@secure-exec/core 0.1.1-rc.1 → 0.1.1-rc.3

package/dist/shared/global-exposure.js

@@ -80,6 +80,21 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host-to-sandbox HTTP server dispatch entrypoint.",
     },
+    {
+        name: "_httpServerUpgradeDispatch",
+        classification: "hardened",
+        rationale: "Host-to-sandbox HTTP server upgrade dispatch entrypoint.",
+    },
+    {
+        name: "_upgradeSocketData",
+        classification: "hardened",
+        rationale: "Host-to-sandbox upgrade socket data push entrypoint.",
+    },
+    {
+        name: "_upgradeSocketEnd",
+        classification: "hardened",
+        rationale: "Host-to-sandbox upgrade socket end push entrypoint.",
+    },
     {
         name: "ProcessExitError",
         classification: "hardened",
@@ -125,6 +140,71 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host entropy bridge reference for crypto.randomUUID.",
     },
+    {
+        name: "_cryptoHashDigest",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for createHash digest computation.",
+    },
+    {
+        name: "_cryptoHmacDigest",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for createHmac digest computation.",
+    },
+    {
+        name: "_cryptoPbkdf2",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for pbkdf2 key derivation.",
+    },
+    {
+        name: "_cryptoScrypt",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for scrypt key derivation.",
+    },
+    {
+        name: "_cryptoCipheriv",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for createCipheriv encryption.",
+    },
+    {
+        name: "_cryptoDecipheriv",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for createDecipheriv decryption.",
+    },
+    {
+        name: "_cryptoCipherivCreate",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for stateful cipher/decipher creation.",
+    },
+    {
+        name: "_cryptoCipherivUpdate",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for stateful cipher/decipher update.",
+    },
+    {
+        name: "_cryptoCipherivFinal",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for stateful cipher/decipher final.",
+    },
+    {
+        name: "_cryptoSign",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for sign operations.",
+    },
+    {
+        name: "_cryptoVerify",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for verify operations.",
+    },
+    {
+        name: "_cryptoGenerateKeyPairSync",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for generateKeyPairSync.",
+    },
+    {
+        name: "_cryptoSubtle",
+        classification: "hardened",
+        rationale: "Host crypto bridge reference for Web Crypto subtle operations.",
+    },
     {
         name: "_fsReadFile",
         classification: "hardened",
@@ -275,6 +355,21 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host network bridge reference.",
     },
+    {
+        name: "_upgradeSocketWriteRaw",
+        classification: "hardened",
+        rationale: "Host upgrade socket write bridge reference.",
+    },
+    {
+        name: "_upgradeSocketEndRaw",
+        classification: "hardened",
+        rationale: "Host upgrade socket end bridge reference.",
+    },
+    {
+        name: "_upgradeSocketDestroyRaw",
+        classification: "hardened",
+        rationale: "Host upgrade socket destroy bridge reference.",
+    },
     {
         name: "_ptySetRawMode",
         classification: "hardened",

package/dist/shared/permissions.js

@@ -229,6 +229,22 @@ export function wrapNetworkAdapter(adapter, permissions) {
             checkPermission(permissions?.network, { op: "http", url, method: options?.method }, (req, reason) => createEaccesError("connect", req.url, reason));
             return adapter.httpRequest(url, options);
         },
+        // Forward upgrade socket methods for bidirectional WebSocket relay
+        upgradeSocketWrite: adapter.upgradeSocketWrite?.bind(adapter),
+        upgradeSocketEnd: adapter.upgradeSocketEnd?.bind(adapter),
+        upgradeSocketDestroy: adapter.upgradeSocketDestroy?.bind(adapter),
+        setUpgradeSocketCallbacks: adapter.setUpgradeSocketCallbacks?.bind(adapter),
+        // Forward TCP socket (net module) methods with permission check on connect
+        netSocketConnect: adapter.netSocketConnect
+            ? (host, port, callbacks) => {
+                checkPermission(permissions?.network, { op: "connect", hostname: host, port }, (req, reason) => createEaccesError("connect", `${req.hostname}:${req.port}`, reason));
+                return adapter.netSocketConnect(host, port, callbacks);
+            }
+            : undefined,
+        netSocketWrite: adapter.netSocketWrite?.bind(adapter),
+        netSocketEnd: adapter.netSocketEnd?.bind(adapter),
+        netSocketDestroy: adapter.netSocketDestroy?.bind(adapter),
+        netSocketUpgradeTls: adapter.netSocketUpgradeTls?.bind(adapter),
     };
 }
 /** Wrap a CommandExecutor so spawn passes through the childProcess permission check. */

package/dist/types.d.ts

@@ -132,12 +132,24 @@ export interface NetworkServerListenOptions {
     port?: number;
     hostname?: string;
     onRequest(request: NetworkServerRequest): Promise<NetworkServerResponse> | NetworkServerResponse;
+    /** Called when an HTTP upgrade request arrives (e.g. WebSocket). */
+    onUpgrade?(request: NetworkServerRequest, head: string, socketId: number): void;
+    /** Called when the real upgrade socket receives data from the remote peer. */
+    onUpgradeSocketData?(socketId: number, dataBase64: string): void;
+    /** Called when the real upgrade socket closes. */
+    onUpgradeSocketEnd?(socketId: number): void;
 }
 export interface NetworkAdapter {
     httpServerListen?(options: NetworkServerListenOptions): Promise<{
         address: NetworkServerAddress | null;
     }>;
     httpServerClose?(serverId: number): Promise<void>;
+    /** Write data from the sandbox to a real upgrade socket on the host. */
+    upgradeSocketWrite?(socketId: number, dataBase64: string): void;
+    /** End a real upgrade socket on the host. */
+    upgradeSocketEnd?(socketId: number): void;
+    /** Destroy a real upgrade socket on the host. */
+    upgradeSocketDestroy?(socketId: number): void;
     fetch(url: string, options: {
         method?: string;
         headers?: Record<string, string>;
@@ -170,7 +182,35 @@ export interface NetworkAdapter {
         body: string;
         url: string;
         trailers?: Record<string, string>;
+        upgradeSocketId?: number;
     }>;
+    /** Register callbacks for client-side upgrade socket data push. */
+    setUpgradeSocketCallbacks?(callbacks: {
+        onData: (socketId: number, dataBase64: string) => void;
+        onEnd: (socketId: number) => void;
+    }): void;
+    /** Create a TCP socket and connect to host:port. Returns a socketId. */
+    netSocketConnect?(host: string, port: number, callbacks: {
+        onConnect: () => void;
+        onData: (dataBase64: string) => void;
+        onEnd: () => void;
+        onError: (message: string) => void;
+        onClose: (hadError: boolean) => void;
+    }): number;
+    /** Write data to a TCP socket. */
+    netSocketWrite?(socketId: number, dataBase64: string): void;
+    /** End a TCP socket (half-close). */
+    netSocketEnd?(socketId: number): void;
+    /** Destroy a TCP socket. */
+    netSocketDestroy?(socketId: number): void;
+    /** Upgrade an existing TCP socket to TLS. */
+    netSocketUpgradeTls?(socketId: number, optionsJson: string, callbacks: {
+        onData: (dataBase64: string) => void;
+        onEnd: () => void;
+        onError: (message: string) => void;
+        onClose: (hadError: boolean) => void;
+        onSecureConnect: () => void;
+    }): void;
 }
 export interface PermissionDecision {
     allow: boolean;
@@ -182,10 +222,11 @@ export interface FsAccessRequest {
     path: string;
 }
 export interface NetworkAccessRequest {
-    op: "fetch" | "http" | "dns" | "listen";
+    op: "fetch" | "http" | "dns" | "listen" | "connect";
     url?: string;
     method?: string;
     hostname?: string;
+    port?: number;
 }
 export interface ChildProcessAccessRequest {
     command: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secure-exec/core",
-  "version": "0.1.1-rc.1",
+  "version": "0.1.1-rc.3",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",