@namzu/sdk 35.0.0 → 37.0.0

package/src/execution/code-runtime/worker-program.ts

@@ -0,0 +1,239 @@
+/**
+ * Trusted worker bootstrap. Only vm.evalCode executes the untrusted program.
+ * Kept as source so installed/bundled SDKs need no separate worker entry file.
+ * No Node object or callback is injected into QuickJS: its native functions
+ * exchange bounded strings and interpreter-owned promise handles.
+ */
+export const QUICKJS_WORKER_SOURCE = `
+const { parentPort, workerData } = require('node:worker_threads')
+const { newQuickJSWASMModuleFromVariant, newVariant } = require(workerData.corePath)
+const variantModule = require(workerData.variantPath)
+const variant = variantModule.default || variantModule
+
+async function main() {
+	const limits = workerData.limits
+	const pages = Math.floor(limits.memoryLimitBytes / 65536)
+	const wasmMemory = new WebAssembly.Memory({ initial: Math.min(256, pages), maximum: pages })
+	const module = await newQuickJSWASMModuleFromVariant(newVariant(variant, { wasmMemory }))
+	const runtime = module.newRuntime()
+	runtime.setMemoryLimit(limits.memoryLimitBytes)
+	runtime.setMaxStackSize(512 * 1024)
+	runtime.setInterruptHandler(() => Date.now() >= workerData.deadline)
+	const vm = runtime.newContext()
+	const pending = new Map()
+	let nextId = 0
+	let printBytes = 0
+	let printCount = 0
+	let truncated = false
+	let ended = false
+	let pumping = false
+	let scheduled = false
+	let program
+	const owned = []
+
+	function keep(result) {
+		const handle = vm.unwrapResult(result)
+		owned.push(handle)
+		return handle
+	}
+	// Capture intrinsics before the program may replace its own globals.
+	const encode = keep(vm.evalCode('(' + function () {
+		const stringify = JSON.stringify
+		const finite = Number.isFinite
+		const prototype = Object.getPrototypeOf
+		const plain = Object.prototype
+		const isArray = Array.isArray
+		const keys = Object.keys
+		const descriptor = Object.getOwnPropertyDescriptor
+		return function (value) {
+			if (value === undefined) return undefined
+			const parents = new Set()
+			function check(item, depth) {
+				const kind = typeof item
+				if (item === null || kind === 'string' || kind === 'boolean' || (kind === 'number' && finite(item))) return
+				if (kind !== 'object' || depth > 64 || parents.has(item)) throw new Error('Code runtime values must be JSON-safe.')
+				if (!isArray(item) && prototype(item) !== plain && prototype(item) !== null) throw new Error('Code runtime values must use plain objects and arrays.')
+				parents.add(item)
+				for (const key of keys(item)) {
+					const property = descriptor(item, key)
+					if (!property || !('value' in property)) throw new Error('Code runtime values must not contain accessors.')
+					check(property.value, depth + 1)
+				}
+				parents.delete(item)
+			}
+			check(value, 0)
+			return stringify(value)
+		}
+	}.toString() + ')()'))
+	const decode = keep(vm.evalCode('(function () { const parse = JSON.parse; return function(value) { return parse(value); }; })()'))
+	const errorText = keep(vm.evalCode('(function () { const string = String; return function(error) { try { return typeof error.message === "string" ? error.message : string(error); } catch { return "The program failed."; } }; })()'))
+
+	function textValue(handle, maximum) {
+		const length = vm.getProp(handle, 'length')
+		try {
+			if (vm.getNumber(length) > maximum) throw new Error('Code runtime value exceeds ' + maximum + ' bytes.')
+		} finally { length.dispose() }
+		const text = vm.getString(handle)
+		if (Buffer.byteLength(text) > maximum) throw new Error('Code runtime value exceeds ' + maximum + ' bytes.')
+		return text
+	}
+	function serialize(handle, maximum) {
+		if (vm.typeof(handle) === 'undefined') return undefined
+		const encoded = vm.callFunction(encode, vm.undefined, handle)
+		if (encoded.error) {
+			encoded.error.dispose()
+			throw new Error('Code runtime values must be JSON-safe and serializable.')
+		}
+		try { return textValue(encoded.value, maximum) }
+		finally { encoded.value.dispose() }
+	}
+	function failureText(handle) {
+		const result = vm.callFunction(errorText, vm.undefined, handle)
+		if (result.error) { result.error.dispose(); return 'The program failed.' }
+		// Diagnostics have their own fixed bound. A deliberately tiny data
+		// allowance must not erase the reason or the no-replay guidance for an
+		// effect that completed but whose return value could not be delivered.
+		try { return textValue(result.value, 4096) }
+		catch { return 'The program failed with an oversized error.' }
+		finally { result.value.dispose() }
+	}
+	function dispose() {
+		for (const deferred of pending.values()) deferred.dispose()
+		pending.clear()
+		if (program && program.alive) program.dispose()
+		for (const handle of owned) if (handle.alive) handle.dispose()
+		vm.dispose()
+		runtime.dispose()
+	}
+	function finish(message) {
+		if (ended) return
+		ended = true
+		// A guest OOM can make QuickJS teardown throw. The worker still owns
+		// the whole WASM module and is terminated by its parent on settlement.
+		try { dispose() } catch {}
+		parentPort.postMessage(message)
+	}
+	function fail(error) {
+		finish(Date.now() >= workerData.deadline
+			? { kind: 'timed-out' }
+			: { kind: 'error', error: String(error && error.message || error).slice(0, 4096) })
+	}
+	function schedule() {
+		if (ended || scheduled) return
+		scheduled = true
+		setImmediate(() => { scheduled = false; pump() })
+	}
+	function pump() {
+		if (ended || pumping) return
+		pumping = true
+		try {
+			const jobs = runtime.executePendingJobs(32)
+			if (jobs.error) {
+				const error = failureText(jobs.error)
+				jobs.error.dispose()
+				throw new Error(error)
+			}
+			const state = vm.getPromiseState(program)
+			if (state.type === 'fulfilled') {
+				let json
+				try { json = serialize(state.value, limits.maxValueBytes) }
+				finally { state.value.dispose() }
+				finish({ kind: 'done', json })
+			} else if (state.type === 'rejected') {
+				let error
+				try { error = failureText(state.error) }
+				finally { state.error.dispose() }
+				fail(new Error(error))
+			} else if (runtime.hasPendingJob()) schedule()
+		} catch (error) { fail(error) }
+		finally { pumping = false }
+	}
+	function rejected(message) {
+		const deferred = vm.newPromise()
+		const error = vm.newError(message)
+		deferred.reject(error)
+		error.dispose()
+		return deferred.handle
+	}
+	const call = vm.newFunction('call', (name, input = vm.undefined) => {
+		try {
+			if (nextId >= limits.maxHostCalls) return rejected('Code runtime host-call limit reached.')
+			if (pending.size >= limits.maxPendingHostCalls) return rejected('Code runtime pending host-call limit reached.')
+			if (vm.typeof(name) !== 'string') return rejected('A host call requires a tool name string.')
+			const tool = textValue(name, Math.min(limits.maxValueBytes, 1024))
+			const json = serialize(input, limits.maxValueBytes)
+			const id = ++nextId
+			const deferred = vm.newPromise()
+			pending.set(id, deferred)
+			parentPort.postMessage({ kind: 'call', id, name: tool, json })
+			return deferred.handle
+		} catch (error) { return rejected(String(error.message || error)) }
+	})
+	vm.setProp(vm.global, 'call', call)
+	call.dispose()
+	const print = vm.newFunction('print', (...values) => {
+		if (truncated) return vm.undefined
+		try {
+			const parts = []
+			let remaining = workerData.maxOutputBytes - printBytes - (printCount > 0 ? 1 : 0)
+			for (const value of values) {
+				if (parts.length) remaining--
+				if (remaining < 0) throw new Error('output limit')
+				const text = vm.typeof(value) === 'string' ? textValue(value, remaining) : serialize(value, remaining)
+				const part = text === undefined ? '' : text
+				remaining -= Buffer.byteLength(part)
+				parts.push(part)
+			}
+			const line = parts.join(' ')
+			const size = Buffer.byteLength(line) + (printCount > 0 ? 1 : 0)
+			if (printBytes + size > workerData.maxOutputBytes) throw new Error('output limit')
+			// Empty prints consume a newline after the first, so the byte
+			// budget also bounds the number of worker messages.
+			printBytes += size
+			printCount++
+			parentPort.postMessage({ kind: 'print', line })
+		} catch {
+			truncated = true
+			parentPort.postMessage({ kind: 'truncated' })
+		}
+		return vm.undefined
+	})
+	vm.setProp(vm.global, 'print', print)
+	print.dispose()
+
+	parentPort.on('message', (message) => {
+		if (ended || message.kind !== 'call-result') return
+		const deferred = pending.get(message.id)
+		if (!deferred) return
+		pending.delete(message.id)
+		try {
+			if (message.ok) {
+				let value = vm.undefined
+				if (message.json !== undefined) {
+					if (typeof message.json !== 'string' || Buffer.byteLength(message.json) > limits.maxValueBytes) throw new Error('Host result exceeds the value limit.')
+					const input = vm.newString(message.json)
+					try { value = vm.unwrapResult(vm.callFunction(decode, vm.undefined, input)) }
+					finally { input.dispose() }
+				}
+				deferred.resolve(value)
+				if (value !== vm.undefined) value.dispose()
+			} else {
+				const error = vm.newError(String(message.error).slice(0, 4096))
+				deferred.reject(error)
+				error.dispose()
+			}
+			deferred.dispose()
+			schedule()
+		} catch (error) { deferred.dispose(); fail(error) }
+	})
+	try {
+		const result = vm.evalCode('(async () => {\\n' + workerData.source + '\\n})()', 'model-program.js')
+		if (result.error) {
+			const error = failureText(result.error)
+			result.error.dispose()
+			fail(new Error(error))
+		} else { program = result.value; pump() }
+	} catch (error) { fail(error) }
+}
+main().catch((error) => parentPort.postMessage({ kind: 'error', error: String(error && error.message || error).slice(0, 4096) }))
+`

package/src/execution/code-runtime/worker.ts

@@ -1,109 +1,85 @@
+import { createRequire } from 'node:module'
 import { Worker } from 'node:worker_threads'
 
+import { encodeCodeValue } from './json-value.js'
 import {
 	type CodeRunResult,
 	type CodeRuntime,
 	HostCallDeniedError,
 	type RunCodeOptions,
 } from './types.js'
+import { QUICKJS_WORKER_SOURCE } from './worker-program.js'
 
-/**
- * A `worker_threads` backend.
- *
- * Chosen over `vm` because `vm` is not a sandbox and its own documentation
- * says so: a context shares the process, so a program that reaches a
- * constructor from the host realm is out — `this.constructor.constructor`
- * on any leaked object is the whole escape, and it fits in a tweet. A
- * worker is a separate V8 isolate with its own heap; escaping it means
- * escaping V8.
- *
- * Chosen over a subprocess because a subprocess is a process: it inherits
- * an environment, it can be a fork bomb, and killing it is the process-tree
- * problem `process/kill-tree.ts` exists for. A worker is cheaper to start,
- * cheaper to kill, and cannot outlive the process that made it.
- *
- * What a worker does NOT give, stated because it is the reason this is not
- * the whole answer: a worker shares the process's filesystem and network
- * access. It is not confined by anything the OS enforces. What confines the
- * program here is that it is handed a scope with nothing in it — no
- * `require`, no `process`, no `fetch` — and a single channel back to the
- * host. That is a language-level boundary, and a language-level boundary is
- * exactly as strong as the enumeration of what was withheld. So a host that
- * needs an OS boundary runs this inside a sandbox that has one, and this
- * comment is here so nobody concludes the worker was the boundary.
- */
-
-/**
- * The worker's own body, as source.
- *
- * Inlined rather than a separate file because a separate file has to be
- * findable at runtime, and this package is consumed as `dist/` by hosts
- * whose bundlers rewrite paths. A string has no path.
- */
-const WORKER_SOURCE = `
-const { parentPort, workerData } = require('node:worker_threads')
-
-// Every host call is a request/response over the port, keyed by an id so
-// several can be in flight — a program that awaits two calls at once is
-// ordinary, and a channel that could only carry one would silently
-// serialise them.
-const pending = new Map()
-let nextId = 0
+const requireFromSdk = createRequire(import.meta.url)
 
-function hostCall(name, input) {
-	const id = ++nextId
-	return new Promise((resolve, reject) => {
-		pending.set(id, { resolve, reject })
-		parentPort.postMessage({ kind: 'call', id, name, input })
-	})
+/** Resource policy for one fresh QuickJS worker execution. */
+export interface WorkerCodeRuntimeOptions {
+	/** QuickJS allocator limit, also the WASM linear-memory ceiling. Does not bound total Node/process memory. Default: 64 MiB. */
+	readonly memoryLimitBytes?: number
+	/** Maximum UTF-8 program source size. Default: 256 KiB. */
+	readonly maxSourceBytes?: number
+	/** Maximum UTF-8 JSON size of each input, host result, and program return. Default: 1 MiB. */
+	readonly maxValueBytes?: number
+	/** Maximum host calls admitted by one program, including refusals. Default: 100. */
+	readonly maxHostCalls?: number
+	/** Maximum host calls awaiting replies simultaneously. Default: 100. */
+	readonly maxPendingHostCalls?: number
 }
 
-// Posted as it happens, NOT batched until the end. A program that printed
-// its progress and then hung has told the host where it got to, and a
-// buffer that only ships on completion loses exactly the output a timeout
-// most needs to explain itself.
-function print(...parts) {
-	parentPort.postMessage({
-		kind: 'print',
-		line: parts.map((p) => (typeof p === 'string' ? p : JSON.stringify(p))).join(' '),
-	})
+function validateInteger(name: string, value: number, minimum: number, maximum: number): void {
+	if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+		throw new RangeError(`${name} must be an integer between ${minimum} and ${maximum}.`)
+	}
 }
 
-parentPort.on('message', (message) => {
-	if (message.kind !== 'call-result') return
-	const entry = pending.get(message.id)
-	if (!entry) return
-	pending.delete(message.id)
-	if (message.ok) entry.resolve(message.value)
-	else entry.reject(new Error(message.error))
-})
-
-async function main() {
-	// The scope the program runs in, and everything it has. Built with
-	// \`new Function\` over an explicit parameter list rather than with
-	// \`with\` or a Proxy: the parameters SHADOW the outer names, so a
-	// program writing \`require\` gets the parameter, and the parameter is
-	// undefined.
-	const names = ['call', 'print', 'require', 'process', 'module', 'exports', 'globalThis', 'fetch']
-	const values = [hostCall, print, undefined, undefined, undefined, undefined, undefined, undefined]
-	const body = new Function(...names, '"use strict";return (async () => {' + workerData.source + '\\n})()')
-	return await body(...values)
+function resolveLimits(options: WorkerCodeRuntimeOptions): Required<WorkerCodeRuntimeOptions> {
+	const limits = {
+		memoryLimitBytes: options.memoryLimitBytes ?? 64 * 1024 * 1024,
+		maxSourceBytes: options.maxSourceBytes ?? 256 * 1024,
+		maxValueBytes: options.maxValueBytes ?? 1024 * 1024,
+		maxHostCalls: options.maxHostCalls ?? 100,
+		maxPendingHostCalls: options.maxPendingHostCalls ?? options.maxHostCalls ?? 100,
+	}
+	validateInteger('memoryLimitBytes', limits.memoryLimitBytes, 16 * 1024 * 1024, 256 * 1024 * 1024)
+	validateInteger('maxSourceBytes', limits.maxSourceBytes, 1, 4 * 1024 * 1024)
+	validateInteger('maxValueBytes', limits.maxValueBytes, 1, 16 * 1024 * 1024)
+	validateInteger('maxHostCalls', limits.maxHostCalls, 1, 10_000)
+	validateInteger('maxPendingHostCalls', limits.maxPendingHostCalls, 1, limits.maxHostCalls)
+	return limits
 }
 
-main().then(
-	(result) => parentPort.postMessage({ kind: 'done', result }),
-	(error) => parentPort.postMessage({ kind: 'error', error: String(error && error.message || error) }),
-)
-`
+function decodeValue(json: unknown, maxBytes: number): unknown {
+	if (json === undefined) return undefined
+	if (typeof json !== 'string' || Buffer.byteLength(json) > maxBytes) {
+		throw new Error('Code runtime value exceeds the serialized value limit.')
+	}
+	return JSON.parse(json)
+}
 
+/**
+ * Runs untrusted JavaScript in a QuickJS interpreter inside a worker thread.
+ * QuickJS owns the guest globals, functions, and promises. Node capabilities
+ * never enter that realm; constructors and dynamic imports cannot recover them.
+ * A fresh interpreter and bounded imported WASM memory are created per run.
+ * The worker makes wall-clock cancellation independent of interpreter progress.
+ */
 export class WorkerCodeRuntime implements CodeRuntime {
 	readonly id = 'worker_threads'
+	private readonly limits: Required<WorkerCodeRuntimeOptions>
+
+	constructor(options: WorkerCodeRuntimeOptions = {}) {
+		this.limits = resolveLimits(options)
+	}
 
 	async run(options: RunCodeOptions): Promise<CodeRunResult> {
+		validateInteger('timeoutMs', options.timeoutMs, 1, 2_147_483_647)
+		validateInteger('maxOutputBytes', options.maxOutputBytes, 0, 16 * 1024 * 1024)
 		const allowed = new Set(options.allowedCalls)
 		const calls: { name: string; ok: boolean }[] = []
 		let output = ''
 		let truncated = false
+		let printCount = 0
+		const seenCalls = new Set<number>()
 
 		// A withdrawn caller owns admission. Do not start an isolate merely to
 		// discover the signal was already aborted after construction.
@@ -116,10 +92,25 @@ export class WorkerCodeRuntime implements CodeRuntime {
 			}
 		}
 
+		if (
+			options.source.length > this.limits.maxSourceBytes ||
+			Buffer.byteLength(options.source) > this.limits.maxSourceBytes
+		) {
+			return {
+				outcome: {
+					status: 'failed',
+					error: `Program source exceeds ${this.limits.maxSourceBytes} bytes.`,
+				},
+				output,
+				outputTruncated: truncated,
+				calls,
+			}
+		}
+
 		const appendOutput = (lines: readonly string[]): void => {
 			for (const line of lines) {
 				if (truncated) return
-				const next = output.length === 0 ? line : `${output}\n${line}`
+				const next = printCount === 0 ? line : `${output}\n${line}`
 				if (Buffer.byteLength(next) > options.maxOutputBytes) {
 					// Cut at the LINE that would exceed, and say so. A cut
 					// mid-JSON produces output a reader cannot parse and cannot
@@ -128,26 +119,24 @@ export class WorkerCodeRuntime implements CodeRuntime {
 					return
 				}
 				output = next
+				printCount++
 			}
 		}
 
-		const worker = new Worker(WORKER_SOURCE, {
+		const worker = new Worker(QUICKJS_WORKER_SOURCE, {
 			eval: true,
-			workerData: { source: options.source },
-			// Nothing from the host's environment.
-			//
-			// **Unobservable today, and kept deliberately.** `process` is
-			// shadowed in the program's scope, so nothing the program can
-			// write reaches `process.env` either way — a mutation removing
-			// this line passes every test, correctly. It is defence behind the
-			// shadowing rather than beside it: the shadowing is a
-			// language-level boundary, exactly as strong as the enumeration of
-			// what was withheld, and the day that enumeration misses something
-			// this is what the leak finds. The cost is one empty object.
+			workerData: {
+				source: options.source,
+				corePath: requireFromSdk.resolve('quickjs-emscripten-core'),
+				variantPath: requireFromSdk.resolve('@jitl/quickjs-wasmfile-release-sync'),
+				limits: this.limits,
+				maxOutputBytes: options.maxOutputBytes,
+				deadline: Date.now() + options.timeoutMs,
+			},
+			// Trusted bootstrap requires Node; guest code runs only inside QuickJS.
+			// Avoid inheriting --input-type or test loaders into the CJS bootstrap.
+			execArgv: [],
 			env: {},
-			// No stdio inheritance: the program prints through `print`, which
-			// is bounded. A worker writing to the host's stdout would bypass
-			// the cap and interleave with the operator's own output.
 			stdout: true,
 			stderr: true,
 		})
@@ -212,13 +201,59 @@ export class WorkerCodeRuntime implements CodeRuntime {
 			}
 
 			worker.on('message', (message: Record<string, unknown>) => {
+				if (settled) return
+				if (message.kind === 'truncated') {
+					truncated = true
+					return
+				}
+				if (message.kind === 'timed-out') {
+					operation.abort(new Error(`Code runtime exceeded ${options.timeoutMs}ms`))
+					finish({
+						outcome: { status: 'timed-out' },
+						output,
+						outputTruncated: truncated,
+						calls,
+					})
+					return
+				}
 				if (message.kind === 'call') {
 					const name = String(message.name)
 					const id = message.id
+					if (
+						typeof id !== 'number' ||
+						!Number.isSafeInteger(id) ||
+						id < 1 ||
+						seenCalls.has(id) ||
+						seenCalls.size >= this.limits.maxHostCalls ||
+						inFlight.size >= this.limits.maxPendingHostCalls
+					) {
+						finish({
+							outcome: {
+								status: 'failed',
+								error: 'Invalid or over-budget host call.',
+							},
+							output,
+							outputTruncated: truncated,
+							calls,
+						})
+						return
+					}
+					seenCalls.add(id)
+					let input: unknown
+					try {
+						input = decodeValue(message.json, this.limits.maxValueBytes)
+					} catch (error) {
+						finish({
+							outcome: { status: 'failed', error: String(error) },
+							output,
+							outputTruncated: truncated,
+							calls,
+						})
+						return
+					}
 					if (!allowed.has(name)) {
-						// Refused HERE, not in the worker. The allow-list lives on
-						// the host side because a check inside the worker is a
-						// check the program shares a heap with.
+						// Authorization remains host-owned even though the interpreter
+						// also bounds its own bridge. A worker never expands the grant.
 						calls.push({ name, ok: false })
 						worker.postMessage({
 							kind: 'call-result',
@@ -234,20 +269,27 @@ export class WorkerCodeRuntime implements CodeRuntime {
 					const runtimeToolCallId = String(id)
 					const hostCall = Promise.resolve()
 						.then(() =>
-							options.onHostCall(
-								{ name, input: message.input },
-								{ runtimeToolCallId, signal: operation.signal },
-							),
+							options.onHostCall({ name, input }, { runtimeToolCallId, signal: operation.signal }),
 						)
 						.then((result) => {
 							if (settled) return
+							let json: string | undefined
+							try {
+								json = result.ok
+									? encodeCodeValue(result.value, this.limits.maxValueBytes)
+									: undefined
+							} catch (error) {
+								throw new Error(
+									`Host call "${name}" completed, but its result could not be delivered: ${error instanceof Error ? error.message : String(error)} Do not repeat a state-changing call solely to recover its output.`,
+								)
+							}
 							calls.push({ name, ok: result.ok })
 							worker.postMessage({
 								kind: 'call-result',
 								id,
 								ok: result.ok,
-								value: result.value,
-								error: result.error,
+								json,
+								error: result.error?.slice(0, 4096),
 							})
 						})
 						.catch((err: unknown) => {
@@ -257,7 +299,7 @@ export class WorkerCodeRuntime implements CodeRuntime {
 								kind: 'call-result',
 								id,
 								ok: false,
-								error: err instanceof Error ? err.message : String(err),
+								error: (err instanceof Error ? err.message : String(err)).slice(0, 4096),
 							})
 						})
 						.finally(() => {
@@ -278,8 +320,20 @@ export class WorkerCodeRuntime implements CodeRuntime {
 					// declaring its JavaScript body complete is not evidence that the
 					// effect it started is complete, so keep the runtime open until the
 					// already-admitted host calls settle (or the deadline revokes them).
+					let value: unknown
+					try {
+						value = decodeValue(message.json, this.limits.maxValueBytes)
+					} catch (error) {
+						finish({
+							outcome: { status: 'failed', error: String(error) },
+							output,
+							outputTruncated: truncated,
+							calls,
+						})
+						return
+					}
 					terminal = {
-						outcome: { status: 'completed', result: message.result },
+						outcome: { status: 'completed', result: value },
 						output,
 						outputTruncated: truncated,
 						calls,
@@ -311,9 +365,8 @@ export class WorkerCodeRuntime implements CodeRuntime {
 			})
 
 			worker.on('exit', (code) => {
-				// Only reached when the worker exited without a `done` or
-				// `error` message — a hard crash, or a program that called
-				// `process.exit` through something we failed to withhold.
+				// A bootstrap or interpreter failure may exit before a terminal
+				// message. Guest code has no access to Node's process object.
 				finish({
 					outcome: {
 						status: 'failed',