docs: model js-exec surface in threat model, align WASM policy docs; ci: coverage report#295
docs: model js-exec surface in threat model, align WASM policy docs; ci: coverage report#295MauricioPerera wants to merge 2 commits into
Conversation
|
@MauricioPerera is attempting to deploy a commit to the Vercel Labs Team on Vercel. A member of the Team first needs to authorize it. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
MauricioPerera
force-pushed
the
quick-wins
branch
from
a693467 to
bb9a20b
Compare
- THREAT_MODEL.md: model the opt-in js-exec/QuickJS surface (new 4.11), qualify the child_process claim in 3.5 (virtual shim), and state the no-bash-to-host-JS architectural invariant guarding 4.2/4.3 - CLAUDE.md: align WASM policy with reality (sql.js, quickjs-emscripten, vendored CPython as approved exceptions) - README: document node as a js-exec alias; list tar/yq/xan (and js-exec/node) as unavailable in browser builds - CI: add coverage.yml (non-gating coverage report artifact) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
test:coverage uses the default vitest config, which pulls in the python3 WASM tests without the wasm pool setup and fails (python3.worker-protocol-abuse.test.ts expects BRIDGE_STDOUT). The existing test:coverage:unit script runs coverage over vitest.unit.config.ts, matching what CI already validates in unit-tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
FYI for reviewers: since Actions runs here are awaiting first-contributor approval, I ran the full suite against this exact branch on my fork — all 8 checks green (lint, typecheck, unit tests on Node 20/22/24, comparison, WASM, and the new coverage workflow): MauricioPerera#1 One fix landed during that validation: the coverage workflow originally called |
CI validation run for upstream PR vercel-labs#295
|
Thanks. I'm not interested in new workflows as they increase surface. The docs changes look fine but not mandatory |
2 participants
Summary
Documentation and CI improvements surfaced by an external review of the repo:
js-exec/QuickJS surface analogously to Python's §4.7: how it is enabled (javascript: trueorinvokeTool), the SharedArrayBuffer host bridge (VFS, sandbox-re-entrantexec, gatedfetch,invokeTool), the virtualchild_processshim, what the isolation rests on (QuickJS WASM + worker +WorkerDefenseInDepth+ 64MB cap + timeout), and the residual risk (MEDIUM).child_processrow: the literal "no code path" claim now notes the virtual shim that exists inside QuickJS whenjavascriptis enabled (re-enters the sandbox, not the host OS), pointing to §4.11.check-banned-patternslinter and that those residuals would become critical if it ever broke.quickjs-emscripten, and the vendored CPython WASM listed as the approved exceptions (previously it said "No WASM dependencies allowed" while two additional WASM runtimes ship in the repo).packages/just-bash): document thatnodeis an alias of thejs-execruntime (not a real Node.js), and listtar,yq,xan(plusjs-exec/node) among the commands unavailable in browser builds, matching the__BROWSER__gate inregistry.ts.coverage.yml, a non-gating workflow that runs the existing (currently unused in CI)test:coveragescript and uploads the report as an artifact (if: always(), no thresholds). Setup mirrorsunit-tests.yml(LFS, pnpm, Node 20).All doc statements were verified against the code before writing. No production code is touched.
Notes for reviewers
unit-tests.yml); it hasn't been executed in a CI run from this fork.🤖 Generated with Claude Code