@intutic/mcp-governance-proxy 1.10.0 → 2.0.0

package/dist/wasm/referencedFiles.js

@@ -0,0 +1,366 @@
+/**
+ * wasm/referencedFiles.ts — The MCP-side resolver behind the
+ * `read_referenced_file` host import (TD-441). A 1:1 port of
+ * `packages/proxy/src/wasm/referenced_files.rs`: same constants, same error
+ * codes, same candidate-token rules, same six guards, same realpath
+ * confinement. Where the two differ it is stated at the site.
+ *
+ * ## The design, in one paragraph
+ *
+ * A rule never names a file. The proxy derives the candidate paths from the
+ * CURRENT tool call's arguments (structured path keys and the shell words of
+ * a command), keeps the manifest-shaped ones, resolves each under the
+ * operator-configured root with every symlink followed, and reads the ones
+ * that survive — all BEFORE the sandbox exists. The guest then passes a path
+ * as a lookup key into that fixed table. There is no code path from a guest
+ * string to `open(2)`.
+ *
+ * ## Guards (numbered as in the Rust module)
+ *
+ * 1. Only paths the tool call literally named (no glob expansion).
+ * 2. Only manifest extensions.
+ * 3. No `..` component; no platform prefix.
+ * 4. Realpath must stay under the realpath'd root (symlink escape covered).
+ * 5. Regular files only.
+ * 6. Size-capped, checked on the stat AND on the read.
+ *
+ * ## Divergence from the Rust module
+ *
+ * Reads are `fs/promises` (async) rather than a blocking pool — the runner
+ * awaits them once per evaluation, before any rule runs, so the per-rule
+ * deadline still covers only guest execution. The residual TOCTOU between
+ * `realpath` and `open` is the same one `referenced_files.rs` documents;
+ * closing it needs `openat2(RESOLVE_BENEATH)`, which Node does not expose.
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+const log = createLogger('mcp-proxy-wasm-referenced-files');
+/** Largest file the host will hand to a rule. `referenced_files.rs`: 256 KiB. */
+export const MAX_REFERENCED_FILE_BYTES = 256 * 1024;
+/** Candidate paths considered per evaluation. */
+export const MAX_REFERENCED_FILES = 8;
+/** Longest path a guest may ask for. */
+export const MAX_GUEST_PATH_BYTES = 4096;
+/** How much of a shell command is scanned for operands. */
+const MAX_COMMAND_SCAN_BYTES = 64 * 1024;
+// Error codes, verbatim from `referenced_files.rs`. Negative so a guest can
+// tell a length from a refusal with one comparison.
+export const ERR_BAD_ARGS = -1;
+export const ERR_REFUSED = -2;
+export const ERR_NOT_FOUND = -3;
+export const ERR_TOO_LARGE = -4;
+export const ERR_BUFFER_TOO_SMALL = -5;
+export const ERR_BUDGET = -6;
+/** Host calls one evaluation may make, charged before argument validation. */
+export const MAX_READS_PER_EVALUATION = 64;
+/** The operator-configured root. Unset means the capability is off. */
+export const MANIFEST_ROOT_ENV = 'INTUTIC_WASM_MANIFEST_ROOT';
+const MANIFEST_EXTENSIONS = new Set(['yaml', 'yml', 'json', 'tf', 'tfvars', 'hcl', 'toml']);
+const PATH_ARG_KEYS = ['file_path', 'filepath', 'path', 'filename', 'target_file', 'notebook_path', 'manifest'];
+const COMMAND_ARG_KEYS = ['command', 'cmd', 'script'];
+/**
+ * The pre-read table one evaluation sees. Immutable after construction; the
+ * worker rebuilds it from `toTable()` on its side of `postMessage`.
+ */
+export class ReferencedFiles {
+    entries;
+    constructor(entries) {
+        this.entries = entries;
+    }
+    static empty() {
+        return new ReferencedFiles([]);
+    }
+    static fromTable(table) {
+        return new ReferencedFiles(table ? table.map(([t, o]) => [t, o]) : []);
+    }
+    toTable() {
+        return this.entries.map(([t, o]) => [t, o]);
+    }
+    isEmpty() {
+        return this.entries.length === 0;
+    }
+    readableCount() {
+        return this.entries.filter(([, o]) => o.kind === 'content').length;
+    }
+    /** The bytes for `requested`, or the error code the guest gets. */
+    lookup(requested) {
+        const hit = this.entries.find(([t]) => t === requested);
+        if (!hit)
+            return { ok: false, code: ERR_REFUSED };
+        const o = hit[1];
+        switch (o.kind) {
+            case 'content':
+                return { ok: true, bytes: o.bytes };
+            case 'not_found':
+                return { ok: false, code: ERR_NOT_FOUND };
+            case 'too_large':
+                return { ok: false, code: ERR_TOO_LARGE };
+            case 'refused':
+                return { ok: false, code: ERR_REFUSED };
+        }
+    }
+    /** Operator-facing reason. Never handed to the guest. */
+    refusalReason(requested) {
+        const hit = this.entries.find(([t]) => t === requested);
+        if (!hit)
+            return "not referenced by this request's tool calls";
+        const o = hit[1];
+        switch (o.kind) {
+            case 'refused':
+                return o.why;
+            case 'not_found':
+                return 'does not exist';
+            case 'too_large':
+                return 'exceeds the size cap';
+            case 'content':
+                return 'readable';
+        }
+    }
+    /** Debug rendering: states, never contents. */
+    describe() {
+        return this.entries
+            .map(([t, o]) => {
+            switch (o.kind) {
+                case 'content':
+                    return `${t} => readable(${o.bytes.length} bytes)`;
+                case 'refused':
+                    return `${t} => refused(${o.why})`;
+                case 'not_found':
+                    return `${t} => not_found`;
+                case 'too_large':
+                    return `${t} => too_large(${o.size} bytes)`;
+            }
+        })
+            .join(', ');
+    }
+}
+/** The configured root, `~/` expanded. `undefined` keeps the capability off. */
+export function resolveRoot(env = process.env) {
+    const raw = env[MANIFEST_ROOT_ENV];
+    if (!raw)
+        return undefined;
+    if (raw.startsWith('~/'))
+        return path.join(os.homedir(), raw.slice(2));
+    return raw;
+}
+/**
+ * Guard 1 and 2: every manifest-shaped path the tool calls literally name,
+ * deduped, capped at `MAX_REFERENCED_FILES`, in first-seen order.
+ */
+export function candidateTokens(toolCalls) {
+    const out = [];
+    for (const call of toolCalls) {
+        const args = call.arguments;
+        if (typeof args !== 'object' || args === null || Array.isArray(args))
+            continue;
+        const map = args;
+        for (const key of PATH_ARG_KEYS) {
+            const value = map[key];
+            if (typeof value === 'string')
+                consider(value, out);
+        }
+        for (const key of COMMAND_ARG_KEYS) {
+            const value = map[key];
+            if (typeof value === 'string') {
+                const scanned = value.length > MAX_COMMAND_SCAN_BYTES ? value.slice(0, MAX_COMMAND_SCAN_BYTES) : value;
+                for (const token of shellTokens(scanned))
+                    consider(token, out);
+            }
+        }
+        if (out.length >= MAX_REFERENCED_FILES)
+            break;
+    }
+    return out;
+}
+function consider(raw, out) {
+    if (out.length >= MAX_REFERENCED_FILES)
+        return;
+    const trimmed = raw.replace(/^["']+|["']+$/g, '');
+    // `--values=charts/prod.yaml` is one shell word carrying one path. Only
+    // option-shaped words are split, so a filename that legitimately contains
+    // `=` is passed through rather than silently rewritten.
+    let candidate = trimmed;
+    const eq = trimmed.indexOf('=');
+    if (eq > 0 && trimmed.startsWith('-'))
+        candidate = trimmed.slice(eq + 1);
+    if (candidate.length === 0 || Buffer.byteLength(candidate) > MAX_GUEST_PATH_BYTES || !hasManifestExtension(candidate))
+        return;
+    if (out.includes(candidate))
+        return;
+    out.push(candidate);
+}
+function hasManifestExtension(token) {
+    const ext = path.extname(token);
+    if (!ext)
+        return false;
+    return MANIFEST_EXTENSIONS.has(ext.slice(1).toLowerCase());
+}
+/**
+ * Split a command into shell words. Quotes group; whitespace and the
+ * metacharacters that end a word separate. Deliberately does NOT expand
+ * globs, variables or command substitution — an unexpanded `*.yaml` simply
+ * fails to resolve and the guest is told so.
+ */
+export function shellTokens(command) {
+    const out = [];
+    let current = '';
+    let quote = null;
+    const flush = () => {
+        if (current.length > 0) {
+            out.push(current);
+            current = '';
+        }
+    };
+    for (const ch of command) {
+        if (quote !== null) {
+            if (ch === quote)
+                quote = null;
+            else
+                current += ch;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+        }
+        else if (';|&<>()`'.includes(ch) || /\s/.test(ch)) {
+            flush();
+        }
+        else {
+            current += ch;
+        }
+    }
+    flush();
+    return out;
+}
+/** Resolve and read every candidate under `root`. Async, so the runner awaits it once per evaluation. */
+export async function readTokens(tokens, root) {
+    if (tokens.length === 0)
+        return ReferencedFiles.empty();
+    // Canonicalised per batch, not once per process: the root is operator
+    // configured and may be created after the proxy starts.
+    let canonicalRoot;
+    try {
+        canonicalRoot = await fs.realpath(root);
+    }
+    catch (err) {
+        log.warn({ action: 'wasm_manifest_root_unresolvable', root, err: err instanceof Error ? err.message : String(err) }, `${MANIFEST_ROOT_ENV} does not resolve — every referenced-file read will be refused`);
+        return ReferencedFiles.fromTable(tokens.map((t) => [t, { kind: 'refused', why: 'the configured manifest root does not resolve' }]));
+    }
+    const table = [];
+    for (const token of tokens) {
+        const outcome = await readOne(canonicalRoot, token);
+        if (outcome.kind === 'content') {
+            log.debug({
+                action: 'wasm_referenced_file_exposed',
+                path: token,
+                bytes: outcome.bytes.length,
+                // A content hash, not the content: enough to explain why a replay
+                // produced a different verdict without copying a manifest into
+                // telemetry.
+                sha256Prefix: createHash('sha256').update(outcome.bytes).digest('hex').slice(0, 16),
+            }, 'referenced file exposed to WASM rules');
+        }
+        else {
+            log.debug({ action: 'wasm_referenced_file_withheld', path: token, reason: describeOutcome(outcome) }, 'referenced file withheld from WASM rules');
+        }
+        table.push([token, outcome]);
+    }
+    return ReferencedFiles.fromTable(table);
+}
+function describeOutcome(o) {
+    switch (o.kind) {
+        case 'refused':
+            return o.why;
+        case 'not_found':
+            return 'does not exist';
+        case 'too_large':
+            return 'exceeds the size cap';
+        case 'content':
+            return 'readable';
+    }
+}
+/** Convenience for callers with tool calls in hand. */
+export function prefetch(toolCalls, root) {
+    return readTokens(candidateTokens(toolCalls), root);
+}
+/**
+ * Guards 3–6 on one candidate. Ordered so nothing touches the filesystem
+ * until the lexical checks pass: a `..` path is refused without a `stat`, so
+ * the import cannot probe for files outside the root.
+ */
+async function readOne(canonicalRoot, token) {
+    if (token.length === 0 || token.includes('\0'))
+        return { kind: 'refused', why: 'is empty or contains a NUL byte' };
+    const parts = token.split(/[\\/]+/);
+    if (parts.includes('..'))
+        return { kind: 'refused', why: 'contains a `..` component' };
+    // Windows drive/UNC prefixes. Refused rather than reasoned about; the
+    // proxy's deployment target is Unix.
+    if (/^[A-Za-z]:/.test(token) || token.startsWith('\\\\'))
+        return { kind: 'refused', why: 'carries a platform path prefix' };
+    const joined = path.isAbsolute(token) ? token : path.join(canonicalRoot, token);
+    let resolved;
+    try {
+        resolved = await fs.realpath(joined);
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return { kind: 'not_found' };
+        return { kind: 'refused', why: 'could not be resolved' };
+    }
+    if (resolved !== canonicalRoot && !resolved.startsWith(canonicalRoot + path.sep)) {
+        return { kind: 'refused', why: 'resolves outside the configured manifest root' };
+    }
+    let meta;
+    try {
+        meta = await fs.lstat(resolved);
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return { kind: 'not_found' };
+        return { kind: 'refused', why: 'could not be inspected' };
+    }
+    if (!meta.isFile())
+        return { kind: 'refused', why: 'is not a regular file' };
+    if (meta.size > MAX_REFERENCED_FILE_BYTES)
+        return { kind: 'too_large', size: meta.size };
+    // Bounded independently of the stat: the file may have grown between the
+    // two, and an unbounded read is how an endless file becomes an OOM.
+    let handle;
+    try {
+        handle = await fs.open(resolved, 'r');
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return { kind: 'not_found' };
+        return { kind: 'refused', why: 'could not be opened' };
+    }
+    try {
+        const buf = new Uint8Array(MAX_REFERENCED_FILE_BYTES + 1);
+        let total = 0;
+        while (total < buf.length) {
+            const { bytesRead } = await handle.read(buf, total, buf.length - total, total);
+            if (bytesRead === 0)
+                break;
+            total += bytesRead;
+        }
+        if (total > MAX_REFERENCED_FILE_BYTES)
+            return { kind: 'too_large', size: total };
+        return { kind: 'content', bytes: buf.slice(0, total) };
+    }
+    catch {
+        return { kind: 'refused', why: 'could not be read' };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function isNotFound(err) {
+    return typeof err === 'object' && err !== null && err.code === 'ENOENT';
+}
+//# sourceMappingURL=referencedFiles.js.map

package/dist/wasm/referencedFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"referencedFiles.js","sourceRoot":"","sources":["../../src/wasm/referencedFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,iCAAiC,CAAC,CAAA;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAA;AACnD,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AACrC,wCAAwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACxC,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAA;AAExC,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAA;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAA;AAC7B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAA;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAA;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAA;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAA;AAE5B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAE1C,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAA;AAE7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3F,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,CAAU,CAAA;AACxH,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAA;AAiB9D;;;GAGG;AACH,MAAM,OAAO,eAAe;IACW;IAArC,YAAqC,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAEtE,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,eAAe,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAuC;QACtD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;IACpE,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YACrC,KAAK,WAAW;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC3C,KAAK,WAAW;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC3C,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,6CAA6C,CAAA;QAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC,GAAG,CAAA;YACd,KAAK,WAAW;gBACd,OAAO,gBAAgB,CAAA;YACzB,KAAK,WAAW;gBACd,OAAO,sBAAsB,CAAA;YAC/B,KAAK,SAAS;gBACZ,OAAO,UAAU,CAAA;QACrB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO;aAChB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAA;gBACpD,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,GAAG,CAAA;gBACpC,KAAK,WAAW;oBACd,OAAO,GAAG,CAAC,eAAe,CAAA;gBAC5B,KAAK,WAAW;oBACd,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,SAAS,CAAA;YAC/C,CAAC;QACH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkC;IAChE,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAA;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9E,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBACtG,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,oBAAoB;YAAE,MAAK;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAa;IAC1C,IAAI,GAAG,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAM;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACjD,wEAAwE;IACxE,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,SAAS,GAAG,OAAO,CAAA;IACvB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACxE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,oBAAoB,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;QAAE,OAAM;IAC7H,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAM;IACnC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACjB,OAAO,GAAG,EAAE,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAA;;gBACzB,OAAO,IAAI,EAAE,CAAA;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAA;QACZ,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,CAAA;QACT,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAA;IACP,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAyB,EAAE,IAAY;IACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAA;IAEvD,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1G,GAAG,iBAAiB,gEAAgE,CACrF,CAAA;QACD,OAAO,eAAe,CAAC,SAAS,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAClG,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,KAAK,CACP;gBACE,MAAM,EAAE,8BAA8B;gBACtC,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC3B,kEAAkE;gBAClE,+DAA+D;gBAC/D,aAAa;gBACb,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACpF,EACD,uCAAuC,CACxC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAC1F,0CAA0C,CAC3C,CAAA;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,GAAG,CAAA;QACd,KAAK,WAAW;YACd,OAAO,gBAAgB,CAAA;QACzB,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAA;QAC/B,KAAK,SAAS;YACZ,OAAO,UAAU,CAAA;IACrB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,SAAkC,EAAE,IAAY;IACvE,OAAO,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,aAAqB,EAAE,KAAa;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAA;IAElH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAA;IACtF,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,gCAAgC,EAAE,CAAA;IAE3H,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAE/E,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC1D,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,IAA0C,CAAA;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC5E,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAExF,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,CAAA;YAC9E,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAK;YAC1B,KAAK,IAAI,SAAS,CAAA;QACpB,CAAC;QACD,IAAI,KAAK,GAAG,yBAAyB;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAChF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAA;AAChG,CAAC"}

package/dist/wasm/runner.d.ts

@@ -0,0 +1,91 @@
+/**
+ * wasm/runner.ts — WasmRunner: owns the one dedicated `worker_threads`
+ * Worker (worker.ts), the local-rules loader (loader.ts), and the
+ * evaluate-all-rules union logic ported from
+ * `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner` (most-restrictive-
+ * wins, short-circuit on a block, carry the first reask through).
+ *
+ * ## Divergences from the Rust runner (all recorded as TD entries)
+ *
+ * - **50ms per-rule deadline, not 5ms + fuel metering.** Wasmtime's `Store`
+ *   can price guest instructions with fuel and enforce a hard wall-clock
+ *   timeout independently; V8's WebAssembly has no fuel-equivalent
+ *   instruction metering accessible from `worker_threads`, so a wall-clock
+ *   race against a `postMessage` round trip (which also pays IPC overhead
+ *   the in-process Wasmtime call never did) is the only backstop available
+ *   here. 50ms, not 5ms, to keep that overhead from false-positiving a
+ *   legitimate rule under normal load.
+ * - **Guest memory ceiling is checked, not enforced mid-call.** `runner.rs`
+ *   sets a 16MB `StoreLimits` cap that stops a `memory.grow` as it happens;
+ *   V8 exposes no such hook on a module-exported memory, so `worker.ts`
+ *   refuses a module whose initial memory is over 16MB and discards the
+ *   verdict of one that grew past it during the call (reported as a
+ *   failure, fail-open like a trap). The growth itself is bounded only by
+ *   V8 (TD-440's remainder).
+ * - **`read_referenced_file` is served from a pre-read table**
+ *   (`referencedFiles.ts`, the port of `referenced_files.rs`), prefetched
+ *   once per `evaluate()` only when a loaded rule imports the function and
+ *   `INTUTIC_WASM_MANIFEST_ROOT` is set; otherwise every call refuses,
+ *   exactly as the Rust proxy answers with no root configured.
+ *
+ * @module
+ */
+import { type CompileBridge, type CompileOutcome } from './loader.js';
+import { type WasmContextInput } from './context.js';
+export type WasmVerdict = {
+    code: 'allow';
+} | {
+    code: 'block';
+    reason: string;
+    ruleId: string;
+} | {
+    code: 'reask';
+    reason: string;
+    ruleId: string;
+};
+export declare class WasmRunner implements CompileBridge {
+    private readonly loader;
+    private worker;
+    private nextRequestId;
+    private pending;
+    private consecutiveTimeouts;
+    private disabledRuleIds;
+    constructor(dirOverride?: string);
+    /** The resolved local rules directory, for logging. */
+    getDir(): string;
+    /** Currently loaded rule ids (`local:<file name>`), priority order — observability for callers/tests. */
+    getLoadedRuleIds(): string[];
+    private ensureWorker;
+    /** Send one message and wait for its correlated reply, or `null` on timeout. */
+    private send;
+    private allocId;
+    compile(ruleId: string, bytes: Uint8Array): Promise<CompileOutcome>;
+    remove(ruleId: string): void;
+    /**
+     * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
+     * clears every rule's disabled-by-timeout status — "disable that rule
+     * until the next policy-driven rescan" is this call.
+     */
+    rescan(): Promise<void>;
+    /** Terminates the worker and respawns a fresh one, resending every currently-loaded rule's bytes so its module cache is rebuilt. */
+    private respawnWorker;
+    /**
+     * Evaluates every currently loaded, non-disabled rule (priority order)
+     * against one context, mirroring `registry.rs`'s `evaluate_inner`:
+     * short-circuit on the first block, carry the first reask through in case
+     * a later, higher-priority rule still blocks, `allow` when nothing fired
+     * or every loaded rule was fail-open (timeout/trap/unmapped code).
+     */
+    evaluate(input: WasmContextInput): Promise<WasmVerdict>;
+    /**
+     * The referenced-files table for this evaluation (TD-441). With no
+     * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.
+     */
+    private prefetchReferencedFiles;
+    /** One rule's evaluation, raced against `EVALUATE_TIMEOUT_MS`. `null` means fail-open (timeout, worker error, or guest trap). */
+    private evaluateOne;
+    /** Terminates the worker. Safe to call even if one was never spawned. */
+    shutdown(): Promise<void>;
+}
+export type { WasmContextInput };
+//# sourceMappingURL=runner.d.ts.map

package/dist/wasm/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAkBtE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAyCrD,qBAAa,UAAW,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,OAAO,CAAC,eAAe,CAAoB;gBAE/B,WAAW,CAAC,EAAE,MAAM;IAIhC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,yGAAyG;IACzG,gBAAgB,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ5B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,oIAAoI;YACtH,aAAa;IAqB3B;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAuD7D;;;OAGG;YACW,uBAAuB;IAUrC,iIAAiI;YACnH,WAAW;IA8CzB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAWD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}