@alisio/core 0.1.0-alpha.21 → 0.1.0-alpha.22

package/dist/runtime/zip.js

@@ -0,0 +1,126 @@
+/**
+ * Streaming ZIP writer on `node:zlib` (no dependency): DEFLATE entries with a data descriptor,
+ * UTF-8 names (general-purpose bit 11) and no ZIP64, so archives and entries must stay below
+ * 4 GiB. Used for multi-file artifact downloads and for folders published as one archive.
+ */
+import { createReadStream } from "node:fs";
+import { createDeflateRaw } from "node:zlib";
+let table;
+/** CRC-32 (IEEE) of `bytes`, continuing from `crc`. */
+export function crc32(bytes, crc = 0) {
+    if (!table) {
+        table = new Uint32Array(256);
+        for (let n = 0; n < 256; n++) {
+            let c = n;
+            for (let k = 0; k < 8; k++)
+                c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+            table[n] = c >>> 0;
+        }
+    }
+    let value = ~crc >>> 0;
+    for (let i = 0; i < bytes.length; i++)
+        value = table[(value ^ bytes[i]) & 0xff] ^ (value >>> 8);
+    return ~value >>> 0;
+}
+/** MS-DOS date and time of `date` (local time, 2-second resolution, 1980 minimum). */
+function dosTime(date) {
+    const year = Math.max(1980, date.getFullYear());
+    return {
+        time: (date.getHours() << 11) | (date.getMinutes() << 5) | Math.floor(date.getSeconds() / 2),
+        date: ((year - 1980) << 9) | ((date.getMonth() + 1) << 5) | date.getDate(),
+    };
+}
+const LIMIT = 0xffff_ffff;
+/**
+ * Writes `entries` as a ZIP archive to `out`, streaming file contents. Entry names use `/` and
+ * must be relative; the caller validates them. Throws when the archive would need ZIP64.
+ */
+export async function writeZip(entries, out, options = {}) {
+    if (entries.length > 0xffff)
+        throw new Error("ZIP archives hold at most 65535 entries");
+    let offset = 0;
+    const put = async (chunk) => {
+        options.signal?.throwIfAborted();
+        offset += chunk.byteLength;
+        if (offset > LIMIT)
+            throw new Error("ZIP archives larger than 4 GiB are not supported");
+        if (!out.write(chunk))
+            await new Promise((resolve) => out.once("drain", resolve));
+    };
+    const { time, date } = dosTime(options.now ?? new Date());
+    const central = [];
+    for (const entry of entries) {
+        const name = Buffer.from(entry.name.replace(/\\/g, "/"), "utf8");
+        const start = offset;
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034b50, 0);
+        local.writeUInt16LE(20, 4); // version needed
+        local.writeUInt16LE(0x0808, 6); // data descriptor + UTF-8 names
+        local.writeUInt16LE(8, 8); // deflate
+        local.writeUInt16LE(time, 10);
+        local.writeUInt16LE(date, 12);
+        local.writeUInt16LE(name.length, 26);
+        await put(local);
+        await put(name);
+        let crc = 0, size = 0, compressed = 0;
+        const deflate = createDeflateRaw();
+        const feed = "data" in entry
+            ? (async () => {
+                crc = crc32(entry.data);
+                size = entry.data.byteLength;
+                deflate.end(Buffer.from(entry.data));
+            })()
+            : new Promise((resolve, reject) => {
+                const input = createReadStream(entry.source);
+                input.on("data", (chunk) => {
+                    const bytes = chunk;
+                    crc = crc32(bytes, crc);
+                    size += bytes.byteLength;
+                });
+                input.once("error", (error) => {
+                    deflate.destroy(error);
+                    reject(error);
+                });
+                input.once("end", resolve);
+                input.pipe(deflate);
+            });
+        for await (const chunk of deflate) {
+            compressed += chunk.byteLength;
+            await put(chunk);
+        }
+        await feed;
+        if (size > LIMIT || compressed > LIMIT)
+            throw new Error("ZIP entries larger than 4 GiB are not supported");
+        const descriptor = Buffer.alloc(16);
+        descriptor.writeUInt32LE(0x08074b50, 0);
+        descriptor.writeUInt32LE(crc, 4);
+        descriptor.writeUInt32LE(compressed, 8);
+        descriptor.writeUInt32LE(size, 12);
+        await put(descriptor);
+        const header = Buffer.alloc(46);
+        header.writeUInt32LE(0x02014b50, 0);
+        header.writeUInt16LE(20, 4); // version made by
+        header.writeUInt16LE(20, 6); // version needed
+        header.writeUInt16LE(0x0808, 8);
+        header.writeUInt16LE(8, 10);
+        header.writeUInt16LE(time, 12);
+        header.writeUInt16LE(date, 14);
+        header.writeUInt32LE(crc, 16);
+        header.writeUInt32LE(compressed, 20);
+        header.writeUInt32LE(size, 24);
+        header.writeUInt16LE(name.length, 28);
+        header.writeUInt32LE(start, 42);
+        central.push(header, name);
+    }
+    const directoryStart = offset;
+    for (const part of central)
+        await put(part);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(entries.length, 8);
+    end.writeUInt16LE(entries.length, 10);
+    end.writeUInt32LE(offset - directoryStart, 12);
+    end.writeUInt32LE(directoryStart, 16);
+    await put(end);
+    return { bytes: offset };
+}

package/dist/sessions/children.js

@@ -148,6 +148,10 @@ export class ChildSessions {
                     write: caps.write,
                     process: caps.process,
                     external: root.external && !caps.readOnly,
+                    // --allow-analysis carries to children whose process permission is not narrowed.
+                    ...(root.analysis && !caps.readOnly && (spec.permission?.process ?? "allow") === "allow"
+                        ? { analysis: true }
+                        : {}),
                 },
                 approvals: caps.approvals,
                 label: this.label(id),

package/dist/tools/analysis.d.ts

@@ -0,0 +1,37 @@
+import type { DatasetService } from "../analysis/data/datasets.ts";
+import type { AnalysisJobs } from "../analysis/jobs.ts";
+import type { OciRuntime } from "../analysis/oci.ts";
+import type { AnalysisRerun } from "../analysis/rerun.ts";
+import { type AnalysisRuntimeManager } from "../analysis/runtime-manager.ts";
+import { type ArtifactStore } from "../artifacts/store.ts";
+import type { ToolRegistry } from "../core/registry.ts";
+export declare const NOT_SANDBOXED = "Managed Python is not a sandbox: the script runs with your user permissions and can read your files and use the network.";
+export interface AnalysisLimits {
+    timeoutMs: number;
+    maxLogBytes: number;
+}
+export interface AnalysisToolDeps {
+    store: ArtifactStore;
+    jobs: AnalysisJobs;
+    /** Discovery (`interpreter`) and, for the optional extras, `hasExtras` / `installExtras`. */
+    runtime: Pick<AnalysisRuntimeManager, "interpreter"> & Partial<Pick<AnalysisRuntimeManager, "hasExtras" | "installExtras">>;
+    /** Container mode (`analysis.runtime: "oci"`), read when each call starts. */
+    oci?: {
+        mode(): "managed" | "oci";
+        runtime(): OciRuntime;
+    };
+    /** Rerun of an earlier execution (`rerunOf`). */
+    rerun?: AnalysisRerun;
+    /** Datasets of the session: `inputs: [{ datasetId }]` copies the dataset's SQLite file. */
+    datasets?: DatasetService;
+    rootOf: (sessionId: string) => string;
+    limits: AnalysisLimits;
+    /** Startup facts for the description (stat only; no process was launched). */
+    startup: {
+        candidates: boolean;
+        extras: string[];
+    };
+}
+/** `48 KB`, `1.2 MB`. */
+export declare function formatBytes(bytes: number): string;
+export declare function registerAnalysisTools(registry: ToolRegistry, deps: AnalysisToolDeps): void;