poe-code 14.0.60 → 14.0.61

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-C7UCTQDN.js";
+} from "./chunks/chunk-VAYQP2VZ.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-MKJBQPBH.js";
+} from "./chunks/chunk-ZTGKRKQH.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-MKJBQPBH.js";
+} from "./chunks/chunk-ZTGKRKQH.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-C7UCTQDN.js";
+} from "./chunks/chunk-VAYQP2VZ.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-MKJBQPBH.js";
+} from "./chunks/chunk-ZTGKRKQH.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/interpreter.js

@@ -4,7 +4,8 @@ import { toPropertyKey } from "./property-key.js";
 import { assertPromiseExecutionAllowed } from "./promise-tracker.js";
 import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./jobs.js";
 import { withCancellationSignal } from "./cancel.js";
-import { runResources } from "./resources.js";
+import { retainValues } from "./resources.js";
+import { sandboxString } from "./string-coercion.js";
 import { attachErrorSpan, formatErrorStack, replaceErrorStack } from "../error/shape.js";
 import { evaluateArrowFunctionExpression, evaluateFunctionExpression, evaluateAwaitExpression, emitResumeBreakpoint, createInterpretedClosure, normalizeClosureResult } from "./async.js";
 import { HostCallResumabilityError } from "./host-call.js";
@@ -360,14 +361,18 @@ function isObjectPrototypeSetterProperty(property, key) {
 }
 async function evaluateTemplateLiteral(node, context) {
     let value = context.budget.allocateString(node.quasis[0]?.value.cooked ?? "");
-    const release = retainValues(context.budget, () => [value]);
+    let input = undefined;
+    const release = retainValues(context.budget, () => [value, input]);
     try {
         for (let index = 0; index < node.expressions.length; index += 1) {
             const expression = await evaluateNode(node.expressions[index], context);
             if (expression.kind !== "normal") {
                 return expression;
             }
-            const expressionText = context.budget.allocateString(String(expression.value));
+            input = expression.value;
+            const text = sandboxString(input, context.budget, createCoercionContext(context));
+            const expressionText = typeof text === "string" ? text : await text;
+            input = undefined;
             value = context.budget.allocateString(value + expressionText);
             const quasiText = context.budget.allocateString(node.quasis[index + 1]?.value.cooked ?? "");
             value = context.budget.allocateString(value + quasiText);
@@ -1831,17 +1836,6 @@ async function evaluateMemberAccess(node, context, consume) {
         release();
     }
 }
-function retainValues(budget, values) {
-    const retained = {};
-    budget.setRetainedValues(retained, values);
-    const pending = runResources.getStore()?.referenceReleases;
-    const release = () => {
-        budget.setRetainedValues(retained, undefined);
-        pending?.delete(release);
-    };
-    pending?.add(release);
-    return release;
-}
 async function evaluateMemberProperty(node, context) {
     const property = await evaluateNode(node, context);
     if (property.kind !== "normal") {

package/packages/safe-js/dist/interp/methods/string.js

@@ -2,6 +2,7 @@ import { invokeBuiltinClosure } from "../builtin-call.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { normalizeLastIndex } from "../regex/engine.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
+import { retainValues } from "../resources.js";
 import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { executeRegex, toMatchArray } from "./regex.js";
 const SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
@@ -83,6 +84,9 @@ export function isStringMethodName(property) {
 }
 export function validateStringMethodArguments(_methodName, _args) { }
 export function callStringMethod(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent, context) {
+    if (methodName === "concat" && args.some(argument => argument !== null && typeof argument === "object")) {
+        return callConcat(value, args, budget, context);
+    }
     if (methodName === "isWellFormed") {
         for (let index = 0; index < value.length; index++) {
             const codeUnit = value.charCodeAt(index);
@@ -239,6 +243,20 @@ export function callStringMethod(value, methodName, args, budget, callClosure =
         operation.release();
     }
 }
+async function callConcat(value, args, budget, context) {
+    let result = budget.allocateString(value);
+    const release = retainValues(budget, () => [result]);
+    try {
+        for (const argument of args) {
+            const text = sandboxString(argument, budget, context);
+            result = budget.allocateString(result + (typeof text === "string" ? text : await text));
+        }
+        return result;
+    }
+    finally {
+        release();
+    }
+}
 function callReplaceLikeMethod(value, methodName, args, budget, callClosure, context) {
     const search = args[0];
     const replacement = args[1];

package/packages/safe-js/dist/interp/resources.d.ts

@@ -1,8 +1,10 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import type { Budget } from "./budget.js";
 export type RunResources = {
     signal: AbortSignal;
     referenceReleases: Set<() => void>;
     add(close: () => Promise<void>): void;
 };
 export declare const runResources: AsyncLocalStorage<RunResources>;
+export declare function retainValues(budget: Budget, values: () => Iterable<unknown>): () => void;
 export declare function withRunResources<Result>(signal: AbortSignal | undefined, execute: () => Promise<Result>): Promise<Result>;

package/packages/safe-js/dist/interp/resources.js

@@ -1,5 +1,16 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 export const runResources = new AsyncLocalStorage();
+export function retainValues(budget, values) {
+    const retained = {};
+    budget.setRetainedValues(retained, values);
+    const pending = runResources.getStore()?.referenceReleases;
+    const release = () => {
+        budget.setRetainedValues(retained, undefined);
+        pending?.delete(release);
+    };
+    pending?.add(release);
+    return release;
+}
 export async function withRunResources(signal, execute) {
     const controller = new AbortController();
     const cancel = () => controller.abort(signal?.reason);

package/packages/safe-js/dist/interp/string-coercion.js

@@ -7,6 +7,7 @@ import { isGuestHostObject } from "./host-capabilities.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
 import { getGuestFunctionProperties, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure } from "./object-model.js";
 import { getRegexMember } from "./methods/regex.js";
+import { retainValues } from "./resources.js";
 import { isSandboxClosure, isSandboxPromise, isSandboxMap, isSandboxSet, isSandboxRegex, isSandboxGenerator } from "./values.js";
 const defaultStringHook = Symbol("defaultStringHook");
 const defaultValueHook = Symbol("defaultValueHook");
@@ -118,9 +119,10 @@ async function defaultToString(value, budget, context, joining) {
         if (joining.has(value))
             return "";
         joining.add(value);
+        let text = "";
+        const release = retainValues(budget, () => [text]);
         try {
             const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
-            let text = "";
             for (let index = 0; index < length; index++) {
                 budget.visitNode();
                 const element = ownDataValue(value, String(index));
@@ -132,15 +134,22 @@ async function defaultToString(value, budget, context, joining) {
             return text;
         }
         finally {
+            release();
             joining.delete(value);
         }
     }
     if (sandboxErrorTypes.has(value)) {
         const nameValue = ownDataValue(value, "name");
         const name = nameValue === undefined ? "Error" : await sandboxString(nameValue, budget, context, joining);
-        const messageValue = ownDataValue(value, "message");
-        const message = messageValue === undefined ? "" : await sandboxString(messageValue, budget, context, joining);
-        return name === "" ? message : message === "" ? name : `${name}: ${message}`;
+        const release = retainValues(budget, () => [name]);
+        try {
+            const messageValue = ownDataValue(value, "message");
+            const message = messageValue === undefined ? "" : await sandboxString(messageValue, budget, context, joining);
+            return name === "" ? message : message === "" ? name : `${name}: ${message}`;
+        }
+        finally {
+            release();
+        }
     }
     return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
 }