exec runs under SES lockdown with no Date, Math.random or setTimeout, and nothing says so #17
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The
mcp__endo__execcompartment is hardened, but the tool description doesnot mention it. Agents discover the restrictions by hitting them:
The
setTimeoutgap has a real cost beyond one wasted call: an agent watchinga workflow reach
await-approvalcannot sleep-and-poll inside a single exec.In session
mt82q1ns-l8nrgethat turned every status check into a separateturn, and the agent wrote loops that spun uselessly because it had no way to
wait between iterations.
Wanted:
Date.now,no
Math.random, no timers, JSON-serialized return values.sleep(ms)(or awaitFor/followhelper bounded by thetool timeout) so polling a run does not need a round trip per sample.
Half done in
046bfeb, leaving open for the rest.The machine-admin prompt now states the compartment rules: no
Date.now(), noMath.random(), no timers, and that you cannot sleep-and-poll inside one exec, so you checkpoint withstatus()and look again on a later turn.Neither of this issue's asks is fully delivered: the rules are in one preset's prompt, not in the
exectool description where every agent would see them, and there is still no way to wait inside a single exec. The second one bites on exactly the case described here - watching a workflow reachawait-approval. My workaround this session was to shell out tonode -ewith asetTimeout, which only works because a child process gets timers the compartment does not.Fixed in
d5772b0, live at generation 46.The
exectool description now states the compartment rules where every caller reads them: noDate.now()ornew Date(), noMath.random(), nosetTimeout/setInterval, and that results are JSON-serialized with BigInts rendered as decimal strings.The second ask - a way to wait - is
sleep(ms), endowed alongsidepowers,E,hardenandconsole. It grants delay and nothing else, to code that already holds the guest's full authority. Verified live:await sleep(1500)inside a single exec now returns normally, where the same call previously threwsetTimeout is not a function. That removes the specific cost named here - watching a workflow reachawait-approvalno longer burns a turn per poll.