poe-code 11.0.26 → 11.0.27

package/packages/safejs/dist/cli.js

@@ -20,7 +20,7 @@ import {
   parseMcpConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-YVBVZ7MR.js";
+} from "./chunks/chunk-EW4KQ32H.js";
 import {
   Budget,
   SandboxError,
@@ -32,7 +32,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-4TA6S7L6.js";
+} from "./chunks/chunk-LSVSAZHI.js";
 import "./chunks/chunk-4YIDX44G.js";
 
 // packages/safejs/src/cli.ts

package/packages/safejs/dist/core.js

@@ -3,7 +3,7 @@ import {
   createReplayableRandom,
   lint,
   run
-} from "./chunks/chunk-4TA6S7L6.js";
+} from "./chunks/chunk-LSVSAZHI.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safejs/dist/index.js

@@ -27,7 +27,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-YVBVZ7MR.js";
+} from "./chunks/chunk-EW4KQ32H.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -49,7 +49,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-4TA6S7L6.js";
+} from "./chunks/chunk-LSVSAZHI.js";
 import "./chunks/chunk-4YIDX44G.js";
 
 // packages/safejs/src/runner/run-harness.ts

package/packages/safejs/dist/interp/host-bridge.d.ts

@@ -1,7 +1,7 @@
 import { type Budget } from "./budget.js";
 import type { PendingHostCallPolicyMode } from "../snapshot/policy.js";
 import { type HostCallJournal, type HostCallOutcome } from "./host-call.js";
-import { type SandboxValue } from "./values.js";
+import { type SandboxClosure, type SandboxValue } from "./values.js";
 import type { RunLifecycle } from "../snapshot/dump.js";
 type CallerInjectedFunction = {
     bivarianceHack(...args: readonly unknown[]): unknown;
@@ -15,6 +15,7 @@ type HostBridgeOptions = {
     operation?: string;
     signal?: AbortSignal;
     lifecycle?: RunLifecycle;
+    proofFunctions?: WeakMap<object, SandboxClosure>;
 };
 export type CallerInjectedBinding = SandboxValue | CallerInjectedFunction | readonly CallerInjectedBinding[] | {
     readonly [key: string]: CallerInjectedBinding;

package/packages/safejs/dist/interp/host-bridge.js

@@ -59,6 +59,7 @@ function wrapCallerInjectedFunction(name, value, options, state) {
                     entries: new Map(),
                     hostFunctions: new Map(),
                     sourceFunctions: new Map(),
+                    proofFunctions: new WeakMap(),
                     active: new Set(),
                     seen: new WeakMap(),
                     restored: []
@@ -220,6 +221,7 @@ function executeHostCall(record, restored, invoke, stackFrames, options, span, c
         throw new HostCallResumabilityError(record, "reset", `Host call ${record.id} was cancelled; reset is required.`);
     }
     if (restored && record.policy === "read-side-effect" && record.lifecycle !== "created") {
+        let active = true;
         const context = callbacks === undefined
             ? undefined
             : {
@@ -231,9 +233,19 @@ function executeHostCall(record, restored, invoke, stackFrames, options, span, c
                 async waitForCallbacks() {
                     while (callbacks.active.size > 0)
                         await Promise.allSettled([...callbacks.active]);
+                },
+                toSandboxValue(value) {
+                    if (!active)
+                        throw new TypeError("Host call resume context is no longer active.");
+                    if (options.signal?.aborted)
+                        throw readAbortReason(options.signal);
+                    return copyHostValueToSandbox(value, stackFrames, { ...options, proofFunctions: callbacks.proofFunctions }, { seen: new WeakMap() }, "<root>");
                 }
             };
-        return createHostCallPromise(record, hostCalls.reconcile(record, context), hostCalls);
+        const outcome = hostCalls.reconcile(record, context).finally(() => {
+            active = false;
+        });
+        return createHostCallPromise(record, outcome, hostCalls);
     }
     if (restored && callbacks !== undefined)
         callbacks.nextReissuedInvocation = 0;
@@ -465,6 +477,7 @@ function wrapSandboxClosureForHost(closure, stackFrames, budget, callbacks) {
     callbacks?.entries.set(id, invoke);
     callbacks?.hostFunctions.set(id, wrapped);
     callbacks?.sourceFunctions.set(id, closure);
+    callbacks?.proofFunctions.set(wrapped, closure);
     if (callbacks?.record !== undefined)
         callbacks.journal?.registerCallbackFunction(callbacks.record, id, closure, wrapped);
     return wrapped;
@@ -552,9 +565,17 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
         throw new TypeError("Host error data must not contain functions or promises.");
     }
     if (isSandboxClosure(value) || isSandboxPromise(value)) {
+        if (options.proofFunctions !== undefined)
+            throw new TypeError(`Unsupported proof value at ${path}: sandbox capability`);
         return deepCopyToSandbox(value);
     }
     if (typeof value === "function") {
+        if (options.proofFunctions !== undefined) {
+            const sourceClosure = options.proofFunctions.get(value);
+            if (sourceClosure === undefined)
+                throw new TypeError(`Unsupported proof value at ${path}: function`);
+            return sourceClosure;
+        }
         const sourceClosure = options.hostCalls?.nativeClosures.get(value);
         if (sourceClosure !== undefined)
             return sourceClosure;
@@ -571,6 +592,8 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
         }, state);
     }
     if (!options.errorData && isPromiseLike(value)) {
+        if (options.proofFunctions !== undefined)
+            throw new TypeError(`Unsupported proof value at ${path}: promise`);
         const existing = state.seen.get(value);
         if (existing !== undefined)
             return existing;

package/packages/safejs/dist/interp/host-call.d.ts

@@ -54,6 +54,7 @@ export type HostCallResumeContext = {
         result: Promise<unknown>;
     }>;
     waitForCallbacks: () => Promise<void>;
+    toSandboxValue: (value: unknown) => SandboxValue;
 };
 export type HostCallResumeRequest = Omit<HostCallRecord, "id" | "outcome"> & {
     callId: string;