@melaya/runner 1.0.117 → 1.1.0

package/dist/codeWorker.js

@@ -0,0 +1,538 @@
+// packages/runner/src/codeWorker.ts
+//
+// Melaya Browser, Phase 1/2 (plan Sections 0.7 and 9): OS-isolated code
+// worker for model-authored JS ("code mode", the /browser/run endpoint).
+//
+// node:vm alone is NOT a security boundary (plan 0.7). The model script
+// therefore runs in a SEPARATE child OS process with, per platform, the
+// tightest sandbox the OS gives us without native modules:
+//
+//   Linux:   bubblewrap (`bwrap`) when installed: --unshare-all (new
+//            user/net/pid/ipc/uts/cgroup namespaces -> NO network, no
+//            host pids), read-only /usr /lib binds, the per-run scratch
+//            dir as the only writable path, --die-with-parent.
+//            Memory cap: bwrap rlimit (--rlimit AS=<bytes>) + Node
+//            --max-old-space-size flag enforced from outside the script.
+//            CPU cap: bwrap does not expose rlimit CPU directly; the
+//            parent wall-clock timer issues SIGKILL on breach.
+//            Fallback without bwrap: plain child + Node permission
+//            model (below); memory cap via --max-old-space-size + the
+//            wall-clock SIGKILL; network denial is then NOT OS-enforced
+//            (documented limitation surfaced in the result).
+//   macOS:   sandbox-exec with a deny-default Seatbelt profile:
+//            (deny default), (deny network*), file reads restricted to
+//            Node runtime paths, file writes only under the scratch dir.
+//            Memory cap: `ulimit -v <kb>` shell wrapper around the
+//            sandbox-exec invocation, plus --max-old-space-size.
+//            CPU cap: `ulimit -t <seconds>` hard CPU-time limit in the
+//            same shell wrapper.
+//            sandbox-exec is deprecated by Apple but still functional
+//            and is what Chrome/Safari helpers use under the hood.
+//            HONEST LIMIT on macOS: ulimit -v caps virtual address
+//            space (not RSS) and can be hit before the real heap
+//            limit on some Node versions. Combined with --max-old-space
+//            the effective memory pressure is bounded.
+//   Windows: NO practical restricted-token/Job-Object API is reachable
+//            from pure Node without a native addon. The child gets: a
+//            sanitized environment (NO MEL_* / tokens / cloud creds),
+//            no shell, windowsHide, only stdio fds inherited, plus the
+//            Node permission model (fs restricted to the scratch dir,
+//            child-process + worker spawning denied), and
+//            --max-old-space-size as the heap cap. HONEST LIMIT:
+//            on Windows, direct outbound sockets from a vm-escaped
+//            script are NOT OS-blocked; compensating controls are the
+//            sanitized env (nothing to exfiltrate), the parent-side
+//            resource caps, and the facade-only IPC (no page/CDP/fetch
+//            handles ever cross the boundary). Job Object memory capping
+//            requires a native addon; the --max-old-space-size flag
+//            provides a partial compensating control.
+//
+//   All platforms additionally get, on Node >= 20, the Node permission
+//   model (--experimental-permission / --permission): fs read/write
+//   limited to the scratch dir, child_process and worker_threads denied.
+//
+// The script sees ONLY a typed governed facade proxied over stdio IPC
+// (newline-delimited JSON). Every facade op is validated, authorized
+// (origin policy + effect ceiling) and traced BY THE PARENT before it
+// touches the browser. Raw page / locator / cdp / fetch handles never
+// exist inside the worker (plan Section 9).
+//
+// External resource enforcement lives in the PARENT (this module): wall
+// clock, op count, per-op arg size, console line count, total output
+// bytes, screenshot count, navigation count. Breach -> SIGKILL with
+// kill verification (poll for exit; escalate; report kill_unverified if
+// the OS will not confirm death).
+import { spawn } from "node:child_process";
+import { writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+export const DEFAULT_LIMITS = {
+    wallClockMs: 60_000,
+    maxOps: 40,
+    maxArgBytes: 32 * 1024,
+    maxConsoleLines: 200,
+    maxOutputBytes: 4 * 1024 * 1024,
+    maxScreenshots: 4,
+    maxNavigations: 10,
+    maxMemoryMb: 256,
+    maxCpuSeconds: 60,
+};
+/** Ops the worker may request. Screenshot/navigation kinds get their own
+ *  counters. Anything not listed is rejected without reaching the facade. */
+const WORKER_OP_ALLOWLIST = new Set([
+    "current_target",
+    "get_screen_tree",
+    "screenshot",
+    "act",
+    "wait",
+]);
+// ---------------------------------------------------------------------
+// Worker entry source (self-contained CJS written into the scratch dir)
+// ---------------------------------------------------------------------
+//
+// The model script runs inside node:vm here purely as a CONTAINMENT AID
+// (undefined globals, no require/process in scope) — the security
+// boundary is the process + OS sandbox around it. The vm context exposes
+// exactly: browser.<op>(), console.log/warn/error, sleep(ms), and
+// JSON/Math/Date via the fresh realm.
+const WORKER_ENTRY_SOURCE = `"use strict";
+const vm = require("node:vm");
+const readline = require("node:readline");
+
+let seq = 0;
+const pending = new Map();
+function send(msg) { process.stdout.write(JSON.stringify(msg) + "\\n"); }
+
+const rl = readline.createInterface({ input: process.stdin, terminal: false });
+let scriptSource = null;
+rl.on("line", (line) => {
+  let m;
+  try { m = JSON.parse(line); } catch { return; }
+  if (m.type === "start" && typeof m.script === "string" && scriptSource === null) {
+    scriptSource = m.script;
+    run(scriptSource);
+  } else if (m.type === "op_result" && pending.has(m.id)) {
+    const { resolve, reject } = pending.get(m.id);
+    pending.delete(m.id);
+    if (m.ok) resolve(m.result);
+    else reject(new Error(m.error || "op failed"));
+  }
+});
+
+function facadeOp(op) {
+  return (args) => new Promise((resolve, reject) => {
+    const id = ++seq;
+    pending.set(id, { resolve, reject });
+    send({ type: "op", id, op, args: args && typeof args === "object" ? args : {} });
+  });
+}
+
+async function run(source) {
+  const browser = Object.freeze({
+    currentTarget: facadeOp("current_target"),
+    getScreenTree: facadeOp("get_screen_tree"),
+    screenshot: facadeOp("screenshot"),
+    act: facadeOp("act"),
+    wait: facadeOp("wait"),
+  });
+  const consoleShim = {
+    log: (...a) => send({ type: "console", line: a.map(String).join(" ") }),
+    warn: (...a) => send({ type: "console", line: "[warn] " + a.map(String).join(" ") }),
+    error: (...a) => send({ type: "console", line: "[error] " + a.map(String).join(" ") }),
+  };
+  const sleep = (ms) => facadeOp("wait")({ ms });
+  const ctx = vm.createContext(Object.create(null), { codeGeneration: { strings: false, wasm: false } });
+  ctx.browser = browser;
+  ctx.console = consoleShim;
+  ctx.sleep = sleep;
+  ctx.JSON = JSON;
+  try {
+    const script = new vm.Script(
+      "(async () => {\\n" + source + "\\n})()",
+      { filename: "model-script.js" },
+    );
+    const result = await script.runInContext(ctx, { timeout: 30000 });
+    send({ type: "done", result: safeJson(result) });
+  } catch (e) {
+    send({ type: "error", message: String((e && e.message) || e) });
+  }
+  process.exit(0);
+}
+
+function safeJson(v) {
+  try { return JSON.parse(JSON.stringify(v === undefined ? null : v)); }
+  catch { return String(v); }
+}
+`;
+function nodePermissionFlags(scratchDir, entryPath) {
+    const major = Number(process.version.replace(/^v/, "").split(".")[0]) || 0;
+    if (major < 20)
+        return [];
+    const flag = major >= 23 ? "--permission" : "--experimental-permission";
+    return [
+        flag,
+        `--allow-fs-read=${scratchDir}`,
+        `--allow-fs-read=${entryPath}`,
+        `--allow-fs-write=${scratchDir}`,
+        // NOT granted: --allow-child-process, --allow-worker, --allow-addons
+    ];
+}
+function buildSandboxedCommand(scratchDir, entryPath, limits) {
+    const memMb = Math.min(Math.max(64, limits.maxMemoryMb), 512);
+    const cpuSec = Math.min(Math.max(10, limits.maxCpuSeconds), 300);
+    // --max-old-space-size caps the V8 heap on every platform.
+    const nodeArgs = [
+        `--max-old-space-size=${memMb}`,
+        ...nodePermissionFlags(scratchDir, entryPath),
+        entryPath,
+    ];
+    const nodeBin = process.execPath;
+    if (process.platform === "linux") {
+        const bwrap = ["/usr/bin/bwrap", "/usr/local/bin/bwrap"].find((p) => existsSync(p));
+        if (bwrap) {
+            const roBinds = [];
+            for (const p of ["/usr", "/lib", "/lib64", "/etc/ssl", "/etc/resolv.conf", "/bin", "/sbin", "/opt"]) {
+                if (existsSync(p))
+                    roBinds.push("--ro-bind", p, p);
+            }
+            // Bind the node binary's own prefix in case it lives outside /usr
+            // (nvm installs under $HOME): read-only, binary only.
+            roBinds.push("--ro-bind", nodeBin, nodeBin);
+            // RLIMIT_AS caps virtual address space in bytes. bwrap expects two
+            // separate tokens: "--rlimit" "RLIMIT_AS=SOFT:HARD". Setting soft
+            // and hard to the same value makes it a hard cap. 4x the V8 heap
+            // limit gives the JS runtime enough headroom for compiled code,
+            // mapped shared libraries, and stack without being so generous
+            // that a leak can thrash the host.
+            // HONEST LIMIT: bwrap versions before ~0.4 may not support
+            // --rlimit. The spawn call will throw ENOENT/EINVAL if the bwrap
+            // binary is too old; the parent catches that and reports
+            // worker_spawn_failed. Operators on older distros should upgrade
+            // bubblewrap (typically available as `bubblewrap` or `bwrap` in
+            // the distro package manager).
+            const asBytes = memMb * 4 * 1024 * 1024;
+            return {
+                cmd: bwrap,
+                args: [
+                    "--unshare-all", // includes --unshare-net: NO network
+                    "--die-with-parent",
+                    "--new-session",
+                    "--proc", "/proc",
+                    "--dev", "/dev",
+                    "--tmpfs", "/tmp",
+                    ...roBinds,
+                    "--bind", scratchDir, scratchDir,
+                    "--chdir", scratchDir,
+                    "--setenv", "HOME", scratchDir,
+                    // bwrap --rlimit syntax: RESOURCE_NAME=SOFT:HARD
+                    "--rlimit", `RLIMIT_AS=${asBytes}:${asBytes}`,
+                    nodeBin,
+                    ...nodeArgs,
+                ],
+                sandbox: "bubblewrap",
+            };
+        }
+        return { cmd: nodeBin, args: nodeArgs, sandbox: "node-permission-only" };
+    }
+    if (process.platform === "darwin") {
+        if (existsSync("/usr/bin/sandbox-exec")) {
+            // Deny-default Seatbelt profile (hardened from the previous version):
+            //   deny default          -- deny everything not explicitly allowed.
+            //   deny network*         -- no outbound or inbound connections.
+            //   deny file-read*       -- then re-allow only what Node needs.
+            //   deny file-write*      -- then re-allow only the scratch dir.
+            //
+            // File-read allowances for the node runtime: the binary itself, the
+            // dyld shared cache (macOS system library mmap), /System/Library for
+            // Foundation and CoreFoundation, /usr/lib for libSystem, and
+            // /private/var/folders/* for the OS's temp-file area (used by Node
+            // internally). The scratch dir is allowed for both read and write.
+            //
+            // HONEST LIMIT: sandbox-exec is deprecated (Apple may remove it in a
+            // future macOS) but remains functional on all current macOS releases.
+            // The node dyld shared cache path varies by macOS version; the
+            // /System/Volumes/Preboot allowance covers macOS 13+.
+            const nodeDir = nodeBin.replace(/\/[^/]+$/, "");
+            const profile = [
+                "(version 1)",
+                "(deny default)",
+                "(deny network*)",
+                // Allow the node binary and its directory (npm installs siblings).
+                `(allow file-read* (literal "${nodeBin}"))`,
+                `(allow file-read* (subpath "${nodeDir}"))`,
+                // Node's own scratch dir: full read/write.
+                `(allow file-read* (subpath "${scratchDir}"))`,
+                `(allow file-write* (subpath "${scratchDir}"))`,
+                // macOS system libraries and dyld shared cache.
+                "(allow file-read* (subpath \"/System/Library\"))",
+                "(allow file-read* (subpath \"/System/Volumes\"))",
+                "(allow file-read* (subpath \"/usr/lib\"))",
+                "(allow file-read* (subpath \"/usr/local/lib\"))",
+                "(allow file-read* (literal \"/dev/null\"))",
+                "(allow file-write* (literal \"/dev/null\"))",
+                "(allow file-read* (literal \"/dev/urandom\"))",
+                "(allow file-read* (literal \"/dev/random\"))",
+                // OS-managed temp area (Node uses this for some internal paths).
+                "(allow file-read* (subpath \"/private/var/folders\"))",
+                "(allow file-write* (subpath \"/private/var/folders\"))",
+                // process and mach primitives needed by dyld and the Node runtime.
+                "(allow process-exec (literal \"/usr/bin/env\"))",
+                `(allow process-exec (literal "${nodeBin}"))`,
+                "(allow sysctl-read)",
+                "(allow mach-lookup)",
+                "(allow ipc-posix-shm-read-data)",
+                "(allow ipc-posix-shm-write-data)",
+            ].join("\n");
+            // Memory and CPU caps via a shell `ulimit` wrapper around sandbox-exec.
+            // ulimit -v: virtual address space in KB (4x heap for runtime headroom).
+            // ulimit -t: hard CPU time in seconds.
+            // We use /bin/sh -c "ulimit ...; exec sandbox-exec ..." so both limits
+            // apply before the Node process starts. This is a soft-then-hard pair;
+            // SIGKILL from the parent wall-clock timer is the backstop.
+            const asKb = memMb * 4 * 1024;
+            const shellCmd = `ulimit -v ${asKb} -t ${cpuSec}; exec /usr/bin/sandbox-exec -p '${profile.replace(/'/g, "'\\''")}' ${JSON.stringify(nodeBin)} ${nodeArgs.map((a) => JSON.stringify(a)).join(" ")}`;
+            return {
+                cmd: "/bin/sh",
+                args: ["-c", shellCmd],
+                sandbox: "seatbelt",
+            };
+        }
+        // No sandbox-exec: fall back to permission model + ulimit wrapper.
+        const asKb = memMb * 4 * 1024;
+        const shellCmd = `ulimit -v ${asKb} -t ${cpuSec}; exec ${JSON.stringify(nodeBin)} ${nodeArgs.map((a) => JSON.stringify(a)).join(" ")}`;
+        return {
+            cmd: "/bin/sh",
+            args: ["-c", shellCmd],
+            sandbox: "node-permission-only",
+        };
+    }
+    // Windows: sanitized env + permission model only (see header).
+    // --max-old-space-size (already in nodeArgs) is the only heap cap
+    // without a native addon. HONEST LIMIT: OS-level memory enforcement
+    // requires a Job Object, which is not reachable from pure Node.
+    const major = Number(process.version.replace(/^v/, "").split(".")[0]) || 0;
+    return {
+        cmd: nodeBin,
+        args: nodeArgs,
+        sandbox: major >= 20 ? "node-permission-only" : "none",
+    };
+}
+/** Minimal, secret-free environment. NO MEL_* names, no tokens, no
+ *  inherited operator env. Windows needs SystemRoot for node to boot. */
+function sanitizedEnv(scratchDir) {
+    const env = {
+        TMPDIR: scratchDir,
+        TEMP: scratchDir,
+        TMP: scratchDir,
+        HOME: scratchDir,
+        USERPROFILE: scratchDir,
+        NODE_OPTIONS: "",
+        NO_COLOR: "1",
+    };
+    if (process.platform === "win32") {
+        env["SystemRoot"] = process.env["SystemRoot"] || "C:\\Windows";
+        env["PATH"] = env["SystemRoot"] + "\\System32";
+    }
+    else {
+        env["PATH"] = "/usr/bin:/bin";
+    }
+    return env;
+}
+// ---------------------------------------------------------------------
+// Runner
+// ---------------------------------------------------------------------
+export async function runSandboxedScript(opts) {
+    const limits = { ...DEFAULT_LIMITS, ...(opts.limits || {}) };
+    limits.wallClockMs = Math.min(limits.wallClockMs, 180_000);
+    const log = opts.log ?? (() => { });
+    const consoleLines = [];
+    const traces = [];
+    mkdirSync(opts.scratchDir, { recursive: true });
+    const entryPath = join(opts.scratchDir, "melaya-code-worker.cjs");
+    writeFileSync(entryPath, WORKER_ENTRY_SOURCE, "utf-8");
+    const { cmd, args, sandbox } = buildSandboxedCommand(opts.scratchDir, entryPath, limits);
+    let child;
+    try {
+        child = spawn(cmd, args, {
+            cwd: opts.scratchDir,
+            env: sanitizedEnv(opts.scratchDir),
+            // ONLY stdio pipes are inherited; Node does not pass extra fds
+            // unless they are listed here, which closes the inherited-fd
+            // channel (plan 0.7).
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+            detached: false,
+            shell: false,
+        });
+    }
+    catch (e) {
+        return {
+            ok: false, console: [], traces, sandbox, killVerified: true,
+            error: { code: "worker_spawn_failed", message: String(e?.message || e) },
+        };
+    }
+    let opCount = 0;
+    let screenshotCount = 0;
+    let navCount = 0;
+    let outputBytes = 0;
+    let settled = false;
+    let killVerified = true;
+    let breach = null;
+    const result = await new Promise((resolve) => {
+        const finish = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(wallTimer);
+            void killAndVerify();
+            resolve({ ...r, console: consoleLines, traces, sandbox, killVerified });
+        };
+        const killAndVerify = async () => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return;
+            try {
+                child.kill();
+            }
+            catch { /* already gone */ }
+            await delay(1500);
+            if (child.exitCode === null && child.signalCode === null) {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch { /* already gone */ }
+                await delay(1500);
+                if (child.exitCode === null && child.signalCode === null) {
+                    killVerified = false;
+                    log(`code worker pid=${child.pid} did not confirm death after SIGKILL`);
+                }
+            }
+        };
+        const wallTimer = setTimeout(() => {
+            breach = { code: "wall_clock_exceeded", message: `script exceeded ${limits.wallClockMs}ms wall clock` };
+            finish({ ok: false, error: breach });
+        }, limits.wallClockMs);
+        child.on("error", (e) => {
+            finish({ ok: false, error: { code: "worker_error", message: e.message } });
+        });
+        child.on("exit", (code, signal) => {
+            if (!settled) {
+                finish({
+                    ok: false,
+                    error: { code: "worker_exited", message: `worker exited early (code=${code}, signal=${signal}) without a result` },
+                });
+            }
+        });
+        child.stderr?.on("data", (d) => {
+            outputBytes += d.length;
+            // Permission-model warnings etc. — keep for verbose diagnosis only.
+            log(`[code-worker stderr] ${d.toString().trim().slice(0, 500)}`);
+        });
+        const rl = createInterface({ input: child.stdout, terminal: false });
+        rl.on("line", (line) => {
+            outputBytes += Buffer.byteLength(line);
+            if (outputBytes > limits.maxOutputBytes) {
+                breach = { code: "output_cap_exceeded", message: `worker output exceeded ${limits.maxOutputBytes} bytes` };
+                finish({ ok: false, error: breach });
+                return;
+            }
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                return;
+            }
+            if (msg.type === "console") {
+                if (consoleLines.length < limits.maxConsoleLines) {
+                    consoleLines.push(String(msg.line ?? "").slice(0, 2000));
+                }
+                return;
+            }
+            if (msg.type === "done") {
+                finish({ ok: true, result: msg.result });
+                return;
+            }
+            if (msg.type === "error") {
+                finish({ ok: false, error: { code: "script_error", message: String(msg.message ?? "script failed").slice(0, 2000) } });
+                return;
+            }
+            if (msg.type === "op") {
+                void handleOp(msg);
+                return;
+            }
+        });
+        const handleOp = async (msg) => {
+            const id = Number(msg.id);
+            const op = String(msg.op ?? "");
+            const args = (msg.args && typeof msg.args === "object" ? msg.args : {});
+            const reply = (ok, resultOrError) => {
+                try {
+                    child.stdin?.write(JSON.stringify(ok ? { type: "op_result", id, ok: true, result: resultOrError }
+                        : { type: "op_result", id, ok: false, error: String(resultOrError) }) + "\n");
+                }
+                catch { /* child died; exit handler resolves */ }
+            };
+            // Parent-side enforcement gates (op count, allowlist, arg size,
+            // per-kind counters) BEFORE the facade ever sees the op.
+            opCount += 1;
+            if (opCount > limits.maxOps) {
+                breach = { code: "op_cap_exceeded", message: `script exceeded ${limits.maxOps} governed ops` };
+                finish({ ok: false, error: breach });
+                return;
+            }
+            if (!WORKER_OP_ALLOWLIST.has(op)) {
+                reply(false, `op '${op}' is not in the worker allowlist`);
+                return;
+            }
+            if (Buffer.byteLength(JSON.stringify(args)) > limits.maxArgBytes) {
+                reply(false, `op args exceed ${limits.maxArgBytes} bytes`);
+                return;
+            }
+            if (op === "screenshot") {
+                screenshotCount += 1;
+                if (screenshotCount > limits.maxScreenshots) {
+                    reply(false, `screenshot cap (${limits.maxScreenshots}) exceeded`);
+                    return;
+                }
+            }
+            if (op === "act" && String(args["kind"] ?? "") === "navigate") {
+                navCount += 1;
+                if (navCount > limits.maxNavigations) {
+                    reply(false, `navigation cap (${limits.maxNavigations}) exceeded`);
+                    return;
+                }
+            }
+            if (op === "wait") {
+                const ms = Math.min(Math.max(0, Number(args["ms"] ?? 0)), 10_000);
+                args["ms"] = ms;
+            }
+            const started = Date.now();
+            const seq = traces.length + 1;
+            try {
+                const out = await opts.facade(op, args);
+                const t = { seq, op, ok: true, ms: Date.now() - started };
+                traces.push(t);
+                opts.onTrace?.(t);
+                reply(true, out);
+            }
+            catch (e) {
+                const t = { seq, op, ok: false, ms: Date.now() - started, error: String(e?.message || e).slice(0, 500) };
+                traces.push(t);
+                opts.onTrace?.(t);
+                reply(false, t.error);
+            }
+        };
+        // Ship the script AFTER handlers are wired. The script goes over
+        // stdin — never argv (visible in process lists) or env.
+        try {
+            child.stdin?.write(JSON.stringify({ type: "start", script: opts.script }) + "\n");
+        }
+        catch (e) {
+            finish({ ok: false, error: { code: "worker_write_failed", message: String(e?.message || e) } });
+        }
+    });
+    return result;
+}
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}