reg-cli 0.18.16 → 0.19.0-rc0

package/dist/tracing-DlLL541f.cjs

@@ -0,0 +1,445 @@
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+let path = require("path");
+path = require_rolldown_runtime.__toESM(path, 1);
+let url = require("url");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_process = require("node:process");
+let node_module = require("node:module");
+//#region src/utils.ts
+const isCJS = typeof __dirname !== "undefined";
+const readWasm = () => {
+	return (0, node_fs_promises.readFile)((0, node_path.join)(isCJS ? __dirname : path.default.dirname((0, url.fileURLToPath)(require("url").pathToFileURL(__filename).href)), "./reg.wasm"));
+};
+const resolveExtention = () => {
+	return isCJS ? "cjs" : "mjs";
+};
+/**
+* Host environment variables intentionally forwarded into the Wasm sandbox.
+* Everything else (shell secrets, CI credentials, AWS_*, NPM_TOKEN, ...) is
+* filtered out.
+*/
+const FORWARDED_ENV = [
+	"OTEL_ENABLED",
+	"JAEGER_ENABLED",
+	"OTEL_DEBUG",
+	"OTEL_EXPORTER_OTLP_ENDPOINT",
+	"OTEL_EXPORTER_OTLP_PROTOCOL",
+	"OTEL_SERVICE_NAME",
+	"OTEL_TRACES_EXPORTER",
+	"OTEL_RESOURCE_ATTRIBUTES"
+];
+/**
+* Longest directory path that every input in `paths` lives under. Treats
+* each path as a sequence of "/"-separated segments; absolute-vs-relative
+* mixes fall back to '.'.
+*/
+const commonAncestor = (paths) => {
+	const defined = paths.filter(Boolean);
+	if (defined.length === 0) return ".";
+	if (defined.length === 1) return defined[0];
+	const isAbs = (p) => p.startsWith("/");
+	const anyAbs = defined.some(isAbs);
+	const allAbs = defined.every(isAbs);
+	if (anyAbs && !allAbs) return ".";
+	const split = defined.map((p) => p.split("/").filter(Boolean));
+	const shortest = Math.min(...split.map((s) => s.length));
+	const common = [];
+	for (let i = 0; i < shortest; i++) {
+		const seg = split[0][i];
+		if (split.every((s) => s[i] === seg)) common.push(seg);
+		else break;
+	}
+	if (common.length === 0) return allAbs ? "/" : ".";
+	return (allAbs ? "/" : "") + common.join("/");
+};
+/**
+* Compute the minimum-capability WASI sandbox for a given reg-cli invocation:
+*
+*   - preopen only the smallest ancestor directory that covers every path
+*     this run touches (actualDir, expectedDir, diffDir, and the parents
+*     of --report / --json)
+*   - forward only an allowlisted subset of host env into Wasm
+*
+* Before this, entry.ts / worker.ts did `preopens: { './': './' }` which
+* exposed the entire cwd (and therefore `.npmrc`, `.env`, `node_modules`,
+* etc.) to whatever runs inside Wasm. Narrowing matters because reg-cli
+* deliberately ingests untrusted images from CI and image decoders
+* (libpng, libwebp, libjpeg) have a long history of RCE-class CVEs.
+*
+* Why a single common-ancestor and not one preopen per directory:
+*   On the `wasm32-wasip1-threads` target, Rust's libstd only enumerates
+*   the first preopen returned by WASI (`fd_prestat_get(3)` is queried but
+*   `fd_prestat_get(4)` is never issued). Until that's fixed upstream,
+*   registering one preopen per dir effectively hides every dir but the
+*   first. Picking the narrowest *single* ancestor that still contains
+*   every touched path gives us a real-world win without tripping the bug.
+*
+* Caveats (follow-ups, not in this PR):
+*   - Symlinks and FIFOs inside the preopened directory are still resolved
+*     by the host, so an attacker who can plant files under `./diff/` could
+*     still exfiltrate via an evil symlink pointing outside the sandbox.
+*     Addressing this needs host-side WASI changes.
+*   - `@tybys/wasm-util`'s WASI still runs on top of Node's `fs` with full
+*     privilege (`fs: fs as IFs`); we only constrain *what paths Wasm is
+*     allowed to name*, not what the host fs underneath could do.
+*   - One-preopen-per-dir limitation above.
+*/
+const computeWasiSandbox = (argv) => {
+	const args = argv[0] === "--" ? argv.slice(1) : argv;
+	const positional = [];
+	for (let i = 0; i < args.length && positional.length < 3; i++) {
+		if (args[i].startsWith("--")) break;
+		positional.push(args[i]);
+	}
+	const flagValue = (name) => {
+		const i = args.indexOf(name);
+		return i >= 0 && i + 1 < args.length ? args[i + 1] : void 0;
+	};
+	const dirs = [];
+	for (const p of positional) if (p) dirs.push(p);
+	const report = flagValue("--report");
+	const json = flagValue("--json");
+	const junit = flagValue("--junit");
+	const from = flagValue("--from") ?? flagValue("-F");
+	if (report) dirs.push((0, node_path.dirname)(report) || ".");
+	if (json) dirs.push((0, node_path.dirname)(json) || ".");
+	if (junit) dirs.push((0, node_path.dirname)(junit) || ".");
+	if (from) dirs.push((0, node_path.dirname)(from) || ".");
+	const preopenRoot = commonAncestor(dirs) || ".";
+	const mapWasm = (p) => p === "." || p === "./" || p.startsWith("/") || p.startsWith("./") ? p : `./${p}`;
+	const preopens = { [mapWasm(preopenRoot)]: preopenRoot };
+	if (!preopenRoot || preopenRoot === "." || preopenRoot === "./") preopens["./"] = "./";
+	const env = {};
+	for (const k of FORWARDED_ENV) {
+		const v = node_process.env[k];
+		if (v !== void 0) env[k] = v;
+	}
+	return {
+		preopens,
+		env
+	};
+};
+//#endregion
+//#region src/tracing.ts
+/**
+* OpenTelemetry tracing utilities for reg-cli
+*
+* This module receives trace data from the Rust/WASM side and converts it
+* to OpenTelemetry spans that can be exported to Jaeger or other backends.
+*
+* The @opentelemetry/* packages are declared as **optional peer
+* dependencies** — they are loaded lazily inside `initTracing()` only when
+* `OTEL_ENABLED=true` (or `JAEGER_ENABLED=true`). Default installs of this
+* package therefore pay zero install or runtime cost for OTel.
+*/
+const PKG_VERSION = (() => {
+	try {
+		return (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)("../package.json").version ?? "unknown";
+	} catch {
+		return "unknown";
+	}
+})();
+let otel = null;
+let provider = null;
+let isInitialized = false;
+let currentRootSpan = null;
+let currentRootContext = null;
+/**
+* Check if tracing is enabled via environment variable
+*/
+const isTracingEnabled = () => {
+	return process.env.OTEL_ENABLED === "true" || process.env.JAEGER_ENABLED === "true";
+};
+/**
+* Lazily import the @opentelemetry/* packages. Returns null and prints a
+* single warning if any are missing — keeps the CLI working without OTel
+* installed even when the env vars are set.
+*/
+const loadOtel = async () => {
+	if (otel) return otel;
+	try {
+		const [api, resources, sdkBase, sdkNode, exporter, semconv] = await Promise.all([
+			import("@opentelemetry/api"),
+			import("@opentelemetry/resources"),
+			import("@opentelemetry/sdk-trace-base"),
+			import("@opentelemetry/sdk-trace-node"),
+			import("@opentelemetry/exporter-trace-otlp-http"),
+			import("@opentelemetry/semantic-conventions")
+		]);
+		otel = {
+			api,
+			resources,
+			sdkBase,
+			sdkNode,
+			exporter,
+			semconv
+		};
+		return otel;
+	} catch (err) {
+		const pkgs = [
+			"@opentelemetry/api",
+			"@opentelemetry/exporter-trace-otlp-http",
+			"@opentelemetry/resources",
+			"@opentelemetry/sdk-trace-base",
+			"@opentelemetry/sdk-trace-node",
+			"@opentelemetry/semantic-conventions"
+		].join(" ");
+		console.warn(`[Tracing] OTEL_ENABLED is set but the @opentelemetry/* peer dependencies are not installed. Continuing without tracing. To enable, install the peers alongside reg-cli, e.g.:
+  npm i -g ${pkgs}     # if reg-cli is installed globally\n  npm i    ${pkgs}     # if reg-cli is a project dependency`);
+		if (process.env.OTEL_DEBUG === "true") console.warn("[Tracing] Import error:", err);
+		return null;
+	}
+};
+/**
+* Initialize OpenTelemetry SDK
+*/
+const initTracing = async () => {
+	if (!isTracingEnabled() || isInitialized) return;
+	const mods = await loadOtel();
+	if (!mods) return;
+	const otlpEndpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT || "http://localhost:4318/v1/traces";
+	const otlpExporter = new mods.exporter.OTLPTraceExporter({ url: otlpEndpoint });
+	provider = new mods.sdkNode.NodeTracerProvider({
+		resource: mods.resources.resourceFromAttributes({
+			[mods.semconv.ATTR_SERVICE_NAME]: "reg-cli",
+			[mods.semconv.ATTR_SERVICE_VERSION]: "0.18.10"
+		}),
+		spanProcessors: [new mods.sdkBase.BatchSpanProcessor(otlpExporter)]
+	});
+	provider.register();
+	isInitialized = true;
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log("[Tracing] OpenTelemetry initialized");
+		console.log(`[Tracing] OTLP endpoint: ${otlpEndpoint}`);
+	}
+};
+/**
+* Shutdown OpenTelemetry SDK gracefully
+*/
+const shutdownTracing = async () => {
+	if (!provider || !isInitialized) return;
+	if (process.env.OTEL_DEBUG === "true") console.log("[Tracing] Starting SDK shutdown...");
+	try {
+		await provider.shutdown();
+	} catch (err) {
+		console.error("[Tracing] Error during shutdown:", err);
+	}
+	isInitialized = false;
+	provider = null;
+	if (process.env.OTEL_DEBUG === "true") console.log("[Tracing] OpenTelemetry SDK shut down");
+};
+/**
+* Get the tracer instance
+*/
+const getTracer = () => {
+	return otel.api.trace.getTracer("reg-cli", PKG_VERSION);
+};
+/**
+* Start a root span and return context info to pass to Rust
+*/
+const startRootSpan = (name) => {
+	if (!isTracingEnabled() || !isInitialized || !otel) return null;
+	currentRootSpan = getTracer().startSpan(name);
+	currentRootContext = otel.api.trace.setSpan(otel.api.ROOT_CONTEXT, currentRootSpan);
+	const spanContext = currentRootSpan.spanContext();
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log(`[Tracing] Started root span: ${name}`);
+		console.log(`[Tracing] Trace ID: ${spanContext.traceId}`);
+		console.log(`[Tracing] Span ID: ${spanContext.spanId}`);
+	}
+	return {
+		traceId: spanContext.traceId,
+		spanId: spanContext.spanId
+	};
+};
+/**
+* End the current root span
+*/
+const endRootSpan = (success = true) => {
+	if (currentRootSpan && otel) {
+		if (success) currentRootSpan.setStatus({ code: otel.api.SpanStatusCode.OK });
+		else currentRootSpan.setStatus({ code: otel.api.SpanStatusCode.ERROR });
+		currentRootSpan.end();
+		if (process.env.OTEL_DEBUG === "true") console.log("[Tracing] Ended root span");
+		currentRootSpan = null;
+		currentRootContext = null;
+	}
+};
+/**
+* Topologically sort spans so parents are always processed before children
+*/
+const topologicalSortSpans = (spans) => {
+	const spanMap = /* @__PURE__ */ new Map();
+	const childrenMap = /* @__PURE__ */ new Map();
+	const rootSpans = [];
+	for (const span of spans) {
+		spanMap.set(span.span_id, span);
+		if (!span.parent_span_id) rootSpans.push(span.span_id);
+		else {
+			const children = childrenMap.get(span.parent_span_id) || [];
+			children.push(span.span_id);
+			childrenMap.set(span.parent_span_id, children);
+		}
+	}
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log(`[Tracing] Total spans: ${spans.length}, Unique IDs in spanMap: ${spanMap.size}`);
+		console.log(`[Tracing] Root spans: ${rootSpans.join(", ")}`);
+		console.log(`[Tracing] All spans:`);
+		for (const span of spans) console.log(`  ${span.span_id}: ${span.name} (parent: ${span.parent_span_id || "none"})`);
+		console.log(`[Tracing] Parent->Children map:`);
+		for (const [parent, children] of childrenMap.entries()) console.log(`  ${parent} -> ${children.join(", ")}`);
+	}
+	const result = [];
+	const queue = [...rootSpans];
+	const visited = /* @__PURE__ */ new Set();
+	while (queue.length > 0) {
+		const spanId = queue.shift();
+		if (visited.has(spanId)) continue;
+		visited.add(spanId);
+		const span = spanMap.get(spanId);
+		if (span) {
+			result.push(span);
+			const children = childrenMap.get(spanId) || [];
+			queue.push(...children);
+		}
+	}
+	for (const span of spans) if (!visited.has(span.span_id)) {
+		if (process.env.OTEL_DEBUG === "true") console.log(`[Tracing] Orphan span: ${span.name} (id: ${span.span_id}, parent: ${span.parent_span_id})`);
+		result.push(span);
+	}
+	return result;
+};
+/**
+* Convert Rust trace data to OpenTelemetry spans
+*
+* Since Rust spans have already ended by the time we receive them,
+* we reconstruct them with their recorded timestamps.
+*/
+const processRustTraceData = (traceData) => {
+	if (!isTracingEnabled() || !isInitialized || !otel) return;
+	const tracer = getTracer();
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log(`[Tracing] Processing ${traceData.spans.length} spans from Rust`);
+		console.log(`[Tracing] JS parent context available: ${currentRootContext !== null}`);
+	}
+	const sortedSpans = topologicalSortSpans(traceData.spans);
+	const spanContextMap = /* @__PURE__ */ new Map();
+	for (const rustSpan of sortedSpans) {
+		const startTimeNs = rustSpan.start_time_ms * 1e6;
+		const endTimeNs = rustSpan.end_time_ms * 1e6;
+		let parentContext;
+		let parentInfo;
+		if (rustSpan.parent_span_id && spanContextMap.has(rustSpan.parent_span_id)) {
+			parentContext = spanContextMap.get(rustSpan.parent_span_id);
+			parentInfo = `rust parent: ${rustSpan.parent_span_id}`;
+		} else if (!rustSpan.parent_span_id && currentRootContext) {
+			parentContext = currentRootContext;
+			parentInfo = `js parent: ${currentRootSpan?.spanContext().spanId}`;
+		} else {
+			parentContext = currentRootContext || otel.api.ROOT_CONTEXT;
+			parentInfo = rustSpan.parent_span_id ? `orphan (parent ${rustSpan.parent_span_id} not found)` : "root (no js context)";
+		}
+		const span = tracer.startSpan(rustSpan.name, { startTime: [Math.floor(startTimeNs / 1e9), startTimeNs % 1e9] }, parentContext);
+		span.setAttribute("rust.target", rustSpan.target);
+		span.setAttribute("rust.level", rustSpan.level);
+		span.setAttribute("rust.span_id", rustSpan.span_id);
+		span.setAttribute("duration_ms", rustSpan.duration_ms);
+		for (const [key, value] of Object.entries(rustSpan.attributes)) span.setAttribute(`rust.${key}`, value);
+		if (rustSpan.status === "error") span.setStatus({
+			code: otel.api.SpanStatusCode.ERROR,
+			message: rustSpan.error_message || "Unknown error"
+		});
+		else span.setStatus({ code: otel.api.SpanStatusCode.OK });
+		span.end([Math.floor(endTimeNs / 1e9), endTimeNs % 1e9]);
+		const ctx = otel.api.trace.setSpan(parentContext, span);
+		spanContextMap.set(rustSpan.span_id, ctx);
+		if (process.env.OTEL_DEBUG === "true") console.log(`[Tracing] Created span: ${rustSpan.name} (${rustSpan.duration_ms}ms) [${parentInfo}] start=${rustSpan.start_time_ms}, end=${rustSpan.end_time_ms}`);
+	}
+};
+/**
+* Convert worker-side timing events to OpenTelemetry spans attached under the
+* current root span. Used to surface JS-bridge costs (Worker creation, wasm
+* compile / instantiate, message round-trips) that Rust-side tracing cannot see.
+*/
+const processWorkerSpans = (spans, workerLabel) => {
+	if (!isTracingEnabled() || !isInitialized || !otel || !spans?.length) return;
+	const tracer = getTracer();
+	const parentCtx = currentRootContext ?? otel.api.ROOT_CONTEXT;
+	for (const s of spans) {
+		const startNs = s.start_ms * 1e6;
+		const endNs = s.end_ms * 1e6;
+		const span = tracer.startSpan(s.name, { startTime: [Math.floor(startNs / 1e9), startNs % 1e9] }, parentCtx);
+		span.setAttribute("worker", s.worker_label ?? workerLabel);
+		span.setAttribute("duration_ms", s.end_ms - s.start_ms);
+		if (s.attributes) for (const [k, v] of Object.entries(s.attributes)) span.setAttribute(k, v);
+		span.end([Math.floor(endNs / 1e9), endNs % 1e9]);
+	}
+};
+//#endregion
+Object.defineProperty(exports, "computeWasiSandbox", {
+	enumerable: true,
+	get: function() {
+		return computeWasiSandbox;
+	}
+});
+Object.defineProperty(exports, "endRootSpan", {
+	enumerable: true,
+	get: function() {
+		return endRootSpan;
+	}
+});
+Object.defineProperty(exports, "initTracing", {
+	enumerable: true,
+	get: function() {
+		return initTracing;
+	}
+});
+Object.defineProperty(exports, "isCJS", {
+	enumerable: true,
+	get: function() {
+		return isCJS;
+	}
+});
+Object.defineProperty(exports, "isTracingEnabled", {
+	enumerable: true,
+	get: function() {
+		return isTracingEnabled;
+	}
+});
+Object.defineProperty(exports, "processRustTraceData", {
+	enumerable: true,
+	get: function() {
+		return processRustTraceData;
+	}
+});
+Object.defineProperty(exports, "processWorkerSpans", {
+	enumerable: true,
+	get: function() {
+		return processWorkerSpans;
+	}
+});
+Object.defineProperty(exports, "readWasm", {
+	enumerable: true,
+	get: function() {
+		return readWasm;
+	}
+});
+Object.defineProperty(exports, "resolveExtention", {
+	enumerable: true,
+	get: function() {
+		return resolveExtention;
+	}
+});
+Object.defineProperty(exports, "shutdownTracing", {
+	enumerable: true,
+	get: function() {
+		return shutdownTracing;
+	}
+});
+Object.defineProperty(exports, "startRootSpan", {
+	enumerable: true,
+	get: function() {
+		return startRootSpan;
+	}
+});

package/dist/worker.cjs

@@ -0,0 +1,143 @@
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+const require_tracing = require("./tracing-DlLL541f.cjs");
+const require_progress = require("./progress-UOiKHaTY.cjs");
+let node_worker_threads = require("node:worker_threads");
+let node_process = require("node:process");
+let node_fs = require("node:fs");
+node_fs = require_rolldown_runtime.__toESM(node_fs, 1);
+let _tybys_wasm_util = require("@tybys/wasm-util");
+//#region src/proxy.ts
+const kIsProxy = Symbol("kIsProxy");
+const createInstanceProxy = (instance, memory) => {
+	if (instance[kIsProxy]) return instance;
+	const originalExports = instance.exports;
+	const createHandler = function(target) {
+		const handlers = [
+			"apply",
+			"construct",
+			"defineProperty",
+			"deleteProperty",
+			"get",
+			"getOwnPropertyDescriptor",
+			"getPrototypeOf",
+			"has",
+			"isExtensible",
+			"ownKeys",
+			"preventExtensions",
+			"set",
+			"setPrototypeOf"
+		];
+		const handler = {};
+		for (let i = 0; i < handlers.length; i++) {
+			const name = handlers[i];
+			handler[name] = function() {
+				const args = Array.prototype.slice.call(arguments, 1);
+				args.unshift(target);
+				return Reflect[name].apply(Reflect, args);
+			};
+		}
+		return handler;
+	};
+	const handler = createHandler(originalExports);
+	const _initialize = () => {};
+	const _start = () => 0;
+	handler.get = function(_target, p, receiver) {
+		if (p === "memory") return (typeof memory === "function" ? memory() : memory) ?? Reflect.get(originalExports, p, receiver);
+		if (p === "_initialize") return p in originalExports ? _initialize : void 0;
+		if (p === "_start") return p in originalExports ? _start : void 0;
+		return Reflect.get(originalExports, p, receiver);
+	};
+	handler.has = function(_target, p) {
+		if (p === "memory") return true;
+		return Reflect.has(originalExports, p);
+	};
+	const exportsProxy = new Proxy(Object.create(null), handler);
+	return new Proxy(instance, { get(target, p, receiver) {
+		if (p === "exports") return exportsProxy;
+		if (p === kIsProxy) return true;
+		return Reflect.get(target, p, receiver);
+	} });
+};
+//#endregion
+//#region src/worker.ts
+const isTracingEnabled = () => node_process.env.OTEL_ENABLED === "true" || node_process.env.JAEGER_ENABLED === "true";
+const sandbox = require_tracing.computeWasiSandbox(node_worker_threads.workerData.argv);
+const printErr = require_progress.createPrintErrHook((ev) => {
+	node_worker_threads.parentPort?.postMessage({
+		cmd: "compare-event",
+		event: ev
+	});
+});
+const wasi = new _tybys_wasm_util.WASI({
+	version: "preview1",
+	args: node_worker_threads.workerData.argv,
+	env: sandbox.env,
+	returnOnExit: true,
+	preopens: sandbox.preopens,
+	fs: node_fs.default,
+	printErr
+});
+const imports = wasi.getImportObject();
+const file = require_tracing.readWasm();
+const handler = async ({ startArg, tid, memory }) => {
+	const workerSpans = [];
+	const workerLabel = `thread-${tid}`;
+	const handler_start_ms = Date.now();
+	const tSpan = async (name, fn, attributes) => {
+		if (!isTracingEnabled()) return fn();
+		const start_ms = Date.now();
+		const r = await fn();
+		workerSpans.push({
+			name,
+			start_ms,
+			end_ms: Date.now(),
+			attributes,
+			worker_label: workerLabel
+		});
+		return r;
+	};
+	try {
+		const wasm = await tSpan("worker.wasm_compile", async () => WebAssembly.compile(await file));
+		let instance = await tSpan("worker.wasm_instantiate", async () => WebAssembly.instantiate(wasm, {
+			...imports,
+			wasi: { "thread-spawn": (startArg) => {
+				const threadIdBuffer = new SharedArrayBuffer(4);
+				const id = new Int32Array(threadIdBuffer);
+				Atomics.store(id, 0, -1);
+				node_worker_threads.parentPort?.postMessage({
+					cmd: "thread-spawn",
+					startArg,
+					threadId: id,
+					memory
+				});
+				Atomics.wait(id, 0, -1);
+				return Atomics.load(id, 0);
+			} },
+			env: { memory }
+		}));
+		instance = createInstanceProxy(instance, memory);
+		await tSpan("worker.wasi_start", async () => {
+			wasi.start(instance);
+		});
+		await tSpan("worker.wasi_thread_start", async () => {
+			instance.exports.wasi_thread_start(tid, startArg);
+		}, { tid });
+		if (isTracingEnabled()) {
+			workerSpans.push({
+				name: "worker.thread_total",
+				start_ms: handler_start_ms,
+				end_ms: Date.now(),
+				worker_label: workerLabel,
+				attributes: { tid }
+			});
+			node_worker_threads.parentPort?.postMessage({
+				cmd: "worker-spans",
+				workerSpans
+			});
+		}
+	} catch (e) {
+		throw e;
+	}
+};
+node_worker_threads.parentPort?.addListener("message", handler);
+//#endregion

package/dist/worker.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/worker.d.mts

@@ -0,0 +1 @@
+export { };