mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
* ci: ratchet synchronous child-process launches in main and shared code
The Electron main process freezes every window while a synchronous child
process runs, and on Windows each launch is slow because antivirus scans
it. Nothing stopped new synchronous launches from landing in main-process
code, and the spawn observer behind ORCA_MAIN_THREAD_DIAGNOSTICS only saw
async spawns, so the worst blocks were invisible to it.
Ratchet: check:main-sync-spawn-ratchet parses production src/main and
src/shared files (test-only paths excluded) and fails when a file not in
config/main-sync-spawn-baseline.txt reaches execFileSync, spawnSync or
execSync from child_process, runProcessSync from @orca/process-host, or
one of the synchronous secure-file writers (they run icacls on Windows).
Named, aliased, namespace, default, require() and import() forms count.
A baseline entry whose file no longer launches synchronously fails as
stale, so the list can only shrink. It runs in lint and in the PR
static-analysis job next to the process-host import check.
Observer: runProcessSync now reports to the spawn observer, timing the
whole call (that is how long the thread was stuck) and reporting from a
finally so failing, throwing and timed-out children are counted too.
Runtime behavior is unchanged except that the diagnostics observer now
sees synchronous launches; with no observer registered the sync path
pays one extra branch.
* ci: count sync launches per file and gate the repo's sync wrappers
The sync-spawn ratchet only tracked which files launched synchronously, so a
file already on the list (wsl.ts, win32-utils.ts, git-exec-file.ts) could add
more launches unnoticed, and new callers of the repo's own synchronous
wrappers passed CI.
The baseline now stores a per-file count of uses, in the same format as the
focus-read ratchet: a rise or a new file fails, a lower or zero count fails
until `pnpm check:main-sync-spawn-ratchet --prune` lowers it, and --prune
never raises an entry. Every value reference to a gated function counts
(call, hand-off, alias and its uses, re-export); imports alone count nothing.
Gated wrappers: gitExecFileSync (and the git/runner re-export),
restrictWindowsPathSync, hardenSecurePath when called with sync: true,
grantDirAcl, getWslHome, listWslDistros, wslUncDirectoryExists,
isWslAvailable (and the wsl.ts re-export), isPwshAvailable. Their 18
current caller files join the baseline.
Failure messages now give advice per family: the async process-host API for
child-process launches, the async twin for wrappers, and for the secure
writers a note that no async secure writer exists yet, so the sync one stays
and must never become a plain write (that drops the Windows ACL hardening).
Also refresh two stale blockMs descriptions and drop a no-op line from the
spawn-observer "stays silent" test.
* ci: count hardenSecurePath unless visibly async, and tighten ratchet tests
hardenSecurePath was counted only when `{ sync: true }` was written inline,
so moving the options into a variable or a spread dropped the count and the
check then asked for a prune. It now counts every use except a call with no
options or a spread-free object literal whose `sync` is absent or false.
Also: resolve backslash paths in the importing file as well as the
specifier; still visit heritage and instantiation expressions
(`extends mixin(fn)`, `fn<T>`); state the reference-only counting limit;
and point the secure-writer advice at raising this file's baseline count.
Tests cover the hardenSecurePath shapes, the alias chains that need the
fixpoint loop, and a prune that must not raise a grown row.
* test(ci): pin the main sync-spawn ratchet background step
* fix: count secure hardening calls with spread arguments
259 lines
8.9 KiB
JavaScript
259 lines
8.9 KiB
JavaScript
import ts from 'typescript-api'
|
|
|
|
const MODULE_BUILTINS = new Set(['module', 'node:module'])
|
|
const PROCESS_BUILTINS = new Set(['process', 'node:process'])
|
|
|
|
export function unwrap(node) {
|
|
while (
|
|
node &&
|
|
(ts.isParenthesizedExpression(node) ||
|
|
ts.isAsExpression(node) ||
|
|
ts.isSatisfiesExpression(node) ||
|
|
ts.isNonNullExpression(node) ||
|
|
ts.isTypeAssertionExpression(node) ||
|
|
ts.isAwaitExpression(node))
|
|
) {
|
|
node = node.expression
|
|
}
|
|
return node
|
|
}
|
|
|
|
function isNamed(node, name) {
|
|
return ts.isIdentifier(node) && node.text === name
|
|
}
|
|
|
|
export function literalString(node) {
|
|
node = unwrap(node)
|
|
return node && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
|
|
? node.text
|
|
: null
|
|
}
|
|
|
|
export function propertyName(node) {
|
|
if (ts.isPropertyAccessExpression(node)) {
|
|
return node.name.text
|
|
}
|
|
return ts.isElementAccessExpression(node) ? literalString(node.argumentExpression) : null
|
|
}
|
|
|
|
function collectBindings(source) {
|
|
const strings = new Map()
|
|
const declarations = []
|
|
const destructures = []
|
|
const imports = []
|
|
const modules = []
|
|
function visit(node, isConst = false) {
|
|
switch (node.kind) {
|
|
case ts.SyntaxKind.VariableDeclarationList:
|
|
for (const declaration of node.declarations) {
|
|
visit(declaration, (node.flags & ts.NodeFlags.Const) !== 0)
|
|
}
|
|
return
|
|
case ts.SyntaxKind.VariableDeclaration: {
|
|
if (!node.initializer) {
|
|
break
|
|
}
|
|
const initializer = unwrap(node.initializer)
|
|
if (ts.isIdentifier(node.name)) {
|
|
declarations.push({ name: node.name.text, initializer })
|
|
const value = literalString(initializer)
|
|
if (isConst && value !== null) {
|
|
strings.set(node.name.text, [...(strings.get(node.name.text) ?? []), value])
|
|
}
|
|
} else if (ts.isObjectBindingPattern(node.name)) {
|
|
for (const element of node.name.elements) {
|
|
const key = element.propertyName ?? element.name
|
|
const name = ts.isIdentifier(key) ? key.text : literalString(key)
|
|
if (ts.isIdentifier(element.name) && name !== null) {
|
|
destructures.push({ name: element.name.text, key: name, initializer })
|
|
}
|
|
}
|
|
}
|
|
break
|
|
}
|
|
case ts.SyntaxKind.ImportDeclaration:
|
|
if (ts.isStringLiteral(node.moduleSpecifier)) {
|
|
imports.push({ module: node.moduleSpecifier.text, clause: node.importClause })
|
|
}
|
|
modules.push(node)
|
|
break
|
|
case ts.SyntaxKind.ImportEqualsDeclaration:
|
|
if (
|
|
ts.isExternalModuleReference(node.moduleReference) &&
|
|
ts.isStringLiteral(node.moduleReference.expression)
|
|
) {
|
|
imports.push({ module: node.moduleReference.expression.text, namespace: node.name })
|
|
}
|
|
modules.push(node)
|
|
break
|
|
case ts.SyntaxKind.ExportDeclaration:
|
|
case ts.SyntaxKind.ImportType:
|
|
case ts.SyntaxKind.CallExpression:
|
|
modules.push(node)
|
|
break
|
|
}
|
|
ts.forEachChild(node, visit)
|
|
}
|
|
visit(source)
|
|
return { strings, declarations, destructures, imports, modules }
|
|
}
|
|
|
|
/**
|
|
* Specifiers a file statically loads: imports, re-exports, `import()`, `require`/`require.resolve`,
|
|
* `module.require`, `createRequire(...)` loaders and their aliases, and `process.getBuiltinModule`.
|
|
* A specifier argument may be a literal or a file-level `const` string. Name bindings are
|
|
* file-wide, not scope-aware. Literal property keys are resolved; computed key values are not.
|
|
* Computed specifiers (concatenation, templates with substitutions, parameters, values imported
|
|
* from other files), loaders stored in objects or passed as arguments, and `eval`/`Function`
|
|
* are not resolved.
|
|
*/
|
|
export function collectModuleSpecifiers(file, contents) {
|
|
const source = ts.createSourceFile(file, contents, ts.ScriptTarget.Latest, false)
|
|
if (source.parseDiagnostics.length > 0) {
|
|
throw new Error(`Cannot parse ${file}; the process-host import check must not skip it.`)
|
|
}
|
|
const { strings, declarations, destructures, imports, modules } = collectBindings(source)
|
|
const loaders = new Set(['require'])
|
|
const createRequires = new Set()
|
|
const moduleNamespaces = new Set()
|
|
const processes = new Set(['process'])
|
|
const builtinLoaders = new Set()
|
|
|
|
function specifierValues(node) {
|
|
node = unwrap(node)
|
|
const value = literalString(node)
|
|
if (value !== null) {
|
|
return [value]
|
|
}
|
|
return node && ts.isIdentifier(node) ? (strings.get(node.text) ?? []) : []
|
|
}
|
|
function isProcess(node) {
|
|
node = unwrap(node)
|
|
return (
|
|
(ts.isIdentifier(node) && processes.has(node.text)) ||
|
|
(propertyName(node) === 'process' && isNamed(node.expression, 'globalThis')) ||
|
|
loadsAny(node, PROCESS_BUILTINS)
|
|
)
|
|
}
|
|
function isBuiltinLoader(node) {
|
|
node = unwrap(node)
|
|
return (
|
|
(ts.isIdentifier(node) && builtinLoaders.has(node.text)) ||
|
|
(propertyName(node) === 'getBuiltinModule' && isProcess(node.expression))
|
|
)
|
|
}
|
|
function isCreateRequire(node) {
|
|
node = unwrap(node)
|
|
return (
|
|
(ts.isIdentifier(node) && createRequires.has(node.text)) ||
|
|
(propertyName(node) === 'createRequire' && isModuleNamespace(node.expression))
|
|
)
|
|
}
|
|
function isLoader(node) {
|
|
node = unwrap(node)
|
|
return (
|
|
(ts.isIdentifier(node) && loaders.has(node.text)) ||
|
|
(propertyName(node) === 'require' && isNamed(node.expression, 'module')) ||
|
|
(ts.isCallExpression(node) && isCreateRequire(node.expression))
|
|
)
|
|
}
|
|
function loadsAny(node, specifiers) {
|
|
return (
|
|
ts.isCallExpression(node) &&
|
|
(node.expression.kind === ts.SyntaxKind.ImportKeyword ||
|
|
isLoader(node.expression) ||
|
|
isBuiltinLoader(node.expression)) &&
|
|
specifierValues(node.arguments[0]).some((specifier) => specifiers.has(specifier))
|
|
)
|
|
}
|
|
function isModuleNamespace(node) {
|
|
node = unwrap(node)
|
|
return (
|
|
(ts.isIdentifier(node) && moduleNamespaces.has(node.text)) || loadsAny(node, MODULE_BUILTINS)
|
|
)
|
|
}
|
|
|
|
for (const { module, clause, namespace } of imports) {
|
|
const named = clause?.namedBindings
|
|
const local = [
|
|
namespace,
|
|
clause?.name,
|
|
named && ts.isNamespaceImport(named) ? named.name : null
|
|
]
|
|
for (const name of local.filter(Boolean)) {
|
|
if (MODULE_BUILTINS.has(module)) {
|
|
moduleNamespaces.add(name.text)
|
|
}
|
|
if (PROCESS_BUILTINS.has(module)) {
|
|
processes.add(name.text)
|
|
}
|
|
}
|
|
for (const element of named && ts.isNamedImports(named) ? named.elements : []) {
|
|
const imported = (element.propertyName ?? element.name).text
|
|
if (MODULE_BUILTINS.has(module) && (imported === 'default' || imported === 'Module')) {
|
|
moduleNamespaces.add(element.name.text)
|
|
}
|
|
if (PROCESS_BUILTINS.has(module) && imported === 'default') {
|
|
processes.add(element.name.text)
|
|
}
|
|
if (MODULE_BUILTINS.has(module) && imported === 'createRequire') {
|
|
createRequires.add(element.name.text)
|
|
}
|
|
if (PROCESS_BUILTINS.has(module) && imported === 'getBuiltinModule') {
|
|
builtinLoaders.add(element.name.text)
|
|
}
|
|
}
|
|
}
|
|
// Aliases can chain (`const m = require('module'); const r = m.createRequire(x)`).
|
|
for (let changed = true; changed;) {
|
|
changed = false
|
|
const bind = (set, name, matches) => {
|
|
if (matches && !set.has(name)) {
|
|
set.add(name)
|
|
changed = true
|
|
}
|
|
}
|
|
for (const { name, initializer } of declarations) {
|
|
bind(loaders, name, isLoader(initializer))
|
|
bind(createRequires, name, isCreateRequire(initializer))
|
|
bind(moduleNamespaces, name, isModuleNamespace(initializer))
|
|
bind(processes, name, isProcess(initializer))
|
|
bind(builtinLoaders, name, isBuiltinLoader(initializer))
|
|
}
|
|
for (const { name, key, initializer } of destructures) {
|
|
bind(createRequires, name, key === 'createRequire' && isModuleNamespace(initializer))
|
|
bind(builtinLoaders, name, key === 'getBuiltinModule' && isProcess(initializer))
|
|
}
|
|
}
|
|
|
|
const specifiers = new Set()
|
|
function add(node) {
|
|
for (const specifier of specifierValues(node)) {
|
|
specifiers.add(specifier)
|
|
}
|
|
}
|
|
for (const node of modules) {
|
|
if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
|
|
add(node.moduleSpecifier)
|
|
} else if (
|
|
ts.isImportEqualsDeclaration(node) &&
|
|
ts.isExternalModuleReference(node.moduleReference)
|
|
) {
|
|
add(node.moduleReference.expression)
|
|
} else if (ts.isImportTypeNode(node) && ts.isLiteralTypeNode(node.argument)) {
|
|
add(node.argument.literal)
|
|
} else if (ts.isCallExpression(node)) {
|
|
const callee = unwrap(node.expression)
|
|
if (
|
|
callee.kind === ts.SyntaxKind.ImportKeyword ||
|
|
isLoader(callee) ||
|
|
isBuiltinLoader(callee) ||
|
|
(propertyName(callee) === 'resolve' && isLoader(callee.expression))
|
|
) {
|
|
add(node.arguments[0])
|
|
}
|
|
}
|
|
}
|
|
return [...specifiers]
|
|
}
|