M13-03C Status

status: done
task: explicit host-call allowlist and structured parameters
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

The production scripting protocol now accepts only five host-call names: READ_MAIN, READ_ASSET, WRITE_MAIN, WRITE_ASSET and SUBMIT_SERVER_JOB. Each request has a version, request/script IDs, permission binding and call-specific structured parameters. Unknown calls, permission confusion, unknown fields, unsafe paths and malformed payloads fail closed. Parsed calls remain execution=DISABLED; no host operation is invoked.

Evidence

node --test web/tests/unit/script-host-call.test.mjs passed 3/3.
WEB_TEST_PORT=5525 npm --prefix web run test:script-host-call passed unit 3/3 and production Chromium Worker E2E 1/1.
node tools/web/check-script-host-call.mjs passed: script-host-call-ok accepted=5 blocked=4 structured=true execution=DISABLED next=M13-03D.
npm --prefix web run typecheck, npm --prefix web run lint and git diff --check passed.

Artifact Hashes

protocol: 6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2
worker: b26a37f20e829172bb70fbe9b9e3a194923818127cccbe8bbc55f6d994be55e8
checker: e90042f4eefd9e89da6d1cead87ca1cb9db9b3bd65ba8028593e093903577e2e
unit: e7679cd902c75504204d528343e4fa6be316d1c56c02b2871a67637aa847a1ec
e2e: 7b17a7da440aee07895101efb8e1eb13bfbebbe54e955bde09299f6b33d6aaf9
report: afb140a3aecff1de52c4363e7cd0ce476b0c9140ffdc016ec13a085049f6dd1a
manifest: 54318c45b11dd1707fecf78b0637257158102ea1dbb88d4d442e33b77df2cdbf

Next Task

M13-03D: sandbox crash/timeout terminates the job without changing Main revision.

Rollback

Remove the host-call parser, focused worker/tests/checker, report, manifest, status entry and package command; restore M13-03B as the queue tail and move nextTask back to M13-03C.

1.9 KiB Raw Blame History