@oneuptime/common 12.0.11 → 12.0.13

package/build/dist/Server/Utils/VM/VMRunner.js

@@ -13,272 +13,7 @@ import http from "http";
 import https from "https";
 import ivm from "isolated-vm";
 import CaptureSpan from "../Telemetry/CaptureSpan";
-import vm from "vm";
 import SSRFProtection from "../SSRFProtection";
-/**
- * Symbol used to retrieve the real (unwrapped) target from a sandbox proxy.
- * Hidden from user code via ownKeys / has traps.
- */
-const PROXY_TARGET_SYMBOL = Symbol("sandboxProxyTarget");
-/**
- * Hardening prelude injected before user code in `runCodeInNodeVM`.
- *
- * Node's `vm` module is not a security boundary. The published PoC for
- * GHSA-g9cp-35m2-fjv6 forces a stack-overflow `RangeError`, walks
- * `e.__proto__.__proto__.__proto__` to `Object.prototype`, then reads
- * `.toString.constructor` to obtain a `Function` constructor that compiles
- * code in a realm where `process.binding('spawn_sync')` is reachable.
- *
- * This prelude closes that path by:
- *  - severing `Error.prototype`'s link to `Object.prototype` so the 3-level
- *    walk lands on `null` instead of `Object.prototype`;
- *  - deleting `.constructor` from every built-in prototype, so even a
- *    different walk (e.g. `(0).constructor.constructor`) cannot resolve to a
- *    function constructor;
- *  - clearing `Function` / `eval` from the sandbox global;
- *  - freezing the affected prototypes so user code cannot reattach them.
- *
- * This is a hotfix for the public PoC. The durable fix is to drop
- * `runCodeInNodeVM` in favor of running synthetic monitor scripts in an
- * out-of-process sandbox (tracked on the `probe-runner` branch).
- */
-const VM_HARDENING_PRELUDE = `(() => {
-  const _ctors = [
-    Object, Function, Array, String, Number, Boolean, RegExp,
-    Error, RangeError, TypeError, SyntaxError, ReferenceError, EvalError, URIError,
-    Symbol, Date, Map, Set, WeakMap, WeakSet, Promise, Proxy,
-    ArrayBuffer, DataView,
-    Int8Array, Uint8Array, Uint8ClampedArray,
-    Int16Array, Uint16Array, Int32Array, Uint32Array,
-    Float32Array, Float64Array,
-  ];
-  if (typeof BigInt !== 'undefined') _ctors.push(BigInt);
-
-  for (const C of _ctors) {
-    try { if (C && C.prototype) delete C.prototype.constructor; } catch (_) {}
-  }
-
-  // Generator / async-function prototypes have no named global — reach via syntax.
-  try { delete Object.getPrototypeOf(function*(){}).constructor; } catch (_) {}
-  try { delete Object.getPrototypeOf(async function(){}).constructor; } catch (_) {}
-  try { delete Object.getPrototypeOf(async function*(){}).constructor; } catch (_) {}
-
-  try { Object.setPrototypeOf(Error.prototype, null); } catch (_) {}
-
-  try {
-    Object.defineProperty(globalThis, 'Function', {
-      value: undefined, writable: false, configurable: false,
-    });
-  } catch (_) {}
-  try {
-    Object.defineProperty(globalThis, 'eval', {
-      value: undefined, writable: false, configurable: false,
-    });
-  } catch (_) {}
-
-  for (const C of _ctors) {
-    try { if (C && C.prototype) Object.freeze(C.prototype); } catch (_) {}
-  }
-})();`;
-/** Properties blocked on every host-realm object exposed to the sandbox. */
-const BLOCKED_SANDBOX_PROPERTIES = new Set([
-    "constructor",
-    "__proto__",
-    "prototype",
-    "mainModule",
-    /*
-     * Block Playwright methods that can spawn processes or access internals.
-     * Prevents RCE via browser.browserType().launch({executablePath:"/bin/sh"})
-     * and traversal via page.context().browser().browserType().launch(...)
-     */
-    "browserType", // Browser → BrowserType (which has launch/connect)
-    "_browserType", // Internal alias for browserType — same escape vector
-    "launch", // BrowserType.launch() spawns a child process
-    "launchServer", // BrowserType.launchServer() spawns a browser server process
-    "launchPersistentContext", // BrowserType.launchPersistentContext() spawns a child process
-    "connectOverCDP", // BrowserType.connectOverCDP() connects via Chrome DevTools Protocol
-    "connect", // BrowserType.connect() connects to a remote browser
-    "newCDPSession", // BrowserContext/Page.newCDPSession() opens raw CDP sessions
-]);
-/**
- * Wraps a host-realm value in a Proxy that blocks prototype-chain traversal.
- * Primitives and null/undefined pass through unchanged.
- * Object proxies are cached to preserve identity; function proxies are created
- * per-access so they bind to the correct `this` (parent object).
- */
-function createSandboxProxy(value, cache, parentObj) {
-    if (value === null || value === undefined) {
-        return value;
-    }
-    const valueType = typeof value;
-    if (valueType !== "object" && valueType !== "function") {
-        return value;
-    }
-    const target = value;
-    if (valueType === "function") {
-        /*
-         * Function proxies are NOT cached because the same function may be a method
-         * on different parent objects and needs a different `this` binding each time.
-         */
-        const fnProxy = new Proxy(target, {
-            get(fnTarget, prop) {
-                if (prop === PROXY_TARGET_SYMBOL) {
-                    return fnTarget;
-                }
-                if (typeof prop === "string" &&
-                    BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
-                    return undefined;
-                }
-                const val = Reflect.get(fnTarget, prop, fnTarget);
-                return createSandboxProxy(val, cache, fnTarget);
-            },
-            getPrototypeOf() {
-                return null;
-            },
-            apply(fnTarget, _thisArg, args) {
-                const thisObj = (parentObj ||
-                    fnTarget);
-                try {
-                    const result = Reflect.apply(fnTarget, thisObj, args);
-                    if (result instanceof Promise) {
-                        return result.then((v) => {
-                            return createSandboxProxy(v, cache);
-                        }, (err) => {
-                            throw createSandboxProxy(err, cache);
-                        });
-                    }
-                    return createSandboxProxy(result, cache);
-                }
-                catch (err) {
-                    throw createSandboxProxy(err, cache);
-                }
-            },
-            has(fnTarget, prop) {
-                if (typeof prop === "string" &&
-                    BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
-                    return false;
-                }
-                return Reflect.has(fnTarget, prop);
-            },
-            ownKeys(fnTarget) {
-                return Reflect.ownKeys(fnTarget).filter((k) => {
-                    return !(typeof k === "string" && BLOCKED_SANDBOX_PROPERTIES.has(k));
-                });
-            },
-            getOwnPropertyDescriptor(fnTarget, prop) {
-                if (typeof prop === "string" &&
-                    BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
-                    return undefined;
-                }
-                const desc = Reflect.getOwnPropertyDescriptor(fnTarget, prop);
-                if (desc && "value" in desc) {
-                    desc.value = createSandboxProxy(desc.value, cache, fnTarget);
-                }
-                return desc;
-            },
-        });
-        return fnProxy;
-    }
-    // Object — use cache to preserve identity and handle circular references
-    if (cache.has(target)) {
-        return cache.get(target);
-    }
-    const objProxy = new Proxy(target, {
-        get(objTarget, prop) {
-            if (prop === PROXY_TARGET_SYMBOL) {
-                return objTarget;
-            }
-            if (typeof prop === "string" && BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
-                return undefined;
-            }
-            const val = Reflect.get(objTarget, prop, objTarget);
-            return createSandboxProxy(val, cache, objTarget);
-        },
-        getPrototypeOf() {
-            return null;
-        },
-        set(objTarget, prop, newValue) {
-            return Reflect.set(objTarget, prop, newValue);
-        },
-        has(objTarget, prop) {
-            if (typeof prop === "string" && BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
-                return false;
-            }
-            return Reflect.has(objTarget, prop);
-        },
-        ownKeys(objTarget) {
-            return Reflect.ownKeys(objTarget).filter((k) => {
-                return !(typeof k === "string" && BLOCKED_SANDBOX_PROPERTIES.has(k));
-            });
-        },
-        getOwnPropertyDescriptor(objTarget, prop) {
-            if (typeof prop === "string" && BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
-                return undefined;
-            }
-            const desc = Reflect.getOwnPropertyDescriptor(objTarget, prop);
-            if (desc && "value" in desc) {
-                desc.value = createSandboxProxy(desc.value, cache, objTarget);
-            }
-            return desc;
-        },
-    });
-    cache.set(target, objProxy);
-    return objProxy;
-}
-/**
- * Recursively unwraps sandbox proxies in a return value so the host code
- * receives original objects (e.g. Buffers that pass `instanceof` checks).
- */
-export function deepUnwrapProxies(value, visited) {
-    if (value === null || value === undefined) {
-        return value;
-    }
-    const valueType = typeof value;
-    if (valueType !== "object" && valueType !== "function") {
-        return value;
-    }
-    const obj = value;
-    // If it's one of our proxies, unwrap to the original target
-    try {
-        const underlying = obj[PROXY_TARGET_SYMBOL];
-        if (underlying !== undefined) {
-            return underlying;
-        }
-    }
-    catch (_a) {
-        // Not a proxy or symbol access failed — treat as a plain value
-    }
-    if (!visited) {
-        visited = new WeakSet();
-    }
-    if (visited.has(obj)) {
-        return obj;
-    }
-    visited.add(obj);
-    if (Array.isArray(obj)) {
-        for (let i = 0; i < obj.length; i++) {
-            obj[i] = deepUnwrapProxies(obj[i], visited);
-        }
-    }
-    else if (valueType === "object") {
-        for (const key of Object.keys(obj)) {
-            obj[key] = deepUnwrapProxies(obj[key], visited);
-        }
-    }
-    return obj;
-}
-/**
- * Unwraps a single value if it is a sandbox proxy, otherwise returns it as-is.
- */
-function unwrapProxy(value) {
-    if (value && typeof value === "object") {
-        const underlying = value[PROXY_TARGET_SYMBOL];
-        if (underlying !== undefined) {
-            return underlying;
-        }
-    }
-    return value;
-}
 export default class VMRunner {
     /*
      * Works out which URL the sandbox's axios call will actually dial, so the
@@ -313,188 +48,123 @@ export default class VMRunner {
         }
         return absolute;
     }
-    static async runCodeInNodeVM(data) {
+    static async runCodeInSandbox(data) {
         const { code, options } = data;
         const timeout = options.timeout || 5000;
         const logMessages = [];
-        const MAX_LOG_BYTES = 1000000; // 1MB cap
-        let totalLogBytes = 0;
         const capturedMetrics = [];
         const MAX_METRICS = 100;
-        const pendingTimeouts = [];
-        const pendingIntervals = [];
-        const wrappedSetTimeout = (fn, ms, ...rest) => {
-            const handle = setTimeout(fn, ms, ...rest);
-            pendingTimeouts.push(handle);
-            return handle;
-        };
-        const wrappedClearTimeout = (handle) => {
-            const actual = unwrapProxy(handle);
-            clearTimeout(actual);
-            const idx = pendingTimeouts.indexOf(actual);
-            if (idx !== -1) {
-                pendingTimeouts.splice(idx, 1);
-            }
-        };
-        const wrappedSetInterval = (fn, ms, ...rest) => {
-            const handle = setInterval(fn, ms, ...rest);
-            pendingIntervals.push(handle);
-            return handle;
-        };
-        const wrappedClearInterval = (handle) => {
-            const actual = unwrapProxy(handle);
-            clearInterval(actual);
-            const idx = pendingIntervals.indexOf(actual);
-            if (idx !== -1) {
-                pendingIntervals.splice(idx, 1);
-            }
-        };
-        // Proxy cache shared across all wrapped host objects in this execution
-        const proxyCache = new WeakMap();
-        // Use null-prototype object to break this.constructor chain on the global
-        const sandbox = Object.create(null);
-        sandbox["process"] = Object.freeze(Object.create(null));
-        sandbox["console"] = createSandboxProxy({
-            log: (...args) => {
-                const msg = args.join(" ");
-                totalLogBytes += msg.length;
-                if (totalLogBytes <= MAX_LOG_BYTES) {
-                    logMessages.push(msg);
-                }
-            },
-        }, proxyCache);
-        sandbox["http"] = createSandboxProxy(http, proxyCache);
-        sandbox["https"] = createSandboxProxy(https, proxyCache);
-        sandbox["axios"] = createSandboxProxy(axios, proxyCache);
-        sandbox["crypto"] = createSandboxProxy(crypto, proxyCache);
-        sandbox["setTimeout"] = createSandboxProxy(wrappedSetTimeout, proxyCache);
-        sandbox["clearTimeout"] = createSandboxProxy(wrappedClearTimeout, proxyCache);
-        sandbox["setInterval"] = createSandboxProxy(wrappedSetInterval, proxyCache);
-        sandbox["clearInterval"] = createSandboxProxy(wrappedClearInterval, proxyCache);
-        sandbox["oneuptime"] = createSandboxProxy({
-            captureMetric: (name, value, attributes) => {
-                if (typeof name !== "string" || name.length === 0) {
-                    return;
-                }
-                if (typeof value !== "number" || isNaN(value)) {
-                    return;
-                }
-                if (capturedMetrics.length >= MAX_METRICS) {
-                    return;
+        const MAX_LOG_MESSAGES = 1000;
+        const MAX_LOG_BYTES = 1000000;
+        const MAX_SCRIPT_ERROR_MESSAGE_LENGTH = 10000;
+        let logBytes = 0;
+        const pendingHostTimeouts = new Set();
+        const pendingAxiosControllers = new Set();
+        let acceptingHostOperations = true;
+        const pendingAxiosOperations = new Map();
+        let nextAxiosOperationId = 0;
+        const pendingSleepOperations = new Map();
+        let nextSleepOperationId = 0;
+        const sanitizeScriptError = (error) => {
+            let message = "Sandbox script failed";
+            try {
+                if (typeof error === "string") {
+                    message = error;
                 }
-                const metric = {
-                    name: name.substring(0, 200),
-                    value: value,
-                };
-                if (attributes && typeof attributes === "object") {
-                    const safeAttrs = {};
-                    for (const [k, v] of Object.entries(attributes)) {
-                        if (typeof v === "string" ||
-                            typeof v === "number" ||
-                            typeof v === "boolean") {
-                            safeAttrs[k] = String(v);
-                        }
+                else if (error && typeof error === "object") {
+                    const candidateMessage = error["message"];
+                    if (typeof candidateMessage === "string") {
+                        message = candidateMessage;
                     }
-                    metric.attributes = safeAttrs;
                 }
-                capturedMetrics.push(metric);
-            },
-        }, proxyCache);
-        // Wrap any additional context (e.g. Playwright browser/page objects)
-        if (options.context) {
-            for (const key of Object.keys(options.context)) {
-                const val = options.context[key];
-                sandbox[key] =
-                    typeof val === "string" ? val : createSandboxProxy(val, proxyCache);
             }
-        }
-        if (options.args) {
-            // args is plain JSON data — no host functions to protect against
-            sandbox["args"] = options.args;
-        }
-        vm.createContext(sandbox, {
-            codeGeneration: {
-                strings: false,
-                wasm: false,
-            },
-        });
-        const script = `(async()=>{
-        ${VM_HARDENING_PRELUDE}
-        ${code}
-      })()`;
-        try {
-            let returnVal;
-            let scriptError;
-            try {
-                /*
-                 * vm timeout only covers synchronous CPU time, so wrap with
-                 * Promise.race to also cover async operations (network, timers, etc.)
-                 */
-                const vmPromise = vm.runInContext(script, sandbox, {
-                    timeout: timeout,
-                });
-                const overallTimeout = new Promise((_resolve, reject) => {
-                    const handle = global.setTimeout(() => {
-                        reject(new Error("Script execution timed out"));
-                    }, timeout + 5000);
-                    // Don't let this timer keep the process alive
-                    handle.unref();
-                });
-                returnVal = await Promise.race([vmPromise, overallTimeout]);
+            catch (_a) {
+                // Do not invoke any attacker-controlled coercion while reporting errors.
             }
-            catch (err) {
-                /*
-                 * Capture user-thrown errors (including timeouts) so the caller can
-                 * still access side-channel data collected before the throw — e.g.
-                 * screenshots assigned to a host-realm object passed via `context`.
-                 * Rethrowing here would discard those partial results.
-                 */
-                scriptError =
-                    err instanceof Error
-                        ? err
-                        : new Error(typeof err === "string" ? err : String(err));
-            }
-            return {
-                returnValue: deepUnwrapProxies(returnVal),
-                logMessages,
-                capturedMetrics,
-                scriptError,
-            };
-        }
-        finally {
-            // Clean up any lingering timers to prevent resource leaks
-            for (const handle of pendingTimeouts) {
-                clearTimeout(handle);
+            let sanitizedMessage = "";
+            for (const character of message) {
+                const characterCode = character.charCodeAt(0);
+                if (characterCode === 9 ||
+                    characterCode === 10 ||
+                    characterCode === 13 ||
+                    (characterCode >= 32 && characterCode !== 127)) {
+                    sanitizedMessage += character;
+                }
+                if (sanitizedMessage.length >= MAX_SCRIPT_ERROR_MESSAGE_LENGTH) {
+                    break;
+                }
             }
-            for (const handle of pendingIntervals) {
-                clearInterval(handle);
+            message = sanitizedMessage.substring(0, MAX_SCRIPT_ERROR_MESSAGE_LENGTH);
+            if (!message) {
+                message = "Sandbox script failed";
             }
-        }
-    }
-    static async runCodeInSandbox(data) {
-        const { code, options } = data;
-        const timeout = options.timeout || 5000;
-        const logMessages = [];
-        const capturedMetrics = [];
-        const MAX_METRICS = 100;
+            /*
+             * Deliberately create a fresh host Error so isolate-owned properties and
+             * stack frames never escape with the result.
+             */
+            return new Error(message);
+        };
         const isolate = new ivm.Isolate({ memoryLimit: 128 });
         try {
             const context = await isolate.createContext();
             const jail = context.global;
             // Set up global object
             await jail.set("global", jail.derefInto());
-            // console.log - fire-and-forget callback
-            await jail.set("_log", new ivm.Callback((...args) => {
-                logMessages.push(args.join(" "));
-            }));
+            /*
+             * Callback values become ordinary functions in the destination isolate.
+             * Never expose ivm.Reference or ivm.ExternalCopy handles to user code:
+             * their prototype methods can be used to cross the isolate boundary.
+             */
+            await jail.set("__oneuptimeHostLogCallback", new ivm.Callback((message) => {
+                if (logMessages.length >= MAX_LOG_MESSAGES) {
+                    return;
+                }
+                const messageBytes = Buffer.byteLength(message, "utf8");
+                if (logBytes + messageBytes > MAX_LOG_BYTES) {
+                    return;
+                }
+                logBytes += messageBytes;
+                logMessages.push(message);
+            }, { sync: true }));
             await context.eval(`
-        const console = { log: (...a) => _log(...a.map(v => {
-          try { return typeof v === 'object' ? JSON.stringify(v) : String(v); }
-          catch(_) { return String(v); }
-        }))};
+        (() => {
+          const hostLog = globalThis.__oneuptimeHostLogCallback;
+          delete globalThis.__oneuptimeHostLogCallback;
+          let sandboxLogCount = 0;
+          let sandboxLogCharacters = 0;
+
+          const sandboxConsole = Object.freeze({
+            log: (...args) => {
+              if (sandboxLogCount >= 1000 || sandboxLogCharacters >= 500000) {
+                return;
+              }
+
+              const message = args.map(value => {
+                try {
+                  return typeof value === 'object' ? JSON.stringify(value) : String(value);
+                } catch (_) {
+                  return String(value);
+                }
+              }).join(' ').substring(0, 250000);
+
+              if (sandboxLogCharacters + message.length > 500000) {
+                return;
+              }
+
+              sandboxLogCount += 1;
+              sandboxLogCharacters += message.length;
+              hostLog(message);
+            }
+          });
+
+          Object.defineProperty(globalThis, 'console', {
+            value: sandboxConsole,
+            writable: false,
+            configurable: false,
+          });
+        })();
       `);
-            // oneuptime.captureMetric - fire-and-forget callback
-            await jail.set("_captureMetric", new ivm.Callback((name, value, attributesJson) => {
+            await jail.set("__oneuptimeHostMetricCallback", new ivm.Callback((name, value, attributesJson) => {
                 if (capturedMetrics.length >= MAX_METRICS) {
                     return;
                 }
@@ -515,25 +185,43 @@ export default class VMRunner {
                     }
                 }
                 capturedMetrics.push(metric);
-            }));
+            }, { sync: true }));
             await context.eval(`
-        const oneuptime = {
-          captureMetric: (name, value, attributes) => {
-            if (typeof name !== 'string' || name.length === 0) return;
-            if (typeof value !== 'number' || isNaN(value)) return;
-            const attrJson = attributes ? JSON.stringify(attributes) : undefined;
-            _captureMetric(String(name), String(value), attrJson);
-          }
-        };
+        (() => {
+          const hostCaptureMetric = globalThis.__oneuptimeHostMetricCallback;
+          delete globalThis.__oneuptimeHostMetricCallback;
+
+          const sandboxOneUptime = Object.freeze({
+            captureMetric: (name, value, attributes) => {
+              if (typeof name !== 'string' || name.length === 0) return;
+              if (typeof value !== 'number' || isNaN(value)) return;
+              const attrJson = attributes ? JSON.stringify(attributes) : undefined;
+              hostCaptureMetric(String(name), String(value), attrJson);
+            }
+          });
+
+          Object.defineProperty(globalThis, 'oneuptime', {
+            value: sandboxOneUptime,
+            writable: false,
+            configurable: false,
+          });
+        })();
       `);
             // args - deep copy into isolate
-            if (options.args) {
-                await jail.set("_args", new ivm.ExternalCopy(options.args).copyInto());
-                await context.eval("const args = _args;");
-            }
-            else {
-                await context.eval("const args = {};");
-            }
+            await jail.set("__oneuptimeCopiedArgs", options.args || {}, {
+                copy: true,
+            });
+            await context.eval(`
+        (() => {
+          const copiedArgs = globalThis.__oneuptimeCopiedArgs;
+          delete globalThis.__oneuptimeCopiedArgs;
+          Object.defineProperty(globalThis, 'args', {
+            value: copiedArgs,
+            writable: false,
+            configurable: false,
+          });
+        })();
+      `);
             /*
              * http / https - provide Agent constructors that serialize across the boundary.
              * The sandbox Agent is a plain object with a marker; the host-side axios bridge
@@ -559,13 +247,13 @@ export default class VMRunner {
       `);
             /*
              * axios (get, head, options, post, put, patch, delete, request)
-             * bridged via applySyncPromise.
+             * bridged through a copied async callback.
              *
              * For GET/HEAD/OPTIONS/DELETE: args = [method, url, configJson?]
              * For POST/PUT/PATCH:         args = [method, url, bodyJson?, configJson?]
              * For REQUEST:                args = ['request', '', configJson]
              */
-            const axiosRef = new ivm.Reference(async (method, url, arg1, arg2) => {
+            const executeAxiosRequest = async (signal, method, url, arg1, arg2) => {
                 const methodsWithBody = ["post", "put", "patch"];
                 const hasBody = methodsWithBody.includes(method);
                 /*
@@ -640,6 +328,11 @@ export default class VMRunner {
                 delete safeConfig["transport"];
                 delete safeConfig["adapter"];
                 safeConfig["maxRedirects"] = 0;
+                Object.defineProperty(safeConfig, "signal", {
+                    value: signal,
+                    enumerable: true,
+                    configurable: true,
+                });
                 config = safeConfig;
                 try {
                     let response;
@@ -702,10 +395,86 @@ export default class VMRunner {
                     }
                     throw err;
                 }
-            });
-            await jail.set("_axiosRef", axiosRef);
+            };
+            const axiosStartCallback = new ivm.Callback((method, url, arg1, arg2) => {
+                const operationId = String(++nextAxiosOperationId);
+                if (!acceptingHostOperations) {
+                    return operationId;
+                }
+                if (pendingAxiosOperations.size >= 100) {
+                    pendingAxiosOperations.set(operationId, {
+                        status: "rejected",
+                        errorMessage: "Too many pending HTTP requests",
+                    });
+                    return operationId;
+                }
+                pendingAxiosOperations.set(operationId, { status: "pending" });
+                const abortController = new AbortController();
+                pendingAxiosControllers.add(abortController);
+                void executeAxiosRequest(abortController.signal, method, url, arg1, arg2)
+                    .then((value) => {
+                    if (pendingAxiosOperations.has(operationId)) {
+                        pendingAxiosOperations.set(operationId, {
+                            status: "fulfilled",
+                            value,
+                        });
+                    }
+                }, (error) => {
+                    if (pendingAxiosOperations.has(operationId)) {
+                        pendingAxiosOperations.set(operationId, {
+                            status: "rejected",
+                            errorMessage: sanitizeScriptError(error).message,
+                        });
+                    }
+                })
+                    .finally(() => {
+                    pendingAxiosControllers.delete(abortController);
+                });
+                return operationId;
+            }, { async: true });
+            const axiosPollCallback = new ivm.Callback((operationId) => {
+                const operation = pendingAxiosOperations.get(operationId);
+                if (!operation) {
+                    return JSON.stringify({
+                        status: "rejected",
+                        errorMessage: "HTTP request result is unavailable",
+                    });
+                }
+                if (operation.status !== "pending") {
+                    pendingAxiosOperations.delete(operationId);
+                }
+                return JSON.stringify(operation);
+            }, { async: true });
+            await jail.set("__oneuptimeHostAxiosStartCallback", axiosStartCallback);
+            await jail.set("__oneuptimeHostAxiosPollCallback", axiosPollCallback);
             await context.eval(`
-        function _assertNoFunctions(obj, path) {
+        (() => {
+        const hostAxiosStart = globalThis.__oneuptimeHostAxiosStartCallback;
+        const hostAxiosPoll = globalThis.__oneuptimeHostAxiosPollCallback;
+        delete globalThis.__oneuptimeHostAxiosStartCallback;
+        delete globalThis.__oneuptimeHostAxiosPollCallback;
+        const axiosPollWaitArray = new Int32Array(new SharedArrayBuffer(4));
+
+        async function hostAxios(method, url, arg1, arg2) {
+          const operationId = await hostAxiosStart(method, url, arg1, arg2);
+
+          while (true) {
+            const operation = JSON.parse(await hostAxiosPoll(operationId));
+
+            if (operation.status === 'pending') {
+              Atomics.wait(axiosPollWaitArray, 0, 0, 1);
+              continue;
+            }
+
+            if (operation.status === 'rejected') {
+              throw new Error(operation.errorMessage);
+            }
+
+            return operation.value;
+          }
+        }
+
+        function assertNoFunctions(obj, path) {
           if (!obj || typeof obj !== 'object') return;
           if (Array.isArray(obj)) {
             for (let i = 0; i < obj.length; i++) {
@@ -717,7 +486,7 @@ export default class VMRunner {
                 );
               }
               if (obj[i] && typeof obj[i] === 'object') {
-                _assertNoFunctions(obj[i], fullPath);
+                assertNoFunctions(obj[i], fullPath);
               }
             }
             return;
@@ -731,12 +500,12 @@ export default class VMRunner {
               );
             }
             if (obj[key] && typeof obj[key] === 'object') {
-              _assertNoFunctions(obj[key], fullPath);
+              assertNoFunctions(obj[key], fullPath);
             }
           }
         }
 
-        function _parseAxiosResult(r) {
+        function parseAxiosResult(r) {
           const parsed = JSON.parse(r);
           if (parsed && parsed.__isAxiosError) {
             const err = new Error(parsed.message);
@@ -753,7 +522,7 @@ export default class VMRunner {
           return parsed;
         }
 
-        function _makeAxiosInstance(defaults) {
+        function makeAxiosInstance(defaults) {
           function mergeConfig(overrides) {
             if (!defaults && !overrides) return undefined;
             if (!defaults) return overrides;
@@ -767,9 +536,9 @@ export default class VMRunner {
 
           async function _request(config) {
             const merged = mergeConfig(config);
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['request', '', merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('request', '', merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           }
 
           // Make instance callable: axios(config) or axios(url, config)
@@ -783,62 +552,67 @@ export default class VMRunner {
           instance.request = _request;
           instance.get = async (url, config) => {
             const merged = mergeConfig(config);
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['get', url, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('get', url, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.head = async (url, config) => {
             const merged = mergeConfig(config);
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['head', url, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('head', url, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.options = async (url, config) => {
             const merged = mergeConfig(config);
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['options', url, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('options', url, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.post = async (url, data, config) => {
             const merged = mergeConfig(config);
-            if (data) _assertNoFunctions(data, 'data');
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['post', url, data ? JSON.stringify(data) : undefined, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (data) assertNoFunctions(data, 'data');
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('post', url, data ? JSON.stringify(data) : undefined, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.put = async (url, data, config) => {
             const merged = mergeConfig(config);
-            if (data) _assertNoFunctions(data, 'data');
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['put', url, data ? JSON.stringify(data) : undefined, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (data) assertNoFunctions(data, 'data');
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('put', url, data ? JSON.stringify(data) : undefined, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.patch = async (url, data, config) => {
             const merged = mergeConfig(config);
-            if (data) _assertNoFunctions(data, 'data');
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['patch', url, data ? JSON.stringify(data) : undefined, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (data) assertNoFunctions(data, 'data');
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('patch', url, data ? JSON.stringify(data) : undefined, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.delete = async (url, config) => {
             const merged = mergeConfig(config);
-            if (merged) _assertNoFunctions(merged, 'config');
-            const r = await _axiosRef.applySyncPromise(undefined, ['delete', url, merged ? JSON.stringify(merged) : undefined]);
-            return _parseAxiosResult(r);
+            if (merged) assertNoFunctions(merged, 'config');
+            const r = await hostAxios('delete', url, merged ? JSON.stringify(merged) : undefined);
+            return parseAxiosResult(r);
           };
           instance.create = (instanceDefaults) => {
-            if (instanceDefaults) _assertNoFunctions(instanceDefaults, 'defaults');
+            if (instanceDefaults) assertNoFunctions(instanceDefaults, 'defaults');
             const combinedDefaults = mergeConfig(instanceDefaults);
-            return _makeAxiosInstance(combinedDefaults);
+            return makeAxiosInstance(combinedDefaults);
           };
 
           return instance;
         }
 
-        const axios = _makeAxiosInstance(null);
+        Object.defineProperty(globalThis, 'axios', {
+          value: makeAxiosInstance(null),
+          writable: false,
+          configurable: false,
+        });
+        })();
       `);
-            // crypto (createHash, createHmac, randomBytes, randomUUID, randomInt) - bridged via applySync
-            const cryptoRef = new ivm.Reference((op, ...args) => {
+            // crypto (createHash, createHmac, randomBytes, randomUUID, randomInt)
+            const cryptoCallback = new ivm.Callback((op, ...args) => {
                 switch (op) {
                     case "createHash": {
                         const [algorithm, inputData, encoding] = args;
@@ -868,47 +642,138 @@ export default class VMRunner {
                     default:
                         throw new Error(`Unsupported crypto operation: ${op}`);
                 }
-            });
-            await jail.set("_cryptoRef", cryptoRef);
+            }, { sync: true });
+            await jail.set("__oneuptimeHostCryptoCallback", cryptoCallback);
             await context.eval(`
-        const crypto = {
+        (() => {
+        const hostCrypto = globalThis.__oneuptimeHostCryptoCallback;
+        delete globalThis.__oneuptimeHostCryptoCallback;
+
+        const sandboxCrypto = {
           createHash: (algorithm) => ({
             _alg: algorithm, _data: '',
             update(d) { this._data = d; return this; },
-            digest(enc) { return _cryptoRef.applySync(undefined, ['createHash', this._alg, this._data, enc || 'hex']); }
+            digest(enc) { return hostCrypto('createHash', this._alg, this._data, enc || 'hex'); }
           }),
           createHmac: (algorithm, key) => ({
             _alg: algorithm, _key: key, _data: '',
             update(d) { this._data = d; return this; },
-            digest(enc) { return _cryptoRef.applySync(undefined, ['createHmac', this._alg, this._key, this._data, enc || 'hex']); }
+            digest(enc) { return hostCrypto('createHmac', this._alg, this._key, this._data, enc || 'hex'); }
           }),
           randomBytes: (size) => ({
-            toString(enc) { return _cryptoRef.applySync(undefined, ['randomBytes', String(size)]); }
+            toString(enc) { return hostCrypto('randomBytes', String(size)); }
           }),
           randomUUID: () => {
-            return _cryptoRef.applySync(undefined, ['randomUUID']);
+            return hostCrypto('randomUUID');
           },
           randomInt: (minOrMax, max) => {
             if (max === undefined) { max = minOrMax; minOrMax = 0; }
-            return Number(_cryptoRef.applySync(undefined, ['randomInt', String(minOrMax), String(max)]));
+            return Number(hostCrypto('randomInt', String(minOrMax), String(max)));
           },
         };
+
+        Object.defineProperty(globalThis, 'crypto', {
+          value: sandboxCrypto,
+          writable: false,
+          configurable: false,
+        });
+        })();
       `);
-            // setTimeout / sleep - bridged via applySyncPromise
-            const sleepRef = new ivm.Reference((ms) => {
-                return new Promise((resolve) => {
-                    global.setTimeout(resolve, Math.min(ms, timeout));
+            // setTimeout / sleep - bridged through copied start/poll callbacks
+            const sleepStartCallback = new ivm.Callback((ms) => {
+                const operationId = String(++nextSleepOperationId);
+                if (!acceptingHostOperations) {
+                    return operationId;
+                }
+                const numericDelay = Number(ms);
+                const boundedDelay = Number.isFinite(numericDelay)
+                    ? Math.max(0, Math.min(numericDelay, timeout))
+                    : 0;
+                const timeoutHandle = global.setTimeout(() => {
+                    const operation = pendingSleepOperations.get(operationId);
+                    if (operation) {
+                        operation.settled = true;
+                    }
+                    pendingHostTimeouts.delete(timeoutHandle);
+                }, boundedDelay);
+                pendingHostTimeouts.add(timeoutHandle);
+                pendingSleepOperations.set(operationId, {
+                    settled: false,
                 });
-            });
-            await jail.set("_sleepRef", sleepRef);
+                return operationId;
+            }, { async: true });
+            const sleepPollCallback = new ivm.Callback((operationId) => {
+                const operation = pendingSleepOperations.get(operationId);
+                if (!operation || operation.settled) {
+                    pendingSleepOperations.delete(operationId);
+                    return true;
+                }
+                return false;
+            }, { async: true });
+            await jail.set("__oneuptimeHostSleepStartCallback", sleepStartCallback);
+            await jail.set("__oneuptimeHostSleepPollCallback", sleepPollCallback);
             await context.eval(`
-        function setTimeout(fn, ms) {
-          _sleepRef.applySyncPromise(undefined, [ms || 0]);
-          if (typeof fn === 'function') fn();
-        }
-        async function sleep(ms) {
-          await _sleepRef.applySyncPromise(undefined, [ms || 0]);
-        }
+        (() => {
+          const hostSleepStart = globalThis.__oneuptimeHostSleepStartCallback;
+          const hostSleepPoll = globalThis.__oneuptimeHostSleepPollCallback;
+          delete globalThis.__oneuptimeHostSleepStartCallback;
+          delete globalThis.__oneuptimeHostSleepPollCallback;
+          const activeTimers = new WeakSet();
+          const pollWaitArray = new Int32Array(new SharedArrayBuffer(4));
+
+          async function hostSleep(ms) {
+            const operationId = await hostSleepStart(ms || 0);
+
+            while (!(await hostSleepPoll(operationId))) {
+              // Pace polling on the isolate worker without blocking Node's
+              // event loop.
+              Atomics.wait(pollWaitArray, 0, 0, 1);
+            }
+          }
+
+          function sandboxSetTimeout(fn, ms, ...args) {
+            if (typeof fn !== 'function') {
+              throw new TypeError('setTimeout callback must be a function');
+            }
+
+            const handle = {};
+            activeTimers.add(handle);
+            hostSleep(ms || 0).then(() => {
+              if (activeTimers.delete(handle)) {
+                fn(...args);
+              }
+            });
+            return handle;
+          }
+
+          function sandboxClearTimeout(handle) {
+            if (handle && typeof handle === 'object') {
+              activeTimers.delete(handle);
+            }
+          }
+
+          async function sandboxSleep(ms) {
+            await hostSleep(ms || 0);
+          }
+
+          Object.defineProperties(globalThis, {
+            setTimeout: {
+              value: sandboxSetTimeout,
+              writable: false,
+              configurable: false,
+            },
+            clearTimeout: {
+              value: sandboxClearTimeout,
+              writable: false,
+              configurable: false,
+            },
+            sleep: {
+              value: sandboxSleep,
+              writable: false,
+              configurable: false,
+            },
+          });
+        })();
       `);
             /*
              * Wrap user code in async IIFE. JSON.stringify the return value inside
@@ -923,20 +788,26 @@ export default class VMRunner {
         try { return JSON.stringify(__result); }
         catch(_) { return undefined; }
       })()`;
-            // Run with overall timeout covering both CPU and I/O wait
-            const resultPromise = context.eval(wrappedCode, {
-                promise: true,
-                timeout: timeout,
-            });
-            const overallTimeout = new Promise((_resolve, reject) => {
-                global.setTimeout(() => {
-                    reject(new Error("Script execution timed out"));
-                }, timeout + 5000); // 5s grace period beyond isolate timeout
-            });
-            const result = await Promise.race([
-                resultPromise,
-                overallTimeout,
-            ]);
+            let result;
+            let scriptError;
+            try {
+                // Run with overall timeout covering both CPU and I/O wait.
+                const resultPromise = context.eval(wrappedCode, {
+                    promise: true,
+                    timeout: timeout,
+                });
+                const overallTimeout = new Promise((_resolve, reject) => {
+                    const timeoutHandle = global.setTimeout(() => {
+                        pendingHostTimeouts.delete(timeoutHandle);
+                        reject(new Error("Script execution timed out"));
+                    }, timeout + 5000); // 5s grace period beyond isolate timeout
+                    pendingHostTimeouts.add(timeoutHandle);
+                });
+                result = await Promise.race([resultPromise, overallTimeout]);
+            }
+            catch (error) {
+                scriptError = sanitizeScriptError(error);
+            }
             // Parse the JSON string returned from inside the isolate
             let returnValue;
             if (typeof result === "string") {
@@ -954,21 +825,27 @@ export default class VMRunner {
                 returnValue,
                 logMessages,
                 capturedMetrics,
+                scriptError,
             };
         }
         finally {
+            acceptingHostOperations = false;
+            for (const timeoutHandle of pendingHostTimeouts) {
+                global.clearTimeout(timeoutHandle);
+            }
+            for (const abortController of pendingAxiosControllers) {
+                abortController.abort();
+            }
+            pendingHostTimeouts.clear();
+            pendingAxiosControllers.clear();
+            pendingSleepOperations.clear();
+            pendingAxiosOperations.clear();
             if (!isolate.isDisposed) {
                 isolate.dispose();
             }
         }
     }
 }
-__decorate([
-    CaptureSpan(),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
-    __metadata("design:returntype", Promise)
-], VMRunner, "runCodeInNodeVM", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),