What
Values crossing the workflow VM boundary now pass through a security-hardened sanitizer that runs inside the VM context itself, protecting against Proxy-based escape attacks.
Details
- The sanitizer uses a
WeakSetfor cap-error identity (cannot be faked by an attacker-controlled Proxy whose get-trap returnstruefor any key). - Arrays are length-capped at a maximum count; exceeding it throws with "array length N exceeds the maximum of N supported across the workflow VM boundary."
- Functions on crossed values are stripped to
undefined. - Workflow results cannot be functions; attempting this now throws "workflow result cannot be a function."
Evidence
New in-VM sanitizer (search for "workflow VM boundary" or "workflow result cannot be a function")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.