poe-code 11.0.17 → 11.0.19

package/packages/safejs/dist/cli.js

@@ -20,7 +20,7 @@ import {
   parseMcpConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-COHIMIAF.js";
+} from "./chunks/chunk-2USRJY3R.js";
 import {
   Budget,
   SandboxError,
@@ -32,7 +32,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-D4DDI3HH.js";
+} from "./chunks/chunk-TIKUUEG2.js";
 import "./chunks/chunk-4YIDX44G.js";
 
 // packages/safejs/src/cli.ts

package/packages/safejs/dist/core.js

@@ -3,7 +3,7 @@ import {
   createReplayableRandom,
   lint,
   run
-} from "./chunks/chunk-D4DDI3HH.js";
+} from "./chunks/chunk-TIKUUEG2.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safejs/dist/graph-depth.js

@@ -64,8 +64,6 @@ function graphEntries(value) {
     if (isSandboxArguments(value)) {
         return getSandboxArgumentEntries(value).map(([key, entry]) => [`.${key}`, entry]);
     }
-    if (Array.isArray(value))
-        return value.map((entry, index) => [`[${index}]`, entry]);
     if (value instanceof Map) {
         return [...value.entries()].flatMap(([key, entry], index) => [
             [`.<map>[${index}].key`, key],
@@ -79,7 +77,7 @@ function graphEntries(value) {
     for (const key of Object.keys(value)) {
         const descriptor = Object.getOwnPropertyDescriptor(value, key);
         if (descriptor !== undefined && "value" in descriptor)
-            entries.push([`.${key}`, descriptor.value]);
+            entries.push([Array.isArray(value) ? `[${key}]` : `.${key}`, descriptor.value]);
     }
     return entries;
 }

package/packages/safejs/dist/index.js

@@ -27,7 +27,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-COHIMIAF.js";
+} from "./chunks/chunk-2USRJY3R.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -49,7 +49,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-D4DDI3HH.js";
+} from "./chunks/chunk-TIKUUEG2.js";
 import "./chunks/chunk-4YIDX44G.js";
 
 // packages/safejs/src/runner/run-harness.ts

package/packages/safejs/dist/interp/exceptions.d.ts

@@ -21,6 +21,7 @@ export type EvaluationResult<TError> = CompletionResult | {
 };
 type CapturedException = {
     readonly reason: unknown;
+    readonly sandbox: boolean;
     readonly stackFrames: readonly string[];
     readonly [capturedExceptionBrand]: true;
 };
@@ -32,9 +33,9 @@ type ExceptionContext = {
 type EvaluateExceptionNode<TContext, TError> = (node: ParseResult, context: TContext) => Promise<EvaluationResult<TError>>;
 export declare function evaluateThrowStatement<TContext extends ExceptionContext, TError>(node: ThrowStatement, context: TContext, evaluateNode: EvaluateExceptionNode<TContext, TError>): Promise<EvaluationResult<TError>>;
 export declare function evaluateTryStatement<TContext extends ExceptionContext, TError>(node: TryStatement, context: TContext, evaluateNode: EvaluateExceptionNode<TContext, TError>): Promise<EvaluationResult<TError>>;
-export declare function createCapturedException(reason: unknown, stackFrames: readonly string[]): CapturedException;
+export declare function createCapturedException(reason: unknown, stackFrames: readonly string[], sandbox?: boolean): CapturedException;
 export declare function isCapturedException(value: unknown): value is CapturedException;
-export declare function coerceThrownValue(reason: unknown, budget: Budget, stackFrames: readonly string[], span?: ErrorSourceSpan): SandboxValue;
+export declare function coerceThrownValue(reason: unknown, budget: Budget, stackFrames: readonly string[], span?: ErrorSourceSpan, sandbox?: boolean): SandboxValue;
 export declare function surfaceThrownValue(reason: unknown, budget: Budget, stackFrames?: readonly string[], span?: ErrorSourceSpan): SandboxObject;
 export declare function createSubsetErrorValue(name: string, message: SandboxValue, stackFrames: readonly string[], budget: Budget, options?: {
     cause?: unknown;

package/packages/safejs/dist/interp/exceptions.js

@@ -54,9 +54,10 @@ export async function evaluateTryStatement(node, context, evaluateNode) {
     }
     return finalizerResult;
 }
-export function createCapturedException(reason, stackFrames) {
+export function createCapturedException(reason, stackFrames, sandbox = false) {
     return {
         reason,
+        sandbox,
         stackFrames,
         [capturedExceptionBrand]: true
     };
@@ -64,7 +65,7 @@ export function createCapturedException(reason, stackFrames) {
 export function isCapturedException(value) {
     return typeof value === "object" && value !== null && capturedExceptionBrand in value;
 }
-export function coerceThrownValue(reason, budget, stackFrames, span) {
+export function coerceThrownValue(reason, budget, stackFrames, span, sandbox = false) {
     if (isSubsetErrorValue(reason)) {
         attachErrorSpan(reason, readErrorSpan(reason) ?? span);
         return reason;
@@ -76,6 +77,9 @@ export function coerceThrownValue(reason, budget, stackFrames, span) {
             span
         });
     }
+    if (sandbox) {
+        return reason;
+    }
     if (isErrorLikeValue(reason)) {
         return createSubsetErrorValue(reason.name || "Error", reason.message, stackFrames, budget, {
             chargeBudget: false,

package/packages/safejs/dist/interp/interpreter.js

@@ -189,8 +189,8 @@ async function evaluateNode(node, context) {
             };
         }
         const exception = isCapturedException(error)
-            ? coerceThrownValue(error.reason, context.budget, error.stackFrames, node.span)
-            : coerceThrownValue(error, context.budget, context.callStack, node.span);
+            ? coerceThrownValue(error.reason, context.budget, error.stackFrames, node.span, error.sandbox)
+            : coerceThrownValue(error, context.budget, context.callStack, node.span, true);
         return {
             kind: "throw",
             hasValue: true,
@@ -1833,7 +1833,7 @@ async function evaluateStringMethodCall(node, target, methodName, context) {
         if (isFatalSandboxError(error)) {
             throw error;
         }
-        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)]);
+        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)], true);
     }
     finally {
         leaveCall();
@@ -1856,7 +1856,7 @@ async function evaluateArrayMethodCall(node, target, methodName, context) {
         if (isFatalSandboxError(error)) {
             throw error;
         }
-        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)]);
+        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)], true);
     }
     finally {
         leaveCall();
@@ -1879,7 +1879,7 @@ async function evaluateMapMethodCall(node, target, methodName, context) {
         if (isFatalSandboxError(error)) {
             throw error;
         }
-        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)]);
+        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)], true);
     }
     finally {
         leaveCall();
@@ -1902,7 +1902,7 @@ async function evaluateSetMethodCall(node, target, methodName, context) {
         if (isFatalSandboxError(error)) {
             throw error;
         }
-        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)]);
+        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)], true);
     }
     finally {
         leaveCall();
@@ -2280,7 +2280,7 @@ async function evaluateNumberMethodCall(node, target, methodName, context) {
         if (isFatalSandboxError(error)) {
             throw error;
         }
-        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)]);
+        throw captureException(error, [...context.callStack, formatStackFrame(node, methodName)], true);
     }
 }
 function createArrayMethodOptions(context) {
@@ -2324,14 +2324,14 @@ async function invokeSandboxClosure(callee, args, context, stack, span, thisValu
             await result.synchronousPrefix;
         }
         return !construct && callee.async === true
-            ? normalizeClosureResult(wrapHostResult(result, stack), context.budget)
-            : await wrapHostResult(result, stack);
+            ? normalizeClosureResult(wrapHostResult(result, stack, callee.sandbox === true), context.budget)
+            : await wrapHostResult(result, stack, callee.sandbox === true);
     }
     catch (error) {
         if (isFatalSandboxError(error)) {
             throw error;
         }
-        throw captureException(error, stack);
+        throw captureException(error, stack, callee.sandbox === true);
     }
     finally {
         leaveCall();
@@ -2461,16 +2461,16 @@ function isInterpreterError(value) {
 function hasOwnProperty(value, name) {
     return Object.prototype.hasOwnProperty.call(value, name);
 }
-function wrapHostResult(result, stack) {
+function wrapHostResult(result, stack, sandbox) {
     if (!isPromiseLikeResult(result)) {
         return result;
     }
     return Promise.resolve(result).then((value) => value, (reason) => Promise.reject(isInterpreterError(reason) || reason instanceof SandboxError || isCapturedException(reason)
         ? reason
-        : createCapturedException(reason, stack)));
+        : createCapturedException(reason, stack, sandbox)));
 }
-function captureException(error, stack) {
-    return isCapturedException(error) ? error : createCapturedException(error, stack);
+function captureException(error, stack, sandbox) {
+    return isCapturedException(error) ? error : createCapturedException(error, stack, sandbox);
 }
 function isFatalSandboxError(error) {
     return (error instanceof SandboxError && (error.code === "budgetExceeded" || error.code === "reentry"));

package/packages/safejs/dist/snapshot/arrays.d.ts

@@ -0,0 +1,10 @@
+export type SerializedArray<TValue> = {
+    kind: "array";
+    items: TValue[];
+} | {
+    kind: "array";
+    length: number;
+    entries: Record<string, TValue>;
+};
+export declare function requiresArrayEntries(value: unknown[]): boolean;
+export declare function serializeArray<TValue>(value: unknown[], serializeValue: (entry: unknown, key: string) => TValue): SerializedArray<TValue>;

package/packages/safejs/dist/snapshot/arrays.js

@@ -0,0 +1,24 @@
+export function requiresArrayEntries(value) {
+    const keys = Object.keys(value);
+    return keys.length !== value.length || keys.some((key, index) => key !== String(index));
+}
+export function serializeArray(value, serializeValue) {
+    if (!requiresArrayEntries(value)) {
+        return {
+            kind: "array",
+            items: Array.from({ length: value.length }, (_, index) => {
+                const key = String(index);
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                return serializeValue(descriptor !== undefined && "value" in descriptor ? descriptor.value : undefined, key);
+            })
+        };
+    }
+    const entries = Object.create(null);
+    for (const key of Object.keys(value)) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor !== undefined && "value" in descriptor) {
+            entries[key] = serializeValue(descriptor.value, key);
+        }
+    }
+    return { kind: "array", length: value.length, entries };
+}

package/packages/safejs/dist/snapshot/dump-format.js

@@ -4,6 +4,7 @@ import { assertSnapshotGraphDepth } from "../graph-depth.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { getSandboxArgumentEntries, isSandboxArguments } from "../interp/arguments.js";
 import { serializeArguments } from "./arguments.js";
+import { requiresArrayEntries, serializeArray } from "./arrays.js";
 const SKIP_VALUE = Symbol("SafeJS.skip-dump-value");
 export function serializeSafeJSSnapshot(snapshot) {
     const replayError = Object.getOwnPropertyDescriptor(snapshot, "replayError");
@@ -94,10 +95,10 @@ function serializeHeapReference(value, path, state) {
             });
         }
         else if (Array.isArray(value)) {
-            state.heap[String(id)] = {
-                kind: "array",
-                items: serializeArrayItems(value, path, state)
-            };
+            state.heap[String(id)] = serializeArray(value, (entry, key) => {
+                const serialized = serializeDumpValue(entry, `${path}[${key}]`, state);
+                return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+            });
         }
         else {
             const errorType = sandboxErrorTypes.get(value);
@@ -137,6 +138,7 @@ function indexHeapContainers(snapshot) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            (Array.isArray(value) && requiresArrayEntries(value)) ||
             isSandboxArguments(value) ||
             sandboxErrorTypes.has(value)) {
             heapIds.set(value, nextId);
@@ -173,9 +175,7 @@ function collectContainerStats(value, stats, ancestors) {
     ancestors.add(value);
     const entries = isSandboxArguments(value)
         ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
-        : Array.isArray(value)
-            ? getArrayDataItems(value)
-            : getEnumerableDataValues(value);
+        : getEnumerableDataValues(value);
     for (const entry of entries) {
         collectContainerStats(entry, stats, ancestors);
     }

package/packages/safejs/dist/snapshot/restore.js

@@ -322,10 +322,16 @@ function restoreHeapValue(id, state) {
         throw new Error(`Snapshot references unknown heap value ${id}.`);
     }
     if (serialized.kind === "array") {
-        const array = [];
+        const array = new Array("items" in serialized ? serialized.items.length : serialized.length);
         state.heapValueById.set(id, array);
-        for (const entry of serialized.items) {
-            array.push(deserializeValue(entry, state));
+        const entries = "items" in serialized ? Object.entries(serialized.items) : Object.entries(serialized.entries);
+        for (const [key, entry] of entries) {
+            Object.defineProperty(array, key, {
+                value: deserializeValue(entry, state),
+                configurable: true,
+                enumerable: true,
+                writable: true
+            });
         }
         return array;
     }

package/packages/safejs/dist/snapshot/serialize.d.ts

@@ -1,5 +1,6 @@
 import { type SandboxErrorName } from "../error/shape.js";
 import { type SerializedArguments } from "./arguments.js";
+import { type SerializedArray } from "./arrays.js";
 import { type SandboxMap, type SandboxGenerator, type SandboxRegex, type SandboxSet } from "../interp/values.js";
 type SnapshotId = number | string;
 type SerializedUndefinedValue = {
@@ -38,10 +39,7 @@ export type SerializedReferenceValue = {
     kind: "ref";
     id: number;
 };
-export type SerializedHeapValue = SerializedArguments<SerializedSnapshotValue> | {
-    kind: "array";
-    items: SerializedSnapshotValue[];
-} | {
+export type SerializedHeapValue = SerializedArguments<SerializedSnapshotValue> | SerializedArray<SerializedSnapshotValue> | {
     kind: "object";
     entries: Record<string, SerializedSnapshotValue>;
     errorType?: SandboxErrorName;

package/packages/safejs/dist/snapshot/serialize.js

@@ -2,6 +2,7 @@ import { hashSource } from "../parse/hash.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
 import { serializeArguments } from "./arguments.js";
+import { requiresArrayEntries, serializeArray } from "./arrays.js";
 import { isSandboxArguments, isSandboxGenerator, isSandboxMap, isSandboxRegex, isSandboxSet } from "../interp/values.js";
 export class UnsnapshotableValueError extends Error {
     path;
@@ -201,10 +202,7 @@ function serializeHeapReference(value, path, state) {
             };
         }
         else if (Array.isArray(value)) {
-            state.heap[String(id)] = {
-                kind: "array",
-                items: value.map((entry, index) => serializeValue(entry, `${path}[${index}]`, state))
-            };
+            state.heap[String(id)] = serializeArray(value, (entry, key) => serializeValue(entry, `${path}[${key}]`, state));
         }
         else {
             const entries = Object.create(null);
@@ -282,6 +280,7 @@ function indexHeapContainers(input) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            (Array.isArray(value) && requiresArrayEntries(value)) ||
             sandboxErrorTypes.has(value) ||
             isSandboxArguments(value) ||
             isSandboxMap(value) ||
@@ -331,9 +330,7 @@ function collectContainerStats(value, stats, ancestors) {
             ? [...value.entries].flatMap(([key, entry]) => [key, entry])
             : isSandboxSet(value)
                 ? [...value.values]
-                : Array.isArray(value)
-                    ? value
-                    : Object.values(value);
+                : Object.values(value);
     for (const entry of entries) {
         collectContainerStats(entry, stats, ancestors);
     }

package/packages/safejs/dist/snapshot/validation.js

@@ -83,7 +83,7 @@ function validateDumpHeap(root, state) {
             continue;
         }
         if (entry.kind === "array") {
-            requireArray(entry.items, `${path}.items`, state);
+            validateArrayHeap(entry, path, state);
             continue;
         }
         if (entry.kind === "object") {
@@ -401,7 +401,7 @@ function validateHeapValue(value, path, state) {
     if (record.kind === "arguments")
         validateArgumentsProperties(record, path);
     if (record.kind === "array")
-        requireArray(record.items, `${path}.items`, state);
+        validateArrayHeap(record, path, state);
     if (record.kind === "object")
         requireRecord(record.entries, `${path}.entries`);
     if (record.kind === "map") {
@@ -414,6 +414,31 @@ function validateHeapValue(value, path, state) {
     if (record.kind === "set")
         requireArray(record.values, `${path}.values`, state);
 }
+function validateArrayHeap(record, path, state) {
+    if (Object.hasOwn(record, "items")) {
+        requireArray(record.items, `${path}.items`, state);
+        if (Object.hasOwn(record, "length") || Object.hasOwn(record, "entries"))
+            fail("invalidValue", path, "array must use either items or length and entries");
+        return;
+    }
+    const length = requireSafeInteger(record.length, `${path}.length`, 0);
+    if (length > 0xffff_ffff)
+        fail("invalidValue", `${path}.length`, "exceeds maximum array length");
+    if (length > state.limits.maxEntries)
+        fail("budgetExceeded", `${path}.length`, `exceeds collection entry limit ${state.limits.maxEntries}`);
+    const entries = requireRecord(record.entries, `${path}.entries`);
+    for (const key of Object.keys(entries)) {
+        if (key === "length")
+            fail("invalidValue", `${path}.entries.length`, "array length is stored separately");
+        const index = Number(key);
+        if (String(index) === key &&
+            Number.isInteger(index) &&
+            index >= 0 &&
+            index < 0xffff_ffff &&
+            index >= length)
+            fail("invalidValue", `${path}.entries${formatKey(key)}`, "array index exceeds its length");
+    }
+}
 function validateErrorType(record, path) {
     if (!Object.hasOwn(record, "errorType"))
         return;