UNPKG

@sema-agent/core

Version:

Stateless, task-oriented AI agent core

github.com/sema-agent/sema-core

sema-agent/sema-core

43 lines (42 loc) • 3.1 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
/** * design/98 §2.3 (S8b) — the reusable CONFORMANCE CONTRACT a HARD {@link WorkflowScriptRunner} * (`safeForUntrustedScripts:true`) MUST pass. Core ships the contract (zero deps beyond `node:assert`); a * deployment's isolated-vm / separate-process runner imports it and runs it in its OWN test suite to prove * its membrane does not leak. It runs a battery of sandbox-escape scripts against the runner and asserts each * FAILS to reach a host capability (`process` / `require` / a host `Function`). * * The dev `vm` runner deliberately does NOT pass this (it is not a boundary) — see * `test/workflow-vm-escape.test.ts`, which PROVES that and asserts `safeForUntrustedScripts === false`. */ import type { WorkflowScriptRunner } from "./workflow-script-runner.js"; /** * Assert a HARD runner passes the sandbox-escape battery. Throws an `AssertionError` on the first escape that * reaches a host capability. * * Structure, in the order it must hold: * 1. a POSITIVE CONTROL ({@link runLivenessCanary}) — the runner executes a body, sees `scriptArgs`, and * returns the value. Without this the battery is vacuous. * 2. four probe families, each judging the MARSHALLED result. The capability families return an in-isolate * WITNESS ({@link WITNESS_PRELUDE}) rather than the capability object, so a leak whose value cannot cross * the marshalling boundary is no longer swallowed as "blocked". * 3. a probe that THROWS is re-tested for liveness before its throw is read as "blocked" * ({@link runProbeBody}) — the two meanings of a throw are separated by evidence, not by assumption. */ /** * The PRIMITIVES-WIRING battery. A production incident was a hard runner whose * injection table wired only `agent` (+ return): `phase`/`log` were silently absent in the isolate, so whole * runs recorded `phases: []` with no error anywhere. Sandbox tightness alone doesn't catch that — a runner can * be perfectly escape-proof AND miss half the API. This battery proves EVERY {@link WorkflowPrimitives} member * is present in-isolate, callable, and actually bridged back to the HOST primitives (recorded on the host * side, not just observed in-script). Run it in the same suite as the escape battery. */ export declare function assertWorkflowPrimitivesWiring(runner: WorkflowScriptRunner): Promise<void>; export declare function assertWorkflowSandboxConformance(runner: WorkflowScriptRunner): Promise<void>; /** * PARITY-SPOT-WORKFLOW B2/F3 (CC `S0m` parity) — assert a runner ENFORCES determinism: Date.now() / * Math.random() / argless new Date() throw (a clock/randomness read silently busts the resume prefix cache), * while DATED construction (`new Date(0)`) stays available. SEPARATE from the sandbox/wiring batteries — those * accept a minimal stub runner (they test the assertion's own leak/bridge logic); determinism requires a * runner that actually executes the body against shimmed intrinsics (the dev vm runner + any hard runner). */ export declare function assertWorkflowDeterminism(runner: WorkflowScriptRunner): Promise<void>;