@dxos/plugin-script 0.8.4-main.c4373fc → 0.8.4-main.c85a9c8dae

package/src/hooks/useToolbarState.ts

@@ -2,15 +2,40 @@
 // Copyright 2025 DXOS.org
 //
 
+import { Atom } from '@effect-atom/atom-react';
 import { useMemo } from 'react';
 
-import { live } from '@dxos/live-object';
+import { Capabilities } from '@dxos/app-framework';
+import { useCapability } from '@dxos/app-framework/ui';
 
 import { type DeployState } from './deploy';
 
 export type ScriptToolbarState = Partial<DeployState>;
 
-// TODO(burdon): Replace with context provider?
-export const useToolbarState = (initialState: ScriptToolbarState = {}) => {
-  return useMemo(() => live<ScriptToolbarState>(initialState), []);
+export type ScriptToolbarStateStore = {
+  atom: Atom.Writable<ScriptToolbarState>;
+  get value(): ScriptToolbarState;
+  update: (updater: (current: ScriptToolbarState) => ScriptToolbarState) => void;
+  set: <K extends keyof ScriptToolbarState>(key: K, value: ScriptToolbarState[K]) => void;
+};
+
+export const useToolbarState = (initialState: ScriptToolbarState = {}): ScriptToolbarStateStore => {
+  const registry = useCapability(Capabilities.AtomRegistry);
+  const atom = useMemo(() => Atom.make<ScriptToolbarState>(initialState), []);
+
+  return useMemo(
+    () => ({
+      atom,
+      get value() {
+        return registry.get(atom);
+      },
+      update: (updater: (current: ScriptToolbarState) => ScriptToolbarState) => {
+        registry.set(atom, updater(registry.get(atom)));
+      },
+      set: <K extends keyof ScriptToolbarState>(key: K, v: ScriptToolbarState[K]) => {
+        registry.set(atom, { ...registry.get(atom), [key]: v });
+      },
+    }),
+    [atom, registry],
+  );
 };

package/src/index.ts

@@ -2,8 +2,9 @@
 // Copyright 2023 DXOS.org
 //
 
-export { ScriptCapabilities } from './capabilities';
+export { ScriptCapabilities, ScriptEvents } from './types';
 export * from './components';
+export * from './containers';
 export * from './meta';
 export * from './util';
 

package/src/meta.ts

@@ -2,14 +2,18 @@
 // Copyright 2023 DXOS.org
 //
 
-import { type PluginMeta } from '@dxos/app-framework';
+import { type Plugin } from '@dxos/app-framework';
+import { trim } from '@dxos/util';
 
-export const meta: PluginMeta = {
+export const meta: Plugin.Meta = {
   id: 'dxos.org/plugin/script',
   name: 'Scripts',
-  description:
-    'Scripts enable you to deploy custom functions that run on the edge. These functions can be referenced by your AI agent and called inside of cells in any Sheet. Use scripts to interact with API’s or external data inside of Composer.',
+  description: trim`
+    Write and deploy custom JavaScript functions that extend your workspace capabilities.
+    Create AI agent tools, spreadsheet formulas, and automation scripts that integrate seamlessly with other plugins.
+  `,
   icon: 'ph--code--regular',
+  iconHue: 'sky',
   source: 'https://github.com/dxos/dxos/tree/main/packages/plugins/plugin-explorer',
   tags: ['labs'],
   screenshots: ['https://dxos.network/plugin-details-scripts-dark.png'],

package/src/notebook/compute-graph.test.ts

@@ -0,0 +1,82 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { Registry } from '@effect-atom/atom-react';
+import { describe, expect, test } from 'vitest';
+
+import { Obj } from '@dxos/echo';
+
+import { createNotebook } from '../testing';
+
+import { ComputeGraph } from './compute-graph';
+
+describe('notebook', () => {
+  test('parse dependency graph', async () => {
+    const registry = Registry.make();
+    const notebook = createNotebook();
+    const graph = new ComputeGraph(notebook, registry);
+    const result = graph.parse();
+
+    const getId = (i: number) => notebook.cells[i].id;
+
+    // Check dependencies.
+    expect(result.dependencyGraph).toMatchObject({
+      [getId(0)]: [getId(1), getId(2)],
+      [getId(3)]: [getId(1)],
+      [getId(4)]: [getId(0), getId(3)],
+    });
+
+    // Compute values.
+    const values = await graph.evaluate();
+    expect(values).toEqual({
+      [getId(0)]: 300,
+      [getId(2)]: 200,
+      [getId(3)]: 200,
+      [getId(4)]: 500,
+    });
+  });
+
+  test('evalScript blocks access to window and document', async () => {
+    const registry = Registry.make();
+    const notebook = createNotebook();
+    // Replace one of the cells with code that tries to access window/document.
+    const sourceTarget = notebook.cells[2].source?.target;
+    if (sourceTarget) {
+      Obj.change(sourceTarget, (t) => {
+        t.content = 'b = typeof window';
+      });
+    }
+
+    const graph = new ComputeGraph(notebook, registry);
+    graph.parse();
+    const values = await graph.evaluate();
+
+    // Should evaluate to 'undefined' since window is blocked.
+    expect(values[notebook.cells[2].id]).toBe('undefined');
+
+    // Test document access.
+    if (sourceTarget) {
+      Obj.change(sourceTarget, (t) => {
+        t.content = 'b = typeof document';
+      });
+    }
+    graph.parse();
+    const values2 = await graph.evaluate();
+
+    // Should evaluate to 'undefined' since document is blocked.
+    expect(values2[notebook.cells[2].id]).toBe('undefined');
+
+    // Test that safe globals still work.
+    if (sourceTarget) {
+      Obj.change(sourceTarget, (t) => {
+        t.content = 'b = Math.max(100, 200)';
+      });
+    }
+    graph.parse();
+    const values3 = await graph.evaluate();
+
+    // Should evaluate correctly.
+    expect(values3[notebook.cells[2].id]).toBe(200);
+  });
+});

package/src/notebook/{notebook.ts → compute-graph.ts}

@@ -2,46 +2,88 @@
 // Copyright 2025 DXOS.org
 //
 
-import { type Signal, signal } from '@preact/signals-core';
+import { Atom, type Registry } from '@effect-atom/atom-react';
 
 import { log } from '@dxos/log';
 
 import { type Notebook } from '../types';
 
+import { evalScript } from './eval';
 import { type ParsedExpression, VirtualTypeScriptParser } from './vfs-parser';
 
 /**
  * Compute graph that evaluates the notebook cells.
  */
+// TODO(burdon): Reconcile with @dxos/conductor.
 export class ComputeGraph {
   private readonly _parser = new VirtualTypeScriptParser();
 
-  private _expressions = signal<Record<string, ParsedExpression>>({});
-  private _values = signal<Record<string, any>>({});
+  private _expressionsAtom = Atom.make<Record<string, ParsedExpression>>({});
+  private _valuesByCellIdAtom = Atom.make<Record<string, any>>({});
+  private _valuesByNameAtom = Atom.make<Record<string, any>>({});
 
-  constructor(private readonly _notebook: Notebook.Notebook) {}
+  constructor(
+    private readonly _notebook: Notebook.Notebook,
+    private readonly _registry: Registry.Registry,
+  ) {}
 
   /**
-   * Parsed expressions by cell ID.
+   * Atom for parsed expressions by cell ID.
    */
-  get expressions(): Signal<Record<string, ParsedExpression>> {
-    return this._expressions;
+  get expressions(): Atom.Atom<Record<string, ParsedExpression>> {
+    return this._expressionsAtom;
   }
 
   /**
-   * Computed values by cell ID.
+   * Get current expressions by cell ID.
    */
-  get values(): Signal<Record<string, any>> {
-    return this._values;
+  getExpressions(): Record<string, ParsedExpression> {
+    return this._registry.get(this._expressionsAtom);
+  }
+
+  /**
+   * Atom for computed values by cell ID.
+   */
+  get values(): Atom.Atom<Record<string, any>> {
+    return this._valuesByCellIdAtom;
+  }
+
+  /**
+   * Get computed values by cell ID.
+   */
+  getValues(): Record<string, any> {
+    return this._registry.get(this._valuesByCellIdAtom);
+  }
+
+  /**
+   * Atom for computed values by name.
+   */
+  get valuesByName(): Atom.Atom<Record<string, any>> {
+    return this._valuesByNameAtom;
+  }
+
+  /**
+   * Get current values by name.
+   */
+  getValuesByName(): Record<string, any> {
+    return this._registry.get(this._valuesByNameAtom);
+  }
+
+  /**
+   * Get computed value by cell ID.
+   */
+  getValue(cellId: string): any {
+    return this._registry.get(this._valuesByCellIdAtom)[cellId];
   }
 
   /**
    * Compute values.
    */
-  evaluate() {
+  async evaluate() {
     // Parse expressions.
     const { expressions, dependencyGraph } = this.parse();
-    this._values.value = {};
+    this._registry.set(this._valuesByCellIdAtom, {});
+    this._registry.set(this._valuesByNameAtom, {});
 
     // Create a map of cell IDs to expressions for easy lookup.
     const cellExpressions = new Map<string, ParsedExpression>();
@@ -64,7 +106,7 @@ export class ComputeGraph {
         continue;
       }
 
-      const cellSource = this._notebook.cells.find((cell) => cell.id === cellId)?.script.target?.content;
+      const cellSource = this._notebook.cells.find((cell) => cell.id === cellId)?.source?.target?.content;
       if (!cellSource) {
         log.error('no source for cell', { cellId });
         continue;
@@ -89,7 +131,7 @@ export class ComputeGraph {
               rhs = rhs.slice(0, -1).trim();
             }
 
-            const result = this.evalScript(rhs, valuesByName);
+            const result = await this.eval(rhs, valuesByName);
             valuesByName[expr.name] = result;
             if (typeof result !== 'function') {
               valuesByCellId[cellId] = result;
@@ -97,35 +139,43 @@ export class ComputeGraph {
           }
         } else {
           // For expressions without assignment, just evaluate.
-          const result = this.evalScript(cellSource, valuesByName);
+          const result = await this.eval(cellSource, valuesByName);
           valuesByCellId[cellId] = result;
         }
       } catch (error) {
+        // TODO(burdon): Set error state.
         log.error('error evaluating cell', { cellId, error });
       }
     }
 
-    this._values.value = valuesByCellId;
+    this._registry.set(this._valuesByCellIdAtom, valuesByCellId);
+    this._registry.set(this._valuesByNameAtom, valuesByName);
     return valuesByCellId;
   }
 
+  private async eval(source: string, values: Record<string, any>) {
+    return evalScript(source, values);
+  }
+
   /**
    * Parse expressions.
    */
   parse() {
-    const expressions = this._notebook.cells.reduce<Record<string, ParsedExpression>>((acc, cell) => {
-      const text = cell.script.target?.content.trim();
-      if (text) {
-        const parsed = this._parser.parseExpression(text);
-        acc[cell.id] = parsed;
-      }
+    const expressions = this._notebook.cells
+      .filter((cell) => cell.type === 'script')
+      .reduce<Record<string, ParsedExpression>>((acc, cell) => {
+        const text = cell.source?.target?.content.trim();
+        if (text) {
+          const parsed = this._parser.parseExpression(text);
+          acc[cell.id] = parsed;
+        }
 
-      return acc;
-    }, {});
+        return acc;
+      }, {});
 
     // Build dependency graph.
     const dependencyGraph = this.buildDependencyGraph(expressions);
-    this._expressions.value = expressions;
+    this._registry.set(this._expressionsAtom, expressions);
     return { expressions, dependencyGraph };
   }
 
@@ -177,12 +227,4 @@ export class ComputeGraph {
 
     return graph;
   }
-
-  /**
-   * Evaluate the script (with dependencies as arguments).
-   */
-  private evalScript(code: string, deps: Record<string, any> = {}) {
-    // eslint-disable-next-line @typescript-eslint/no-implied-eval
-    return new Function(...Object.keys(deps), 'return ' + code)(...Object.values(deps));
-  }
 }

package/src/notebook/eval.ts

@@ -0,0 +1,105 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { trim } from '@dxos/util';
+
+/**
+ * Evaluate the script (with dependencies as arguments).
+ */
+export const evalScript = async (code: string, deps: Record<string, any> = {}) => {
+  // Create a sandboxed environment that blocks access to window and document.
+  const sandbox = {
+    ...deps,
+
+    // Block access to global objects.
+    console: undefined,
+    document: undefined,
+    global: undefined,
+    globalThis: undefined,
+    self: undefined,
+    window: undefined,
+
+    // Allow some safe globals.
+    Array,
+    Boolean,
+    Date,
+    Error,
+    JSON,
+    Map,
+    Math,
+    Number,
+    Object,
+    Promise,
+    RegExp,
+    Set,
+    String,
+
+    // Functions.
+    isFinite,
+    isNaN,
+    parseFloat,
+    parseInt,
+
+    // Note: undefined and null are not included as they are keywords, not variables.
+  };
+
+  // Create function with all sandbox keys as parameters.
+  const sandboxKeys = Object.keys(sandbox);
+  const sandboxValues = Object.values(sandbox);
+
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  const fn = new Function(
+    ...sandboxKeys,
+    trim`
+      'use strict';
+      return ${code};
+    `,
+  );
+
+  return fn(...sandboxValues);
+};
+
+/**
+ * Globals.
+ */
+export const builtIns = new Set([
+  // Types.
+  'Array',
+  'Date',
+  'Error',
+  'JSON',
+  'Map',
+  'Math',
+  'Number',
+  'Object',
+  'Promise',
+  'RegExp',
+  'Set',
+  'String',
+
+  // Functions.
+  'isFinite',
+  'isNaN',
+  'parseFloat',
+  'parseInt',
+]);
+
+/**
+ * Default system definitions.
+ */
+export const systemDefinitions = trim`
+  interface Array<T> { length: number; [n: number]: T; }
+  interface Boolean {}
+  interface Function {}
+  interface IArguments {}
+  interface Number {}
+  interface Object {}
+  interface RegExp {}
+  interface String { length: number; }
+
+  interface CallableFunction extends Function {}
+  interface NewableFunction extends Function {}
+
+  declare var console: { log(...args: any[]): void };
+`;

package/src/notebook/index.ts

@@ -2,4 +2,4 @@
 // Copyright 2025 DXOS.org
 //
 
-export * from './notebook';
+export * from './compute-graph';