poe-code 14.0.62 → 14.0.64

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-F7TJSPDZ.js";
+} from "./chunks/chunk-3EXDJDQM.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-VKGWGZBH.js";
+} from "./chunks/chunk-XO7B4P27.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-VKGWGZBH.js";
+} from "./chunks/chunk-XO7B4P27.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/graph-depth.js

@@ -3,6 +3,7 @@ import { SandboxError } from "./interp/budget.js";
 import { getSandboxArgumentEntries, isSandboxArguments } from "./interp/arguments.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./interp/collection-iterator.js";
 import { isSandboxMap, isSandboxSet } from "./interp/collection-brands.js";
+import { boxedDataProperties, isSandboxBox } from "./interp/boxed.js";
 export const MAX_DATA_DEPTH = 1_024;
 export class SnapshotBudgetError extends Error {
     code = "budgetExceeded";
@@ -63,6 +64,8 @@ function walkGraphDepth(root, rootPath, assertDepth) {
     }
 }
 function graphEntries(value) {
+    if (isSandboxBox(value))
+        return boxedDataProperties(value).map(([key, descriptor]) => [`.${key}`, descriptor.value]);
     if (isSandboxArguments(value)) {
         return getSandboxArgumentEntries(value).map(([key, entry]) => [`.${key}`, entry]);
     }

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-F7TJSPDZ.js";
+} from "./chunks/chunk-3EXDJDQM.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-VKGWGZBH.js";
+} from "./chunks/chunk-XO7B4P27.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/boxed.d.ts

@@ -0,0 +1,14 @@
+import type { SandboxObject } from "./values.js";
+export type BoxedPrimitive = string | number | boolean;
+export type BoxedKind = "string" | "number" | "boolean";
+declare const boxedPrimitiveBrand: unique symbol;
+export type SandboxBox = SandboxObject & {
+    readonly [boxedPrimitiveBrand]: true;
+};
+export declare function nativeBoxedValue(value: unknown): BoxedPrimitive | undefined;
+export declare function createSandboxBox(value: unknown): SandboxBox;
+export declare function isSandboxBox(value: unknown): value is SandboxBox;
+export declare function boxedValue(value: object): BoxedPrimitive;
+export declare function primitiveReceiver(value: unknown, kind: BoxedKind): BoxedPrimitive;
+export declare function boxedDataProperties(value: object): Array<[string, PropertyDescriptor]>;
+export {};

package/packages/safe-js/dist/interp/boxed.js

@@ -0,0 +1,50 @@
+import { types } from "node:util";
+const boxes = new WeakSet();
+const numberValue = Number.prototype.valueOf;
+const stringValue = String.prototype.valueOf;
+const booleanValue = Boolean.prototype.valueOf;
+export function nativeBoxedValue(value) {
+    if (types.isNumberObject(value))
+        return Reflect.apply(numberValue, value, []);
+    if (types.isStringObject(value))
+        return Reflect.apply(stringValue, value, []);
+    if (types.isBooleanObject(value))
+        return Reflect.apply(booleanValue, value, []);
+    return undefined;
+}
+export function createSandboxBox(value) {
+    if (typeof value !== "number" && typeof value !== "string" && typeof value !== "boolean")
+        throw new TypeError("Invalid boxed primitive payload.");
+    const box = Object(value);
+    Object.setPrototypeOf(box, null);
+    boxes.add(box);
+    return box;
+}
+export function isSandboxBox(value) {
+    return typeof value === "object" && value !== null && boxes.has(value);
+}
+export function boxedValue(value) {
+    if (!boxes.has(value))
+        throw new TypeError("Expected a sandbox boxed primitive.");
+    return nativeBoxedValue(value);
+}
+export function primitiveReceiver(value, kind) {
+    const primitive = isSandboxBox(value) ? boxedValue(value) : value;
+    if (typeof primitive !== kind)
+        throw new TypeError(`${kind} method requires a ${kind} receiver.`);
+    return primitive;
+}
+export function boxedDataProperties(value) {
+    const primitive = nativeBoxedValue(value);
+    return Object.entries(Object.getOwnPropertyDescriptors(value)).filter(([key]) => {
+        if (typeof primitive !== "string")
+            return true;
+        if (key === "length")
+            return false;
+        const index = Number(key);
+        return !(Number.isInteger(index) &&
+            index >= 0 &&
+            index < primitive.length &&
+            String(index) === key);
+    });
+}

package/packages/safe-js/dist/interp/globals/collections.js

@@ -71,13 +71,13 @@ function populateCollection(source, collection, { name, budget, context, append,
     budget.allocateCollectionEntries(0);
     if (source === undefined || source === null)
         return collection;
-    const iterator = getSandboxIterator(source, budget);
+    const iterator = getSandboxIterator(source, budget, context);
     if (iterator === undefined)
         throw new TypeError(`${name} constructor requires an iterable.`);
     let entry;
     let failure;
     const retained = {};
-    budget.setRetainedValues(retained, () => [source, collection, entry, failure, ...(retainedValues?.() ?? [])]);
+    budget.setRetainedValues(retained, () => [source, iterator.retainedValue, collection, entry, failure, ...(retainedValues?.() ?? [])]);
     const checkData = createDataCheckpoint(budget, context);
     const closeOnThrow = (error) => {
         failure = isCapturedException(error) ? error.reason : error;
@@ -88,7 +88,7 @@ function populateCollection(source, collection, { name, budget, context, append,
         };
         try {
             const closing = iterator.return?.();
-            if (iterator.generator)
+            if (iterator.generator || iterator.asynchronous)
                 return Promise.resolve(closing).then(() => { throw error; }, rethrow);
         }
         catch (closeError) {
@@ -113,7 +113,7 @@ function populateCollection(source, collection, { name, budget, context, append,
         }
         return false;
     };
-    if (iterator.generator) {
+    if (iterator.generator || iterator.asynchronous) {
         return (async () => {
             try {
                 checkData(collection, 0, true);

package/packages/safe-js/dist/interp/globals/console-json.js

@@ -1,4 +1,6 @@
 import { dateMethods, isSandboxDate } from "../date.js";
+import { boxedValue, isSandboxBox } from "../boxed.js";
+import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { wrapCallerInjectedBindings } from "../host-bridge.js";
 import { allocateProducedSandboxValue, createSandboxClosure, deepCopyFromSandbox, isSandboxClosure, isSandboxPromise } from "../values.js";
@@ -8,12 +10,15 @@ export function createConsoleJsonGlobals(options) {
         JSON: {
             parse: createSandboxClosure({
                 sandbox: true,
-                call: async ([text]) => parseJson(text, options.budget),
+                call: async ([text], context) => {
+                    const converted = sandboxString(text, options.budget, context);
+                    return copyJsonToSandbox(JSON.parse(converted instanceof Promise ? await converted : converted), options.budget);
+                },
                 name: "parse"
             }),
             stringify: createSandboxClosure({
                 sandbox: true,
-                call: async ([value, replacer, indent]) => stringifyJson(value, replacer, indent, options.budget),
+                call: async ([value, replacer, indent], context) => stringifyJson(value, replacer, indent, options.budget, context),
                 name: "stringify"
             })
         },
@@ -69,11 +74,7 @@ export function createConsoleJsonGlobals(options) {
             })
     };
 }
-function parseJson(input, budget) {
-    const text = budget.allocateString(toJsonParseText(input));
-    return copyJsonToSandbox(JSON.parse(text), budget);
-}
-async function stringifyJson(value, replacer, indent, budget) {
+async function stringifyJson(value, replacer, indent, budget, context) {
     if (replacer !== undefined && replacer !== null && !isSandboxClosure(replacer)) {
         throw new TypeError("JSON.stringify(value, replacer, indent) only supports function, null, or undefined replacers.");
     }
@@ -84,6 +85,7 @@ async function stringifyJson(value, replacer, indent, budget) {
     defineDataProperty(holder, "", value);
     const output = await stringifyProperty("", holder, {
         budget,
+        context,
         gap: normalizeStringifyGap(indent),
         replacer: isSandboxClosure(replacer) ? replacer : undefined,
         stack: []
@@ -93,17 +95,6 @@ async function stringifyJson(value, replacer, indent, budget) {
     }
     return budget.allocateString(output);
 }
-function toJsonParseText(input) {
-    if (Array.isArray(input)) {
-        return input
-            .map((entry) => (entry === null || entry === undefined ? "" : toJsonParseText(entry)))
-            .join(",");
-    }
-    if (typeof input === "object" && input !== null) {
-        return "[object Object]";
-    }
-    return String(input);
-}
 async function stringifyProperty(key, holder, state, indent = "") {
     let value = getOwnDataValue(holder, key);
     if (isSandboxDate(value)) {
@@ -121,6 +112,12 @@ async function stringifyProperty(key, holder, state, indent = "") {
     return stringifyValue(value, state, indent);
 }
 async function stringifyValue(value, state, indent) {
+    if (isSandboxBox(value)) {
+        const primitive = boxedValue(value);
+        value = typeof primitive === "number" ? await sandboxNumber(value, state.budget, state.context)
+            : typeof primitive === "string" ? await sandboxString(value, state.budget, state.context)
+                : primitive;
+    }
     if (value === null) {
         return "null";
     }

package/packages/safe-js/dist/interp/globals/misc.js

@@ -34,7 +34,7 @@ function structuredCloneSandboxValue(value, budget, parent) {
     const operation = budget.acquireCompileOwner(false, parent?.owner);
     const compilation = parent?.owner === operation.owner ? parent : new CompileScope(operation.owner);
     try {
-        const clone = cloneSandboxValue(value, { compilation, resetRegexLastIndex: true });
+        const clone = cloneSandboxValue(value, { compilation, resetRegexLastIndex: true, structuredClone: true });
         assertSandboxGraphDepth(clone);
         assertStructuredCloneable(clone, new WeakSet());
         allocateProducedSandboxValue(clone, budget);

package/packages/safe-js/dist/interp/globals/object-array.js

@@ -3,6 +3,7 @@ import { invokeBuiltinClosure } from "../builtin-call.js";
 import { createDataCheckpoint } from "../data-checkpoint.js";
 import { isCapturedException } from "../exceptions.js";
 import { isSandboxDate } from "../date.js";
+import { createSandboxBox } from "../boxed.js";
 import { getDatePrototype } from "./date.js";
 import { createObjectGlobal, hasOwnSandboxProperty } from "./object.js";
 import { getHostObjectKeys, isGuestHostObject } from "../host-capabilities.js";
@@ -11,6 +12,7 @@ import { setSandboxProperty } from "../interpreter.js";
 import { getSandboxIterator } from "../iteration.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { createNumericParsers } from "./numeric-parsers.js";
+import { createPrimitiveConstructor } from "./primitives.js";
 import { getSandboxDataProperty, getSandboxPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
 import { allocateProducedSandboxValue, createSandboxClosure, deepCopyToSandbox, defineOwnDataProperty, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, measureSandboxData, ownEnumerableSandboxEntries as getOwnEnumerableEntries } from "../values.js";
 export function createObjectArrayGlobals(options) {
@@ -82,6 +84,8 @@ export function createObjectArrayGlobals(options) {
                 call: ([value]) => {
                     if (isSandboxDate(value))
                         return getDatePrototype(value, options.budget, options.compileOwner);
+                    if (value !== null && value !== undefined && typeof value !== "object")
+                        value = createSandboxBox(value);
                     objectProperties(value);
                     return getSandboxPrototype(value, options.budget);
                 },
@@ -123,11 +127,11 @@ export function createObjectArrayGlobals(options) {
             fromEntries: createSandboxClosure({
                 sandbox: true,
                 call: ([value], context) => {
-                    const iterator = getSandboxIterator(value, options.budget);
+                    const iterator = getSandboxIterator(value, options.budget, context);
                     if (iterator === undefined) {
                         throw new TypeError("Object.fromEntries requires an iterable.");
                     }
-                    if (context === undefined && !iterator.generator) {
+                    if (context === undefined && !iterator.generator && !iterator.asynchronous) {
                         // The direct host adapter preserves synchronous results and native hooks.
                         return allocateProducedSandboxValue(Object.setPrototypeOf(Reflect.apply(Object.fromEntries, Object, [{ [Symbol.iterator]: () => iterator }]), null), options.budget);
                     }
@@ -181,8 +185,7 @@ export function createObjectArrayGlobals(options) {
                 })
             }
         }),
-        String: createSandboxClosure({
-            sandbox: true,
+        String: createPrimitiveConstructor({
             call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
             name: "String",
             properties: {
@@ -202,9 +205,8 @@ export function createObjectArrayGlobals(options) {
                     name: "fromCodePoint"
                 })
             }
-        }),
-        Number: createSandboxClosure({
-            sandbox: true,
+        }, options.budget),
+        Number: createPrimitiveConstructor({
             call: (args, context) => sandboxNumber(args.length === 0 ? 0 : args[0], options.budget, context),
             name: "Number",
             properties: {
@@ -238,12 +240,11 @@ export function createObjectArrayGlobals(options) {
                 NEGATIVE_INFINITY: Number.NEGATIVE_INFINITY,
                 POSITIVE_INFINITY: Number.POSITIVE_INFINITY
             }
-        }),
-        Boolean: createSandboxClosure({
-            sandbox: true,
+        }, options.budget),
+        Boolean: createPrimitiveConstructor({
             call: ([value]) => Boolean(value),
             name: "Boolean"
-        })
+        }, options.budget)
     };
 }
 async function objectFromSandboxEntries(items, iterator, budget, context) {
@@ -253,7 +254,7 @@ async function objectFromSandboxEntries(items, iterator, budget, context) {
     let value;
     let failure;
     const retained = {};
-    budget.setRetainedValues(retained, () => [items, object, entry, key, value, failure]);
+    budget.setRetainedValues(retained, () => [items, iterator.retainedValue, object, entry, key, value, failure]);
     const checkData = createDataCheckpoint(budget, context);
     const closeOnThrow = async (error) => {
         failure = isCapturedException(error) ? error.reason : error;
@@ -315,6 +316,10 @@ function assignSandboxValues(target, sources, budget) {
     if (target === null || target === undefined) {
         throw new TypeError("Object.assign(target, ...sources) requires a non-null target.");
     }
+    if (typeof target !== "object") {
+        target = createSandboxBox(target);
+        budget.chargeDataUsage(measureSandboxData([target]));
+    }
     if (!isGuestClosure(target) && !isAssignableSandboxTarget(target)) {
         throw new TypeError("Object.assign(target, ...sources) requires an object or array target.");
     }
@@ -403,13 +408,13 @@ async function arrayFromSandboxValues(args, budget, context) {
     const read = (property) => context?.getProperty !== undefined
         ? context.getProperty(items, property)
         : getSandboxDataProperty(items, property, budget);
-    const iterator = getSandboxIterator(items, budget);
+    const iterator = getSandboxIterator(items, budget, context);
     const constructor = context?.thisValue;
     let result;
     let currentValue;
     let failure;
     const retained = {};
-    budget.setRetainedValues(retained, () => [items, mapFn, constructor, result, currentValue, failure]);
+    budget.setRetainedValues(retained, () => [items, iterator?.retainedValue, mapFn, constructor, result, currentValue, failure]);
     const checkData = createDataCheckpoint(budget, context);
     const closeOnThrow = async (error) => {
         failure = isCapturedException(error) ? error.reason : error;

package/packages/safe-js/dist/interp/globals/object.js

@@ -1,5 +1,6 @@
 import { assertSandboxDataDepth } from "../../graph-depth.js";
 import { isSandboxDate } from "../date.js";
+import { boxedValue, createSandboxBox, isSandboxBox } from "../boxed.js";
 import { isSandboxErrorConstructorInstance } from "../exceptions.js";
 import { isFloat32Array } from "../float32.js";
 import { hasHostObjectMember, isGuestHostObject } from "../host-capabilities.js";
@@ -7,14 +8,18 @@ import { collectionIteratorState, isSandboxCollectionIterator } from "../collect
 import { getSandboxPrototype, installObjectPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties } from "../object-model.js";
 import { sandboxString } from "../string-coercion.js";
 import { createSandboxClosure, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "../values.js";
+import { measureSandboxData } from "../values.js";
 export function createObjectGlobal(methods, budget) {
     const construct = ([value]) => {
         if (value === null || value === undefined) {
             budget.chargeDataUsage(1);
             return Object.create(null);
         }
-        if (typeof value !== "object")
-            throw new TypeError("Object primitive boxing is not supported.");
+        if (typeof value !== "object") {
+            const box = createSandboxBox(value);
+            budget.chargeDataUsage(measureSandboxData([box]));
+            return box;
+        }
         return value;
     };
     const constructor = createSandboxClosure({
@@ -44,9 +49,7 @@ export function createObjectGlobal(methods, budget) {
             length: 0,
             call: (_args, context) => {
                 const value = requireReceiver(context?.thisValue);
-                if (typeof value !== "object")
-                    throw new TypeError("Object primitive boxing is not supported.");
-                return value;
+                return construct([value]);
             }
         }),
         hasOwnProperty: createSandboxClosure({
@@ -117,6 +120,8 @@ export function hasOwnSandboxProperty(value, key, enumerable) {
     return descriptor !== undefined && (!enumerable || descriptor.enumerable === true);
 }
 function typeTag(value) {
+    if (isSandboxBox(value))
+        value = boxedValue(value);
     if (value === undefined)
         return "Undefined";
     if (value === null)

package/packages/safe-js/dist/interp/globals/primitives.d.ts

@@ -0,0 +1,8 @@
+import type { Budget } from "../budget.js";
+import { type BoxedPrimitive } from "../boxed.js";
+import { type SandboxCallContext, type SandboxClosure, type SandboxObject, type SandboxValue } from "../values.js";
+export declare function createPrimitiveConstructor(options: {
+    name: "Number" | "String" | "Boolean";
+    call(args: readonly SandboxValue[], context?: SandboxCallContext): BoxedPrimitive | Promise<BoxedPrimitive>;
+    properties?: SandboxObject;
+}, budget: Budget): SandboxClosure;

package/packages/safe-js/dist/interp/globals/primitives.js

@@ -0,0 +1,69 @@
+import { createSandboxBox, primitiveReceiver } from "../boxed.js";
+import { installBoxedPrototype, materializeFunctionProperties } from "../object-model.js";
+import { getNumberMember, numberMethodNames } from "../methods/number.js";
+import { getStringMember, stringMethodNames } from "../methods/string.js";
+import { createSandboxClosure, isSandboxClosure, measureSandboxData } from "../values.js";
+export function createPrimitiveConstructor(options, budget) {
+    const initial = { Number: 0, String: "", Boolean: false }[options.name];
+    const kind = typeof initial;
+    const prototype = createSandboxBox(initial);
+    const allocate = (value) => {
+        const box = createSandboxBox(value);
+        budget.chargeDataUsage(measureSandboxData([box]));
+        return box;
+    };
+    const constructor = createSandboxClosure({
+        guest: true,
+        sandbox: true,
+        name: options.name,
+        length: 1,
+        call: options.call,
+        construct: (args, context) => {
+            const value = options.call(args, context);
+            return value instanceof Promise ? value.then(allocate) : allocate(value);
+        }
+    });
+    const properties = materializeFunctionProperties(constructor);
+    Object.defineProperty(properties, "prototype", { value: prototype, writable: false });
+    Object.defineProperty(prototype, "constructor", {
+        value: constructor,
+        writable: true,
+        configurable: true
+    });
+    for (const [name, value] of Object.entries(options.properties ?? {}))
+        Object.defineProperty(properties, name, {
+            value,
+            writable: isSandboxClosure(value),
+            configurable: isSandboxClosure(value)
+        });
+    const methods = new Map([
+        [
+            "valueOf",
+            createSandboxClosure({
+                sandbox: true,
+                name: "valueOf",
+                length: 0,
+                call: (_args, context) => primitiveReceiver(context?.thisValue, kind)
+            })
+        ]
+    ]);
+    if (kind === "number") {
+        for (const name of numberMethodNames)
+            methods.set(name, getNumberMember(name, budget));
+    }
+    else {
+        methods.set("toString", createSandboxClosure({
+            sandbox: true,
+            name: "toString",
+            length: 0,
+            call: (_args, context) => budget.allocateString(String(primitiveReceiver(context?.thisValue, kind)))
+        }));
+        if (kind === "string")
+            for (const name of stringMethodNames)
+                methods.set(name, getStringMember("", name, budget));
+    }
+    for (const [name, value] of methods)
+        Object.defineProperty(prototype, name, { value, writable: true, configurable: true });
+    installBoxedPrototype(budget, prototype, constructor);
+    return constructor;
+}

package/packages/safe-js/dist/interp/host-bridge.js

@@ -1,5 +1,6 @@
 import { normalizeClosureResult } from "./async.js";
 import { copyNativeDate } from "./date.js";
+import { boxedDataProperties, createSandboxBox, nativeBoxedValue } from "./boxed.js";
 import { exportHostCapability, importHostCapability, isLiveCapability } from "./host-capabilities.js";
 import { attachErrorSpan, replaceErrorStack } from "../error/shape.js";
 import { SandboxError } from "./budget.js";
@@ -670,6 +671,27 @@ export function copyHostValueToSandbox(value, stackFrames, options, state, path)
                 : path
         }, state);
     }
+    const primitive = nativeBoxedValue(value);
+    if (primitive !== undefined) {
+        if (typeof primitive === "string")
+            budget.allocateString(primitive);
+        const original = value;
+        const existing = state.seen.get(original);
+        if (existing !== undefined)
+            return existing;
+        const copy = createSandboxBox(primitive);
+        state.seen.set(original, copy);
+        budget.chargeDataUsage(measureSandboxData([copy]));
+        for (const [key, descriptor] of boxedDataProperties(original)) {
+            if (!("value" in descriptor))
+                throw new TypeError(`Unsupported sandbox value at ${joinPath(path, key)}: accessor property`);
+            Object.defineProperty(copy, budget.allocateString(key), {
+                ...descriptor,
+                value: copyHostValueToSandbox(descriptor.value, stackFrames, { ...options, capabilityPath: [...(options.capabilityPath ?? []), key] }, state, joinPath(path, key))
+            });
+        }
+        return copy;
+    }
     const date = copyNativeDate(value);
     if (date !== undefined) {
         const existing = state.seen.get(value);