Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

permissions: { network: "allow" } authorizes egress but guest fetch() hangs — no host network adapter on public API

未关闭
  • 哪里不对？
#96 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
52/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
node.js, typescript
领域
api, backend, documentation

调研方向

首先使用公开的 NodeRuntime.create API 重现 10 秒超时，然后检查 NodeRuntimeCreateOptions 和所引用的 test-runtime 定义，包括 NetworkAdapter 和 hasHostNetworkAdapter()。检查公开的 @secure-exec/core index.d.ts 以及 quickstart 中的 Permissions Configuration 部分。完成的标准是：出站请求要么通过有文档说明的公开设置正常工作，要么在没有适配器时 network: "allow" 快速失败，并且 quickstart 已得到澄清。

由索引模型根据 Issue 内容生成。

描述

Summary

Granting permissions: { network: "allow" } via the public NodeRuntime.create API authorizes guest network access, but there is no way through the public SDK to provide a host network adapter to actually service outbound requests. As a result, an outbound fetch() in guest code hangs indefinitely instead of either succeeding or failing fast.

The quickstart's Permissions Configuration section implies network: "allow" is sufficient to enable network, so this is misleading as written.

Environment

Repro

import { NodeRuntime } from "secure-exec";

const rt = await NodeRuntime.create({ permissions: { network: "allow" } });
const r = await Promise.race([
  rt.run(`
    try { const res = await fetch("https://example.com"); __return({ status: res.status }); }
    catch (e) { __return({ err: String(e.message || e) }); }
  `),
  new Promise((res) => setTimeout(() => res({ value: { TIMEOUT_10s: true } }), 10000)),
]);
console.log("result:", r.value); // -> { TIMEOUT_10s: true }  (hangs until the race timer fires)
await rt.dispose();

Observed: the guest fetch never resolves — bounded to a 10s race, it times out at exactly 10s every time.

Control checks:

  • A host-side fetch("https://example.com") returns 200 in the same environment, so host egress is not the problem.
  • The default deny path works correctly and fails fast: without the permission, the guest fetch rejects promptly with fetch failed.

So the issue is specific to the network: "allow" + outbound-request path hanging rather than completing.

Root cause (from reading the type defs)

Granting the permission only authorizes network; performing it requires a host network adapter. The architecture clearly expects one — @secure-exec/core's test-runtime defines createNodeHostNetworkAdapter(), createDefaultNetworkAdapter(), a NetworkAdapter interface, and hasHostNetworkAdapter().

However:

  • test-runtime is not re-exported from @secure-exec/core's index.d.ts, and the public secure-exec package only re-exports NodeRuntime + types.
  • NodeRuntimeCreateOptions has no field to supply a network adapter (only permissions, env, cwd, commandsDir, files, mounts, nodeModules, tools, loopbackExemptPorts).

So through the public API there is no way to wire egress, and network: "allow" ends up granting permission with no transport behind it.

Suggested fix (either)

  1. Expose a host network adapter on NodeRuntimeCreateOptions (e.g. network / networkAdapter), and document it in the quickstart, or
  2. Make network: "allow" with no available adapter reject fast with a clear error (e.g. "network permitted but no host network adapter configured") instead of hanging.

Either way, the quickstart's Permissions section should clarify whether outbound HTTP is supported on the public SDK in 0.3.0 and, if so, the complete setup required.

Minor doc nit

The quickstart code uses .run<{...}>(...) (TS generics) and the package is "type": "module", but doesn't mention that a .js file in a CommonJS project won't load it — it needs .mjs or "type": "module". Worth a one-line note for JS users following along.

主要语言
TypeScript
星标
1k
派生
54
30 天内没有已合并 PR

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

rivet-dev/dynamic-apps 的其他 Issue

查看 rivet-dev/dynamic-apps 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。