@markii/lua 0.3.1 → 0.5.0

package/README.md

@@ -1,5 +1,5 @@
 # @markii/lua
 
-A sandboxed Lua 5.4 (via `wasmoon`) execution runtime for [Mark](https://github.com/sadigaxund/markii)'s document scripting: an empty-environment global whitelist, capability-gated net/cache/bundle access, instruction-count and wall-clock/memory limits, and depth/size-capped Lua↔JS value marshaling. No React, no markdown parsing.
+A sandboxed Lua 5.4 (via `wasmoon`) execution runtime for [Markii](https://github.com/sadigaxund/markii)'s document scripting: an empty-environment global whitelist, capability-gated net/cache/bundle access, instruction-count and wall-clock/memory limits, and depth/size-capped Lua↔JS value marshaling. No React, no markdown parsing.
 
 See the [repository](https://github.com/sadigaxund/markii) for the format spec and the reference library as a whole.

package/dist/capabilities.d.ts

@@ -85,6 +85,10 @@ export interface CapabilityDenial {
 export interface CapabilityDenials {
     last(): CapabilityDenial | undefined;
 }
+/** Construct an `Error` a `NetProvider` throws for a policy denial — see {@link NET_PROVIDER_DENIAL}. */
+export declare function netProviderDenial(message: string): Error;
+/** True when `err` was built by {@link netProviderDenial} — a provider's policy refusal, not a transport failure. */
+export declare function isNetProviderDenial(err: unknown): err is Error;
 /**
  * `Uint8Array` <-> Lua string, byte-for-byte via one JS UTF-16 code unit
  * per byte (Latin-1-style). Lua strings are themselves 8-bit-clean byte

package/dist/capabilities.js

@@ -6,6 +6,37 @@ export const DEFAULT_MAX_FETCH_BYTES = 2_000_000;
 function capabilityError(message) {
     return new Error(`${CAPABILITY_ERROR_TAG}: ${message}`);
 }
+/**
+ * Brand marking an `Error` a {@link NetProvider} throws for a POLICY denial
+ * (an ungranted redirect hop, an over-size body, too many hops, a
+ * credential-bearing redirect) as opposed to a genuine transport failure
+ * (DNS, connection refused). A provider is one layer below `buildCapabilities`'
+ * own grant check, so its throws would otherwise surface as an ordinary
+ * runtime error and be classified `'script-error'`. Marking the throw lets
+ * this module record it on the non-spoofable {@link CapabilityDenials} handle
+ * (see `callNetProvider` below) instead of relying on a message string a
+ * script could read and forge.
+ *
+ * This closes P2-c (PENTEST-REPORT-2026-08-23.md §9.3): the earlier host-side
+ * fix embedded a per-run random tag in the thrown message so the host could
+ * reclassify the failure, but that message crosses back into Lua, where a
+ * script's own `pcall`/`tostring` reads the tag and then forges it. The brand
+ * is a JS `Symbol` checked on the JS side, BEFORE the error ever crosses the
+ * Lua boundary, so nothing a script can observe distinguishes a denial, and
+ * classification no longer depends on any Lua-visible string.
+ */
+const NET_PROVIDER_DENIAL = Symbol('markii.net.provider-denial');
+/** Construct an `Error` a `NetProvider` throws for a policy denial — see {@link NET_PROVIDER_DENIAL}. */
+export function netProviderDenial(message) {
+    return Object.assign(new Error(message), {
+        [NET_PROVIDER_DENIAL]: true,
+    });
+}
+/** True when `err` was built by {@link netProviderDenial} — a provider's policy refusal, not a transport failure. */
+export function isNetProviderDenial(err) {
+    return (err instanceof Error &&
+        err[NET_PROVIDER_DENIAL] === true);
+}
 function describeThrown(err) {
     return err instanceof Error ? err.message : String(err);
 }
@@ -138,6 +169,28 @@ export function buildCapabilities(config) {
         lastDenial = { reason, message };
     }
     const denials = { last: () => lastDenial };
+    /**
+     * Invokes a `NetProvider` method, turning a POLICY denial the provider
+     * throws (marked via `netProviderDenial`) into the same non-spoofable
+     * outcome an in-house grant check produces: recorded on `recordDenial` and
+     * re-thrown as a `capabilityError` carrying the provider's own plain
+     * message. A transport failure (unmarked) is left to propagate untouched,
+     * so it stays a `'script-error'`. This is what lets the host provider stop
+     * smuggling a secret classification tag through the Lua-visible error text
+     * (P2-c — see `netProviderDenial`).
+     */
+    async function callNetProvider(op) {
+        try {
+            return await op();
+        }
+        catch (err) {
+            if (isNetProviderDenial(err)) {
+                recordDenial('denied', err.message);
+                throw capabilityError(err.message);
+            }
+            throw err;
+        }
+    }
     // --- net --------------------------------------------------------------
     // `fetch_json` and `post`/`patch` are gated INDEPENDENTLY of each other
     // (a manifest can grant POST to a host without granting it GET, or vice
@@ -163,7 +216,7 @@ export function buildCapabilities(config) {
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            const res = await config.net.get(url);
+            const res = await callNetProvider(() => config.net.get(url));
             if (res.body.length > maxFetchBytes) {
                 const message = `fetch response for "${url}" exceeds the ${maxFetchBytes}-byte cap`;
                 recordDenial('denied', message);
@@ -235,7 +288,7 @@ net.fetch_json = function(url) return __smd_net_get_json_decode(__smd_net_get(ur
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            const res = await config.net.post(url, body);
+            const res = await callNetProvider(() => config.net.post(url, body));
             // As with `net.fetch_json` above (GitHub issue #6): a plain JS object
             // (even one this shallow) crosses into Lua as a `js_proxy` userdata,
             // not a genuine table. `status`/`body` are both scalars, so instead
@@ -289,7 +342,7 @@ net.post = function(url, body) return __smd_net_post_blocked(url, body):await()
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            const res = await config.net.patch(url, body);
+            const res = await callNetProvider(() => config.net.patch(url, body));
             // Same fix as `net.post` above (GitHub issue #6) — see that block's
             // comment for the full mechanism.
             return LuaMultiReturn.of(res.status, res.body);
@@ -390,28 +443,58 @@ net.patch = function(url, body) return __smd_net_patch_blocked(url, body):await(
             // below — so without this check, a 300k-element cached array reached
             // the script completely uncapped even though the FETCH path was
             // already capped.
-            const budgetCheck = checkJsonWithinLimits(entry.value, marshalLimits);
-            if (!budgetCheck.ok) {
-                const message = `cached value for "${key}" ${budgetCheck.message}`;
-                recordDenial('denied', message);
-                throw capabilityError(message);
+            //
+            // An entry that fails the budget check, isn't a plain object at all,
+            // or carries a missing/non-finite `storedAtMs` (adversarial finding:
+            // a poisoned host snapshot like `{value: 'x'}` with no `storedAtMs`,
+            // or `storedAtMs: 'abc'`, would otherwise reach the Lua-side
+            // `now - storedAtMs` arithmetic in `cache.get` below and throw a
+            // script-error, wedging the note permanently instead of self-healing)
+            // — or that cannot be `JSON.stringify`'d at all (cyclic, or
+            // BigInt-bearing — something other than this sandbox's own WRITE
+            // side must have written it, since that side already rejects both) —
+            // is SELF-HEALED rather than denied (orchestrator decision, #6
+            // verification notes): it is treated as a cache MISS, exactly as if
+            // `key` had never been stored. `cache.get`'s Lua body (below) then
+            // calls `fn()` and writes the fresh, already-capped result back
+            // through `__smd_cache_set_raw`, which quietly repairs the stored
+            // entry for next time. No denial is recorded for this path — a
+            // capability denial is reserved for the fresh recompute itself
+            // failing the WRITE side's own caps, which is unchanged.
+            //
+            // Finiteness alone isn't enough (pentest finding N-1): a poisoned
+            // snapshot with a huge FUTURE `storedAtMs` (e.g.
+            // `Number.MAX_SAFE_INTEGER * 1000`) is finite, so it used to pass
+            // straight through to the Lua-side `(now - storedAtMs) < ttl*1000`
+            // freshness check below, which then went hugely negative and
+            // reported the poisoned value as fresh forever — served without
+            // `fn()` ever running. `storedAtMs` must additionally be an integer
+            // and plausible: not before the epoch, and not after "now" as this
+            // same call sees it. `nowMs` is read once, right before the check,
+            // and reused for the equality bound so a genuine entry written and
+            // read in the same millisecond (`storedAtMs === nowMs`) is still a
+            // HIT, not a false self-heal.
+            const nowMs = Date.now();
+            const storedAtMs = entry.storedAtMs;
+            if (typeof entry !== 'object' ||
+                entry === null ||
+                Array.isArray(entry) ||
+                typeof storedAtMs !== 'number' ||
+                !Number.isInteger(storedAtMs) ||
+                storedAtMs < 0 ||
+                storedAtMs > nowMs) {
+                return undefined;
             }
+            const budgetCheck = checkJsonWithinLimits(entry.value, marshalLimits);
+            if (!budgetCheck.ok)
+                return undefined;
             let text;
             try {
-                // A cyclic or BigInt-bearing stored value throws here. This
-                // module's own WRITE side (`__smd_cache_set_raw` below) already
-                // rejects both before ever storing anything, but a `CacheProvider`
-                // is host-controlled storage that something other than this
-                // sandbox could have written — turn that into the same clean,
-                // catchable denial instead of an unclassified throw out of the
-                // capability layer.
                 const encoded = JSON.stringify(entry.value);
                 text = encoded === undefined ? 'null' : encoded;
             }
-            catch (err) {
-                const message = `cached value for "${key}" could not be encoded: ${describeThrown(err)}`;
-                recordDenial('denied', message);
-                throw capabilityError(message);
+            catch {
+                return undefined;
             }
             return LuaMultiReturn.of(text, entry.storedAtMs);
         });
@@ -498,7 +581,17 @@ end
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            return data === undefined ? null : bytesToLuaString(data);
+            // Resolve with `undefined`, NOT `null`, for a missing path. wasmoon's
+            // `Thread.pushValue` special-cases `typeof target === 'undefined'`
+            // with a direct `lua_pushnil` BEFORE it ever reaches its
+            // type-extension dispatch loop (`dist/index.js`'s `pushValue`
+            // `switch`); `null` is `typeof 'object'`, so it instead falls into
+            // that loop, where `PromiseTypeExtension.pushValue` unconditionally
+            // reads `decoration.target.then` and throws `Cannot read properties
+            // of null (reading 'then')` — verified empirically (wasmoon 1.16.0).
+            // This is exactly the failure this fixes (GitHub issue #9): a
+            // missing bundle path must resolve to Lua `nil`, not throw.
+            return data === undefined ? undefined : bytesToLuaString(data);
         });
         rawGlobals.__smd_bundle_exists_raw = (async (path) => {
             try {

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { ALLOWED_GLOBALS, DENIED_GLOBALS, createEmptyLuaEngine, } from './global
 export type { LimitHandle, ScriptLimits } from './limits.js';
 export { DEFAULT_LIMITS, installLimits } from './limits.js';
 export type { CacheEntry, CacheProvider, CapabilityConfig, CapabilityDenial, CapabilityDenials, CapabilityTier, NetGrants, NetProvider, NetResponse, } from './capabilities.js';
-export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, luaStringToBytes, } from './capabilities.js';
+export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, isNetProviderDenial, luaStringToBytes, netProviderDenial, } from './capabilities.js';
 export type { MarshalLimits } from './marshal.js';
 export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, checkJsonWithinLimits, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
 export { NOT_YET_SUPPORTED_MESSAGE, buildRequireStub } from './require.js';

package/dist/index.js

@@ -6,7 +6,7 @@
 export { CAPABILITY_ERROR_TAG, FETCH_DECODE_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';
 export { ALLOWED_GLOBALS, DENIED_GLOBALS, createEmptyLuaEngine, } from './globals.js';
 export { DEFAULT_LIMITS, installLimits } from './limits.js';
-export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, luaStringToBytes, } from './capabilities.js';
+export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, isNetProviderDenial, luaStringToBytes, netProviderDenial, } from './capabilities.js';
 export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, checkJsonWithinLimits, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
 export { NOT_YET_SUPPORTED_MESSAGE, buildRequireStub } from './require.js';
 export { runScript } from './sandbox.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markii/lua",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Sandboxed Lua 5.4 (wasmoon) execution runtime for Mark's document scripting: an empty-env global whitelist, two-tier capability-gated net/cache/bundle access, instruction-count/wall-clock/memory limits, and depth/size-capped Lua<->JS marshaling.",
   "keywords": [
     "markdown",
@@ -44,8 +44,8 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@markii/bundle": "0.3.1",
-    "@markii/runtime": "0.3.1",
+    "@markii/bundle": "0.5.0",
+    "@markii/runtime": "0.5.0",
     "wasmoon": "^1.16.0"
   }
 }