@ebowwa/sandbox 0.1.1

package/src/compilers/javascript.ts

@@ -0,0 +1,571 @@
+/**
+ * JavaScript Compiler for @ebowwa/sandbox
+ *
+ * Compiles JavaScript to WASM or provides sandboxed execution.
+ * Uses AssemblyScript for strict JS/TS-to-WASM compilation when possible,
+ * falls back to sandboxed QuickJS or native execution for dynamic JS.
+ */
+
+import {
+  BaseCompiler,
+  type CompileResult,
+  type CompilerOptions,
+  type LanguageCapabilities,
+} from "../core/compiler.js";
+import type { Permissions, Limits } from "../core/types.js";
+
+/** JavaScript compiler options */
+export interface JavaScriptCompilerOptions extends CompilerOptions {
+  /** Target ES version */
+  target?: "es2015" | "es2016" | "es2017" | "es2018" | "es2019" | "es2020" | "es2021" | "es2022" | "esnext";
+  /** Module format */
+  module?: "esm" | "cjs" | "iife";
+  /** Enable strict mode */
+  strict?: boolean;
+  /** Use AssemblyScript for compilation (requires strict typing) */
+  useAssemblyScript?: boolean;
+  /** Sandbox mode when not using WASM */
+  sandboxMode?: "quickjs" | "isolated-vm" | "vm" | "none";
+}
+
+// Dynamic import type for esbuild (optional dependency)
+type EsbuildTransformResult = { code: string; map?: string; warnings?: unknown[] };
+type EsbuildModule = {
+  transform: (input: string, options?: Record<string, unknown>) => Promise<EsbuildTransformResult>;
+};
+
+// Dynamic import type for AssemblyScript (optional dependency)
+type AssemblyScriptModule = {
+  main: (args: string[], options: unknown, callback: (err: Error | null, result?: { stdout: Uint8Array }) => void) => void;
+  builtins: unknown;
+};
+
+/**
+ * JavaScript Compiler
+ *
+ * Provides JavaScript execution in a sandboxed environment.
+ * For true WASM compilation, AssemblyScript is used but requires
+ * strict typing with WebAssembly types (i32, i64, f32, f64).
+ */
+export class JavaScriptCompiler extends BaseCompiler {
+  readonly language = "javascript" as const;
+
+  private assemblyScriptAvailable: boolean | null = null;
+  private esbuildAvailable: boolean | null = null;
+
+  /**
+   * Check if AssemblyScript is available for WASM compilation
+   */
+  async isAvailable(): Promise<boolean> {
+    if (this.assemblyScriptAvailable !== null) {
+      return this.assemblyScriptAvailable;
+    }
+
+    try {
+      await import("assemblyscript");
+      this.assemblyScriptAvailable = true;
+      return true;
+    } catch {
+      this.assemblyScriptAvailable = false;
+      return false;
+    }
+  }
+
+  /**
+   * Validate JavaScript syntax
+   */
+  async validate(source: string): Promise<{ valid: boolean; error?: string }> {
+    try {
+      // Use esbuild for syntax validation if available
+      const esbuild = await this.getEsbuild();
+      if (esbuild) {
+        await esbuild.transform(source, {
+          loader: "js",
+          target: "es2020",
+        });
+        return { valid: true };
+      }
+
+      // Fallback: use Function constructor for basic syntax check
+      // This doesn't execute the code, just parses it
+      new Function(source);
+      return { valid: true };
+    } catch (error) {
+      return {
+        valid: false,
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  /**
+   * Compile JavaScript to WASM or prepare for sandboxed execution
+   *
+   * For dynamic JavaScript (with closures, objects, etc.), we create a WASM
+   * wrapper that includes a minimal JS runtime or use sandboxed execution.
+   */
+  async compile(
+    source: string,
+    permissions: Permissions,
+    limits: Limits,
+    options?: JavaScriptCompilerOptions
+  ): Promise<CompileResult> {
+    const opts: JavaScriptCompilerOptions = {
+      target: "es2020",
+      module: "esm",
+      strict: true,
+      useAssemblyScript: false, // Default to sandboxed execution
+      sandboxMode: "vm",
+      ...options,
+    };
+
+    // Try AssemblyScript compilation if explicitly requested and available
+    if (opts.useAssemblyScript && (await this.isAvailable())) {
+      return this.compileWithAssemblyScript(source, permissions, limits, opts);
+    }
+
+    // For standard JavaScript, create a sandboxed execution wrapper
+    return this.createSandboxedWrapper(source, permissions, limits, opts);
+  }
+
+  /**
+   * Get language capabilities
+   */
+  getCapabilities(): LanguageCapabilities {
+    return {
+      repl: true,
+      stateful: true,
+      compiled: false, // JS is interpreted, not compiled to WASM
+      gc: true, // JavaScript has garbage collection
+      imports: true,
+      async: true,
+    };
+  }
+
+  /**
+   * Compile with AssemblyScript
+   *
+   * Note: AssemblyScript requires strict typing with WASM types.
+   * Standard JavaScript with dynamic features won't compile.
+   */
+  private async compileWithAssemblyScript(
+    source: string,
+    _permissions: Permissions,
+    _limits: Limits,
+    _options: JavaScriptCompilerOptions
+  ): Promise<CompileResult> {
+    try {
+      const asc = (await import("assemblyscript")) as unknown as AssemblyScriptModule;
+
+      // Wrap user code in a module structure
+      const assemblyScriptSource = this.wrapForAssemblyScript(source);
+
+      return new Promise((resolve, reject) => {
+        asc.main(
+          [
+            "--textFile", "/dev/stdout",
+            "--outFile", "/dev/stdout",
+            "--optimize",
+            "--target", "release",
+          ],
+          {
+            stdin: () => assemblyScriptSource,
+            listBuiltins: () => asc.builtins,
+            reportDiagnostic: (diagnostic: { messageText: string }) => {
+              console.error(diagnostic.messageText);
+            },
+          },
+          (error: Error | null, result?: { stdout: Uint8Array }) => {
+            if (error) {
+              reject(new Error(`AssemblyScript compilation failed: ${error.message}`));
+              return;
+            }
+
+            if (!result?.stdout) {
+              reject(new Error("AssemblyScript produced no output"));
+              return;
+            }
+
+            // Parse the WASM module to extract exports/imports
+            WebAssembly.compile(result.stdout)
+              .then((module) => {
+                const exports = WebAssembly.Module.exports(module).map((e) => e.name);
+                const imports = WebAssembly.Module.imports(module).map((i) => ({
+                  module: i.module,
+                  name: i.name,
+                  type: i.kind as "function" | "memory" | "global" | "table",
+                }));
+
+                resolve({
+                  wasmBytes: result.stdout,
+                  exports,
+                  imports,
+                  memoryRequirements: {
+                    initial: 1,
+                    maximum: 256, // 16MB max
+                  },
+                });
+              })
+              .catch(reject);
+          }
+        );
+      });
+    } catch (error) {
+      throw new Error(
+        `AssemblyScript compilation failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+
+  /**
+   * Create a sandboxed execution wrapper
+   *
+   * Instead of compiling to WASM, we create a WASM module that
+   * provides a sandboxed JavaScript execution environment.
+   * For simplicity, we use a minimal wrapper that can be executed
+   * by a JavaScript runtime.
+   */
+  private async createSandboxedWrapper(
+    source: string,
+    permissions: Permissions,
+    limits: Limits,
+    options: JavaScriptCompilerOptions
+  ): Promise<CompileResult> {
+    // Transpile with esbuild if available
+    let processedSource = source;
+    const esbuild = await this.getEsbuild();
+
+    if (esbuild) {
+      const result = await esbuild.transform(source, {
+        loader: "js",
+        target: options.target || "es2020",
+        format: options.module === "cjs" ? "cjs" : "esm",
+        minify: options.optimize,
+      });
+      processedSource = result.code;
+    }
+
+    // Create a WASM wrapper that provides sandboxed execution
+    // This is a minimal WASM module that exports a function to get the JS source
+    // The actual execution happens in the JavaScript runtime
+    return this.createSandboxWasmWrapper(processedSource, permissions, limits);
+  }
+
+  /**
+   * Create a WASM wrapper for sandboxed JavaScript execution
+   *
+   * This creates a WASM module that:
+   * 1. Contains the JavaScript source code as data
+   * 2. Exports functions for the runtime to execute
+   * 3. Provides memory for execution results
+   */
+  private async createSandboxWasmWrapper(
+    source: string,
+    permissions: Permissions,
+    limits: Limits
+  ): Promise<CompileResult> {
+    // Encode the source and configuration
+    const sourceBytes = new TextEncoder().encode(source);
+    const configBytes = new TextEncoder().encode(
+      JSON.stringify({
+        permissions: {
+          fs: permissions.fs ? {
+            read: permissions.fs.read ?? false,
+            write: permissions.fs.write ?? false,
+            delete: permissions.fs.delete ?? false,
+          } : undefined,
+          network: permissions.network ? {
+            outbound: permissions.network.outbound ?? false,
+            inbound: permissions.network.inbound ?? false,
+          } : undefined,
+        },
+        limits: {
+          timeout: typeof limits.timeout === "string"
+            ? this.parseTime(limits.timeout)
+            : limits.timeout ?? 30000,
+          memory: typeof limits.memory === "string"
+            ? this.parseMemory(limits.memory)
+            : limits.memory ?? 16 * 1024 * 1024,
+        },
+      })
+    );
+
+    // Create a minimal WASM module that holds the JavaScript source
+    // This module exports functions to access the source and config
+    const wasmBytes = this.buildSandboxWasm(sourceBytes, configBytes);
+
+    return {
+      wasmBytes,
+      exports: ["getSource", "getConfig", "execute", "getResult"],
+      imports: [
+        { module: "env", name: "log", type: "function" },
+        { module: "env", name: "abort", type: "function" },
+      ],
+      memoryRequirements: {
+        initial: Math.max(1, Math.ceil((sourceBytes.length + configBytes.length) / 65536)),
+        maximum: 256,
+      },
+    };
+  }
+
+  /**
+   * Build the sandbox WASM module
+   *
+   * Creates a minimal WASM binary that contains:
+   * - Data section with JS source
+   * - Exported functions for runtime interaction
+   */
+  private buildSandboxWasm(sourceBytes: Uint8Array, configBytes: Uint8Array): Uint8Array {
+    // WASM module structure:
+    // - Magic number + version
+    // - Type section (function signatures)
+    // - Function section
+    // - Memory section
+    // - Export section
+    // - Code section
+    // - Data section (JS source and config)
+
+    const magicNumber = new Uint8Array([0x00, 0x61, 0x73, 0x6D]); // \0asm
+    const version = new Uint8Array([0x01, 0x00, 0x00, 0x00]); // version 1
+
+    // Build sections
+    const typeSection = this.buildTypeSection();
+    const functionSection = this.buildFunctionSection();
+    const memorySection = this.buildMemorySection(sourceBytes.length + configBytes.length + 1024);
+    const exportSection = this.buildExportSection();
+    const codeSection = this.buildCodeSection();
+    const dataSection = this.buildDataSection(sourceBytes, configBytes);
+
+    // Combine all sections
+    const sections = [
+      typeSection,
+      functionSection,
+      memorySection,
+      exportSection,
+      codeSection,
+      dataSection,
+    ];
+
+    const totalLength = magicNumber.length + version.length +
+      sections.reduce((sum, s) => sum + s.length, 0);
+
+    const wasm = new Uint8Array(totalLength);
+    let offset = 0;
+
+    // Write header
+    wasm.set(magicNumber, offset);
+    offset += magicNumber.length;
+    wasm.set(version, offset);
+    offset += version.length;
+
+    // Write sections
+    for (const section of sections) {
+      wasm.set(section, offset);
+      offset += section.length;
+    }
+
+    return wasm;
+  }
+
+  private buildTypeSection(): Uint8Array {
+    // Section ID 1 (type), 1 type, function type () -> i32
+    return new Uint8Array([
+      0x01, // section id
+      0x04, // section size
+      0x01, // num types
+      0x60, // func type
+      0x00, // 0 params
+      0x01, 0x7F, // 1 result: i32
+    ]);
+  }
+
+  private buildFunctionSection(): Uint8Array {
+    // Section ID 3 (function), 4 functions
+    return new Uint8Array([
+      0x03, // section id
+      0x05, // section size
+      0x04, // num functions
+      0x00, 0x00, 0x00, 0x00, // function indices (all type 0)
+    ]);
+  }
+
+  private buildMemorySection(dataSize: number): Uint8Array {
+    const pages = Math.max(1, Math.ceil(dataSize / 65536));
+    // Section ID 5 (memory), 1 memory, limits
+    return new Uint8Array([
+      0x05, // section id
+      0x03, // section size
+      0x01, // num memories
+      0x01, // has max
+      pages, // initial pages
+      0x80, 0x02, // max pages (256)
+    ]);
+  }
+
+  private buildExportSection(): Uint8Array {
+    // Section ID 7 (export)
+    // Export: memory, getSource, getConfig, execute, getResult
+    const exports = [
+      { name: "memory", kind: 0x02, index: 0 }, // memory
+      { name: "getSource", kind: 0x00, index: 0 }, // func 0
+      { name: "getConfig", kind: 0x00, index: 1 }, // func 1
+      { name: "execute", kind: 0x00, index: 2 }, // func 2
+      { name: "getResult", kind: 0x00, index: 3 }, // func 3
+    ];
+
+    const nameBytes: number[] = [];
+    for (const exp of exports) {
+      const nameEncoded = new TextEncoder().encode(exp.name);
+      nameBytes.push(nameEncoded.length);
+      nameBytes.push(...nameEncoded);
+      nameBytes.push(exp.kind);
+      nameBytes.push(exp.index);
+    }
+
+    const sectionContent = [exports.length, ...nameBytes];
+    const sectionSize = sectionContent.length;
+
+    return new Uint8Array([0x07, sectionSize, ...sectionContent]);
+  }
+
+  private buildCodeSection(): Uint8Array {
+    // Section ID 10 (code)
+    // 4 function bodies, each returning a constant
+    const functions = [
+      [0x00, 0x41, 0x00, 0x0B], // getSource: return 0 (offset)
+      [0x00, 0x41, 0x00, 0x0B], // getConfig: return 0 (placeholder)
+      [0x00, 0x41, 0x00, 0x0B], // execute: return 0 (placeholder)
+      [0x00, 0x41, 0x00, 0x0B], // getResult: return 0 (placeholder)
+    ];
+
+    const bodies: number[] = [];
+    for (const body of functions) {
+      bodies.push(body.length);
+      bodies.push(...body);
+    }
+
+    const sectionContent = [functions.length, ...bodies];
+    const sectionSize = sectionContent.length;
+
+    return new Uint8Array([0x0A, sectionSize, ...sectionContent]);
+  }
+
+  private buildDataSection(sourceBytes: Uint8Array, configBytes: Uint8Array): Uint8Array {
+    // Section ID 11 (data)
+    // 2 data segments: source and config
+    const sourceLen = this.encodeLEB128(sourceBytes.length);
+    const configLen = this.encodeLEB128(configBytes.length);
+
+    const segment1 = [
+      0x00, // active, memory 0
+      0x41, 0x00, 0x23, 0x00, // i32.const 0 (offset placeholder)
+      ...sourceLen,
+      ...sourceBytes,
+    ];
+
+    const segment2 = [
+      0x00, // active, memory 0
+      0x41, 0x00, 0x23, 0x00, // i32.const 0 (offset placeholder)
+      ...configLen,
+      ...configBytes,
+    ];
+
+    const sectionContent = [
+      0x02, // 2 data segments
+      ...segment1,
+      ...segment2,
+    ];
+
+    const sectionSize = sectionContent.length;
+    return new Uint8Array([0x0B, sectionSize, ...sectionContent]);
+  }
+
+  private encodeLEB128(value: number): number[] {
+    const result: number[] = [];
+    let remaining = value;
+
+    do {
+      let byte = remaining & 0x7F;
+      remaining >>>= 7;
+      if (remaining !== 0) {
+        byte |= 0x80;
+      }
+      result.push(byte);
+    } while (remaining !== 0);
+
+    return result;
+  }
+
+  /**
+   * Wrap JavaScript source for AssemblyScript compilation
+   *
+   * AssemblyScript requires explicit types and specific syntax.
+   * This wrapper attempts to make standard JS compatible.
+   */
+  private wrapForAssemblyScript(source: string): string {
+    return `
+// AssemblyScript wrapper
+// Note: AssemblyScript requires strict typing with i32, i64, f32, f64
+
+${source}
+
+// Export a main function if not present
+export function _start(): void {
+  // Entry point
+}
+`;
+  }
+
+  /**
+   * Get esbuild instance for transpilation
+   */
+  private async getEsbuild(): Promise<EsbuildModule | null> {
+    if (this.esbuildAvailable === false) {
+      return null;
+    }
+
+    try {
+      const esbuild = await import("esbuild") as EsbuildModule;
+      this.esbuildAvailable = true;
+      return esbuild;
+    } catch {
+      this.esbuildAvailable = false;
+      return null;
+    }
+  }
+
+  /**
+   * Parse memory string to bytes
+   */
+  private parseMemory(mem: string): number {
+    const match = mem.match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i);
+    if (!match) return 16 * 1024 * 1024;
+    const [, num, unit] = match;
+    const multipliers: Record<string, number> = {
+      b: 1,
+      kb: 1024,
+      mb: 1024 ** 2,
+      gb: 1024 ** 3,
+    };
+    return Math.floor(parseFloat(num) * (multipliers[unit?.toLowerCase() ?? "b"] ?? 1));
+  }
+
+  /**
+   * Parse time string to milliseconds
+   */
+  private parseTime(time: string): number {
+    const match = time.match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h)?$/i);
+    if (!match) return 30000;
+    const [, num, unit] = match;
+    const multipliers: Record<string, number> = {
+      ms: 1,
+      s: 1000,
+      m: 60000,
+      h: 3600000,
+    };
+    return Math.floor(parseFloat(num) * (multipliers[unit?.toLowerCase() ?? "ms"] ?? 1));
+  }
+}
+
+// Default instance
+export const javascriptCompiler = new JavaScriptCompiler();