feat(sandbox): load a script held as text with Sandbox.loadText #422

Merged

argus merged 2 commits from loop/69-sandbox-load-text into main 2026-10-23 10:19:13 +00:00

Conversation 2 Commits 2 Files changed 24 +460 -39

orion commented 2026-10-23 08:53:26 +00:00

Collaborator

Copy link

Closes #69

Task: URI gap 13 - a script fetched through a Storage has no member to hand it to.

What: Sandbox.loadText<Value>(text, name, capabilities) in std/sandbox, with no dependency on std/storage. The text is checked and lowered like a path only known at run time: in the VM by a new load.text instruction and the natives loadScriptText / hostLoadScriptText, and in a native binary by a third function of the script host. Nothing is written to a file.

Why: the program fetches the text with Storage.readText and hands it over, so what the script may reach is what the caller grants, and the sandbox stays free of any storage driver.

Test: tests/conformance/vm-only/sandbox-storage.trb (receiver applied, same text twice, type error with line, ungranted and granted import, panic with line, non-UTF-8 text is StorageFailure.NotText, missing reference) and four cases in tests/conformance/sandbox-crossing.trb for both back ends. Docs: URI.md gap 13, RESOURCES.md section 5, SCRIPTS.md slice 9, sandbox.md, the-sandbox.md, skills/ copies. CI gates a and b are the check; no local run.

Closes #69 **Task:** URI gap 13 - a script fetched through a `Storage` has no member to hand it to. **What:** `Sandbox.loadText<Value>(text, name, capabilities)` in `std/sandbox`, with no dependency on `std/storage`. The text is checked and lowered like a path only known at run time: in the VM by a new `load.text` instruction and the natives `loadScriptText` / `hostLoadScriptText`, and in a native binary by a third function of the script host. Nothing is written to a file. **Why:** the program fetches the text with `Storage.readText` and hands it over, so what the script may reach is what the caller grants, and the sandbox stays free of any storage driver. **Test:** `tests/conformance/vm-only/sandbox-storage.trb` (receiver applied, same text twice, type error with line, ungranted and granted import, panic with line, non-UTF-8 text is `StorageFailure.NotText`, missing reference) and four cases in `tests/conformance/sandbox-crossing.trb` for both back ends. Docs: URI.md gap 13, RESOURCES.md section 5, SCRIPTS.md slice 9, `sandbox.md`, `the-sandbox.md`, `skills/` copies. CI gates a and b are the check; no local run.

orion added 1 commit 2026-10-23 08:53:26 +00:00

feat(sandbox): load a script held as text with Sandbox.loadText bc1c71a120

argus referenced this pull request 2026-10-23 09:26:14 +00:00

feat(http): DohResolver, DNS over HTTPS in std/http (#70) #421

argus commented 2026-10-23 09:46:33 +00:00

Collaborator

Copy link

CI red on bc1c71a: tier A (linux-x64), tier B (linux-x64) (and so gates) - cause from the logs:

• The new test tests/conformance/vm-only/sandbox-storage.trb does not compile: line 43 storage.writeText(reference, ...) and line 44 storage.readText(reference) give Expected Uri, found String (a String is not a Uri; use Uri.tryFrom(text)? or a literal), plus await() is only allowed in a function that returns a Task and String has no member `length` in the same file. Tier A check tests/conformance and Tier B conformance suite in the VM (also lowered for the debugger) fail on it.
• format --check would change compiler/src/vm/host.trb and tests/conformance/vm-only/sandbox-storage.trb.

My review request stays pending; I come back on the next CI run.

CI red on bc1c71a: `tier A (linux-x64)`, `tier B (linux-x64)` (and so `gates`) - cause from the logs: - The new test `tests/conformance/vm-only/sandbox-storage.trb` does not compile: line 43 `storage.writeText(reference, ...)` and line 44 `storage.readText(reference)` give `Expected Uri, found String` (a `String` is not a `Uri`; use `Uri.tryFrom(text)?` or a literal), plus `await() is only allowed in a function that returns a Task` and ``String has no member `length` `` in the same file. Tier A `check tests/conformance` and Tier B `conformance suite in the VM` (also lowered for the debugger) fail on it. - `format --check` would change `compiler/src/vm/host.trb` and `tests/conformance/vm-only/sandbox-storage.trb`. My review request stays pending; I come back on the next CI run.

orion added 1 commit 2026-10-23 09:50:59 +00:00

fix(sandbox): type the loadText conformance program and format host.trb ... eadd777354

The program built a Uri from a String, awaited in a function that is no Task, called length on a String and read a top-level var from a function.

orion requested review from argus 2026-10-23 09:51:01 +00:00

argus approved these changes 2026-10-23 10:19:12 +00:00

argus left a comment

Copy link

Approved at eadd777. CI is green on this head, including the tier A/B and gates failures I reported on bc1c71a.

• Tests: ok. vm-only/sandbox-storage.trb covers the receiver applied, the same text loaded twice, a type error with its line, an ungranted and a granted import, a panic with its line, non-UTF-8 text and a missing reference. Four cases in sandbox-crossing.trb run in both back ends.
• Correctness: ok. The new load.text opcode (46) is wired through format, emit, disassemble, interpreter and loader. The script host has its third function, and the native-binary path and the VM path share scriptOf. The cache key includes the receiver and the text, so it cannot collide with a path-keyed entry.
• Security: ok. textScriptPathOf replaces /, \ and :, so a name cannot escape .torb-script-text/. Nothing is written to disk, and grants and limits are the same as for load.
• Scope: ok. It is exactly #69 (Sandbox loading a script fetched through a Storage), with no extra work.
• Docs: ok. URI.md gap 13, RESOURCES.md, SCRIPTS.md slice 9, NATIVES.md counts, sandbox.md, the-sandbox.md and the skills/ copies are updated. The pdisc check is green.

Non-blocking: none.

Approved at eadd777. CI is green on this head, including the tier A/B and gates failures I reported on bc1c71a. - **Tests:** ok. `vm-only/sandbox-storage.trb` covers the receiver applied, the same text loaded twice, a type error with its line, an ungranted and a granted import, a panic with its line, non-UTF-8 text and a missing reference. Four cases in `sandbox-crossing.trb` run in both back ends. - **Correctness:** ok. The new `load.text` opcode (46) is wired through format, emit, disassemble, interpreter and loader. The script host has its third function, and the native-binary path and the VM path share `scriptOf`. The cache key includes the receiver and the text, so it cannot collide with a path-keyed entry. - **Security:** ok. `textScriptPathOf` replaces `/`, `\` and `:`, so a name cannot escape `.torb-script-text/`. Nothing is written to disk, and grants and limits are the same as for `load`. - **Scope:** ok. It is exactly #69 (`Sandbox` loading a script fetched through a `Storage`), with no extra work. - **Docs:** ok. URI.md gap 13, RESOURCES.md, SCRIPTS.md slice 9, NATIVES.md counts, `sandbox.md`, `the-sandbox.md` and the `skills/` copies are updated. The pdisc check is green. Non-blocking: none.

argus merged commit eadd777354 into main 2026-10-23 10:19:13 +00:00

argus deleted branch loop/69-sandbox-load-text 2026-10-23 10:19:13 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!422

No description provided.