u

README.md

@@ -92,6 +92,7 @@ All currently registered tools are defined in `src/tools/index.js`.
 | `rm` | Deletes a file while retaining its contents in the undo log. |
 | `rmdir` | Recursively deletes a directory. Its undo entry records the path but not the removed contents. |
 | `bash_exec` | Runs `bash -c` with the workspace as its initial working directory. Requires explicit approval, closes stdin, disables interactive/color behavior, limits output, and kills the process tree at timeout. |
+| `javascript_execute` | Runs a JavaScript snippet in a vm2 sandbox on a worker thread, terminated at `timeout`. Returns `module.exports` (sync or a promise) and captured `console` output. `require` is restricted to workspace files — no host modules, no `node_modules`, no `process`/`fs`. `fetch` is off unless `allow_network=true` is explicitly approved by the user. |
 | `websearch` | Uses Tavily to return a synthesized answer and ranked web results. It fails when no Tavily key is configured. |
 | `browse_url` | Uses Tavily to extract one or more web pages, optionally focused by a relevance query. It fails when no Tavily key is configured. |
 | `ask_user` | Prompts the user for clarification or a decision, with up to three suggested choices and a free-text option. |
@@ -169,6 +170,8 @@ Fido has useful path and workflow safeguards, but it is not an operating-system
 - Dedicated filesystem tools require relative paths and reject lexical paths that resolve outside `ROOT_DIR`.
 - Direct filesystem access can still follow filesystem semantics such as symlinks; path checks should not be treated as a hard kernel-enforced isolation boundary.
 - `bash_exec` pins only the shell's starting directory. The shell can use absolute paths or change directories, so interactive approval is the primary protection around shell execution.
+- `javascript_execute` runs code in a vm2 sandbox on a worker thread. `NodeVM` ignores vm2's own `timeout` option, so the parent enforces a hard wall-clock limit and terminates the thread — this is what stops `while (true) {}`. The sandbox gets no `process`, no built-in modules and no `node_modules`; `require` resolves only against the workspace root.
+- `javascript_execute` never enables the network implicitly. `fetch` and the WHATWG classes are injected only when `allow_network=true` is passed *and* the user approves; declining runs the snippet offline rather than failing the call. Approved network access still permits SSRF (localhost, internal services, cloud metadata endpoints), so the approval prompt is the only guard.
 - Users can approve one command or all shell commands for the rest of that Fido session.
 - Network and extracted web content is explicitly treated as untrusted third-party input.
 - The model is instructed to inspect files before patching and to prefer targeted replacements over whole-file rewrites.