"Code"-type Modify Request/Response rules ran rule-supplied JS via
`new Function(...)` directly in the proxy's Node process (full require/process/
fs/child_process). Code rules travel between users (shared lists, import/export,
team sync), so this was a supply-chain RCE primitive.

Rule code now runs inside QuickJS compiled to WebAssembly (quickjs-emscripten,
single-file embedded variant). QuickJS is a separate JS engine in the WASM
sandbox: no require/process/fs/global, and no prototype path back to the host
(constructor-escape blocked). Only injected primitives are reachable.

Why QuickJS-WASM (not isolated-vm or worker_threads + vm):
- isolated-vm is a native addon with no build for a supported Electron's V8
  (6.x too old for V8 13, 7.x needs Node 26).
- worker_threads cannot create a Worker in an Electron renderer ("The V8
  platform ... does not support creating Workers"), and the proxy runs in the
  desktop app's background renderer.
QuickJS-WASM is pure WASM+JS — builds nowhere natively and runs in the renderer.

- src/utils/index.ts: executeUserFunction runs in QuickJS; 5s deadline interrupt,
  128MB cap. isValidFunctionString compiles via `new Function` WITHOUT calling it
  (parse-only, no execution). getFunctionFromString removed.
- both Modify Request/Response processors: validate -> pass the source string.
- contract preserved: returns a string (objects JSON-stringified), promises
  awaited, console captured as {type,args}, $sharedState read + written back.
- intentional gap: no fetch/Buffer/timers (fetch needs the asyncify variant +
  async host bridge — a follow-up; QuickJS can do it safely).

Verified: sandbox harness 13/13 (Node 24); instantiates + runs + blocks
host access inside the Electron 42 renderer; before/after exploit probe flips
from RCE/file/env/process access to fully blocked.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

QuickJS is a bare ECMAScript engine — it lacks the Web/Node globals rule code
commonly expects. Add them as PURE-JS shims that run inside the sandbox, built
only from QuickJS built-ins so no host object crosses the boundary (same safety
model as atob/btoa; verified require/process stay undefined in-sandbox):

- URL / URLSearchParams (regex-based parser; common cases — protocol/host/port/
  path/search/hash/origin, searchParams, basic relative-base resolution)
- TextEncoder / TextDecoder (UTF-8)
- structuredClone (deep clone, preserves Date/Map/Set, handles cycles)
- crypto.randomUUID / crypto.getRandomValues

NOTE on crypto: this is a Math.random-based STOPGAP — NOT cryptographically
secure (no entropy source in the WASM realm). Fine for ids/non-security random;
secure crypto should be a host bridge (follow-up), matching
@requestly/sandbox-node's byte-identical-to-host crypto approach.

Aligns with the API client's QuickJS sandbox model: pure-JS shims for
computation-only APIs, host bridge reserved for capability APIs (crypto/fetch).
URL is hand-rolled (sandbox-node doesn't expose URL — uses a regex internally —
so this is a superset of theirs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

setTimeout previously fired once on a microtask and ignored `ms`, silently turning
retry/backoff code into a hot loop (hammering endpoints, ignoring rate limits) and
breaking delay-based ordering — a quiet behavioral surprise for existing rules.

Add a __hostTimer bridge: the guest setTimeout now waits the real delay via a host
timer, clamped host-side to the execution's remaining wall-clock budget (so a timer
can never outlast the run), driven by the existing guest-promise + pump loop.
clearTimeout cancels the pending callback. setInterval stays a no-op (a repeating
timer can't outlive a per-request execution); queueMicrotask stays a microtask.

Chose delay-aware scheduling over throwing on setTimeout: throwing would break the
common benign `setTimeout(fn, 0)` yield and library-internal timer use.

Verified: 120ms timer elapses ~123ms; delay ordering (fast before slow); backoff
loop accumulates real delay; clearTimeout cancels; setTimeout(0) still yields.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Previously any sandbox failure was swallowed: a prelude (our shim) error was
disposed silently, user throws/timeouts degraded to a generic "Returned value is
not a string", nothing reached host logs/Sentry, and synchronous user throws
leaked out as untracked top-level eval errors. A regressed polyfill would have
been invisible in production.

Now executeUserFunction categorises and surfaces every failure:
- Eval the prelude (our shims) SEPARATELY from the user wrapper, so a shim error
  is unambiguously ours (kind "prelude") and is dumped, not disposed.
- Run the user fn inside a `.then` so SYNC throws become rejections captured by
  `.catch` (→ __OUTPUT.error) like async ones, instead of leaking out.
- Throw a typed SandboxError { kind: "prelude" | "user" | "timeout" } carrying the
  real message; success still returns the result string. A CPU-deadline interrupt
  is classified as "timeout" (not a user logic error).
- reportSandboxError(): always console.error("[rq-sandbox]", kind, msg); prelude/
  timeout also go to Sentry (guarded — may be uninitialised). user → console only.

Processors now show the real error and a distinct code: 188 = sandbox-internal
(our bug), 187 = the rule author's code.

Verified: prelude error reported (not swallowed); user sync + async throws surface
the real message; infinite loop → timeout; happy paths for all APIs unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The host bridge returns the random bytes as a plain JSON array (only data crosses
the sandbox boundary), so randomBytes(n) handed the guest a plain Array and
randomBytes(16).toString('hex') produced comma-joined decimals instead of hex.
Wrap the crossed-over bytes in the guest Buffer shim so the return type matches
Node (toString('hex'/'base64'/'utf8') work). Entropy is unchanged (real host
node:crypto); only the guest-side container type is restored.

Addresses CodeRabbit review on PR #112.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>