poe-code 14.0.63 → 14.0.64

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-KMTTD3BL.js";
+} from "./chunks/chunk-3EXDJDQM.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-RU2BCN4G.js";
+} from "./chunks/chunk-XO7B4P27.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-RU2BCN4G.js";
+} from "./chunks/chunk-XO7B4P27.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-KMTTD3BL.js";
+} from "./chunks/chunk-3EXDJDQM.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-RU2BCN4G.js";
+} from "./chunks/chunk-XO7B4P27.js";
 import "./chunks/chunk-UXMKEUH3.js";
 import "./chunks/chunk-5DYEOCT5.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/interpreter.js

@@ -14,7 +14,7 @@ import { CompileScope, RegexCompileGuard } from "./regex/compile-guard.js";
 import { createCapturedException, createThrowCompletion, evaluateThrowStatement as evaluateThrowStatementResult, evaluateTryStatement as evaluateTryStatementResult, isCapturedException, isInterpreterError, surfaceThrownValue } from "./exceptions.js";
 import { callArrayMethod, getArrayMember, isArrayMethodName } from "./methods/array.js";
 import { getFunctionMember } from "./methods/function.js";
-import { getBoxedPrototype, getGuestFunctionProperty, getSandboxPrototype, isDefaultBoxedMethod, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
+import { getBoxedPrototype, getGuestFunctionProperty, getSandboxPrototype, hasExplicitSandboxPrototype, isDefaultBoxedMethod, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
 import { getStringIndex } from "./methods/string.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { callMapMethod, getMapMember, isMapMethodName } from "./methods/map.js";
@@ -2219,8 +2219,9 @@ function hasSandboxProperty(value, key, context) {
             return hasHostObjectMember(current, key);
         if (hasOwnSandboxProperty(current, key, false))
             return true;
-        if (Array.isArray(current) || !isPlainSandboxObject(current) ||
-            isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current)) {
+        if (!(isGuestClosure(current) && hasExplicitSandboxPrototype(current)) &&
+            (Array.isArray(current) || !isPlainSandboxObject(current) ||
+                isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current))) {
             return getPropertyValue(current, key, context) !== undefined;
         }
         current = getSandboxPrototype(current, context.budget);

package/packages/safe-js/dist/interp/methods/function.js

@@ -1,23 +1,37 @@
 import { createSandboxClosure, isSandboxClosure } from "../values.js";
-import { getGuestFunctionProperty, isGuestClosure } from "../object-model.js";
+import { getGuestFunctionProperty, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure, setSandboxPrototype } from "../object-model.js";
+import { assertSandboxDataDepth } from "../../graph-depth.js";
 import { functionString } from "../function-string.js";
 import { runResources } from "../resources.js";
 const functionMethodNames = new Set(["apply", "bind", "call", "toString"]);
 export function getFunctionMember(target, property, options) {
-    if (isGuestClosure(target)) {
-        const value = getGuestFunctionProperty(target, String(property));
-        if (value !== undefined || Object.hasOwn(target.properties ?? {}, String(property)))
-            return value;
-        if (!isFunctionMethodName(property))
-            return undefined;
-    }
-    const properties = target.properties;
-    if (properties !== undefined && Object.hasOwn(properties, String(property))) {
-        return properties[String(property)];
-    }
-    if (property === "length") {
-        return target.length;
+    let current = target;
+    let depth = 0;
+    while (current !== null) {
+        if (isGuestClosure(current)) {
+            const value = getGuestFunctionProperty(current, String(property));
+            if (value !== undefined || Object.hasOwn(current.properties ?? {}, String(property)))
+                return value;
+        }
+        else if (isSandboxClosure(current)) {
+            if (current.properties !== undefined && Object.hasOwn(current.properties, String(property)))
+                return current.properties[String(property)];
+            if (property === "length")
+                return current.length;
+        }
+        else if (Object.hasOwn(current, String(property))) {
+            return current[String(property)];
+        }
+        if (isSandboxClosure(current) && !hasExplicitSandboxPrototype(current))
+            break;
+        current = getSandboxPrototype(current, options.budget);
+        if (current !== null) {
+            options.budget?.visitNode();
+            assertSandboxDataDepth(++depth);
+        }
     }
+    if (current === null)
+        return undefined;
     if (property === "toString" && runResources.getStore()?.functionSourceText === false)
         return undefined;
     if (!isFunctionMethodName(property)) {
@@ -44,7 +58,7 @@ function callFunctionMethod(target, methodName, args, options, stack) {
     const thisValue = args[0];
     if (methodName === "bind") {
         const boundArgs = args.slice(1);
-        return createSandboxClosure({
+        const bound = createSandboxClosure({
             guest: true,
             sandbox: true,
             name: `bound ${target.name ?? ""}`,
@@ -58,6 +72,9 @@ function callFunctionMethod(target, methodName, args, options, stack) {
                     construct: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], undefined, true)
                 })
         });
+        if (hasExplicitSandboxPrototype(target))
+            setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+        return bound;
     }
     if (methodName === "call") {
         return options.callClosure(target, args.slice(1), stack, thisValue);

package/packages/safe-js/dist/interp/object-model.js

@@ -91,17 +91,26 @@ function registerIntrinsicPrototype(budget, prototype, constructor) {
     if (roots === undefined)
         intrinsicPrototypeRoots.set(budget, roots = new Set());
     roots.add(prototype);
-    const records = [prototype, materializeFunctionProperties(constructor)].map(value => ({
-        value, descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(value)))
+    const records = [prototype, constructor].map(target => ({
+        target,
+        value: isGuestClosure(target) ? materializeFunctionProperties(target) : target,
+        prototype: getSandboxPrototype(target),
+        explicit: hasExplicitSandboxPrototype(target)
+    })).map(record => ({
+        ...record, descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record.value)))
     }));
     const unchanged = (before, after) => before !== undefined && after !== undefined && Object.is(before.value, after.value) &&
         before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
-    intrinsicConstructors.set(constructor, () => records.every(({ value, descriptors }) => {
+    intrinsicConstructors.set(constructor, () => records.every(({ target, value, descriptors, prototype: parent, explicit }) => {
         const current = Object.getOwnPropertyDescriptors(value);
-        return Object.keys(current).length === descriptors.size &&
+        return getSandboxPrototype(target) === parent && hasExplicitSandboxPrototype(target) === explicit &&
+            Object.keys(current).length === descriptors.size &&
             Object.keys(current).every(key => unchanged(descriptors.get(key), current[key]));
     }));
-    budget.setRetainedValues(prototype, () => records.flatMap(({ value, descriptors }) => Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])));
+    budget.setRetainedValues(prototype, () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
+        ...(getSandboxPrototype(target) === parent ? [] : [getSandboxPrototype(target)]),
+        ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])
+    ]));
 }
 export function releaseObjectPrototype(budget) {
     for (const prototype of intrinsicPrototypeRoots.get(budget) ?? [])
@@ -118,7 +127,7 @@ export function getSandboxPrototype(value, budget) {
         if (prototype !== undefined && prototype !== value)
             return prototype;
     }
-    return budget !== undefined && isPrototypeRecord(value)
+    return budget !== undefined && !isSandboxClosure(value) && isPrototypeRecord(value)
         ? intrinsicPrototypes.get(budget) ?? null
         : null;
 }
@@ -131,9 +140,12 @@ export function getSandboxDataProperty(value, key, budget) {
     while (typeof current === "object" && current !== null) {
         if (isGuestHostObject(current))
             return getHostObjectMember(current, String(key));
-        if (isGuestClosure(current))
-            return getGuestFunctionProperty(current, String(key));
-        if (isSandboxClosure(current)) {
+        if (isGuestClosure(current)) {
+            const entry = getGuestFunctionProperty(current, String(key));
+            if (entry !== undefined || Object.hasOwn(current.properties ?? {}, String(key)))
+                return entry;
+        }
+        else if (isSandboxClosure(current)) {
             const properties = current.properties;
             return properties !== undefined && Object.hasOwn(properties, String(key))
                 ? properties[String(key)]
@@ -145,7 +157,7 @@ export function getSandboxDataProperty(value, key, budget) {
             isSandboxRegex(current) ||
             isSandboxGenerator(current))
             return undefined;
-        if (Object.hasOwn(current, String(key)))
+        if (!isSandboxClosure(current) && Object.hasOwn(current, String(key)))
             return current[String(key)];
         current = getSandboxPrototype(current, budget);
         if (current !== null) {
@@ -160,7 +172,7 @@ export function setSandboxPrototype(value, prototype, budget) {
         throw new TypeError("Object.prototype has an immutable null prototype.");
     }
     if (!isPrototypeRecord(value) || (prototype !== null && !isPrototypeRecord(prototype))) {
-        throw new TypeError("Prototype links require ordinary sandbox objects; callable and exotic prototype chains are not supported.");
+        throw new TypeError("Prototype links require ordinary sandbox objects or guest functions.");
     }
     if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype)
         return;
@@ -177,6 +189,8 @@ export function setSandboxPrototype(value, prototype, budget) {
     prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+    if (isGuestClosure(value))
+        return true;
     if (isGuestHostObject(value))
         return false;
     if (isSandboxClosure(value) ||