fix(sandbox): undefine the raw fetch host bridge before user code runs - #6761

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 16, 2026 1:47am

PR Summary

Medium Risk
Changes sandbox bootstrap and global hardening on the user-code execution path; behavior of fetch must stay correct while removing a host bridge from the isolate global scope.

Overview
Defense-in-depth for the executeCode isolated-vm path: user code could still see a live __fetchRef ivm.Reference global because the bootstrap never removed it after wiring fetch.

The bootstrap now captures __fetchRef in an IIFE closure, installs fetch via Object.defineProperty, and adds __fetchRef to the same undefined_globals hardening list used for __brokerRef and isolated-vm escape globals—aligned with how sim and executeTask already treat host bridges.

A new static regression test (isolated-vm-worker-hardening.test.ts) parses each execution path in the worker and asserts every jail.set('__*Ref', …) bridge is listed in that path’s undefined_globals, plus the standard escape globals.

^{Reviewed by Cursor Bugbot for commit 99e4a61. Configure here.}

Greptile Summary

The PR prevents user code from accessing the raw fetch host reference while preserving the sandboxed fetch API.

• Captures __fetchRef inside the fetch closure before hardening globals.
• Adds __fetchRef to the executeCode hardening list.
• Adds per-execution-path regression coverage for exposed ivm.Reference bridges.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (3): Last reviewed commit: "fix(sandbox): preserve the fetch global'..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review