forgeos 0.1.0-alpha.0

package/src/forge/compiler/sandbox/inspector-entry.ts

@@ -0,0 +1,115 @@
+/**
+ * Spawnable entry for sandbox runtime export inspection.
+ * Reads install path from argv[2] and prints JSON RuntimeExportShape to stdout.
+ */
+import { join } from "node:path";
+import { nodeFileSystem } from "../fs/index.ts";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+interface PackageJson {
+  name?: string;
+  main?: string;
+  module?: string;
+  exports?: unknown;
+}
+
+function resolveMainFile(pkgDir: string, pkg: PackageJson): string {
+  if (typeof pkg.main === "string" && pkg.main.length > 0) {
+    return join(pkgDir, pkg.main);
+  }
+  if (typeof pkg.module === "string" && pkg.module.length > 0) {
+    return join(pkgDir, pkg.module);
+  }
+
+  const exports = pkg.exports;
+  if (typeof exports === "object" && exports != null && !Array.isArray(exports)) {
+    const root = (exports as Record<string, unknown>)["."];
+    if (typeof root === "string") {
+      return join(pkgDir, root);
+    }
+    if (typeof root === "object" && root != null) {
+      const importPath = (root as Record<string, unknown>).import;
+      if (typeof importPath === "string") {
+        return join(pkgDir, importPath);
+      }
+      const requirePath = (root as Record<string, unknown>).require;
+      if (typeof requirePath === "string") {
+        return join(pkgDir, requirePath);
+      }
+      const defaultPath = (root as Record<string, unknown>).default;
+      if (typeof defaultPath === "string") {
+        return join(pkgDir, defaultPath);
+      }
+    }
+  }
+
+  return join(pkgDir, "index.js");
+}
+
+function classifyExport(value: unknown): "function" | "class" | "const" | "object" | "unknown" {
+  if (typeof value === "function") {
+    const proto = value.prototype;
+    if (proto != null && proto.constructor === value) {
+      return "class";
+    }
+    return "function";
+  }
+  if (typeof value === "object" && value != null) {
+    return "object";
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return "const";
+  }
+  return "unknown";
+}
+
+async function main(): Promise<void> {
+  const installPath = process.argv[2];
+  if (installPath == null || installPath.length === 0) {
+    process.stderr.write("missing install path\n");
+    process.exit(2);
+  }
+
+  const pkgPath = join(installPath, "package.json");
+  const pkgRaw = nodeFileSystem.readText(pkgPath);
+  if (pkgRaw === null) {
+    process.stderr.write(`missing package.json at ${pkgPath}\n`);
+    process.exit(2);
+  }
+  const pkg = JSON.parse(pkgRaw) as PackageJson;
+  const mainFile = resolveMainFile(installPath, pkg);
+  const mod = await import(pathToFileURL(mainFile).href);
+
+  const exportNames = new Set<string>();
+  if (mod != null && typeof mod === "object") {
+    for (const key of Object.keys(mod)) {
+      if (key !== "default") {
+        exportNames.add(key);
+      }
+    }
+    if ("default" in mod && mod.default != null) {
+      exportNames.add("default");
+    }
+  }
+
+  const exports = [...exportNames]
+    .sort((a, b) => a.localeCompare(b))
+    .map((name) => ({
+      name,
+      kind: classifyExport(name === "default" ? mod.default : mod[name]),
+    }));
+
+  const shape = {
+    entrypoints: [{ subpath: ".", exports }],
+  };
+
+  process.stdout.write(`${JSON.stringify(shape)}\n`);
+}
+
+const entryPath = fileURLToPath(import.meta.url);
+if (process.argv[1] != null && process.argv[1] === entryPath) {
+  main().catch((error: unknown) => {
+    process.stderr.write(String(error));
+    process.exit(1);
+  });
+}

package/src/forge/compiler/sandbox/limits.ts

@@ -0,0 +1,31 @@
+import type { SandboxLimits } from "../types/cli.ts";
+import type { SandboxBackend } from "../types/runtime.ts";
+
+export const DEFAULT_SANDBOX_TIMEOUT_MS = 30_000;
+export const DEFAULT_SANDBOX_MEMORY_MB = 256;
+export const DEFAULT_SANDBOX_PIDS_LIMIT = 128;
+export const SANDBOX_KILL_GRACE_MS = 1_000;
+
+export function defaultSandboxLimits(
+  backend: SandboxBackend = "none",
+): SandboxLimits {
+  return {
+    backend,
+    timeoutMs: DEFAULT_SANDBOX_TIMEOUT_MS,
+    memoryMb: DEFAULT_SANDBOX_MEMORY_MB,
+    network: false,
+    filesystem: "read-only",
+    allowPostinstall: false,
+  };
+}
+
+export function clampSandboxLimits(limits: SandboxLimits): SandboxLimits {
+  return {
+    ...limits,
+    timeoutMs: Math.min(limits.timeoutMs, DEFAULT_SANDBOX_TIMEOUT_MS),
+    memoryMb: Math.min(limits.memoryMb, DEFAULT_SANDBOX_MEMORY_MB),
+    network: false,
+    filesystem: "read-only",
+    allowPostinstall: false,
+  };
+}

package/src/forge/compiler/sandbox/scrub-env.ts

@@ -0,0 +1,60 @@
+const ENV_ALLOWLIST = new Set([
+  "PATH",
+  "HOME",
+  "USERPROFILE",
+  "TEMP",
+  "TMP",
+  "TMPDIR",
+  "SYSTEMROOT",
+  "PATHEXT",
+  "COMSPEC",
+  "LANG",
+  "LC_ALL",
+  "NODE_PATH",
+]);
+
+const SECRET_KEY_PATTERN =
+  /secret|password|token|api[_-]?key|credential|private[_-]?key|auth/i;
+
+export interface ScrubEnvOptions {
+  /** Values loaded from .env files that must never pass through. */
+  dotEnvValues?: Iterable<string>;
+}
+
+export function isSecretEnvKey(key: string): boolean {
+  return SECRET_KEY_PATTERN.test(key);
+}
+
+export function scrubEnv(
+  env: NodeJS.ProcessEnv,
+  options: ScrubEnvOptions = {},
+): Record<string, string> {
+  const blockedValues = new Set<string>();
+  for (const value of options.dotEnvValues ?? []) {
+    if (value.length > 0) {
+      blockedValues.add(value);
+    }
+  }
+
+  const scrubbed: Record<string, string> = {};
+  for (const key of Object.keys(env).sort()) {
+    if (!ENV_ALLOWLIST.has(key)) {
+      continue;
+    }
+    if (isSecretEnvKey(key)) {
+      continue;
+    }
+
+    const value = env[key];
+    if (value == null || value.length === 0) {
+      continue;
+    }
+    if (blockedValues.has(value)) {
+      continue;
+    }
+
+    scrubbed[key] = value;
+  }
+
+  return scrubbed;
+}

package/src/forge/compiler/sandbox/secret-scan.ts

@@ -0,0 +1,54 @@
+const TOKEN_PREFIXES = ["sk_", "pk_", "ghp_", "xoxb-", "xoxp-", "xoxa-"] as const;
+
+/** Match JSON object keys that may carry secret values — not substrings like "secrets". */
+const SECRET_KEY_JSON_PATTERN =
+  /"(?:api[_-]?key|secret|password|token|credential|private[_-]?key)"\s*:/i;
+
+const HIGH_ENTROPY_PATTERN = /[A-Za-z0-9+/]{40,}={0,2}/;
+
+export interface SecretScanOptions {
+  knownSecretValues?: Iterable<string>;
+  /** When false, skip high-entropy heuristics (for stable artifact checksums). */
+  includeHighEntropy?: boolean;
+}
+
+export interface SecretScanResult {
+  hasLeak: boolean;
+  matches: string[];
+}
+
+export function secretLeakScan(
+  serialized: string,
+  options: SecretScanOptions = {},
+): SecretScanResult {
+  const matches: string[] = [];
+  const includeHighEntropy = options.includeHighEntropy ?? true;
+
+  for (const value of options.knownSecretValues ?? []) {
+    if (value.length >= 4 && serialized.includes(value)) {
+      matches.push(`known-secret:${value.slice(0, 4)}…`);
+    }
+  }
+
+  if (SECRET_KEY_JSON_PATTERN.test(serialized)) {
+    matches.push("secret-like-key");
+  }
+
+  for (const prefix of TOKEN_PREFIXES) {
+    if (serialized.includes(prefix)) {
+      matches.push(`token-prefix:${prefix}`);
+    }
+  }
+
+  if (includeHighEntropy) {
+    const entropy = serialized.match(HIGH_ENTROPY_PATTERN);
+    if (entropy != null) {
+      matches.push("high-entropy");
+    }
+  }
+
+  return {
+    hasLeak: matches.length > 0,
+    matches,
+  };
+}

package/src/forge/compiler/sandbox/serialize.ts

@@ -0,0 +1,106 @@
+import type {
+  RuntimeEntrypointShape,
+  RuntimeExportEntry,
+  RuntimeExportKind,
+  RuntimeExportShape,
+} from "./types.ts";
+
+export function serializeRuntimeExportShape(shape: RuntimeExportShape): string {
+  return JSON.stringify(shape);
+}
+
+export function parseRuntimeExportShape(raw: string): RuntimeExportShape {
+  const parsed: unknown = JSON.parse(raw);
+  return sanitizeRuntimeExportShape(parsed);
+}
+
+function parseExportKind(value: unknown): RuntimeExportKind {
+  if (
+    value === "function" ||
+    value === "class" ||
+    value === "const" ||
+    value === "object"
+  ) {
+    return value;
+  }
+  return "unknown";
+}
+
+export function sanitizeRuntimeExportShape(value: unknown): RuntimeExportShape {
+  if (typeof value !== "object" || value === null) {
+    return { entrypoints: [] };
+  }
+
+  const record = value as Record<string, unknown>;
+  const entrypointsRaw = Array.isArray(record.entrypoints)
+    ? record.entrypoints
+    : [];
+
+  const entrypoints: RuntimeEntrypointShape[] = [];
+
+  for (const item of entrypointsRaw) {
+    if (typeof item !== "object" || item === null) {
+      continue;
+    }
+    const ep = item as Record<string, unknown>;
+    const subpath = typeof ep.subpath === "string" ? ep.subpath : ".";
+    const exportsRaw = Array.isArray(ep.exports) ? ep.exports : [];
+    const exports: RuntimeExportEntry[] = [];
+
+    for (const entry of exportsRaw) {
+      if (typeof entry !== "object" || entry === null) {
+        continue;
+      }
+      const ex = entry as Record<string, unknown>;
+      if (typeof ex.name !== "string") {
+        continue;
+      }
+      exports.push({
+        name: ex.name,
+        kind: parseExportKind(ex.kind),
+      });
+    }
+
+    exports.sort((a, b) => a.name.localeCompare(b.name));
+    entrypoints.push({ subpath, exports });
+  }
+
+  entrypoints.sort((a, b) => a.subpath.localeCompare(b.subpath));
+  return { entrypoints };
+}
+
+export function assertJsonSerializable(value: unknown): void {
+  const seen = new WeakSet<object>();
+
+  const walk = (current: unknown): void => {
+    if (current == null || typeof current !== "object") {
+      if (
+        typeof current === "function" ||
+        typeof current === "symbol" ||
+        typeof current === "bigint"
+      ) {
+        throw new Error("non-JSON-serializable sandbox value");
+      }
+      return;
+    }
+
+    if (seen.has(current)) {
+      return;
+    }
+    seen.add(current);
+
+    if (Array.isArray(current)) {
+      for (const item of current) {
+        walk(item);
+      }
+      return;
+    }
+
+    for (const key of Object.keys(current)) {
+      walk((current as Record<string, unknown>)[key]);
+    }
+  };
+
+  walk(value);
+  JSON.stringify(value);
+}

package/src/forge/compiler/sandbox/types.ts

@@ -0,0 +1,7 @@
+export {
+  emptyRuntimeExportShape,
+  type RuntimeEntrypointShape,
+  type RuntimeExportEntry,
+  type RuntimeExportKind,
+  type RuntimeExportShape,
+} from "../types/sandbox.ts";

package/src/forge/compiler/secret-registry/build.ts

@@ -0,0 +1,123 @@
+import { detectSecrets } from "../classifier/secrets.ts";
+import type { ClassifiedPackage } from "../classifier/runtime-matrix.ts";
+import { resolveByPackageName } from "../recipes/registry.ts";
+import type {
+  ConfigRegistry,
+  EnvSchema,
+  EnvVariable,
+  SecretRegistry,
+  SecretRegistryEntry,
+} from "../types/secret-registry.ts";
+import type { RuntimeContext } from "../types/runtime.ts";
+
+const SECRET_CONTEXTS: RuntimeContext[] = [
+  "server",
+  "action",
+  "workflow",
+  "endpoint",
+  "test",
+  "build",
+];
+
+const CONFIG_CONTEXTS: RuntimeContext[] = [
+  "server",
+  "action",
+  "workflow",
+  "endpoint",
+  "command",
+];
+
+function isPublicEnvVar(name: string): boolean {
+  return name.startsWith("NEXT_PUBLIC_") || name.startsWith("PUBLIC_");
+}
+
+export function buildSecretRegistry(classified: ClassifiedPackage[]): SecretRegistry {
+  const entries = new Map<string, SecretRegistryEntry>();
+
+  for (const pkg of classified) {
+    const recipe = pkg.recipe ?? resolveByPackageName(pkg.api.name) ?? undefined;
+    const secrets = detectSecrets(pkg.api, recipe);
+    const integration = recipe?.alias ?? pkg.api.name;
+
+    for (const secretReq of secrets) {
+      if (isPublicEnvVar(secretReq.envVar)) {
+        continue;
+      }
+
+      const existing = entries.get(secretReq.envVar);
+      entries.set(secretReq.envVar, {
+        name: secretReq.envVar,
+        required: existing?.required || secretReq.required,
+        source: secretReq.detectedFrom === "recipe" ? "recipe" : secretReq.detectedFrom,
+        integration: existing?.integration ?? integration,
+        allowedContexts: SECRET_CONTEXTS,
+        public: false,
+      });
+    }
+  }
+
+  return {
+    secrets: [...entries.values()].sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}
+
+export function buildEnvSchema(registry: SecretRegistry): EnvSchema {
+  const variables: EnvVariable[] = registry.secrets.map((entry) => ({
+    name: entry.name,
+    kind: "secret" as const,
+    required: entry.required,
+    source: entry.source,
+    integration: entry.integration,
+    public: entry.public,
+  }));
+
+  return {
+    variables: variables.sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}
+
+export function buildConfigRegistry(registry: SecretRegistry): ConfigRegistry {
+  const configs = registry.secrets
+    .filter((entry) => entry.public || !entry.required)
+    .map((entry) => ({
+      name: entry.name,
+      required: entry.required,
+      source: entry.source,
+      integration: entry.integration,
+    }));
+
+  return {
+    configs: configs.sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}
+
+export function augmentEnvSchemaWithPublicVars(
+  schema: EnvSchema,
+  classified: ClassifiedPackage[],
+): EnvSchema {
+  const variables = new Map(schema.variables.map((variable) => [variable.name, variable]));
+
+  for (const pkg of classified) {
+    const recipe = pkg.recipe ?? resolveByPackageName(pkg.api.name) ?? undefined;
+    for (const secretReq of detectSecrets(pkg.api, recipe)) {
+      if (!isPublicEnvVar(secretReq.envVar)) {
+        continue;
+      }
+
+      variables.set(secretReq.envVar, {
+        name: secretReq.envVar,
+        kind: "config",
+        required: secretReq.required,
+        source: secretReq.detectedFrom,
+        integration: recipe?.alias ?? pkg.api.name,
+        public: true,
+      });
+    }
+  }
+
+  return {
+    variables: [...variables.values()].sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}
+
+export { SECRET_CONTEXTS, CONFIG_CONTEXTS, isPublicEnvVar };

package/src/forge/compiler/telemetry-registry/build.ts

@@ -0,0 +1,89 @@
+import { GENERATOR_VERSION } from "../emitter/constants.ts";
+import { hashStable } from "../primitives/hash.ts";
+import { canonicalJson } from "../primitives/serialize.ts";
+import type { AppGraph } from "../types/app-graph.ts";
+import type {
+  TelemetryEventDefinition,
+  TelemetryRegistry,
+  TelemetrySinkDefinition,
+  TelemetrySinks,
+} from "../types/telemetry-registry.ts";
+import type { ClassifiedPackage } from "../classifier/runtime-matrix.ts";
+import {
+  TELEMETRY_REGISTRY_ANALYZER_VERSION,
+  TELEMETRY_REGISTRY_SCHEMA_VERSION,
+} from "./constants.ts";
+import { parseTelemetryEventsFromSlice } from "./parse.ts";
+
+function stableSortEvents(events: TelemetryEventDefinition[]): TelemetryEventDefinition[] {
+  return [...events].sort((a, b) =>
+    a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
+  );
+}
+
+export function buildTelemetryRegistry(appGraph: AppGraph): TelemetryRegistry {
+  const byName = new Map<string, Set<string>>();
+
+  for (const symbol of appGraph.symbols) {
+    const sourceSlice =
+      typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+    if (sourceSlice.length === 0) {
+      continue;
+    }
+
+    const eventNames = parseTelemetryEventsFromSlice(sourceSlice);
+    for (const name of eventNames) {
+      const files = byName.get(name) ?? new Set<string>();
+      files.add(symbol.file);
+      byName.set(name, files);
+    }
+  }
+
+  const events: TelemetryEventDefinition[] = [...byName.entries()].map(
+    ([name, files]) => ({
+      name,
+      files: [...files].sort(),
+    }),
+  );
+
+  return {
+    schemaVersion: TELEMETRY_REGISTRY_SCHEMA_VERSION,
+    generatorVersion: GENERATOR_VERSION,
+    analyzerVersion: TELEMETRY_REGISTRY_ANALYZER_VERSION,
+    inputHash: hashStable(
+      canonicalJson({
+        appInputHash: appGraph.inputHash,
+        analyzerVersion: TELEMETRY_REGISTRY_ANALYZER_VERSION,
+      }),
+    ),
+    events: stableSortEvents(events),
+    diagnostics: [],
+  };
+}
+
+export function buildTelemetrySinks(
+  classified: ClassifiedPackage[],
+): TelemetrySinks {
+  const sinks: TelemetrySinkDefinition[] = [{ id: "local", kind: "local" }];
+  const seen = new Set<string>(["local"]);
+
+  for (const pkg of classified) {
+    const alias = pkg.recipe?.alias;
+    if (alias === "posthog" && !seen.has("posthog")) {
+      sinks.push({ id: "posthog", kind: "posthog" });
+      seen.add("posthog");
+    }
+    if (alias === "sentry" && !seen.has("sentry")) {
+      sinks.push({ id: "sentry", kind: "sentry" });
+      seen.add("sentry");
+    }
+  }
+
+  sinks.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+
+  return {
+    schemaVersion: TELEMETRY_REGISTRY_SCHEMA_VERSION,
+    generatorVersion: GENERATOR_VERSION,
+    sinks,
+  };
+}

package/src/forge/compiler/telemetry-registry/constants.ts

@@ -0,0 +1,2 @@
+export const TELEMETRY_REGISTRY_SCHEMA_VERSION = "1.0.0";
+export const TELEMETRY_REGISTRY_ANALYZER_VERSION = "1.0.0";

package/src/forge/compiler/telemetry-registry/parse.ts

@@ -0,0 +1,13 @@
+const TELEMETRY_CAPTURE_PATTERN =
+  /(?:telemetry|ctx\.telemetry)\.capture\s*\(\s*["']([^"']+)["']/g;
+
+export function parseTelemetryEventsFromSlice(sourceSlice: string): string[] {
+  const names: string[] = [];
+  for (const match of sourceSlice.matchAll(TELEMETRY_CAPTURE_PATTERN)) {
+    const name = match[1];
+    if (name && !names.includes(name)) {
+      names.push(name);
+    }
+  }
+  return names;
+}