@markii/host 0.17.0-next.2 → 0.17.0-next.4

package/dist/run/node-isolate.js

@@ -1,81 +1,23 @@
 /**
  * The Node half of the Run path's isolate seam: a `node:worker_threads`
- * worker, plus the dev/Vitest worker-entry fallback. Split out of
- * `./run-host.ts` so the watchdog, the exactly-once settlement and the
- * never-rejects contract stay in a module with no `node:*` import and run
- * unchanged for every host kind. Reached only through `@markii/host/node`.
+ * worker. Split out of `./run-host.ts` so the watchdog, the exactly-once
+ * settlement and the never-rejects contract stay in a module with no
+ * `node:*` import and run unchanged for every host kind. Reached only
+ * through `@markii/host/node`.
  */
 import { Worker } from 'node:worker_threads';
 import { existsSync } from 'node:fs';
-import * as path from 'node:path';
-import { spawnRun } from './run-host.js';
-/** `execArgv` needed to run a `.ts` worker entry directly (dev/Vitest only) — see `./worker-entry.ts`'s doc comment on why a plain `node` `.ts` import can't resolve this repo's `@markii/*` bare specifiers or its `./foo.js` -> `./foo.ts` import convention on its own. `--require tsx/cjs` (rather than `tsx/esm`) is deliberate: empirically, the ESM loader hook deadlocks Node's CJS/ESM interop translator for a worker thread requiring `.js`-suffixed relative imports that resolve to `.ts` files (this repo's convention throughout `@markii/*`), while the CJS `require` hook has no such issue. */
-const TSX_DEV_EXEC_ARGV = ['--require', 'tsx/cjs'];
-/**
- * The ONLY fallback this shared package supplies for an unset `workerPath`:
- * the sibling `worker-entry.ts`, run straight from source via `tsx`
- * (`TSX_DEV_EXEC_ARGV`, above). That is correct for this package's own
- * dev/Vitest runs — `__dirname` at that point is this real source
- * directory — but it says nothing about where a packaged host's bundled
- * worker lives, because this package does not know that host's `dist/`
- * layout. A packaged host (e.g. `apps/vscode`) MUST resolve its own bundled
- * worker path itself and pass it as `SpawnRunOptions.workerPath`; see
- * `apps/vscode/src/worker-path.ts` for that host's resolution and
- * `apps/vscode/esbuild.config.mjs`'s worker build for where it bundles to.
- */
-export function defaultWorkerPath() {
-    // The built package is ESM, where `__dirname` does not exist: a packaged
-    // host always passes its own bundled worker, so say so instead of
-    // throwing a ReferenceError.
-    const devSource = typeof __dirname === 'undefined'
-        ? undefined
-        : path.join(__dirname, 'worker-entry.ts');
-    if (devSource !== undefined && existsSync(devSource))
-        return devSource;
-    throw new Error('spawnRun: could not resolve the worker entry file (looked for ' +
-        `${devSource ?? 'worker-entry.ts beside the package source'}) — pass workerPath explicitly`);
-}
-function execArgvFor(workerPath) {
-    return workerPath.endsWith('.ts') ? TSX_DEV_EXEC_ARGV : undefined;
-}
-/**
- * Dev/Vitest only: point `tsx` at the repo's `tsconfig.dev.json` so a
- * `.ts` worker entry resolves `@markii/*` to each package's SOURCE.
- *
- * Without this the worker is a plain Node resolution: a bare `@markii/lua`
- * goes through `node_modules` to that package's `exports`, which name the
- * built `dist/`. `npm run build` only type-checks (`tsc --noEmit`); the
- * emitting script is `build:dist`, which runs at release. So `dist/` is
- * whatever a past release left behind, and a real-isolate probe would
- * silently exercise that stale code instead of the source it is written to
- * test. A capability added since the last `build:dist` simply would not
- * exist inside the worker.
- *
- * Gated on a `.ts` entry, the same signal `execArgvFor` already uses for
- * the tsx hook, so a packaged host passing its own bundled `.js` worker is
- * never touched by this.
- */
-function devTsconfigEnv(entryPath) {
-    if (!entryPath.endsWith('.ts') || typeof __dirname === 'undefined') {
-        return undefined;
-    }
-    const tsconfig = path.resolve(__dirname, '../../../..', 'tsconfig.dev.json');
-    if (!existsSync(tsconfig))
-        return undefined;
-    return { env: { ...process.env, TSX_TSCONFIG_PATH: tsconfig } };
-}
+import { fileURLToPath } from 'node:url';
 /**
  * The default isolate: a `node:worker_threads` worker, which is what every
- * Node host (the VS Code extension host, this package's own tests) uses. It
- * is the only kind that accepts `resourceLimits`, so it is also the only
+ * Node host uses. It is the only kind that accepts `resourceLimits`, so it is also the only
  * kind whose V8 heap is bounded — see `./isolate.ts` for why a host might
  * still have to supply the other one.
  */
 export const workerThreadIsolate = (options) => {
-    const execArgv = options.execArgv ?? execArgvFor(options.entryPath);
     const worker = new Worker(options.entryPath, {
-        ...(execArgv ? { execArgv } : {}),
-        ...(devTsconfigEnv(options.entryPath) ?? {}),
+        ...(options.execArgv ? { execArgv: options.execArgv } : {}),
+        ...(options.env ? { env: options.env } : {}),
         resourceLimits: {
             maxOldGenerationSizeMb: options.maxOldGenerationSizeMb,
         },
@@ -88,11 +30,11 @@ export const workerThreadIsolate = (options) => {
             void worker.terminate();
         },
         onMessage: (listener) => {
-            // `on`, not `once`: a run now sends one progress message per script
-            // (GitHub issue #35) ahead of its single result message, and
-            // `spawnRun` is what tells the two apart. Messages arriving after
-            // the run settles are harmless — `settled` guards every path — and
-            // the worker is terminated on settle anyway.
+            // `on`, not `once`: a run sends one progress message per script
+            // ahead of its single result message, and `spawnRun` tells the two
+            // apart. Messages arriving after the run settles are harmless
+            // (`settled` guards every path) and the worker is terminated on
+            // settle anyway.
             worker.on('message', listener);
         },
         onError: (listener) => {
@@ -104,14 +46,23 @@ export const workerThreadIsolate = (options) => {
     };
 };
 /**
- * `spawnRun` with the Node defaults filled in: the worker-thread isolate and
- * the dev/Vitest worker entry. For this package's own tests and any Node
- * caller that wants them; a packaged host passes its own `workerPath`.
+ * A `HostIsolate` of kind `node`: each run starts a `worker_threads` worker
+ * from the packaged, self-contained `node-worker.js`. A host that bundles
+ * the worker itself passes its own `workerPath`. The default is resolved
+ * when a run asks for it, so constructing the isolate never throws.
  */
-export function spawnRunInThread(options) {
-    return spawnRun({
-        ...options,
-        workerPath: options.workerPath ?? defaultWorkerPath(),
-        spawnIsolate: options.spawnIsolate ?? workerThreadIsolate,
-    });
+export function createNodeHostIsolate(options = {}) {
+    return {
+        kind: 'node',
+        workerPath: () => {
+            if (options.workerPath !== undefined)
+                return options.workerPath;
+            const packaged = fileURLToPath(new URL('../node-worker.js', import.meta.url));
+            if (!existsSync(packaged)) {
+                throw new Error(`the packaged worker was not found at ${packaged}: pass workerPath`);
+            }
+            return packaged;
+        },
+        spawnIsolate: workerThreadIsolate,
+    };
 }

package/dist/run/run-flow.d.ts

@@ -163,8 +163,7 @@ export interface RunOnceResult {
     /**
      * Consent unification (SECURITY-RELEVANT): lines describing any mismatch
      * between what is DECLARED (a bundle manifest's `permissions.net`, and/or
-     * an individual script's own `permissions` fence attribute — batch 7
-     * #47) and the hosts this run's scripts actually reach, from
+     * an individual script's own `permissions` fence attribute) and the hosts this run's scripts actually reach, from
      * `./bundle-run.ts`'s `netDeclarationDiagnostics`. `[]` when there is
      * nothing to compare against (no bundle manifest and no script declares
      * `permissions`) or every declared host agrees with the scan. For the

package/dist/run/run-host.d.ts

@@ -85,9 +85,9 @@ export interface SpawnRunOptions {
     /**
      * The entry the isolate loads. This package cannot know how a given host
      * bundles or lays out its own `dist/` (see e.g.
-     * `apps/vscode/src/worker-path.ts`), so the host always passes it. The
-     * Node-only dev/Vitest fallback lives in `@markii/host/node`
-     * (`defaultWorkerPath`).
+     * `apps/vscode/src/worker-path.ts`), so the host always passes it.
+     * `createNodeHostIsolate` from `@markii/host/node` supplies the packaged
+     * worker's path.
      */
     workerPath: string;
 }

package/dist/run/worker-entry-browser.d.ts

@@ -10,10 +10,11 @@
  * the failure classification cannot drift between hosts. This file supplies
  * only the two things a Web Worker has to do differently:
  *
- *   1. Network goes through `./net-bridge.ts` to the host, which still has
- *      Node and runs the same pinned provider as before. The isolate itself
- *      has no network stack, which makes the allowlist unbypassable from
- *      inside it.
+ *   1. Network goes through `./net-bridge.ts` to the host, which runs the
+ *      same pinned provider as before. A Web Worker does have network
+ *      globals, so `lockdownWorkerGlobals` (below) removes them before any
+ *      script runs. Lua cannot reach JavaScript at all; the removal is a
+ *      second wall for the case where an interpreter escape does.
  *   2. wasmoon's `glue.wasm` arrives as a URL on the job, because there is
  *      no `__dirname` here to find it beside the bundle.
  *
@@ -29,6 +30,25 @@ interface WorkerGlobal {
         data: unknown;
     }) => void) => void;
 }
+/**
+ * Removes the worker's own ways to reach a network, once, before the first
+ * script runs.
+ *
+ * - Every name in `REMOVED_GLOBALS` (the connection and storage
+ *   constructors, and `Worker`, which would start an unlocked scope) is
+ *   shadowed with `undefined`.
+ * - `importScripts` becomes a function that throws. It stays a function
+ *   because the Lua engine's start-up detects a worker by
+ *   `typeof importScripts`.
+ * - `fetch` keeps working for exactly one URL, the `glue.wasm` the job
+ *   named, because the engine loads its WebAssembly through it for every
+ *   script. Any other URL is refused.
+ *
+ * Net traffic is unaffected: it goes to the host with `postMessage`.
+ * Idempotent. Covered by `worker-entry-browser.test.ts` and, in a real
+ * browser, by the e2e suite.
+ */
+export declare function lockdownWorkerGlobals(scope: object, wasmUri: string | undefined): void;
 /**
  * A job for this entry additionally carries where `glue.wasm` can be
  * fetched from — a blob URL the host minted from the file on disk. Absent,

package/dist/run/worker-entry-browser.js

@@ -10,10 +10,11 @@
  * the failure classification cannot drift between hosts. This file supplies
  * only the two things a Web Worker has to do differently:
  *
- *   1. Network goes through `./net-bridge.ts` to the host, which still has
- *      Node and runs the same pinned provider as before. The isolate itself
- *      has no network stack, which makes the allowlist unbypassable from
- *      inside it.
+ *   1. Network goes through `./net-bridge.ts` to the host, which runs the
+ *      same pinned provider as before. A Web Worker does have network
+ *      globals, so `lockdownWorkerGlobals` (below) removes them before any
+ *      script runs. Lua cannot reach JavaScript at all; the removal is a
+ *      second wall for the case where an interpreter escape does.
  *   2. wasmoon's `glue.wasm` arrives as a URL on the job, because there is
  *      no `__dirname` here to find it beside the bundle.
  *
@@ -23,6 +24,99 @@
  */
 import { isRunJob, resultForInternalError, runJob, } from './run-job.js';
 import { createNetBridge } from './net-bridge-worker.js';
+/**
+ * Globals through which a worker can open a connection or keep state outside
+ * the run. `fetch` and `importScripts` are handled separately because the
+ * Lua engine's start-up needs them (see `lockdownWorkerGlobals`).
+ */
+const REMOVED_GLOBALS = [
+    'XMLHttpRequest',
+    'WebSocket',
+    'EventSource',
+    'indexedDB',
+    'caches',
+    'BroadcastChannel',
+    // A nested worker would start with a fresh, unlocked global scope.
+    'Worker',
+    'SharedWorker',
+    'WebTransport',
+    'WebSocketStream',
+];
+/** Reads the URL out of a `fetch` argument without assuming DOM types. */
+function requestUrl(input, base) {
+    try {
+        if (typeof input === 'string')
+            return new URL(input, base).href;
+        if (input instanceof URL)
+            return input.href;
+        const url = input?.url;
+        if (typeof url === 'string')
+            return new URL(url, base).href;
+    }
+    catch {
+        // an unparseable URL is not the allowed one
+    }
+    return undefined;
+}
+/**
+ * Removes the worker's own ways to reach a network, once, before the first
+ * script runs.
+ *
+ * - Every name in `REMOVED_GLOBALS` (the connection and storage
+ *   constructors, and `Worker`, which would start an unlocked scope) is
+ *   shadowed with `undefined`.
+ * - `importScripts` becomes a function that throws. It stays a function
+ *   because the Lua engine's start-up detects a worker by
+ *   `typeof importScripts`.
+ * - `fetch` keeps working for exactly one URL, the `glue.wasm` the job
+ *   named, because the engine loads its WebAssembly through it for every
+ *   script. Any other URL is refused.
+ *
+ * Net traffic is unaffected: it goes to the host with `postMessage`.
+ * Idempotent. Covered by `worker-entry-browser.test.ts` and, in a real
+ * browser, by the e2e suite.
+ */
+export function lockdownWorkerGlobals(scope, wasmUri) {
+    const target = scope;
+    if (target.__markiiLocked)
+        return;
+    const base = target.location?.href ?? 'http://localhost/';
+    const allowed = wasmUri === undefined ? undefined : requestUrl(wasmUri, base);
+    const realFetch = target.fetch;
+    const shadow = (name, value) => {
+        try {
+            Object.defineProperty(scope, name, {
+                value,
+                configurable: false,
+                writable: false,
+            });
+        }
+        catch {
+            // A non-configurable property cannot be shadowed; assign instead.
+            try {
+                target[name] = value;
+            }
+            catch {
+                // nothing more can be done for this name
+            }
+        }
+    };
+    for (const name of REMOVED_GLOBALS)
+        shadow(name, undefined);
+    shadow('importScripts', () => {
+        throw new Error('importScripts is not available in the run isolate');
+    });
+    if (typeof realFetch === 'function') {
+        shadow('fetch', (input, init) => {
+            const url = requestUrl(input, base);
+            if (allowed !== undefined && url === allowed) {
+                return realFetch.call(scope, input, init);
+            }
+            return Promise.reject(new TypeError('network access is not available in the run isolate'));
+        });
+    }
+    Object.defineProperty(scope, '__markiiLocked', { value: true });
+}
 function start(scope) {
     const bridge = createNetBridge((message) => {
         scope.postMessage(message);
@@ -47,6 +141,7 @@ function start(scope) {
                 return;
             }
             const job = message;
+            lockdownWorkerGlobals(scope, job.wasmUri);
             let result;
             try {
                 result = await runJob(job, {

package/dist/run/worker-entry.js

@@ -53,6 +53,8 @@ import { isRunJob, resultForInternalError, runJob } from './run-job.js';
  * pass here.
  */
 function resolveWasmUri() {
+    if (typeof __dirname === 'undefined')
+        return undefined;
     const candidate = path.join(__dirname, 'glue.wasm');
     return existsSync(candidate) ? candidate : undefined;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@markii/host",
-  "version": "0.17.0-next.2",
-  "description": "Shared, host-neutral script-running layer for Markii hosts: tier gating, the grant model, address pinning, and the terminatable-isolate watchdog, plus the HostAdapter contract and createMarkiiHost. Entries: the neutral main entry, /node, /browser, /conformance.",
+  "version": "0.17.0-next.4",
+  "description": "Shared, host-neutral script-running layer for Markii hosts: tier gating, the grant model, address pinning, and the terminatable-isolate watchdog, plus the HostAdapter contract and createMarkiiHost. Entries: the neutral main entry, /internal (no semver promise), /node, /html-engine, /browser, /browser-worker-classic, /conformance.",
   "keywords": [
     "markdown",
     "mk.md",
@@ -27,22 +27,41 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./internal": {
+      "types": "./dist/internal.d.ts",
+      "import": "./dist/internal.js",
+      "default": "./dist/internal.js"
+    },
     "./node": {
       "types": "./dist/node.d.ts",
       "import": "./dist/node.js",
       "default": "./dist/node.js"
     },
+    "./html-engine": {
+      "types": "./dist/html-engine.d.ts",
+      "import": "./dist/html-engine.js",
+      "default": "./dist/html-engine.js"
+    },
+    "./node-worker": {
+      "default": "./dist/node-worker.js"
+    },
     "./browser": {
       "types": "./dist/browser.d.ts",
       "import": "./dist/browser.js",
       "default": "./dist/browser.js"
     },
+    "./browser-worker-classic": {
+      "default": "./dist/browser-worker.classic.js"
+    },
     "./conformance": {
       "types": "./dist/conformance.d.ts",
       "import": "./dist/conformance.js",
       "default": "./dist/conformance.js"
     }
   },
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "pretest": "npm run generate:doc-css --workspace @markii/html",
     "test": "vitest run",
@@ -52,20 +71,20 @@
     "build:dist": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/build-dist-assets.mjs"
   },
   "dependencies": {
-    "@markii/bundle": "^0.17.0-next.2",
-    "@markii/core": "^0.17.0-next.2",
-    "@markii/lua": "^0.17.0-next.2",
-    "@markii/pack": "^0.17.0-next.2",
-    "@markii/runtime": "^0.17.0-next.2",
-    "@markii/stdlib": "^0.17.0-next.2",
+    "@markii/bundle": "^0.17.0-next.4",
+    "@markii/core": "^0.17.0-next.4",
+    "@markii/lua": "^0.17.0-next.4",
+    "@markii/pack": "^0.17.0-next.4",
+    "@markii/runtime": "^0.17.0-next.4",
+    "@markii/stdlib": "^0.17.0-next.4",
     "fflate": "^0.8.3"
   },
   "files": [
     "dist"
   ],
   "peerDependencies": {
-    "@markii/html": "^0.17.0-next.2",
-    "@markii/react": "^0.17.0-next.2"
+    "@markii/html": "^0.17.0-next.4",
+    "@markii/react": "^0.17.0-next.4"
   },
   "peerDependenciesMeta": {
     "@markii/html": {
@@ -76,8 +95,8 @@
     }
   },
   "devDependencies": {
-    "@markii/html": "^0.17.0-next.2",
-    "@markii/react": "^0.17.0-next.2",
+    "@markii/html": "^0.17.0-next.4",
+    "@markii/react": "^0.17.0-next.4",
     "esbuild": "^0.28.2"
   },
   "publishConfig": {