poe-code 13.0.0 → 13.0.2

package/README.md

@@ -263,9 +263,9 @@ Uses `POE_API_KEY` or the stored credential and honors `POE_BASE_URL`. Throws an
 
 ### Shared filesystem foundation
 
-`poe-code@12.0.7` publishes the Node.js foundation at `poe-code/safe-fs`
+`poe-code@13.0.0` publishes the Node.js foundation at `poe-code/safe-fs`
 and shared filesystem integration for the SafeJS SDK and both CLIs.
-The installed release was verified on Node 18.18.2, 18.20.8, 20.20.0,
+The installed release was verified on Node 18.18.2, 18.20.8, 20.19.2, 20.20.0,
 22.22.2 and 24.14.0, including public runtime and TypeScript consumers.
 `@poe-code/safe-fs` is the private workspace name, not a public npm import.
 
@@ -280,8 +280,8 @@ const filesystem = new MemoryFileSystem();
 await filesystem.writeFile("/note", new TextEncoder().encode("hello"));
 ```
 
-The current source uses canonical SafeJS names; the versioned C verification
-above predates that rename. SafeJS accepts these adapters through
+Canonical SafeJS names shipped in `poe-code@12.0.8` and were reverified in
+`13.0.0`. SafeJS accepts these adapters through
 `makeFsModule({ adapter, root?, cwd?, signal? })`
 from `poe-code/safe-js`. The legacy `poe-code/safejs` routes and `poe-safejs` binary
 remain aliases to the identical canonical artifacts. Both `poe-safe-js` and `poe-code harness run` accept
@@ -290,7 +290,7 @@ legacy `--fs` and `--fs-root` options retain their Node-backed behavior.
 
 The default public entries target Node.js. Full browser runtime support,
 safe-bash runtime migration and removal of legacy adapter copies remain pending. Canonical and legacy
-SafeJS names share artifacts; publication is tracked in the rename plan.
+SafeJS names share the same published artifacts.
 The host-directory adapter is not race-proof OS isolation. See the
 [foundation documentation](packages/safe-fs/README.md) for configuration,
 capabilities and backend limitations.
@@ -318,6 +318,27 @@ in both pages and module workers on Chromium 149.0.7827.55, Firefox 150.0.2 and
 Playwright WebKit 26.4: 102 checks total, plus 11 negative browser-graph cases
 and 20 strict browser type profiles. This is FS-only coverage, not Safari
 certification, browser SafeJS execution or coverage of unreleased guest codecs.
+Those earlier checks did not establish WebDAV request-stream transport support.
+
+#### WebDAV streaming migration in 13.0.0
+
+Custom or bound Fetch functions must now declare `requestStreamSupport`:
+`"native"` for faithful current-realm native delegation, `true` for a trusted
+custom transport that preserves and consumes stream bodies, or `false` to
+disable streaming. Exact `globalThis.fetch` is probed automatically. Unknown
+transports reject with `ENOTSUP` before source acquisition or any DAV I/O;
+ordinary byte writes are unchanged. This is a programmatic adapter option,
+not a new environment variable, CLI flag or JSON configuration field. `true`
+is a host assertion, not protection against a dishonest transport.
+
+The actual `13.0.0` registry artifact passed 50 native Node HTTP controls and
+390 browser assertions across Chromium, Firefox and WebKit pages and workers,
+including 134 zero-source/no-I/O cases. Native Firefox/WebKit streaming safely
+rejects; genuine Chromium HTTP/2 streaming passes in the exercised deployment.
+Native Chromium HTTP/1 streaming remains unsupported. These are bounded FS
+transport results, not certification of every server or a browser SafeJS SDK.
+See the [WebDAV contract](packages/safe-fs/README.md#breaking-change-declare-custom-request-stream-support)
+and [release record](docs/plans/webdav-stream-capability-fix.md#verified-1300-publication--august-30-2026).
 
 Full browser SafeJS SDK/runtime support remains pending. Guest codec integration,
 portable SDK declaration closure and shared host-call policy/replay metadata

package/dist/index.js

@@ -143225,6 +143225,93 @@ var init_misc = __esm({
   }
 });
 
+// packages/safe-js/src/interp/string-coercion.ts
+function sandboxString(value, budget, context, joining = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "function") throw new TypeError("Expected a sandbox value.");
+    return budget.allocateString(String(value));
+  }
+  return stringifyObject2(value, budget, context, joining);
+}
+async function stringifyObject2(value, budget, context, joining) {
+  const leaveCall = budget.enterCall();
+  try {
+    budget.visitNode();
+    for (const name of ["toString", "valueOf"]) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, name);
+      let result;
+      if (descriptor === void 0) {
+        if (name === "valueOf") continue;
+        result = await defaultToString(value, budget, context, joining);
+      } else {
+        const hook = ownDataValue(value, name);
+        if (!isSandboxClosure(hook)) continue;
+        if (context?.invokeClosure === void 0) {
+          throw new TypeError("String hooks require a sandbox call context.");
+        }
+        result = await context.invokeClosure(hook, [], value);
+      }
+      if (result === null || typeof result !== "object") {
+        return sandboxString(result, budget, context, joining);
+      }
+    }
+    throw new TypeError("Cannot convert object to primitive value");
+  } finally {
+    leaveCall();
+  }
+}
+async function defaultToString(value, budget, context, joining) {
+  if (Array.isArray(value) || isFloat32Array(value)) {
+    if (Object.hasOwn(value, "join")) {
+      const join21 = ownDataValue(value, "join");
+      if (!isSandboxClosure(join21))
+        return isFloat32Array(value) ? "[object Float32Array]" : "[object Array]";
+      if (context?.invokeClosure === void 0) {
+        throw new TypeError("String hooks require a sandbox call context.");
+      }
+      return context.invokeClosure(join21, [], value);
+    }
+    if (joining.has(value)) return "";
+    joining.add(value);
+    try {
+      const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
+      let text5 = "";
+      for (let index = 0; index < length; index++) {
+        budget.visitNode();
+        const element = ownDataValue(value, String(index));
+        const part = element === null || element === void 0 ? "" : await sandboxString(element, budget, context, joining);
+        text5 = budget.allocateString(text5 + (index === 0 ? "" : ",") + part);
+      }
+      return text5;
+    } finally {
+      joining.delete(value);
+    }
+  }
+  if (sandboxErrorTypes.has(value)) {
+    const nameValue = ownDataValue(value, "name");
+    const name = nameValue === void 0 ? "Error" : await sandboxString(nameValue, budget, context, joining);
+    const messageValue2 = ownDataValue(value, "message");
+    const message2 = messageValue2 === void 0 ? "" : await sandboxString(messageValue2, budget, context, joining);
+    return name === "" ? message2 : message2 === "" ? name : `${name}: ${message2}`;
+  }
+  return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
+}
+function ownDataValue(value, name) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, name);
+  if (descriptor !== void 0 && !Object.hasOwn(descriptor, "value")) {
+    throw new TypeError("String conversion requires sandbox data properties.");
+  }
+  return descriptor?.value;
+}
+var init_string_coercion = __esm({
+  "packages/safe-js/src/interp/string-coercion.ts"() {
+    "use strict";
+    init_shape();
+    init_float32();
+    init_values();
+  }
+});
+
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
@@ -143320,9 +143407,7 @@ function createObjectArrayGlobals(options) {
     }),
     String: createSandboxClosure({
       sandbox: true,
-      call: ([value]) => options.budget.allocateString(
-        typeof value === "object" && value !== null && sandboxErrorTypes.has(value) && !Object.hasOwn(value, "toString") ? Error.prototype.toString.call(value) : String(value)
-      ),
+      call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
       name: "String",
       properties: {
         raw: createSandboxClosure({
@@ -143538,10 +143623,10 @@ function getTemplateRawParts(template2) {
 var init_object_array = __esm({
   "packages/safe-js/src/interp/globals/object-array.ts"() {
     "use strict";
-    init_shape();
     init_float32();
     init_float32array2();
     init_iteration();
+    init_string_coercion();
     init_values();
   }
 });
@@ -147823,6 +147908,7 @@ async function invokeSandboxClosure(callee, args, context, stack, span, thisValu
       {
         stack,
         thisValue,
+        invokeClosure: (closure, argumentsList, receiver) => invokeSandboxClosure(closure, argumentsList, context, stack, span, receiver),
         ...span === void 0 ? {} : { span }
       }
     ]);
@@ -156468,7 +156554,7 @@ var init_package2 = __esm({
   "package.json"() {
     package_default2 = {
       name: "poe-code",
-      version: "13.0.0",
+      version: "13.0.2",
       description: "CLI tool to configure Poe API for developer workflows.",
       license: "MIT",
       type: "module",
@@ -156747,7 +156833,7 @@ var init_package2 = __esm({
         openai: "^6.34.0",
         "parse-duration": "^2.1.5",
         semver: "^7.7.4",
-        "shell-quote": "^1.8.4",
+        "shell-quote": "^1.9.0",
         "simple-git": "^3.36.0",
         "smol-toml": "^1.6.0",
         tiktoken: "^1.0.22",
@@ -156872,7 +156958,10 @@ var init_package2 = __esm({
           },
           default: null
         }
-      }
+      },
+      bundleDependencies: [
+        "gray-matter"
+      ]
     };
   }
 });