@rulvar/planner 1.37.0 → 1.39.0

package/dist/{compile-BtCY9wfO.js → compile-DjzdBuva.js}

@@ -1,4 +1,6 @@
 import { ScriptRejected } from "@rulvar/core";
+import * as acorn from "acorn";
+import { scanDialect } from "eslint-plugin-rulvar";
 //#region src/compile.ts
 /**
 * The exact curated sandbox global set, in canonical order.
@@ -164,6 +166,63 @@ function scanImports(source, blanked, allowImports) {
 	}
 	return diagnostics;
 }
+const CODEGEN_DIAGNOSTIC = {
+	eval: {
+		ruleId: "no-eval",
+		message: "eval is not part of the sandbox dialect; dynamically generated code reopens the import allowlist and the ambient capability surface the dialect closes"
+	},
+	"function-constructor": {
+		ruleId: "no-function-constructor",
+		message: "the Function constructor is not part of the sandbox dialect; it compiles arbitrary code that bypasses the import allowlist (use only the curated globals)"
+	},
+	"constructor-access": {
+		ruleId: "no-constructor-access",
+		message: "constructor access is not part of the sandbox dialect; it reaches the Function constructor from any function value and reopens dynamic code generation"
+	}
+};
+/**
+* Rejects dynamic code generation. `eval` and the Function constructor
+* compile attacker supplied text in a fresh scope where the import
+* expression, ambient time, and host capability are back in reach, so
+* banning `import` while allowing `new Function("return import(x)")` closes
+* nothing. Constructor reconstruction is the same vector by another name:
+* every function value exposes the Function constructor through its prototype
+* ((function(){}).constructor === Function), reachable as `.constructor`,
+* `["constructor"]`, a computed key that folds to the constant, a
+* `{ constructor: x }` destructuring, or `Reflect.get(fn, "constructor")`.
+*
+* The scan runs the SAME shared AST policy the `no-code-generation` ESLint
+* rule uses (`scanDialect`), so the linter and this structural gate reach one
+* decision for every statically visible form. A truly dynamic key
+* (`fn[valueFromAnAgent]`) cannot be resolved statically without rejecting
+* every dynamic property access, so it is left to the worker realm, which
+* neutralizes the runtime reconstruction path. A syntax error is reported by
+* the AsyncFunction construction below, so a parse failure here yields no
+* diagnostics rather than a duplicate.
+*/
+function scanCodegen(source) {
+	let program;
+	try {
+		program = acorn.parse(source, {
+			ecmaVersion: "latest",
+			sourceType: "module",
+			allowReturnOutsideFunction: true,
+			allowAwaitOutsideFunction: true,
+			locations: true
+		});
+	} catch {
+		return [];
+	}
+	return scanDialect(program).map((finding) => {
+		const { ruleId, message } = CODEGEN_DIAGNOSTIC[finding.kind];
+		return {
+			ruleId,
+			message,
+			line: finding.line,
+			column: finding.column
+		};
+	});
+}
 /**
 * Validates and compiles planner-generated source into a CompiledWorkflow.
 * The source is an async function body over the sandbox
@@ -180,6 +239,7 @@ function compileScript(source, o) {
 	}] } });
 	const blanked = blankLiterals(source);
 	diagnostics.push(...scanImports(source, blanked, allowImports));
+	diagnostics.push(...scanCodegen(source));
 	try {
 		new AsyncFunctionCtor(...SANDBOX_GLOBALS, source);
 	} catch (error) {

package/dist/index.js

@@ -1,8 +1,8 @@
-import { n as compileScript, r as scriptDiagnosticsOf, t as SANDBOX_GLOBALS } from "./compile-BtCY9wfO.js";
+import { n as compileScript, r as scriptDiagnosticsOf, t as SANDBOX_GLOBALS } from "./compile-DjzdBuva.js";
 import { ConfigError, InMemoryStore, SANDBOX_AGENT_OPT_KEYS, SandboxError, ScriptRejected, createEngine, createSandboxBridge, defineWorkflow, readRunMeta, toJournalValue } from "@rulvar/core";
+import { toJsonDiagnostics, workflowsConfig } from "eslint-plugin-rulvar";
 import { createHash } from "node:crypto";
 import { Linter } from "eslint";
-import { toJsonDiagnostics, workflowsConfig } from "eslint-plugin-rulvar";
 import { MessageChannel, Worker } from "node:worker_threads";
 //#region src/api-card.ts
 /**

package/dist/sandbox-worker.js

@@ -1,4 +1,4 @@
-import { t as SANDBOX_GLOBALS } from "./compile-BtCY9wfO.js";
+import { t as SANDBOX_GLOBALS } from "./compile-DjzdBuva.js";
 import { NonSerializableValueError, toJournalValue } from "@rulvar/core";
 import { createHash } from "node:crypto";
 import { parentPort } from "node:worker_threads";
@@ -135,6 +135,24 @@ function main(port, init) {
 	Math.random = shimRandom;
 	Reflect.set(globalThis, "fetch", void 0);
 	Reflect.set(globalThis, "process", void 0);
+	Reflect.set(globalThis, "eval", void 0);
+	Reflect.set(globalThis, "Function", void 0);
+	const asyncProto = Object.getPrototypeOf(shimAsyncMarker);
+	const AsyncFunctionCtor = asyncProto.constructor;
+	const denyCodegen = function constructor() {
+		throw new EvalError("dynamic code generation is not available in the sandbox dialect");
+	};
+	for (const proto of [
+		Object.getPrototypeOf(shimRegularMarker),
+		asyncProto,
+		Object.getPrototypeOf(shimGeneratorMarker),
+		Object.getPrototypeOf(shimAsyncGeneratorMarker)
+	]) Object.defineProperty(proto, "constructor", {
+		value: denyCodegen,
+		writable: false,
+		enumerable: false,
+		configurable: false
+	});
 	const sandboxGlobals = {
 		agent: (prompt, opts) => callHost("agent", {
 			prompt,
@@ -268,7 +286,6 @@ function main(port, init) {
 			default: return;
 		}
 	});
-	const AsyncFunctionCtor = Object.getPrototypeOf(shimAsyncMarker).constructor;
 	enterFrame();
 	(async () => {
 		try {
@@ -286,8 +303,13 @@ function main(port, init) {
 		}
 	})();
 }
-/** Marker reaching the AsyncFunction constructor; never invoked. */
+/** Markers reaching each Function family constructor prototype; never invoked. */
 const shimAsyncMarker = async () => void 0;
+const shimRegularMarker = () => void 0;
+function* shimGeneratorMarker() {}
+async function* shimAsyncGeneratorMarker() {
+	return void 0;
+}
 parentPort?.once("message", (init) => {
 	main(init.port, init);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/planner",
-  "version": "1.37.0",
+  "version": "1.39.0",
   "description": "Rulvar flagship hybrid mode: plan agent, compileScript, WorkerSandboxRunner, self-repair loop.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,15 +22,16 @@
     "access": "public"
   },
   "dependencies": {
+    "acorn": "^8.17.0",
     "eslint": "^9.39.4",
-    "@rulvar/core": "1.37.0",
-    "eslint-plugin-rulvar": "1.37.0"
+    "eslint-plugin-rulvar": "1.39.0",
+    "@rulvar/core": "1.39.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/testing": "1.37.0"
+    "@rulvar/testing": "1.39.0"
   },
   "repository": {
     "type": "git",