@secure-exec/core 0.1.0-rc.2 → 0.1.0-rc.3

package/dist/bridge.js

@@ -6178,8 +6178,8 @@ var bridge = (() => {
     },
     {
       name: "_moduleCache",
-      classification: "mutable-runtime-state",
-      rationale: "Per-execution CommonJS/require cache state."
+      classification: "hardened",
+      rationale: "Per-execution CommonJS/require cache \u2014 hardened via read-only Proxy to prevent cache poisoning."
     },
     {
       name: "_pendingModules",
@@ -6230,6 +6230,31 @@ var bridge = (() => {
       name: "__dirname",
       classification: "mutable-runtime-state",
       rationale: "Per-execution CommonJS file context state."
+    },
+    {
+      name: "fetch",
+      classification: "hardened",
+      rationale: "Network fetch API global \u2014 must not be replaceable by sandbox code."
+    },
+    {
+      name: "Headers",
+      classification: "hardened",
+      rationale: "Network Headers API global \u2014 must not be replaceable by sandbox code."
+    },
+    {
+      name: "Request",
+      classification: "hardened",
+      rationale: "Network Request API global \u2014 must not be replaceable by sandbox code."
+    },
+    {
+      name: "Response",
+      classification: "hardened",
+      rationale: "Network Response API global \u2014 must not be replaceable by sandbox code."
+    },
+    {
+      name: "Blob",
+      classification: "hardened",
+      rationale: "Blob API global stub \u2014 must not be replaceable by sandbox code."
     }
   ];
   var HARDENED_NODE_CUSTOM_GLOBALS = NODE_CUSTOM_GLOBAL_INVENTORY.filter((entry) => entry.classification === "hardened").map((entry) => entry.name);
@@ -6257,6 +6282,9 @@ var bridge = (() => {
   var _activeHandles = /* @__PURE__ */ new Map();
   var _waitResolvers = [];
   function _registerHandle2(id, description) {
+    if (typeof _maxHandles !== "undefined" && !_activeHandles.has(id) && _activeHandles.size >= _maxHandles) {
+      throw new Error("ERR_RESOURCE_BUDGET_EXCEEDED: maximum active handles exceeded");
+    }
     _activeHandles.set(id, description);
   }
   function _unregisterHandle2(id) {
@@ -6285,6 +6313,7 @@ var bridge = (() => {
 
   // src/bridge/fs.ts
   var import_buffer = __toESM(require_buffer(), 1);
+  var MAX_BRIDGE_FDS = 1024;
   var fdTable = /* @__PURE__ */ new Map();
   var nextFd = 3;
   var O_RDONLY = 0;
@@ -6646,6 +6675,7 @@ var bridge = (() => {
       yield this.readableEncoding ? chunk.toString(this.readableEncoding) : chunk;
     }
   };
+  var MAX_WRITE_STREAM_BYTES = 16 * 1024 * 1024;
   var WriteStream = class {
     // WriteStream-specific properties
     bytesWritten = 0;
@@ -6704,6 +6734,16 @@ var bridge = (() => {
       } else {
         data = import_buffer.Buffer.from(String(chunk));
       }
+      if (this.writableLength + data.length > MAX_WRITE_STREAM_BYTES) {
+        const err = new Error(`WriteStream buffer exceeded ${MAX_WRITE_STREAM_BYTES} bytes`);
+        this.errored = err;
+        this.destroyed = true;
+        this.writable = false;
+        const cb2 = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
+        if (cb2) Promise.resolve().then(() => cb2(err));
+        Promise.resolve().then(() => this.emit("error", err));
+        return false;
+      }
       this._chunks.push(data);
       this.bytesWritten += data.length;
       this.writableLength += data.length;
@@ -6908,7 +6948,7 @@ var bridge = (() => {
   function createFsError(code, message, syscall, path) {
     const err = new Error(message);
     err.code = code;
-    err.errno = code === "ENOENT" ? -2 : code === "EACCES" ? -13 : code === "EBADF" ? -9 : -1;
+    err.errno = code === "ENOENT" ? -2 : code === "EACCES" ? -13 : code === "EBADF" ? -9 : code === "EMFILE" ? -24 : -1;
     err.syscall = syscall;
     if (path) err.path = path;
     return err;
@@ -6990,10 +7030,12 @@ var bridge = (() => {
     }
     return baseParts.join("/") || "/";
   }
+  var MAX_GLOB_DEPTH = 100;
   function _globCollect(pattern, results) {
     const regex = _globToRegex(pattern);
     const base = _globGetBase(pattern);
-    const walk = (dir) => {
+    const walk = (dir, depth) => {
+      if (depth > MAX_GLOB_DEPTH) return;
       let entries;
       try {
         entries = _globReadDir(dir);
@@ -7008,7 +7050,7 @@ var bridge = (() => {
         try {
           const stat = _globStat(fullPath);
           if (stat.isDirectory()) {
-            walk(fullPath);
+            walk(fullPath, depth + 1);
           }
         } catch {
         }
@@ -7022,7 +7064,7 @@ var bridge = (() => {
           return;
         }
       }
-      walk(base);
+      walk(base, 0);
     } catch {
     }
   }
@@ -7317,6 +7359,9 @@ var bridge = (() => {
     },
     // File descriptor methods
     openSync(path, flags, _mode) {
+      if (fdTable.size >= MAX_BRIDGE_FDS) {
+        throw createFsError("EMFILE", "EMFILE: too many open files, open '" + toPathString(path) + "'", "open", toPathString(path));
+      }
       const rawPath = toPathString(path);
       const pathStr = rawPath;
       const numFlags = parseFlags(flags);
@@ -8127,11 +8172,63 @@ var bridge = (() => {
     },
     realpathSync: Object.assign(
       function realpathSync(path) {
-        return toPathString(path).replace(/\/\/+/g, "/").replace(/\/$/, "") || "/";
+        const MAX_SYMLINK_DEPTH = 40;
+        let symlinksFollowed = 0;
+        const raw = toPathString(path);
+        const pending = [];
+        for (const seg of raw.split("/")) {
+          if (!seg || seg === ".") continue;
+          if (seg === "..") {
+            if (pending.length > 0) pending.pop();
+          } else pending.push(seg);
+        }
+        const resolved = [];
+        while (pending.length > 0) {
+          const seg = pending.shift();
+          if (seg === ".") continue;
+          if (seg === "..") {
+            if (resolved.length > 0) resolved.pop();
+            continue;
+          }
+          resolved.push(seg);
+          const currentPath = "/" + resolved.join("/");
+          try {
+            const stat = fs.lstatSync(currentPath);
+            if (stat.isSymbolicLink()) {
+              if (++symlinksFollowed > MAX_SYMLINK_DEPTH) {
+                const err = new Error(`ELOOP: too many levels of symbolic links, realpath '${raw}'`);
+                err.code = "ELOOP";
+                err.syscall = "realpath";
+                err.path = raw;
+                throw err;
+              }
+              const target = fs.readlinkSync(currentPath);
+              const targetSegs = target.split("/").filter(Boolean);
+              if (target.startsWith("/")) {
+                resolved.length = 0;
+              } else {
+                resolved.pop();
+              }
+              pending.unshift(...targetSegs);
+            }
+          } catch (e) {
+            const err = e;
+            if (err.code === "ELOOP") throw e;
+            if (err.code === "ENOENT" || err.code === "ENOTDIR") {
+              const enoent = new Error(`ENOENT: no such file or directory, realpath '${raw}'`);
+              enoent.code = "ENOENT";
+              enoent.syscall = "realpath";
+              enoent.path = raw;
+              throw enoent;
+            }
+            break;
+          }
+        }
+        return "/" + resolved.join("/") || "/";
       },
       {
         native(path) {
-          return toPathString(path).replace(/\/\/+/g, "/").replace(/\/$/, "") || "/";
+          return fs.realpathSync(path);
         }
       }
     ),
@@ -8556,10 +8653,25 @@ var bridge = (() => {
     }
   };
   exposeCustomGlobal("_childProcessDispatch", childProcessDispatch);
+  function checkStreamMaxListeners(stream, event) {
+    if (stream._maxListeners > 0 && !stream._maxListenersWarned.has(event)) {
+      const total = (stream._listeners[event]?.length ?? 0) + (stream._onceListeners[event]?.length ?? 0);
+      if (total > stream._maxListeners) {
+        stream._maxListenersWarned.add(event);
+        const warning = `MaxListenersExceededWarning: Possible EventEmitter memory leak detected. ${total} ${event} listeners added. MaxListeners is ${stream._maxListeners}. Use emitter.setMaxListeners() to increase limit`;
+        if (typeof console !== "undefined" && console.error) {
+          console.error(warning);
+        }
+      }
+    }
+  }
+  var _nextChildPid = 1e3;
   var ChildProcess = class {
     _listeners = {};
     _onceListeners = {};
-    pid = Math.floor(Math.random() * 1e4) + 1e3;
+    _maxListeners = 10;
+    _maxListenersWarned = /* @__PURE__ */ new Set();
+    pid = _nextChildPid++;
     killed = false;
     exitCode = null;
     signalCode = null;
@@ -8593,14 +8705,18 @@ var bridge = (() => {
         readable: true,
         _listeners: {},
         _onceListeners: {},
+        _maxListeners: 10,
+        _maxListenersWarned: /* @__PURE__ */ new Set(),
         on(event, listener) {
           if (!this._listeners[event]) this._listeners[event] = [];
           this._listeners[event].push(listener);
+          checkStreamMaxListeners(this, event);
           return this;
         },
         once(event, listener) {
           if (!this._onceListeners[event]) this._onceListeners[event] = [];
           this._onceListeners[event].push(listener);
+          checkStreamMaxListeners(this, event);
           return this;
         },
         emit(event, ...args) {
@@ -8619,6 +8735,13 @@ var bridge = (() => {
         setEncoding() {
           return this;
         },
+        setMaxListeners(n) {
+          this._maxListeners = n;
+          return this;
+        },
+        getMaxListeners() {
+          return this._maxListeners;
+        },
         pipe(dest) {
           return dest;
         }
@@ -8627,14 +8750,18 @@ var bridge = (() => {
         readable: true,
         _listeners: {},
         _onceListeners: {},
+        _maxListeners: 10,
+        _maxListenersWarned: /* @__PURE__ */ new Set(),
         on(event, listener) {
           if (!this._listeners[event]) this._listeners[event] = [];
           this._listeners[event].push(listener);
+          checkStreamMaxListeners(this, event);
           return this;
         },
         once(event, listener) {
           if (!this._onceListeners[event]) this._onceListeners[event] = [];
           this._onceListeners[event].push(listener);
+          checkStreamMaxListeners(this, event);
           return this;
         },
         emit(event, ...args) {
@@ -8653,6 +8780,13 @@ var bridge = (() => {
         setEncoding() {
           return this;
         },
+        setMaxListeners(n) {
+          this._maxListeners = n;
+          return this;
+        },
+        getMaxListeners() {
+          return this._maxListeners;
+        },
         pipe(dest) {
           return dest;
         }
@@ -8662,11 +8796,13 @@ var bridge = (() => {
     on(event, listener) {
       if (!this._listeners[event]) this._listeners[event] = [];
       this._listeners[event].push(listener);
+      this._checkMaxListeners(event);
       return this;
     }
     once(event, listener) {
       if (!this._onceListeners[event]) this._onceListeners[event] = [];
       this._onceListeners[event].push(listener);
+      this._checkMaxListeners(event);
       return this;
     }
     off(event, listener) {
@@ -8679,6 +8815,25 @@ var bridge = (() => {
     removeListener(event, listener) {
       return this.off(event, listener);
     }
+    setMaxListeners(n) {
+      this._maxListeners = n;
+      return this;
+    }
+    getMaxListeners() {
+      return this._maxListeners;
+    }
+    _checkMaxListeners(event) {
+      if (this._maxListeners > 0 && !this._maxListenersWarned.has(event)) {
+        const total = (this._listeners[event]?.length ?? 0) + (this._onceListeners[event]?.length ?? 0);
+        if (total > this._maxListeners) {
+          this._maxListenersWarned.add(event);
+          const warning = `MaxListenersExceededWarning: Possible EventEmitter memory leak detected. ${total} ${event} listeners added to [ChildProcess]. MaxListeners is ${this._maxListeners}. Use emitter.setMaxListeners() to increase limit`;
+          if (typeof console !== "undefined" && console.error) {
+            console.error(warning);
+          }
+        }
+      }
+    }
     emit(event, ...args) {
       let handled = false;
       if (this._listeners[event]) {
@@ -8741,19 +8896,21 @@ var bridge = (() => {
     let stderrBytes = 0;
     let maxBufferExceeded = false;
     child.stdout.on("data", (data) => {
+      if (maxBufferExceeded) return;
       const chunk = String(data);
       stdout += chunk;
       stdoutBytes += chunk.length;
-      if (stdoutBytes > maxBuffer && !maxBufferExceeded) {
+      if (stdoutBytes > maxBuffer) {
         maxBufferExceeded = true;
         child.kill("SIGTERM");
       }
     });
     child.stderr.on("data", (data) => {
+      if (maxBufferExceeded) return;
       const chunk = String(data);
       stderr += chunk;
       stderrBytes += chunk.length;
-      if (stderrBytes > maxBuffer && !maxBufferExceeded) {
+      if (stderrBytes > maxBuffer) {
         maxBufferExceeded = true;
         child.kill("SIGTERM");
       }
@@ -8891,7 +9048,7 @@ var bridge = (() => {
     }
     if (typeof _childProcessSpawnSync === "undefined") {
       return {
-        pid: 0,
+        pid: _nextChildPid++,
         output: [null, "", "child_process.spawnSync requires CommandExecutor to be configured"],
         stdout: "",
         stderr: "child_process.spawnSync requires CommandExecutor to be configured",
@@ -8915,7 +9072,7 @@ var bridge = (() => {
         const err = new Error("stdout maxBuffer length exceeded");
         err.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
         return {
-          pid: Math.floor(Math.random() * 1e4) + 1e3,
+          pid: _nextChildPid++,
           output: [null, stdoutBuf, stderrBuf],
           stdout: stdoutBuf,
           stderr: stderrBuf,
@@ -8925,7 +9082,7 @@ var bridge = (() => {
         };
       }
       return {
-        pid: Math.floor(Math.random() * 1e4) + 1e3,
+        pid: _nextChildPid++,
         output: [null, stdoutBuf, stderrBuf],
         stdout: stdoutBuf,
         stderr: stderrBuf,
@@ -8937,7 +9094,7 @@ var bridge = (() => {
       const errMsg = err instanceof Error ? err.message : String(err);
       const stderrBuf = typeof Buffer !== "undefined" ? Buffer.from(errMsg) : errMsg;
       return {
-        pid: 0,
+        pid: _nextChildPid++,
         output: [null, "", stderrBuf],
         stdout: typeof Buffer !== "undefined" ? Buffer.from("") : "",
         stderr: stderrBuf,
@@ -10393,13 +10550,13 @@ var bridge = (() => {
   exposeCustomGlobal("_http2Module", http2);
   exposeCustomGlobal("_dnsModule", dns);
   exposeCustomGlobal("_httpServerDispatch", dispatchServerRequest);
-  globalThis.fetch = fetch;
-  globalThis.Headers = Headers;
-  globalThis.Request = Request;
-  globalThis.Response = Response;
+  exposeCustomGlobal("fetch", fetch);
+  exposeCustomGlobal("Headers", Headers);
+  exposeCustomGlobal("Request", Request);
+  exposeCustomGlobal("Response", Response);
   if (typeof globalThis.Blob === "undefined") {
-    globalThis.Blob = class BlobStub {
-    };
+    exposeCustomGlobal("Blob", class BlobStub {
+    });
   }
   var network_default = {
     fetch,
@@ -10472,14 +10629,65 @@ var bridge = (() => {
     }
   };
   exposeCustomGlobal("ProcessExitError", ProcessExitError);
+  var _signalNumbers = {
+    SIGHUP: 1,
+    SIGINT: 2,
+    SIGQUIT: 3,
+    SIGILL: 4,
+    SIGTRAP: 5,
+    SIGABRT: 6,
+    SIGBUS: 7,
+    SIGFPE: 8,
+    SIGKILL: 9,
+    SIGUSR1: 10,
+    SIGSEGV: 11,
+    SIGUSR2: 12,
+    SIGPIPE: 13,
+    SIGALRM: 14,
+    SIGTERM: 15,
+    SIGCHLD: 17,
+    SIGCONT: 18,
+    SIGSTOP: 19,
+    SIGTSTP: 20,
+    SIGTTIN: 21,
+    SIGTTOU: 22,
+    SIGURG: 23,
+    SIGXCPU: 24,
+    SIGXFSZ: 25,
+    SIGVTALRM: 26,
+    SIGPROF: 27,
+    SIGWINCH: 28,
+    SIGIO: 29,
+    SIGPWR: 30,
+    SIGSYS: 31
+  };
+  function _resolveSignal(signal) {
+    if (signal === void 0 || signal === null) return 15;
+    if (typeof signal === "number") return signal;
+    const num = _signalNumbers[signal];
+    if (num !== void 0) return num;
+    throw new Error("Unknown signal: " + signal);
+  }
   var _processListeners = {};
   var _processOnceListeners = {};
+  var _processMaxListeners = 10;
+  var _processMaxListenersWarned = /* @__PURE__ */ new Set();
   function _addListener(event, listener, once = false) {
     const target = once ? _processOnceListeners : _processListeners;
     if (!target[event]) {
       target[event] = [];
     }
     target[event].push(listener);
+    if (_processMaxListeners > 0 && !_processMaxListenersWarned.has(event)) {
+      const total = (_processListeners[event]?.length ?? 0) + (_processOnceListeners[event]?.length ?? 0);
+      if (total > _processMaxListeners) {
+        _processMaxListenersWarned.add(event);
+        const warning = `MaxListenersExceededWarning: Possible EventEmitter memory leak detected. ${total} ${event} listeners added to [process]. MaxListeners is ${_processMaxListeners}. Use emitter.setMaxListeners() to increase limit`;
+        if (typeof _error !== "undefined") {
+          _error.applySync(void 0, [warning]);
+        }
+      }
+    }
     return process2;
   }
   function _removeListener(event, listener) {
@@ -10764,6 +10972,26 @@ var bridge = (() => {
       return _cwd;
     },
     chdir(dir) {
+      let statJson;
+      try {
+        statJson = _fs.stat.applySyncPromise(void 0, [dir]);
+      } catch {
+        const err = new Error(`ENOENT: no such file or directory, chdir '${dir}'`);
+        err.code = "ENOENT";
+        err.errno = -2;
+        err.syscall = "chdir";
+        err.path = dir;
+        throw err;
+      }
+      const parsed = JSON.parse(statJson);
+      if (!parsed.isDirectory) {
+        const err = new Error(`ENOTDIR: not a directory, chdir '${dir}'`);
+        err.code = "ENOTDIR";
+        err.errno = -20;
+        err.syscall = "chdir";
+        err.path = dir;
+        throw err;
+      }
       _cwd = dir;
     },
     get exitCode() {
@@ -10878,10 +11106,8 @@ var bridge = (() => {
         err.syscall = "kill";
         throw err;
       }
-      if (!signal || signal === "SIGTERM" || signal === 15) {
-        process2.exit(143);
-      }
-      return true;
+      const sigNum = _resolveSignal(signal);
+      return process2.exit(128 + sigNum);
     },
     // EventEmitter methods
     on(event, listener) {
@@ -10944,11 +11170,12 @@ var bridge = (() => {
         ])
       ];
     },
-    setMaxListeners() {
+    setMaxListeners(n) {
+      _processMaxListeners = n;
       return process2;
     },
     getMaxListeners() {
-      return 10;
+      return _processMaxListeners;
     },
     rawListeners(event) {
       return process2.listeners(event);
@@ -10966,32 +11193,11 @@ var bridge = (() => {
       const msg = typeof warning === "string" ? warning : warning.message;
       _emit("warning", { message: msg, name: "Warning" });
     },
-    binding(name) {
-      const stubs = {
-        fs: {},
-        buffer: {
-          Buffer: globalThis.Buffer,
-          constants: BUFFER_CONSTANTS,
-          kMaxLength: BUFFER_MAX_LENGTH,
-          kStringMaxLength: BUFFER_MAX_STRING_LENGTH
-        },
-        process_wrap: {},
-        natives: {},
-        config: {},
-        uv: { UV_UDP_REUSEADDR: 4 },
-        constants: {
-          MAX_LENGTH: BUFFER_MAX_LENGTH,
-          MAX_STRING_LENGTH: BUFFER_MAX_STRING_LENGTH,
-          buffer: BUFFER_CONSTANTS
-        },
-        crypto: {},
-        string_decoder: {},
-        os: {}
-      };
-      return stubs[name] || {};
+    binding(_name) {
+      throw new Error("process.binding is not supported in sandbox");
     },
-    _linkedBinding(name) {
-      return process2.binding(name);
+    _linkedBinding(_name) {
+      throw new Error("process._linkedBinding is not supported in sandbox");
     },
     dlopen() {
       throw new Error("process.dlopen is not supported");
@@ -11106,7 +11312,7 @@ var bridge = (() => {
     const id = ++_timerId;
     const handle = new TimerHandle(id);
     _intervals.set(id, handle);
-    const actualDelay = delay ?? 0;
+    const actualDelay = Math.max(1, delay ?? 0);
     const scheduleNext = () => {
       if (!_intervals.has(id)) return;
       if (typeof _scheduleTimer !== "undefined" && actualDelay > 0) {
@@ -11155,6 +11361,11 @@ var bridge = (() => {
       if (typeof _cryptoRandomFill === "undefined") {
         throwUnsupportedCryptoApi("getRandomValues");
       }
+      if (array.byteLength > 65536) {
+        throw new RangeError(
+          `The ArrayBufferView's byte length (${array.byteLength}) exceeds the number of bytes of entropy available via this API (65536)`
+        );
+      }
       const bytes = new Uint8Array(
         array.buffer,
         array.byteOffset,