Slice (Nexus-JS) v0.10.4

Slice (Nexus-JS) v0.10.4

Highlights

• Workspace-Wide Domain Architecture: Reorganized all five workspace crates (slice-engine, slice-cas, slice-sandbox, slice-io, and slice-cli) into focused domain subdirectories with concise root lib.rs / main.rs entrypoints.
• Security Hardening:
  • slice-engine: Hardened isolate compartment lifecycle, OCap/DLP enforcement, and cryptographic intrinsics.
  • slice-cas: Prevented JSON module code injection, blocked package.json exports/imports path traversal outside package roots, guarded against circular tsconfig.json extends chains, and added safe bracket export binding for non-identifier export names.
  • slice-sandbox: Hardened VFS lexical normalization against Windows UNC/device-namespace prefixes and null bytes, enforced strict port isolation in verify_net_connect, expanded SSRF guards for trailing-dot FQDNs, IPv6 zone indices, and NAT64/6to4/Teredo transition ranges, and sanitized subprocess binary names.
  • slice-io: Enforced active-allocation bitmap checks on slab reads/writes, zeroed slab buffers on release, and rejected duplicate buffer-slot aliasing in completion ring submissions.
  • slice-cli: Registered explicit audit_secrets across all HTTP server worker isolates, JSON-escaped SandboxViolation 403 responses, switched temporary .cas staging files to unique per-invocation paths, skipped symlinks in --watch and test discovery, and wired allowNet/allowExec with bounded request lines in slice mcp.
• Performance Optimizations:
  • slice-cas: Single-pass CJS require summary scanning, zero-allocation import specifier scanning, and cached Oxc AST dead-export liveness analysis.
  • slice-sandbox: Zero-allocation VFS path validation, ASCII case-insensitive secret key classification, and FxHashMap/FxHashSet capability lookups.
  • slice-io: LIFO hot-cache slab slot allocation and O(1) active-slot accounting.
  • slice-cli: Single-stat FxHashMap multi-tenant .cas hot-swap caching and stack-allocated itoa HTTP response header formatting.