reg-cli 0.18.16 → 0.19.0-rc1

package/dist/tracing-Bo38b9aR.mjs

@@ -0,0 +1,422 @@
+import { createRequire } from "node:module";
+import path from "path";
+import { fileURLToPath } from "url";
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { env } from "node:process";
+//#region src/utils.ts
+const isCJS = typeof __dirname !== "undefined";
+const readWasm = () => {
+	return readFile(join(isCJS ? __dirname : path.dirname(fileURLToPath(import.meta.url)), "./reg.wasm"));
+};
+const resolveExtention = () => {
+	return isCJS ? "cjs" : "mjs";
+};
+/**
+* Restrict the WASI namespace passed to `WebAssembly.instantiate` to only the
+* functions the wasm module actually imports. `@tybys/wasm-util` exposes the
+* full WASI preview1 surface (~46 fns) but `reg.wasm` declares ~20. The unused
+* 26 include capabilities reg-cli never needs (`path_unlink_file`,
+* `path_remove_directory`, `sock_*`, `proc_raise`, ...). Withholding them
+* shrinks the blast radius if the bundled wasm or one of its image-decoder
+* dependencies (libpng/libwebp/libjpeg) is ever compromised.
+*/
+const filterWasiImports = (module, full) => {
+	const needed = new Set(WebAssembly.Module.imports(module).filter((i) => i.module === "wasi_snapshot_preview1").map((i) => i.name));
+	const filtered = {};
+	const src = full;
+	for (const name of needed) if (name in src) filtered[name] = src[name];
+	return filtered;
+};
+/**
+* Host environment variables intentionally forwarded into the Wasm sandbox.
+* Everything else (shell secrets, CI credentials, AWS_*, NPM_TOKEN, ...) is
+* filtered out.
+*/
+const FORWARDED_ENV = [
+	"OTEL_ENABLED",
+	"JAEGER_ENABLED",
+	"OTEL_DEBUG",
+	"OTEL_EXPORTER_OTLP_ENDPOINT",
+	"OTEL_EXPORTER_OTLP_PROTOCOL",
+	"OTEL_SERVICE_NAME",
+	"OTEL_TRACES_EXPORTER",
+	"OTEL_RESOURCE_ATTRIBUTES"
+];
+/**
+* Longest directory path that every input in `paths` lives under. Treats
+* each path as a sequence of "/"-separated segments; absolute-vs-relative
+* mixes fall back to '.'.
+*/
+const commonAncestor = (paths) => {
+	const defined = paths.filter(Boolean);
+	if (defined.length === 0) return ".";
+	if (defined.length === 1) return defined[0];
+	const isAbs = (p) => p.startsWith("/");
+	const anyAbs = defined.some(isAbs);
+	const allAbs = defined.every(isAbs);
+	if (anyAbs && !allAbs) return ".";
+	const split = defined.map((p) => p.split("/").filter(Boolean));
+	const shortest = Math.min(...split.map((s) => s.length));
+	const common = [];
+	for (let i = 0; i < shortest; i++) {
+		const seg = split[0][i];
+		if (split.every((s) => s[i] === seg)) common.push(seg);
+		else break;
+	}
+	if (common.length === 0) return allAbs ? "/" : ".";
+	return (allAbs ? "/" : "") + common.join("/");
+};
+const WASI_PATH_FLAGS = new Set([
+	"--report",
+	"-R",
+	"--json",
+	"-J",
+	"--junit",
+	"--from",
+	"-F"
+]);
+/**
+* Normalize `./foo` to `foo` for paths passed into WASI. wasm-util does not
+* match a guest path beginning with `./` to an otherwise equivalent relative
+* preopen, so leaving the prefix intact makes valid paths unreachable.
+*/
+const normalizeWasiArgv = (argv) => {
+	const normalized = [...argv];
+	const stripDot = (value) => value.startsWith("./") ? value.slice(2) || "." : value;
+	const offset = normalized[0] === "--" ? 1 : 0;
+	for (let i = offset; i < normalized.length && i < offset + 3; i++) {
+		if (normalized[i].startsWith("-")) break;
+		normalized[i] = stripDot(normalized[i]);
+	}
+	for (let i = offset; i < normalized.length - 1; i++) if (WASI_PATH_FLAGS.has(normalized[i])) {
+		normalized[i + 1] = stripDot(normalized[i + 1]);
+		i++;
+	}
+	return normalized;
+};
+/**
+* Compute the minimum-capability WASI sandbox for a given reg-cli invocation:
+*
+*   - preopen only the smallest ancestor directory that covers every path
+*     this run touches (actualDir, expectedDir, diffDir, and the parents
+*     of --report / --json)
+*   - forward only an allowlisted subset of host env into Wasm
+*
+* Before this, entry.ts / worker.ts did `preopens: { './': './' }` which
+* exposed the entire cwd (and therefore `.npmrc`, `.env`, `node_modules`,
+* etc.) to whatever runs inside Wasm. Narrowing matters because reg-cli
+* deliberately ingests untrusted images from CI and image decoders
+* (libpng, libwebp, libjpeg) have a long history of RCE-class CVEs.
+*
+* Why a single common-ancestor and not one preopen per directory:
+*   On the `wasm32-wasip1-threads` target, Rust's libstd only enumerates
+*   the first preopen returned by WASI (`fd_prestat_get(3)` is queried but
+*   `fd_prestat_get(4)` is never issued). Until that's fixed upstream,
+*   registering one preopen per dir effectively hides every dir but the
+*   first. Picking the narrowest *single* ancestor that still contains
+*   every touched path gives us a real-world win without tripping the bug.
+*
+* Caveats (follow-ups, not in this PR):
+*   - Symlinks and FIFOs inside the preopened directory are still resolved
+*     by the host, so an attacker who can plant files under `./diff/` could
+*     still exfiltrate via an evil symlink pointing outside the sandbox.
+*     Addressing this needs host-side WASI changes.
+*   - `@tybys/wasm-util`'s WASI still runs on top of Node's `fs` with full
+*     privilege (`fs: fs as IFs`); we only constrain *what paths Wasm is
+*     allowed to name*, not what the host fs underneath could do.
+*   - One-preopen-per-dir limitation above.
+*/
+const computeWasiSandbox = (argv) => {
+	const args = argv[0] === "--" ? argv.slice(1) : argv;
+	const positional = [];
+	for (let i = 0; i < args.length && positional.length < 3; i++) {
+		if (args[i].startsWith("--")) break;
+		positional.push(args[i]);
+	}
+	const flagValue = (name) => {
+		const i = args.indexOf(name);
+		return i >= 0 && i + 1 < args.length ? args[i + 1] : void 0;
+	};
+	const dirs = [];
+	for (const p of positional) if (p) dirs.push(p);
+	const report = flagValue("--report");
+	const json = flagValue("--json");
+	const junit = flagValue("--junit");
+	const from = flagValue("--from") ?? flagValue("-F");
+	if (report) dirs.push(dirname(report) || ".");
+	if (json) dirs.push(dirname(json) || ".");
+	if (junit) dirs.push(dirname(junit) || ".");
+	if (from) dirs.push(dirname(from) || ".");
+	const preopenRoot = commonAncestor(dirs) || ".";
+	const mapWasm = (p) => p === "." || p === "./" || p.startsWith("/") || p.startsWith("./") ? p : `./${p}`;
+	const preopens = { [mapWasm(preopenRoot)]: preopenRoot };
+	if (!preopenRoot || preopenRoot === "." || preopenRoot === "./") preopens["./"] = "./";
+	const env$1 = {};
+	for (const k of FORWARDED_ENV) {
+		const v = env[k];
+		if (v !== void 0) env$1[k] = v;
+	}
+	return {
+		preopens,
+		env: env$1
+	};
+};
+//#endregion
+//#region src/tracing.ts
+/**
+* OpenTelemetry tracing utilities for reg-cli
+*
+* This module receives trace data from the Rust/WASM side and converts it
+* to OpenTelemetry spans that can be exported to Jaeger or other backends.
+*
+* The @opentelemetry/* packages are declared as **optional peer
+* dependencies** — they are loaded lazily inside `initTracing()` only when
+* `OTEL_ENABLED=true` (or `JAEGER_ENABLED=true`). Default installs of this
+* package therefore pay zero install or runtime cost for OTel.
+*/
+const PKG_VERSION = (() => {
+	try {
+		return createRequire(import.meta.url)("../package.json").version ?? "unknown";
+	} catch {
+		return "unknown";
+	}
+})();
+let otel = null;
+let provider = null;
+let isInitialized = false;
+let currentRootSpan = null;
+let currentRootContext = null;
+/**
+* Check if tracing is enabled via environment variable
+*/
+const isTracingEnabled = () => {
+	return process.env.OTEL_ENABLED === "true" || process.env.JAEGER_ENABLED === "true";
+};
+/**
+* Lazily import the @opentelemetry/* packages. Returns null and prints a
+* single warning if any are missing — keeps the CLI working without OTel
+* installed even when the env vars are set.
+*/
+const loadOtel = async () => {
+	if (otel) return otel;
+	try {
+		const [api, resources, sdkBase, sdkNode, exporter, semconv] = await Promise.all([
+			import("@opentelemetry/api"),
+			import("@opentelemetry/resources"),
+			import("@opentelemetry/sdk-trace-base"),
+			import("@opentelemetry/sdk-trace-node"),
+			import("@opentelemetry/exporter-trace-otlp-http"),
+			import("@opentelemetry/semantic-conventions")
+		]);
+		otel = {
+			api,
+			resources,
+			sdkBase,
+			sdkNode,
+			exporter,
+			semconv
+		};
+		return otel;
+	} catch (err) {
+		const pkgs = [
+			"@opentelemetry/api",
+			"@opentelemetry/exporter-trace-otlp-http",
+			"@opentelemetry/resources",
+			"@opentelemetry/sdk-trace-base",
+			"@opentelemetry/sdk-trace-node",
+			"@opentelemetry/semantic-conventions"
+		].join(" ");
+		console.warn(`[Tracing] OTEL_ENABLED is set but the @opentelemetry/* peer dependencies are not installed. Continuing without tracing. To enable, install the peers alongside reg-cli, e.g.:
+  npm i -g ${pkgs}     # if reg-cli is installed globally\n  npm i    ${pkgs}     # if reg-cli is a project dependency`);
+		if (process.env.OTEL_DEBUG === "true") console.warn("[Tracing] Import error:", err);
+		return null;
+	}
+};
+/**
+* Initialize OpenTelemetry SDK
+*/
+const initTracing = async () => {
+	if (!isTracingEnabled() || isInitialized) return;
+	const mods = await loadOtel();
+	if (!mods) return;
+	const otlpEndpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT || "http://localhost:4318/v1/traces";
+	const otlpExporter = new mods.exporter.OTLPTraceExporter({ url: otlpEndpoint });
+	provider = new mods.sdkNode.NodeTracerProvider({
+		resource: mods.resources.resourceFromAttributes({
+			[mods.semconv.ATTR_SERVICE_NAME]: "reg-cli",
+			[mods.semconv.ATTR_SERVICE_VERSION]: "0.18.10"
+		}),
+		spanProcessors: [new mods.sdkBase.BatchSpanProcessor(otlpExporter)]
+	});
+	provider.register();
+	isInitialized = true;
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log("[Tracing] OpenTelemetry initialized");
+		console.log(`[Tracing] OTLP endpoint: ${otlpEndpoint}`);
+	}
+};
+/**
+* Shutdown OpenTelemetry SDK gracefully
+*/
+const shutdownTracing = async () => {
+	if (!provider || !isInitialized) return;
+	if (process.env.OTEL_DEBUG === "true") console.log("[Tracing] Starting SDK shutdown...");
+	try {
+		await provider.shutdown();
+	} catch (err) {
+		console.error("[Tracing] Error during shutdown:", err);
+	}
+	isInitialized = false;
+	provider = null;
+	if (process.env.OTEL_DEBUG === "true") console.log("[Tracing] OpenTelemetry SDK shut down");
+};
+/**
+* Get the tracer instance
+*/
+const getTracer = () => {
+	return otel.api.trace.getTracer("reg-cli", PKG_VERSION);
+};
+/**
+* Start a root span and return context info to pass to Rust
+*/
+const startRootSpan = (name) => {
+	if (!isTracingEnabled() || !isInitialized || !otel) return null;
+	currentRootSpan = getTracer().startSpan(name);
+	currentRootContext = otel.api.trace.setSpan(otel.api.ROOT_CONTEXT, currentRootSpan);
+	const spanContext = currentRootSpan.spanContext();
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log(`[Tracing] Started root span: ${name}`);
+		console.log(`[Tracing] Trace ID: ${spanContext.traceId}`);
+		console.log(`[Tracing] Span ID: ${spanContext.spanId}`);
+	}
+	return {
+		traceId: spanContext.traceId,
+		spanId: spanContext.spanId
+	};
+};
+/**
+* End the current root span
+*/
+const endRootSpan = (success = true) => {
+	if (currentRootSpan && otel) {
+		if (success) currentRootSpan.setStatus({ code: otel.api.SpanStatusCode.OK });
+		else currentRootSpan.setStatus({ code: otel.api.SpanStatusCode.ERROR });
+		currentRootSpan.end();
+		if (process.env.OTEL_DEBUG === "true") console.log("[Tracing] Ended root span");
+		currentRootSpan = null;
+		currentRootContext = null;
+	}
+};
+/**
+* Topologically sort spans so parents are always processed before children
+*/
+const topologicalSortSpans = (spans) => {
+	const spanMap = /* @__PURE__ */ new Map();
+	const childrenMap = /* @__PURE__ */ new Map();
+	const rootSpans = [];
+	for (const span of spans) {
+		spanMap.set(span.span_id, span);
+		if (!span.parent_span_id) rootSpans.push(span.span_id);
+		else {
+			const children = childrenMap.get(span.parent_span_id) || [];
+			children.push(span.span_id);
+			childrenMap.set(span.parent_span_id, children);
+		}
+	}
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log(`[Tracing] Total spans: ${spans.length}, Unique IDs in spanMap: ${spanMap.size}`);
+		console.log(`[Tracing] Root spans: ${rootSpans.join(", ")}`);
+		console.log(`[Tracing] All spans:`);
+		for (const span of spans) console.log(`  ${span.span_id}: ${span.name} (parent: ${span.parent_span_id || "none"})`);
+		console.log(`[Tracing] Parent->Children map:`);
+		for (const [parent, children] of childrenMap.entries()) console.log(`  ${parent} -> ${children.join(", ")}`);
+	}
+	const result = [];
+	const queue = [...rootSpans];
+	const visited = /* @__PURE__ */ new Set();
+	while (queue.length > 0) {
+		const spanId = queue.shift();
+		if (visited.has(spanId)) continue;
+		visited.add(spanId);
+		const span = spanMap.get(spanId);
+		if (span) {
+			result.push(span);
+			const children = childrenMap.get(spanId) || [];
+			queue.push(...children);
+		}
+	}
+	for (const span of spans) if (!visited.has(span.span_id)) {
+		if (process.env.OTEL_DEBUG === "true") console.log(`[Tracing] Orphan span: ${span.name} (id: ${span.span_id}, parent: ${span.parent_span_id})`);
+		result.push(span);
+	}
+	return result;
+};
+/**
+* Convert Rust trace data to OpenTelemetry spans
+*
+* Since Rust spans have already ended by the time we receive them,
+* we reconstruct them with their recorded timestamps.
+*/
+const processRustTraceData = (traceData) => {
+	if (!isTracingEnabled() || !isInitialized || !otel) return;
+	const tracer = getTracer();
+	if (process.env.OTEL_DEBUG === "true") {
+		console.log(`[Tracing] Processing ${traceData.spans.length} spans from Rust`);
+		console.log(`[Tracing] JS parent context available: ${currentRootContext !== null}`);
+	}
+	const sortedSpans = topologicalSortSpans(traceData.spans);
+	const spanContextMap = /* @__PURE__ */ new Map();
+	for (const rustSpan of sortedSpans) {
+		const startTimeNs = rustSpan.start_time_ms * 1e6;
+		const endTimeNs = rustSpan.end_time_ms * 1e6;
+		let parentContext;
+		let parentInfo;
+		if (rustSpan.parent_span_id && spanContextMap.has(rustSpan.parent_span_id)) {
+			parentContext = spanContextMap.get(rustSpan.parent_span_id);
+			parentInfo = `rust parent: ${rustSpan.parent_span_id}`;
+		} else if (!rustSpan.parent_span_id && currentRootContext) {
+			parentContext = currentRootContext;
+			parentInfo = `js parent: ${currentRootSpan?.spanContext().spanId}`;
+		} else {
+			parentContext = currentRootContext || otel.api.ROOT_CONTEXT;
+			parentInfo = rustSpan.parent_span_id ? `orphan (parent ${rustSpan.parent_span_id} not found)` : "root (no js context)";
+		}
+		const span = tracer.startSpan(rustSpan.name, { startTime: [Math.floor(startTimeNs / 1e9), startTimeNs % 1e9] }, parentContext);
+		span.setAttribute("rust.target", rustSpan.target);
+		span.setAttribute("rust.level", rustSpan.level);
+		span.setAttribute("rust.span_id", rustSpan.span_id);
+		span.setAttribute("duration_ms", rustSpan.duration_ms);
+		for (const [key, value] of Object.entries(rustSpan.attributes)) span.setAttribute(`rust.${key}`, value);
+		if (rustSpan.status === "error") span.setStatus({
+			code: otel.api.SpanStatusCode.ERROR,
+			message: rustSpan.error_message || "Unknown error"
+		});
+		else span.setStatus({ code: otel.api.SpanStatusCode.OK });
+		span.end([Math.floor(endTimeNs / 1e9), endTimeNs % 1e9]);
+		const ctx = otel.api.trace.setSpan(parentContext, span);
+		spanContextMap.set(rustSpan.span_id, ctx);
+		if (process.env.OTEL_DEBUG === "true") console.log(`[Tracing] Created span: ${rustSpan.name} (${rustSpan.duration_ms}ms) [${parentInfo}] start=${rustSpan.start_time_ms}, end=${rustSpan.end_time_ms}`);
+	}
+};
+/**
+* Convert worker-side timing events to OpenTelemetry spans attached under the
+* current root span. Used to surface JS-bridge costs (Worker creation, wasm
+* compile / instantiate, message round-trips) that Rust-side tracing cannot see.
+*/
+const processWorkerSpans = (spans, workerLabel) => {
+	if (!isTracingEnabled() || !isInitialized || !otel || !spans?.length) return;
+	const tracer = getTracer();
+	const parentCtx = currentRootContext ?? otel.api.ROOT_CONTEXT;
+	for (const s of spans) {
+		const startNs = s.start_ms * 1e6;
+		const endNs = s.end_ms * 1e6;
+		const span = tracer.startSpan(s.name, { startTime: [Math.floor(startNs / 1e9), startNs % 1e9] }, parentCtx);
+		span.setAttribute("worker", s.worker_label ?? workerLabel);
+		span.setAttribute("duration_ms", s.end_ms - s.start_ms);
+		if (s.attributes) for (const [k, v] of Object.entries(s.attributes)) span.setAttribute(k, v);
+		span.end([Math.floor(endNs / 1e9), endNs % 1e9]);
+	}
+};
+//#endregion
+export { processWorkerSpans as a, computeWasiSandbox as c, normalizeWasiArgv as d, readWasm as f, processRustTraceData as i, filterWasiImports as l, initTracing as n, shutdownTracing as o, resolveExtention as p, isTracingEnabled as r, startRootSpan as s, endRootSpan as t, isCJS as u };