@secure-exec/core 0.1.0-rc.4 → 0.1.1-rc.1

package/dist/bridge/child-process.js

@@ -376,13 +376,8 @@ function execSync(command, options) {
     }
     // Default maxBuffer 1MB (Node.js convention)
     const maxBuffer = opts.maxBuffer ?? 1024 * 1024;
-    // Use synchronous bridge call - result is JSON string
-    const jsonResult = _childProcessSpawnSync.applySyncPromise(undefined, [
-        "bash",
-        JSON.stringify(["-c", command]),
-        JSON.stringify({ cwd: opts.cwd, env: opts.env, maxBuffer }),
-    ]);
-    const result = JSON.parse(jsonResult);
+    // Use synchronous bridge call
+    const result = _childProcessSpawnSync("bash", JSON.stringify(["-c", command]), JSON.stringify({ cwd: opts.cwd, env: opts.env, maxBuffer }));
     if (result.maxBufferExceeded) {
         const err = new Error("stdout maxBuffer length exceeded");
         err.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
@@ -423,11 +418,7 @@ function spawn(command, args, options) {
         // This ensures process.chdir() changes are reflected in child processes
         const effectiveCwd = opts.cwd ?? (typeof process !== "undefined" ? process.cwd() : "/");
         // Streaming mode - spawn immediately
-        const sessionId = _childProcessSpawnStart.applySync(undefined, [
-            command,
-            JSON.stringify(argsArray),
-            JSON.stringify({ cwd: effectiveCwd, env: opts.env }),
-        ]);
+        const sessionId = _childProcessSpawnStart(command, JSON.stringify(argsArray), JSON.stringify({ cwd: effectiveCwd, env: opts.env }));
         activeChildren.set(sessionId, child);
         // Register handle to keep sandbox alive until child exits
         // See: docs-internal/node/ACTIVE_HANDLES.md
@@ -439,12 +430,12 @@ function spawn(command, args, options) {
             if (typeof _childProcessStdinWrite === "undefined")
                 return false;
             const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
-            _childProcessStdinWrite.applySync(undefined, [sessionId, bytes]);
+            _childProcessStdinWrite(sessionId, bytes);
             return true;
         };
         child.stdin.end = () => {
             if (typeof _childProcessStdinClose !== "undefined") {
-                _childProcessStdinClose.applySync(undefined, [sessionId]);
+                _childProcessStdinClose(sessionId);
             }
             child.stdin.writable = false;
         };
@@ -457,7 +448,7 @@ function spawn(command, args, options) {
                 : signal === "SIGINT" || signal === 2
                     ? 2
                     : 15;
-            _childProcessKill.applySync(undefined, [sessionId, sig]);
+            _childProcessKill(sessionId, sig);
             child.killed = true;
             child.signalCode = (typeof signal === "string" ? signal : "SIGTERM");
             return true;
@@ -501,13 +492,8 @@ function spawnSync(command, args, options) {
         const effectiveCwd = opts.cwd ?? (typeof process !== "undefined" ? process.cwd() : "/");
         // Pass maxBuffer through to host for enforcement
         const maxBuffer = opts.maxBuffer;
-        // Args passed as JSON string for transferability
-        const jsonResult = _childProcessSpawnSync.applySyncPromise(undefined, [
-            command,
-            JSON.stringify(argsArray),
-            JSON.stringify({ cwd: effectiveCwd, env: opts.env, maxBuffer }),
-        ]);
-        const result = JSON.parse(jsonResult);
+        // Args and options passed as JSON strings for transferability
+        const result = _childProcessSpawnSync(command, JSON.stringify(argsArray), JSON.stringify({ cwd: effectiveCwd, env: opts.env, maxBuffer }));
         const stdoutBuf = typeof Buffer !== "undefined" ? Buffer.from(result.stdout) : result.stdout;
         const stderrBuf = typeof Buffer !== "undefined" ? Buffer.from(result.stderr) : result.stderr;
         if (result.maxBufferExceeded) {

package/dist/bridge/fs.js

@@ -919,13 +919,13 @@ const fs = {
         try {
             if (encoding) {
                 // Text mode - use text read
-                const content = _fs.readFile.applySyncPromise(undefined, [pathStr]);
+                const content = _fs.readFile(pathStr);
                 return content;
             }
             else {
-                // Binary mode - use binary read with base64 encoding
-                const base64Content = _fs.readFileBinary.applySyncPromise(undefined, [pathStr]);
-                return Buffer.from(base64Content, "base64");
+                // Binary mode - host returns raw Uint8Array via MessagePack bin
+                const binaryData = _fs.readFileBinary(pathStr);
+                return Buffer.from(binaryData);
             }
         }
         catch (err) {
@@ -952,17 +952,16 @@ const fs = {
         if (typeof data === "string") {
             // Text mode - use text write
             // Return the result so async callers (fs.promises) can await it.
-            return _fs.writeFile.applySyncPromise(undefined, [pathStr, data]);
+            return _fs.writeFile(pathStr, data);
         }
         else if (ArrayBuffer.isView(data)) {
-            // Binary mode - convert to base64 and use binary write
+            // Binary mode - send raw Uint8Array via MessagePack bin
             const uint8 = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-            const base64 = Buffer.from(uint8).toString("base64");
-            return _fs.writeFileBinary.applySyncPromise(undefined, [pathStr, base64]);
+            return _fs.writeFileBinary(pathStr, uint8);
         }
         else {
             // Fallback to text mode
-            return _fs.writeFile.applySyncPromise(undefined, [pathStr, String(data)]);
+            return _fs.writeFile(pathStr, String(data));
         }
     },
     appendFileSync(path, data, options) {
@@ -975,9 +974,9 @@ const fs = {
     readdirSync(path, options) {
         const rawPath = toPathString(path);
         const pathStr = rawPath;
-        let entriesJson;
+        let entries;
         try {
-            entriesJson = _fs.readDir.applySyncPromise(undefined, [pathStr]);
+            entries = _fs.readDir(pathStr);
         }
         catch (err) {
             // Convert "entry not found" and similar errors to proper ENOENT
@@ -987,7 +986,6 @@ const fs = {
             }
             throw err;
         }
-        const entries = JSON.parse(entriesJson);
         if (options?.withFileTypes) {
             return entries.map((e) => new Dirent(e.name, e.isDirectory, rawPath));
         }
@@ -997,12 +995,12 @@ const fs = {
         const rawPath = toPathString(path);
         const pathStr = rawPath;
         const recursive = typeof options === "object" ? options?.recursive ?? false : false;
-        _fs.mkdir.applySyncPromise(undefined, [pathStr, recursive]);
+        _fs.mkdir(pathStr, recursive);
         return recursive ? rawPath : undefined;
     },
     rmdirSync(path, _options) {
         const pathStr = toPathString(path);
-        _fs.rmdir.applySyncPromise(undefined, [pathStr]);
+        _fs.rmdir(pathStr);
     },
     rmSync(path, options) {
         const pathStr = toPathString(path);
@@ -1042,14 +1040,14 @@ const fs = {
     },
     existsSync(path) {
         const pathStr = toPathString(path);
-        return _fs.exists.applySyncPromise(undefined, [pathStr]);
+        return _fs.exists(pathStr);
     },
     statSync(path, _options) {
         const rawPath = toPathString(path);
         const pathStr = rawPath;
-        let statJson;
+        let stat;
         try {
-            statJson = _fs.stat.applySyncPromise(undefined, [pathStr]);
+            stat = _fs.stat(pathStr);
         }
         catch (err) {
             // Convert various "not found" errors to proper ENOENT
@@ -1062,23 +1060,21 @@ const fs = {
             }
             throw err;
         }
-        const stat = JSON.parse(statJson);
         return new Stats(stat);
     },
     lstatSync(path, _options) {
         const pathStr = toPathString(path);
-        const statJson = bridgeCall(() => _fs.lstat.applySyncPromise(undefined, [pathStr]), "lstat", pathStr);
-        const stat = JSON.parse(statJson);
+        const stat = bridgeCall(() => _fs.lstat(pathStr), "lstat", pathStr);
         return new Stats(stat);
     },
     unlinkSync(path) {
         const pathStr = toPathString(path);
-        _fs.unlink.applySyncPromise(undefined, [pathStr]);
+        _fs.unlink(pathStr);
     },
     renameSync(oldPath, newPath) {
         const oldPathStr = toPathString(oldPath);
         const newPathStr = toPathString(newPath);
-        _fs.rename.applySyncPromise(undefined, [oldPathStr, newPathStr]);
+        _fs.rename(oldPathStr, newPathStr);
     },
     copyFileSync(src, dest, _mode) {
         // readFileSync and writeFileSync already normalize paths
@@ -1340,35 +1336,35 @@ const fs = {
     chmodSync(path, mode) {
         const pathStr = toPathString(path);
         const modeNum = typeof mode === "string" ? parseInt(mode, 8) : mode;
-        bridgeCall(() => _fs.chmod.applySyncPromise(undefined, [pathStr, modeNum]), "chmod", pathStr);
+        bridgeCall(() => _fs.chmod(pathStr, modeNum), "chmod", pathStr);
     },
     chownSync(path, uid, gid) {
         const pathStr = toPathString(path);
-        bridgeCall(() => _fs.chown.applySyncPromise(undefined, [pathStr, uid, gid]), "chown", pathStr);
+        bridgeCall(() => _fs.chown(pathStr, uid, gid), "chown", pathStr);
     },
     linkSync(existingPath, newPath) {
         const existingStr = toPathString(existingPath);
         const newStr = toPathString(newPath);
-        bridgeCall(() => _fs.link.applySyncPromise(undefined, [existingStr, newStr]), "link", newStr);
+        bridgeCall(() => _fs.link(existingStr, newStr), "link", newStr);
     },
     symlinkSync(target, path, _type) {
         const targetStr = toPathString(target);
         const pathStr = toPathString(path);
-        bridgeCall(() => _fs.symlink.applySyncPromise(undefined, [targetStr, pathStr]), "symlink", pathStr);
+        bridgeCall(() => _fs.symlink(targetStr, pathStr), "symlink", pathStr);
     },
     readlinkSync(path, _options) {
         const pathStr = toPathString(path);
-        return bridgeCall(() => _fs.readlink.applySyncPromise(undefined, [pathStr]), "readlink", pathStr);
+        return bridgeCall(() => _fs.readlink(pathStr), "readlink", pathStr);
     },
     truncateSync(path, len) {
         const pathStr = toPathString(path);
-        bridgeCall(() => _fs.truncate.applySyncPromise(undefined, [pathStr, len ?? 0]), "truncate", pathStr);
+        bridgeCall(() => _fs.truncate(pathStr, len ?? 0), "truncate", pathStr);
     },
     utimesSync(path, atime, mtime) {
         const pathStr = toPathString(path);
         const atimeNum = typeof atime === "number" ? atime : new Date(atime).getTime() / 1000;
         const mtimeNum = typeof mtime === "number" ? mtime : new Date(mtime).getTime() / 1000;
-        bridgeCall(() => _fs.utimes.applySyncPromise(undefined, [pathStr, atimeNum, mtimeNum]), "utimes", pathStr);
+        bridgeCall(() => _fs.utimes(pathStr, atimeNum, mtimeNum), "utimes", pathStr);
     },
     // Async methods - wrap sync methods in callbacks/promises
     //

package/dist/bridge/module.js

@@ -78,10 +78,7 @@ export function createRequire(filename) {
     };
     // Create resolve function
     const resolve = function (request, _options) {
-        const resolved = _resolveModule.applySyncPromise(undefined, [
-            request,
-            dirname,
-        ]);
+        const resolved = _resolveModule(request, dirname);
         if (resolved === null) {
             const err = new Error("Cannot find module '" + request + "'");
             err.code = "MODULE_NOT_FOUND";
@@ -155,10 +152,7 @@ export class Module {
         const wrapper = new Function("exports", "require", "module", "__filename", "__dirname", content);
         const moduleRequire = (request) => _requireFrom(request, this.path);
         moduleRequire.resolve = (request) => {
-            const resolved = _resolveModule.applySyncPromise(undefined, [
-                request,
-                this.path,
-            ]);
+            const resolved = _resolveModule(request, this.path);
             if (resolved === null) {
                 const err = new Error("Cannot find module '" + request + "'");
                 err.code = "MODULE_NOT_FOUND";
@@ -190,10 +184,7 @@ export class Module {
         : {};
     static _resolveFilename(request, parent, _isMain, _options) {
         const parentDir = parent && parent.path ? parent.path : "/";
-        const resolved = _resolveModule.applySyncPromise(undefined, [
-            request,
-            parentDir,
-        ]);
+        const resolved = _resolveModule(request, parentDir);
         if (resolved === null) {
             const err = new Error("Cannot find module '" + request + "'");
             err.code = "MODULE_NOT_FOUND";

package/dist/bridge/network.d.ts

@@ -154,6 +154,7 @@ export declare class ClientRequest {
     private _callback?;
     private _listeners;
     private _body;
+    private _bodyBytes;
     private _ended;
     private _agent;
     private _hostKey;

package/dist/bridge/network.js

@@ -1,5 +1,7 @@
 // Network module polyfill for isolated-vm
 // Provides fetch, http, https, and dns module emulation that bridges to host
+// Cap in-sandbox request/response buffering to prevent host memory exhaustion
+const MAX_HTTP_BODY_BYTES = 50 * 1024 * 1024; // 50 MB
 import { exposeCustomGlobal } from "../shared/global-exposure.js";
 // Fetch polyfill
 export async function fetch(url, options = {}) {
@@ -12,10 +14,7 @@ export async function fetch(url, options = {}) {
         headers: options.headers || {},
         body: options.body || null,
     });
-    const responseJson = await _networkFetchRaw.apply(undefined, [String(url), optionsJson], {
-        result: { promise: true },
-    });
-    const response = JSON.parse(responseJson);
+    const response = await _networkFetchRaw(String(url), optionsJson);
     // Create Response-like object
     return {
         ok: response.ok,
@@ -162,10 +161,8 @@ export const dns = {
         if (typeof options === "function") {
             cb = options;
         }
-        _networkDnsLookupRaw
-            .apply(undefined, [hostname], { result: { promise: true } })
-            .then((resultJson) => {
-            const result = JSON.parse(resultJson);
+        _networkDnsLookupRaw(hostname)
+            .then((result) => {
             if (result.error) {
                 const err = new Error(result.error);
                 err.code = result.code || "ENOTFOUND";
@@ -539,6 +536,7 @@ export class ClientRequest {
     _callback;
     _listeners = {};
     _body = "";
+    _bodyBytes = 0;
     _ended = false;
     _agent;
     _hostKey;
@@ -580,15 +578,17 @@ export class ClientRequest {
                 throw new Error('http/https request requires NetworkAdapter to be configured');
             }
             const url = this._buildUrl();
+            const tls = {};
+            if (this._options.rejectUnauthorized !== undefined) {
+                tls.rejectUnauthorized = this._options.rejectUnauthorized;
+            }
             const optionsJson = JSON.stringify({
                 method: this._options.method || "GET",
                 headers: this._options.headers || {},
                 body: this._body || null,
+                ...tls,
             });
-            const responseJson = await _networkHttpRequestRaw.apply(undefined, [url, optionsJson], {
-                result: { promise: true },
-            });
-            const response = JSON.parse(responseJson);
+            const response = await _networkHttpRequestRaw(url, optionsJson);
             this.finished = true;
             // 101 Switching Protocols → fire 'upgrade' event
             if (response.status === 101) {
@@ -648,12 +648,17 @@ export class ClientRequest {
         }
     }
     write(data) {
+        const addedBytes = typeof Buffer !== "undefined" ? Buffer.byteLength(data) : data.length;
+        if (this._bodyBytes + addedBytes > MAX_HTTP_BODY_BYTES) {
+            throw new Error("ERR_HTTP_BODY_TOO_LARGE: request body exceeds " + MAX_HTTP_BODY_BYTES + " byte limit");
+        }
         this._body += data;
+        this._bodyBytes += addedBytes;
         return true;
     }
     end(data) {
         if (data)
-            this._body += data;
+            this.write(data);
         this._ended = true;
         return this;
     }
@@ -919,6 +924,7 @@ class ServerResponseBridge {
     writableFinished = false;
     _headers = new Map();
     _chunks = [];
+    _chunksBytes = 0;
     _listeners = {};
     _closedPromise;
     _resolveClosed = null;
@@ -993,12 +999,12 @@ class ServerResponseBridge {
         if (chunk == null)
             return true;
         this.headersSent = true;
-        if (typeof chunk === "string") {
-            this._chunks.push(Buffer.from(chunk));
-        }
-        else {
-            this._chunks.push(chunk);
+        const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        if (this._chunksBytes + buf.byteLength > MAX_HTTP_BODY_BYTES) {
+            throw new Error("ERR_HTTP_BODY_TOO_LARGE: response body exceeds " + MAX_HTTP_BODY_BYTES + " byte limit");
         }
+        this._chunks.push(buf);
+        this._chunksBytes += buf.byteLength;
         return true;
     }
     end(chunk) {
@@ -1106,8 +1112,7 @@ class Server {
         if (typeof _networkHttpServerListenRaw === "undefined") {
             throw new Error("http.createServer requires NetworkAdapter.httpServerListen support");
         }
-        const resultJson = await _networkHttpServerListenRaw.apply(undefined, [JSON.stringify({ serverId: this._serverId, port, hostname })], { result: { promise: true } });
-        const result = JSON.parse(resultJson);
+        const result = await _networkHttpServerListenRaw(JSON.stringify({ serverId: this._serverId, port, hostname }));
         this._address = result.address;
         this.listening = true;
         this._handleId = `http-server:${this._serverId}`;
@@ -1144,9 +1149,7 @@ class Server {
                     await this._listenPromise;
                 }
                 if (this.listening && typeof _networkHttpServerCloseRaw !== "undefined") {
-                    await _networkHttpServerCloseRaw.apply(undefined, [this._serverId], {
-                        result: { promise: true },
-                    });
+                    await _networkHttpServerCloseRaw(this._serverId);
                 }
                 this.listening = false;
                 this._address = null;
@@ -1222,12 +1225,11 @@ class Server {
     }
 }
 /** Route an incoming HTTP request to the server's request listener and return the serialized response. */
-async function dispatchServerRequest(serverId, requestJson) {
+async function dispatchServerRequest(serverId, request) {
     const listener = serverRequestListeners.get(serverId);
     if (!listener) {
         throw new Error(`Unknown HTTP server: ${serverId}`);
     }
-    const request = JSON.parse(requestJson);
     const incoming = new ServerIncomingMessage(request);
     const outgoing = new ServerResponseBridge();
     try {
@@ -1242,13 +1244,20 @@ async function dispatchServerRequest(serverId, requestJson) {
     }
     catch (err) {
         outgoing.statusCode = 500;
-        outgoing.end(err instanceof Error ? `Error: ${err.message}` : "Error");
+        try {
+            outgoing.end(err instanceof Error ? `Error: ${err.message}` : "Error");
+        }
+        catch {
+            // Body cap may prevent writing error — finalize without data
+            if (!outgoing.writableFinished)
+                outgoing.end();
+        }
     }
     if (!outgoing.writableFinished) {
         outgoing.end();
     }
     await outgoing.waitForClose();
-    return JSON.stringify(outgoing.serialize());
+    return outgoing.serialize();
 }
 // Function-based ServerResponse constructor — allows .call() inheritance
 // used by light-my-request (Fastify's inject), which does
@@ -1262,6 +1271,7 @@ function ServerResponseCallable() {
     this.writableFinished = false;
     this._headers = new Map();
     this._chunks = [];
+    this._chunksBytes = 0;
     this._listeners = {};
     this._closedPromise = new Promise((resolve) => {
         this._resolveClosed = resolve;
@@ -1287,10 +1297,17 @@ ServerResponseCallable.prototype = Object.create(ServerResponseBridge.prototype,
     constructor: { value: ServerResponseCallable, writable: true, configurable: true },
 });
 // Create HTTP module
-function createHttpModule(_protocol) {
+function createHttpModule(protocol) {
+    const defaultProtocol = protocol === "https" ? "https:" : "http:";
     const moduleAgent = new Agent({ keepAlive: false });
     // Set module-level globalAgent so ClientRequest defaults to it
     _moduleGlobalAgent = moduleAgent;
+    // Ensure protocol is set on request options (defaults to module protocol)
+    function ensureProtocol(opts) {
+        if (!opts.protocol)
+            return { ...opts, protocol: defaultProtocol };
+        return opts;
+    }
     return {
         request(options, callback) {
             let opts;
@@ -1314,7 +1331,7 @@ function createHttpModule(_protocol) {
             else {
                 opts = options;
             }
-            return new ClientRequest(opts, callback);
+            return new ClientRequest(ensureProtocol(opts), callback);
         },
         get(options, callback) {
             let opts;
@@ -1340,7 +1357,7 @@ function createHttpModule(_protocol) {
             else {
                 opts = { ...options, method: "GET" };
             }
-            const req = new ClientRequest(opts, callback);
+            const req = new ClientRequest(ensureProtocol(opts), callback);
             req.end();
             return req;
         },

package/dist/bridge/process.d.ts

@@ -19,6 +19,9 @@ export interface ProcessConfig {
     stdin?: string;
     timingMitigation?: "off" | "freeze";
     frozenTimeMs?: number;
+    stdinIsTTY?: boolean;
+    stdoutIsTTY?: boolean;
+    stderrIsTTY?: boolean;
 }
 /**
  * Thrown by `process.exit()` to unwind the sandbox call stack. The host

package/dist/bridge/process.js

@@ -40,8 +40,8 @@ function getNowMs() {
         ? performance.now()
         : Date.now();
 }
-// Start time for uptime calculation
-const _processStartTime = getNowMs();
+// Start time for uptime calculation (mutable for snapshot restore)
+let _processStartTime = getNowMs();
 const BUFFER_MAX_LENGTH = typeof BufferPolyfill.kMaxLength ===
     "number"
     ? BufferPolyfill.kMaxLength
@@ -71,6 +71,18 @@ if (typeof bufferPolyfillMutable.constants !== "object" ||
 // Exit code tracking
 let _exitCode = 0;
 let _exited = false;
+// Expose reset function for snapshot restore — resets mutable state
+// captured in this closure so each restored context starts fresh.
+globalThis.__runtimeResetProcessState =
+    function () {
+        _processStartTime =
+            typeof performance !== "undefined" && performance.now
+                ? performance.now()
+                : Date.now();
+        _exitCode = 0;
+        _exited = false;
+        delete globalThis.__runtimeResetProcessState;
+    };
 /**
  * Thrown by `process.exit()` to unwind the sandbox call stack. The host
  * catches this to extract the exit code without killing the isolate.
@@ -122,7 +134,7 @@ function _addListener(event, listener, once = false) {
             const warning = `MaxListenersExceededWarning: Possible EventEmitter memory leak detected. ${total} ${event} listeners added to [process]. MaxListeners is ${_processMaxListeners}. Use emitter.setMaxListeners() to increase limit`;
             // Use console.error to emit warning without recursion risk
             if (typeof _error !== "undefined") {
-                _error.applySync(undefined, [warning]);
+                _error(warning);
             }
         }
     }
@@ -161,11 +173,15 @@ function _emit(event, ...args) {
     }
     return handled;
 }
+// Resolve isTTY flags from config
+const _stdinIsTTY = (typeof _processConfig !== "undefined" && _processConfig.stdinIsTTY) || false;
+const _stdoutIsTTY = (typeof _processConfig !== "undefined" && _processConfig.stdoutIsTTY) || false;
+const _stderrIsTTY = (typeof _processConfig !== "undefined" && _processConfig.stderrIsTTY) || false;
 // Stdout stream
 const _stdout = {
     write(data) {
         if (typeof _log !== "undefined") {
-            _log.applySync(undefined, [String(data).replace(/\n$/, "")]);
+            _log(String(data).replace(/\n$/, ""));
         }
         return true;
     },
@@ -182,7 +198,7 @@ const _stdout = {
         return false;
     },
     writable: true,
-    isTTY: false,
+    isTTY: _stdoutIsTTY,
     columns: 80,
     rows: 24,
 };
@@ -190,7 +206,7 @@ const _stdout = {
 const _stderr = {
     write(data) {
         if (typeof _error !== "undefined") {
-            _error.applySync(undefined, [String(data).replace(/\n$/, "")]);
+            _error(String(data).replace(/\n$/, ""));
         }
         return true;
     },
@@ -207,7 +223,7 @@ const _stderr = {
         return false;
     },
     writable: true,
-    isTTY: false,
+    isTTY: _stderrIsTTY,
     columns: 80,
     rows: 24,
 };
@@ -319,7 +335,16 @@ const _stdin = {
         this.encoding = enc;
         return this;
     },
-    isTTY: false,
+    setRawMode(mode) {
+        if (!_stdinIsTTY) {
+            throw new Error("setRawMode is not supported when stdin is not a TTY");
+        }
+        if (typeof _ptySetRawMode !== "undefined") {
+            _ptySetRawMode(mode);
+        }
+        return this;
+    },
+    isTTY: _stdinIsTTY,
     // For readline compatibility
     [Symbol.asyncIterator]: async function* () {
         const lines = getStdinData().split("\n");
@@ -419,9 +444,9 @@ const process = {
     },
     chdir(dir) {
         // Validate directory exists in VFS before setting cwd
-        let statJson;
+        let stat;
         try {
-            statJson = _fs.stat.applySyncPromise(undefined, [dir]);
+            stat = _fs.stat(dir);
         }
         catch {
             const err = new Error(`ENOENT: no such file or directory, chdir '${dir}'`);
@@ -431,8 +456,7 @@ const process = {
             err.path = dir;
             throw err;
         }
-        const parsed = JSON.parse(statJson);
-        if (!parsed.isDirectory) {
+        if (!stat.isDirectory) {
             const err = new Error(`ENOTDIR: not a directory, chdir '${dir}'`);
             err.code = "ENOTDIR";
             err.errno = -20;
@@ -746,11 +770,7 @@ export function setTimeout(callback, delay, ...args) {
     const actualDelay = delay ?? 0;
     // Use host timer for actual delays if available and delay > 0
     if (typeof _scheduleTimer !== "undefined" && actualDelay > 0) {
-        // _scheduleTimer.apply() returns a Promise that resolves after the delay
-        // Using { result: { promise: true } } tells isolated-vm to wait for the
-        // host Promise to resolve before resolving the apply() Promise
-        _scheduleTimer
-            .apply(undefined, [actualDelay], { result: { promise: true } })
+        _scheduleTimer(actualDelay)
             .then(() => {
             if (_timers.has(id)) {
                 _timers.delete(id);
@@ -798,8 +818,7 @@ export function setInterval(callback, delay, ...args) {
             return; // Interval was cleared
         if (typeof _scheduleTimer !== "undefined" && actualDelay > 0) {
             // Use host timer for actual delays
-            _scheduleTimer
-                .apply(undefined, [actualDelay], { result: { promise: true } })
+            _scheduleTimer(actualDelay)
                 .then(() => {
                 if (_intervals.has(id)) {
                     try {
@@ -871,8 +890,7 @@ export const cryptoPolyfill = {
         }
         const bytes = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);
         try {
-            const base64 = _cryptoRandomFill.applySync(undefined, [bytes.byteLength]);
-            const hostBytes = BufferPolyfill.from(base64, "base64");
+            const hostBytes = _cryptoRandomFill(bytes.byteLength);
             if (hostBytes.byteLength !== bytes.byteLength) {
                 throw new Error("invalid host entropy size");
             }
@@ -888,7 +906,7 @@ export const cryptoPolyfill = {
             throwUnsupportedCryptoApi("randomUUID");
         }
         try {
-            const uuid = _cryptoRandomUUID.applySync(undefined, []);
+            const uuid = _cryptoRandomUUID();
             if (typeof uuid !== "string") {
                 throw new Error("invalid host uuid");
             }