@oxygen-agent/cli 1.46.0 → 1.64.5

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import * as vm from "node:vm";
+import * as vm from "node:vm"; // skipcq: JS-C1003
 export const WORKFLOW_MANIFEST_VERSION = 1;
 export const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
 export const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
@@ -8,16 +8,16 @@ export const DEFAULT_WORKFLOW_CRON_TIMEZONE = "UTC";
 // Compatibility and determinism lint only. The Vercel sandbox process,
 // denied network policy, and runtime global guards are the security boundary.
 const UNSAFE_RECIPE_BUNDLE_PATTERNS = [
-    { token: "globalThis", pattern: /\bglobalThis\b/ },
+    { token: "globalThis", pattern: /\bglobalThis\b/ }, // skipcq: SCT-A000
     { token: "global", pattern: /\bglobal\b/ },
     { token: "process", pattern: /\bprocess\b/ },
     { token: "fetch", pattern: /\bfetch\b/ },
-    { token: "XMLHttpRequest", pattern: /\bXMLHttpRequest\b/ },
+    { token: "XMLHttpRequest", pattern: /\bXMLHttpRequest\b/ }, // skipcq: SCT-A000
     { token: "WebSocket", pattern: /\bWebSocket\b/ },
-    { token: "EventSource", pattern: /\bEventSource\b/ },
+    { token: "EventSource", pattern: /\bEventSource\b/ }, // skipcq: SCT-A000
     { token: "require", pattern: /\brequire\b/ },
-    { token: "dynamic import", pattern: /\bimport(?:\s|\/\*[\s\S]*?\*\/)*\(/ },
-    { token: "node module import", pattern: /\b(?:node:)?(?:fs|child_process|net|tls|http|https|dns|dgram|worker_threads)\b/ },
+    { token: "dynamic import", pattern: /\bimport(?:\s|\/\*[\s\S]*?\*\/)*\(/ }, // skipcq: SCT-A000
+    { token: "node module import", pattern: /\b(?:node:)?(?:fs|child_process|net|tls|http|https|dns|dgram|worker_threads)\b/ }, // skipcq: SCT-A000
     { token: "eval", pattern: /\beval\b/ },
     { token: "Function", pattern: /\bFunction\b/ },
     { token: "constructor", pattern: /\bconstructor\b/ },
@@ -26,7 +26,7 @@ const UNSAFE_RECIPE_BUNDLE_PATTERNS = [
     { token: "Math.random", pattern: /\bMath\s*\.\s*random\b/ },
     { token: "crypto.randomUUID", pattern: /\bcrypto\s*\.\s*randomUUID\b/ },
     { token: "setTimeout", pattern: /\bsetTimeout\b/ },
-    { token: "setInterval", pattern: /\bsetInterval\b/ },
+    { token: "setInterval", pattern: /\bsetInterval\b/ }, // skipcq: SCT-A000
 ];
 export function defineWorkflow(input) {
     return {
@@ -195,7 +195,8 @@ export function buildRecipeManifest(input) {
     };
     return manifest;
 }
-export function lintWorkflowManifest(value, options = {}) {
+export function lintWorkflowManifest(// skipcq: JS-R1005
+value, options = {}) {
     if (isRecord(value)
         && typeof value.compiler_version === "string"
         && value.compiler_version.startsWith("oxygen-recipes-")) {
@@ -294,7 +295,8 @@ export function lintWorkflowManifest(value, options = {}) {
     }
     return { ok: issues.length === 0, issues };
 }
-export function lintRecipeManifest(value, options = {}) {
+export function lintRecipeManifest(// skipcq: JS-R1005
+value, options = {}) {
     const issues = [];
     const add = (path, code, message) => issues.push({ path, code, message });
     if (!isRecord(value)) {
@@ -409,31 +411,49 @@ export async function runPureWorkflowFunction(input) {
         const first = issues[0];
         throw new Error(first ? `${first.code}: ${first.message}` : "Invalid workflow function source.");
     }
+    // Cross the host/sandbox boundary as a JSON string, then parse INSIDE the
+    // vm context. If we passed the host object directly its prototype chain
+    // would point at the host's Object/Function, and the regex token blacklist
+    // is trivially bypassed (e.g. "con"+"structor") to reach
+    // __oxygen_context.constructor.constructor === host Function — which is
+    // not affected by the new context's codeGeneration setting and yields
+    // worker-process RCE. Parsing inside the context rebinds the prototype to
+    // the sandboxed Object, so the same walk reaches the sandboxed Function,
+    // which then trips contextCodeGeneration.strings=false below.
     const context = toJsonValue(input.context, "context");
+    const contextJson = JSON.stringify(context);
     const sandbox = Object.create(null);
-    sandbox.__oxygen_context = context;
-    const script = new vm.Script(`"use strict";\nconst __oxygen_fn = (${input.source});\n__oxygen_fn(__oxygen_context);`);
-    const result = script.runInNewContext(sandbox, { timeout: timeoutMs });
+    sandbox.__oxygen_context_json = contextJson;
+    // Shadow dangerous globals on the sandbox surface. Defense-in-depth: the
+    // load-bearing block is contextCodeGeneration; this just removes the
+    // obvious top-level handles.
+    sandbox.Function = undefined;
+    sandbox.eval = undefined;
+    sandbox.setTimeout = undefined;
+    sandbox.setInterval = undefined;
+    sandbox.setImmediate = undefined;
+    sandbox.queueMicrotask = undefined;
+    sandbox.WebAssembly = undefined;
+    const script = new vm.Script(`"use strict";\n`
+        + `const __oxygen_context = JSON.parse(__oxygen_context_json);\n`
+        + `const __oxygen_fn = (${input.source});\n`
+        + `__oxygen_fn(__oxygen_context);`);
+    // Disable dynamic code generation in the sandboxed context. Combined with
+    // the JSON re-parse above, this means every prototype-walk path to
+    // Function — direct, via context.constructor.constructor, or any other
+    // reachable Function instance — throws EvalError when called with source.
+    const result = script.runInNewContext(sandbox, {
+        timeout: timeoutMs,
+        contextCodeGeneration: {
+            strings: false,
+            wasm: false,
+        },
+    });
     const resolved = isPromiseLike(result)
         ? await withTimeout(result, timeoutMs)
         : result;
     return enforceJsonOutput(resolved, maxOutputBytes);
 }
-export function getWorkflowApplySchema() {
-    return workflowApplySchema;
-}
-export function getWorkflowSchema(subject = "apply") {
-    const schemas = {
-        apply: workflowApplySchema,
-        call: workflowCallSchema,
-        event: workflowEventEmitSchema,
-        trigger: workflowTriggerSchema,
-        manifest: workflowManifestSchema,
-    };
-    if (subject === "all")
-        return { schemas };
-    return schemas[subject];
-}
 export const workflowApplySchema = {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: "OXYGEN Workflow Apply Input",
@@ -516,7 +536,23 @@ export const workflowManifestSchema = {
     additionalProperties: true,
     required: ["manifest_version", "workflow", "steps", "source_hash", "compiler_version"],
 };
-function validateJsonSchemaValueInto(value, schema, path, issues) {
+export function getWorkflowApplySchema() {
+    return workflowApplySchema;
+}
+export function getWorkflowSchema(subject = "apply") {
+    const schemas = {
+        apply: workflowApplySchema,
+        call: workflowCallSchema,
+        event: workflowEventEmitSchema,
+        trigger: workflowTriggerSchema,
+        manifest: workflowManifestSchema,
+    };
+    if (subject === "all")
+        return { schemas };
+    return schemas[subject];
+}
+function validateJsonSchemaValueInto(// skipcq: JS-R1005
+value, schema, path, issues) {
     const startCount = issues.length;
     if (schema.const !== undefined && !jsonEqual(value, schema.const)) {
         issues.push({
@@ -638,7 +674,8 @@ function formatSchemaTypes(types) {
 function jsonEqual(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);
 }
-function validateTrigger(value, path, add) {
+function validateTrigger(// skipcq: JS-R1005
+value, path, add) {
     if (!isRecord(value)) {
         add(path, "invalid_trigger", "Workflow trigger must be an object.");
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.46.0",
+  "version": "1.64.5",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",