poe-code 14.0.59 → 14.0.61

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-YZGYOQK3.js";
+} from "./chunks/chunk-VAYQP2VZ.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-D4YY44EF.js";
+} from "./chunks/chunk-ZTGKRKQH.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-D4YY44EF.js";
+} from "./chunks/chunk-ZTGKRKQH.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-YZGYOQK3.js";
+} from "./chunks/chunk-VAYQP2VZ.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-D4YY44EF.js";
+} from "./chunks/chunk-ZTGKRKQH.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/interpreter.js

@@ -4,7 +4,8 @@ import { toPropertyKey } from "./property-key.js";
 import { assertPromiseExecutionAllowed } from "./promise-tracker.js";
 import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./jobs.js";
 import { withCancellationSignal } from "./cancel.js";
-import { runResources } from "./resources.js";
+import { retainValues } from "./resources.js";
+import { sandboxString } from "./string-coercion.js";
 import { attachErrorSpan, formatErrorStack, replaceErrorStack } from "../error/shape.js";
 import { evaluateArrowFunctionExpression, evaluateFunctionExpression, evaluateAwaitExpression, emitResumeBreakpoint, createInterpretedClosure, normalizeClosureResult } from "./async.js";
 import { HostCallResumabilityError } from "./host-call.js";
@@ -360,14 +361,18 @@ function isObjectPrototypeSetterProperty(property, key) {
 }
 async function evaluateTemplateLiteral(node, context) {
     let value = context.budget.allocateString(node.quasis[0]?.value.cooked ?? "");
-    const release = retainValues(context.budget, () => [value]);
+    let input = undefined;
+    const release = retainValues(context.budget, () => [value, input]);
     try {
         for (let index = 0; index < node.expressions.length; index += 1) {
             const expression = await evaluateNode(node.expressions[index], context);
             if (expression.kind !== "normal") {
                 return expression;
             }
-            const expressionText = context.budget.allocateString(String(expression.value));
+            input = expression.value;
+            const text = sandboxString(input, context.budget, createCoercionContext(context));
+            const expressionText = typeof text === "string" ? text : await text;
+            input = undefined;
             value = context.budget.allocateString(value + expressionText);
             const quasiText = context.budget.allocateString(node.quasis[index + 1]?.value.cooked ?? "");
             value = context.budget.allocateString(value + quasiText);
@@ -1831,17 +1836,6 @@ async function evaluateMemberAccess(node, context, consume) {
         release();
     }
 }
-function retainValues(budget, values) {
-    const retained = {};
-    budget.setRetainedValues(retained, values);
-    const pending = runResources.getStore()?.referenceReleases;
-    const release = () => {
-        budget.setRetainedValues(retained, undefined);
-        pending?.delete(release);
-    };
-    pending?.add(release);
-    return release;
-}
 async function evaluateMemberProperty(node, context) {
     const property = await evaluateNode(node, context);
     if (property.kind !== "normal") {

package/packages/safe-js/dist/interp/methods/string.js

@@ -2,6 +2,7 @@ import { invokeBuiltinClosure } from "../builtin-call.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { normalizeLastIndex } from "../regex/engine.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
+import { retainValues } from "../resources.js";
 import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { executeRegex, toMatchArray } from "./regex.js";
 const SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
@@ -83,6 +84,9 @@ export function isStringMethodName(property) {
 }
 export function validateStringMethodArguments(_methodName, _args) { }
 export function callStringMethod(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent, context) {
+    if (methodName === "concat" && args.some(argument => argument !== null && typeof argument === "object")) {
+        return callConcat(value, args, budget, context);
+    }
     if (methodName === "isWellFormed") {
         for (let index = 0; index < value.length; index++) {
             const codeUnit = value.charCodeAt(index);
@@ -239,6 +243,20 @@ export function callStringMethod(value, methodName, args, budget, callClosure =
         operation.release();
     }
 }
+async function callConcat(value, args, budget, context) {
+    let result = budget.allocateString(value);
+    const release = retainValues(budget, () => [result]);
+    try {
+        for (const argument of args) {
+            const text = sandboxString(argument, budget, context);
+            result = budget.allocateString(result + (typeof text === "string" ? text : await text));
+        }
+        return result;
+    }
+    finally {
+        release();
+    }
+}
 function callReplaceLikeMethod(value, methodName, args, budget, callClosure, context) {
     const search = args[0];
     const replacement = args[1];

package/packages/safe-js/dist/interp/resources.d.ts

@@ -1,8 +1,10 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import type { Budget } from "./budget.js";
 export type RunResources = {
     signal: AbortSignal;
     referenceReleases: Set<() => void>;
     add(close: () => Promise<void>): void;
 };
 export declare const runResources: AsyncLocalStorage<RunResources>;
+export declare function retainValues(budget: Budget, values: () => Iterable<unknown>): () => void;
 export declare function withRunResources<Result>(signal: AbortSignal | undefined, execute: () => Promise<Result>): Promise<Result>;

package/packages/safe-js/dist/interp/resources.js

@@ -1,5 +1,16 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 export const runResources = new AsyncLocalStorage();
+export function retainValues(budget, values) {
+    const retained = {};
+    budget.setRetainedValues(retained, values);
+    const pending = runResources.getStore()?.referenceReleases;
+    const release = () => {
+        budget.setRetainedValues(retained, undefined);
+        pending?.delete(release);
+    };
+    pending?.add(release);
+    return release;
+}
 export async function withRunResources(signal, execute) {
     const controller = new AbortController();
     const cancel = () => controller.abort(signal?.reason);

package/packages/safe-js/dist/interp/string-coercion.js

@@ -7,6 +7,7 @@ import { isGuestHostObject } from "./host-capabilities.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
 import { getGuestFunctionProperties, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure } from "./object-model.js";
 import { getRegexMember } from "./methods/regex.js";
+import { retainValues } from "./resources.js";
 import { isSandboxClosure, isSandboxPromise, isSandboxMap, isSandboxSet, isSandboxRegex, isSandboxGenerator } from "./values.js";
 const defaultStringHook = Symbol("defaultStringHook");
 const defaultValueHook = Symbol("defaultValueHook");
@@ -118,9 +119,10 @@ async function defaultToString(value, budget, context, joining) {
         if (joining.has(value))
             return "";
         joining.add(value);
+        let text = "";
+        const release = retainValues(budget, () => [text]);
         try {
             const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
-            let text = "";
             for (let index = 0; index < length; index++) {
                 budget.visitNode();
                 const element = ownDataValue(value, String(index));
@@ -132,15 +134,22 @@ async function defaultToString(value, budget, context, joining) {
             return text;
         }
         finally {
+            release();
             joining.delete(value);
         }
     }
     if (sandboxErrorTypes.has(value)) {
         const nameValue = ownDataValue(value, "name");
         const name = nameValue === undefined ? "Error" : await sandboxString(nameValue, budget, context, joining);
-        const messageValue = ownDataValue(value, "message");
-        const message = messageValue === undefined ? "" : await sandboxString(messageValue, budget, context, joining);
-        return name === "" ? message : message === "" ? name : `${name}: ${message}`;
+        const release = retainValues(budget, () => [name]);
+        try {
+            const messageValue = ownDataValue(value, "message");
+            const message = messageValue === undefined ? "" : await sandboxString(messageValue, budget, context, joining);
+            return name === "" ? message : message === "" ? name : `${name}: ${message}`;
+        }
+        finally {
+            release();
+        }
     }
     return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
 }

package/packages/safe-js/dist/parse/parser.js

@@ -107,24 +107,22 @@ function parseTokens(tokens, compilation) {
 function parseModuleTokens(tokens, compilation) {
     return new Parser(tokens, compilation).parseModule();
 }
-function parseExpressionTokens(tokens, compilation) {
-    return new Parser(tokens, compilation).parseExpressionOnly();
-}
 class Parser {
     tokens;
     compilation;
+    functionContext;
     index = 0;
     breakableDepth = 0;
     conditionalExpressionDepth = 0;
     ifStatementDepth = 0;
     loopDepth = 0;
-    generatorBody = false;
     scopes = [new Map()];
     functionScopes = new WeakSet();
     varNames = new WeakMap();
-    constructor(tokens, compilation) {
+    constructor(tokens, compilation, functionContext = "normal") {
         this.tokens = tokens;
         this.compilation = compilation;
+        this.functionContext = functionContext;
         this.functionScopes.add(this.scopes[0]);
     }
     parseTopLevel() {
@@ -312,9 +310,9 @@ class Parser {
     }
     parseArrowFunctionBody(params) {
         if (this.currentToken().type === "punctuator" && this.currentToken().value === "{") {
-            return this.withFunctionContext(false, () => this.parseBlockStatement(params));
+            return this.withFunctionContext("normal", () => this.parseBlockStatement(params));
         }
-        return this.withFunctionContext(false, () => this.parseExpression().node);
+        return this.withFunctionContext("normal", () => this.parseExpression().node);
     }
     parseBlockStatement(params, catchParam) {
         const start = this.expectPunctuator("{");
@@ -921,7 +919,7 @@ class Parser {
             return parsedParams;
         });
         const generator = generatorToken !== undefined;
-        const body = this.withFunctionContext(generator, () => this.parseBlockStatement(params));
+        const body = this.withFunctionContext(generator ? "generator" : "normal", () => this.parseBlockStatement(params));
         return {
             type: "FunctionDeclaration",
             async: asyncToken !== undefined,
@@ -952,30 +950,32 @@ class Parser {
         };
     }
     parseArrowParameters() {
-        this.expectPunctuator("(");
-        const params = [];
-        if (this.consumePunctuator(")") !== undefined) {
-            return params;
-        }
-        while (true) {
-            const param = this.parseBindingElement();
-            params.push(param);
-            const comma = this.consumePunctuator(",");
-            if (comma === undefined) {
-                break;
+        return this.withFunctionContext("parameters", () => {
+            this.expectPunctuator("(");
+            const params = [];
+            if (this.consumePunctuator(")") !== undefined) {
+                return params;
             }
-            if (param.type === "RestElement") {
+            while (true) {
+                const param = this.parseBindingElement();
+                params.push(param);
+                const comma = this.consumePunctuator(",");
+                if (comma === undefined) {
+                    break;
+                }
+                if (param.type === "RestElement") {
+                    if (this.currentToken().type === "punctuator" && this.currentToken().value === ")") {
+                        throw unexpectedTokenError(comma);
+                    }
+                    throw new Error(`Rest element must be the last parameter at line ${comma.start.line}, column ${comma.start.column}.`);
+                }
                 if (this.currentToken().type === "punctuator" && this.currentToken().value === ")") {
-                    throw unexpectedTokenError(comma);
+                    break;
                 }
-                throw new Error(`Rest element must be the last parameter at line ${comma.start.line}, column ${comma.start.column}.`);
-            }
-            if (this.currentToken().type === "punctuator" && this.currentToken().value === ")") {
-                break;
             }
-        }
-        this.expectPunctuator(")");
-        return params;
+            this.expectPunctuator(")");
+            return params;
+        });
     }
     parseBindingElement() {
         if (this.consumePunctuator("...") !== undefined) {
@@ -1509,7 +1509,7 @@ class Parser {
             };
         }
         if (token.type === "keyword" && token.value === "yield") {
-            if (!this.generatorBody) {
+            if (this.functionContext !== "generator") {
                 throw new Error(`yield is only valid inside a generator body at line ${token.start.line}, column ${token.start.column}.`);
             }
             this.index += 1;
@@ -1539,9 +1539,12 @@ class Parser {
             };
         }
         if (token.type === "keyword" && token.value === "await") {
-            if (this.generatorBody) {
+            if (this.functionContext === "generator") {
                 throw new Error(`generators cannot await; use a regular async function at line ${token.start.line}, column ${token.start.column}.`);
             }
+            if (this.functionContext === "parameters") {
+                throw new Error(`await is not valid in function parameters at line ${token.start.line}, column ${token.start.column}.`);
+            }
             this.index += 1;
             const argument = this.parseUnaryExpression();
             return {
@@ -1666,7 +1669,7 @@ class Parser {
                 continue;
             }
             if (this.currentToken().type === "template") {
-                const quasi = createTemplateLiteral(this.currentToken(), { allowMalformedEscapes: true }, this.compilation);
+                const quasi = createTemplateLiteral(this.currentToken(), { allowMalformedEscapes: true, functionContext: this.functionContext }, this.compilation);
                 this.index += 1;
                 expression = {
                     node: {
@@ -1754,7 +1757,7 @@ class Parser {
         if (token.type === "template") {
             this.index += 1;
             return {
-                node: createTemplateLiteral(token, { allowMalformedEscapes: false }, this.compilation),
+                node: createTemplateLiteral(token, { allowMalformedEscapes: false, functionContext: this.functionContext }, this.compilation),
                 parenthesized: false
             };
         }
@@ -1871,7 +1874,7 @@ class Parser {
             return parsedParams;
         });
         const generator = generatorToken !== undefined;
-        const body = this.withFunctionContext(generator, () => this.parseBlockStatement(params));
+        const body = this.withFunctionContext(generator ? "generator" : "normal", () => this.parseBlockStatement(params));
         return {
             type: "FunctionExpression",
             async: asyncToken !== undefined,
@@ -2135,7 +2138,7 @@ class Parser {
             }
             return parsedParams;
         });
-        const body = this.withFunctionContext(false, () => this.parseBlockStatement(params));
+        const body = this.withFunctionContext("normal", () => this.parseBlockStatement(params));
         return {
             type: "FunctionExpression",
             async: asyncToken !== undefined,
@@ -2546,20 +2549,20 @@ class Parser {
             (nextToken.type === "punctuator" && (nextToken.value === ";" || nextToken.value === "}")) ||
             nextToken.type === "eof");
     }
-    withFunctionContext(generatorBody, callback) {
+    withFunctionContext(functionContext, callback) {
         const previousBreakableDepth = this.breakableDepth;
         const previousLoopDepth = this.loopDepth;
-        const previousGeneratorBody = this.generatorBody;
+        const previousFunctionContext = this.functionContext;
         this.breakableDepth = 0;
         this.loopDepth = 0;
-        this.generatorBody = generatorBody;
+        this.functionContext = functionContext;
         try {
             return callback();
         }
         finally {
             this.breakableDepth = previousBreakableDepth;
             this.loopDepth = previousLoopDepth;
-            this.generatorBody = previousGeneratorBody;
+            this.functionContext = previousFunctionContext;
         }
     }
     withLoopContext(callback) {
@@ -3014,7 +3017,7 @@ function createLiteralFromToken(token) {
     }
     return createKeywordLiteral(token);
 }
-function createTemplateLiteral(token, options = { allowMalformedEscapes: false }, compilation) {
+function createTemplateLiteral(token, options, compilation) {
     const raw = token.value;
     const expressions = [];
     const quasis = [];
@@ -3030,7 +3033,7 @@ function createTemplateLiteral(token, options = { allowMalformedEscapes: false }
             quasis.push(createTemplateElement(token.start, raw, quasiStart, cursor, false, options));
             const expressionStart = cursor + 2;
             const expressionEnd = findTemplateExpressionEnd(raw, expressionStart);
-            expressions.push(parseEmbeddedExpression(raw.slice(expressionStart, expressionEnd), positionWithinRaw(token.start, raw, expressionStart), compilation));
+            expressions.push(parseEmbeddedExpression(raw.slice(expressionStart, expressionEnd), positionWithinRaw(token.start, raw, expressionStart), options.functionContext, compilation));
             quasiStart = expressionEnd + 1;
             cursor = expressionEnd + 1;
             continue;
@@ -3391,13 +3394,13 @@ function decodeHexEscape(value, start) {
         end: index + 2
     };
 }
-function parseEmbeddedExpression(source, base, compilation) {
+function parseEmbeddedExpression(source, base, functionContext, compilation) {
     const tokens = tokenize(source, { allowRegexLiterals: true, compilation }).map((token) => ({
         ...token,
         start: rebasePosition(token.start, base),
         end: rebasePosition(token.end, base)
     }));
-    return parseExpressionTokens(tokens, compilation);
+    return new Parser(tokens, compilation, functionContext).parseExpressionOnly();
 }
 export function findRegexLiteral(node) {
     if (node === null || node === undefined) {