Build checked workspace source in a sealed tenant-scoped VM

src/capability-language/checked-build.ts

@@ -128,6 +128,7 @@ export async function buildImmutableCandidate(
     log.once("open", () => resolve());
     log.once("error", reject);
   });
+  let logBytes = 0;
   const run = async (executable: string, args: string[]) =>
     await new Promise<string>((resolve, reject) => {
       let output = "",
@@ -140,9 +141,18 @@ export async function buildImmutableCandidate(
       };
       log.on("error", failedLog);
       child.stdout.on("data", (chunk) => {
-        output += chunk;
+        if (failure) return;
+        if (Buffer.byteLength(output) + chunk.length > 65536)
+          failedLog(new Error("Candidate checker output exceeds 64 KiB"));
+        else output += chunk;
       });
       child.stderr.on("data", (chunk) => {
+        if (failure) return;
+        logBytes += chunk.length;
+        if (logBytes > 16 * 1024 * 1024) {
+          failedLog(new Error("Candidate checker log exceeds 16 MiB"));
+          return;
+        }
         log.write(chunk);
         tail = (tail + String(chunk)).slice(-6000);
       });