@@ -0,0 +1,63 @@
+---
+"@objectstack/runtime": patch
+---
+
+fix(runtime): a NON-sandboxed crash at `/api/v1/actions` no longer ships its native error message verbatim (#18540)
+
+Clause-②: no
+
+A plain `TypeError` thrown by an in-process registered action handler answered
+`500 INTERNAL_ERROR` carrying the native sentence on the wire:
+
+```
+{"success":false,"error":{"code":"INTERNAL_ERROR",
+ "message":"Cannot read properties of undefined (reading 'id')","httpStatus":500}}
+```
+
+The identical crash through the `/data` door answered `"Internal server error"`
+(#7543 / #15071). One repository, two doors, one already meeting the contract.
+
+**The status was already right; what leaked was the sentence.** No status code,
+no `error.code` and no envelope key moves — reaching this branch already proves
+the throw declared no `status`/`statusCode` (the branch above serves those) and
+is not a `ValidationError`, so the resolver's status was the 500 fallback and its
+code was the status-derived `INTERNAL_ERROR`. Only `error.message` changes.
+
+**Why neither existing guard caught it.** #17273's crash terminal is keyed on the
+SANDBOX — `isNativeErrorName` read over the `innerMessage` the QuickJS runner
+fills — and this face never crosses a VM boundary, so nothing sets `innerMessage`
+and that terminal never fires. *A predicate that classifies by HOW a crash
+arrived is structurally blind to crashes that did not arrive that way, while
+looking exhaustive.* The other guard, the dispatcher's 5xx withhold, is gated on
+`looksLikeInternalErrorLeak`, which recognises DRIVER DUMPS and reads FALSE for
+stack-shaped prose.
+
+**The structural difference, which is the fix.** The `/data` door is default-DENY:
+`classifyDataError` ends in an unconditional `UNCLASSIFIED_FAULT()`, and its
+`looksLikeInternalErrorLeak` limb only picks `DATABASE_ERROR` over
+`INTERNAL_ERROR` — that limb is not what sanitises. The actions door's
+`unexpectedFault` exit relayed `err.message` and was therefore default-ALLOW:
+prose shipped unless a heuristic recognised it. That exit is this door's
+unclassified-fault terminal, so it now answers the terminal's envelope —
+`INTERNAL_ERROR_MESSAGE`, through the same `deps.error` seam #17273's terminal
+uses.
+
+⛔ `looksLikeInternalErrorLeak` is NOT re-pointed at stack-shaped prose. It guards
+a different question at every other boundary, and widening it would change what
+each of them withholds.
+
+**Measured population.** Driven through the real `HttpDispatcher.handleActions`
+door against `mapDataError` on the same throws: seven shapes leaked at `/actions`
+and were already sanitised at `/data` — `TypeError`, `ReferenceError`,
+`RangeError`, `SyntaxError`, a driver class whose prose the heuristic does not
+recognise (this one shipped a server **filesystem path**), a sandbox timeout and
+a sandbox capability denial. All seven now answer the same sentence at both
+doors. Two controls are unchanged in both directions: a deliberate rejection
+keeps its `400` and its own words, and a crash that DECLARED its own status keeps
+that status and that sentence.
+
+**Who is affected.** Any caller reading `error.message` off a `500` from
+`/api/v1/actions` to tell one crash from another. That text was never a contract
+— it is the thrown error's own prose — and the full text still reaches the
+operator: the `console.error` on the line above keeps it, the same
+"the client does not read it, the log keeps it" split `rest` already draws.
@@ -145,6 +145,11 @@ describe('an unexpected FAULT is a 500', () => {
         // No `{success:true, data:{...}}` wrapper — this is the dispatcher's
         // error exit, so monitoring sees a 5xx.
         expect(response.body.data).toBeUndefined();
+        // [#18540] …and the SENTENCE is withheld. This pin asserted the three
+        // lines above and nothing about `message`, so the live leak sat green
+        // underneath it — "still 500" is exactly what the defect looked like.
+        // The disclosure half is pinned in full in its own section below.
+        expect(response.body.error.message).toBe('Internal server error');
     });
 
     it('a ReferenceError from a buggy handler', async () => {
@@ -314,3 +319,101 @@ describe('[#17273] a sandboxed body that CRASHED is a fault, not a rejection', (
         expect(response.body.error.message).toBe('Import failed with a TypeError in row 4');
     });
 });
+
+/**
+ * [#18540] A NON-sandboxed crash's native sentence is withheld — the face of
+ * this question that needs no sandbox at all.
+ *
+ * #17273 put a crash terminal above every branch of this door that reads a
+ * producer declaration as intent, but its predicate is keyed on the SANDBOX:
+ * `isNativeErrorName` over the `innerMessage` the QuickJS runner fills. A plain
+ * `TypeError` from an in-process registered handler never crosses a VM
+ * boundary, so nothing sets `innerMessage`, that terminal never fires, and the
+ * throw fell to `unexpectedFault` → `errorFromThrown`, which relays
+ * `err.message`. Measured on the wire before this change:
+ *
+ *     {"success":false,"error":{"code":"INTERNAL_ERROR",
+ *      "message":"Cannot read properties of undefined (reading 'id')","httpStatus":500}}
+ *
+ * The same crash through the `/data` door answered `"Internal server error"`
+ * (#7543 / #15071). ⇒ the status was already right; what leaked was the
+ * sentence.
+ *
+ * **The shape worth carrying: a predicate that classifies by HOW a crash
+ * arrived is structurally blind to crashes that did not arrive that way —
+ * while looking exhaustive.** Same family as a ratchet with no row for the
+ * case, and as a slot whose third consumer nobody reached.
+ *
+ * The other guard misses it for a second, independent reason, and that is why
+ * the fix is not a new phrasing: the dispatcher's 5xx withhold is gated on
+ * `looksLikeInternalErrorLeak`, which recognises DRIVER DUMPS and reads FALSE
+ * for stack-shaped prose. So the relay is DEFAULT-ALLOW, while `/data` is
+ * default-DENY — `classifyDataError` ends in an unconditional
+ * `UNCLASSIFIED_FAULT()`, and its `looksLikeInternalErrorLeak` limb only picks
+ * `DATABASE_ERROR` over `INTERNAL_ERROR`. The fix answers this door's terminal
+ * with the terminal's envelope; ⛔ it does not re-point the heuristic, which
+ * guards a different question at every other boundary.
+ *
+ * The cases below are BOTH halves, because a disclosure pin that only asserts
+ * the withheld case cannot tell a fix from a blanket sweep that ate the
+ * refusal channel: two crashes whose text the heuristic does NOT recognise,
+ * then the two controls one property away on either side. The `/data` parity
+ * is deliberately asserted in prose rather than by importing
+ * `@objectstack/rest` here — a cross-package import would move this file, and
+ * the pins above it, into the `repo` vitest project.
+ */
+describe('[#18540] a NON-sandboxed crash is answered with the sanitised sentence', () => {
+    it("the card's exact repro — a bare TypeError, no sandbox anywhere in the path", async () => {
+        const response = await invoke(new TypeError("Cannot read properties of undefined (reading 'id')"));
+
+        // Unmoved: the status and the code were already right, and this card is
+        // fenced from touching them.
+        expect(response.status).toBe(500);
+        expect(response.body.error.code).toBe('INTERNAL_ERROR');
+        // The whole of the change: the sentence, matching what `/data` answers.
+        expect(response.body.error.message).toBe('Internal server error');
+        expect(String(response.body.error.message)).not.toContain('Cannot read properties');
+        expect(response.body.success).toBe(false);
+    });
+
+    it('a fault whose prose the leak heuristic does NOT recognise — a driver class naming a FILE PATH', async () => {
+        // `looksLikeInternalErrorLeak` reads FALSE here: no SQL keyword, no
+        // dialect template, nothing quoted. Before this change the tenant
+        // received a server filesystem path. This case is why the fix cannot be
+        // "teach the heuristic about TypeError" — the leaking population is not
+        // a phrasing family, it is everything the terminal was relaying.
+        const err: any = new Error('database disk image is malformed at /srv/data/tenant_42.db');
+        err.name = 'SqliteError';
+        const response = await invoke(err);
+
+        expect(response.status).toBe(500);
+        expect(response.body.error.message).toBe('Internal server error');
+        expect(String(response.body.error.message)).not.toContain('/srv/data');
+    });
+
+    it('negative control: a deliberate rejection keeps its 400 AND its own sentence', async () => {
+        // One `name` away from the first case. An implementation that withheld
+        // every message at this catch — or that moved the fault terminal above
+        // the rejection exit — would turn the cases above green while deleting
+        // the channel a business rule speaks through.
+        const response = await invoke(new Error('Lead is already converted'));
+
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe('Lead is already converted');
+    });
+
+    it('negative control: a crash that DECLARED its own status keeps that status and that sentence', async () => {
+        // The branch serving `.status` sits above `unexpectedFault`, so this
+        // throw never reaches the terminal. It is the control for the fence on
+        // this card: ⛔ no declared status moves, and a producer that composed
+        // an answer still speaks.
+        const err: any = new TypeError('Not allowed');
+        err.status = 403;
+        err.code = 'FORBIDDEN';
+        const response = await invoke(err);
+
+        expect(response.status).toBe(403);
+        expect(response.body.error.code).toBe('FORBIDDEN');
+        expect(response.body.error.message).toBe('Not allowed');
+    });
+});
@@ -969,7 +969,58 @@ export async function handleActionsRequest(deps: DomainHandlerDeps, path: string
             && !validationFailureDetails(err);
         if (unexpectedFault) {
             console.error(`[action ${objectName}/${actionName}] unexpected fault (${name}): ${full}`);
-            return { handled: true, response: deps.errorFromThrown(err, 500) };
+            // [#18540] This branch is this door's UNCLASSIFIED-FAULT TERMINAL, so
+            // it answers the terminal's envelope — `INTERNAL_ERROR_MESSAGE`, the
+            // same sentence `/data` answers — instead of relaying `err.message`.
+            //
+            // The status was already right; what leaked was the SENTENCE. A
+            // non-sandboxed crash — a plain `TypeError` from an in-process
+            // registered handler — reached the wire as `500 INTERNAL_ERROR`
+            // carrying `Cannot read properties of undefined (reading 'id')`
+            // verbatim, while the IDENTICAL throw through the `/data` door
+            // answered `Internal server error`.
+            //
+            // Why neither existing guard caught it, both measured on this tree:
+            //
+            //   - #17273's crash terminal above is keyed on the SANDBOX
+            //     (`isNativeErrorName` over the `innerMessage` the QuickJS runner
+            //     fills). This face never crosses a VM boundary, so nothing sets
+            //     `innerMessage` and that terminal never fires. A predicate that
+            //     classifies by HOW a crash arrived is structurally blind to
+            //     crashes that did not arrive that way — while looking exhaustive.
+            //   - `errorFromThrown` relays `err.message` through the dispatcher's
+            //     5xx withhold, which is gated on `looksLikeInternalErrorLeak` —
+            //     a DRIVER-DUMP heuristic that reads FALSE for stack-shaped prose
+            //     (#17273's changeset records the same reading). So that relay is
+            //     DEFAULT-ALLOW: prose ships unless the heuristic recognises it.
+            //
+            // `/data` is default-DENY by construction: `classifyDataError` ends
+            // in an unconditional `UNCLASSIFIED_FAULT()`, and its
+            // `looksLikeInternalErrorLeak` limb only chooses `DATABASE_ERROR`
+            // over `INTERNAL_ERROR` — that limb is not what sanitises. Aligning
+            // therefore means answering the terminal here too, ⛔ never teaching
+            // the heuristic a new phrasing: re-pointing `looksLikeInternalErrorLeak`
+            // at stack-shaped prose would change what every OTHER boundary
+            // withholds, and it guards a different question.
+            //
+            // Nothing about the ANSWER moves but the sentence. Reaching here
+            // already proves `.status`/`.statusCode` are absent (the branch above
+            // serves them) and that this is not a `ValidationError`, so
+            // `resolveThrownHttpError` had no declared status either: its `status`
+            // was the 500 fallback and its `code` was
+            // `standardErrorCodeForHttpStatus(500)` — `INTERNAL_ERROR`, the code
+            // this exit emits. Same status, same code, same envelope shape.
+            //
+            // ⛔ Deliberately the SAME `deps.error` seam #17273's terminal uses,
+            // never a widened one: a fault's `userMessage` and its non-string
+            // `details.code` (a driver errno — the backend-naming disclosure
+            // `demotedDeclaredCode` already withholds on an undeclared 5xx) do not
+            // ride this exit, exactly as they do not ride `/data`'s.
+            //
+            // The words are not lost: the `console.error` above keeps the full
+            // text — the same "the client does not read it, the log keeps it"
+            // split #5437 draws in `rest`.
+            return { handled: true, response: deps.error(INTERNAL_ERROR_MESSAGE, 500) };
         }
 
         // [#3962] A deliberate REJECTION is a 400. The 200-with-inner-envelope
 
@@ -67,12 +67,16 @@ describe('[#4431] an in-VM capability denial reaches the classifier as a FAULT',
     // invisible to gateway error rates, APM and alerting.
     expect(err.innerMessage).toBeUndefined();
 
-    // The debug prefix must not reach the client. The runner's own doc says
-    // only the business message should — and a sandbox fault has none, so what
-    // the client sees is this text, minus the prefix.
+    // The debug prefix must not reach the OPERATOR'S LOG line either. Every
+    // assertion in this block is about the THROWN error — what the runner hands
+    // the classifier and what `domains/actions.ts` prints — never about the wire.
+    // [#18540] Since the door's unexpected-fault terminal answers
+    // `INTERNAL_ERROR_MESSAGE`, what the CLIENT sees for this denial is
+    // `Internal server error`, the same sentence `/data` answers; this text is
+    // the diagnostic half of that split, and it has to stay readable.
     expect(err.message).not.toContain('SandboxError:');
-    // …while the actionable content survives: which capability, whose, and the
-    // call that tripped the gate.
+    // …while the actionable content survives for the log: which capability,
+    // whose, and the call that tripped the gate.
     expect(err.message).toContain("capability 'api.read' not granted");
     expect(err.message).toContain("action 'rc1_crash_probe'");
     expect(err.message).toContain("ctx.api.object('showcase_task').count");