feat(flows): add execute-javascript step with isolated-vm sandbox - #802
Open
realcodesiman wants to merge 1 commit into
Open
feat(flows): add execute-javascript step with isolated-vm sandbox#802realcodesiman wants to merge 1 commit into
realcodesiman wants to merge 1 commit into
Conversation
Adds a new "Execute JavaScript" flow step that runs user-authored JavaScript in an isolated-vm sandbox (8MB memory limit, 500ms timeout, no Node/network globals) and maps the returned value into contact custom fields via JSON-path mappings. - packages/javascript-sandbox: pure executeJavascript() sandbox, single source of truth for the isolate/context lifecycle - packages/business: javascriptExecutionService wraps the sandbox with ChatbotXException mapping and executeAndMap() custom-field writes (bounded to 64KB per field) - packages/flow-config: executeJavascript step schema/defaults, registered in stepTypes, toolSteps, and the barrel export - apps/builder: editor/viewer/menu entry for the new step - apps/worker: flow step handler wired into flowStepHandlers, isolated-vm kept out of the tsdown bundle (native addon) Schema enforces max code length (10k chars) and max mapping count (20) to bound worst-case payload size.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
isolated-vm(8MB memory limit, 500ms timeout, no Node/network globals), with code length (10k chars) and mapping count (20) bounded at the schema and sandbox level.@chatbotx.io/javascript-sandboxpackage as the single source of truth;packages/businesswraps it withChatbotXExceptionmapping and the custom-field write path (bounded to 64KB per field).Changes
packages/javascript-sandbox(new): pureexecuteJavascript()sandbox — isolate/context lifecycle, timeout/memory error classification,MAX_CODE_LENGTHguard.packages/business/src/javascript-execution:javascriptExecutionService.execute()/.executeAndMap(), wraps sandbox errors asChatbotXException, writes mapped values viacontactCustomFieldService.packages/flow-config:executeJavascriptstep schema/defaults, registered instepTypes,toolSteps, and the package barrel.apps/builder: editor dialog (code textarea + JSON-path → custom-field mapping rows), viewer, and menu entry for the new step.apps/worker:handleExecuteJavascriptstep handler wired intoflowStepHandlers;isolated-vmkept out of the tsdown bundle (native addon) vianeverBundle.pnpm-workspace.yaml:isolated-vmadded toonlyBuiltDependencies.Test plan
pnpm --filter @chatbotx.io/javascript-sandbox test— 5/5 passingpnpm --filter @chatbotx.io/business test— 458/458 passingpnpm --filter @chatbotx.io/flow-config test— 132/132 passingpnpm --filter worker check-types— cleanpnpm lint— clean