poe-code 14.0.53 → 14.0.55

package/packages/safe-js/dist/chunks/{chunk-4XYGVCOQ.js → chunk-G5LQ37D4.js}

@@ -27,7 +27,7 @@ import {
   validateMigrationSemantics,
   validateSnapshotData,
   validateSnapshotMigration
-} from "./chunk-VDFW3EKS.js";
+} from "./chunk-6LFWVA64.js";
 import {
   createFileSystem,
   createNodeFileSystemAdapterRegistry,
@@ -8245,4 +8245,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-4XYGVCOQ.js.map
+//# sourceMappingURL=chunk-G5LQ37D4.js.map

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-4XYGVCOQ.js";
+} from "./chunks/chunk-G5LQ37D4.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-VDFW3EKS.js";
+} from "./chunks/chunk-6LFWVA64.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-VDFW3EKS.js";
+} from "./chunks/chunk-6LFWVA64.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-4XYGVCOQ.js";
+} from "./chunks/chunk-G5LQ37D4.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-VDFW3EKS.js";
+} from "./chunks/chunk-6LFWVA64.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/globals/regex.d.ts

@@ -1,5 +1,8 @@
 import { type SandboxClosure } from "../values.js";
-import { type CompileOwner } from "../budget.js";
-export declare function createRegexGlobals(owner?: CompileOwner): {
+import { type Budget, type CompileOwner } from "../budget.js";
+export declare function createRegexGlobals(options: {
+    budget: Budget;
+    compileOwner?: CompileOwner;
+}): {
     RegExp: SandboxClosure;
 };

package/packages/safe-js/dist/interp/globals/regex.js

@@ -1,28 +1,42 @@
-import { createSandboxClosure, createSandboxRegex, reconcileCompiledValues } from "../values.js";
+import { createSandboxClosure, createSandboxRegex, isSandboxRegex, reconcileCompiledValues } from "../values.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { SandboxError } from "../budget.js";
-export function createRegexGlobals(owner) {
-    const construct = (args, context) => {
-        const selected = owner ?? context?.compilation?.owner;
+import { sandboxString } from "../string-coercion.js";
+export function createRegexGlobals(options) {
+    const invoke = (construct) => async (args, context) => {
+        const selected = options.compileOwner ?? context?.compilation?.owner;
         if (context?.compilation?.owner !== undefined && selected !== context.compilation.owner) {
             throw new SandboxError("reentry");
         }
-        const operation = selected?.budget.acquireCompileOwner(false, selected);
-        const compilation = context?.compilation ?? new CompileScope(selected);
+        const operation = options.budget.acquireCompileOwner(false, selected);
+        const compilation = context?.compilation?.owner === operation.owner
+            ? context.compilation : new CompileScope(operation.owner);
+        let source = "";
+        const retained = {};
+        options.budget.setRetainedValues(retained, () => [...args, source]);
         try {
-            const regex = createSandboxRegex(String(args[0] ?? ""), String(args[1] ?? ""), 0, compilation);
-            if (context?.compilation === undefined && selected !== undefined) {
-                reconcileCompiledValues(selected.budget, [regex], compilation);
+            const pattern = args[0];
+            const flags = args[1];
+            if (!construct && isSandboxRegex(pattern) && flags === undefined)
+                return pattern;
+            const sourceValue = isSandboxRegex(pattern) ? pattern.source : pattern;
+            const flagsValue = isSandboxRegex(pattern) && flags === undefined ? pattern.flags : flags;
+            source = sourceValue === undefined ? "" : await sandboxString(sourceValue, options.budget, context);
+            const flagText = flagsValue === undefined ? "" : await sandboxString(flagsValue, options.budget, context);
+            const regex = createSandboxRegex(source, flagText, 0, compilation);
+            if (compilation !== context?.compilation) {
+                reconcileCompiledValues(options.budget, [regex], compilation);
             }
             return regex;
         }
         finally {
-            if (context?.compilation === undefined)
+            options.budget.setRetainedValues(retained, undefined);
+            if (compilation !== context?.compilation)
                 compilation.dispose();
-            operation?.release();
+            operation.release();
         }
     };
     return {
-        RegExp: createSandboxClosure({ sandbox: true, name: "RegExp", call: construct, construct })
+        RegExp: createSandboxClosure({ sandbox: true, name: "RegExp", call: invoke(false), construct: invoke(true) })
     };
 }

package/packages/safe-js/dist/interp/globals.js

@@ -19,6 +19,6 @@ export function createBuiltinBindings(options) {
         ...createObjectArrayGlobals(options),
         ...createMiscGlobals(options),
         ...createPromiseGlobals(options),
-        ...createRegexGlobals(options.compileOwner)
+        ...createRegexGlobals(options)
     };
 }

package/packages/safe-js/dist/interp/interpreter.js

@@ -1938,7 +1938,7 @@ async function evaluateStringMethodCall(node, target, methodName, context) {
         return {
             kind: "normal",
             hasValue: true,
-            value: await callStringMethod(target, methodName, args.value, context.budget, (closure, closureArgs) => invokeSandboxClosure(closure, closureArgs, context, context.callStack), context.compilation)
+            value: await callStringMethod(target, methodName, args.value, context.budget, (closure, closureArgs) => invokeSandboxClosure(closure, closureArgs, context, context.callStack), context.compilation, createCoercionContext(context))
         };
     }
     catch (error) {

package/packages/safe-js/dist/interp/methods/string.d.ts

@@ -1,10 +1,10 @@
 import type { Expression } from "../../parse.js";
 import { Budget } from "../budget.js";
 import { CompileScope } from "../regex/compile-guard.js";
-import { type SandboxClosure, type SandboxValue } from "../values.js";
+import { type SandboxCallContext, type SandboxClosure, type SandboxValue } from "../values.js";
 type StringMethodName = "at" | "charAt" | "charCodeAt" | "codePointAt" | "concat" | "endsWith" | "includes" | "indexOf" | "isWellFormed" | "lastIndexOf" | "localeCompare" | "match" | "matchAll" | "normalize" | "padEnd" | "padStart" | "repeat" | "replace" | "replaceAll" | "slice" | "search" | "split" | "startsWith" | "substr" | "substring" | "toLowerCase" | "toUpperCase" | "toWellFormed" | "trim" | "trimEnd" | "trimStart";
 export declare function getStringMember(value: string, property: string | number, budget: Budget): SandboxValue | undefined;
 export declare function isStringMethodName(property: string | number): property is StringMethodName;
 export declare function validateStringMethodArguments(_methodName: StringMethodName, _args: readonly Expression[]): void;
-export declare function callStringMethod(value: string, methodName: StringMethodName, args: readonly SandboxValue[], budget: Budget, callClosure?: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>, parent?: CompileScope): SandboxValue | Promise<SandboxValue>;
+export declare function callStringMethod(value: string, methodName: StringMethodName, args: readonly SandboxValue[], budget: Budget, callClosure?: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>, parent?: CompileScope, context?: SandboxCallContext): SandboxValue | Promise<SandboxValue>;
 export {};

package/packages/safe-js/dist/interp/methods/string.js

@@ -1,4 +1,6 @@
+import { invokeBuiltinClosure } from "../builtin-call.js";
 import { CompileScope } from "../regex/compile-guard.js";
+import { sandboxString } from "../string-coercion.js";
 import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { executeRegex, toMatchArray } from "./regex.js";
 const SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
@@ -51,9 +53,21 @@ export function getStringMember(value, property, budget) {
         name: `String#${property}`,
         ...(property === "localeCompare" ? { length: 1 } : {}),
         ...(property === "isWellFormed" || property === "toWellFormed" ? { length: 0 } : {}),
-        call: (args, context) => callStringMethod(value, property, args, budget, context === undefined
-            ? undefined
-            : async (closure, closureArgs) => await closure.call(closureArgs, { ...context, thisValue: undefined }), context?.compilation)
+        call: async (args, context) => {
+            const receiver = context?.thisValue;
+            if (receiver === null || receiver === undefined) {
+                throw new TypeError(`String#${property} requires a non-null receiver.`);
+            }
+            const retainedReceiver = {};
+            budget.setRetainedValues(retainedReceiver, () => [receiver]);
+            try {
+                const string = await sandboxString(receiver, budget, context);
+                return await callStringMethod(string, property, args, budget, (closure, closureArgs) => invokeBuiltinClosure(closure, closureArgs, budget, context, undefined), context?.compilation, context);
+            }
+            finally {
+                budget.setRetainedValues(retainedReceiver, undefined);
+            }
+        }
     });
 }
 function getStringIndex(property) {
@@ -67,7 +81,7 @@ export function isStringMethodName(property) {
     return typeof property === "string" && stringMethodNames.has(property);
 }
 export function validateStringMethodArguments(_methodName, _args) { }
-export function callStringMethod(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent) {
+export function callStringMethod(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent, context) {
     if (methodName === "isWellFormed") {
         for (let index = 0; index < value.length; index++) {
             const codeUnit = value.charCodeAt(index);
@@ -108,6 +122,9 @@ export function callStringMethod(value, methodName, args, budget, callClosure =
     if (methodName === "replace" || methodName === "replaceAll") {
         return callReplaceLikeMethod(value, methodName, args, budget, callClosure);
     }
+    if ((methodName === "match" || methodName === "matchAll" || methodName === "search") && !isSandboxRegex(args[0])) {
+        return callStringPattern(value, methodName, args[0], budget, parent, context);
+    }
     const operation = budget.acquireCompileOwner(false, parent?.owner);
     const compilation = new CompileScope(operation.owner);
     try {
@@ -365,6 +382,22 @@ function callSplit(value, args, budget, compilation) {
     budget.allocateArrayLength(result.length);
     return result;
 }
+async function callStringPattern(value, methodName, pattern, budget, parent, context) {
+    const operation = budget.acquireCompileOwner(false, parent?.owner);
+    const compilation = new CompileScope(operation.owner);
+    const retainedPattern = {};
+    budget.setRetainedValues(retainedPattern, () => [pattern]);
+    try {
+        const source = pattern === undefined ? "" : await sandboxString(pattern, budget, context);
+        const regex = createSandboxRegex(source, methodName === "matchAll" ? "g" : "", 0, compilation);
+        return callMatchLikeMethod(value, methodName, [regex], compilation);
+    }
+    finally {
+        budget.setRetainedValues(retainedPattern, undefined);
+        compilation.dispose();
+        operation.release();
+    }
+}
 function callMatchLikeMethod(value, methodName, args, compilation) {
     const regex = args[0];
     if (!isSandboxRegex(regex))
@@ -387,19 +420,20 @@ function callMatchLikeMethod(value, methodName, args, compilation) {
     const matcher = methodName === "matchAll"
         ? createSandboxRegex(regex.source, regex.flags, regex.lastIndex, compilation)
         : regex;
-    const matches = collectRegexMatches(matcher, value, true);
+    const matches = collectRegexMatches(matcher, value, true, compilation.owner?.budget);
     if (methodName === "match" && matches.length === 0)
         return null;
     return methodName === "match"
         ? matches.map((match) => match.text)
         : matches.map((match) => toMatchArray(match, value));
 }
-function collectRegexMatches(regex, value, all) {
+function collectRegexMatches(regex, value, all, budget) {
     const matches = [];
     do {
         const match = executeRegex(regex, value);
         if (match === null)
             break;
+        budget?.allocateArrayLength(matches.length + 1);
         matches.push(match);
         if (all && match.text.length === 0)
             regex.lastIndex += 1;