`objectstack build` lowers an inline hook handler that references `Intl` into the QuickJS body — `detect-free-identifiers` allowlists host globals the sandbox does not provide, so the handler passes validate/typecheck/test/build and throws ReferenceError in production

[huangyiirene]

Filed by the triage seat (session session_019kDRpB7D2XzVzkaLp57T5D, R+89) as the defect half split out of #14168. #14168 is a feature question (a declarative value-domain slot on a field) and sits in the decision inbox; this half does not depend on that decision and is graded directly.

What was measured

By #14168's reporter on @objectstack/cli / @objectstack/runtime 17.2.0, Node v22.22.2, and re-verified here on origin/main a39b02a6 by reading the allowlist:

• The QuickJS sandbox the runtime evaluates lowered hook bodies in (quickjs-emscripten 0.32.0, the variant AppPlugin wires through QuickJSScriptRunner) has no Intl — typeof Intl is undefined there, while Date and JSON exist. HookBodyCapability grants nothing that would add it.
• packages/cli/src/utils/detect-free-identifiers.ts, the GLOBALS set starting at line 39, allowlists Intl next to Math, JSON, Date, Reflect, Proxy, under the comment "Web-ish that the sandbox / Node commonly provide". A handler body that calls Intl.DateTimeFormat therefore has no free identifier, extractHookBody lowers it, and the hook-body-lowering lint rule (Hook-body lowering fails OPEN: tryExtractBody swallows extractHookBody's refusal into a warnings array and bundles the closure — make it loud (ask 1; the constant-surface half is split out) #13651) has nothing to report — that rule fires only on a refused lowering.
• Consequence, measured in a real artifact: pnpm validate, typecheck, test and build are all green (in-process tests run the raw function in Node, where Intl exists); in production the lowered body throws ReferenceError: Intl is not defined, and with the onError: 'abort' a validation-shaped hook must declare, every write to that object is refused.

Why this is a defect, not a documentation gap

The allowlist is the platform's own statement of what a lowered body may reference. Where it names a global the sandbox does not provide, the build lowers code that cannot run and every local gate agrees it is fine — the silent-until-production shape. The deprecation text on Hook.handler ("prefer body") steers authors into exactly this path.

Ruled direction (triage)

Split GLOBALS into the set the sandbox actually provides and the set only Node provides. A free reference to a Node-only global becomes a lowering refusal with a named reason (for example: Intl is not available in the hook sandbox — keep the check in a string handler ref, or move it to a validation rule), so the existing #13651 lint rule reports it and os build's existing warn-and-bundle behaviour handles the rest. The membership of the sandbox set is measured against the shipped QuickJS build (a typeof X probe run inside the same sandbox the runtime uses), never written from memory, and pinned by a test that reads that probe. ⛔ Not in scope: changing whether os build fails on the lowering class (#13838), or giving the sandbox Intl (a capability expansion).

Grade: pm:queue · priority:p2 · domain:cli (landing file is in packages/cli) · type Bug. Not clause ②: the lowering already refuses handlers with free identifiers; this corrects which identifiers count as free, against the runtime's measured truth.

Re-check

git grep -n "'Intl'" origin/main -- packages/cli/src/utils/detect-free-identifiers.ts

Positive control: 'JSON' in the same list.

Dedup

search_issues (two queries, positive controls returned #13651 / #13838): #13651 (closed — lowering failed open, made loud), #13838 (pm:on-hold — whether os build should fail by default on the lowering class), #14168 (the feature half), #1867 (closed — sandbox crashes on nested writes). None names the allowlist/sandbox mismatch.

Refs: #14168 · #13651 · #13838 · objectstack-ai/duly#24 (the application that hit it).

[os-trump]

Claim: PM loop round 65
Session: session_016yfqQh2dBgPAymYd7xipza
Branch: claude/issue-14301-sandbox-globals-allowlist
Worktree: objectstack-issue-14301
Domain: domain:cli
File surface: packages/cli/src/utils/detect-free-identifiers.ts — the GLOBALS set split into the set the QuickJS hook sandbox actually provides and the Node-only set, membership MEASURED by a typeof probe run inside the same sandbox the runtime uses (never written from memory) and pinned by a test that reads that probe; packages/cli/src/utils/detect-free-identifiers.test.ts (+ the probe-reading pin); packages/cli/src/lint/hook-body-lowering.ts / .test.ts only if the named refusal reason needs a new spelling to surface; one changeset for @objectstack/cli. ⛔ Not in scope: making os build fail on the lowering class (#13838, on hold), giving the sandbox Intl (a capability expansion), any write under packages/runtime/** — the probe uses the runtime's sandbox read-only; if it needs an export that does not exist, stop and report. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — no triage size line on the card; a two-set split plus a measured membership probe plus lint surfacing.
Clause-②: no, per the triage grading in the body ("the lowering already refuses handlers with free identifiers; this corrects which identifiers count as free, against the runtime's measured truth") — it narrows what os build LOWERS, not a published accept-set. ⚠️ Re-declare from your actual diff.
Serial constraints cleared: fence re-derived from every open PR's own merge-base diff at 15:0xZ on origin/main=79c71d29db6d (27 open PR branches): none touches detect-free-identifiers.ts, hook-body-lowering.*, extract-hook-body.ts or lower-callables.*. H17 trigger index (#7898): no intersection.

Comments re-read before claiming: none — the card carries its triage grading in the body (pm:queue · priority:p2 · domain:cli · type Bug, ruled direction: split GLOBALS, refuse Node-only globals with a named reason, membership measured in the sandbox and pinned). ⛔ No claim from another session.

Premise re-verified on origin/main (79c71d29db6d) — three limbs: (action face) 'Intl' is still in GLOBALS at packages/cli/src/utils/detect-free-identifiers.ts:43 under the "Web-ish that the sandbox / Node commonly provide" comment (positive control: 'JSON' at :41); (reference limb) #13651's hook-body-lowering lint rule is on the tree and fires only on a refused lowering, #13838 stays pm:on-hold, #14168 (the feature half) stays in the decision inbox; (ruling limb) the body's triage grading is the only ruling on the card.

---

Generated by Claude Code

[os-trump]

Dev claim (os-dev, dispatched by the domain:cli PM seat)
Session: session_016yfqQh2dBgPAymYd7xipza
Branch: claude/issue-14301-sandbox-globals-allowlist (pushed empty first as the write-route probe — 200)
Worktree: objectstack-issue-14301
Base sha: 90ff957e6e8fd7cf7a25e3dcc3ff24f88b822494 (origin/main at worktree creation; the PM's fence was derived at 79c71d29db6d)
File surface claimed: packages/cli/src/utils/detect-free-identifiers.ts, packages/cli/src/utils/detect-free-identifiers.test.ts, a new probe-reading pin under packages/cli/src/utils/, packages/cli/src/utils/extract-hook-body.ts (the refusal path the named reason is composed on), packages/cli/src/lint/hook-body-lowering.ts / .test.ts only if the named reason needs a spelling to surface, one changeset.

Comments re-read before the first edit: one comment only — the PM claim 5511622241, naming this same session and branch. No claim from another session.

Premise re-verified by symbol on the worktree base 90ff957e6e: 'Intl' is still a member of GLOBALS in packages/cli/src/utils/detect-free-identifiers.ts (line 43, under the "Web-ish that the sandbox / Node commonly provide" comment); positive control 'JSON' present in the same set at line 41. hook-body-lowering.ts (#13651) is on the tree and reads HookBodyExtractionError.kind. @objectstack/runtime is already a dependency of @objectstack/cli and is already registered in KNOWN_UNALIASED_TEST_IMPORTS['@objectstack/cli'], so the sandbox probe can import QuickJSScriptRunner from a packages/cli test with no write under packages/runtime/** and no change to that shrink-only ledger.

Premise stands. Proceeding.

---

Generated by Claude Code