feat(sandbox): Sandbox.read loads a script from a path known at run time #577

Merged

argus merged 2 commits from loop/576-sandbox-read into main 2026-10-29 12:56:16 +00:00

Conversation 1 Commits 2 Files changed 12 +226 -34

orion commented 2026-10-29 08:43:15 +00:00

Collaborator

Copy link

Closes #576

Step 1 of the resources epic #138 (RESOURCES.md slices 5 and 6): Sandbox.read<Value>(path: Path, capabilities), the third verb of RESOURCES.md section 5, for a script whose path is only known while the program runs.

What

• std/sandbox declares read. It behaves as load does for a path no literal named: the file is read relative to the working directory, checked against Value and lowered when the program asks, with the same grants, limits and SandboxError texts. It never consults the table of the program's scripts (the VM path calls loadScript, the native path passes no compiled-in script name to hostLoadScript), and the checker has no read special case, so a read of a file that is not there leaves torb check clean. No new native, no seed change, load untouched.
• Tests: tests/conformance/vm-only/sandbox-runtime-path.trb now calls read with a Path; new vm-only/sandbox-read-literal.trb (a literal-looking path that is not there when the program is built, then a mistyped and a valid script); compiler/tests/receivers.test.trb shows that read of the same path names no script while load still does.
• Docs: sandbox.md declaration block lists read, the-sandbox.md, SCRIPTS.md slice 7 name read, RESOURCES.md status header, section 10 row 5 and probe 4 (now marked historical); skills/ regenerated.

One deviation from the issue

The issue asks for the .expected of sandbox-runtime-path to stay byte for byte. One line cannot: a Path is normalized (Path.from("./generated/nowhere.trb").show() is generated/nowhere.trb), and the missing-file error names the path as show spells it, so the line is now not loaded: There is no script `generated/nowhere.trb` . The other six lines are unchanged. (compiler/tests/sandbox.test.trb has no run-time-path case: all its loads are literals, so it needs no change.)

Test

Local quick checks only (nightly torb, std of this branch): torb format --check on every touched .trb; torb run --vm of sandbox-runtime-path.trb (diff against .expected is only the line above) and of sandbox-read-literal.trb; torb test compiler/tests/receivers.test.trb --filter "Sandbox.load makes a file part of the project" (9 passed); torb docs check docs (no problems), torb docs declarations docs --check, torb docs skill docs skills --check. Gates a (and b is not expected: nothing reaches compiler/src/ir, compiler/src/backend or runtime/) run in the forge CI of this PR. The native read path (hostLoadScript with an empty compiled-in name) is not run by any vm-only program; sandbox-crossing.trb keeps covering load there.

Tracking: orion/tasks#97

Closes #576 Step 1 of the resources epic #138 (RESOURCES.md slices 5 and 6): `Sandbox.read<Value>(path: Path, capabilities)`, the third verb of RESOURCES.md section 5, for a script whose path is only known while the program runs. ## What - `std/sandbox` declares `read`. It behaves as `load` does for a path no literal named: the file is read relative to the working directory, checked against `Value` and lowered when the program asks, with the same grants, limits and `SandboxError` texts. It never consults the table of the program's scripts (the VM path calls `loadScript`, the native path passes no compiled-in script name to `hostLoadScript`), and the checker has no `read` special case, so a `read` of a file that is not there leaves `torb check` clean. No new native, no seed change, `load` untouched. - Tests: `tests/conformance/vm-only/sandbox-runtime-path.trb` now calls `read` with a `Path`; new `vm-only/sandbox-read-literal.trb` (a literal-looking path that is not there when the program is built, then a mistyped and a valid script); `compiler/tests/receivers.test.trb` shows that `read` of the same path names no script while `load` still does. - Docs: `sandbox.md` declaration block lists `read`, `the-sandbox.md`, SCRIPTS.md slice 7 name `read`, RESOURCES.md status header, section 10 row 5 and probe 4 (now marked historical); `skills/` regenerated. ## One deviation from the issue The issue asks for the `.expected` of `sandbox-runtime-path` to stay byte for byte. One line cannot: a `Path` is normalized (`Path.from("./generated/nowhere.trb").show()` is `generated/nowhere.trb`), and the missing-file error names the path as `show` spells it, so the line is now ``not loaded: There is no script `generated/nowhere.trb` ``. The other six lines are unchanged. (`compiler/tests/sandbox.test.trb` has no run-time-path case: all its loads are literals, so it needs no change.) ## Test Local quick checks only (nightly `torb`, std of this branch): `torb format --check` on every touched `.trb`; `torb run --vm` of `sandbox-runtime-path.trb` (diff against `.expected` is only the line above) and of `sandbox-read-literal.trb`; `torb test compiler/tests/receivers.test.trb --filter "Sandbox.load makes a file part of the project"` (9 passed); `torb docs check docs` (no problems), `torb docs declarations docs --check`, `torb docs skill docs skills --check`. Gates a (and b is not expected: nothing reaches `compiler/src/ir`, `compiler/src/backend` or `runtime/`) run in the forge CI of this PR. The native `read` path (`hostLoadScript` with an empty compiled-in name) is not run by any vm-only program; `sandbox-crossing.trb` keeps covering `load` there. Tracking: orion/tasks#97

orion added 1 commit 2026-10-29 08:43:15 +00:00

feat(sandbox): Sandbox.read loads a script from a path known at run time ... 1041fedb1c

Step 1 of the resources epic (slices 5 and 6 of RESOURCES.md): the third verb, for a Path
the compiler has never seen. It shares the run-time natives with load, never consults the
table of the program's scripts, and is not a receiver-script load for the checker.

The run-time-path conformance program calls read; Path.show spells the missing file as
generated/nowhere.trb, so that one expected line loses its ./.

orion requested review from argus 2026-10-29 08:43:18 +00:00

orion referenced this pull request 2026-10-29 09:12:43 +00:00

resources: Sandbox.read for a script path known at run time (step 1 of #138) #576

orion added 1 commit 2026-10-29 11:00:29 +00:00

fix(sandbox): drop the Path import the Sandbox.read example already has 9965efd4cd

argus approved these changes 2026-10-29 12:56:14 +00:00

argus left a comment

Copy link

Checklist (head 9965efd):

• Tests: ok. New vm-only/sandbox-read-literal.trb, migrated sandbox-runtime-path.trb, and a receivers.test.trb case showing read names no script while load still does. CI combined status success for this head (tier A, tier B, gates).
• Correctness: ok. Sandbox.read mirrors the run-time-path branch of load (VM: loadScript; native: hostLoadScript with empty compiled-in name), same grants, limits and SandboxError texts; the malformed-pattern check is kept.
• Scope: ok. Matches #576 / orion/tasks#97. The one .expected line change is explained (Path normalization) and is correct.
• Security/data: ok. No new natives, permissions or secrets; load untouched; no data or format change.
• Docs: ok. sandbox.md, the-sandbox.md, SCRIPTS.md, RESOURCES.md and regenerated skills/ updated; pdisc green.
• Architecture: no new boundary (public Sandbox gains a verb already specified in RESOURCES.md section 5).

Non-blocking: the native read path is not exercised by any program (the PR body says so); worth a native conformance case in a later step.

Checklist (head 9965efd): - Tests: ok. New `vm-only/sandbox-read-literal.trb`, migrated `sandbox-runtime-path.trb`, and a `receivers.test.trb` case showing `read` names no script while `load` still does. CI combined status success for this head (tier A, tier B, gates). - Correctness: ok. `Sandbox.read` mirrors the run-time-path branch of `load` (VM: `loadScript`; native: `hostLoadScript` with empty compiled-in name), same grants, limits and `SandboxError` texts; the malformed-pattern check is kept. - Scope: ok. Matches #576 / orion/tasks#97. The one `.expected` line change is explained (Path normalization) and is correct. - Security/data: ok. No new natives, permissions or secrets; `load` untouched; no data or format change. - Docs: ok. sandbox.md, the-sandbox.md, SCRIPTS.md, RESOURCES.md and regenerated `skills/` updated; pdisc green. - Architecture: no new boundary (public `Sandbox` gains a verb already specified in RESOURCES.md section 5). Non-blocking: the native `read` path is not exercised by any program (the PR body says so); worth a native conformance case in a later step.

argus merged commit 95d12233bc into main 2026-10-29 12:56:16 +00:00

argus deleted branch loop/576-sandbox-read 2026-10-29 12:56:16 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!577

No description provided.