@miphamai/cli 0.15.0 → 0.16.1

package/src/ui/strip-indent.ts

@@ -0,0 +1,19 @@
+/**
+ * Template literal tag that strips leading indentation from multi-line strings.
+ * Used by slash command handlers to format help text and status messages.
+ */
+export function stripIndent(strings: TemplateStringsArray, ...values: unknown[]): string {
+  let result = strings.reduce((acc, s, i) => acc + s + (values[i] ?? ''), '')
+  // Remove leading newline
+  result = result.replace(/^\n/, '')
+  // Find minimum indent
+  const match = result.match(/^( +)/m)
+  if (match?.[1]) {
+    const indent = match[1].length
+    result = result
+      .split('\n')
+      .map((line) => line.slice(indent))
+      .join('\n')
+  }
+  return result.trim()
+}

package/src/workflow/runtime.ts

@@ -1,3 +1,4 @@
+import vm from 'node:vm'
 import { createSandbox } from './sandbox'
 import { createJournal, appendJournal, loadJournal, loadScript } from './journal'
 import { createBudget } from './budget'
@@ -47,7 +48,8 @@ function agentCacheKey(prompt: string, opts: Record<string, unknown> = {}): stri
  *   - Returns cacheHits and cacheMisses counts
  *
  * The sandbox blocks non-deterministic APIs (Date.now, Math.random) to make
- * this deterministic replay possible.
+ * this deterministic replay possible. Scripts execute inside a node:vm.Context
+ * that blocks sandbox escape vectors (eval, Function, import, require, process, etc.).
  */
 export async function runWorkflow(
   script: string,
@@ -134,42 +136,38 @@ export async function runWorkflow(
     appendJournal(runId, { type: 'log', message })
   }
 
-  const sandbox = createSandbox(args, budget)
-
   // Build the script wrapper
   const wrappedScript = `
-    return (async () => {
+    (async () => {
       ${script}
     })()
   `
 
-  // Execute in sandboxed context
-  const scriptFn = new Function(
-    'agent',
-    'parallel',
-    'pipeline',
-    'verify',
-    'judge',
-    'loopUntilConvergence',
-    'phase',
-    'log',
-    'args',
-    'budget',
-    wrappedScript,
-  )
-
-  const result = await scriptFn(
-    agent,
-    parallel,
-    pipeline,
-    verify,
-    judge,
-    loopUntilConvergence,
-    wrappedPhase,
-    log,
-    args,
-    budget,
-  )
+  // Execute in node:vm sandbox — no access to host globals
+  const vmScript = new vm.Script(wrappedScript, { filename: 'workflow.js' })
+  const sandboxCtx = createSandbox(args, budget)
+
+  // Inject primitives into the sandbox context (whitelist approach)
+  sandboxCtx.agent = agent
+  sandboxCtx.parallel = parallel
+  sandboxCtx.pipeline = pipeline
+  sandboxCtx.verify = verify
+  sandboxCtx.judge = judge
+  sandboxCtx.loopUntilConvergence = loopUntilConvergence
+  sandboxCtx.phase = wrappedPhase
+  sandboxCtx.log = log
+
+  let result: unknown
+  try {
+    result = await vmScript.runInContext(sandboxCtx, { timeout: 120_000 })
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    throw new Error(
+      `Workflow script execution failed: ${message}\n\n` +
+        `This is likely a bug in the workflow script, not in Mipham Code itself. ` +
+        `Check the script for syntax errors, undefined references, or unhandled promise rejections.`,
+    )
+  }
 
   // Count journal entries from state
   const priorEntries = loadJournal(runId)

package/src/workflow/sandbox.ts

@@ -1,27 +1,39 @@
-/** APIs disabled in workflow scripts to ensure deterministic replay. */
+import vm from 'node:vm'
+
+/** APIs disabled in workflow scripts to ensure deterministic replay + sandbox escape prevention. */
 const FORBIDDEN = new Set(['Date.now', 'Math.random', 'crypto.randomUUID'])
 
 /**
- * Create a sandboxed global scope for workflow script execution.
- * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID().
+ * Create a sandboxed VM context for workflow script execution.
+ * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID(),
+ * plus explicit sandbox escape vectors: eval, Function constructor, import(),
+ * require(), process, Bun, fetch, setTimeout/setInterval, etc.
  */
 export function createSandbox(
   args: unknown,
   budget: { total: number | null; spent(): number; remaining(): number },
-): Record<string, unknown> {
-  const sandbox: Record<string, unknown> = {
+): vm.Context {
+  const sandboxObj: Record<string, unknown> = {
     args,
     budget,
     console: {
       log: (..._a: unknown[]) => {}, // no-op in sandbox
       error: (..._a: unknown[]) => {},
     },
-    // Primitives are injected by the runtime, not the sandbox
+
+    // ── Explicit sandbox escape prevention ──
+    // V8 builtins that would otherwise be available in a vm.Context
+    eval: () => {
+      throw new Error('eval() is disabled in workflow sandbox.')
+    },
+    Function: () => {
+      throw new Error('new Function() is disabled in workflow sandbox.')
+    },
   }
 
   // Override Date to block now() and argless constructor
   const OriginalDate = Date
-  sandbox.Date = new Proxy(OriginalDate, {
+  sandboxObj.Date = new Proxy(OriginalDate, {
     construct(_target, constructorArgs) {
       if (constructorArgs.length === 0) {
         throw new Error('new Date() is disabled in workflow sandbox. Pass timestamps via args.')
@@ -42,7 +54,7 @@ export function createSandbox(
   })
 
   // Override Math.random
-  sandbox.Math = new Proxy(Math, {
+  sandboxObj.Math = new Proxy(Math, {
     get(_target, prop) {
       if (prop === 'random') {
         throw new Error('Math.random() is disabled in workflow sandbox. Use a seed from args.')
@@ -57,7 +69,7 @@ export function createSandbox(
     | { randomUUID?: unknown; [key: string]: unknown }
     | undefined
   if (globalCrypto) {
-    sandbox.crypto = new Proxy(globalCrypto, {
+    sandboxObj.crypto = new Proxy(globalCrypto, {
       get(_target, prop) {
         if (prop === 'randomUUID') {
           throw new Error('crypto.randomUUID() is disabled in workflow sandbox.')
@@ -70,7 +82,7 @@ export function createSandbox(
     })
   }
 
-  return sandbox
+  return vm.createContext(sandboxObj)
 }
 
 /** Check whether a given API identifier is in the forbidden set. */