Slice (Nexus-JS) v0.10.5

Slice (Nexus-JS) v0.10.5

Highlights

• Sandbox & MCP Security/Capability Enhancements (#12–#16):
  • Custom Slice.evalSandbox Audit Secrets (#12): Added auditSecret / auditSecrets options to Slice.evalSandbox and slice mcp (slice_eval_ts), scanning child stdout and return values for raw, Base64, and Base64URL secret leaks while isolating child secrets from the parent compartment.
  • Guest Checkpoint Controls (#13): Added checkpoints (boolean), maxCheckpoints (usize), and checkpointsTaken / restoresPerformed telemetry to Slice.evalSandbox and slice mcp.
  • MCP Deterministic Seed & Memory Alias (#14, #15): Added deterministicSeed and memoryBytes support to slice_eval_ts in slice mcp.
  • Time-Travel slice test Async & Clock Accuracy (#16): Started per-test wall-clock timers after lazy compilation, preserved async errors across async test(...) promises, and restored BOA_TIME_WARP_ENABLED via an RAII guard.
• Bug & Isolation Fixes (#1–#11):
  • Partitioned outbound HTTP/1.1 Keep-Alive connection pools by (tenant, host, port) to prevent cross-tenant socket reuse or eviction.
  • Enforced strict OCap and SSRF validation on mocked fetch, WebSocket, and Slice.connect sockets before consulting mock tables.
  • Fixed SavedIsolateContextGuard restoration of parent event-loop state, BOA_ENV_MAP, BOA_HTTP_REQ, BOA_HTTP_RESP, BOA_ACTIVE_TENANT, and mock tables across nested Slice.evalSandbox calls.
• Engine Performance & Memory Optimizations:
  • Dirty-Subsystem Bitmask (BOA_DIRTY_SUBSYSTEMS) & Zero-Allocation Context Guard: Added a single-byte dirty bitmask (DIRTY_EVENT_LOOP, DIRTY_ALS, DIRTY_FETCH_MOCK, DIRTY_WEBSOCKET, DIRTY_SOCKETS, DIRTY_WORKERS, DIRTY_WASM) and Option<SavedEventLoopSnapshot> fast path so synchronous isolates and nested sandboxes skip cloning or clearing untouched subsystems.
  • SANDBOX_EVAL_BC_CACHE & Tier-0 AST Fast Rejections: Added a 64-entry thread-local Rc<[u8]> bytecode cache in compile_source_for_sandbox_eval, reducing child Slice.evalSandbox latency by 88.4% (15.22 us -> 1.77 us) and 3-branch Tree-of-Thought evaluation by 48.6% (107.06 us -> 55.02 us).
  • Precompiled __slice_drain_wu & Response.json Fast-Path: Cached globalThis.__slice_drain_wu on WarmBoaRealm::drain_wu_fn and added a !init fast-path to Response.json, boosting slice serve Tier-1 WinterTC throughput by +21.2% (120,333 req/s -> 145,839 req/s).
  • CHECKPOINT_SLAB & EDGE_KV_SLAB Cleanup: Purged pre-warm checkpoints in prewarm_boa_bundle and skipped empty KV shard probes in restore_tenant_state, cutting CS-01 Warm latency by -16.4% (15.69 ms -> 13.12 ms), CS-05 Warm latency by -12.9% (11.85 ms -> 10.31 ms), and Slice.kv memory footprint by -31.8% (12,362 B -> 8,431 B).