Tianyi Cui
aa2a7f9a8a
The host's message listener trusted the compile-time WorkerToHost shape on traffic from a peer that runs model code: postMessage(null) threw in the listener and crashed the host process; forged log/done messages bypassed maxLogBytes/maxValueBytes (the worker-side LogBuffer and prepareValue cap only honest flows); and the error-reply renegotiation re-echoed a forged non-cloneable call id, throwing outside any catch. Every inbound message now passes a runtime shape gate that validates and REBUILDS it field by field (junk drops without a throw; call ids must be numbers, so replies are always clone-plain; forged extra fields never ride along). One host-side ledger bounds everything landing in logs — honest port entries, forged ones, and stray pipe bytes — at the single documented maxLogBytes, with the shared in-band truncation marker emitted host-side when the ledger trips first; the completion value is re-capped host-side through the same prepareValue (with exactly the truncation suffix as slack so honest worker-capped values pass unchanged), and done error text is bounded. Also folds the stray-capture budget into that shared ledger (round-1 finding B: it was a second maxLogBytes on top of the documented shared cap).
code-runtime/ — code-execution capability family
The code-execution capability seam (see capability seams): an abstract runtime interface for executing one model-written program against host-provided async bindings, capturing what it printed and returned. The consumer is the tool registry's Code Mode, specified alongside the seam in the Code Mode RFC. Product packages.
| Package | Role | ctx key |
|---|---|---|
code-runtime/ |
Abstract code-execution seam (interface + vocabulary) | ctx.codeRuntime |
code-runtime-worker/ |
Worker-thread backend: fresh worker per run, TypeScript via host-side type-strip, port-bridged bindings, budget/heap containment | registers ctx.codeRuntime |
The interface lives at code-runtime/code-runtime/; the shipped backend at code-runtime/code-runtime-worker/. Backends differ by execution substrate (worker thread, process, container) and by source language — both readonly descriptors on the service — and register ctx.codeRuntime without touching the interface or its consumer; that split is what makes a hardened backend a drop-in later.