@markii/lua 0.4.0 → 0.5.0

package/dist/capabilities.d.ts

@@ -85,6 +85,10 @@ export interface CapabilityDenial {
 export interface CapabilityDenials {
     last(): CapabilityDenial | undefined;
 }
+/** Construct an `Error` a `NetProvider` throws for a policy denial — see {@link NET_PROVIDER_DENIAL}. */
+export declare function netProviderDenial(message: string): Error;
+/** True when `err` was built by {@link netProviderDenial} — a provider's policy refusal, not a transport failure. */
+export declare function isNetProviderDenial(err: unknown): err is Error;
 /**
  * `Uint8Array` <-> Lua string, byte-for-byte via one JS UTF-16 code unit
  * per byte (Latin-1-style). Lua strings are themselves 8-bit-clean byte

package/dist/capabilities.js

@@ -6,6 +6,37 @@ export const DEFAULT_MAX_FETCH_BYTES = 2_000_000;
 function capabilityError(message) {
     return new Error(`${CAPABILITY_ERROR_TAG}: ${message}`);
 }
+/**
+ * Brand marking an `Error` a {@link NetProvider} throws for a POLICY denial
+ * (an ungranted redirect hop, an over-size body, too many hops, a
+ * credential-bearing redirect) as opposed to a genuine transport failure
+ * (DNS, connection refused). A provider is one layer below `buildCapabilities`'
+ * own grant check, so its throws would otherwise surface as an ordinary
+ * runtime error and be classified `'script-error'`. Marking the throw lets
+ * this module record it on the non-spoofable {@link CapabilityDenials} handle
+ * (see `callNetProvider` below) instead of relying on a message string a
+ * script could read and forge.
+ *
+ * This closes P2-c (PENTEST-REPORT-2026-08-23.md §9.3): the earlier host-side
+ * fix embedded a per-run random tag in the thrown message so the host could
+ * reclassify the failure, but that message crosses back into Lua, where a
+ * script's own `pcall`/`tostring` reads the tag and then forges it. The brand
+ * is a JS `Symbol` checked on the JS side, BEFORE the error ever crosses the
+ * Lua boundary, so nothing a script can observe distinguishes a denial, and
+ * classification no longer depends on any Lua-visible string.
+ */
+const NET_PROVIDER_DENIAL = Symbol('markii.net.provider-denial');
+/** Construct an `Error` a `NetProvider` throws for a policy denial — see {@link NET_PROVIDER_DENIAL}. */
+export function netProviderDenial(message) {
+    return Object.assign(new Error(message), {
+        [NET_PROVIDER_DENIAL]: true,
+    });
+}
+/** True when `err` was built by {@link netProviderDenial} — a provider's policy refusal, not a transport failure. */
+export function isNetProviderDenial(err) {
+    return (err instanceof Error &&
+        err[NET_PROVIDER_DENIAL] === true);
+}
 function describeThrown(err) {
     return err instanceof Error ? err.message : String(err);
 }
@@ -138,6 +169,28 @@ export function buildCapabilities(config) {
         lastDenial = { reason, message };
     }
     const denials = { last: () => lastDenial };
+    /**
+     * Invokes a `NetProvider` method, turning a POLICY denial the provider
+     * throws (marked via `netProviderDenial`) into the same non-spoofable
+     * outcome an in-house grant check produces: recorded on `recordDenial` and
+     * re-thrown as a `capabilityError` carrying the provider's own plain
+     * message. A transport failure (unmarked) is left to propagate untouched,
+     * so it stays a `'script-error'`. This is what lets the host provider stop
+     * smuggling a secret classification tag through the Lua-visible error text
+     * (P2-c — see `netProviderDenial`).
+     */
+    async function callNetProvider(op) {
+        try {
+            return await op();
+        }
+        catch (err) {
+            if (isNetProviderDenial(err)) {
+                recordDenial('denied', err.message);
+                throw capabilityError(err.message);
+            }
+            throw err;
+        }
+    }
     // --- net --------------------------------------------------------------
     // `fetch_json` and `post`/`patch` are gated INDEPENDENTLY of each other
     // (a manifest can grant POST to a host without granting it GET, or vice
@@ -163,7 +216,7 @@ export function buildCapabilities(config) {
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            const res = await config.net.get(url);
+            const res = await callNetProvider(() => config.net.get(url));
             if (res.body.length > maxFetchBytes) {
                 const message = `fetch response for "${url}" exceeds the ${maxFetchBytes}-byte cap`;
                 recordDenial('denied', message);
@@ -235,7 +288,7 @@ net.fetch_json = function(url) return __smd_net_get_json_decode(__smd_net_get(ur
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            const res = await config.net.post(url, body);
+            const res = await callNetProvider(() => config.net.post(url, body));
             // As with `net.fetch_json` above (GitHub issue #6): a plain JS object
             // (even one this shallow) crosses into Lua as a `js_proxy` userdata,
             // not a genuine table. `status`/`body` are both scalars, so instead
@@ -289,7 +342,7 @@ net.post = function(url, body) return __smd_net_post_blocked(url, body):await()
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            const res = await config.net.patch(url, body);
+            const res = await callNetProvider(() => config.net.patch(url, body));
             // Same fix as `net.post` above (GitHub issue #6) — see that block's
             // comment for the full mechanism.
             return LuaMultiReturn.of(res.status, res.body);
@@ -528,7 +581,17 @@ end
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            return data === undefined ? null : bytesToLuaString(data);
+            // Resolve with `undefined`, NOT `null`, for a missing path. wasmoon's
+            // `Thread.pushValue` special-cases `typeof target === 'undefined'`
+            // with a direct `lua_pushnil` BEFORE it ever reaches its
+            // type-extension dispatch loop (`dist/index.js`'s `pushValue`
+            // `switch`); `null` is `typeof 'object'`, so it instead falls into
+            // that loop, where `PromiseTypeExtension.pushValue` unconditionally
+            // reads `decoration.target.then` and throws `Cannot read properties
+            // of null (reading 'then')` — verified empirically (wasmoon 1.16.0).
+            // This is exactly the failure this fixes (GitHub issue #9): a
+            // missing bundle path must resolve to Lua `nil`, not throw.
+            return data === undefined ? undefined : bytesToLuaString(data);
         });
         rawGlobals.__smd_bundle_exists_raw = (async (path) => {
             try {

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { ALLOWED_GLOBALS, DENIED_GLOBALS, createEmptyLuaEngine, } from './global
 export type { LimitHandle, ScriptLimits } from './limits.js';
 export { DEFAULT_LIMITS, installLimits } from './limits.js';
 export type { CacheEntry, CacheProvider, CapabilityConfig, CapabilityDenial, CapabilityDenials, CapabilityTier, NetGrants, NetProvider, NetResponse, } from './capabilities.js';
-export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, luaStringToBytes, } from './capabilities.js';
+export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, isNetProviderDenial, luaStringToBytes, netProviderDenial, } from './capabilities.js';
 export type { MarshalLimits } from './marshal.js';
 export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, checkJsonWithinLimits, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
 export { NOT_YET_SUPPORTED_MESSAGE, buildRequireStub } from './require.js';

package/dist/index.js

@@ -6,7 +6,7 @@
 export { CAPABILITY_ERROR_TAG, FETCH_DECODE_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';
 export { ALLOWED_GLOBALS, DENIED_GLOBALS, createEmptyLuaEngine, } from './globals.js';
 export { DEFAULT_LIMITS, installLimits } from './limits.js';
-export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, luaStringToBytes, } from './capabilities.js';
+export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, isNetProviderDenial, luaStringToBytes, netProviderDenial, } from './capabilities.js';
 export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, checkJsonWithinLimits, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
 export { NOT_YET_SUPPORTED_MESSAGE, buildRequireStub } from './require.js';
 export { runScript } from './sandbox.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markii/lua",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Sandboxed Lua 5.4 (wasmoon) execution runtime for Mark's document scripting: an empty-env global whitelist, two-tier capability-gated net/cache/bundle access, instruction-count/wall-clock/memory limits, and depth/size-capped Lua<->JS marshaling.",
   "keywords": [
     "markdown",
@@ -44,8 +44,8 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@markii/bundle": "0.4.0",
-    "@markii/runtime": "0.4.0",
+    "@markii/bundle": "0.5.0",
+    "@markii/runtime": "0.5.0",
     "wasmoon": "^1.16.0"
   }
 }