@wardby/cli 0.1.0

package/dist/sandbox/limits.js

@@ -0,0 +1,39 @@
+/** Sandbox resource limits — one module, tunable. All defaulted. */
+/** QuickJS heap ceiling per invocation (bytes). Trips a QuickJS-level OOM error. */
+export const MEMORY_LIMIT_BYTES = 32 * 1024 * 1024; // 32 MiB
+/**
+ * Interrupt-handler check budget. Counts interrupt-handler invocations (the
+ * interpreter calls this periodically while running bytecode), not wall
+ * time — deterministic, can't be gamed by a busy loop that happens to be
+ * slow on one machine and fast on another.
+ */
+export const MAX_INTERRUPT_CHECKS = 20_000_000;
+/**
+ * Wall-time cap per tool invocation. Belt-and-suspenders alongside the
+ * instruction cap: the interrupt handler only runs while the interpreter is
+ * actively executing bytecode, so it can't bound time spent suspended
+ * awaiting a host async call (e.g. a slow `fetch`) — this does.
+ */
+export const WALL_TIME_LIMIT_MS = 10_000;
+/** Timeout for the sandbox's `fetch` host bridge, independent of the wall-time cap. */
+export const FETCH_TIMEOUT_MS = 8_000;
+/** QuickJS interpreter stack size cap (bytes). */
+export const MAX_STACK_SIZE_BYTES = 1024 * 1024; // 1 MiB
+export const FETCH_RESPONSE_BYTES = 8 * 1024 * 1024;
+export const MAX_REDIRECTS = 5;
+export const RANDOM_BYTES_LIMIT = 65_536;
+export const BRIDGE_INPUT_BYTES = 1024 * 1024;
+export const BRIDGE_RESULT_BYTES = 12 * 1024 * 1024;
+export const PARSER_INPUT_BYTES = 256 * 1024;
+export const HTML_LINKS_LIMIT = 1000;
+export const LOG_BYTES = 16 * 1024;
+export const MAX_HOST_CALLS = 256;
+export const MAX_PENDING_HOST_CALLS = 8;
+/** Max concurrent parser worker threads across the whole process (html/csv/xml bridge calls share this budget). */
+export const PARSER_WORKER_MAX_CONCURRENCY = 4;
+/** Max callers waiting for a free worker slot before a new call is rejected immediately instead of queueing. */
+export const PARSER_WORKER_QUEUE_LIMIT = 32;
+/** Hard wall-clock budget for one parse call; the worker is forcibly terminated if it runs longer. */
+export const PARSER_WORKER_TIMEOUT_MS = 5_000;
+/** Per-worker V8 old-generation heap cap (resourceLimits) — see plan D2 for its known Buffer-allocation blind spot. */
+export const PARSER_WORKER_MAX_OLD_GEN_MB = 64;

package/dist/sandbox/parser-worker/__fixtures__/crash.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/parser-worker/__fixtures__/crash.js

@@ -0,0 +1,6 @@
+import { parentPort } from "node:worker_threads";
+if (parentPort) {
+    parentPort.on("message", () => {
+        throw new Error("fixture_crash");
+    });
+}

package/dist/sandbox/parser-worker/__fixtures__/echo.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/parser-worker/__fixtures__/echo.js

@@ -0,0 +1,5 @@
+import { parentPort } from "node:worker_threads";
+if (parentPort) {
+    const port = parentPort;
+    port.on("message", (request) => port.postMessage({ ok: true, value: request }));
+}

package/dist/sandbox/parser-worker/__fixtures__/reject.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/parser-worker/__fixtures__/reject.js

@@ -0,0 +1,5 @@
+import { parentPort } from "node:worker_threads";
+if (parentPort) {
+    const port = parentPort;
+    port.on("message", () => port.postMessage({ ok: false, message: "fixture_reject" }));
+}

package/dist/sandbox/parser-worker/__fixtures__/spin-forever.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/parser-worker/__fixtures__/spin-forever.js

@@ -0,0 +1,11 @@
+import { parentPort } from "node:worker_threads";
+if (parentPort) {
+    parentPort.on("message", () => {
+        // Simulates a pathological synchronous parse that never yields — this
+        // is what proves the pool's timeout can reclaim a genuinely hung
+        // worker, without depending on any real library's specific behavior.
+        let _busyWork = 0;
+        while (true)
+            _busyWork++;
+    });
+}

package/dist/sandbox/parser-worker/pool.d.ts

@@ -0,0 +1,13 @@
+export type ParserKind = "html" | "csv" | "xml";
+export interface ParserWorkerPool {
+    run(kind: ParserKind, payload: unknown, signal?: AbortSignal): Promise<unknown>;
+}
+export interface ParserWorkerPoolOptions {
+    maxConcurrency?: number;
+    timeoutMs?: number;
+    maxOldGenerationSizeMb?: number;
+    queueLimit?: number;
+    /** Test-only escape hatch: which worker script to spawn (real workers point fixtures here instead). */
+    workerUrl?: URL;
+}
+export declare function createParserWorkerPool(options?: ParserWorkerPoolOptions): ParserWorkerPool;

package/dist/sandbox/parser-worker/pool.js

@@ -0,0 +1,111 @@
+/**
+ * Bounds the three parser bridge functions (HTML/CSV/XML) to a fixed
+ * number of concurrent, isolated worker threads with a hard per-call
+ * timeout. These parsers run fully attacker-controlled (but size-capped)
+ * input through third-party libraries in the HOST Node process — QuickJS's
+ * own CPU/memory/wall-time limits don't apply to that work at all, and an
+ * AbortSignal alone cannot interrupt a synchronous CPU-bound call already
+ * in flight. A worker thread's terminate() can (verified: kills a genuine
+ * synchronous infinite loop in ~300ms) — this module pairs that
+ * termination primitive with a bounded concurrency gate and queue so a
+ * pathological input degrades one call, not the whole process.
+ *
+ * Deliberately spawn-per-call rather than a persistent reused pool: a
+ * dead/terminated worker just isn't reused, so there's no "respawn a
+ * broken slot" state machine to get wrong after an attack. The cost is a
+ * few ms of thread-spawn overhead per call, negligible against the
+ * multi-second timeout budget this exists to bound.
+ */
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+import { PARSER_WORKER_MAX_CONCURRENCY, PARSER_WORKER_MAX_OLD_GEN_MB, PARSER_WORKER_QUEUE_LIMIT, PARSER_WORKER_TIMEOUT_MS, } from "../limits.js";
+const defaultWorkerJsUrl = new URL("./worker.js", import.meta.url);
+// `new Worker()` loads by literal file URL — it gets none of the NodeNext
+// ".js"-import-resolves-to-".ts" remapping tsx/vitest give normal `import`
+// statements. Under tsx/vitest only worker.ts exists on disk; after
+// `tsc -p tsconfig.build.json` only the compiled worker.js does.
+const DEFAULT_WORKER_URL = existsSync(fileURLToPath(defaultWorkerJsUrl))
+    ? defaultWorkerJsUrl
+    : new URL("./worker.ts", import.meta.url);
+// A worker spawned from a vitest-run process does NOT inherit a tsx loader
+// via process.execArgv (vitest's own parent process isn't started via
+// `tsx` — only a `tsx`-launched process, e.g. the `cli` script, has that
+// in its execArgv to inherit). worker.ts imports sibling files via
+// NodeNext ".js" specifiers that only resolve to their real ".ts" files
+// under a TS-aware loader, so a .ts worker needs one explicitly rather
+// than relying on inheritance. Verified: without this, spawning worker.ts
+// under vitest fails with "Cannot find module '.../bounded-json.js'".
+const TS_WORKER_EXEC_ARGV = ["--import", "tsx/esm"];
+export function createParserWorkerPool(options = {}) {
+    const maxConcurrency = options.maxConcurrency ?? PARSER_WORKER_MAX_CONCURRENCY;
+    const timeoutMs = options.timeoutMs ?? PARSER_WORKER_TIMEOUT_MS;
+    const maxOldGenerationSizeMb = options.maxOldGenerationSizeMb ?? PARSER_WORKER_MAX_OLD_GEN_MB;
+    const queueLimit = options.queueLimit ?? PARSER_WORKER_QUEUE_LIMIT;
+    const workerUrl = options.workerUrl ?? DEFAULT_WORKER_URL;
+    let active = 0;
+    const waiters = [];
+    async function acquire() {
+        if (active < maxConcurrency) {
+            active++;
+            return;
+        }
+        if (waiters.length >= queueLimit)
+            throw new Error("parser_pool_saturated");
+        await new Promise((resolve) => waiters.push(resolve));
+        active++;
+    }
+    function release() {
+        active--;
+        const next = waiters.shift();
+        if (next)
+            next();
+    }
+    async function run(kind, payload, signal) {
+        if (signal?.aborted)
+            throw new Error("parser_aborted");
+        await acquire();
+        if (signal?.aborted) {
+            release();
+            throw new Error("parser_aborted");
+        }
+        const worker = new Worker(workerUrl, {
+            resourceLimits: { maxOldGenerationSizeMb },
+            ...(workerUrl.pathname.endsWith(".ts") ? { execArgv: TS_WORKER_EXEC_ARGV } : {}),
+        });
+        try {
+            return await new Promise((resolve, reject) => {
+                let settled = false;
+                const cleanup = () => {
+                    clearTimeout(timer);
+                    signal?.removeEventListener("abort", onAbort);
+                };
+                const finish = (fn) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    fn();
+                };
+                const timer = setTimeout(() => finish(() => reject(new Error("parser_timeout"))), timeoutMs);
+                const onAbort = () => finish(() => reject(new Error("parser_aborted")));
+                signal?.addEventListener("abort", onAbort, { once: true });
+                worker.once("message", (msg) => {
+                    finish(() => (msg.ok ? resolve(msg.value) : reject(new Error(msg.message ?? "parser_failed"))));
+                });
+                worker.once("error", (err) => {
+                    finish(() => reject(new Error(`parser_worker_crashed: ${err.message}`)));
+                });
+                worker.once("exit", (code) => {
+                    finish(() => reject(new Error(`parser_worker_terminated: exit code ${code}`)));
+                });
+                worker.postMessage({ kind, payload });
+            });
+        }
+        finally {
+            await worker.terminate().catch(() => { });
+            release();
+        }
+    }
+    return { run };
+}

package/dist/sandbox/parser-worker/worker.d.ts

@@ -0,0 +1,14 @@
+export declare function parseHtmlPayload(html: string): {
+    title: string | null;
+    text: string;
+    links: {
+        href: string;
+        text: string;
+    }[];
+};
+export declare function parseCsvPayload(csv: string, header: boolean): {
+    data: unknown;
+    errors: unknown;
+    meta: unknown;
+};
+export declare function parseXmlPayload(xml: string, xmlOptions: Record<string, unknown> | null): unknown;

package/dist/sandbox/parser-worker/worker.js

@@ -0,0 +1,63 @@
+/**
+ * Runs inside a spawned worker thread (see ./pool.ts) — the actual
+ * node-html-parser/papaparse/fast-xml-parser calls happen here, off the
+ * main event loop, so a pathological input can only ever hang this one
+ * disposable thread. `parentPort` is null when this file is imported
+ * directly (e.g. by worker.test.ts), so the message-wiring block below is
+ * a no-op in that context — the exported functions are plain, directly
+ * testable without spinning up a thread.
+ */
+import { parentPort } from "node:worker_threads";
+import { parse as parseHtmlDom } from "node-html-parser";
+import Papa from "papaparse";
+import { XMLParser } from "fast-xml-parser";
+import { boundedJson } from "../bounded-json.js";
+import { BRIDGE_RESULT_BYTES, HTML_LINKS_LIMIT } from "../limits.js";
+export function parseHtmlPayload(html) {
+    const root = parseHtmlDom(html);
+    const title = root.querySelector("title")?.text?.trim() ?? null;
+    const text = root.text.replace(/\s+/g, " ").trim();
+    const anchors = root.querySelectorAll("a[href]");
+    if (anchors.length > HTML_LINKS_LIMIT)
+        throw new Error("html_link_limit");
+    const links = [];
+    let remaining = BRIDGE_RESULT_BYTES - Buffer.byteLength(boundedJson({ title, text, links }, BRIDGE_RESULT_BYTES));
+    // Nested anchors can repeat the same text; bound expansion during extraction.
+    for (const a of anchors) {
+        const link = { href: a.getAttribute("href") ?? "", text: a.text.trim() };
+        remaining -= Buffer.byteLength(boundedJson(link, remaining)) + 1;
+        if (remaining < 0)
+            throw new Error("bridge_size_limit");
+        links.push(link);
+    }
+    return { title, text, links };
+}
+export function parseCsvPayload(csv, header) {
+    const result = Papa.parse(csv, { header, skipEmptyLines: true });
+    return { data: result.data, errors: result.errors, meta: result.meta };
+}
+export function parseXmlPayload(xml, xmlOptions) {
+    const parser = new XMLParser({ ...xmlOptions, processEntities: false });
+    return parser.parse(xml);
+}
+function handle(request) {
+    if (request.kind === "html")
+        return parseHtmlPayload(request.payload.html);
+    if (request.kind === "csv") {
+        const { csv, header } = request.payload;
+        return parseCsvPayload(csv, header);
+    }
+    const { xml, xmlOptions } = request.payload;
+    return parseXmlPayload(xml, xmlOptions);
+}
+if (parentPort) {
+    const port = parentPort;
+    port.on("message", (request) => {
+        try {
+            port.postMessage({ ok: true, value: handle(request) });
+        }
+        catch (err) {
+            port.postMessage({ ok: false, message: err instanceof Error ? err.message : String(err) });
+        }
+    });
+}

package/dist/sandbox/pii-redaction.d.ts

@@ -0,0 +1 @@
+export declare function redactPii(text: string): string;

package/dist/sandbox/pii-redaction.js

@@ -0,0 +1,29 @@
+/**
+ * Best-effort, pattern-based PII redaction for sandboxed tool console
+ * output before it reaches the shared pino logger. Unlike host-functions.ts's
+ * `redactSecrets` (exact-match against values the tool actually fetched via
+ * secrets.get()), PII surfaces in arbitrary fetched web/datastore content —
+ * there is no known value to match against, only common structured formats.
+ * NOT exhaustive: free-text names, addresses, and anything not matching one
+ * of these formats passes through unredacted.
+ */
+const PATTERNS = [
+    { name: "EMAIL", pattern: /\b[\w.+-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+\b/gi },
+    { name: "SSN", pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
+    // `(?<!\d)` rather than a leading `\b`: a leading "+" is a non-word char,
+    // so `\b` fails to match right before it and the country code gets left
+    // behind unredacted.
+    { name: "PHONE", pattern: /(?<!\d)(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g },
+    // Contiguous or grouped (e.g. 4-4-4-4) digit runs in the credit-card
+    // length range. Digits-only, so it never touches alphanumeric ids/tokens.
+    // Always ends on a digit (not the optional separator) so it can't eat a
+    // trailing space/dash that isn't part of the number.
+    { name: "CREDIT_CARD", pattern: /\b\d(?:[ -]?\d){12,18}\b/g },
+];
+export function redactPii(text) {
+    let out = text;
+    for (const { name, pattern } of PATTERNS) {
+        out = out.replace(pattern, `[REDACTED_${name}]`);
+    }
+    return out;
+}

package/dist/sandbox/prelude.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The sandbox's Medium host API surface, evaluated once per invocation
+ * before the tool's own code. Everything here is either:
+ *  - pure computation (Buffer, TextEncoder/Decoder, URL/URLSearchParams,
+ *    atob/btoa, AbortController, Blob, FormData, formatDate) — no host call
+ *    needed, so these are plain JS classes/functions; or
+ *  - a thin wrapper over one of the low-level `__bridge_*` functions
+ *    registered by host-functions.ts (fetch, datastore, parsers, sleep,
+ *    console, crypto) — every one of those is JSON-string in, JSON-string
+ *    (or thrown error) out, per bridge.ts.
+ *
+ * Known, deliberate simplifications (documented, not silent):
+ *  - `crypto.randomUUID`/`getRandomValues` are ASYNC here (must `await`),
+ *    unlike the real synchronous Web Crypto API — true randomness needs a
+ *    real host entropy source, which means crossing the bridge.
+ *  - `AbortController`/`AbortSignal` are a real but "cosmetic" polyfill: a
+ *    signal can be checked/thrown-on synchronously, but aborting it does
+ *    not cancel an in-flight host `fetch` already underway. The per-
+ *    invocation wall-time cap is the actual backstop for a hung call.
+ *  - `FormData` is a real data structure but `fetch` does not encode it as
+ *    multipart/form-data — a tool needing genuine multipart upload isn't
+ *    fully supported yet.
+ *
+ * Nothing else is reachable: no `process`, no filesystem, no host `require`.
+ */
+export declare const SANDBOX_PRELUDE: string;