Skip to content

fix(deps): pick up fetchkit 0.7.2 linear readable extraction - #2914

Merged
chaliy merged 9 commits into
mainfrom
claude/project-thread-hcbtls
Nov 10, 2026
Merged

fix(deps): pick up fetchkit 0.7.2 linear readable extraction#2914
chaliy merged 9 commits into
mainfrom
claude/project-thread-hcbtls

Conversation

@chaliy

@chaliy chaliy commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Requested by Михайло · project thread

What changed

The fetchkit builtin now uses fetchkit/fetchkit-cli 0.7.2, and the cargo-vet exemptions move from 0.7.1 to 0.7.2.

Why

fetchkit 0.7.2 makes readable and agent content extraction linear on hostile nesting (fetchkit TM-DOS-009, security audit F8). With 0.7.1, a crafted 2.16 MB page cost about 57 s of CPU inside the fetchkit builtin.

Before / After

  • Before: crafted deep-nesting page takes about 57 s of CPU in fetchkit readable extraction (0.7.1).
  • After: the same extraction is linear (fetchkit 0.7.2 release notes and tests). cargo test -p bashkit --features fetchkit --test integration -- fetchkit passes (10 tests).

Risk

  • Low.
  • This is a patch-level dependency bump behind the off-by-default fetchkit feature.

Checklist

  • Tests added or updated
  • Backward compatibility considered

@chaliy
fix(ts): enforce max_memory and wall-clock limit for TypeScript
be7e14e 
ZapCode 1.5.1 never reads memory_limit_bytes, and a failed allocation
aborts the process with every tenant. Template-literal, concat and spread
doubling all aborted the host. Each ts run now gets its own vm_meter
(the Monty meter, renamed from python_meter): every instruction stops the
run past max_memory, and output-amplifying builtins (join, toString,
JSON.stringify, console.log, concat, repeat, split, replace) size their
result before allocating. Native ts fails closed without MeteredAllocator.

A new multi-tenant stress suite found a host-call loop ran 30 s under a
500 ms limit because ZapCode restarts its clock at every resume. The
host-call loop now checks the run's wall-clock deadline, caps callbacks
at the remaining time, and yields.

TM-TS-026, TM-TS-027.
@chaliy
test(ts): add ts_fuzz target, nightly ASan pass and stress soak
95ee6aa 
Mirror the Monty coverage for the vendored ZapCode VM: a ts_fuzz target
under the metered allocator (nightly fuzz matrix plus CI compile check),
an ASan step for the ts unit, threat-model and stress tests, and a
300-round ts-stress-soak job.
@chaliy
refactor(ts): pass run time limit and deadline as one RunClock (clippy)
5e8d800
@chaliy
docs(ts): install MeteredAllocator in the TypeScript guide quick start
ac8869a
@chaliy
fix(ts): stop a run over its memory limit before a host call
43b1831
@chaliy
chore(knowledge): note the wasm32 ts metering residual risk
ec09005
@chaliy
fix(deps): pick up fetchkit 0.7.2 linear readable extraction
f9cc8b9 
fetchkit 0.7.2 makes readable/agent content focus linear on hostile nesting (TM-DOS-009, security audit F8); 0.7.1 spent ~57 s CPU on a 2.16 MB crafted page inside the fetchkit builtin.
@chaliy
chore(supply-chain): exempt fetchkit 0.7.2
6c00569
@chaliy
Merge origin/main into fetchkit bump
362a884
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 10, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 bashkit 362a884 Commit Preview URL

Branch Preview URL		 Nov 10 2026, 10:42 PM

@bashkit-pr-reviewer

bashkit-pr-reviewer Bot commented Nov 10, 2026

Copy link
Copy Markdown

Review summary (PR #2914, head 362a884)

Verdict: Looks good. Three-file patch bump fetchkit/fetchkit-cli 0.7.1 → 0.7.2 (crates/bashkit/Cargo.toml, Cargo.lock with checksums, supply-chain/config.toml vet exemptions). No code changes needed: the fetchkit builtin wrapper (crates/bashkit/src/builtins/fetchkit.rs) uses stable ToolBuilder/HttpTransport/CliHost APIs, features (docs-pdf, docs-markkit) unchanged, network path still goes through SandboxTransport (no new TLS stack), and CPU-heavy extraction already runs off the async worker (spawn_blocking + run_with_exec_budget, TM-DOS-143), so the upstream linear-extraction fix (TM-DOS-009) directly shortens time spent under the existing exec budget. No findings posted.

Context read beyond the diff: crates/bashkit/src/builtins/fetchkit.rs (transport, timeout, blocking-pool handling), crates/bashkit/Cargo.toml 0.7.2 pins, Cargo.lock 0.7.2 entries + checksums, supply-chain/config.toml fetchkit exemptions at 0.7.2, and checked for stale 0.7.1 pins (none in the threat model or fetchkit docs).

Not reviewed: could not execute the test suite from this shell (no cargo); relied on the PR's statement that cargo test -p bashkit --features fetchkit --test integration -- fetchkit (10 tests) passes. One optional consideration (not filed as a finding): the checklist claims tests were added/updated but the diff adds none — a small local-HTML deep-nesting regression test would pin the upstream fix in-tree, though upstream coverage plus the existing integration suite is a reasonable basis for a patch-level dep bump.

@chaliy
chaliy merged commit eda8b8f into main Nov 10, 2026
51 checks passed
@chaliy
chaliy deleted the claude/project-thread-hcbtls branch November 10, 2026 23:15
@chaliy chaliy mentioned this pull request Nov 10, 2026
Merged
2 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chaliy