wu-framework 1.1.6 → 1.1.8

package/src/core/wu-script-executor.js

@@ -1,216 +1,113 @@
 /**
- * 📜 WU-SCRIPT-EXECUTOR: Sistema de ejecución segura de scripts
- * Basado en video-code - Ejecuta scripts en contexto sandbox aislado
+ * WU-SCRIPT-EXECUTOR: Execute scripts inside a Proxy sandbox.
+ *
+ * Two isolation levels:
+ * - strictGlobal: true  → with(proxy) { code } — all global access goes through proxy
+ * - strictGlobal: false → (function(window){ code })(proxy) — only explicit window.xxx
+ *
+ * This is what makes the sandbox REAL instead of decorative.
+ * Without this, import() runs code in global scope and the proxy is just a cleanup tracker.
+ * With this, code receives the proxy as "window" and every setTimeout, addEventListener,
+ * document.querySelector, localStorage access goes through the proxy's traps.
  */
 
+import { logger } from './wu-logger.js';
+
 export class WuScriptExecutor {
-  constructor() {
-    console.log('[WuScriptExecutor] 📜 Script execution system initialized');
-  }
 
   /**
-   * Ejecutar script usando Function constructor (más seguro que eval)
-   * @param {string} script - Código JavaScript a ejecutar
-   * @param {string} appName - Nombre de la app
-   * @param {Proxy} globalProxy - Proxy sandbox como window
-   * @returns {*} Resultado de la ejecución
+   * Execute a script string inside the proxy sandbox.
+   *
+   * @param {string} scriptText - JavaScript code to execute
+   * @param {string} appName - App identifier (for logging)
+   * @param {Proxy} proxy - The activated proxy sandbox
+   * @param {Object} [options]
+   * @param {boolean} [options.strictGlobal=true] - Use with(proxy) for maximum isolation
+   * @param {string} [options.sourceUrl=''] - Source URL for devtools (//# sourceURL)
+   * @returns {*} Return value of the executed code
    */
-  executeWithFunction(script, appName, globalProxy) {
-    console.log(`[WuScriptExecutor] 🚀 Executing script for ${appName} using Function`);
-
-    try {
-      // 🌟 Almacenar proxy globalmente de forma temporal
-      window.__WU_PROXY_TEMP__ = globalProxy;
+  execute(scriptText, appName, proxy, options = {}) {
+    const { strictGlobal = true, sourceUrl = '' } = options;
 
-      // 🎯 Crear función que recibe window como parámetro
-      const scriptText = `
-        return ((window) => {
-          ${script}
-          return window['${appName}'];
-        })(window.__WU_PROXY_TEMP__);
-      `;
+    if (!scriptText || !scriptText.trim()) return;
 
-      // 🚀 Ejecutar con Function (más seguro que eval)
-      const fn = new Function(scriptText);
-      const result = fn();
+    const sourceComment = sourceUrl ? `\n//# sourceURL=wu-sandbox:///${appName}/${sourceUrl}\n` : '';
 
-      // 🧹 Limpiar proxy temporal
-      delete window.__WU_PROXY_TEMP__;
-
-      console.log(`[WuScriptExecutor] ✅ Script executed successfully for ${appName}`);
-      return result;
-
-    } catch (error) {
-      // 🧹 Limpiar en caso de error
-      delete window.__WU_PROXY_TEMP__;
+    let wrappedCode;
 
-      console.error(`[WuScriptExecutor] ❌ Script execution failed for ${appName}:`, error);
-      throw error;
-    }
+    if (strictGlobal) {
+      // MAXIMUM ISOLATION
+      // with(window) makes ALL unqualified identifiers (setTimeout, fetch, document, etc.)
+      // resolve through the proxy's has/get traps, not the real window.
+      // Note: 'use strict' inside the with block becomes a no-op string expression,
+      // so bundled code with strict mode still works.
+      wrappedCode = `;(function(window, self, globalThis, top, parent) {
+  with(window) {
+    ;${scriptText}${sourceComment}
   }
-
-  /**
-   * Ejecutar script usando eval (fallback)
-   * @param {string} script - Código JavaScript a ejecutar
-   * @param {string} appName - Nombre de la app
-   * @param {Proxy} globalProxy - Proxy sandbox como window
-   * @returns {*} Resultado de la ejecución
-   */
-  executeWithEval(script, appName, globalProxy) {
-    console.log(`[WuScriptExecutor] 🚀 Executing script for ${appName} using eval`);
+}).call(proxy, proxy, proxy, proxy, proxy, proxy);`;
+    } else {
+      // IIFE ONLY — only explicit window.xxx goes through proxy
+      wrappedCode = `;(function(window, self, globalThis, top, parent) {
+  ;${scriptText}${sourceComment}
+}).call(proxy, proxy, proxy, proxy, proxy, proxy);`;
+    }
 
     try {
-      // 🌟 Almacenar proxy globalmente de forma temporal
-      window.__WU_PROXY_TEMP__ = globalProxy;
-
-      // 🎯 IIFE que recibe window como parámetro
-      const scriptText = `
-        ((window) => {
-          ${script}
-          return window['${appName}'];
-        })(window.__WU_PROXY_TEMP__);
-      `;
-
-      // ⚠️ Usar eval (menos seguro pero compatible)
-      const result = eval(scriptText);
-
-      // 🧹 Limpiar proxy temporal
-      delete window.__WU_PROXY_TEMP__;
-
-      console.log(`[WuScriptExecutor] ✅ Script executed successfully for ${appName}`);
-      return result;
-
+      // new Function('proxy', code) creates a function with 'proxy' as the single param.
+      // This avoids polluting scope — the only bridge to the sandbox is the proxy argument.
+      const fn = new Function('proxy', wrappedCode);
+      return fn(proxy);
     } catch (error) {
-      // 🧹 Limpiar en caso de error
-      delete window.__WU_PROXY_TEMP__;
-
-      console.error(`[WuScriptExecutor] ❌ Script execution failed for ${appName}:`, error);
+      // If strictGlobal failed (rare edge case with with-statement), retry without it
+      if (strictGlobal) {
+        logger.wuWarn(`[ScriptExecutor] strictGlobal failed for ${appName}, retrying without with(): ${error.message}`);
+        return this.execute(scriptText, appName, proxy, { ...options, strictGlobal: false });
+      }
+      logger.wuError(`[ScriptExecutor] Execution failed for ${appName}:`, error);
       throw error;
     }
   }
 
   /**
-   * Ejecutar script con estrategia automática (intenta Function primero, luego eval)
-   * @param {string} script - Código JavaScript a ejecutar
-   * @param {string} appName - Nombre de la app
-   * @param {Proxy} globalProxy - Proxy sandbox como window
-   * @param {string} strategy - 'function' | 'eval' | 'auto'
-   * @returns {*} Resultado de la ejecución
+   * Fetch script content from a URL.
+   * @param {string} url - Script URL
+   * @returns {Promise<string>} Script text
    */
-  execute(script, appName, globalProxy, strategy = 'function') {
-    if (strategy === 'eval') {
-      return this.executeWithEval(script, appName, globalProxy);
+  async fetchScript(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+      throw new Error(`Failed to fetch script ${url}: HTTP ${response.status}`);
     }
-
-    if (strategy === 'function' || strategy === 'auto') {
-      try {
-        return this.executeWithFunction(script, appName, globalProxy);
-      } catch (error) {
-        if (strategy === 'auto') {
-          console.warn(`[WuScriptExecutor] ⚠️ Function failed, falling back to eval`);
-          return this.executeWithEval(script, appName, globalProxy);
-        }
-        throw error;
-      }
-    }
-
-    throw new Error(`Unknown execution strategy: ${strategy}`);
+    return response.text();
   }
 
   /**
-   * Ejecutar múltiples scripts en secuencia
-   * @param {Array<string>} scripts - Array de scripts
-   * @param {string} appName - Nombre de la app
-   * @param {Proxy} globalProxy - Proxy sandbox
-   * @param {string} strategy - Estrategia de ejecución
-   * @returns {Array<*>} Resultados de ejecución
+   * Execute an array of scripts in sequence inside the proxy.
+   * External scripts (with src) are fetched first.
+   *
+   * @param {Array<{content?: string, src?: string}>} scripts
+   * @param {string} appName
+   * @param {Proxy} proxy
+   * @param {Object} [options]
    */
-  async executeMultiple(scripts, appName, globalProxy, strategy = 'function') {
-    console.log(`[WuScriptExecutor] 📚 Executing ${scripts.length} scripts for ${appName}`);
-
-    const results = [];
-
-    for (let i = 0; i < scripts.length; i++) {
-      const script = scripts[i];
-      console.log(`[WuScriptExecutor] 📜 Executing script ${i + 1}/${scripts.length}`);
+  async executeAll(scripts, appName, proxy, options = {}) {
+    for (const script of scripts) {
+      let text = script.content;
 
-      try {
-        const result = this.execute(script, appName, globalProxy, strategy);
-        results.push({ success: true, result });
-      } catch (error) {
-        console.error(`[WuScriptExecutor] ❌ Script ${i + 1} failed:`, error);
-        results.push({ success: false, error });
+      if (!text && script.src) {
+        logger.wuDebug(`[ScriptExecutor] Fetching external script: ${script.src}`);
+        text = await this.fetchScript(script.src);
       }
-    }
-
-    const successCount = results.filter(r => r.success).length;
-    console.log(`[WuScriptExecutor] ✅ Executed ${successCount}/${scripts.length} scripts successfully`);
-
-    return results;
-  }
 
-  /**
-   * Validar script antes de ejecutar
-   * @param {string} script - Código a validar
-   * @returns {boolean} True si el script parece válido
-   */
-  validateScript(script) {
-    if (!script || typeof script !== 'string') {
-      return false;
-    }
-
-    if (script.trim().length === 0) {
-      return false;
-    }
-
-    // Detectar código potencialmente peligroso
-    const dangerousPatterns = [
-      /__proto__/,
-      /constructor.*prototype/,
-      /document\.write/,
-      /eval\(/,
-      /new\s+Function\(/
-    ];
-
-    for (const pattern of dangerousPatterns) {
-      if (pattern.test(script)) {
-        console.warn(`[WuScriptExecutor] ⚠️ Potentially dangerous code detected`);
-        // No bloquear, solo advertir
+      if (text && text.trim()) {
+        this.execute(text, appName, proxy, {
+          ...options,
+          sourceUrl: script.src || options.sourceUrl || ''
+        });
       }
     }
 
-    return true;
-  }
-
-  /**
-   * Obtener estadísticas del executor
-   */
-  getStats() {
-    return {
-      executor: 'WuScriptExecutor',
-      capabilities: ['function', 'eval', 'auto'],
-      defaultStrategy: 'function',
-      validation: true
-    };
+    logger.wuDebug(`[ScriptExecutor] Executed ${scripts.length} scripts for ${appName}`);
   }
 }
-
-/**
- * 🎯 EXPORTS DE CONVENIENCIA
- */
-
-/**
- * Ejecutar script de forma segura
- */
-export function executeScript(script, appName, globalProxy, strategy = 'function') {
-  const executor = new WuScriptExecutor();
-  return executor.execute(script, appName, globalProxy, strategy);
-}
-
-/**
- * Ejecutar múltiples scripts
- */
-export async function executeScripts(scripts, appName, globalProxy, strategy = 'function') {
-  const executor = new WuScriptExecutor();
-  return await executor.executeMultiple(scripts, appName, globalProxy, strategy);
-}

package/src/core/wu-snapshot-sandbox.js

@@ -1,184 +1,227 @@
 /**
- * 🛡️ WU-SNAPSHOT-SANDBOX: JavaScript Isolation con Snapshots
- * Basado en video-code - Fallback para navegadores sin Proxy
+ * WU-SNAPSHOT-SANDBOX: JavaScript Isolation via Snapshots
+ * Fallback for browsers without Proxy support.
  *
- * Este sandbox toma "fotos" del estado de window antes de montar
- * y restaura el estado original al desmontar
+ * Takes a snapshot of window state before mount,
+ * restores original state on deactivate.
+ * Also tracks timers and event listeners for cleanup.
  */
 
+import { logger } from './wu-logger.js';
+
 export class WuSnapshotSandbox {
   constructor(appName) {
     this.appName = appName;
-    this.proxy = window; // En snapshot mode, proxy es window directamente
+    this.proxy = window;
     this.snapshot = new Map();
     this.modifiedKeys = new Set();
     this.active = false;
 
-    console.log(`[WuSnapshotSandbox] 📸 Creating snapshot sandbox for: ${appName}`);
+    // Side-effect tracking (same as ProxySandbox)
+    this._timers = new Set();
+    this._intervals = new Set();
+    this._rafs = new Set();
+    this._eventListeners = [];
+
+    // Window patching state
+    this._patched = false;
+    this._originals = null;
   }
 
   /**
-   * Activar sandbox - Captura snapshot del window
+   * Activate sandbox - capture window snapshot and start tracking.
    */
   activate() {
-    if (this.active) {
-      console.warn(`[WuSnapshotSandbox] Sandbox already active for ${this.appName}`);
-      return this.proxy;
-    }
-
-    console.log(`[WuSnapshotSandbox] 📸 Taking window snapshot for ${this.appName}...`);
+    if (this.active) return this.proxy;
 
-    // 📸 Capturar estado actual de window
     this.snapshot.clear();
     this.modifiedKeys.clear();
 
-    // Iterar sobre todas las propiedades de window
+    // Capture current window state
     for (const key in window) {
       try {
-        // Guardar el valor actual
         this.snapshot.set(key, window[key]);
-      } catch (error) {
-        // Algunas propiedades pueden ser inaccesibles
-        console.warn(`[WuSnapshotSandbox] ⚠️ Could not snapshot property: ${key}`);
+      } catch {
+        // Some properties may be inaccessible
       }
     }
 
     this.active = true;
-    console.log(`[WuSnapshotSandbox] ✅ Snapshot captured with ${this.snapshot.size} properties`);
-
+    logger.wuDebug(`[SnapshotSandbox] Activated for ${this.appName} (${this.snapshot.size} props)`);
     return this.proxy;
   }
 
   /**
-   * Desactivar sandbox - Restaura el snapshot original
+   * Deactivate sandbox - restore snapshot AND clean side effects.
    */
   deactivate() {
-    if (!this.active) {
-      console.warn(`[WuSnapshotSandbox] Sandbox not active for ${this.appName}`);
-      return;
+    if (!this.active) return;
+
+    // Unpatch window if patched
+    this.unpatchWindow();
+
+    // --- Clean tracked timers ---
+    for (const id of this._timers) {
+      try { clearTimeout(id); } catch {}
+    }
+    for (const id of this._intervals) {
+      try { clearInterval(id); } catch {}
     }
+    for (const id of this._rafs) {
+      try { cancelAnimationFrame(id); } catch {}
+    }
+
+    const timerCount = this._timers.size + this._intervals.size + this._rafs.size;
+    this._timers.clear();
+    this._intervals.clear();
+    this._rafs.clear();
 
-    console.log(`[WuSnapshotSandbox] 🔄 Restoring window snapshot for ${this.appName}...`);
+    // --- Clean tracked event listeners ---
+    const listenerCount = this._eventListeners.length;
+    for (const { target, event, handler, options } of this._eventListeners) {
+      try { target.removeEventListener(event, handler, options); } catch {}
+    }
+    this._eventListeners = [];
 
+    // --- Restore window snapshot ---
     let restoredCount = 0;
     let deletedCount = 0;
 
-    // 🔄 Detectar y restaurar cambios
     for (const key in window) {
       try {
         const currentValue = window[key];
         const originalValue = this.snapshot.get(key);
 
-        // Si la propiedad cambió, restaurarla
         if (currentValue !== originalValue) {
           if (this.snapshot.has(key)) {
             window[key] = originalValue;
             restoredCount++;
           } else {
-            // Nueva propiedad agregada por la app, eliminarla
             try {
               delete window[key];
               deletedCount++;
-            } catch (error) {
-              // Algunas propiedades no se pueden eliminar
-              console.warn(`[WuSnapshotSandbox] ⚠️ Could not delete: ${key}`);
-            }
+            } catch {}
           }
         }
-      } catch (error) {
-        console.warn(`[WuSnapshotSandbox] ⚠️ Could not restore property: ${key}`);
-      }
+      } catch {}
     }
 
-    // 🧹 Limpiar estado
     this.snapshot.clear();
     this.modifiedKeys.clear();
     this.active = false;
 
-    console.log(`[WuSnapshotSandbox] ✅ Snapshot restored - ${restoredCount} restored, ${deletedCount} deleted`);
+    if (timerCount > 0 || listenerCount > 0) {
+      logger.wuDebug(
+        `[SnapshotSandbox] ${this.appName} cleanup: ${timerCount} timers, ${listenerCount} listeners, ${restoredCount} restored, ${deletedCount} deleted`
+      );
+    }
+    logger.wuDebug(`[SnapshotSandbox] Deactivated for ${this.appName}`);
   }
 
-  /**
-   * Obtener el proxy (en este caso, window)
-   */
+  // ================================================================
+  // WINDOW PATCHING - same interface as ProxySandbox
+  // ================================================================
+
+  patchWindow() {
+    if (this._patched) return;
+
+    const self = this;
+
+    // Capture in local closure — survives unpatch safely
+    const originals = {
+      setTimeout: window.setTimeout,
+      clearTimeout: window.clearTimeout,
+      setInterval: window.setInterval,
+      clearInterval: window.clearInterval,
+      requestAnimationFrame: window.requestAnimationFrame,
+      cancelAnimationFrame: window.cancelAnimationFrame,
+      addEventListener: window.addEventListener,
+      removeEventListener: window.removeEventListener
+    };
+
+    this._originals = originals;
+
+    window.setTimeout = function(fn, delay, ...args) {
+      const id = originals.setTimeout.call(window, fn, delay, ...args);
+      if (self._patched) self._timers.add(id);
+      return id;
+    };
+    window.clearTimeout = function(id) {
+      self._timers.delete(id);
+      return originals.clearTimeout.call(window, id);
+    };
+    window.setInterval = function(fn, delay, ...args) {
+      const id = originals.setInterval.call(window, fn, delay, ...args);
+      if (self._patched) self._intervals.add(id);
+      return id;
+    };
+    window.clearInterval = function(id) {
+      self._intervals.delete(id);
+      return originals.clearInterval.call(window, id);
+    };
+    window.requestAnimationFrame = function(fn) {
+      const id = originals.requestAnimationFrame.call(window, fn);
+      if (self._patched) self._rafs.add(id);
+      return id;
+    };
+    window.cancelAnimationFrame = function(id) {
+      self._rafs.delete(id);
+      return originals.cancelAnimationFrame.call(window, id);
+    };
+
+    window.addEventListener = function(event, handler, options) {
+      if (self._patched) self._eventListeners.push({ target: window, event, handler, options });
+      return originals.addEventListener.call(window, event, handler, options);
+    };
+    window.removeEventListener = function(event, handler, options) {
+      self._eventListeners = self._eventListeners.filter(
+        l => !(l.target === window && l.event === event && l.handler === handler)
+      );
+      return originals.removeEventListener.call(window, event, handler, options);
+    };
+
+    this._patched = true;
+    logger.wuDebug(`[SnapshotSandbox] Window patched for ${this.appName}`);
+  }
+
+  unpatchWindow() {
+    if (!this._patched || !this._originals) return;
+
+    window.setTimeout = this._originals.setTimeout;
+    window.clearTimeout = this._originals.clearTimeout;
+    window.setInterval = this._originals.setInterval;
+    window.clearInterval = this._originals.clearInterval;
+    window.requestAnimationFrame = this._originals.requestAnimationFrame;
+    window.cancelAnimationFrame = this._originals.cancelAnimationFrame;
+    window.addEventListener = this._originals.addEventListener;
+    window.removeEventListener = this._originals.removeEventListener;
+
+    this._patched = false;
+    logger.wuDebug(`[SnapshotSandbox] Window unpatched for ${this.appName}`);
+  }
+
+  // ================================================================
+  // UTILITIES
+  // ================================================================
+
   getProxy() {
     return this.active ? this.proxy : null;
   }
 
-  /**
-   * Verificar si el sandbox está activo
-   */
   isActive() {
     return this.active;
   }
 
-  /**
-   * Obtener estadísticas del sandbox
-   */
   getStats() {
-    const modifiedProps = [];
-
-    if (this.active) {
-      // Detectar qué propiedades han cambiado
-      for (const key in window) {
-        try {
-          const currentValue = window[key];
-          const originalValue = this.snapshot.get(key);
-
-          if (currentValue !== originalValue) {
-            modifiedProps.push(key);
-          }
-        } catch (error) {
-          // Ignorar errores de acceso
-        }
-      }
-    }
-
     return {
       appName: this.appName,
       active: this.active,
+      patched: this._patched,
       snapshotSize: this.snapshot.size,
-      modifiedProperties: modifiedProps,
-      modifiedCount: modifiedProps.length
+      trackedTimers: this._timers.size,
+      trackedIntervals: this._intervals.size,
+      trackedRAFs: this._rafs.size,
+      trackedEventListeners: this._eventListeners.length
     };
   }
-
-  /**
-   * Verificar si una propiedad fue modificada
-   */
-  isPropertyModified(prop) {
-    if (!this.active) return false;
-
-    try {
-      const currentValue = window[prop];
-      const originalValue = this.snapshot.get(prop);
-      return currentValue !== originalValue;
-    } catch {
-      return false;
-    }
-  }
-
-  /**
-   * Obtener todas las propiedades modificadas
-   */
-  getModifiedProperties() {
-    const modified = {};
-
-    if (this.active) {
-      for (const key in window) {
-        try {
-          if (this.isPropertyModified(key)) {
-            modified[key] = {
-              original: this.snapshot.get(key),
-              current: window[key]
-            };
-          }
-        } catch (error) {
-          // Ignorar errores de acceso
-        }
-      }
-    }
-
-    return modified;
-  }
 }

package/src/core/wu-strategies.js

@@ -75,6 +75,19 @@ export class WuLoadingStrategy {
       }
     });
 
+    // Speculate: Uses Speculation Rules API (Chrome 121+) with fallbacks
+    this.register('speculate', {
+      shouldPreload: true,
+      priority: 'medium',
+      load: async (appName, config) => {
+        if (this.core.prefetcher) {
+          await this.core.prefetcher.prefetch(appName, {
+            eagerness: config.eagerness || 'moderate'
+          });
+        }
+      }
+    });
+
     // Idle: Carga cuando el navegador está idle
     this.register('idle', {
       shouldPreload: false,

package/src/core/wu-style-bridge.js

@@ -30,7 +30,6 @@
 
 export class WuStyleBridge {
   constructor() {
-    this.sharedStyles = new Map();
     this.styleObserver = null;
     this.fullyIsolatedApps = new Map(); // Mapa de appName -> appUrl para apps con fully-isolated
     this.config = {
@@ -454,7 +453,6 @@ export class WuStyleBridge {
       this.styleObserver = null;
     }
 
-    this.sharedStyles.clear();
     console.log('[WuStyleBridge] 🧹 StyleBridge cleaned up');
   }