🛡️ Execution Sandboxing & Lifecycle
🔒 Sandbox Creation
- 🌐 Iframe Isolation:
sandbox="allow-scripts" blocks parent access, cookies, and local storage.
- ❄️ Context Lock: Global scope is isolated via a shadow iframe; sensitive APIs are frozen using
Object.defineProperty.
🔄 Script Lifecycle
- ⚙️ Compile: Parses JS & catches syntax errors.
- 📥 Load: Mounts compiled scripts to the environment.
- 🏃 Run: Executes the entrypoint with injected globals.
- 🧹 Teardown: Kills dangling intervals, timeouts, workers, and event listeners.
- 🚨 Timeout Guard: Web Worker monitor or generator loop counter terminates infinite loops by force-recreating the sandbox.
🔌 State Syncing
- 📨 Protocol:
postMessage transfers serialized data/errors (execution_event).
- ⚠️ Limits: Standard
structuredClone rules apply (no functions/DOM nodes).