@oxygen-agent/cli 1.50.37 → 1.98.7

package/node_modules/@oxygen/workflows/dist/index.js

@@ -3,7 +3,10 @@ import * as vm from "node:vm"; // skipcq: JS-C1003
 export const WORKFLOW_MANIFEST_VERSION = 1;
 export const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
 export const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
+export const BLUEPRINT_VERSION = 1;
+export const BLUEPRINT_COMPILER_VERSION = "oxygen-blueprints-v1";
 export const MAX_RECIPE_BUNDLE_BYTES = 2_000_000;
+export const MAX_BLUEPRINT_BYTES = 4_000_000;
 export const DEFAULT_WORKFLOW_CRON_TIMEZONE = "UTC";
 // Compatibility and determinism lint only. The Vercel sandbox process,
 // denied network policy, and runtime global guards are the security boundary.
@@ -380,6 +383,234 @@ export function assertWorkflowManifest(value, options = {}) {
     const first = result.issues[0];
     throw new Error(first ? `${first.code}: ${first.message}` : "Invalid workflow manifest.");
 }
+export function isBlueprint(value) {
+    return isRecord(value)
+        && value.blueprint_version === BLUEPRINT_VERSION
+        && value.compiler_version === BLUEPRINT_COMPILER_VERSION;
+}
+const BLUEPRINT_REF_PATTERN = /^[a-z][a-z0-9_-]{0,79}$/;
+const BLUEPRINT_PROMPT_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,119}$/;
+export function lintBlueprint(// skipcq: JS-R1005
+value, options = {}) {
+    const issues = [];
+    const add = (path, code, message) => issues.push({ path, code, message });
+    if (!isRecord(value)) {
+        add("$", "invalid_blueprint", "Blueprint must be an object.");
+        return { ok: false, issues };
+    }
+    if (value.blueprint_version !== BLUEPRINT_VERSION) {
+        add("$.blueprint_version", "invalid_blueprint_version", "Blueprint version must be 1.");
+    }
+    if (value.compiler_version !== BLUEPRINT_COMPILER_VERSION) {
+        add("$.compiler_version", "invalid_compiler_version", `Blueprint compiler_version must be '${BLUEPRINT_COMPILER_VERSION}'.`);
+    }
+    if (!isNonEmptyString(value.id))
+        add("$.id", "invalid_blueprint_id", "Blueprint id is required.");
+    if (!isNonEmptyString(value.name))
+        add("$.name", "invalid_blueprint_name", "Blueprint name is required.");
+    if (typeof value.summary !== "string")
+        add("$.summary", "invalid_summary", "Blueprint summary must be a string.");
+    if (!Array.isArray(value.tags)) {
+        add("$.tags", "invalid_tags", "Blueprint tags must be an array of strings.");
+    }
+    if (!isNonEmptyString(value.exported_at)) {
+        add("$.exported_at", "invalid_exported_at", "Blueprint exported_at must be an ISO timestamp.");
+    }
+    if (!isNonEmptyString(value.source_hash)) {
+        add("$.source_hash", "missing_source_hash", "Blueprint source_hash is required.");
+    }
+    const tableRefs = new Set();
+    if (!Array.isArray(value.tables)) {
+        add("$.tables", "invalid_tables", "Blueprint tables must be an array.");
+    }
+    else {
+        value.tables.forEach((table, index) => {
+            const path = `$.tables.${index}`;
+            if (!isRecord(table)) {
+                add(path, "invalid_table", "Blueprint table must be an object.");
+                return;
+            }
+            if (!isNonEmptyString(table.ref) || !BLUEPRINT_REF_PATTERN.test(table.ref)) {
+                add(`${path}.ref`, "invalid_table_ref", "Blueprint table ref must be lowercase kebab/snake_case (a-z0-9_-).");
+            }
+            else {
+                if (tableRefs.has(table.ref)) {
+                    add(`${path}.ref`, "duplicate_table_ref", `Blueprint table ref '${table.ref}' is duplicated.`);
+                }
+                tableRefs.add(table.ref);
+            }
+            if (!isNonEmptyString(table.name))
+                add(`${path}.name`, "invalid_table_name", "Blueprint table name is required.");
+            if (!Array.isArray(table.columns) || table.columns.length === 0) {
+                add(`${path}.columns`, "invalid_table_columns", "Blueprint table must declare at least one column.");
+            }
+            else {
+                table.columns.forEach((column, columnIndex) => {
+                    const columnPath = `${path}.columns.${columnIndex}`;
+                    if (!isRecord(column)) {
+                        add(columnPath, "invalid_column", "Blueprint column must be an object.");
+                        return;
+                    }
+                    if (!isNonEmptyString(column.label)) {
+                        add(`${columnPath}.label`, "invalid_column_label", "Blueprint column label is required.");
+                    }
+                });
+            }
+        });
+    }
+    if (value.column_grafts !== undefined) {
+        if (!Array.isArray(value.column_grafts)) {
+            add("$.column_grafts", "invalid_column_grafts", "Blueprint column_grafts must be an array.");
+        }
+        else {
+            value.column_grafts.forEach((graft, index) => {
+                const path = `$.column_grafts.${index}`;
+                if (!isRecord(graft)) {
+                    add(path, "invalid_column_graft", "Column graft must be an object.");
+                    return;
+                }
+                if (!isNonEmptyString(graft.table_ref) || !tableRefs.has(graft.table_ref)) {
+                    add(`${path}.table_ref`, "invalid_graft_ref", "Column graft table_ref must match a declared blueprint table ref.");
+                }
+                if (!isRecord(graft.column) || !isNonEmptyString(graft.column.label)) {
+                    add(`${path}.column`, "invalid_graft_column", "Column graft column must be an object with a label.");
+                }
+            });
+        }
+    }
+    const promptSlugs = new Set();
+    if (!Array.isArray(value.prompt_templates)) {
+        add("$.prompt_templates", "invalid_prompt_templates", "Blueprint prompt_templates must be an array.");
+    }
+    else {
+        value.prompt_templates.forEach((prompt, index) => {
+            const path = `$.prompt_templates.${index}`;
+            if (!isRecord(prompt)) {
+                add(path, "invalid_prompt", "Blueprint prompt must be an object.");
+                return;
+            }
+            if (!isNonEmptyString(prompt.slug) || !BLUEPRINT_PROMPT_SLUG_PATTERN.test(prompt.slug)) {
+                add(`${path}.slug`, "invalid_prompt_slug", "Prompt slug must be lowercase kebab/snake_case (a-z0-9_-).");
+            }
+            else {
+                if (promptSlugs.has(prompt.slug)) {
+                    add(`${path}.slug`, "duplicate_prompt_slug", `Prompt slug '${prompt.slug}' is duplicated.`);
+                }
+                promptSlugs.add(prompt.slug);
+            }
+            if (!isNonEmptyString(prompt.name))
+                add(`${path}.name`, "invalid_prompt_name", "Prompt name is required.");
+            if (!isNonEmptyString(prompt.body))
+                add(`${path}.body`, "invalid_prompt_body", "Prompt body is required.");
+            if (prompt.kind !== "ai_column_system" && prompt.kind !== "scoring_rubric" && prompt.kind !== "other") {
+                add(`${path}.kind`, "invalid_prompt_kind", "Prompt kind must be ai_column_system, scoring_rubric, or other.");
+            }
+        });
+    }
+    if (!Array.isArray(value.workflows)) {
+        add("$.workflows", "invalid_workflows", "Blueprint workflows must be an array.");
+    }
+    else if (value.workflows.length === 0) {
+        add("$.workflows", "missing_workflows", "Blueprint must include at least one workflow.");
+    }
+    else {
+        value.workflows.forEach((entry, index) => {
+            const path = `$.workflows.${index}`;
+            if (!isRecord(entry)) {
+                add(path, "invalid_workflow_entry", "Workflow entry must be an object.");
+                return;
+            }
+            const manifest = entry.manifest;
+            const manifestResult = lintWorkflowManifest(manifest, options);
+            if (!manifestResult.ok) {
+                manifestResult.issues.forEach((issue) => {
+                    add(`${path}.manifest${issue.path.replace(/^\$/, "")}`, issue.code, issue.message);
+                });
+            }
+            if (entry.table_refs !== undefined && !isRecord(entry.table_refs)) {
+                add(`${path}.table_refs`, "invalid_workflow_table_refs", "Workflow table_refs must be an object map.");
+            }
+            else if (isRecord(entry.table_refs)) {
+                for (const refName of Object.keys(entry.table_refs)) {
+                    if (!tableRefs.has(refName)) {
+                        add(`${path}.table_refs.${refName}`, "unknown_workflow_table_ref", `Workflow references table ref '${refName}' which is not declared on this blueprint.`);
+                    }
+                }
+            }
+            if (entry.prompt_template_slugs !== undefined) {
+                if (!Array.isArray(entry.prompt_template_slugs)) {
+                    add(`${path}.prompt_template_slugs`, "invalid_prompt_slug_list", "Workflow prompt_template_slugs must be an array of strings.");
+                }
+                else {
+                    entry.prompt_template_slugs.forEach((slug, slugIndex) => {
+                        if (!isNonEmptyString(slug)) {
+                            add(`${path}.prompt_template_slugs.${slugIndex}`, "invalid_prompt_slug", "Workflow prompt slug references must be non-empty strings.");
+                        }
+                        else if (!promptSlugs.has(slug)) {
+                            add(`${path}.prompt_template_slugs.${slugIndex}`, "unknown_prompt_slug", `Workflow references prompt slug '${slug}' which is not declared on this blueprint.`);
+                        }
+                    });
+                }
+            }
+        });
+    }
+    const requires = value.requires;
+    if (!isRecord(requires)) {
+        add("$.requires", "invalid_requires", "Blueprint requires must be an object.");
+    }
+    else {
+        if (requires.integrations !== undefined) {
+            if (!Array.isArray(requires.integrations)) {
+                add("$.requires.integrations", "invalid_requires_integrations", "Blueprint requires.integrations must be an array.");
+            }
+            else {
+                requires.integrations.forEach((entry, index) => {
+                    const path = `$.requires.integrations.${index}`;
+                    if (!isRecord(entry)) {
+                        add(path, "invalid_integration", "Integration requirement must be an object.");
+                        return;
+                    }
+                    if (!isNonEmptyString(entry.kind)) {
+                        add(`${path}.kind`, "invalid_integration_kind", "Integration requirement kind is required (e.g. 'instantly', 'apollo').");
+                    }
+                });
+            }
+        }
+        if (requires.context_keys !== undefined && !Array.isArray(requires.context_keys)) {
+            add("$.requires.context_keys", "invalid_context_keys", "Blueprint requires.context_keys must be an array of strings.");
+        }
+    }
+    return { ok: issues.length === 0, issues };
+}
+export function assertBlueprint(value, options = {}) {
+    const result = lintBlueprint(value, options);
+    if (result.ok)
+        return;
+    const first = result.issues[0];
+    throw new Error(first ? `${first.code}: ${first.message}` : "Invalid blueprint.");
+}
+export function buildBlueprint(input) {
+    const draft = {
+        blueprint_version: BLUEPRINT_VERSION,
+        id: input.id,
+        name: input.name,
+        summary: input.summary ?? "",
+        tags: Array.isArray(input.tags) ? Array.from(new Set(input.tags.filter(Boolean))) : [],
+        ...(input.audience ? { audience: input.audience } : {}),
+        requires: input.requires ?? {},
+        ...(input.inputSchema ? { input_schema: input.inputSchema } : {}),
+        tables: input.tables,
+        ...(input.columnGrafts && input.columnGrafts.length > 0 ? { column_grafts: input.columnGrafts } : {}),
+        prompt_templates: input.promptTemplates ?? [],
+        workflows: input.workflows,
+        exported_at: (input.exportedAt ?? new Date()).toISOString(),
+        ...(input.exportedFrom ? { exported_from: input.exportedFrom } : {}),
+        compiler_version: BLUEPRINT_COMPILER_VERSION,
+    };
+    const sourceHash = input.sourceHash
+        ?? hashWorkflowSource(JSON.stringify(draft, workflowJsonReplacer));
+    return { ...draft, source_hash: sourceHash };
+}
 export function validateJsonSchemaValue(value, schema, path = "$") {
     if (!schema || typeof schema !== "object" || Array.isArray(schema))
         return [];
@@ -411,11 +642,44 @@ export async function runPureWorkflowFunction(input) {
         const first = issues[0];
         throw new Error(first ? `${first.code}: ${first.message}` : "Invalid workflow function source.");
     }
+    // Cross the host/sandbox boundary as a JSON string, then parse INSIDE the
+    // vm context. If we passed the host object directly its prototype chain
+    // would point at the host's Object/Function, and the regex token blacklist
+    // is trivially bypassed (e.g. "con"+"structor") to reach
+    // __oxygen_context.constructor.constructor === host Function — which is
+    // not affected by the new context's codeGeneration setting and yields
+    // worker-process RCE. Parsing inside the context rebinds the prototype to
+    // the sandboxed Object, so the same walk reaches the sandboxed Function,
+    // which then trips contextCodeGeneration.strings=false below.
     const context = toJsonValue(input.context, "context");
+    const contextJson = JSON.stringify(context);
     const sandbox = Object.create(null);
-    sandbox.__oxygen_context = context;
-    const script = new vm.Script(`"use strict";\nconst __oxygen_fn = (${input.source});\n__oxygen_fn(__oxygen_context);`);
-    const result = script.runInNewContext(sandbox, { timeout: timeoutMs });
+    sandbox.__oxygen_context_json = contextJson;
+    // Shadow dangerous globals on the sandbox surface. Defense-in-depth: the
+    // load-bearing block is contextCodeGeneration; this just removes the
+    // obvious top-level handles.
+    sandbox.Function = undefined;
+    sandbox.eval = undefined;
+    sandbox.setTimeout = undefined;
+    sandbox.setInterval = undefined;
+    sandbox.setImmediate = undefined;
+    sandbox.queueMicrotask = undefined;
+    sandbox.WebAssembly = undefined;
+    const script = new vm.Script(`"use strict";\n`
+        + `const __oxygen_context = JSON.parse(__oxygen_context_json);\n`
+        + `const __oxygen_fn = (${input.source});\n`
+        + `__oxygen_fn(__oxygen_context);`);
+    // Disable dynamic code generation in the sandboxed context. Combined with
+    // the JSON re-parse above, this means every prototype-walk path to
+    // Function — direct, via context.constructor.constructor, or any other
+    // reachable Function instance — throws EvalError when called with source.
+    const result = script.runInNewContext(sandbox, {
+        timeout: timeoutMs,
+        contextCodeGeneration: {
+            strings: false,
+            wasm: false,
+        },
+    });
     const resolved = isPromiseLike(result)
         ? await withTimeout(result, timeoutMs)
         : result;
@@ -775,7 +1039,7 @@ function validateRecipeBundleSafety(source, path, add) {
     }
 }
 function isWorkflowToolRejected(toolId) {
-    return toolId === "run_javascript" || toolId === "custom_http" || toolId.includes("custom_http");
+    return toolId === "run_javascript" || toolId === "custom_http";
 }
 const CRON_FIELD_LIMITS = [
     { name: "minute", min: 0, max: 59 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.50.37",
+  "version": "1.98.7",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",