eslint-plugin-rulvar 1.36.0 → 1.38.0

package/dist/index.js

@@ -151,6 +151,73 @@ const noProcessEnv = {
 	}
 };
 //#endregion
+//#region src/rules/dialect.ts
+const noCodeGeneration = {
+	meta: {
+		type: "problem",
+		docs: { description: "ban dynamic code generation (eval, the Function constructor, and .constructor access) in workflow modules; it reopens the import allowlist and the ambient capability surface the sandbox dialect closes" },
+		messages: {
+			noEval: "eval is not part of the workflow dialect; it compiles code in a fresh scope that reopens import() and ambient capability. Stay on the ctx surface.",
+			noFunctionConstructor: "the Function constructor is not part of the workflow dialect; it compiles arbitrary code that bypasses the import allowlist. Stay on the ctx surface.",
+			noConstructorAccess: ".constructor access reaches the Function constructor from any function value and reopens dynamic code generation; it is not part of the workflow dialect."
+		},
+		schema: []
+	},
+	create(context) {
+		const checkCallee = (node, callee) => {
+			if (callee.type === "Identifier" && isGlobalReference(context, callee)) {
+				if (callee.name === "eval") {
+					context.report({
+						node,
+						messageId: "noEval"
+					});
+					return;
+				}
+				if (callee.name === "Function") {
+					context.report({
+						node,
+						messageId: "noFunctionConstructor"
+					});
+					return;
+				}
+			}
+			if (isGlobalMemberCall(context, callee, "globalThis", "eval")) {
+				context.report({
+					node,
+					messageId: "noEval"
+				});
+				return;
+			}
+			if (isGlobalMemberCall(context, callee, "globalThis", "Function")) context.report({
+				node,
+				messageId: "noFunctionConstructor"
+			});
+		};
+		return {
+			CallExpression(node) {
+				checkCallee(node, node.callee);
+			},
+			NewExpression(node) {
+				checkCallee(node, node.callee);
+			},
+			MemberExpression(node) {
+				const { property, computed } = node;
+				if (!computed && property.type === "Identifier" && property.name === "constructor") {
+					context.report({
+						node,
+						messageId: "noConstructorAccess"
+					});
+					return;
+				}
+				if (computed && property.type === "Literal" && property.value === "constructor") context.report({
+					node,
+					messageId: "noConstructorAccess"
+				});
+			}
+		};
+	}
+};
+//#endregion
 //#region src/rules/scheduling.ts
 const PROMISE_COMBINATORS = /* @__PURE__ */ new Set([
 	"all",
@@ -245,6 +312,7 @@ const rules = {
 	"no-bare-random": noBareRandom,
 	"no-fetch": noFetch,
 	"no-process-env": noProcessEnv,
+	"no-code-generation": noCodeGeneration,
 	"no-promise-all-over-ctx": noPromiseAllOverCtx,
 	"duplicate-identical-call": duplicateIdenticalCall
 };
@@ -264,6 +332,7 @@ const workflowsConfig = {
 		"rulvar/no-bare-random": "error",
 		"rulvar/no-fetch": "error",
 		"rulvar/no-process-env": "error",
+		"rulvar/no-code-generation": "error",
 		"rulvar/no-promise-all-over-ctx": "error",
 		"rulvar/duplicate-identical-call": "warn"
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-rulvar",
-  "version": "1.36.0",
+  "version": "1.38.0",
   "description": "Rulvar determinism lint rules with structural JSON diagnostics for the planner self-repair loop.",
   "type": "module",
   "license": "Apache-2.0",