291 lines
11 KiB
TypeScript
291 lines
11 KiB
TypeScript
|
import { parse } from "@babel/parser";
|
||
|
|
import { builtinModules } from "node:module";
|
||
|
|
import { ExecutionPlanError, hexDigest, type ExecutionPlan } from "./plan.js";
|
||
|
|
import type { ExecutionInstallation } from "./installation.js";
|
||
|
|
import type { ArtifactImplementation, ArtifactReader } from "./artifacts.js";
|
||
|
|
|
||
|
|
export interface PlacementBlocker {
|
||
|
|
readonly code: string;
|
||
|
|
readonly path: readonly string[];
|
||
|
|
readonly detail: string;
|
||
|
|
}
|
||
|
|
export interface PlacementEntry {
|
||
|
|
readonly operation: string;
|
||
|
|
readonly effect: string;
|
||
|
|
readonly availableTargets: readonly string[];
|
||
|
|
readonly requiresVM: boolean;
|
||
|
|
readonly nativeBindings: readonly string[];
|
||
|
|
readonly cycles: readonly (readonly string[])[];
|
||
|
|
readonly blockers: readonly PlacementBlocker[];
|
||
|
|
}
|
||
|
|
export interface ImportFinding {
|
||
|
|
readonly code: string;
|
||
|
|
readonly detail: string;
|
||
|
|
readonly line: number | null;
|
||
|
|
}
|
||
|
|
const nativeImports = new Set(builtinModules.flatMap((name) => [name, name.replace(/^node:/, "")]));
|
||
|
|
const ambient = new Set([
|
||
|
|
"process",
|
||
|
|
"global",
|
||
|
|
"globalThis",
|
||
|
|
"fetch",
|
||
|
|
"WebSocket",
|
||
|
|
"XMLHttpRequest",
|
||
|
|
"Deno",
|
||
|
|
"Bun",
|
||
|
|
"eval",
|
||
|
|
"Function",
|
||
|
|
"SharedArrayBuffer",
|
||
|
|
"Atomics",
|
||
|
|
]);
|
||
|
|
|
||
|
|
/** Diagnostic scan of compiled JavaScript, never a certificate of purity. A
|
||
|
|
* shadowed name can conservatively produce a finding; computed access/aliases
|
||
|
|
* cannot be proven safe here. No findings still require a qualified loader and
|
||
|
|
* runtime before this artifact can enter restricted execution. */
|
||
|
|
export function inspectJavaScriptSurface(source: string, checkedSDKImports: readonly string[] = []): ImportFinding[] {
|
||
|
|
if (Buffer.byteLength(source) > 1024 * 1024)
|
||
|
|
return [{ code: "ANALYSIS_LIMIT", detail: "JavaScript exceeds the 1 MiB inspection budget", line: null }];
|
||
|
|
let ast;
|
||
|
|
try {
|
||
|
|
ast = parse(source, { sourceType: "module", createImportExpressions: true });
|
||
|
|
} catch {
|
||
|
|
return [
|
||
|
|
{
|
||
|
|
code: "UNCLASSIFIED_SYNTAX",
|
||
|
|
detail: "Compiled source cannot be classified by the selected parser",
|
||
|
|
line: null,
|
||
|
|
},
|
||
|
|
];
|
||
|
|
}
|
||
|
|
const findings: ImportFinding[] = [],
|
||
|
|
seen = new Set<string>(),
|
||
|
|
sdk = new Set(checkedSDKImports);
|
||
|
|
const add = (code: string, detail: string, node: any) => {
|
||
|
|
const key = JSON.stringify([code, detail]);
|
||
|
|
if (seen.has(key)) return;
|
||
|
|
seen.add(key);
|
||
|
|
if (findings.length < 63) findings.push({ code, detail, line: node?.loc?.start.line ?? null });
|
||
|
|
};
|
||
|
|
const imported = (node: any, at: any) => {
|
||
|
|
if (node?.type !== "StringLiteral") {
|
||
|
|
add("COMPUTED_MODULE_LOADING", "Module name is computed", at);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
const name: string = node.value;
|
||
|
|
if (sdk.has(name)) return;
|
||
|
|
add(
|
||
|
|
name.startsWith("node:") || nativeImports.has(name) ? "NATIVE_IMPORT" : "UNCLASSIFIED_IMPORT",
|
||
|
|
name.slice(0, 256),
|
||
|
|
at,
|
||
|
|
);
|
||
|
|
};
|
||
|
|
const pending: { node: any; parent?: any; key?: string }[] = [{ node: ast }];
|
||
|
|
let visited = 0;
|
||
|
|
while (pending.length) {
|
||
|
|
if (++visited > 100000) {
|
||
|
|
add("ANALYSIS_LIMIT", "JavaScript exceeds the syntax-node inspection budget", null);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
const { node, parent, key } = pending.pop()!;
|
||
|
|
if (!node || typeof node !== "object") continue;
|
||
|
|
if (["ImportDeclaration", "ExportAllDeclaration", "ExportNamedDeclaration"].includes(node.type) && node.source)
|
||
|
|
imported(node.source, node);
|
||
|
|
if (node.type === "ImportExpression") imported(node.source, node);
|
||
|
|
if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require")
|
||
|
|
imported(node.arguments[0], node);
|
||
|
|
const propertyName = key === "property" && parent?.type === "MemberExpression" && !parent.computed;
|
||
|
|
const recordKey =
|
||
|
|
key === "key" &&
|
||
|
|
["ObjectProperty", "ObjectMethod"].includes(parent?.type) &&
|
||
|
|
!parent.computed &&
|
||
|
|
!parent.shorthand;
|
||
|
|
if (node.type === "Identifier" && ambient.has(node.name) && !propertyName && !recordKey)
|
||
|
|
add("AMBIENT_HOST_ACCESS", node.name, node);
|
||
|
|
if (
|
||
|
|
node.type === "MemberExpression" &&
|
||
|
|
node.object?.type === "Identifier" &&
|
||
|
|
node.object.name === "Math" &&
|
||
|
|
(node.computed || node.property?.name === "random")
|
||
|
|
)
|
||
|
|
add("AMBIENT_RANDOMNESS", "Use captured input or a frame-scoped seed", node);
|
||
|
|
if (
|
||
|
|
(node.type === "CallExpression" || node.type === "NewExpression") &&
|
||
|
|
node.callee?.type === "Identifier" &&
|
||
|
|
node.callee.name === "Date" &&
|
||
|
|
node.arguments.length === 0
|
||
|
|
)
|
||
|
|
add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
|
||
|
|
if (
|
||
|
|
node.type === "MemberExpression" &&
|
||
|
|
node.object?.type === "Identifier" &&
|
||
|
|
node.object.name === "Date" &&
|
||
|
|
(node.computed || node.property?.name === "now")
|
||
|
|
)
|
||
|
|
add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
|
||
|
|
for (const [childKey, child] of Object.entries(node)) {
|
||
|
|
if (["loc", "start", "end", "extra", "comments", "tokens"].includes(childKey)) continue;
|
||
|
|
if (Array.isArray(child)) {
|
||
|
|
for (const value of child)
|
||
|
|
if (value && typeof value === "object") pending.push({ node: value, parent: node, key: childKey });
|
||
|
|
} else if (child && typeof child === "object") pending.push({ node: child, parent: node, key: childKey });
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (seen.size > findings.length)
|
||
|
|
findings.push({ code: "ANALYSIS_LIMIT", detail: "Additional findings omitted", line: null });
|
||
|
|
return findings;
|
||
|
|
}
|
||
|
|
|
||
|
|
/** Derived metadata only. Browser/server portability and available targets say
|
||
|
|
* nothing about sandbox eligibility. No existing package artifact has a
|
||
|
|
* qualified restricted runtime, so it conservatively requires its VM. */
|
||
|
|
export async function reportExecutionPlacement(
|
||
|
|
plan: ExecutionPlan,
|
||
|
|
installation: ExecutionInstallation,
|
||
|
|
read: ArtifactReader,
|
||
|
|
) {
|
||
|
|
if (installation.plan !== plan.digest || hexDigest(plan.definition) !== plan.digest)
|
||
|
|
throw new ExecutionPlanError(
|
||
|
|
"PLACEMENT_PLAN_MISMATCH",
|
||
|
|
plan.digest,
|
||
|
|
"Expected the selected checked plan and installation",
|
||
|
|
);
|
||
|
|
const operations = new Map(plan.definition.operations.map((entry) => [entry.key, entry]));
|
||
|
|
const queries = new Map(plan.definition.queries.map((entry) => [entry.id, entry]));
|
||
|
|
const packages = await Promise.all(
|
||
|
|
installation.packages.map(async (pkg) => {
|
||
|
|
const implementations: { id: string; digest: string; compatibility: string; findings: ImportFinding[] }[] = [];
|
||
|
|
for (const implementation of [pkg.service, pkg.module].filter(
|
||
|
|
(entry): entry is ArtifactImplementation => !!entry,
|
||
|
|
)) {
|
||
|
|
let findings: ImportFinding[];
|
||
|
|
if (implementation.compatibility === "quixos-js-module-v1") {
|
||
|
|
const file = implementation.files.find((file) => file.path === implementation.path)!;
|
||
|
|
if (!file || file.bytes > 1024 * 1024)
|
||
|
|
findings = [
|
||
|
|
{ code: "ANALYSIS_LIMIT", detail: "Entry source unavailable within the inspection budget", line: null },
|
||
|
|
];
|
||
|
|
else {
|
||
|
|
const sdk = implementation.files.filter((file) => file.path.endsWith("/core.mjs"));
|
||
|
|
const allowed = sdk.flatMap((file) => [
|
||
|
|
`${pkg.root}/${file.path}`,
|
||
|
|
`/__quixos/artifacts/content/${file.digest}/core.mjs`,
|
||
|
|
]);
|
||
|
|
findings = inspectJavaScriptSurface(
|
||
|
|
Buffer.from(await read(pkg.revision, file.path, file.bytes)).toString("utf8"),
|
||
|
|
allowed,
|
||
|
|
);
|
||
|
|
}
|
||
|
|
} else
|
||
|
|
findings = [
|
||
|
|
{ code: "NATIVE_SERVICE", detail: "Native/persistent service stays in VM execution", line: null },
|
||
|
|
];
|
||
|
|
implementations.push({
|
||
|
|
id: implementation.id,
|
||
|
|
digest: implementation.contentDigest,
|
||
|
|
compatibility: implementation.compatibility,
|
||
|
|
findings,
|
||
|
|
});
|
||
|
|
}
|
||
|
|
return {
|
||
|
|
revision: pkg.revision,
|
||
|
|
requiresVM: implementations.length > 0,
|
||
|
|
restrictedEligible: false as const,
|
||
|
|
reason: "NO_QUALIFIED_RESTRICTED_RUNTIME",
|
||
|
|
implementations,
|
||
|
|
};
|
||
|
|
}),
|
||
|
|
);
|
||
|
|
const entries: PlacementEntry[] = plan.definition.operations.map((root) => {
|
||
|
|
const native = new Set<string>(),
|
||
|
|
visited = new Set<string>(),
|
||
|
|
cycles: string[][] = [],
|
||
|
|
blockers: PlacementBlocker[] = [];
|
||
|
|
const pending = [{ key: root.key, path: [root.key] }];
|
||
|
|
let limited = false;
|
||
|
|
const block = (code: string, path: string[], detail: string) => {
|
||
|
|
if (blockers.length < 63) blockers.push({ code, path, detail });
|
||
|
|
else limited = true;
|
||
|
|
};
|
||
|
|
while (pending.length) {
|
||
|
|
if (visited.size >= 512) {
|
||
|
|
limited = true;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
const { key, path } = pending.pop()!;
|
||
|
|
const repeated = path.slice(0, -1).indexOf(key);
|
||
|
|
if (repeated >= 0) {
|
||
|
|
if (cycles.length < 16) cycles.push(path.slice(repeated));
|
||
|
|
else limited = true;
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
if (visited.has(key)) continue;
|
||
|
|
if (path.length > 128) {
|
||
|
|
limited = true;
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
visited.add(key);
|
||
|
|
const node = operations.get(key);
|
||
|
|
if (!node) {
|
||
|
|
block("UNCLASSIFIED_DEPENDENCY", path, "Operation is absent from the checked closure");
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
if (node.execution.kind === "remote")
|
||
|
|
block("REMOTE_EFFECT", path, "Remote effects require VM or separately approved effect authority");
|
||
|
|
if (node.binding.kind === "package")
|
||
|
|
block(
|
||
|
|
"UNQUALIFIED_PACKAGE",
|
||
|
|
path,
|
||
|
|
`${node.binding.packageRevisionId}/${node.binding.exportId}: no qualified restricted implementation`,
|
||
|
|
);
|
||
|
|
else if (["state", "edge", "journal", "subscription", "lifecycle"].includes(node.binding.kind))
|
||
|
|
native.add(node.binding.kind);
|
||
|
|
else block("UNCLASSIFIED_NATIVE", path, node.binding.kind);
|
||
|
|
for (const dependency of node.dependencies) {
|
||
|
|
if (dependency.kind === "operation")
|
||
|
|
pending.push({ key: dependency.operation, path: [...path, dependency.port, dependency.operation] });
|
||
|
|
if (dependency.kind === "query") {
|
||
|
|
const query = queries.get(dependency.query);
|
||
|
|
if (!query) block("UNCLASSIFIED_QUERY", [...path, dependency.port], dependency.query);
|
||
|
|
else
|
||
|
|
for (const operation of new Set([...query.operations, ...query.admittedOperations]))
|
||
|
|
pending.push({ key: operation, path: [...path, dependency.port, dependency.query, operation] });
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (limited)
|
||
|
|
blockers.push({
|
||
|
|
code: "ANALYSIS_LIMIT",
|
||
|
|
path: [root.key],
|
||
|
|
detail: "Dependency closure exceeds the bounded report; keep VM placement",
|
||
|
|
});
|
||
|
|
return {
|
||
|
|
operation: root.key,
|
||
|
|
effect: root.execution.kind,
|
||
|
|
availableTargets: [...root.availableTargets],
|
||
|
|
requiresVM: blockers.length > 0,
|
||
|
|
nativeBindings: [...native].sort(),
|
||
|
|
cycles,
|
||
|
|
blockers,
|
||
|
|
};
|
||
|
|
});
|
||
|
|
const background = plan.definition.packages.flatMap((pkg) =>
|
||
|
|
(pkg.controllers ?? []).map((controller) => ({
|
||
|
|
package: pkg.revision,
|
||
|
|
id: controller.id,
|
||
|
|
requiresVM: true,
|
||
|
|
reason: "PERSISTENT_CONTROLLER_EXECUTION",
|
||
|
|
})),
|
||
|
|
);
|
||
|
|
return {
|
||
|
|
codec: "quixos-execution-placement-v1" as const,
|
||
|
|
workspace: plan.definition.workspace.workspaceId,
|
||
|
|
plan: plan.digest,
|
||
|
|
requiresVM:
|
||
|
|
packages.some((pkg) => pkg.requiresVM) || entries.some((entry) => entry.requiresVM) || background.length > 0,
|
||
|
|
operations: entries,
|
||
|
|
packages,
|
||
|
|
background,
|
||
|
|
};
|
||
|
|
}
|