@aalis/plugin-process-local 0.4.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.d.ts +10 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +31 -5
- package/dist/index.js.map +1 -1
- package/package.json +14 -4
- package/dist/sandbox.d.ts +0 -21
- package/dist/sandbox.d.ts.map +0 -1
- package/dist/sandbox.js +0 -83
- package/dist/sandbox.js.map +0 -1
package/README.md
CHANGED
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,16 @@
|
|
|
1
|
+
import type { ExecResult, ProcessService, SpawnHandle, SpawnOptions, TempDirHandle } from '@aalis/api-process';
|
|
2
|
+
import type { StorageService } from '@aalis/api-storage';
|
|
1
3
|
import type { Context, PluginModule } from '@aalis/core';
|
|
2
4
|
export declare const name = "@aalis/plugin-process-local";
|
|
3
5
|
export declare const provides: string[];
|
|
6
|
+
export declare class LocalProcessService implements ProcessService {
|
|
7
|
+
private readonly storage;
|
|
8
|
+
constructor(storage: StorageService);
|
|
9
|
+
spawn(cmd: string, args: readonly string[], opts?: SpawnOptions): SpawnHandle;
|
|
10
|
+
execFile(cmd: string, args: readonly string[], opts?: SpawnOptions): Promise<ExecResult>;
|
|
11
|
+
makeTempDir(prefix: string): Promise<TempDirHandle>;
|
|
12
|
+
readExternalFile(path: string): Promise<Uint8Array>;
|
|
13
|
+
}
|
|
4
14
|
export declare function apply(ctx: Context): Promise<void>;
|
|
5
15
|
declare const plugin: PluginModule;
|
|
6
16
|
export default plugin;
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE/G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,eAAO,MAAM,IAAI,gCAAgC,CAAC;AAClD,eAAO,MAAM,QAAQ,UAAc,CAAC;AAKpC,qBAAa,mBAAoB,YAAW,cAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,WAAW;IAoF3E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;IAa5F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAInD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAI1D;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvD;AAED,QAAA,MAAM,MAAM,EAAE,YAA8B,CAAC;AAC7C,eAAe,MAAM,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -3,11 +3,13 @@
|
|
|
3
3
|
// ============================================================
|
|
4
4
|
import { spawn as nodeSpawn } from 'node:child_process';
|
|
5
5
|
import { readFile as fsReadFile } from 'node:fs/promises';
|
|
6
|
-
import { makeTempDirViaStorage } from '@aalis/
|
|
7
|
-
import { createStorageGateway } from '@aalis/
|
|
6
|
+
import { makeTempDirViaStorage } from '@aalis/api-process';
|
|
7
|
+
import { createStorageGateway } from '@aalis/api-storage';
|
|
8
8
|
export const name = '@aalis/plugin-process-local';
|
|
9
9
|
export const provides = ['process'];
|
|
10
|
-
|
|
10
|
+
/** wait() 默认累计缓冲上限（stdout+stderr 合计）：10MB，足够正常输出，又防失控输出 OOM。 */
|
|
11
|
+
const DEFAULT_MAX_BUFFER = 10 * 1024 * 1024;
|
|
12
|
+
export class LocalProcessService {
|
|
11
13
|
storage;
|
|
12
14
|
constructor(storage) {
|
|
13
15
|
this.storage = storage;
|
|
@@ -21,6 +23,8 @@ class LocalProcessService {
|
|
|
21
23
|
detached: opts.detached === true,
|
|
22
24
|
});
|
|
23
25
|
if (opts.input != null && stdioMode === 'pipe') {
|
|
26
|
+
// stdin 写入的 EPIPE 等是异步 'error' 事件；无监听器会 uncaughtException 崩整个宿主进程。
|
|
27
|
+
child.stdin?.on('error', () => { });
|
|
24
28
|
try {
|
|
25
29
|
child.stdin?.end(opts.input);
|
|
26
30
|
}
|
|
@@ -54,10 +58,31 @@ class LocalProcessService {
|
|
|
54
58
|
}
|
|
55
59
|
},
|
|
56
60
|
wait: () => new Promise((resolve, reject) => {
|
|
61
|
+
// 累计缓冲上限（stdout+stderr 合计）：边读边计数，超限即停止累积（丢弃后续、标 truncated），
|
|
62
|
+
// 防失控/恶意输出无上限累积撑爆内存。不杀进程——终止交给 timeout / 调用方：后台进程
|
|
63
|
+
// （dev server / --watch 等）本就该长跑，杀掉会误伤，且超 buffer 也不应被误报成 SIGKILL/timedOut。
|
|
64
|
+
const maxBuffer = opts.maxBuffer && opts.maxBuffer > 0 ? opts.maxBuffer : DEFAULT_MAX_BUFFER;
|
|
57
65
|
const chunksOut = [];
|
|
58
66
|
const chunksErr = [];
|
|
59
|
-
|
|
60
|
-
|
|
67
|
+
let total = 0;
|
|
68
|
+
let truncated = false;
|
|
69
|
+
const collect = (arr, d) => {
|
|
70
|
+
if (truncated)
|
|
71
|
+
return;
|
|
72
|
+
const b = Buffer.from(d);
|
|
73
|
+
const room = maxBuffer - total;
|
|
74
|
+
if (b.length >= room) {
|
|
75
|
+
if (room > 0)
|
|
76
|
+
arr.push(b.subarray(0, room));
|
|
77
|
+
total = maxBuffer;
|
|
78
|
+
truncated = true;
|
|
79
|
+
return; // 停止累积即可：后续 chunk 经顶部 if(truncated) 丢弃但仍被消费(不阻塞)；不杀进程
|
|
80
|
+
}
|
|
81
|
+
arr.push(b);
|
|
82
|
+
total += b.length;
|
|
83
|
+
};
|
|
84
|
+
child.stdout?.on('data', d => collect(chunksOut, d));
|
|
85
|
+
child.stderr?.on('data', d => collect(chunksErr, d));
|
|
61
86
|
child.on('error', err => {
|
|
62
87
|
if (timer)
|
|
63
88
|
clearTimeout(timer);
|
|
@@ -71,6 +96,7 @@ class LocalProcessService {
|
|
|
71
96
|
signal,
|
|
72
97
|
stdout: Buffer.concat(chunksOut).toString('utf-8'),
|
|
73
98
|
stderr: Buffer.concat(chunksErr).toString('utf-8'),
|
|
99
|
+
...(truncated ? { truncated: true } : {}),
|
|
74
100
|
});
|
|
75
101
|
});
|
|
76
102
|
}),
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,kDAAkD;AAClD,+DAA+D;AAE/D,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,kDAAkD;AAClD,+DAA+D;AAE/D,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,CAAC,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAClD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,CAAC;AAEpC,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,KAAK,CAAC,GAAW,EAAE,IAAuB,EAAE,OAAqB,EAAE;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAuB;YACjE,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAClE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/C,mEAAmE;YACnE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,KAAiC,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAgB;YAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,GAAG,EAAE;gBACV,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,IAAI,EAAE,GAAG,EAAE,CACT,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,4DAA4D;gBAC5D,kDAAkD;gBAClD,0EAA0E;gBAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBAC7F,MAAM,SAAS,GAAa,EAAE,CAAC;gBAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;gBAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,MAAM,OAAO,GAAG,CAAC,GAAa,EAAE,CAAU,EAAQ,EAAE;oBAClD,IAAI,SAAS;wBAAE,OAAO;oBACtB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAe,CAAC,CAAC;oBACvC,MAAM,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;oBAC/B,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,IAAI,GAAG,CAAC;4BAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;wBAC5C,KAAK,GAAG,SAAS,CAAC;wBAClB,SAAS,GAAG,IAAI,CAAC;wBACjB,OAAO,CAAC,sDAAsD;oBAChE,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC;gBACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBACtB,IAAI,KAAK;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;oBACjC,IAAI,KAAK;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC/B,OAAO,CAAC;wBACN,IAAI;wBACJ,MAAM;wBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAClD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAClD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;SACL,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAuB,EAAE,OAAqB,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,YAAY,GAAG,QAAQ,GAAG,CAAC,IAAI,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAC;YACrC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7C,eAAe,MAAM,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,17 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aalis/plugin-process-local",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.1",
|
|
4
4
|
"license": "MIT",
|
|
5
|
+
"repository": {
|
|
6
|
+
"type": "git",
|
|
7
|
+
"url": "git+https://github.com/AalisLabs/Aalis.git",
|
|
8
|
+
"directory": "packages/plugin-process-local"
|
|
9
|
+
},
|
|
10
|
+
"author": "Ace Nyan <ace@acenyan.com>",
|
|
11
|
+
"bugs": {
|
|
12
|
+
"url": "https://github.com/AalisLabs/Aalis/issues"
|
|
13
|
+
},
|
|
14
|
+
"homepage": "https://github.com/AalisLabs/Aalis#readme",
|
|
5
15
|
"description": "进程网关本地实现：受控执行子进程",
|
|
6
16
|
"type": "module",
|
|
7
17
|
"keywords": [
|
|
@@ -14,13 +24,13 @@
|
|
|
14
24
|
"dist"
|
|
15
25
|
],
|
|
16
26
|
"dependencies": {
|
|
17
|
-
"@aalis/
|
|
18
|
-
"@aalis/
|
|
27
|
+
"@aalis/api-process": ">=0.5.0 <1.0.0",
|
|
28
|
+
"@aalis/api-storage": ">=0.5.5 <1.0.0"
|
|
19
29
|
},
|
|
20
30
|
"devDependencies": {
|
|
21
31
|
"@types/node": "^22.0.0",
|
|
22
32
|
"typescript": "^5.7.0",
|
|
23
|
-
"@aalis/core": "0.
|
|
33
|
+
"@aalis/core": "0.10.0"
|
|
24
34
|
},
|
|
25
35
|
"peerDependencies": {
|
|
26
36
|
"@aalis/core": ">=0.2.0 <1.0.0"
|
package/dist/sandbox.d.ts
DELETED
|
@@ -1,21 +0,0 @@
|
|
|
1
|
-
import type { SandboxPolicy } from '@aalis/plugin-process-api';
|
|
2
|
-
export type SandboxBackend = 'seatbelt' | 'bwrap' | 'none';
|
|
3
|
-
export interface SandboxWrap {
|
|
4
|
-
cmd: string;
|
|
5
|
-
args: string[];
|
|
6
|
-
}
|
|
7
|
-
/**
|
|
8
|
-
* 按平台 + 命令存在性探测可用后端（纯函数；commandExists 注入便于测试）。
|
|
9
|
-
* 注意：仅判「启动器是否存在」，bwrap 是否真能跑（unprivileged userns）由调用方再做功能性 smoke。
|
|
10
|
-
*/
|
|
11
|
-
export declare function detectSandboxBackend(platform: NodeJS.Platform, commandExists: (cmd: string) => boolean): SandboxBackend;
|
|
12
|
-
/**
|
|
13
|
-
* 生成 macOS Seatbelt (SBPL) profile：默认拒绝；放开 进程/读/常见系统调用；
|
|
14
|
-
* 写仅限 fsWrite + /dev 标准设备；网络按 policy。
|
|
15
|
-
*/
|
|
16
|
-
export declare function buildSeatbeltProfile(policy: SandboxPolicy): string;
|
|
17
|
-
/** 生成 Linux bubblewrap 参数：只读绑定根（可读+取解释器/库）、rw 绑定写白名单、按 policy 隔离网络。 */
|
|
18
|
-
export declare function buildBwrapArgs(policy: SandboxPolicy, cmd: string, args: readonly string[], cwd?: string): SandboxWrap;
|
|
19
|
-
/** 按后端把 (cmd,args) 改写为「经沙箱启动器运行」。backend==='none' 不应调用（调用方先 fail-closed）。 */
|
|
20
|
-
export declare function wrapForSandbox(backend: SandboxBackend, policy: SandboxPolicy, cmd: string, args: readonly string[], cwd?: string): SandboxWrap;
|
|
21
|
-
//# sourceMappingURL=sandbox.d.ts.map
|
package/dist/sandbox.d.ts.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GACtC,cAAc,CAIhB;AAOD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAgBlE;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,CAAC,EAAE,MAAM,GACX,WAAW,CAqBb;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,CAAC,EAAE,MAAM,GACX,WAAW,CAQb"}
|
package/dist/sandbox.js
DELETED
|
@@ -1,83 +0,0 @@
|
|
|
1
|
-
// ============================================================
|
|
2
|
-
// sandbox.ts — 子进程 OS 沙箱：后端探测 + 命令改写（纯逻辑，便于单测）
|
|
3
|
-
//
|
|
4
|
-
// 把不可信代码的子进程包到 OS 沙箱启动器里运行（仍 shell-free）：
|
|
5
|
-
// - macOS → sandbox-exec -p '<SBPL>' <cmd> <args>
|
|
6
|
-
// - Linux → bwrap <flags> -- <cmd> <args>
|
|
7
|
-
// v1 语义：读放开（解释器需系统库）、写限定 fsWrite、网络粗粒度开关。
|
|
8
|
-
// 实际可用性探测（含功能性 smoke）在 index.ts 做；本文件只做纯生成/判定。
|
|
9
|
-
// ============================================================
|
|
10
|
-
/**
|
|
11
|
-
* 按平台 + 命令存在性探测可用后端（纯函数；commandExists 注入便于测试）。
|
|
12
|
-
* 注意：仅判「启动器是否存在」，bwrap 是否真能跑（unprivileged userns）由调用方再做功能性 smoke。
|
|
13
|
-
*/
|
|
14
|
-
export function detectSandboxBackend(platform, commandExists) {
|
|
15
|
-
if (platform === 'darwin')
|
|
16
|
-
return commandExists('sandbox-exec') ? 'seatbelt' : 'none';
|
|
17
|
-
if (platform === 'linux')
|
|
18
|
-
return commandExists('bwrap') ? 'bwrap' : 'none';
|
|
19
|
-
return 'none';
|
|
20
|
-
}
|
|
21
|
-
/** SBPL 字符串字面量转义 */
|
|
22
|
-
function sbplQuote(p) {
|
|
23
|
-
return `"${p.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
|
|
24
|
-
}
|
|
25
|
-
/**
|
|
26
|
-
* 生成 macOS Seatbelt (SBPL) profile：默认拒绝；放开 进程/读/常见系统调用；
|
|
27
|
-
* 写仅限 fsWrite + /dev 标准设备；网络按 policy。
|
|
28
|
-
*/
|
|
29
|
-
export function buildSeatbeltProfile(policy) {
|
|
30
|
-
const lines = [
|
|
31
|
-
'(version 1)',
|
|
32
|
-
'(deny default)',
|
|
33
|
-
'(allow process-fork)',
|
|
34
|
-
'(allow process-exec)',
|
|
35
|
-
'(allow file-read*)',
|
|
36
|
-
'(allow sysctl-read)',
|
|
37
|
-
'(allow mach-lookup)',
|
|
38
|
-
'(allow ipc-posix-shm)',
|
|
39
|
-
'(allow signal)',
|
|
40
|
-
'(allow file-write-data (literal "/dev/null") (literal "/dev/stdout") (literal "/dev/stderr") (literal "/dev/dtracehelper") (literal "/dev/urandom"))',
|
|
41
|
-
];
|
|
42
|
-
for (const dir of policy.fsWrite)
|
|
43
|
-
lines.push(`(allow file-write* (subpath ${sbplQuote(dir)}))`);
|
|
44
|
-
lines.push(policy.network === 'allow' ? '(allow network*)' : '(deny network*)');
|
|
45
|
-
return `${lines.join('\n')}\n`;
|
|
46
|
-
}
|
|
47
|
-
/** 生成 Linux bubblewrap 参数：只读绑定根（可读+取解释器/库）、rw 绑定写白名单、按 policy 隔离网络。 */
|
|
48
|
-
export function buildBwrapArgs(policy, cmd, args, cwd) {
|
|
49
|
-
const a = [
|
|
50
|
-
'--ro-bind',
|
|
51
|
-
'/',
|
|
52
|
-
'/',
|
|
53
|
-
'--dev',
|
|
54
|
-
'/dev',
|
|
55
|
-
'--proc',
|
|
56
|
-
'/proc',
|
|
57
|
-
'--tmpfs',
|
|
58
|
-
'/tmp', // 私有可写 /tmp（解释器/库常用）；写白名单的 bind 在其后，故仍可覆盖回真实子目录
|
|
59
|
-
'--unshare-all', // 含 net 命名空间隔离（断网）
|
|
60
|
-
'--die-with-parent',
|
|
61
|
-
'--new-session',
|
|
62
|
-
];
|
|
63
|
-
if (policy.network === 'allow')
|
|
64
|
-
a.push('--share-net');
|
|
65
|
-
// rw 绑定写白名单（顺序在 --tmpfs /tmp 之后，确保 /tmp 下的真实临时目录被重新暴露为可写）
|
|
66
|
-
for (const dir of policy.fsWrite)
|
|
67
|
-
a.push('--bind', dir, dir);
|
|
68
|
-
if (cwd)
|
|
69
|
-
a.push('--chdir', cwd);
|
|
70
|
-
a.push('--', cmd, ...args);
|
|
71
|
-
return { cmd: 'bwrap', args: a };
|
|
72
|
-
}
|
|
73
|
-
/** 按后端把 (cmd,args) 改写为「经沙箱启动器运行」。backend==='none' 不应调用（调用方先 fail-closed）。 */
|
|
74
|
-
export function wrapForSandbox(backend, policy, cmd, args, cwd) {
|
|
75
|
-
if (backend === 'seatbelt') {
|
|
76
|
-
return { cmd: 'sandbox-exec', args: ['-p', buildSeatbeltProfile(policy), cmd, ...args] };
|
|
77
|
-
}
|
|
78
|
-
if (backend === 'bwrap') {
|
|
79
|
-
return buildBwrapArgs(policy, cmd, args, cwd);
|
|
80
|
-
}
|
|
81
|
-
throw new Error(`不支持的沙箱后端: ${backend}`);
|
|
82
|
-
}
|
|
83
|
-
//# sourceMappingURL=sandbox.js.map
|
package/dist/sandbox.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+CAA+C;AAC/C,EAAE;AACF,0CAA0C;AAC1C,oDAAoD;AACpD,4CAA4C;AAC5C,0CAA0C;AAC1C,+CAA+C;AAC/C,+DAA+D;AAW/D;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,aAAuC;IAEvC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oBAAoB;AACpB,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,MAAM,KAAK,GAAa;QACtB,aAAa;QACb,gBAAgB;QAChB,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,uBAAuB;QACvB,gBAAgB;QAChB,sJAAsJ;KACvJ,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAChF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAAW,EACX,IAAuB,EACvB,GAAY;IAEZ,MAAM,CAAC,GAAa;QAClB,WAAW;QACX,GAAG;QACH,GAAG;QACH,OAAO;QACP,MAAM;QACN,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM,EAAE,gDAAgD;QACxD,eAAe,EAAE,mBAAmB;QACpC,mBAAmB;QACnB,eAAe;KAChB,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,0DAA0D;IAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG;QAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,MAAqB,EACrB,GAAW,EACX,IAAuB,EACvB,GAAY;IAEZ,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC"}
|