here to find it beside the bundle.
  *
@@ -23,6 +24,99 @@
  */
 import { isRunJob, resultForInternalError, runJob, } from './run-job.js';
 import { createNetBridge } from './net-bridge-worker.js';
+/**
+ * Globals through which a worker can open a connection or keep state outside
+ * the run. `fetch` and `importScripts` are handled separately because the
+ * Lua engine's start-up needs them (see `lockdownWorkerGlobals`).
+ */
+const REMOVED_GLOBALS = [
+    'XMLHttpRequest',
+    'WebSocket',
+    'EventSource',
+    'indexedDB',
+    'caches',
+    'BroadcastChannel',
+    // A nested worker would start with a fresh, unlocked global scope.
+    'Worker',
+    'SharedWorker',
+    'WebTransport',
+    'WebSocketStream',
+];
+/** Reads the URL out of a `fetch` argument without assuming DOM types. */
+function requestUrl(input, base) {
+    try {
+        if (typeof input === 'string')
+            return new URL(input, base).href;
+        if (input instanceof URL)
+            return input.href;
+        const url = input?.url;
+        if (typeof url === 'string')
+            return new URL(url, base).href;
+    }
+    catch {
+        // an unparseable URL is not the allowed one
+    }
+    return undefined;
+}
+/**
+ * Removes the worker's own ways to reach a network, once, before the first
+ * script runs.
+ *
+ * - Every name in `REMOVED_GLOBALS` (the connection and storage
+ *   constructors, and `Worker`, which would start an unlocked scope) is
+ *   shadowed with `undefined`.
+ * - `importScripts` becomes a function that throws. It stays a function
+ *   because the Lua engine's start-up detects a worker by
+ *   `typeof importScripts`.
+ * - `fetch` keeps working for exactly one URL, the `glue.wasm` the job
+ *   named, because the engine loads its WebAssembly through it for every
+ *   script. Any other URL is refused.
+ *
+ * Net traffic is unaffected: it goes to the host with `postMessage`.
+ * Idempotent. Covered by `worker-entry-browser.test.ts` and, in a real
+ * browser, by the e2e suite.
+ */
+export function lockdownWorkerGlobals(scope, wasmUri) {
+    const target = scope;
+    if (target.__markiiLocked)
+        return;
+    const base = target.location?.href ?? 'http://localhost/';
+    const allowed = wasmUri === undefined ? undefined : requestUrl(wasmUri, base);
+    const realFetch = target.fetch;
+    const shadow = (name, value) => {
+        try {
+            Object.defineProperty(scope, name, {
+                value,
+                configurable: false,
+                writable: false,
+            });
+        }
+        catch {
+            // A non-configurable property cannot be shadowed; assign instead.
+            try {
+                target[name] = value;
+            }
+            catch {
+                // nothing more can be done for this name
+            }
+        }
+    };
+    for (const name of REMOVED_GLOBALS)
+        shadow(name, undefined);
+    shadow('importScripts', () => {
+        throw new Error('importScripts is not available in the run isolate');
+    });
+    if (typeof realFetch === 'function') {
+        shadow('fetch', (input, init) => {
+            const url = requestUrl(input, base);
+            if (allowed !== undefined && url === allowed) {
+                return realFetch.call(scope, input, init);
+            }
+            return Promise.reject(new TypeError('network access is not available in the run isolate'));
+        });
+    }
+    Object.defineProperty(scope, '__markiiLocked', { value: true });
+}
 function start(scope) {
     const bridge = createNetBridge((message) => {
         scope.postMessage(message);
@@ -47,6 +141,7 @@ function start(scope) {
                 return;
             }
             const job = message;
+            lockdownWorkerGlobals(scope, job.wasmUri);
             let result;
             try {
                 result = await runJob(job, {

package/dist/run/worker-entry.js

@@ -53,6 +53,8 @@ import { isRunJob, resultForInternalError, runJob } from './run-job.js';
  * pass here.
  */
 function resolveWasmUri() {
+    if (typeof __dirname === 'undefined')
+        return undefined;
     const candidate = path.join(__dirname, 'glue.wasm');
     return existsSync(candidate) ? candidate : undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markii/host",
-  "version": "0.17.0-next.2",
+  "version": "0.17.0-next.3",
   "description": "Shared, host-neutral script-running layer for Markii hosts: tier gating, the grant model, address pinning, and the terminatable-isolate watchdog, plus the HostAdapter contract and createMarkiiHost. Entries: the neutral main entry, /node, /browser, /conformance.",
   "keywords": [
     "markdown",
@@ -32,6 +32,9 @@
       "import": "./dist/node.js",
       "default": "./dist/node.js"
     },
+    "./node-worker": {
+      "default": "./dist/node-worker.js"
+    },
     "./browser": {
       "types": "./dist/browser.d.ts",
       "import": "./dist/browser.js",
@@ -52,20 +55,20 @@
     "build:dist": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/build-dist-assets.mjs"
   },
   "dependencies": {
-    "@markii/bundle": "^0.17.0-next.2",
-    "@markii/core": "^0.17.0-next.2",
-    "@markii/lua": "^0.17.0-next.2",
-    "@markii/pack": "^0.17.0-next.2",
-    "@markii/runtime": "^0.17.0-next.2",
-    "@markii/stdlib": "^0.17.0-next.2",
+    "@markii/bundle": "^0.17.0-next.3",
+    "@markii/core": "^0.17.0-next.3",
+    "@markii/lua": "^0.17.0-next.3",
+    "@markii/pack": "^0.17.0-next.3",
+    "@markii/runtime": "^0.17.0-next.3",
+    "@markii/stdlib": "^0.17.0-next.3",
     "fflate": "^0.8.3"
   },
   "files": [
     "dist"
   ],
   "peerDependencies": {
-    "@markii/html": "^0.17.0-next.2",
-    "@markii/react": "^0.17.0-next.2"
+    "@markii/html": "^0.17.0-next.3",
+    "@markii/react": "^0.17.0-next.3"
   },
   "peerDependenciesMeta": {
     "@markii/html": {
@@ -76,8 +79,8 @@
     }
   },
   "devDependencies": {
-    "@markii/html": "^0.17.0-next.2",
-    "@markii/react": "^0.17.0-next.2",
+    "@markii/html": "^0.17.0-next.3",
+    "@markii/react": "^0.17.0-next.3",
     "esbuild": "^0.28.2"
   },
   "publishConfig": {