eslint-plugin-rulvar 1.37.0 → 1.39.0

package/dist/index.d.ts

@@ -12,6 +12,28 @@ interface RulvarLintDiagnostic {
 }
 declare function toJsonDiagnostics(messages: readonly Linter.LintMessage[]): RulvarLintDiagnostic[];
 //#endregion
+//#region src/dialect-scan.d.ts
+/** Where a finding sits in the ORIGINAL source (line and column counted from 1). */
+interface DialectFinding {
+  kind: "eval" | "function-constructor" | "constructor-access";
+  line: number;
+  column: number;
+}
+/**
+* Structural scan for compileScript: every dynamic code generation form the
+* dialect rejects, as findings positioned in the original source. Covers bare
+* `eval`/`Function` calls and `new`, `globalThis.eval`/`globalThis.Function`,
+* and every constructor reconstruction form the shared predicates recognize.
+* Member access on other objects (`response.eval`, `parser.Function`) and a
+* property NAMED constructor in an object LITERAL are not code generation and
+* are left alone.
+*
+* Takes a parsed ESTree Program, typed `unknown` so a caller needs neither the
+* estree types nor a specific parser in its own public surface; any ESTree
+* compatible parser (espree in the lint pass, acorn in compileScript) works.
+*/
+declare function scanDialect(program: unknown): DialectFinding[];
+//#endregion
 //#region src/index.d.ts
 declare const rules: Record<string, Rule.RuleModule>;
 declare const plugin: ESLint.Plugin;
@@ -21,4 +43,4 @@ declare const plugin: ESLint.Plugin;
 */
 declare const workflowsConfig: Linter.Config;
 //#endregion
-export { type RulvarLintDiagnostic, plugin as default, rules, toJsonDiagnostics, workflowsConfig };
+export { type DialectFinding, type RulvarLintDiagnostic, plugin as default, rules, scanDialect, toJsonDiagnostics, workflowsConfig };

package/dist/index.js

@@ -151,6 +151,219 @@ const noProcessEnv = {
 	}
 };
 //#endregion
+//#region src/dialect-scan.ts
+function positionOf(node) {
+	const start = node.loc?.start;
+	return {
+		line: start?.line ?? 1,
+		column: (start?.column ?? 0) + 1
+	};
+}
+/**
+* Folds an expression that evaluates to a string to its constant value, or
+* undefined when it is not statically constant. Handles string literals, templates whose
+* every interpolation folds, and `+` concatenations of foldable operands.
+* This is deliberately conservative: anything it cannot prove constant (a
+* variable, a call, an index) folds to undefined and is left to the runtime.
+*/
+function foldStaticString(node) {
+	if (node === null || node === void 0) return;
+	if (node.type === "Literal") return typeof node.value === "string" ? node.value : void 0;
+	if (node.type === "TemplateLiteral") {
+		let out = "";
+		for (let i = 0; i < node.quasis.length; i += 1) {
+			out += node.quasis[i].value.cooked ?? node.quasis[i].value.raw;
+			if (i < node.expressions.length) {
+				const piece = foldStaticString(node.expressions[i]);
+				if (piece === void 0) return;
+				out += piece;
+			}
+		}
+		return out;
+	}
+	if (node.type === "BinaryExpression" && node.operator === "+") {
+		const left = node.left.type === "PrivateIdentifier" ? void 0 : foldStaticString(node.left);
+		const right = foldStaticString(node.right);
+		return left === void 0 || right === void 0 ? void 0 : left + right;
+	}
+}
+/** `fn.constructor` or `fn["constructor"]` (any statically constant key). */
+function isConstructorMemberExpression(node) {
+	if (!node.computed) return node.property.type === "Identifier" && node.property.name === "constructor";
+	return foldStaticString(node.property) === "constructor";
+}
+/** A destructuring property that binds the `constructor` slot of its source. */
+function isConstructorPatternProperty(node) {
+	if (!node.computed) {
+		if (node.key.type === "Identifier") return node.key.name === "constructor";
+		if (node.key.type === "Literal") return node.key.value === "constructor";
+		return false;
+	}
+	return foldStaticString(node.key) === "constructor";
+}
+/** `Reflect.get(fn, "constructor")` with a statically constant key. */
+function isReflectConstructorGet(node) {
+	const callee = node.callee;
+	if (callee.type !== "MemberExpression" || callee.computed || callee.object.type !== "Identifier" || callee.object.name !== "Reflect" || callee.property.type !== "Identifier" || callee.property.name !== "get") return false;
+	const keyArg = node.arguments[1];
+	return keyArg !== void 0 && keyArg.type !== "SpreadElement" && foldStaticString(keyArg) === "constructor";
+}
+/** A bare global `eval`/`Function` used as a call or `new` target. */
+function bareCodegenCallee(callee) {
+	if (callee.type === "Identifier") {
+		if (callee.name === "eval") return "eval";
+		if (callee.name === "Function") return "function-constructor";
+		return null;
+	}
+	if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.object.name === "globalThis" && callee.property.type === "Identifier") {
+		if (callee.property.name === "eval") return "eval";
+		if (callee.property.name === "Function") return "function-constructor";
+	}
+	return null;
+}
+const SKIP_KEYS = /* @__PURE__ */ new Set([
+	"loc",
+	"range",
+	"start",
+	"end",
+	"parent",
+	"comments",
+	"tokens",
+	"leadingComments",
+	"trailingComments"
+]);
+function walk(root, visit) {
+	const stack = [root];
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (current === null || typeof current !== "object") continue;
+		if (Array.isArray(current)) {
+			for (const item of current) stack.push(item);
+			continue;
+		}
+		const node = current;
+		if (typeof node.type !== "string") continue;
+		visit(node);
+		for (const [key, value] of Object.entries(node)) if (!SKIP_KEYS.has(key)) stack.push(value);
+	}
+}
+/**
+* Structural scan for compileScript: every dynamic code generation form the
+* dialect rejects, as findings positioned in the original source. Covers bare
+* `eval`/`Function` calls and `new`, `globalThis.eval`/`globalThis.Function`,
+* and every constructor reconstruction form the shared predicates recognize.
+* Member access on other objects (`response.eval`, `parser.Function`) and a
+* property NAMED constructor in an object LITERAL are not code generation and
+* are left alone.
+*
+* Takes a parsed ESTree Program, typed `unknown` so a caller needs neither the
+* estree types nor a specific parser in its own public surface; any ESTree
+* compatible parser (espree in the lint pass, acorn in compileScript) works.
+*/
+function scanDialect(program) {
+	const findings = [];
+	walk(program, (node) => {
+		switch (node.type) {
+			case "CallExpression":
+			case "NewExpression": {
+				const codegen = bareCodegenCallee(node.callee);
+				if (codegen !== null) findings.push({
+					kind: codegen,
+					...positionOf(node)
+				});
+				if (node.type === "CallExpression" && isReflectConstructorGet(node)) findings.push({
+					kind: "constructor-access",
+					...positionOf(node)
+				});
+				break;
+			}
+			case "MemberExpression":
+				if (isConstructorMemberExpression(node)) findings.push({
+					kind: "constructor-access",
+					...positionOf(node)
+				});
+				break;
+			case "ObjectPattern":
+				for (const property of node.properties) if (property.type === "Property" && isConstructorPatternProperty(property)) findings.push({
+					kind: "constructor-access",
+					...positionOf(property)
+				});
+				break;
+			default: break;
+		}
+	});
+	return findings;
+}
+//#endregion
+//#region src/rules/dialect.ts
+const noCodeGeneration = {
+	meta: {
+		type: "problem",
+		docs: { description: "ban dynamic code generation (eval, the Function constructor, and constructor reconstruction) in workflow modules; it reopens the import allowlist and the ambient capability surface the sandbox dialect closes" },
+		messages: {
+			noEval: "eval is not part of the workflow dialect; it compiles code in a fresh scope that reopens import() and ambient capability. Stay on the ctx surface.",
+			noFunctionConstructor: "the Function constructor is not part of the workflow dialect; it compiles arbitrary code that bypasses the import allowlist. Stay on the ctx surface.",
+			noConstructorAccess: "constructor access reaches the Function constructor from any function value and reopens dynamic code generation; it is not part of the workflow dialect."
+		},
+		schema: []
+	},
+	create(context) {
+		const checkCallee = (node, callee) => {
+			if (callee.type === "Identifier" && isGlobalReference(context, callee)) {
+				if (callee.name === "eval") {
+					context.report({
+						node,
+						messageId: "noEval"
+					});
+					return;
+				}
+				if (callee.name === "Function") {
+					context.report({
+						node,
+						messageId: "noFunctionConstructor"
+					});
+					return;
+				}
+			}
+			if (isGlobalMemberCall(context, callee, "globalThis", "eval")) {
+				context.report({
+					node,
+					messageId: "noEval"
+				});
+				return;
+			}
+			if (isGlobalMemberCall(context, callee, "globalThis", "Function")) context.report({
+				node,
+				messageId: "noFunctionConstructor"
+			});
+		};
+		return {
+			CallExpression(node) {
+				checkCallee(node, node.callee);
+				if (isReflectConstructorGet(node)) context.report({
+					node,
+					messageId: "noConstructorAccess"
+				});
+			},
+			NewExpression(node) {
+				checkCallee(node, node.callee);
+			},
+			MemberExpression(node) {
+				if (isConstructorMemberExpression(node)) context.report({
+					node,
+					messageId: "noConstructorAccess"
+				});
+			},
+			ObjectPattern(node) {
+				for (const property of node.properties) if (property.type === "Property" && isConstructorPatternProperty(property)) context.report({
+					node: property,
+					messageId: "noConstructorAccess"
+				});
+			}
+		};
+	}
+};
+//#endregion
 //#region src/rules/scheduling.ts
 const PROMISE_COMBINATORS = /* @__PURE__ */ new Set([
 	"all",
@@ -245,6 +458,7 @@ const rules = {
 	"no-bare-random": noBareRandom,
 	"no-fetch": noFetch,
 	"no-process-env": noProcessEnv,
+	"no-code-generation": noCodeGeneration,
 	"no-promise-all-over-ctx": noPromiseAllOverCtx,
 	"duplicate-identical-call": duplicateIdenticalCall
 };
@@ -264,10 +478,11 @@ const workflowsConfig = {
 		"rulvar/no-bare-random": "error",
 		"rulvar/no-fetch": "error",
 		"rulvar/no-process-env": "error",
+		"rulvar/no-code-generation": "error",
 		"rulvar/no-promise-all-over-ctx": "error",
 		"rulvar/duplicate-identical-call": "warn"
 	}
 };
 plugin.configs = { workflows: workflowsConfig };
 //#endregion
-export { plugin as default, rules, toJsonDiagnostics, workflowsConfig };
+export { plugin as default, rules, scanDialect, toJsonDiagnostics, workflowsConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-rulvar",
-  "version": "1.37.0",
+  "version": "1.39.0",
   "description": "Rulvar determinism lint rules with structural JSON diagnostics for the planner self-repair loop.",
   "type": "module",
   "license": "Apache-2.0",