improvement(security): isolated-vm env construction (v8s escape case)

[icecrasher321]

Summary

• isolated-vm env construction (v8s escape case)
• upgrade app image node version to 24 which has current LTS support

Type of Change

• Other: Security

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Jul 31, 2026 2:23am

[cursor]

PR Summary

High Risk
Changes the security boundary for untrusted code execution (env leakage on isolate escape) and upgrades Node/isolated-vm native bindings used by the sandbox worker—both are high-impact if misconfigured or ABI-mismatched.

Overview
Sandbox workers no longer inherit the app’s full process.env. Spawning the isolated-vm child now passes an explicit allowlist via new buildWorkerEnv() in isolated-vm.ts (PATH, NODE_ENV, two IVM_* limits, locale/timezone, Windows boot vars). That closes the case where Node would copy host secrets into the worker if spawn omitted env—relevant if a V8 escape reads the child environment.

A regression test in isolated-vm.test.ts asserts known secret keys and a canary env var are absent and that every forwarded key is on the allowlist. .claude/rules/sim-sandbox.md documents the rule and checklist item for new worker env vars.

Runtime alignment for the sandbox worker: CI (test-build.yml) and docker/app.Dockerfile move Node 22 → 24 (Active LTS for the Node process that runs user code). isolated-vm is bumped 6.0.2 → 6.1.2 in apps/sim/package.json / lockfile (build path shifts toward node-gyp-build), kept in sync with Node 24 ABI expectations noted in the Dockerfile comments.

^{Reviewed by Cursor Bugbot for commit 0e5c067. Configure here.}

[greptile-apps]

Greptile Summary

The PR reduces sandbox-worker secret exposure and updates its runtime compatibility.

• Replaces implicit parent-environment inheritance with an explicit worker environment allowlist and adds a regression test.
• Upgrades isolated-vm from 6.0.2 to 6.1.2.
• Moves the application image and primary test/build workflows from Node.js 22 to Node.js 24.
• Documents the sandbox environment-isolation requirement.

Confidence Score: 5/5

The PR appears safe to merge, with the worker allowlist covering all environment variables currently consumed by the sandbox process.

The sandbox worker reads only the two forwarded IVM limit variables, both retain worker-side defaults, and the production image rebuilds the native isolated-vm addon against its Node.js 24 runtime.

Important Files Changed

Filename	Overview
apps/sim/lib/execution/isolated-vm.ts	Adds a complete environment allowlist for the current worker requirements and applies it when spawning workers.
apps/sim/lib/execution/isolated-vm.test.ts	Adds regression coverage confirming sandbox workers do not inherit application secrets or unexpected variables.
docker/app.Dockerfile	Upgrades the sandbox-worker runtime to Node.js 24 while retaining the native isolated-vm rebuild step.
apps/sim/package.json	Upgrades isolated-vm to 6.1.2 for the updated runtime.
.github/workflows/test-build.yml	Aligns the primary test and build jobs with Node.js 24.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  App[Application process<br/>full environment] -->|buildWorkerEnv| Allowlist[Explicit environment allowlist]
  Allowlist -->|spawn Node 24| Worker[Sandbox worker process]
  Worker --> Isolate[isolated-vm isolate]
  Secrets[Database and provider secrets] -. blocked .-> Worker

Loading

_{Reviews (1): Last reviewed commit: "upgrade main node to v24" | Re-trigger Greptile}