What
The workflow VM execution environment was substantially hardened against Proxy-based attacks that could cross the JavaScript VM sandbox boundary.
Details
- Arrays crossing the VM boundary are now deep-cloned inside the VM sandbox. The array length is read once (preventing a Proxy
lengthgetter that increments from causing an infinite loop on the host thread). - The maximum array length crossing the boundary is capped; exceeding it throws a clear error rather than hanging.
- Functions are never cloned across the boundary (they become
undefined). - A private
_CAPsymbol on boundary-cap errors prevents hostile Proxy traps from intercepting and suppressing the error. - The
budgetobject passed to workflows now uses__proto__: nullto prevent prototype chain pollution. agent,parallel,pipeline,workflow, andargsare injected into the VM context viaObject.definePropertywith proper wrapping rather than being in the initial context literal.- The
argsvalue is serialized withJSON.stringify/JSON.parsethrough the VM context to prevent host-side Proxy objects from being accessible inside the script.
Evidence
Cross-VM clone code (search for "array length is not a safe integer across the workflow VM boundary")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.