From d7a27b20df82be857a8c8c86ead561f9d4ac646f Mon Sep 17 00:00:00 2001
From: Tianyi Cui <53024+tianyicui@users.noreply.github.com>
Date: Wed, 8 Jul 2026 14:11:15 +0800
Subject: [PATCH] test: pin the no-recursive-run_code invariant; document the
 fold at the drain site (bot review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both bot criticals verified against the code and rejected as exploit
paths — pinned instead of patched:

The bindings loop already excludes run_code (the skip predates the
finding), and the runtime host resolves forged port calls as own
properties of the bindings record, so an absent binding is unreachable
from a program under any mode. A new both-mode test pins the invariant:
the record has no run_code key on any lookup path.

The drain await cannot mask a run failure: `queue` is the folded tail
(every link swallows its rejection), so `await queue` never rejects and
the runtime's own result.error always reaches the CodeRunFailedError
conversion — the existing abort test exercises exactly the
queued-abandonment-plus-run-failure scenario. Stated at the drain site so
the fold's purpose is explicit.
---
 packages/core/tools/src/code-mode.ts        |  4 ++++
 packages/core/tools/tests/code-mode.spec.ts | 20 ++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/packages/core/tools/src/code-mode.ts b/packages/core/tools/src/code-mode.ts
index 904c65ef0e..970bb6e208 100644
--- a/packages/core/tools/src/code-mode.ts
+++ b/packages/core/tools/src/code-mode.ts
@@ -259,6 +259,10 @@ export function createRunCodeTool(registry: ToolRegistry, requireRuntime: () =>
         // an in-flight sub-dispatch, abandoning queued ones), then await the
         // queue's drain — an aborted sub-call still settles and logs its
         // event INSIDE the open turn; nothing can append after we return.
+        // `queue` is the FOLDED tail (every link swallows its rejection into
+        // undefined), so this await cannot itself reject — an abandoned
+        // queued call can never mask the runtime's own `result.error` below;
+        // rejections surface only on the per-call promises the program holds.
         runController.abort('run_code settled')
         await queue
 
diff --git a/packages/core/tools/tests/code-mode.spec.ts b/packages/core/tools/tests/code-mode.spec.ts
index 7fcd0890e6..7cbceb5361 100644
--- a/packages/core/tools/tests/code-mode.spec.ts
+++ b/packages/core/tools/tests/code-mode.spec.ts
@@ -119,6 +119,26 @@ describe('mode-aware wire contribution', () => {
     expect(assembly.sections.some(section => section.name === 'tools:sdk')).toBe(true)
   })
 
+  it("never exposes run_code to programs, even under mode 'both' (no recursive dispatch path)", async () => {
+    const { ctx, runtime } = await setup({ mode: 'both' })
+    registerEcho(ctx)
+    runtime.behavior = (request) => {
+      const functions = request.bindings[0]!.functions
+      return Promise.resolve({
+        logs: [],
+        value: JSON.stringify({
+          names: Object.keys(functions).sort(),
+          // Own-property AND prototype-chain reads both come back empty —
+          // there is no handle a program could re-enter run_code through.
+          runCode: String(functions[RUN_CODE_NAME]),
+        }),
+      })
+    }
+    const result = await runCode(ctx, 'program')
+    expect(result.isError).toBe(false)
+    expect(JSON.parse((result.content[0] as { text: string }).text)).toEqual({ names: ['echo'], runCode: 'undefined' })
+  })
+
   it('renders byte-identical SDK text across consecutive assemblies of an unchanged tool set', async () => {
     const { ctx, systemPrompt } = await setup({ mode: 'code' })
     registerEcho(ctx)