@intutic/mcp-governance-proxy 1.10.0 → 2.0.0

package/dist/wasm/runner.js

@@ -0,0 +1,308 @@
+/**
+ * wasm/runner.ts — WasmRunner: owns the one dedicated `worker_threads`
+ * Worker (worker.ts), the local-rules loader (loader.ts), and the
+ * evaluate-all-rules union logic ported from
+ * `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner` (most-restrictive-
+ * wins, short-circuit on a block, carry the first reask through).
+ *
+ * ## Divergences from the Rust runner (all recorded as TD entries)
+ *
+ * - **50ms per-rule deadline, not 5ms + fuel metering.** Wasmtime's `Store`
+ *   can price guest instructions with fuel and enforce a hard wall-clock
+ *   timeout independently; V8's WebAssembly has no fuel-equivalent
+ *   instruction metering accessible from `worker_threads`, so a wall-clock
+ *   race against a `postMessage` round trip (which also pays IPC overhead
+ *   the in-process Wasmtime call never did) is the only backstop available
+ *   here. 50ms, not 5ms, to keep that overhead from false-positiving a
+ *   legitimate rule under normal load.
+ * - **Guest memory ceiling is checked, not enforced mid-call.** `runner.rs`
+ *   sets a 16MB `StoreLimits` cap that stops a `memory.grow` as it happens;
+ *   V8 exposes no such hook on a module-exported memory, so `worker.ts`
+ *   refuses a module whose initial memory is over 16MB and discards the
+ *   verdict of one that grew past it during the call (reported as a
+ *   failure, fail-open like a trap). The growth itself is bounded only by
+ *   V8 (TD-440's remainder).
+ * - **`read_referenced_file` is served from a pre-read table**
+ *   (`referencedFiles.ts`, the port of `referenced_files.rs`), prefetched
+ *   once per `evaluate()` only when a loaded rule imports the function and
+ *   `INTUTIC_WASM_MANIFEST_ROOT` is set; otherwise every call refuses,
+ *   exactly as the Rust proxy answers with no root configured.
+ *
+ * @module
+ */
+import { Worker } from 'node:worker_threads';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+import { WasmLoader, resolveWasmDir } from './loader.js';
+import { buildWasmContext } from './context.js';
+import { prefetch, resolveRoot, ReferencedFiles } from './referencedFiles.js';
+const log = createLogger('mcp-proxy-wasm-runner');
+/**
+ * Per-rule evaluation deadline. See this module's doc comment for why this
+ * is 50ms rather than `runner.rs`'s 5ms.
+ */
+const EVALUATE_TIMEOUT_MS = 50;
+/** Generous — compilation is not guest-controlled per evaluation, but a
+ *  pathological file must not hang a rescan forever. */
+const COMPILE_TIMEOUT_MS = 3_000;
+/** Consecutive per-rule timeouts before that rule is disabled until the next rescan. */
+const MAX_CONSECUTIVE_TIMEOUTS = 3;
+/**
+ * Resolves the worker script to spawn.
+ *
+ * Always prefers the BUILT `dist/wasm/worker.js` when it exists on disk,
+ * even while this module itself is running as TypeScript source (a test
+ * runner, `tsx` dev mode) — plain compiled JS needs no loader help to
+ * resolve its own sibling `./hostImports.js` import, sidestepping
+ * `worker_threads` module-resolution entirely. `turbo.json` declares
+ * `test: { dependsOn: ['build'] }`, so `dist/` is guaranteed fresh by the
+ * time `pnpm turbo test` (CI's invocation) runs any package's suite.
+ *
+ * Only falls back to spawning the `.ts` source directly (via `tsx`'s ESM
+ * loader, registered on the worker's own `execArgv`) when no build has run
+ * yet — e.g. `vitest run` invoked standalone, bypassing turbo. That
+ * fallback path is NOT reliably portable: `execArgv: ['--import',
+ * 'tsx/esm']` (and the `NODE_OPTIONS`-delivered equivalent, also tried) both
+ * failed to propagate the loader hook to the worker's own sibling import on
+ * this repo's CI runner (Node 22, Linux) despite both working locally
+ * (Node 26, macOS) — a real, observed Node-version-dependent gap in how
+ * `worker_threads` applies ESM loader hooks, not a hypothetical one. Run
+ * `pnpm --filter @intutic/mcp-governance-proxy build` first if iterating on
+ * this file with bare `vitest` outside of `turbo test`.
+ */
+function workerScriptSpec() {
+    const srcUrl = new URL('./worker.ts', import.meta.url);
+    const distPath = fileURLToPath(srcUrl).replace(/\/src\/wasm\/worker\.ts$/, '/dist/wasm/worker.js');
+    if (existsSync(distPath)) {
+        return { url: new URL(`file://${distPath}`), execArgv: [] };
+    }
+    const isSource = import.meta.url.endsWith('.ts');
+    const url = new URL(isSource ? './worker.ts' : './worker.js', import.meta.url);
+    return { url, execArgv: isSource ? ['--import', 'tsx/esm'] : [] };
+}
+export class WasmRunner {
+    loader;
+    worker = null;
+    nextRequestId = 1;
+    pending = new Map();
+    consecutiveTimeouts = new Map();
+    disabledRuleIds = new Set();
+    constructor(dirOverride) {
+        this.loader = new WasmLoader(resolveWasmDir(dirOverride));
+    }
+    /** The resolved local rules directory, for logging. */
+    getDir() {
+        return this.loader.getDir();
+    }
+    /** Currently loaded rule ids (`local:<file name>`), priority order — observability for callers/tests. */
+    getLoadedRuleIds() {
+        return this.loader.getRules().map((r) => r.ruleId);
+    }
+    ensureWorker() {
+        if (this.worker)
+            return this.worker;
+        const { url, execArgv } = workerScriptSpec();
+        const worker = new Worker(url, execArgv.length > 0 ? { execArgv } : undefined);
+        worker.on('message', (msg) => {
+            if (typeof msg.id !== 'number')
+                return;
+            const entry = this.pending.get(msg.id);
+            if (!entry)
+                return; // already timed out and removed
+            clearTimeout(entry.timer);
+            this.pending.delete(msg.id);
+            entry.resolve(msg);
+        });
+        worker.on('error', (err) => {
+            log.error({ action: 'wasm_worker_error', err: err.message }, 'WASM worker thread error');
+        });
+        this.worker = worker;
+        return worker;
+    }
+    /** Send one message and wait for its correlated reply, or `null` on timeout. */
+    send(msg, timeoutMs) {
+        const worker = this.ensureWorker();
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(msg['id']);
+                resolve(null);
+            }, timeoutMs);
+            this.pending.set(msg['id'], { resolve: (v) => resolve(v), timer });
+            worker.postMessage(msg);
+        });
+    }
+    allocId() {
+        const id = this.nextRequestId;
+        this.nextRequestId += 1;
+        return id;
+    }
+    // ── CompileBridge, consumed by WasmLoader.rescan ──────────────────────
+    async compile(ruleId, bytes) {
+        const id = this.allocId();
+        const reply = await this.send({ type: 'compile', id, ruleId, bytes: toArrayBuffer(bytes) }, COMPILE_TIMEOUT_MS);
+        if (!reply)
+            return { ok: false, error: `compile timed out after ${COMPILE_TIMEOUT_MS}ms` };
+        if (!reply.ok) {
+            const fallback = reply.unsupportedImports && reply.unsupportedImports.length > 0
+                ? `imports ${reply.unsupportedImports.join(', ')}, which this proxy does not provide`
+                : 'unknown compile error';
+            return { ok: false, error: reply.error ?? fallback, unsupportedImports: reply.unsupportedImports };
+        }
+        return { ok: true, readsReferencedFiles: reply.readsReferencedFiles ?? false };
+    }
+    remove(ruleId) {
+        this.ensureWorker().postMessage({ type: 'remove', ruleId });
+        this.consecutiveTimeouts.delete(ruleId);
+        this.disabledRuleIds.delete(ruleId);
+    }
+    // ── Rescan (driven by the existing policy-tick timer — see policy.ts) ──
+    /**
+     * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
+     * clears every rule's disabled-by-timeout status — "disable that rule
+     * until the next policy-driven rescan" is this call.
+     */
+    async rescan() {
+        await this.loader.rescan(this);
+        this.disabledRuleIds.clear();
+        this.consecutiveTimeouts.clear();
+    }
+    /** Terminates the worker and respawns a fresh one, resending every currently-loaded rule's bytes so its module cache is rebuilt. */
+    async respawnWorker() {
+        const old = this.worker;
+        this.worker = null;
+        if (old) {
+            // Fail every request still waiting on the dead worker rather than
+            // leaving its promise unresolved forever.
+            for (const [id, entry] of this.pending) {
+                clearTimeout(entry.timer);
+                entry.resolve({ ok: false, error: 'worker terminated' });
+                this.pending.delete(id);
+            }
+            await old.terminate();
+        }
+        // Force-reload every currently-known file into the new worker — its
+        // module cache started empty. `force: true` mirrors this loader's own
+        // "worker cache was lost, nothing on disk moved" case.
+        await this.loader.rescan(this, true);
+    }
+    // ── Evaluation ───────────────────────────────────────────────────────
+    /**
+     * Evaluates every currently loaded, non-disabled rule (priority order)
+     * against one context, mirroring `registry.rs`'s `evaluate_inner`:
+     * short-circuit on the first block, carry the first reask through in case
+     * a later, higher-priority rule still blocks, `allow` when nothing fired
+     * or every loaded rule was fail-open (timeout/trap/unmapped code).
+     */
+    async evaluate(input) {
+        const rules = this.loader.getRules().filter((r) => !this.disabledRuleIds.has(r.ruleId));
+        if (rules.length === 0)
+            return { code: 'allow' };
+        const contextBytes = Buffer.from(JSON.stringify(buildWasmContext(input)));
+        let pendingReask = null;
+        // Read once per evaluation, before any rule runs, so the per-rule
+        // deadline covers guest execution only — and only when a rule will ask.
+        const files = rules.some((r) => r.readsReferencedFiles) ? await this.prefetchReferencedFiles(input) : undefined;
+        for (const rule of rules) {
+            const result = await this.evaluateOne(rule.ruleId, contextBytes, rule.readsReferencedFiles ? files : undefined);
+            if (result === null)
+                continue; // fail-open ALLOW for this rule (timeout, trap, or worker error)
+            switch (result.code) {
+                case 0:
+                    break; // Bypass — try the next rule
+                case 1:
+                    return { code: 'block', reason: result.reason ?? 'Blocked by custom WASM governance rule', ruleId: rule.ruleId };
+                case 2:
+                    // Deprecated REDACT code — the guest never receives the request
+                    // body (this context carries no raw payload), so redaction was
+                    // never expressible. Treated as a block, loudly, mirroring
+                    // runner.rs's own handling exactly.
+                    log.warn({ action: 'wasm_deprecated_verdict', ruleId: rule.ruleId }, 'WASM rule returned deprecated verdict code 2 (REDACT); treating as a block. Return 1 to block, or 3 to reask.');
+                    return {
+                        code: 'block',
+                        reason: result.reason ?? 'Blocked by custom WASM governance rule (legacy code 2)',
+                        ruleId: rule.ruleId,
+                    };
+                case 3:
+                    if (!pendingReask) {
+                        pendingReask = {
+                            code: 'reask',
+                            reason: result.reason ?? 'Refused by custom WASM governance rule — revise and retry',
+                            ruleId: rule.ruleId,
+                        };
+                    }
+                    break;
+                default:
+                    log.warn({ action: 'wasm_unmapped_verdict', ruleId: rule.ruleId, code: result.code }, 'WASM rule returned an unmapped verdict code; allowing. Valid codes are 0 (allow), 1 (block), 3 (reask).');
+                    break;
+            }
+        }
+        return pendingReask ?? { code: 'allow' };
+    }
+    /**
+     * The referenced-files table for this evaluation (TD-441). With no
+     * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.
+     */
+    async prefetchReferencedFiles(input) {
+        const root = resolveRoot();
+        if (!root)
+            return ReferencedFiles.empty().toTable();
+        const files = await prefetch([{ name: input.toolName, arguments: input.toolArguments ?? {} }], root);
+        if (!files.isEmpty()) {
+            log.debug({ action: 'wasm_referenced_files', readable: files.readableCount(), table: files.describe() }, 'referenced files resolved for WASM rules');
+        }
+        return files.toTable();
+    }
+    /** One rule's evaluation, raced against `EVALUATE_TIMEOUT_MS`. `null` means fail-open (timeout, worker error, or guest trap). */
+    async evaluateOne(ruleId, contextBytes, files) {
+        const id = this.allocId();
+        const reply = await this.send({ type: 'evaluate', id, ruleId, bytes: toArrayBuffer(contextBytes), ...(files ? { files } : {}) }, EVALUATE_TIMEOUT_MS);
+        if (reply === null) {
+            // Timed out. Mirrors `runner.rs`'s `Err(_) => Bypass` — this call
+            // fails open — plus the MCP-specific per-rule consecutive-timeout
+            // disable ladder the task calls for.
+            log.warn({ action: 'wasm_evaluate_timeout', ruleId, timeoutMs: EVALUATE_TIMEOUT_MS }, 'WASM rule evaluation timed out — failing open');
+            const attempts = (this.consecutiveTimeouts.get(ruleId) ?? 0) + 1;
+            this.consecutiveTimeouts.set(ruleId, attempts);
+            // terminate + lazily respawn: the NEXT evaluate() call pays the
+            // respawn cost via ensureWorker()/rescan(force); triggered here so a
+            // wedged worker does not keep timing out every rule behind it in this
+            // same evaluate() loop.
+            await this.respawnWorker();
+            if (attempts >= MAX_CONSECUTIVE_TIMEOUTS) {
+                this.disabledRuleIds.add(ruleId);
+                log.warn({ action: 'wasm_rule_disabled', ruleId, consecutiveTimeouts: attempts }, 'WASM rule disabled after consecutive timeouts — will retry on the next policy-driven rescan');
+            }
+            return null;
+        }
+        if (!reply.ok) {
+            // Worker-reported failure: a guest trap (including one following an
+            // `abort` call) or an internal error. Fail-open ALLOW for this call,
+            // never a crash — matches the task's explicit instruction.
+            log.warn({ action: 'wasm_evaluate_error', ruleId, err: reply.error }, 'WASM rule evaluation failed — failing open');
+            return null;
+        }
+        // A clean reply resets this rule's timeout streak.
+        this.consecutiveTimeouts.delete(ruleId);
+        return { code: reply.code ?? -1, reason: reply.reason };
+    }
+    /** Terminates the worker. Safe to call even if one was never spawned. */
+    async shutdown() {
+        const worker = this.worker;
+        this.worker = null;
+        for (const [id, entry] of this.pending) {
+            clearTimeout(entry.timer);
+            entry.resolve({ ok: false, error: 'runner shut down' });
+            this.pending.delete(id);
+        }
+        if (worker)
+            await worker.terminate();
+    }
+}
+function toArrayBuffer(bytes) {
+    // Structured-clone (postMessage) needs an ArrayBuffer, not a Node Buffer
+    // view that may share a larger underlying pool — slice guarantees the
+    // bytes sent are exactly, and only, this rule's/context's own.
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+//# sourceMappingURL=runner.js.map

package/dist/wasm/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAA2C,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAyB,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AAExG,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;wDACwD;AACxD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC,wFAAwF;AACxF,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAYlC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAA;IAClG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,OAAO,UAAU;IACJ,MAAM,CAAY;IAC3B,MAAM,GAAkB,IAAI,CAAA;IAC5B,aAAa,GAAG,CAAC,CAAA;IACjB,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IAE3C,YAAY,WAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,uDAAuD;IACvD,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC7B,CAAC;IAED,yGAAyG;IACzG,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAkC,EAAE,EAAE;YAC1D,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAM;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAM,CAAC,gCAAgC;YACnD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IACxE,IAAI,CAAI,GAA6C,EAAE,SAAiB;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAA;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,EAAE,SAAS,CAAC,CAAA;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;QAC7B,IAAI,CAAC,aAAa,IAAI,CAAC,CAAA;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAiB;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAK1B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,kBAAkB,IAAI,EAAE,CAAA;QAC1F,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,WAAW,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACrF,CAAC,CAAC,uBAAuB,CAAA;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAA;QACpG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,KAAK,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAA;QAC5B,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAClC,CAAC;IAED,oIAAoI;IAC5H,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,kEAAkE;YAClE,0CAA0C;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACzB,CAAC;YACD,MAAM,GAAG,CAAC,SAAS,EAAE,CAAA;QACvB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,wEAAwE;IAExE;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzE,IAAI,YAAY,GAA6D,IAAI,CAAA;QAEjF,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE/G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC/G,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAQ,CAAC,iEAAiE;YAE/F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,CAAC;oBACJ,MAAK,CAAC,6BAA6B;gBACrC,KAAK,CAAC;oBACJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wCAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAClH,KAAK,CAAC;oBACJ,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,oCAAoC;oBACpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,+GAA+G,CAChH,CAAA;oBACD,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wDAAwD;wBACjF,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAA;gBACH,KAAK,CAAC;oBACJ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG;4BACb,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,2DAA2D;4BACpF,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAA;oBACH,CAAC;oBACD,MAAK;gBACP;oBACE,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC3E,yGAAyG,CAC1G,CAAA;oBACD,MAAK;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CAAC,KAAuB;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QACtJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;IAED,iIAAiI;IACzH,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,YAAoB,EACpB,KAA4B;QAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAC3B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjG,mBAAmB,CACpB,CAAA;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,kEAAkE;YAClE,kEAAkE;YAClE,qCAAqC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,+CAA+C,CAAC,CAAA;YACtI,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;YAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAC9C,gEAAgE;YAChE,qEAAqE;YACrE,sEAAsE;YACtE,wBAAwB;YACxB,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;YAC1B,IAAI,QAAQ,IAAI,wBAAwB,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAChC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EACvE,6FAA6F,CAC9F,CAAA;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,4CAA4C,CAAC,CAAA;YACnH,OAAO,IAAI,CAAA;QACb,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACzD,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzB,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;IACtC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}

package/dist/wasm/watch.d.ts

@@ -0,0 +1,5 @@
+export interface WasmDirWatcher {
+    close(): void;
+}
+export declare function watchWasmDir(dir: string, onChange: () => void | Promise<void>, debounceMs?: number): WasmDirWatcher | null;
+//# sourceMappingURL=watch.d.ts.map

package/dist/wasm/watch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/wasm/watch.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,IAAI,CAAA;CACd;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACpC,UAAU,SAAM,GACf,cAAc,GAAG,IAAI,CA6BvB"}

package/dist/wasm/watch.js

@@ -0,0 +1,54 @@
+/**
+ * Watch the local rules directory and call back, debounced, when a `.wasm`
+ * file appears, changes or goes away (TD-442).
+ *
+ * The rescan rides the 60-second policy tick (`policy.ts` `start(onTick)`)
+ * and no second timer was wanted. A filesystem watcher is not a timer: it
+ * costs nothing while nothing changes and fires within a second when
+ * something does, which is the ~5 s hot-reload the Rust proxy has
+ * (`registry.rs` `ensure_local_up_to_date`). The tick stays as the fallback
+ * for platforms where `fs.watch` misses events.
+ *
+ * A missing directory is not an error — the operator may never create it.
+ * The watcher is retried on every policy tick through `ensureWasmWatch`, so
+ * a directory created later is picked up without a restart.
+ */
+import * as node_fs from 'node:fs';
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+const log = createLogger('mcp-proxy-wasm-watch');
+export function watchWasmDir(dir, onChange, debounceMs = 500) {
+    if (!node_fs.existsSync(dir))
+        return null;
+    let timer = null;
+    let watcher;
+    try {
+        watcher = node_fs.watch(dir, { persistent: false }, (_event, filename) => {
+            if (filename && !String(filename).endsWith('.wasm'))
+                return;
+            if (timer)
+                clearTimeout(timer);
+            timer = setTimeout(() => {
+                timer = null;
+                Promise.resolve(onChange()).catch((err) => {
+                    log.warn({ action: 'wasm_watch_rescan_failed', err: err.message }, 'WASM rescan after a directory change failed');
+                });
+            }, debounceMs);
+            timer.unref();
+        });
+    }
+    catch (err) {
+        log.warn({ action: 'wasm_watch_unavailable', dir, err: err.message }, 'fs.watch unavailable for the WASM rules directory; the policy tick still rescans');
+        return null;
+    }
+    watcher.on('error', (err) => {
+        log.warn({ action: 'wasm_watch_error', dir, err: err.message }, 'WASM directory watcher errored; the policy tick still rescans');
+    });
+    return {
+        close() {
+            if (timer)
+                clearTimeout(timer);
+            watcher.close();
+        },
+    };
+}
+//# sourceMappingURL=watch.js.map

package/dist/wasm/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../src/wasm/watch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAOhD,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,QAAoC,EACpC,UAAU,GAAG,GAAG;IAEhB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,KAAK,GAA0B,IAAI,CAAA;IACvC,IAAI,OAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YACvE,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAM;YAC3D,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC9B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,KAAK,GAAG,IAAI,CAAA;gBACZ,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,6CAA6C,CAAC,CAAA;gBAC9H,CAAC,CAAC,CAAA;YACJ,CAAC,EAAE,UAAU,CAAC,CAAA;YACd,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,kFAAkF,CAAC,CAAA;QACpK,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,+DAA+D,CAAC,CAAA;IAClI,CAAC,CAAC,CAAA;IACF,OAAO;QACL,KAAK;YACH,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC9B,OAAO,CAAC,KAAK,EAAE,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/wasm/worker.d.ts

@@ -0,0 +1,39 @@
+/**
+ * wasm/worker.ts — The ONE dedicated `worker_threads` worker hosting every
+ * compiled WASM governance rule.
+ *
+ * Runs in its own thread (spawned by `wasm/runner.ts`). Owns a
+ * `Map<ruleId, WebAssembly.Module>` — compiled ONCE per file and cached here
+ * — but instantiates a FRESH `WebAssembly.Instance` (fresh guest memory) for
+ * every `evaluate` message, mirroring the Rust runner's actual per-evaluation
+ * `Store` and preventing any cross-request state leakage between calls that
+ * happen to share a rule.
+ *
+ * Protocol (see `runner.ts` for the main-thread side):
+ *   compile  { type:'compile',  id, ruleId, bytes }  -> { type:'compile-result',  id, ruleId, ok, unsupportedImports?, readsReferencedFiles?, error? }
+ *   remove   { type:'remove', ruleId }                  (no reply)
+ *   evaluate { type:'evaluate', id, ruleId, bytes, files? } -> { type:'evaluate-result', id, ruleId, ok, code?, reason?, error? }
+ *
+ * `files` is the per-evaluation referenced-files table (TD-441), posted only
+ * to a rule that imports `read_referenced_file`; it is rebuilt here into the
+ * host-import state, so the main thread never shares memory with the guest.
+ *
+ * A guest `abort` call is inert (hostImports.ts logs and returns); an
+ * uncaught exception or trap during instantiation/evaluation is caught here
+ * and reported as `ok:false` — the caller (runner.ts) treats that as
+ * fail-open ALLOW, exactly like a timeout, never a crash.
+ *
+ * @module
+ */
+/**
+ * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits` (TD-440). V8 offers
+ * no grow hook on a memory the module itself exports and `unsupportedWasmImports`
+ * refuses an imported one, so this is enforced AFTER the call: a rule whose
+ * memory grew past the ceiling has its verdict discarded and reported as a
+ * failure (fail-open, like a trap), rather than being stopped mid-growth.
+ * What it cannot do is bound the growth itself; that remainder stays in
+ * TD-440. Checked before the call too, so a module that declares more than
+ * the ceiling as its initial size never runs.
+ */
+export declare const MAX_GUEST_MEMORY_BYTES: number;
+//# sourceMappingURL=worker.d.ts.map

package/dist/wasm/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAA"}