Files
orca/config/scripts/static-module-specifiers.mjs
T
Brennan Benson fa4ef2b961 ci: stop new main-process code from freezing Orca with synchronous launches (#27756)
* ci: ratchet synchronous child-process launches in main and shared code

The Electron main process freezes every window while a synchronous child
process runs, and on Windows each launch is slow because antivirus scans
it. Nothing stopped new synchronous launches from landing in main-process
code, and the spawn observer behind ORCA_MAIN_THREAD_DIAGNOSTICS only saw
async spawns, so the worst blocks were invisible to it.

Ratchet: check:main-sync-spawn-ratchet parses production src/main and
src/shared files (test-only paths excluded) and fails when a file not in
config/main-sync-spawn-baseline.txt reaches execFileSync, spawnSync or
execSync from child_process, runProcessSync from @orca/process-host, or
one of the synchronous secure-file writers (they run icacls on Windows).
Named, aliased, namespace, default, require() and import() forms count.
A baseline entry whose file no longer launches synchronously fails as
stale, so the list can only shrink. It runs in lint and in the PR
static-analysis job next to the process-host import check.

Observer: runProcessSync now reports to the spawn observer, timing the
whole call (that is how long the thread was stuck) and reporting from a
finally so failing, throwing and timed-out children are counted too.

Runtime behavior is unchanged except that the diagnostics observer now
sees synchronous launches; with no observer registered the sync path
pays one extra branch.

* ci: count sync launches per file and gate the repo's sync wrappers

The sync-spawn ratchet only tracked which files launched synchronously, so a
file already on the list (wsl.ts, win32-utils.ts, git-exec-file.ts) could add
more launches unnoticed, and new callers of the repo's own synchronous
wrappers passed CI.

The baseline now stores a per-file count of uses, in the same format as the
focus-read ratchet: a rise or a new file fails, a lower or zero count fails
until `pnpm check:main-sync-spawn-ratchet --prune` lowers it, and --prune
never raises an entry. Every value reference to a gated function counts
(call, hand-off, alias and its uses, re-export); imports alone count nothing.

Gated wrappers: gitExecFileSync (and the git/runner re-export),
restrictWindowsPathSync, hardenSecurePath when called with sync: true,
grantDirAcl, getWslHome, listWslDistros, wslUncDirectoryExists,
isWslAvailable (and the wsl.ts re-export), isPwshAvailable. Their 18
current caller files join the baseline.

Failure messages now give advice per family: the async process-host API for
child-process launches, the async twin for wrappers, and for the secure
writers a note that no async secure writer exists yet, so the sync one stays
and must never become a plain write (that drops the Windows ACL hardening).

Also refresh two stale blockMs descriptions and drop a no-op line from the
spawn-observer "stays silent" test.

* ci: count hardenSecurePath unless visibly async, and tighten ratchet tests

hardenSecurePath was counted only when `{ sync: true }` was written inline,
so moving the options into a variable or a spread dropped the count and the
check then asked for a prune. It now counts every use except a call with no
options or a spread-free object literal whose `sync` is absent or false.

Also: resolve backslash paths in the importing file as well as the
specifier; still visit heritage and instantiation expressions
(`extends mixin(fn)`, `fn<T>`); state the reference-only counting limit;
and point the secure-writer advice at raising this file's baseline count.

Tests cover the hardenSecurePath shapes, the alias chains that need the
fixpoint loop, and a prune that must not raise a grown row.

* test(ci): pin the main sync-spawn ratchet background step

* fix: count secure hardening calls with spread arguments
2026-10-12 11:28:25 -07:00

259 lines
8.9 KiB
JavaScript

import ts from 'typescript-api'
const MODULE_BUILTINS = new Set(['module', 'node:module'])
const PROCESS_BUILTINS = new Set(['process', 'node:process'])
export function unwrap(node) {
while (
node &&
(ts.isParenthesizedExpression(node) ||
ts.isAsExpression(node) ||
ts.isSatisfiesExpression(node) ||
ts.isNonNullExpression(node) ||
ts.isTypeAssertionExpression(node) ||
ts.isAwaitExpression(node))
) {
node = node.expression
}
return node
}
function isNamed(node, name) {
return ts.isIdentifier(node) && node.text === name
}
export function literalString(node) {
node = unwrap(node)
return node && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
? node.text
: null
}
export function propertyName(node) {
if (ts.isPropertyAccessExpression(node)) {
return node.name.text
}
return ts.isElementAccessExpression(node) ? literalString(node.argumentExpression) : null
}
function collectBindings(source) {
const strings = new Map()
const declarations = []
const destructures = []
const imports = []
const modules = []
function visit(node, isConst = false) {
switch (node.kind) {
case ts.SyntaxKind.VariableDeclarationList:
for (const declaration of node.declarations) {
visit(declaration, (node.flags & ts.NodeFlags.Const) !== 0)
}
return
case ts.SyntaxKind.VariableDeclaration: {
if (!node.initializer) {
break
}
const initializer = unwrap(node.initializer)
if (ts.isIdentifier(node.name)) {
declarations.push({ name: node.name.text, initializer })
const value = literalString(initializer)
if (isConst && value !== null) {
strings.set(node.name.text, [...(strings.get(node.name.text) ?? []), value])
}
} else if (ts.isObjectBindingPattern(node.name)) {
for (const element of node.name.elements) {
const key = element.propertyName ?? element.name
const name = ts.isIdentifier(key) ? key.text : literalString(key)
if (ts.isIdentifier(element.name) && name !== null) {
destructures.push({ name: element.name.text, key: name, initializer })
}
}
}
break
}
case ts.SyntaxKind.ImportDeclaration:
if (ts.isStringLiteral(node.moduleSpecifier)) {
imports.push({ module: node.moduleSpecifier.text, clause: node.importClause })
}
modules.push(node)
break
case ts.SyntaxKind.ImportEqualsDeclaration:
if (
ts.isExternalModuleReference(node.moduleReference) &&
ts.isStringLiteral(node.moduleReference.expression)
) {
imports.push({ module: node.moduleReference.expression.text, namespace: node.name })
}
modules.push(node)
break
case ts.SyntaxKind.ExportDeclaration:
case ts.SyntaxKind.ImportType:
case ts.SyntaxKind.CallExpression:
modules.push(node)
break
}
ts.forEachChild(node, visit)
}
visit(source)
return { strings, declarations, destructures, imports, modules }
}
/**
* Specifiers a file statically loads: imports, re-exports, `import()`, `require`/`require.resolve`,
* `module.require`, `createRequire(...)` loaders and their aliases, and `process.getBuiltinModule`.
* A specifier argument may be a literal or a file-level `const` string. Name bindings are
* file-wide, not scope-aware. Literal property keys are resolved; computed key values are not.
* Computed specifiers (concatenation, templates with substitutions, parameters, values imported
* from other files), loaders stored in objects or passed as arguments, and `eval`/`Function`
* are not resolved.
*/
export function collectModuleSpecifiers(file, contents) {
const source = ts.createSourceFile(file, contents, ts.ScriptTarget.Latest, false)
if (source.parseDiagnostics.length > 0) {
throw new Error(`Cannot parse ${file}; the process-host import check must not skip it.`)
}
const { strings, declarations, destructures, imports, modules } = collectBindings(source)
const loaders = new Set(['require'])
const createRequires = new Set()
const moduleNamespaces = new Set()
const processes = new Set(['process'])
const builtinLoaders = new Set()
function specifierValues(node) {
node = unwrap(node)
const value = literalString(node)
if (value !== null) {
return [value]
}
return node && ts.isIdentifier(node) ? (strings.get(node.text) ?? []) : []
}
function isProcess(node) {
node = unwrap(node)
return (
(ts.isIdentifier(node) && processes.has(node.text)) ||
(propertyName(node) === 'process' && isNamed(node.expression, 'globalThis')) ||
loadsAny(node, PROCESS_BUILTINS)
)
}
function isBuiltinLoader(node) {
node = unwrap(node)
return (
(ts.isIdentifier(node) && builtinLoaders.has(node.text)) ||
(propertyName(node) === 'getBuiltinModule' && isProcess(node.expression))
)
}
function isCreateRequire(node) {
node = unwrap(node)
return (
(ts.isIdentifier(node) && createRequires.has(node.text)) ||
(propertyName(node) === 'createRequire' && isModuleNamespace(node.expression))
)
}
function isLoader(node) {
node = unwrap(node)
return (
(ts.isIdentifier(node) && loaders.has(node.text)) ||
(propertyName(node) === 'require' && isNamed(node.expression, 'module')) ||
(ts.isCallExpression(node) && isCreateRequire(node.expression))
)
}
function loadsAny(node, specifiers) {
return (
ts.isCallExpression(node) &&
(node.expression.kind === ts.SyntaxKind.ImportKeyword ||
isLoader(node.expression) ||
isBuiltinLoader(node.expression)) &&
specifierValues(node.arguments[0]).some((specifier) => specifiers.has(specifier))
)
}
function isModuleNamespace(node) {
node = unwrap(node)
return (
(ts.isIdentifier(node) && moduleNamespaces.has(node.text)) || loadsAny(node, MODULE_BUILTINS)
)
}
for (const { module, clause, namespace } of imports) {
const named = clause?.namedBindings
const local = [
namespace,
clause?.name,
named && ts.isNamespaceImport(named) ? named.name : null
]
for (const name of local.filter(Boolean)) {
if (MODULE_BUILTINS.has(module)) {
moduleNamespaces.add(name.text)
}
if (PROCESS_BUILTINS.has(module)) {
processes.add(name.text)
}
}
for (const element of named && ts.isNamedImports(named) ? named.elements : []) {
const imported = (element.propertyName ?? element.name).text
if (MODULE_BUILTINS.has(module) && (imported === 'default' || imported === 'Module')) {
moduleNamespaces.add(element.name.text)
}
if (PROCESS_BUILTINS.has(module) && imported === 'default') {
processes.add(element.name.text)
}
if (MODULE_BUILTINS.has(module) && imported === 'createRequire') {
createRequires.add(element.name.text)
}
if (PROCESS_BUILTINS.has(module) && imported === 'getBuiltinModule') {
builtinLoaders.add(element.name.text)
}
}
}
// Aliases can chain (`const m = require('module'); const r = m.createRequire(x)`).
for (let changed = true; changed;) {
changed = false
const bind = (set, name, matches) => {
if (matches && !set.has(name)) {
set.add(name)
changed = true
}
}
for (const { name, initializer } of declarations) {
bind(loaders, name, isLoader(initializer))
bind(createRequires, name, isCreateRequire(initializer))
bind(moduleNamespaces, name, isModuleNamespace(initializer))
bind(processes, name, isProcess(initializer))
bind(builtinLoaders, name, isBuiltinLoader(initializer))
}
for (const { name, key, initializer } of destructures) {
bind(createRequires, name, key === 'createRequire' && isModuleNamespace(initializer))
bind(builtinLoaders, name, key === 'getBuiltinModule' && isProcess(initializer))
}
}
const specifiers = new Set()
function add(node) {
for (const specifier of specifierValues(node)) {
specifiers.add(specifier)
}
}
for (const node of modules) {
if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
add(node.moduleSpecifier)
} else if (
ts.isImportEqualsDeclaration(node) &&
ts.isExternalModuleReference(node.moduleReference)
) {
add(node.moduleReference.expression)
} else if (ts.isImportTypeNode(node) && ts.isLiteralTypeNode(node.argument)) {
add(node.argument.literal)
} else if (ts.isCallExpression(node)) {
const callee = unwrap(node.expression)
if (
callee.kind === ts.SyntaxKind.ImportKeyword ||
isLoader(callee) ||
isBuiltinLoader(callee) ||
(propertyName(callee) === 'resolve' && isLoader(callee.expression))
) {
add(node.arguments[0])
}
}
}
return [...specifiers]
}