@markii/lua 0.17.0-next.2 → 0.17.0-next.4

package/dist/capabilities.js

@@ -199,9 +199,9 @@ export function buildCapabilities(config) {
     // this function nested POST/PATCH wiring inside "if GET is granted",
     // which silently produced no `net.post` at all for a POST-only grant.
     //
-    // The `net` table itself, and every one of its three methods, is now
-    // ALWAYS wired, regardless of grants, provider wiring, or tier (GitHub
-    // capability-stub finding, batch 7 #47). Before this, an ungranted
+    // The `net` table itself, and every one of its three methods, is
+    // ALWAYS wired, regardless of grants, provider wiring, or tier. Were it
+    // not, an ungranted
     // script saw a missing global (`net` itself omitted when nothing was
     // granted, or a missing method when a specific host/verb wasn't) and
     // failed with an ordinary Lua "attempt to index/call a nil value" —
@@ -270,8 +270,8 @@ local __smd_net_get = __smd_net_get_raw
 -- a dynamic global lookup inside \`net.fetch_json\`'s own body. Otherwise a
 -- script could do \`__smd_json_decode = function(t) return t end\` before a
 -- LATER \`net.fetch_json\` call and neuter the decoder's own depth guard and
--- array-marker stripping entirely (adversarial finding A2) -- the same
--- rebinding risk \`./json-decode\`'s own doc comment (finding A1) already
+-- array-marker stripping entirely -- the same
+-- rebinding risk \`./json-decode\`'s own doc comment already
 -- closes for the primitives the decoder uses internally.
 local __smd_net_get_json_decode = __smd_json_decode
 __smd_net_get_raw = nil
@@ -415,7 +415,7 @@ end
                 return undefined;
             // Depth/node budget, checked BEFORE the stored value is ever encoded
             // to text and handed to Lua — mirrors `net.fetch_json`'s own
-            // pre-check exactly (adversarial finding B2). A host-stored value is
+            // pre-check exactly. A host-stored value is
             // exactly as untrusted as a remote fetch body — a bundle's
             // `.cache/*.json` file, for instance, can be edited by anything with
             // write access to the bundle, not just this sandbox's own WRITE side
@@ -424,16 +424,14 @@ end
             // already capped.
             //
             // An entry that fails the budget check, isn't a plain object at all,
-            // or carries a missing/non-finite `storedAtMs` (adversarial finding:
-            // a poisoned host snapshot like `{value: 'x'}` with no `storedAtMs`,
+            // or carries a missing/non-finite `storedAtMs` (a poisoned host snapshot like `{value: 'x'}` with no `storedAtMs`,
             // or `storedAtMs: 'abc'`, would otherwise reach the Lua-side
             // `now - storedAtMs` arithmetic in `cache.get` below and throw a
             // script-error, wedging the note permanently instead of self-healing)
             // — or that cannot be `JSON.stringify`'d at all (cyclic, or
             // BigInt-bearing — something other than this sandbox's own WRITE
             // side must have written it, since that side already rejects both) —
-            // is SELF-HEALED rather than denied (orchestrator decision, #6
-            // verification notes): it is treated as a cache MISS, exactly as if
+            // is SELF-HEALED rather than denied (by design): it is treated as a cache MISS, exactly as if
             // `key` had never been stored. `cache.get`'s Lua body (below) then
             // calls `fn()` and writes the fresh, already-capped result back
             // through `__smd_cache_set_raw`, which quietly repairs the stored
@@ -441,7 +439,7 @@ end
             // capability denial is reserved for the fresh recompute itself
             // failing the WRITE side's own caps, which is unchanged.
             //
-            // Finiteness alone isn't enough (pentest finding N-1): a poisoned
+            // Finiteness alone isn't enough: a poisoned
             // snapshot with a huge FUTURE `storedAtMs` (e.g.
             // `Number.MAX_SAFE_INTEGER * 1000`) is finite, so it used to pass
             // straight through to the Lua-side `(now - storedAtMs) < ttl*1000`
@@ -501,10 +499,10 @@ local __smd_cache_get = __smd_cache_get_raw
 local __smd_cache_set = __smd_cache_set_raw
 local __smd_now_ms = __smd_now_ms_raw
 -- Captured into locals HERE, at prelude-definition time -- NOT resolved as
--- dynamic globals inside cache.get's own body (adversarial findings A2 and
--- D1). Without this, a script could do \`__smd_json_decode = function(t)
--- return t end\` (A2) or, more seriously, \`__smd_marshal_root = function(v)
--- return v end\` (D1) before a LATER cache.get call: the marshal-root
+-- dynamic globals inside cache.get's own body. Without this, a script
+-- could do \`__smd_json_decode = function(t)
+-- return t end\` or, more seriously, \`__smd_marshal_root = function(v)
+-- return v end\` before a LATER cache.get call: the marshal-root
 -- rebind would send an UNBOUNDED, uncapped table straight through
 -- wasmoon's own eager table->JS conversion into the store the moment the
 -- rebound "identity" function handed it back, since the write side

package/dist/json-decode.d.ts

@@ -68,8 +68,7 @@ import { type MarshalLimits } from './marshal.js';
  * cap that already bounds the JS-side parse.
  *
  * ## Every Lua primitive this decoder uses is pinned at PRELUDE-DEFINITION
- * ## time, not resolved as a dynamic global at call time (adversarial
- * ## finding A1)
+ * ## time, not resolved as a dynamic global at call time
  *
  * `string.byte`/`sub`/`find`/`char`, `table.concat`, `tonumber`,
  * `math.floor`, and `error` are all captured into locals ONCE, at the top
@@ -84,6 +83,6 @@ import { type MarshalLimits } from './marshal.js';
  * the depth guard entirely, since `fail()` would then no longer actually
  * raise). This mirrors `./marshal`'s own `buildMarshalPrelude`, which
  * already does exactly this for the same reason (see that module's doc
- * comment referencing sandbox-audit finding F-1).
+ * comment).
  */
 export declare function buildJsonDecodePrelude(limits: MarshalLimits): string;

package/dist/json-decode.js

@@ -69,8 +69,7 @@ import { ARRAY_MARKER } from './marshal.js';
  * cap that already bounds the JS-side parse.
  *
  * ## Every Lua primitive this decoder uses is pinned at PRELUDE-DEFINITION
- * ## time, not resolved as a dynamic global at call time (adversarial
- * ## finding A1)
+ * ## time, not resolved as a dynamic global at call time
  *
  * `string.byte`/`sub`/`find`/`char`, `table.concat`, `tonumber`,
  * `math.floor`, and `error` are all captured into locals ONCE, at the top
@@ -85,7 +84,7 @@ import { ARRAY_MARKER } from './marshal.js';
  * the depth guard entirely, since `fail()` would then no longer actually
  * raise). This mirrors `./marshal`'s own `buildMarshalPrelude`, which
  * already does exactly this for the same reason (see that module's doc
- * comment referencing sandbox-audit finding F-1).
+ * comment).
  */
 export function buildJsonDecodePrelude(limits) {
     return `
@@ -246,7 +245,7 @@ function __smd_json_decode(__smd_json_text)
       -- \`{"${ARRAY_MARKER}":true,"1":"a","2":"b","x":"kept"}\` would decode
       -- to a Lua table carrying that same key, and later marshal to the
       -- host as a JS ARRAY -- silently reshaping attacker-controlled data
-      -- and dropping its real keys (adversarial finding A4). Dropping
+      -- and dropping its real keys (see marshal.ts). Dropping
       -- (rather than rejecting the whole response) keeps an otherwise
       -- ordinary API response usable even if it happens to use this exact
       -- field name for something unrelated.
@@ -281,7 +280,7 @@ function __smd_json_decode(__smd_json_text)
       local value = decode_value(depth + 1)
       n = n + 1
       -- A JSON null ARRAY ELEMENT decodes to Lua \`false\`, not an absent
-      -- slot (orchestrator decision, adversarial finding C2): an absent
+      -- slot (by design): an absent
       -- slot would leave a hole (\`#\`/\`ipairs\` stop early, and returning
       -- the table to the host fails \`MARK_MARSHAL:key-type\` since the walk
       -- no longer sees sequential \`1..n\` keys) -- reproducing issue #6's

package/dist/json-table.d.ts

@@ -78,8 +78,8 @@ export interface JsonTableConfig {
  * PRELUDE-DEFINITION TIME -- before any untrusted script code runs -- so a
  * later script reassigning any of those globals (or `json` itself) cannot
  * neuter the type check or reach past the reused decoder/marshal walk. This
- * is the same discipline `./json-decode` (finding A1) and `./capabilities`
- * (findings A2/D1) already apply to their own internal calls into these
+ * is the same discipline `./json-decode` and `./capabilities`
+ * already apply to their own internal calls into these
  * exact two functions.
  */
 export declare function buildJsonTable(config: JsonTableConfig): {

package/dist/json-table.js

@@ -64,8 +64,8 @@ import { checkJsonWithinLimits, finalizeMarshaledValue, } from './marshal.js';
  * PRELUDE-DEFINITION TIME -- before any untrusted script code runs -- so a
  * later script reassigning any of those globals (or `json` itself) cannot
  * neuter the type check or reach past the reused decoder/marshal walk. This
- * is the same discipline `./json-decode` (finding A1) and `./capabilities`
- * (findings A2/D1) already apply to their own internal calls into these
+ * is the same discipline `./json-decode` and `./capabilities`
+ * already apply to their own internal calls into these
  * exact two functions.
  */
 export function buildJsonTable(config) {

package/dist/marshal.d.ts

@@ -121,8 +121,7 @@ export declare function checkJsonWithinLimits(value: unknown, limits: MarshalLim
  * True array marker set by the Lua-side marshal walk (see
  * `buildMarshalPrelude`). Exported (not just module-private) so
  * `./json-decode`'s JSON decoder can recognize and DROP this exact key if
- * it ever appears as an object key in attacker-controlled JSON (adversarial
- * finding A4): without that, a remote response body like
+ * it ever appears as an object key in attacker-controlled JSON: without that, a remote response body like
  * `{"__smd_is_array":true,"1":"a","2":"b","x":"kept"}` would decode to an
  * ordinary Lua table carrying this same marker key, and `finalizeMarshaledValue`
  * below — which has no way to tell "the trusted marshal walk set this" apart

package/dist/marshal.js

@@ -78,9 +78,9 @@ export function buildMarshalPrelude(limits) {
 -- once per engine, before any untrusted user code runs), so the walk below
 -- closes over these as upvalues fixed to the genuine primitives -- immune to
 -- a later script doing e.g. \`error = function() end\` in the shared globals
--- table before this walk runs. See finding F-1 in the sandbox audit: the
--- walk previously resolved error/type/pairs/math.floor as DYNAMIC GLOBAL
--- lookups, which a script could rebind to neuter its own caps.
+-- table before this walk runs. Resolving error/type/pairs/math.floor as
+-- DYNAMIC GLOBAL lookups would let a script rebind them to neuter its own
+-- caps.
 local error, type, pairs, floor, sfind = error, type, pairs, math.floor, string.find
 
 local function __smd_marshal(value, seen, depth, budget)
@@ -222,8 +222,7 @@ export function checkJsonWithinLimits(value, limits) {
  * True array marker set by the Lua-side marshal walk (see
  * `buildMarshalPrelude`). Exported (not just module-private) so
  * `./json-decode`'s JSON decoder can recognize and DROP this exact key if
- * it ever appears as an object key in attacker-controlled JSON (adversarial
- * finding A4): without that, a remote response body like
+ * it ever appears as an object key in attacker-controlled JSON: without that, a remote response body like
  * `{"__smd_is_array":true,"1":"a","2":"b","x":"kept"}` would decode to an
  * ordinary Lua table carrying this same marker key, and `finalizeMarshaledValue`
  * below — which has no way to tell "the trusted marshal walk set this" apart

package/dist/sandbox.js

@@ -476,8 +476,7 @@ export async function runScript(options) {
         // throws synchronously inside the try — e.g. `finalizeMarshaledValue`
         // recursing deep enough to overflow the JS call stack, which today is
         // safe only INCIDENTALLY because wasmoon's own `getValue` conversion
-        // overflows first on sufficiently deep input (see the sandbox audit's
-        // finding F-1 "also recommended" note) — so that guarantee no longer
+        // overflows first on sufficiently deep input — so that guarantee no longer
         // depends on that ordering holding forever. Classified the same as any
         // other unclassified failure: a plain `'runtime'` failure, never a raw
         // throw out of `runScript`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markii/lua",
-  "version": "0.17.0-next.2",
+  "version": "0.17.0-next.4",
   "description": "Sandboxed Lua 5.4 (wasmoon) execution runtime for Mark's document scripting: an empty-env global whitelist, two-tier capability-gated net/cache/bundle access, instruction-count/wall-clock/memory limits, and depth/size-capped Lua<->JS marshaling.",
   "keywords": [
     "markdown",
@@ -44,8 +44,8 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@markii/bundle": "^0.17.0-next.2",
-    "@markii/runtime": "^0.17.0-next.2",
+    "@markii/bundle": "^0.17.0-next.4",
+    "@markii/runtime": "^0.17.0-next.4",
     "wasmoon": "^1.16.0"
   }
 }