@nocobase/plugin-workflow-javascript 2.1.0-beta.14 → 2.1.0-beta.15

package/dist/externalVersion.js

@@ -13,11 +13,11 @@ module.exports = {
   "antd-style": "3.7.1",
   "@formily/antd-v5": "1.2.3",
   "@ant-design/icons": "5.6.1",
-  "@nocobase/client": "2.1.0-beta.14",
-  "@nocobase/plugin-workflow": "2.1.0-beta.14",
+  "@nocobase/client": "2.1.0-beta.15",
+  "@nocobase/plugin-workflow": "2.1.0-beta.15",
   "antd": "5.24.2",
-  "@nocobase/flow-engine": "2.1.0-beta.14",
+  "@nocobase/flow-engine": "2.1.0-beta.15",
   "react-i18next": "11.18.6",
   "winston": "3.13.0",
-  "@nocobase/server": "2.1.0-beta.14"
+  "@nocobase/server": "2.1.0-beta.15"
 };

package/dist/node_modules/isolated-vm/package.json

@@ -1 +1 @@
-{"name":"isolated-vm","version":"5.0.4","description":"Access to multiple isolates","main":"isolated-vm.js","types":"isolated-vm.d.ts","engines":{"node":">=18.0.0"},"scripts":{"install":"prebuild-install || (node-gyp rebuild --release -j max && node-gyp clean)","rebuild":"node-gyp rebuild --release -j max","lint":"find src -name '*.cc' | xargs -n1 clang-tidy","test":"node test.js"},"dependencies":{"prebuild-install":"^7.1.2"},"devDependencies":{"isolated-vm":".","prebuild":"^13.0.1"},"binary":{"module_path":"out"},"repository":{"type":"git","url":"git+https://github.com/laverdet/isolated-vm.git"},"author":"https://github.com/laverdet/","license":"ISC","gypfile":true,"bugs":{"url":"https://github.com/laverdet/isolated-vm/issues"},"homepage":"https://github.com/laverdet/isolated-vm#readme","_lastModified":"2026-04-20T09:22:20.565Z"}
+{"name":"isolated-vm","version":"5.0.4","description":"Access to multiple isolates","main":"isolated-vm.js","types":"isolated-vm.d.ts","engines":{"node":">=18.0.0"},"scripts":{"install":"prebuild-install || (node-gyp rebuild --release -j max && node-gyp clean)","rebuild":"node-gyp rebuild --release -j max","lint":"find src -name '*.cc' | xargs -n1 clang-tidy","test":"node test.js"},"dependencies":{"prebuild-install":"^7.1.2"},"devDependencies":{"isolated-vm":".","prebuild":"^13.0.1"},"binary":{"module_path":"out"},"repository":{"type":"git","url":"git+https://github.com/laverdet/isolated-vm.git"},"author":"https://github.com/laverdet/","license":"ISC","gypfile":true,"bugs":{"url":"https://github.com/laverdet/isolated-vm/issues"},"homepage":"https://github.com/laverdet/isolated-vm#readme","_lastModified":"2026-04-24T08:11:49.689Z"}

package/dist/node_modules/winston-transport/package.json

@@ -1 +1 @@
-{"name":"winston-transport","description":"Base stream implementations for winston@3 and up.","version":"4.7.0","main":"index.js","browser":"dist/index.js","scripts":{"lint":"eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist","pretest":"npm run lint && npm run build","test":"nyc mocha test/*.test.js","report":"nyc report --reporter=lcov","build":"rimraf dist && babel *.js -d ./dist","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git@github.com:winstonjs/winston-transport.git"},"keywords":["winston","transport","winston3"],"author":"Charlie Robbins <charlie.robbins@gmail.com>","license":"MIT","bugs":{"url":"https://github.com/winstonjs/winston-transport/issues"},"homepage":"https://github.com/winstonjs/winston-transport#readme","dependencies":{"logform":"^2.3.2","readable-stream":"^3.6.0","triple-beam":"^1.3.0"},"devDependencies":{"@types/node":"^20.8.6","abstract-winston-transport":">=0.5.1","assume":"^2.3.0","babel-cli":"^6.26.0","babel-preset-env":"^1.7.0","deep-equal":"^2.0.5","eslint":"^8.8.0","@dabh/eslint-config-populist":"^5.0.0","mocha":"^10.0.0","nyc":"^15.1.0","rimraf":"^5.0.5","winston-compat":"^0.1.5"},"engines":{"node":">= 12.0.0"},"_lastModified":"2026-04-20T09:22:21.027Z"}
+{"name":"winston-transport","description":"Base stream implementations for winston@3 and up.","version":"4.7.0","main":"index.js","browser":"dist/index.js","scripts":{"lint":"eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist","pretest":"npm run lint && npm run build","test":"nyc mocha test/*.test.js","report":"nyc report --reporter=lcov","build":"rimraf dist && babel *.js -d ./dist","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git@github.com:winstonjs/winston-transport.git"},"keywords":["winston","transport","winston3"],"author":"Charlie Robbins <charlie.robbins@gmail.com>","license":"MIT","bugs":{"url":"https://github.com/winstonjs/winston-transport/issues"},"homepage":"https://github.com/winstonjs/winston-transport#readme","dependencies":{"logform":"^2.3.2","readable-stream":"^3.6.0","triple-beam":"^1.3.0"},"devDependencies":{"@types/node":"^20.8.6","abstract-winston-transport":">=0.5.1","assume":"^2.3.0","babel-cli":"^6.26.0","babel-preset-env":"^1.7.0","deep-equal":"^2.0.5","eslint":"^8.8.0","@dabh/eslint-config-populist":"^5.0.0","mocha":"^10.0.0","nyc":"^15.1.0","rimraf":"^5.0.5","winston-compat":"^0.1.5"},"engines":{"node":">= 12.0.0"},"_lastModified":"2026-04-24T08:11:50.146Z"}

package/dist/server/Vm.js

@@ -11,184 +11,34 @@ const { parentPort, workerData } = require("node:worker_threads");
 const { Script } = require("node:vm");
 const Path = require("node:path");
 let timer = null;
-function harden(v) {
-  Object.setPrototypeOf(v, null);
-  Object.defineProperty(v, "constructor", {
+function customRequire(m) {
+  var _a;
+  const configuredModules = (((_a = process.env.WORKFLOW_SCRIPT_MODULES) == null ? void 0 : _a.split(",")) ?? []).filter(Boolean);
+  let mainName;
+  if (Path.isAbsolute(m)) {
+    mainName = m;
+  } else if (m.startsWith(".")) {
+    mainName = m;
+    m = Path.resolve(process.cwd(), m);
+  } else {
+    mainName = m.split("/").slice(0, m.startsWith("@") ? 2 : 1).join("/");
+  }
+  if (configuredModules.includes(mainName)) {
+    return require(m);
+  }
+  throw new Error(`module "${m}" not supported`);
+}
+function hardenFunction(fn) {
+  Object.setPrototypeOf(fn, null);
+  Object.defineProperty(fn, "constructor", {
     value: null,
     writable: false,
     enumerable: false,
     configurable: false
   });
-  return v;
-}
-function createSandboxError(msg) {
-  return harden(new Error(msg));
-}
-function resolveProperty(obj, key) {
-  const desc = Object.getOwnPropertyDescriptor(obj, key);
-  if (!desc) return void 0;
-  if ("value" in desc) return desc.value;
-  if (desc.get) {
-    try {
-      return desc.get.call(obj);
-    } catch (_) {
-      return void 0;
-    }
-  }
-  return void 0;
-}
-function sanitizeError(e) {
-  let msg;
-  try {
-    msg = e != null && typeof e.message === "string" ? e.message : String(e);
-  } catch (_) {
-    msg = "unknown error";
-  }
-  return createSandboxError(msg);
-}
-function sanitizeReturnValue(result) {
-  if (result === null || result === void 0) return result;
-  if (typeof result !== "object" && typeof result !== "function") return result;
-  if (typeof result.then === "function") {
-    const cleanThenable = /* @__PURE__ */ Object.create(null);
-    const originalThen = result.then.bind(result);
-    Object.defineProperty(cleanThenable, "then", {
-      value: harden(function(onFulfilled, onRejected) {
-        const next = originalThen(
-          typeof onFulfilled === "function" ? (v) => onFulfilled(sanitizeForSandbox(v, null, /* @__PURE__ */ new WeakMap())) : onFulfilled,
-          typeof onRejected === "function" ? (e) => onRejected(sanitizeError(e)) : onRejected
-        );
-        return sanitizeReturnValue(next);
-      }),
-      writable: false,
-      enumerable: true,
-      configurable: false
-    });
-    return cleanThenable;
-  }
-  return sanitizeForSandbox(result, null, /* @__PURE__ */ new WeakMap());
-}
-function sanitizeForSandbox(val, parent, cache) {
-  if (!cache) cache = /* @__PURE__ */ new WeakMap();
-  if (val === null || val === void 0) return val;
-  if (typeof val !== "object" && typeof val !== "function") return val;
-  if (cache.has(val)) return cache.get(val);
-  if (typeof val === "function") {
-    const fn = parent != null ? val.bind(parent) : val;
-    const wrapper = function(...args) {
-      let ret;
-      try {
-        ret = fn(...args);
-      } catch (e) {
-        throw sanitizeError(e);
-      }
-      return sanitizeReturnValue(ret);
-    };
-    cache.set(val, wrapper);
-    harden(wrapper);
-    const SKIP_PROPS = /* @__PURE__ */ new Set(["length", "name", "prototype", "caller", "arguments", "constructor"]);
-    for (const key of Object.getOwnPropertyNames(val)) {
-      if (SKIP_PROPS.has(key)) continue;
-      try {
-        const resolved = resolveProperty(val, key);
-        if (resolved !== void 0) {
-          Object.defineProperty(wrapper, key, {
-            value: sanitizeForSandbox(resolved, val, cache),
-            writable: false,
-            enumerable: true,
-            configurable: false
-          });
-        }
-      } catch (_) {
-      }
-    }
-    return wrapper;
-  }
-  if (Array.isArray(val)) {
-    const len = val.length;
-    const cleanArr = /* @__PURE__ */ Object.create(null);
-    cache.set(val, cleanArr);
-    Object.defineProperty(cleanArr, "length", {
-      value: len,
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-    for (let i = 0; i < len; i++) {
-      try {
-        cleanArr[i] = sanitizeForSandbox(val[i], null, cache);
-      } catch (_) {
-      }
-    }
-    Object.defineProperty(cleanArr, Symbol.iterator, {
-      value: harden(function() {
-        let idx = 0;
-        const iterator = /* @__PURE__ */ Object.create(null);
-        iterator.next = harden(function() {
-          const result = /* @__PURE__ */ Object.create(null);
-          if (idx < len) {
-            result.value = cleanArr[idx++];
-            result.done = false;
-          } else {
-            result.value = void 0;
-            result.done = true;
-          }
-          return result;
-        });
-        iterator[Symbol.iterator] = harden(function() {
-          return iterator;
-        });
-        return iterator;
-      }),
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-    return cleanArr;
-  }
-  const clean = /* @__PURE__ */ Object.create(null);
-  cache.set(val, clean);
-  let proto = val;
-  while (proto !== null && proto !== Object.prototype) {
-    for (const key of Object.getOwnPropertyNames(proto)) {
-      if (key === "constructor" || key in clean) continue;
-      try {
-        const resolved = resolveProperty(proto, key);
-        if (resolved !== void 0) {
-          clean[key] = sanitizeForSandbox(resolved, val, cache);
-        }
-      } catch (_) {
-      }
-    }
-    proto = Object.getPrototypeOf(proto);
-  }
-  return clean;
+  return fn;
 }
-function customRequire(m) {
-  var _a;
-  try {
-    if (typeof m !== "string") {
-      throw new Error("module name must be a string");
-    }
-    const configuredModules = (((_a = process.env.WORKFLOW_SCRIPT_MODULES) == null ? void 0 : _a.split(",")) ?? []).filter(Boolean);
-    let mainName;
-    if (Path.isAbsolute(m)) {
-      mainName = m;
-    } else if (m.startsWith(".")) {
-      mainName = m;
-      m = Path.resolve(process.cwd(), m);
-    } else {
-      mainName = m.split("/").slice(0, m.startsWith("@") ? 2 : 1).join("/");
-    }
-    if (configuredModules.includes(mainName)) {
-      return sanitizeForSandbox(require(m));
-    }
-    throw new Error(`module "${m}" not supported`);
-  } catch (e) {
-    throw sanitizeError(e);
-  }
-}
-harden(customRequire);
+hardenFunction(customRequire);
 function createSafeConsole(originalConsole) {
   const safe = /* @__PURE__ */ Object.create(null);
   const allowedMethods = [
@@ -214,7 +64,8 @@ function createSafeConsole(originalConsole) {
   ];
   for (const key of allowedMethods) {
     if (typeof originalConsole[key] === "function") {
-      const bound = harden(originalConsole[key].bind(originalConsole));
+      const bound = originalConsole[key].bind(originalConsole);
+      hardenFunction(bound);
       Object.defineProperty(safe, key, {
         value: bound,
         writable: false,
@@ -223,7 +74,13 @@ function createSafeConsole(originalConsole) {
       });
     }
   }
-  return Object.freeze(harden(safe));
+  Object.defineProperty(safe, "constructor", {
+    value: null,
+    writable: false,
+    enumerable: false,
+    configurable: false
+  });
+  return Object.freeze(safe);
 }
 async function main() {
   const { source, args = {}, options = {} } = workerData;
@@ -248,17 +105,8 @@ async function main() {
   const result = script.runInNewContext(context, { timeout: options.timeout });
   return result;
 }
-function toJsonResult(value) {
-  if (value === null || value === void 0) return value;
-  if (typeof value !== "object" && typeof value !== "function") return value;
-  try {
-    return JSON.parse(JSON.stringify(value));
-  } catch (_) {
-    return value;
-  }
-}
 main().then((result) => {
-  parentPort.postMessage({ type: "result", result: toJsonResult(result) });
+  parentPort.postMessage({ type: "result", result });
 }).catch((error) => {
   throw error;
 }).finally(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-workflow-javascript",
-  "version": "2.1.0-beta.14",
+  "version": "2.1.0-beta.15",
   "displayName": "Workflow: JavaScript",
   "displayName.zh-CN": "工作流：JavaScript 节点",
   "description": "Execute a piece of JavaScript in an isolated Node.js environment.",
@@ -37,5 +37,5 @@
     "Workflow"
   ],
   "license": "Apache-2.0",
-  "gitHead": "cd55c9a14596d834c30c83a82c38f1f719f7aac4"
+  "gitHead": "dc1aceea6357e6ab149976c2a236fc4b6bee1370"
 }

package/.env.example

@@ -1,15 +0,0 @@
-# This is an example of environment variables for the plugin-workflow-javascript plugin.
-# You can merge this file with your existing .env file and customize the values as needed.
-#
-# --- SECURITY WARNING ---
-# * By default, no modules are allowed to be used in the JavaScript node. Your script will be executed in a sandboxed environment by `isolated-vm`.
-#
-# * By setting any module in WORKFLOW_SCRIPT_MODULES, the JavaScript node will use `node:vm` to execute the script,
-#   which will cause potential security risks. Please make sure the script content is managed by privileged users,
-#   and use it with caution. This will be at your own risk.
-#
-# See the documentation for more details: https://docs.nocobase.com/workflow/nodes/javascript#safe-mode-default
-#
-# Example: lodash,dayjs
-# WORKFLOW_SCRIPT_MODULES=lodash,dayjs
-WORKFLOW_SCRIPT_MODULES=