fix(sandbox): provide btoa and atob to sandbox tasks

docx 9.15 encodes base64 through the global btoa/atob, so in the task
isolate Packer.toBase64String and patchDocument's base64 output (which
worked on 9.7.1) and password protection threw ReferenceError. The worker
now bridges btoa/atob to Node's native WHATWG implementations, like the
text codecs, and the bare verification context mirrors them.

Author: waleedlatif1

apps/sim/lib/execution/isolated-vm-worker.cjs

@@ -740,6 +740,17 @@ async function executeTask(request, executionId) {
     releaseables.push(textDecodeCallback)
     await jail.set('__textDecode', textDecodeCallback)
 
+    // btoa / atob delegate to Node's native WHATWG implementations, so
+    // libraries that encode base64 through them (docx's Packer.toBase64String,
+    // document protection hashes, data-URI images) behave as in a browser.
+    const btoaCallback = new ivm.Callback((data) => btoa(data))
+    releaseables.push(btoaCallback)
+    await jail.set('__btoa', btoaCallback)
+
+    const atobCallback = new ivm.Callback((data) => atob(data))
+    releaseables.push(atobCallback)
+    await jail.set('__atob', atobCallback)
+
     // Delegate timers to Node's real timer heap via ivm.Reference (the pattern
     // recommended by laverdet/isolated-vm#136). Host-side bookkeeping was
     // hoisted to the function scope above so the finally can always sweep.
@@ -890,6 +901,8 @@ async function executeTask(request, executionId) {
         const __error = globalThis.__error;
         const __textEncode = globalThis.__textEncode;
         const __textDecode = globalThis.__textDecode;
+        const __btoa = globalThis.__btoa;
+        const __atob = globalThis.__atob;
         const __setTimeoutRef = globalThis.__setTimeoutRef;
         const __clearTimeoutRef = globalThis.__clearTimeoutRef;
         const __setIntervalRef = globalThis.__setIntervalRef;
@@ -927,6 +940,9 @@ async function executeTask(request, executionId) {
           }
         };
 
+        globalThis.btoa = function btoa(data) { return __btoa(String(data)); };
+        globalThis.atob = function atob(data) { return __atob(String(data)); };
+
         // setTimeout / setInterval delegate to Node's real timer heap via
         // ivm.Reference. The \`ms\` arg is honored (host clamps to the script
         // timeout window); \`clearTimeout\` / \`clearInterval\` actually cancel.
@@ -1039,7 +1055,7 @@ async function executeTask(request, executionId) {
       const undefined_globals = [
         'Isolate', 'Context', 'Script', 'Module', 'Callback', 'Reference',
         'ExternalCopy', '__dirname', '__filename', '__brokerRef',
-        '__log', '__error', '__textEncode', '__textDecode',
+        '__log', '__error', '__textEncode', '__textDecode', '__btoa', '__atob',
         '__setTimeoutRef', '__clearTimeoutRef', '__setIntervalRef'
       ];
       for (const name of undefined_globals) {

apps/sim/lib/execution/sandbox/bundles/isolate-polyfills.ts

@@ -10,9 +10,9 @@
  * Beyond aliasing `global -> globalThis` for UMD-style fallbacks inside the
  * bundles, this file only answers the one name the bundler can leave dangling
  * (see below). All other runtime surface (`console`, `TextEncoder`,
- * `TextDecoder`, timers) is installed by the worker via `ivm.Callback` /
- * `ivm.Reference` bridges to Node's native implementations — no hand-rolled
- * polyfill logic lives in the isolate.
+ * `TextDecoder`, `btoa`, `atob`, timers) is installed by the worker via
+ * `ivm.Callback` / `ivm.Reference` bridges to Node's native implementations —
+ * no hand-rolled polyfill logic lives in the isolate.
  */
 
 const g: typeof globalThis & {

apps/sim/lib/execution/sandbox/bundles/verify.test.ts

@@ -49,6 +49,37 @@ describe('sandbox bundles', () => {
     expect(await zip.file('word/document.xml')?.async('string')).toContain('R&D <ok>')
   })
 
+  it('docx encodes and decodes base64 through the btoa/atob the worker provides', async () => {
+    const context = createBareSandboxContext()
+    evaluateSandboxBundle(
+      readFileSync(new URL('./docx.cjs', import.meta.url), 'utf-8'),
+      'docx',
+      context
+    )
+    const pngBase64 =
+      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg=='
+
+    const packed: unknown = await vm.runInContext(
+      `(async () => {
+        const docx = globalThis.__bundles.docx;
+        const doc = new docx.Document({
+          protection: { type: 'readOnly', password: 'secret' },
+          sections: [{ children: [new docx.Paragraph({ children: [
+            new docx.ImageRun({ type: 'png', data: 'data:image/png;base64,${pngBase64}', transformation: { width: 10, height: 10 } }),
+          ] })] }],
+        });
+        return docx.Packer.toBase64String(doc);
+      })()`,
+      context
+    )
+
+    const zip = await JSZip.loadAsync(packed as string, { base64: true })
+    expect(await zip.file('word/settings.xml')?.async('string')).toMatch(
+      /<w:documentProtection[^>]*w:hash="[^"]+"/
+    )
+    expect(zip.file('word/media/image1.png')).not.toBeNull()
+  })
+
   it('pdf-lib evaluates in a bare context and exposes the pdf-generate surface', () => {
     const pdfLib = loadCheckedInBundle('pdf-lib')
     expect(typeof pdfLib.PDFDocument).toBe('function')

apps/sim/lib/execution/sandbox/bundles/verify.ts

@@ -2,10 +2,10 @@ import vm from 'node:vm'
 import type { SandboxBundleName } from '@/lib/execution/sandbox/types'
 
 /**
- * A context shaped like the isolated-vm worker's: timers, `console`, and the
- * text codecs, but no `require`, `process`, `Buffer`, `atob`, or `btoa` of its
- * own. Code that reaches for any other Node or browser global fails here the
- * same way it fails inside the isolate.
+ * A context shaped like the isolated-vm worker's task mode: timers, `console`,
+ * the text codecs, and `btoa`/`atob`, but no `require`, `process`, or `Buffer`
+ * of its own. Code that reaches for any other Node or browser global fails here
+ * the same way it fails inside the isolate.
  */
 export function createBareSandboxContext(): vm.Context {
   const context: Record<string, unknown> = {
@@ -17,6 +17,8 @@ export function createBareSandboxContext(): vm.Context {
     console,
     TextEncoder,
     TextDecoder,
+    btoa,
+    atob,
   }
   context.globalThis = context
   return vm.createContext(context)