@secure-exec/browser 0.2.0-rc.2 → 0.3.0-rc.2

package/dist/runtime.js

@@ -0,0 +1,377 @@
+import { createInMemoryFileSystem, InMemoryFileSystem, } from "./os-filesystem.js";
+export const allowAllFs = () => true;
+export const allowAllNetwork = () => true;
+export const allowAllChildProcess = () => true;
+export const allowAllEnv = () => true;
+export const allowAll = {
+    fs: allowAllFs,
+    network: allowAllNetwork,
+    childProcess: allowAllChildProcess,
+    env: allowAllEnv,
+};
+function normalizePath(inputPath) {
+    if (!inputPath)
+        return "/";
+    let normalized = inputPath.startsWith("/") ? inputPath : `/${inputPath}`;
+    normalized = normalized.replace(/\/+/g, "/");
+    if (normalized.length > 1 && normalized.endsWith("/")) {
+        normalized = normalized.slice(0, -1);
+    }
+    const parts = normalized.split("/");
+    const resolved = [];
+    for (const part of parts) {
+        if (!part || part === ".")
+            continue;
+        if (part === "..") {
+            resolved.pop();
+            continue;
+        }
+        resolved.push(part);
+    }
+    return resolved.length === 0 ? "/" : `/${resolved.join("/")}`;
+}
+function dirname(inputPath) {
+    const normalized = normalizePath(inputPath);
+    if (normalized === "/")
+        return "/";
+    const parts = normalized.split("/").filter(Boolean);
+    return parts.length <= 1 ? "/" : `/${parts.slice(0, -1).join("/")}`;
+}
+function permissionAllowed(decision) {
+    if (decision === undefined)
+        return true;
+    if (typeof decision === "boolean")
+        return decision;
+    return "allowed" in decision ? decision.allowed : decision.allow;
+}
+export function filterEnv(env, permissions) {
+    const source = env ?? {};
+    if (!permissions?.env)
+        return { ...source };
+    const output = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (permissionAllowed(permissions.env({ name, value }))) {
+            output[name] = value;
+        }
+    }
+    return output;
+}
+export function createEnosysError(operation) {
+    const error = new Error(`ENOSYS: ${operation} is not supported`);
+    error.code = "ENOSYS";
+    return error;
+}
+export function createFsStub() {
+    return createInMemoryFileSystem();
+}
+export function createNetworkStub() {
+    return {
+        async fetch() {
+            throw createEnosysError("network.fetch");
+        },
+        async dnsLookup() {
+            return { error: "DNS not supported", code: "ENOSYS" };
+        },
+        async httpRequest() {
+            throw createEnosysError("network.httpRequest");
+        },
+    };
+}
+export function createCommandExecutorStub() {
+    return {
+        spawn() {
+            throw createEnosysError("child_process.spawn");
+        },
+    };
+}
+export function wrapFileSystem(filesystem, permissions) {
+    if (!permissions?.fs)
+        return filesystem;
+    const check = (path, operation) => {
+        if (!permissionAllowed(permissions.fs?.({ path, operation }))) {
+            throw new Error(`EACCES: blocked ${operation} on '${path}'`);
+        }
+    };
+    return {
+        readFile(path) {
+            check(path, "readFile");
+            return filesystem.readFile(path);
+        },
+        readTextFile(path) {
+            check(path, "readTextFile");
+            return filesystem.readTextFile(path);
+        },
+        readDir(path) {
+            check(path, "readDir");
+            return filesystem.readDir(path);
+        },
+        readDirWithTypes(path) {
+            check(path, "readDirWithTypes");
+            return filesystem.readDirWithTypes(path);
+        },
+        writeFile(path, content) {
+            check(path, "writeFile");
+            return filesystem.writeFile(path, content);
+        },
+        createDir(path) {
+            check(path, "createDir");
+            return filesystem.createDir(path);
+        },
+        mkdir(path, options) {
+            check(path, "mkdir");
+            return filesystem.mkdir(path, options);
+        },
+        exists(path) {
+            check(path, "exists");
+            return filesystem.exists(path);
+        },
+        stat(path) {
+            check(path, "stat");
+            return filesystem.stat(path);
+        },
+        removeFile(path) {
+            check(path, "removeFile");
+            return filesystem.removeFile(path);
+        },
+        removeDir(path) {
+            check(path, "removeDir");
+            return filesystem.removeDir(path);
+        },
+        rename(oldPath, newPath) {
+            check(oldPath, "rename");
+            check(newPath, "rename");
+            return filesystem.rename(oldPath, newPath);
+        },
+        realpath(path) {
+            check(path, "realpath");
+            return filesystem.realpath(path);
+        },
+        symlink(target, linkPath) {
+            check(linkPath, "symlink");
+            return filesystem.symlink(target, linkPath);
+        },
+        readlink(path) {
+            check(path, "readlink");
+            return filesystem.readlink(path);
+        },
+        lstat(path) {
+            check(path, "lstat");
+            return filesystem.lstat(path);
+        },
+        link(oldPath, newPath) {
+            check(oldPath, "link");
+            check(newPath, "link");
+            return filesystem.link(oldPath, newPath);
+        },
+        chmod(path, mode) {
+            check(path, "chmod");
+            return filesystem.chmod(path, mode);
+        },
+        chown(path, uid, gid) {
+            check(path, "chown");
+            return filesystem.chown(path, uid, gid);
+        },
+        utimes(path, atime, mtime) {
+            check(path, "utimes");
+            return filesystem.utimes(path, atime, mtime);
+        },
+        truncate(path, length) {
+            check(path, "truncate");
+            return filesystem.truncate(path, length);
+        },
+        pread(path, offset, length) {
+            check(path, "pread");
+            return filesystem.pread(path, offset, length);
+        },
+        pwrite(path, offset, data) {
+            check(path, "pwrite");
+            return filesystem.pwrite(path, offset, data);
+        },
+    };
+}
+export function wrapNetworkAdapter(adapter, permissions) {
+    if (!permissions?.network)
+        return adapter;
+    const check = (request) => {
+        if (!permissionAllowed(permissions.network?.(request))) {
+            throw new Error(`EACCES: blocked network access to '${request.url ?? request.host ?? ""}'`);
+        }
+    };
+    return {
+        async fetch(url, options) {
+            check({ url });
+            return adapter.fetch(url, options);
+        },
+        async dnsLookup(hostname) {
+            check({ host: hostname });
+            return adapter.dnsLookup(hostname);
+        },
+        async httpRequest(url, options) {
+            check({ url });
+            return adapter.httpRequest(url, options);
+        },
+    };
+}
+export async function mkdir(filesystem, path, options) {
+    if (typeof options === "boolean") {
+        return filesystem.mkdir(path, { recursive: options });
+    }
+    return filesystem.mkdir(path, options);
+}
+export async function loadFile(path, filesystem) {
+    try {
+        return await filesystem.readTextFile(path);
+    }
+    catch {
+        return null;
+    }
+}
+export async function resolveModule(specifier, fromPath, filesystem, _mode = "require") {
+    if (!specifier.startsWith(".") &&
+        !specifier.startsWith("/") &&
+        !specifier.startsWith("node:")) {
+        return specifier;
+    }
+    if (specifier.startsWith("node:")) {
+        return specifier;
+    }
+    let fromDir = normalizePath(fromPath);
+    try {
+        const fromStat = await filesystem.stat(fromDir);
+        if (!fromStat.isDirectory) {
+            fromDir = dirname(fromDir);
+        }
+    }
+    catch {
+        const basename = fromDir.split("/").at(-1) ?? "";
+        if (basename.includes(".")) {
+            fromDir = dirname(fromDir);
+        }
+    }
+    const base = specifier.startsWith("/")
+        ? specifier
+        : `${fromDir}/${specifier}`;
+    const candidates = [
+        normalizePath(base),
+        `${normalizePath(base)}.js`,
+        `${normalizePath(base)}.mjs`,
+        `${normalizePath(base)}/index.js`,
+    ];
+    for (const candidate of candidates) {
+        if (await filesystem.exists(candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+}
+export function isESM(code, filePath) {
+    if (filePath?.endsWith(".mjs"))
+        return true;
+    return /\b(import|export)\b/.test(code);
+}
+export function transformDynamicImport(code) {
+    return code;
+}
+export const POLYFILL_CODE_MAP = {
+    fs: "module.exports = globalThis._fsModule;",
+    "node:fs": "module.exports = globalThis._fsModule;",
+};
+export function exposeCustomGlobal(name, value) {
+    globalThis[name] = value;
+}
+export function exposeMutableRuntimeStateGlobal(name, value) {
+    globalThis[name] = value;
+}
+export function getIsolateRuntimeSource(id) {
+    if (id === "overrideProcessCwd") {
+        return `
+			if (globalThis.process && globalThis.__runtimeProcessCwdOverride) {
+				globalThis.process.cwd = () => String(globalThis.__runtimeProcessCwdOverride);
+			}
+		`;
+    }
+    return "";
+}
+export function getRequireSetupCode() {
+    return `
+		(function () {
+			const callSyncBridge = (ref, ...args) => {
+				if (typeof ref === "function") {
+					return ref(...args);
+				}
+				if (ref && typeof ref.applySync === "function") {
+					return ref.applySync(undefined, args);
+				}
+				if (ref && typeof ref.applySyncPromise === "function") {
+					return ref.applySyncPromise(undefined, args);
+				}
+				return undefined;
+			};
+
+			const pathDirname = (value) => {
+				const normalized = String(value || "/").replace(/\\\\/g, "/");
+				if (normalized === "/") return "/";
+				const parts = normalized.split("/").filter(Boolean);
+				return parts.length <= 1 ? "/" : "/" + parts.slice(0, -1).join("/");
+			};
+
+			globalThis.require = function require(specifier) {
+				const polyfillSource = callSyncBridge(
+					globalThis._loadPolyfill,
+					specifier.replace(/^node:/, ""),
+				);
+				if (polyfillSource) {
+					const module = { exports: {} };
+					const fn = new Function("module", "exports", polyfillSource);
+					fn(module, module.exports);
+					return module.exports;
+				}
+
+				const currentModule = globalThis._currentModule || { dirname: "/" };
+				const resolved = callSyncBridge(
+					globalThis._resolveModuleSync,
+					specifier,
+					currentModule.dirname || "/",
+					"require",
+				);
+				if (!resolved) {
+					throw new Error("Cannot resolve module '" + specifier + "'");
+				}
+
+				const cache = globalThis._moduleCache || (globalThis._moduleCache = {});
+				if (cache[resolved]) {
+					return cache[resolved].exports;
+				}
+
+				const source = callSyncBridge(
+					globalThis._loadFileSync,
+					resolved,
+					"require",
+				);
+				if (source == null) {
+					throw new Error("Cannot load module '" + resolved + "'");
+				}
+
+				const module = { exports: {} };
+				cache[resolved] = module;
+				const previous = globalThis._currentModule;
+				globalThis._currentModule = { filename: resolved, dirname: pathDirname(resolved) };
+				try {
+					const fn = new Function(
+						"require",
+						"module",
+						"exports",
+						"__filename",
+						"__dirname",
+						source,
+					);
+					fn(globalThis.require, module, module.exports, resolved, pathDirname(resolved));
+				} finally {
+					globalThis._currentModule = previous;
+				}
+				return module.exports;
+			};
+		})();
+	`;
+}
+export { createInMemoryFileSystem, InMemoryFileSystem };

package/dist/sync-bridge.d.ts

@@ -0,0 +1,46 @@
+export declare const SYNC_BRIDGE_SIGNAL_STATE_INDEX = 0;
+export declare const SYNC_BRIDGE_SIGNAL_STATUS_INDEX = 1;
+export declare const SYNC_BRIDGE_SIGNAL_KIND_INDEX = 2;
+export declare const SYNC_BRIDGE_SIGNAL_LENGTH_INDEX = 3;
+export declare const SYNC_BRIDGE_SIGNAL_STATE_IDLE = 0;
+export declare const SYNC_BRIDGE_SIGNAL_STATE_READY = 1;
+export declare const SYNC_BRIDGE_STATUS_OK = 0;
+export declare const SYNC_BRIDGE_STATUS_ERROR = 1;
+export declare const SYNC_BRIDGE_KIND_NONE = 0;
+export declare const SYNC_BRIDGE_KIND_TEXT = 1;
+export declare const SYNC_BRIDGE_KIND_BINARY = 2;
+export declare const SYNC_BRIDGE_KIND_JSON = 3;
+export declare const SYNC_BRIDGE_SIGNAL_BYTES: number;
+export declare const SYNC_BRIDGE_DEFAULT_WAIT_TIMEOUT_MS = 30000;
+export declare const SYNC_BRIDGE_DEFAULT_DATA_BYTES: number;
+export declare const SYNC_BRIDGE_MIN_DATA_BYTES: number;
+export declare const SYNC_BRIDGE_PAYLOAD_LIMIT_ERROR_CODE = "ERR_SANDBOX_PAYLOAD_TOO_LARGE";
+export type BrowserWorkerSyncOperation = "fs.readFile" | "fs.writeFile" | "fs.readFileBinary" | "fs.writeFileBinary" | "fs.readDir" | "fs.createDir" | "fs.mkdir" | "fs.rmdir" | "fs.exists" | "fs.stat" | "fs.lstat" | "fs.unlink" | "fs.rename" | "fs.realpath" | "fs.readlink" | "fs.symlink" | "fs.link" | "fs.chmod" | "fs.truncate" | "module.resolve" | "module.loadFile";
+export interface BrowserSyncBridgeBuffers {
+    signalBuffer: SharedArrayBuffer;
+    dataBuffer: SharedArrayBuffer;
+}
+export interface BrowserSyncBridgePayload extends BrowserSyncBridgeBuffers {
+    timeoutMs?: number;
+}
+export interface BrowserWorkerSyncRequestMessage {
+    type: "sync-request";
+    controlToken: string;
+    requestId: number;
+    operation: BrowserWorkerSyncOperation;
+    args: unknown[];
+}
+export interface BrowserSyncBridgeErrorPayload {
+    message: string;
+    code?: string;
+}
+export declare function assertBrowserSyncBridgeSupport(): void;
+export declare function getBrowserSyncBridgeDataBytes(payloadLimits?: {
+    base64TransferBytes?: number;
+    jsonPayloadBytes?: number;
+}): number;
+export declare function createBrowserSyncBridgePayload(payloadLimits?: {
+    base64TransferBytes?: number;
+    jsonPayloadBytes?: number;
+}): BrowserSyncBridgePayload;
+export declare function toBrowserSyncBridgeError(error: unknown): BrowserSyncBridgeErrorPayload;

package/dist/sync-bridge.js

@@ -0,0 +1,49 @@
+export const SYNC_BRIDGE_SIGNAL_STATE_INDEX = 0;
+export const SYNC_BRIDGE_SIGNAL_STATUS_INDEX = 1;
+export const SYNC_BRIDGE_SIGNAL_KIND_INDEX = 2;
+export const SYNC_BRIDGE_SIGNAL_LENGTH_INDEX = 3;
+export const SYNC_BRIDGE_SIGNAL_STATE_IDLE = 0;
+export const SYNC_BRIDGE_SIGNAL_STATE_READY = 1;
+export const SYNC_BRIDGE_STATUS_OK = 0;
+export const SYNC_BRIDGE_STATUS_ERROR = 1;
+export const SYNC_BRIDGE_KIND_NONE = 0;
+export const SYNC_BRIDGE_KIND_TEXT = 1;
+export const SYNC_BRIDGE_KIND_BINARY = 2;
+export const SYNC_BRIDGE_KIND_JSON = 3;
+export const SYNC_BRIDGE_SIGNAL_BYTES = 4 * Int32Array.BYTES_PER_ELEMENT;
+export const SYNC_BRIDGE_DEFAULT_WAIT_TIMEOUT_MS = 30_000;
+export const SYNC_BRIDGE_DEFAULT_DATA_BYTES = 16 * 1024 * 1024;
+export const SYNC_BRIDGE_MIN_DATA_BYTES = 64 * 1024;
+export const SYNC_BRIDGE_PAYLOAD_LIMIT_ERROR_CODE = "ERR_SANDBOX_PAYLOAD_TOO_LARGE";
+export function assertBrowserSyncBridgeSupport() {
+    if (typeof SharedArrayBuffer === "undefined") {
+        throw new Error("Browser runtime requires SharedArrayBuffer for sync filesystem and module loading parity");
+    }
+    if (typeof Atomics === "undefined" || typeof Atomics.wait !== "function") {
+        throw new Error("Browser runtime requires Atomics.wait for sync filesystem and module loading parity");
+    }
+}
+export function getBrowserSyncBridgeDataBytes(payloadLimits) {
+    return Math.max(payloadLimits?.base64TransferBytes ?? SYNC_BRIDGE_DEFAULT_DATA_BYTES, payloadLimits?.jsonPayloadBytes ?? 4 * 1024 * 1024, SYNC_BRIDGE_MIN_DATA_BYTES);
+}
+export function createBrowserSyncBridgePayload(payloadLimits) {
+    assertBrowserSyncBridgeSupport();
+    return {
+        signalBuffer: new SharedArrayBuffer(SYNC_BRIDGE_SIGNAL_BYTES),
+        dataBuffer: new SharedArrayBuffer(getBrowserSyncBridgeDataBytes(payloadLimits)),
+        timeoutMs: SYNC_BRIDGE_DEFAULT_WAIT_TIMEOUT_MS,
+    };
+}
+export function toBrowserSyncBridgeError(error) {
+    if (error instanceof Error) {
+        return {
+            message: error.message,
+            code: typeof error.code === "string"
+                ? error.code
+                : undefined,
+        };
+    }
+    return {
+        message: String(error),
+    };
+}

package/dist/worker-adapter.js

@@ -4,6 +4,7 @@
  * Wraps the Web Worker API for spawning Workers.
  * Requires COOP/COEP headers for SharedArrayBuffer support.
  */
+// biome-ignore lint/complexity/noStaticOnlyClass: This class is part of the public browser package API.
 export class BrowserWorkerAdapter {
     /**
      * Spawn a Web Worker for the given script URL.

package/dist/worker-protocol.d.ts

@@ -1,4 +1,5 @@
-import type { OSConfig, ProcessConfig, ExecResult, RunResult, StdioChannel } from "@secure-exec/core";
+import type { ExecResult, OSConfig, ProcessConfig, RunResult, StdioChannel, TimingMitigation } from "./runtime.js";
+import type { BrowserSyncBridgePayload, BrowserWorkerSyncRequestMessage } from "./sync-bridge.js";
 export type SerializedPermissions = {
     fs?: string;
     network?: string;
@@ -10,6 +11,15 @@ export type BrowserWorkerExecOptions = {
     env?: Record<string, string>;
     cwd?: string;
     stdin?: string;
+    timingMitigation?: TimingMitigation;
+};
+export type BrowserWorkerExtensionRequestPayload = {
+    namespace: string;
+    payload: Uint8Array;
+};
+export type BrowserWorkerExtensionResponse = {
+    namespace: string;
+    payload: Uint8Array;
 };
 export type BrowserWorkerInitPayload = {
     processConfig?: ProcessConfig;
@@ -17,16 +27,22 @@ export type BrowserWorkerInitPayload = {
     permissions?: SerializedPermissions;
     filesystem?: "opfs" | "memory";
     networkEnabled?: boolean;
+    timingMitigation?: TimingMitigation;
     payloadLimits?: {
         base64TransferBytes?: number;
         jsonPayloadBytes?: number;
     };
+    syncBridge?: BrowserSyncBridgePayload;
 };
-export type BrowserWorkerRequestMessage = {
+type BrowserWorkerControlMessage = {
+    controlToken: string;
+};
+export type BrowserWorkerRequestMessage = (BrowserWorkerControlMessage & {
     id: number;
     type: "init";
     payload: BrowserWorkerInitPayload;
-} | {
+}) | {
+    controlToken: string;
     id: number;
     type: "exec";
     payload: {
@@ -35,6 +51,7 @@ export type BrowserWorkerRequestMessage = {
         captureStdio?: boolean;
     };
 } | {
+    controlToken: string;
     id: number;
     type: "run";
     payload: {
@@ -42,16 +59,21 @@ export type BrowserWorkerRequestMessage = {
         filePath?: string;
         captureStdio?: boolean;
     };
-} | {
+} | (BrowserWorkerControlMessage & {
+    id: number;
+    type: "extension";
+    payload: BrowserWorkerExtensionRequestPayload;
+}) | (BrowserWorkerControlMessage & {
     id: number;
     type: "dispose";
-};
-export type BrowserWorkerResponseMessage = {
+});
+export type BrowserWorkerResponseMessage = (BrowserWorkerControlMessage & {
     type: "response";
     id: number;
     ok: true;
-    result: ExecResult | RunResult | true;
-} | {
+    result: ExecResult | RunResult | BrowserWorkerExtensionResponse | true;
+}) | {
+    controlToken: string;
     type: "response";
     id: number;
     ok: false;
@@ -61,10 +83,11 @@ export type BrowserWorkerResponseMessage = {
         code?: string;
     };
 };
-export type BrowserWorkerStdioMessage = {
+export type BrowserWorkerStdioMessage = BrowserWorkerControlMessage & {
     type: "stdio";
     requestId: number;
     channel: StdioChannel;
     message: string;
 };
-export type BrowserWorkerOutboundMessage = BrowserWorkerResponseMessage | BrowserWorkerStdioMessage;
+export type BrowserWorkerOutboundMessage = BrowserWorkerResponseMessage | BrowserWorkerStdioMessage | BrowserWorkerSyncRequestMessage;
+export {};