@questpie/sandbox 3.26.2 → 3.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@questpie/sandbox",
-	"version": "3.26.2",
+	"version": "3.27.0",
 	"private": false,
 	"description": "Hardened isolated-script execution for QUESTPIE",
 	"repository": {
@@ -73,8 +73,8 @@
 		"test": "bun test"
 	},
 	"dependencies": {
-		"@questpie/mcp": "^3.26.2",
-		"questpie": "^3.26.2"
+		"@questpie/mcp": "^3.27.0",
+		"questpie": "^3.27.0"
 	},
 	"devDependencies": {
 		"bun-types": "latest",
@@ -82,6 +82,6 @@
 		"zod": "^4.2.1"
 	},
 	"peerDependencies": {
-		"questpie": "^3.26.2"
+		"questpie": "^3.27.0"
 	}
 }

package/src/guest-bindings.ts

@@ -23,6 +23,23 @@
 /** Transport: send one binding RPC, resolve with its brokered value or reject. */
 export type HostCall = (method: string, args: unknown) => Promise<unknown>;
 
+/** Relay brokered fetch and retain a rejected host call as the fetch error cause. */
+export async function callBrokeredFetch<T>(
+	hostCall: HostCall,
+	request: unknown,
+): Promise<T> {
+	try {
+		return (await hostCall("http.fetch", request)) as T;
+	} catch (error) {
+		throw new TypeError(
+			error instanceof Error ? error.message : String(error),
+			{
+				cause: error,
+			},
+		);
+	}
+}
+
 /**
  * Per-collection access surface. Reads (`find`/`findOne`) are always available;
  * writes (`create`/`update`/`delete`) are dispatched ONLY where the host wires a

package/src/guest-entry.ts

@@ -40,7 +40,7 @@
 
 import nodeProcess from "node:process";
 
-import { buildGuestBindings } from "./guest-bindings.ts";
+import { buildGuestBindings, callBrokeredFetch } from "./guest-bindings.ts";
 
 /** Marker so the supervisor can pick the result line out of guest stdout noise. */
 const RESULT_MARKER = "__QP_SANDBOX_RESULT__";
@@ -336,6 +336,7 @@ function installFetchShim(
 		} catch (e) {
 			throw new TypeError(
 				`Failed to construct fetch request: ${e instanceof Error ? e.message : String(e)}`,
+				{ cause: e },
 			);
 		}
 
@@ -367,12 +368,7 @@ function installFetchShim(
 		// Relay over the existing stdio RPC channel. A structured broker error
 		// (network failure / blocked target / oversize) arrives as a rejected
 		// hostCall — surface it as a fetch-like TypeError, NOT a fake 5xx Response.
-		let value: HttpFetchResponse;
-		try {
-			value = (await hostCall("http.fetch", request)) as HttpFetchResponse;
-		} catch (e) {
-			throw new TypeError(e instanceof Error ? e.message : String(e));
-		}
+		const value = await callBrokeredFetch<HttpFetchResponse>(hostCall, request);
 
 		const status = typeof value?.status === "number" ? value.status : 0;
 		const body = value?.bodyBase64

package/src/guest-runtime-source.ts

@@ -1,5 +1,5 @@
 const GUEST_BINDINGS_IMPORT =
-	'import { buildGuestBindings } from "./guest-bindings.ts";';
+	'import { buildGuestBindings, callBrokeredFetch } from "./guest-bindings.ts";';
 const HTTP_BODY_CAP_MARKER = "__QP_HTTP_FETCH_BODY_CAP_BYTES__";
 
 /** Inline the trusted dependency so the guest entry needs no host path/socket. */