Skip to content

Slice (Nexus-JS) v0.10.12

Latest
Latest

Choose a tag to compare

View all tags
@siktec-lab siktec-lab released this 12 Nov 02:36
v0.10.12
8aa4054
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Slice (Nexus-JS) v0.10.12

Highlights

Security & Sandbox Hardening (#71)

  • Deny-by-Default Filesystem OCap & CoW VFS Tombstone Isolation:
    • Enforced strict deny-by-default filesystem capability tokens across CapabilityToken::pure_compute(), Slice.evalSandbox, slice eval, slice serve, and slice mcp unless explicit --allow-read / --allow-write flags or slice.toml capabilities are granted (slice test retains isolated /tmp and /vfs scratch access).
    • Added copy-on-write VFS deletion tombstones (BOA_VFS_TOMBSTONES) so unlinkSync, rmSync, rmdirSync, and renameSync mask entries in memory without deleting underlying host filesystem files, with O(1) rollback on Slice.restore().
  • Asymmetric Cryptography Hardening (RSA 2048..8192 & RFC 7748 X25519):
    • Removed static RSA-2048 keys and disabled unbounded runtime RSA/DSA prime generation in the multi-tenant edge sandbox (ERR_CRYPTO_UNSUPPORTED_OPERATION / NotSupportedError / ERR_INVALID_ARG_VALUE).
    • Implemented dynamic 2048 to 8192-bit ASN.1 DER (PKCS#8, PKCS#1, SPKI) and JWK RSA import/export plus ring-backed RSASSA-PKCS1-v1_5 and RSA-PSS (SHA-256, SHA-384, SHA-512) signing and verification across node:crypto and crypto.subtle.
    • Implemented constant-time RFC 7748 X25519 key generation, PKCS#8 v1/v2 + SPKI + JWK + raw codecs, crypto.diffieHellman, and crypto.subtle X25519 (deriveBits, deriveKey) via x25519-dalek with constant-time low-order public point rejection.

Runtime Performance & Prelude Sharding (#62, #69, #71)

  • WinterTC fetch Hot-Path Latency Optimization (#62):
    • Optimized SliceIsolate::dispatch_http_request with lazy header materialization, fast-path synchronous Response extraction, and conditional event-loop draining, lifting Tier-1 WinterTC HTTP/1.1 keep-alive throughput to 154,737 req/s (6.46 us/req).
  • Runtime Hot Paths, JSON Fast Paths, VFS Slab, & Shard 18/19 Split (#69):
    • Accelerated JSON.parse / JSON.stringify fast paths and object shape property lookups in boa_engine, optimized node:fs VFS slab paths, and split 18_intl.js from 19_process_cli.js so CLI and server workloads that do not use Intl skip evaluating internationalization tables.

Compiler Diagnostics & Documentation (#60, #70, #71)

  • Multi-Frame Source-Mapped Stack Traces & Class Method Spans (#60):
    • Extended //#[SLICE_SMAP_V1] source mapping in slice-cas and stack formatting in slice-engine to resolve multi-frame uncaught call stacks and class/object methods back to original TypeScript files and line numbers, and aligned pre-fused SLICEBC\x01 prelude line offsets.
  • Documentation & Compatibility Matrix Alignment (#70, #71):
    • Streamlined README.md, added unified documentation navigation (docs/README.md), removed stale internal specs, and aligned COMPATIBILITY.md and docs/ with verified runtime behavior.

Benchmark Summary (v0.10.12 vs Bun v1.4.4, Deno v2.9.8, Node.js v27.0.0-alpha)

  • 33 / 33 Workloads Won in --warm pooled isolate mode (33/33 vs Deno, 33/33 vs Node.js, and 29/33 cold one-shot vs Bun).
  • Single Isolate Cold-Start (Linux x86_64): 0.94 us Min / 1.24 us P50 / 2.10 us P99 (1.50 ms for 1,000-tenant MicroVM swarm at 4.0 KB per-tenant compartment footprint).
  • slice serve Multi-Tenant HTTP/1.1 Keep-Alive: 154,737 req/s (Tier-1 WinterTC) / 148,865 req/s (Tier-0 CAS), 1.60x faster than Bun.serve and 2.71x faster than Node.js.
  • Security Verification: 5 / 5 PASS across OCap, SES, Fuel, SSRF/DLP, and MPK containment vectors.
Assets 6
Loading