ai-evaluate 2.1.6 → 2.1.7

package/src/evaluate.ts

@@ -6,11 +6,103 @@
  *
  * Requires:
  * - LOADER binding (worker_loaders)
- * - TEST binding (ai-tests service)
+ * - TEST binding (ai-tests service) - optional, only needed for test assertions
  */
 
 import type { EvaluateOptions, EvaluateResult, WorkerLoader, SandboxEnv } from './types.js'
 import { generateWorkerCode } from './worker-template.js'
+import { CAPNWEB_SOURCE } from './capnweb-bundle.js'
+
+/**
+ * Compatibility date for dynamic workers (2026)
+ */
+const COMPATIBILITY_DATE = '2026-01-01'
+
+/**
+ * Generate a minimal worker for simple script execution
+ * This doesn't require capnweb or TEST binding
+ */
+function generateSimpleWorkerCode(options: {
+  module?: string
+  script?: string
+  imports?: string[]
+}): string {
+  const { module = '', script = '', imports = [] } = options
+
+  // Build import statements for pre-fetched external modules
+  // Modules are fetched by the host worker and included in the worker definition
+  const importStatements = imports
+    .map((url, i) => `import * as __import${i}__ from './__external_${i}__.js';`)
+    .join('\n')
+
+  // Make imports available as globals
+  const importGlobals = imports
+    .map((url, i) => {
+      // Extract package name from URL for variable naming
+      const match = url.match(/esm\.sh\/([^@/]+)/)
+      const pkgName = match ? match[1].replace(/-/g, '_') : `pkg${i}`
+      const varName = pkgName === 'lodash' ? '_' : pkgName
+      return `globalThis.${varName} = __import${i}__.default || __import${i}__;
+globalThis.pkg = __import${i}__.default || __import${i}__;`
+    })
+    .join('\n')
+
+  // Wrap script to capture return value (code is embedded at build time, no eval)
+  const wrappedScript = script
+    ? `const __executeScript__ = async () => { ${script} }; const __result__ = await __executeScript__();`
+    : 'const __result__ = undefined;'
+
+  return `
+// Simple Sandbox Worker
+${importStatements}
+
+const logs = [];
+
+// Capture console output
+const originalConsole = { ...console };
+const captureConsole = (level) => (...args) => {
+  logs.push({
+    level,
+    message: args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '),
+    timestamp: Date.now()
+  });
+  originalConsole[level](...args);
+};
+console.log = captureConsole('log');
+console.warn = captureConsole('warn');
+console.error = captureConsole('error');
+console.info = captureConsole('info');
+
+// Make imports available globally
+${importGlobals}
+
+// User module code (if any)
+${module}
+
+export default {
+  async fetch(request, env) {
+    try {
+      // Execute the script (embedded at generation time - no new Function())
+      ${wrappedScript}
+
+      return Response.json({
+        success: true,
+        value: __result__,
+        logs,
+        duration: 0
+      });
+    } catch (error) {
+      return Response.json({
+        success: false,
+        error: error.message || String(error),
+        logs,
+        duration: 0
+      });
+    }
+  }
+};
+`
+}
 
 /**
  * Evaluate code in a sandboxed worker
@@ -40,11 +132,19 @@ export async function evaluate(
         success: false,
         logs: [],
         error:
-          'Sandbox requires worker_loaders binding. Add to wrangler.jsonc: "worker_loaders": [{ "binding": "loader" }]. For Node.js, use: import { evaluate } from "ai-evaluate/node"',
+          'Sandbox requires worker_loaders binding. Add to wrangler.toml: [[worker_loaders]] binding = "LOADER". For Node.js, use: import { evaluate } from "ai-evaluate/node"',
         duration: Date.now() - start,
       }
     }
 
+    // Use simple worker for basic script execution (no tests, no SDK)
+    const useSimpleWorker = !options.tests && !options.sdk
+
+    if (useSimpleWorker) {
+      return await evaluateSimple(options, loader, start)
+    }
+
+    // Use full worker template for tests and SDK features
     return await evaluateWithWorkerLoader(options, loader, env?.TEST, start)
   } catch (error) {
     return {
@@ -57,7 +157,110 @@ export async function evaluate(
 }
 
 /**
- * Evaluate using Cloudflare worker_loaders binding
+ * Pre-fetch external modules from URLs (e.g., esm.sh)
+ * Returns a map of module name to source code
+ *
+ * Handles esm.sh's redirect-style modules by following the internal import paths.
+ */
+async function prefetchModules(imports: string[]): Promise<Record<string, string>> {
+  const modules: Record<string, string> = {}
+
+  await Promise.all(
+    imports.map(async (url, i) => {
+      try {
+        // For esm.sh URLs, try to get the bundled version directly
+        let fetchUrl = url
+        if (url.includes('esm.sh/') && !url.includes('.mjs') && !url.includes('.js')) {
+          // Parse the esm.sh URL to construct the bundle path
+          // e.g., https://esm.sh/lodash@4.17.21 -> https://esm.sh/lodash@4.17.21/es2022/lodash.bundle.mjs
+          const urlObj = new URL(url)
+          const pathParts = urlObj.pathname.slice(1).split('/')
+          const pkgSpec = pathParts[0] // e.g., "lodash@4.17.21"
+          const pkgName = pkgSpec.split('@')[0]
+          fetchUrl = `${urlObj.origin}/${pkgSpec}/es2022/${pkgName}.bundle.mjs`
+        }
+
+        const response = await fetch(fetchUrl, { redirect: 'follow' })
+        if (!response.ok) {
+          // Fallback to original URL if bundle URL fails
+          const fallbackResponse = await fetch(url, { redirect: 'follow' })
+          if (!fallbackResponse.ok) {
+            throw new Error(`Failed to fetch ${url}: ${fallbackResponse.status}`)
+          }
+          const source = await fallbackResponse.text()
+          modules[`__external_${i}__.js`] = source
+          return
+        }
+        const source = await response.text()
+        // Use a simple module name that can be imported
+        const moduleName = `__external_${i}__.js`
+        modules[moduleName] = source
+      } catch (error) {
+        throw new Error(
+          `Failed to fetch import ${url}: ${error instanceof Error ? error.message : String(error)}`
+        )
+      }
+    })
+  )
+
+  return modules
+}
+
+/**
+ * Simple evaluation without capnweb/TEST dependencies
+ */
+async function evaluateSimple(
+  options: EvaluateOptions,
+  loader: WorkerLoader,
+  start: number
+): Promise<EvaluateResult> {
+  // Pre-fetch any external modules
+  let externalModules: Record<string, string> = {}
+  if (options.imports && options.imports.length > 0) {
+    try {
+      externalModules = await prefetchModules(options.imports)
+    } catch (error) {
+      return {
+        success: false,
+        logs: [],
+        error: error instanceof Error ? error.message : String(error),
+        duration: Date.now() - start,
+      }
+    }
+  }
+
+  const workerCode = generateSimpleWorkerCode({
+    module: options.module,
+    script: options.script,
+    imports: options.imports,
+  })
+
+  const id = `sandbox-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+  const worker = loader.get(id, async () => ({
+    mainModule: 'worker.js',
+    modules: {
+      'worker.js': workerCode,
+      ...externalModules,
+    },
+    compatibilityDate: COMPATIBILITY_DATE,
+    // Block network access only if fetch: null
+    globalOutbound: options.fetch === null ? null : undefined,
+  }))
+
+  // Get the entrypoint and call fetch
+  const entrypoint = worker.getEntrypoint()
+  const response = await entrypoint.fetch(new Request('http://sandbox/execute'))
+  const result = (await response.json()) as EvaluateResult
+
+  return {
+    ...result,
+    duration: Date.now() - start,
+  }
+}
+
+/**
+ * Evaluate using full worker template with capnweb and TEST binding
  */
 async function evaluateWithWorkerLoader(
   options: EvaluateOptions,
@@ -78,8 +281,10 @@ async function evaluateWithWorkerLoader(
     mainModule: 'worker.js',
     modules: {
       'worker.js': workerCode,
+      // Include capnweb as a module so the worker can import it
+      'capnweb.js': CAPNWEB_SOURCE,
     },
-    compatibilityDate: '2026-01-01',
+    compatibilityDate: COMPATIBILITY_DATE,
     // Block network access only if fetch: null
     globalOutbound: options.fetch === null ? null : undefined,
     bindings: {

package/src/worker-template.ts

@@ -2885,17 +2885,11 @@ function transformModuleCode(moduleCode: string): string {
   let code = moduleCode
 
   // Transform: export const foo = ... → const foo = ...; exports.foo = foo;
-  code = code.replace(
-    /export\s+(const|let|var)\s+(\w+)\s*=/g,
-    '$1 $2 = exports.$2 ='
-  )
+  code = code.replace(/export\s+(const|let|var)\s+(\w+)\s*=/g, '$1 $2 = exports.$2 =')
 
   // Transform: export function foo(...) → function foo(...) exports.foo = foo;
   // Also handles async generators: export async function* foo
-  code = code.replace(
-    /export\s+(async\s+)?function(\*?)\s+(\w+)/g,
-    '$1function$2 $3'
-  )
+  code = code.replace(/export\s+(async\s+)?function(\*?)\s+(\w+)/g, '$1function$2 $3')
   // Add exports for functions after their definition
   const funcNames = [...moduleCode.matchAll(/export\s+(?:async\s+)?function\*?\s+(\w+)/g)]
   for (const [, name] of funcNames) {
@@ -2931,7 +2925,10 @@ function wrapScriptForReturn(script: string): string {
   const isSingleLine = !withoutTrailingSemi.includes('\n')
 
   // Check if it looks like a single expression (no control flow, no declarations)
-  const startsWithKeyword = /^\s*(const|let|var|if|for|while|switch|try|class|function|async\s+function)\b/.test(withoutTrailingSemi)
+  const startsWithKeyword =
+    /^\s*(const|let|var|if|for|while|switch|try|class|function|async\s+function)\b/.test(
+      withoutTrailingSemi
+    )
 
   if (isSingleLine && !startsWithKeyword) {
     return `return ${withoutTrailingSemi}`
@@ -2944,7 +2941,10 @@ function wrapScriptForReturn(script: string): string {
   const lastLine = lastLineRaw.trim()
 
   // If last line is an expression (not a declaration, control flow, or throw)
-  if (lastLine && !/^\s*(const|let|var|if|for|while|switch|try|class|function|return|throw)\b/.test(lastLine)) {
+  if (
+    lastLine &&
+    !/^\s*(const|let|var|if|for|while|switch|try|class|function|return|throw)\b/.test(lastLine)
+  ) {
     lines[lines.length - 1] = `return ${lastLine.replace(/;?\s*$/, '')}`
     return lines.join('\n')
   }
@@ -2963,7 +2963,7 @@ export function generateWorkerCode(options: {
   imports?: string[] | undefined
 }): string {
   const { module: rawModule = '', tests = '', script: rawScript = '', sdk, imports = [] } = options
-  const sdkConfig = sdk === true ? {} : (sdk || null)
+  const sdkConfig = sdk === true ? {} : sdk || null
   const module = rawModule ? transformModuleCode(rawModule) : ''
   const script = rawScript ? wrapScriptForReturn(rawScript) : ''
   const exportNames = getExportNames(rawModule)
@@ -2973,7 +2973,7 @@ export function generateWorkerCode(options: {
 
   return `
 // Sandbox Worker Entry Point
-import { RpcTarget, newWorkersRpcResponse } from 'capnweb';
+import { RpcTarget, newWorkersRpcResponse } from 'capnweb.js';
 ${hoistedImports}
 const logs = [];
 
@@ -3003,20 +3003,28 @@ console.debug = captureConsole('debug');
 // Module exports object - exports become top-level variables
 const exports = {};
 
-${module ? `
+${
+  module
+    ? `
 // Execute module code
 try {
 ${module}
 } catch (e) {
   console.error('Module error:', e.message);
 }
-` : '// No module code provided'}
+`
+    : '// No module code provided'
+}
 
 // Expose all exports as top-level variables for tests and scripts
 // This allows: export const add = (a, b) => a + b; then later: add(1, 2)
-${rawModule ? `
+${
+  rawModule
+    ? `
 const { ${exportNames} } = exports;
-`.trim() : ''}
+`.trim()
+    : ''
+}
 
 // ============================================================
 // RPC SERVER - Expose exports via capnweb
@@ -3156,17 +3164,23 @@ export default {
     // USER TEST CODE (embedded at generation time)
     // ============================================================
 
-    ${tests ? `
+    ${
+      tests
+        ? `
     // Register tests
     try {
 ${tests}
     } catch (e) {
       console.error('Test registration error:', e.message);
     }
-    ` : '// No test code provided'}
+    `
+        : '// No test code provided'
+    }
 
     // Execute user script
-    ${script ? `
+    ${
+      script
+        ? `
     try {
       scriptResult = await (async () => {
 ${script}
@@ -3175,17 +3189,23 @@ ${script}
       console.error('Script error:', e.message);
       scriptError = e.message;
     }
-    ` : '// No script code provided'}
+    `
+        : '// No script code provided'
+    }
 
     // Run tests if any were registered
-    ${tests ? `
+    ${
+      tests
+        ? `
     try {
       testResults = await testService.run();
     } catch (e) {
       console.error('Test run error:', e.message);
       testResults = { total: 0, passed: 0, failed: 1, skipped: 0, tests: [], duration: 0, error: e.message };
     }
-    ` : ''}
+    `
+        : ''
+    }
 
     const hasTests = ${tests ? 'true' : 'false'};
     const success = scriptError === null && (!hasTests || (testResults && testResults.failed === 0));
@@ -3217,8 +3237,15 @@ export function generateDevWorkerCode(options: {
   imports?: string[] | undefined
   fetch?: null | undefined
 }): string {
-  const { module: rawModule = '', tests = '', script: rawScript = '', sdk, imports = [], fetch: fetchOption } = options
-  const sdkConfig = sdk === true ? {} : (sdk || null)
+  const {
+    module: rawModule = '',
+    tests = '',
+    script: rawScript = '',
+    sdk,
+    imports = [],
+    fetch: fetchOption,
+  } = options
+  const sdkConfig = sdk === true ? {} : sdk || null
   const module = rawModule ? transformModuleCode(rawModule) : ''
   const script = rawScript ? wrapScriptForReturn(rawScript) : ''
   const exportNames = getExportNames(rawModule)
@@ -3234,13 +3261,17 @@ const logs = [];
 const testResults = { total: 0, passed: 0, failed: 0, skipped: 0, tests: [], duration: 0 };
 const pendingTests = [];
 
-${blockFetch ? `
+${
+  blockFetch
+    ? `
 // Block fetch when fetch: null is specified
 const __originalFetch__ = globalThis.fetch;
 globalThis.fetch = async (...args) => {
   throw new Error('Network access blocked: fetch is disabled in this sandbox');
 };
-` : ''}
+`
+    : ''
+}
 
 ${sdkConfig ? generateShouldCode() : ''}
 
@@ -3548,32 +3579,44 @@ const expect = (actual) => {
 // Module exports object - exports become top-level variables
 const exports = {};
 
-${module ? `
+${
+  module
+    ? `
 // Execute module code
 try {
 ${module}
 } catch (e) {
   console.error('Module error:', e.message);
 }
-` : '// No module code provided'}
+`
+    : '// No module code provided'
+}
 
 // Expose all exports as top-level variables for tests and scripts
 // This allows: export const add = (a, b) => a + b; then later: add(1, 2)
-${rawModule ? `
+${
+  rawModule
+    ? `
 const { ${exportNames} } = exports;
-`.trim() : ''}
+`.trim()
+    : ''
+}
 
 // ============================================================
 // USER TEST CODE (embedded at generation time)
 // ============================================================
-${tests ? `
+${
+  tests
+    ? `
 // Register tests
 try {
 ${tests}
 } catch (e) {
   console.error('Test registration error:', e.message);
 }
-` : '// No test code provided'}
+`
+    : '// No test code provided'
+}
 
 // ============================================================
 // SIMPLE RPC HANDLER (dev mode - no capnweb dependency)
@@ -3674,7 +3717,9 @@ export default {
     let scriptError = null;
 
     // Execute user script
-    ${script ? `
+    ${
+      script
+        ? `
     try {
       scriptResult = await (async () => {
 ${script}
@@ -3683,7 +3728,9 @@ ${script}
       console.error('Script error:', e.message);
       scriptError = e.message;
     }
-    ` : '// No script code provided'}
+    `
+        : '// No script code provided'
+    }
 
     // Run all pending tests
     const testStart = Date.now();