@bubblebrain-ai/bubble 0.0.34 → 0.0.36

package/dist/external-runtime/grok-preflight.js

@@ -0,0 +1,194 @@
+import { realpath } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+import { isSafeGrokSkillName } from "./grok-profile.js";
+import { runGrokCommand } from "./grok-process.js";
+import { GrokRuntimeError } from "./grok-errors.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireEmptyArray(root, key) {
+    const value = root[key];
+    if (!Array.isArray(value) || value.length !== 0) {
+        throw new GrokRuntimeError("preflight_failed", `Grok isolation check failed: ${key} must be empty.`);
+    }
+}
+function sourcePath(value) {
+    if (typeof value === "string") {
+        // Grok 0.2.93 renders permission origins as
+        // "/absolute/file.toml (config)" in inspect JSON.
+        return value.replace(/\s+\((?:config|requirements)\)$/, "");
+    }
+    if (!isRecord(value))
+        return undefined;
+    for (const key of ["path", "file", "sourcePath"]) {
+        if (typeof value[key] === "string")
+            return value[key];
+    }
+    const source = value.source;
+    if (typeof source === "string" && source.startsWith("/"))
+        return source;
+    if (isRecord(source))
+        return sourcePath(source);
+    return undefined;
+}
+async function canonicalOrResolved(path) {
+    try {
+        return await realpath(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+/** Render a workspace-controlled path safely inside an error message. */
+function describeForeignPath(path) {
+    if (!path)
+        return "an unidentified configuration source";
+    const printable = path.replace(/[\p{Cc}\p{Cf}]/gu, "?");
+    return printable.length > 160 ? `${printable.slice(0, 157)}...` : printable;
+}
+/**
+ * The directory subtree Grok legitimately scans for project extensions: the
+ * validated project root when the workspace sits inside one, otherwise the
+ * workspace itself.
+ */
+async function workspaceExtensionScope(payload, workspace) {
+    const expectedCwd = await canonicalOrResolved(workspace);
+    if (typeof payload.projectRoot === "string") {
+        const projectRoot = await canonicalOrResolved(payload.projectRoot);
+        if (expectedCwd === projectRoot || expectedCwd.startsWith(`${projectRoot}${sep}`))
+            return projectRoot;
+    }
+    return expectedCwd;
+}
+/**
+ * Collect the names of every skill Grok discovered for this workspace so they
+ * can be written into the profile's `[skills] disabled` list. Fails closed on
+ * any skill that is not a plain project-level discovery inside the workspace
+ * scope, or whose name cannot be disabled safely.
+ */
+export async function collectGrokProjectSkills(payload, workspace) {
+    if (!isRecord(payload) || !Array.isArray(payload.skills)) {
+        throw new GrokRuntimeError("preflight_failed", "Grok isolation check returned invalid skill data.");
+    }
+    const scope = await workspaceExtensionScope(payload, workspace);
+    const names = new Set();
+    for (const entry of payload.skills) {
+        if (!isRecord(entry) || typeof entry.name !== "string" || !isSafeGrokSkillName(entry.name)) {
+            throw new GrokRuntimeError("preflight_failed", "Grok discovered a skill Bubble cannot disable safely.");
+        }
+        const source = entry.source;
+        if (!isRecord(source) || source.type !== "project" || typeof source.path !== "string") {
+            throw new GrokRuntimeError("preflight_failed", `Grok discovered the skill "${entry.name}" outside the workspace project scope.`);
+        }
+        const path = await canonicalOrResolved(source.path);
+        if (path !== scope && !path.startsWith(`${scope}${sep}`)) {
+            throw new GrokRuntimeError("preflight_failed", `Grok discovered the skill "${entry.name}" outside the workspace project scope.`);
+        }
+        names.add(entry.name);
+    }
+    return [...names].sort();
+}
+export async function validateGrokInspect(payload, profile, workspace = profile.workspace, policy) {
+    if (!isRecord(payload))
+        throw new GrokRuntimeError("preflight_failed", "Grok isolation check returned invalid data.");
+    const expectedCwd = await canonicalOrResolved(workspace);
+    if (typeof payload.cwd !== "string" || (await canonicalOrResolved(payload.cwd)) !== expectedCwd) {
+        throw new GrokRuntimeError("preflight_failed", "Grok isolation check used an unexpected workspace.");
+    }
+    if (payload.projectRoot !== null) {
+        if (typeof payload.projectRoot !== "string") {
+            throw new GrokRuntimeError("preflight_failed", "Grok isolation check returned an invalid project root.");
+        }
+        const projectRoot = await canonicalOrResolved(payload.projectRoot);
+        if (expectedCwd !== projectRoot && !expectedCwd.startsWith(`${projectRoot}${sep}`)) {
+            throw new GrokRuntimeError("preflight_failed", "Grok isolation check discovered an unrelated project root.");
+        }
+    }
+    for (const key of ["projectInstructions", "hooks", "plugins", "marketplaces", "lspServers"]) {
+        requireEmptyArray(payload, key);
+    }
+    if (policy) {
+        for (const name of await collectGrokProjectSkills(payload, workspace)) {
+            if (!policy.allowedProjectSkills.has(name)) {
+                throw new GrokRuntimeError("preflight_failed", `Grok discovered the workspace skill "${name}" that Bubble has not disabled.`);
+            }
+        }
+    }
+    else {
+        requireEmptyArray(payload, "skills");
+    }
+    if (policy?.allowCompatMcpServers) {
+        const mcpServers = payload.mcpServers;
+        if (!Array.isArray(mcpServers)) {
+            throw new GrokRuntimeError("preflight_failed", "Grok isolation check returned invalid MCP data.");
+        }
+        for (const entry of mcpServers) {
+            // Compat-scanner discoveries stay listed even though the disabled
+            // compatibility cells (verified below) and Bubble's empty session MCP
+            // list keep them from loading. Anything else fails closed.
+            if (!isRecord(entry) || (entry.vendor !== "cursor" && entry.vendor !== "claude")) {
+                throw new GrokRuntimeError("preflight_failed", "Grok discovered an MCP server it could load.");
+            }
+        }
+    }
+    else {
+        requireEmptyArray(payload, "mcpServers");
+    }
+    const externalCompat = payload.externalCompat;
+    if (!isRecord(externalCompat) || !Array.isArray(externalCompat.cells) || externalCompat.cells.length === 0) {
+        throw new GrokRuntimeError("preflight_failed", "Grok compatibility scanners could not be verified as disabled.");
+    }
+    for (const cell of externalCompat.cells) {
+        if (!isRecord(cell) || cell.enabled !== false) {
+            throw new GrokRuntimeError("preflight_failed", "Grok compatibility scanners are not fully disabled.");
+        }
+    }
+    const allowedSources = new Set([
+        await canonicalOrResolved(profile.configPath),
+        await canonicalOrResolved(profile.requirementsPath),
+    ]);
+    const permissions = payload.permissions;
+    if (!isRecord(permissions) || !Array.isArray(permissions.sources)) {
+        throw new GrokRuntimeError("preflight_failed", "Grok permission sources could not be verified.");
+    }
+    for (const source of permissions.sources) {
+        const path = sourcePath(source);
+        if (!path || !allowedSources.has(await canonicalOrResolved(path))) {
+            throw new GrokRuntimeError("preflight_failed", "Grok discovered a permission source outside Bubble's isolated profile.");
+        }
+    }
+    if (Array.isArray(permissions.skipped) && permissions.skipped.length > 0) {
+        throw new GrokRuntimeError("preflight_failed", "Grok discovered an unverified permission source.");
+    }
+    if (permissions.managedSettingsActive === true) {
+        throw new GrokRuntimeError("preflight_failed", "Grok discovered active managed settings outside Bubble's isolated profile.");
+    }
+    const configSources = payload.configSources;
+    if (isRecord(configSources) && Array.isArray(configSources.layers)) {
+        for (const layer of configSources.layers) {
+            const path = sourcePath(layer);
+            if (!path || !allowedSources.has(await canonicalOrResolved(path))) {
+                // A project-scope config layer overrides the isolated profile's
+                // settings (verified on the pinned CLI: it can re-enable disabled
+                // skills past requirements.toml), so it can never be allowed.
+                throw new GrokRuntimeError("preflight_failed", `Grok would load ${describeForeignPath(path)} as project configuration. Start Bubble in a workspace without its own Grok config file.`);
+            }
+        }
+    }
+}
+export async function runGrokInspectJson(spawn, binary, profile, env, workspace = profile.workspace, signal) {
+    const result = await runGrokCommand(spawn, binary, ["--no-auto-update", "--cwd", workspace, "inspect", "--json"], { cwd: workspace, env, signal });
+    if (result.code !== 0) {
+        throw new GrokRuntimeError("preflight_failed", "Grok isolation check failed to run.", result.stderr);
+    }
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        throw new GrokRuntimeError("preflight_failed", "Grok isolation check returned invalid JSON.");
+    }
+}
+export async function runGrokPreflight(spawn, binary, profile, env, workspace = profile.workspace, signal, policy) {
+    const payload = await runGrokInspectJson(spawn, binary, profile, env, workspace, signal);
+    await validateGrokInspect(payload, profile, workspace, policy);
+}

package/dist/external-runtime/grok-process.d.ts

@@ -0,0 +1,26 @@
+import { type ChildProcess, type SpawnOptions } from "node:child_process";
+export type GrokSpawn = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+export interface GrokCommandResult {
+    stdout: string;
+    stderr: string;
+    code: number;
+}
+export interface RunGrokCommandOptions {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    maxStdoutBytes?: number;
+    maxStderrBytes?: number;
+    /** Login-only hook. Called once, and only with Bubble's strictly allowlisted xAI OAuth URL. */
+    onOAuthAuthorizeUrl?: (url: string) => void;
+    /** Keep login stdout inside the process boundary; callers only receive the trusted URL hook above. */
+    discardStdout?: boolean;
+}
+export declare const defaultGrokSpawn: GrokSpawn;
+export declare function sanitizeGrokDiagnostic(input: string, maxLength?: number): string;
+/**
+ * Extract only the pinned xAI authorization endpoint. OAuth query values are
+ * intentionally treated as opaque and are never copied into diagnostics.
+ */
+export declare function extractGrokOAuthAuthorizeUrl(input: string): string | undefined;
+export declare function runGrokCommand(spawn: GrokSpawn, binary: string, args: readonly string[], options: RunGrokCommandOptions): Promise<GrokCommandResult>;

package/dist/external-runtime/grok-process.js

@@ -0,0 +1,184 @@
+import { spawn as nodeSpawn } from "node:child_process";
+import { GrokRuntimeError } from "./grok-errors.js";
+export const defaultGrokSpawn = (command, args, options) => nodeSpawn(command, [...args], { ...options, shell: false });
+function appendBounded(chunks, chunk, used, limit) {
+    if (used >= limit)
+        return used;
+    const remaining = limit - used;
+    chunks.push(chunk.subarray(0, remaining));
+    return used + Math.min(chunk.byteLength, remaining);
+}
+export function sanitizeGrokDiagnostic(input, maxLength = 2048) {
+    let value = input
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
+        .replace(/https:\/\/auth\.x\.ai\/oauth2\/authorize[^\s"'<>`]*/gi, "https://auth.x.ai/oauth2/authorize?[redacted]")
+        .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1 [redacted]")
+        .replace(/\bxai-[A-Za-z0-9_-]+/gi, "xai-[redacted]")
+        .replace(/([?&](?:access_token|refresh_token|token|api_key|key|secret|password)=)[^\s&#]+/gi, "$1[redacted]")
+        .replace(/(["']?(?:access_token|refresh_token|id_token|token|api_key|secret|password)["']?\s*[:=]\s*["']?)[^"',\s}]+/gi, "$1[redacted]")
+        .replace(/\b([A-Z0-9_]*(?:TOKEN|KEY|SECRET|PASSWORD|AUTH)[A-Z0-9_]*)\s*=\s*[^\s]+/gi, "$1=[redacted]")
+        .replace(/\beyJ[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]{8,})?/g, "[redacted-jwt]")
+        .replace(/(https?:\/\/)[^\s/@:]+:[^\s/@]+@/gi, "$1[redacted]@");
+    if (value.length > maxLength)
+        value = `${value.slice(0, maxLength)}…`;
+    return value.trim();
+}
+const GROK_OAUTH_AUTHORIZE_PREFIX = "https://auth.x.ai/oauth2/authorize";
+/**
+ * Extract only the pinned xAI authorization endpoint. OAuth query values are
+ * intentionally treated as opaque and are never copied into diagnostics.
+ */
+export function extractGrokOAuthAuthorizeUrl(input) {
+    let offset = 0;
+    while (offset < input.length) {
+        const start = input.indexOf(GROK_OAUTH_AUTHORIZE_PREFIX, offset);
+        if (start < 0)
+            return undefined;
+        let end = start + GROK_OAUTH_AUTHORIZE_PREFIX.length;
+        while (end < input.length) {
+            const char = input[end];
+            const code = char.charCodeAt(0);
+            if (code <= 0x20 || code === 0x7f || char === '"' || char === "'" || char === "<" || char === ">" || char === "`") {
+                break;
+            }
+            end += 1;
+        }
+        let candidate = input.slice(start, end);
+        while (/[),.;\]}]$/.test(candidate))
+            candidate = candidate.slice(0, -1);
+        try {
+            const parsed = new URL(candidate);
+            if (parsed.protocol === "https:"
+                && parsed.hostname === "auth.x.ai"
+                && parsed.port === ""
+                && parsed.username === ""
+                && parsed.password === ""
+                && parsed.pathname === "/oauth2/authorize"
+                && parsed.hash === "") {
+                return parsed.toString();
+            }
+        }
+        catch {
+            // Keep scanning: a malformed lookalike must not suppress a later valid URL.
+        }
+        offset = start + GROK_OAUTH_AUTHORIZE_PREFIX.length;
+    }
+    return undefined;
+}
+export async function runGrokCommand(spawn, binary, args, options) {
+    return await new Promise((resolve, reject) => {
+        if (options.signal?.aborted) {
+            reject(new GrokRuntimeError("cancelled", "Grok command cancelled."));
+            return;
+        }
+        const child = spawn(binary, args, {
+            cwd: options.cwd,
+            env: options.env,
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        const maxStdout = options.maxStdoutBytes ?? 512 * 1024;
+        const maxStderr = options.maxStderrBytes ?? 8 * 1024;
+        let stdoutBytes = 0;
+        let stdoutStoredBytes = 0;
+        let stderrBytes = 0;
+        let stdoutOverflow = false;
+        let oauthStdoutScanBuffer = "";
+        let oauthStderrScanBuffer = "";
+        let oauthUrlSeen = false;
+        let oauthHandlerFailed = false;
+        let childError;
+        let aborted = false;
+        let killTimer;
+        const terminate = () => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return;
+            child.kill("SIGTERM");
+            if (killTimer)
+                return;
+            killTimer = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill("SIGKILL");
+            }, 1_000);
+            killTimer.unref?.();
+        };
+        const onAbort = () => {
+            aborted = true;
+            terminate();
+        };
+        const scanOAuthChunk = (source, text) => {
+            if (oauthUrlSeen || !options.onOAuthAuthorizeUrl)
+                return;
+            if (source === "stdout") {
+                oauthStdoutScanBuffer = `${oauthStdoutScanBuffer}${text}`.slice(-64 * 1024);
+            }
+            else {
+                oauthStderrScanBuffer = `${oauthStderrScanBuffer}${text}`.slice(-64 * 1024);
+            }
+            const url = extractGrokOAuthAuthorizeUrl(source === "stdout" ? oauthStdoutScanBuffer : oauthStderrScanBuffer);
+            if (!url)
+                return;
+            oauthUrlSeen = true;
+            try {
+                options.onOAuthAuthorizeUrl(url);
+            }
+            catch {
+                oauthHandlerFailed = true;
+                terminate();
+            }
+        };
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        child.stdout?.on("data", (chunk) => {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            if (!stdoutOverflow && stdoutBytes + bytes.byteLength > maxStdout) {
+                stdoutOverflow = true;
+                terminate();
+            }
+            stdoutBytes += bytes.byteLength;
+            if (!options.discardStdout) {
+                stdoutStoredBytes = appendBounded(stdout, bytes, stdoutStoredBytes, maxStdout);
+            }
+            scanOAuthChunk("stdout", bytes.toString("utf8"));
+        });
+        child.stderr?.on("data", (chunk) => {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            stderrBytes = appendBounded(stderr, bytes, stderrBytes, maxStderr);
+            scanOAuthChunk("stderr", bytes.toString("utf8"));
+        });
+        child.once("error", (error) => {
+            childError = error;
+        });
+        child.once("close", (code, signal) => {
+            options.signal?.removeEventListener("abort", onAbort);
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (aborted || options.signal?.aborted) {
+                reject(new GrokRuntimeError("cancelled", "Grok command cancelled."));
+                return;
+            }
+            if (stdoutOverflow) {
+                reject(new GrokRuntimeError("protocol_error", "Grok command output exceeded the safe capture limit."));
+                return;
+            }
+            if (oauthHandlerFailed) {
+                reject(new GrokRuntimeError("protocol_error", "Grok OAuth URL handling failed."));
+                return;
+            }
+            if (childError) {
+                reject(childError);
+                return;
+            }
+            if (code === null) {
+                reject(new GrokRuntimeError("process_crashed", `Grok runtime terminated by ${signal ?? "an unknown signal"}.`));
+                return;
+            }
+            resolve({
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: sanitizeGrokDiagnostic(Buffer.concat(stderr).toString("utf8")),
+                code,
+            });
+        });
+    });
+}

package/dist/external-runtime/grok-profile.d.ts

@@ -0,0 +1,32 @@
+export interface GrokProfile {
+    root: string;
+    home: string;
+    grokHome: string;
+    tmp: string;
+    workspace: string;
+    configPath: string;
+    requirementsPath: string;
+    lockPath: string;
+}
+export interface GrokProfileLock {
+    release(): Promise<void>;
+}
+export declare function isSafeGrokSkillName(name: string): boolean;
+export declare function buildGrokConfigToml(extraDisabledSkills?: readonly string[]): string;
+export declare function buildGrokRequirementsToml(extraDisabledSkills?: readonly string[]): string;
+export declare const GROK_CONFIG_TOML: string;
+export declare const GROK_REQUIREMENTS_TOML: string;
+export declare function getGrokProfile(bubbleHome?: string): GrokProfile;
+/**
+ * Establish only the private directory needed to create runtime.lock. Existing
+ * profile content is validated but never chmodded or rewritten here, because
+ * another Bubble process may already own the lock and be using that profile.
+ */
+export declare function prepareGrokProfileLockRoot(profile?: GrokProfile, uid?: number | undefined): Promise<GrokProfile>;
+export declare function prepareGrokProfile(profile?: GrokProfile, uid?: number | undefined, extraDisabledSkills?: readonly string[]): Promise<GrokProfile>;
+export declare function buildGrokChildEnv(profile: GrokProfile, parentEnv?: NodeJS.ProcessEnv, proxy?: string): NodeJS.ProcessEnv;
+export declare function acquireGrokProfileLock(profile: GrokProfile): Promise<GrokProfileLock>;
+export declare function grokProfileHasAuth(profile: GrokProfile): Promise<boolean>;
+export declare function clearGrokRuntimeData(profile: GrokProfile, includeAuth: boolean): Promise<void>;
+/** Remove extension surfaces that the pinned CLI may materialize at startup. */
+export declare function clearGrokGeneratedExtensions(profile: GrokProfile): Promise<void>;