From ab9392180a96c2cc6a92885cb98860526f3544ba Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 8 Sep 2026 08:23:38 +0000
Subject: [PATCH 1/2] Fix missing Network capability check in web.rs server
 startup

This commit adds a missing context capability check for `Capability::Network`
to the `start`, `serve`, and `fetch` functions in `stdlib/src/web.rs`. It also updates the module
registration to require the network capability, preventing a potential capability bypass.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/web.rs | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/stdlib/src/web.rs b/stdlib/src/web.rs
index 3edf64c6..3df03aa3 100644
--- a/stdlib/src/web.rs
+++ b/stdlib/src/web.rs
@@ -86,7 +86,7 @@ impl Resolver for SafeResolver {
 use std::sync::Mutex;
 use std::thread;
 use techscript_runtime::{
-    context::RuntimeContext, error::RuntimeError, function::Callable, value::RuntimeValue,
+    context::{Capability, RuntimeContext}, error::RuntimeError, function::Callable, value::RuntimeValue,
 };
 
 static SERVER_RUNNING: AtomicBool = AtomicBool::new(false);
@@ -382,7 +382,16 @@ impl StdlibRegistry {
             Rc::new(StdFunction {
                 name: "start".to_string(),
                 arity: 2,
-                callback: |_ctx, args| {
+                callback: |ctx, args| {
+                    if !ctx.config.capabilities.contains(&Capability::Network) {
+                        return Err(RuntimeError::new(
+                            techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Network capability is denied".to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let port = args[0].try_into_int().map_err(|e| {
                         RuntimeError::new(
                             techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
@@ -442,7 +451,16 @@ impl StdlibRegistry {
             Rc::new(StdFunction {
                 name: "serve".to_string(),
                 arity: 1,
-                callback: |_ctx, args| {
+                callback: |ctx, args| {
+                    if !ctx.config.capabilities.contains(&Capability::Network) {
+                        return Err(RuntimeError::new(
+                            techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Network capability is denied".to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let port = args[0].try_into_int().map_err(|e| {
                         RuntimeError::new(
                             techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
@@ -511,7 +529,16 @@ impl StdlibRegistry {
             Rc::new(StdFunction {
                 name: "fetch".to_string(),
                 arity: 1,
-                callback: |_ctx, args| {
+                callback: |ctx, args| {
+                    if !ctx.config.capabilities.contains(&Capability::Network) {
+                        return Err(RuntimeError::new(
+                            techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Network capability is denied".to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let url = args[0].to_string();
 
                     if !is_safe_url(&url) {
@@ -592,7 +619,7 @@ impl StdlibRegistry {
                 name: "std.web".to_string(),
                 version: "1.0.0".to_string(),
                 exports,
-                required_capabilities: Vec::new(),
+                required_capabilities: vec![Capability::Network],
             },
         );
     }

From 95239c2ae5fa6279e1ff4d089b69c4aa7e7abd45 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 8 Sep 2026 08:54:02 +0000
Subject: [PATCH 2/2] Fix missing Network capability check in web.rs server
 startup

This commit adds a missing context capability check for `Capability::Network`
to the `start`, `serve`, and `fetch` functions in `stdlib/src/web.rs`. It also updates the module
registration to require the network capability, preventing a potential capability bypass.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/web.rs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/stdlib/src/web.rs b/stdlib/src/web.rs
index 3df03aa3..b3fedb0a 100644
--- a/stdlib/src/web.rs
+++ b/stdlib/src/web.rs
@@ -86,7 +86,10 @@ impl Resolver for SafeResolver {
 use std::sync::Mutex;
 use std::thread;
 use techscript_runtime::{
-    context::{Capability, RuntimeContext}, error::RuntimeError, function::Callable, value::RuntimeValue,
+    context::{Capability, RuntimeContext},
+    error::RuntimeError,
+    function::Callable,
+    value::RuntimeValue,
 };
 
 static SERVER_RUNNING: AtomicBool = AtomicBool::new(false);
@@ -386,7 +389,8 @@ impl StdlibRegistry {
                     if !ctx.config.capabilities.contains(&Capability::Network) {
                         return Err(RuntimeError::new(
                             techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
-                                "Security policy violation: Network capability is denied".to_string(),
+                                "Security policy violation: Network capability is denied"
+                                    .to_string(),
                             ),
                             None,
                             None,
@@ -455,7 +459,8 @@ impl StdlibRegistry {
                     if !ctx.config.capabilities.contains(&Capability::Network) {
                         return Err(RuntimeError::new(
                             techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
-                                "Security policy violation: Network capability is denied".to_string(),
+                                "Security policy violation: Network capability is denied"
+                                    .to_string(),
                             ),
                             None,
                             None,