feat(runtime): add sandboxed JavaScript execution with QuickJS (#1088)

* feat(runtime): add sandboxed JavaScript execution with QuickJS

* fix(runtime): merge sync and resolved promise handling logic

* fix(runtime): move param serialization before WASM allocation and wrap promise handling in try-finally

* fix(runtime): switch test environment from jsdom to node

Author: louisyoungx

common/config/rush/pnpm-lock.yaml

@@ -33,6 +33,7 @@
     "@langchain/openai": "0.5.18",
     "@langchain/core": "^0.3.58",
     "lodash-es": "^4.17.21",
+    "quickjs-emscripten": "^0.32.0",
     "uuid": "^9.0.0",
     "zod": "^3.24.4"
   },

packages/runtime/js-core/package.json

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: MIT
  */
 
+import { getQuickJS, shouldInterruptAfterDeadline } from 'quickjs-emscripten';
 import {
   CodeNodeSchema,
   ExecutionContext,
@@ -48,47 +49,74 @@ export class CodeExecutor implements INodeExecutor {
   }
 
   private async javascript(inputs: CodeExecutorInputs): Promise<ExecutionResult> {
-    // Extract script content and inputs
     const { params = {}, script } = inputs;
 
+    // Serialize before allocating WASM resources – fails fast on circular references.
+    const serializedParams = JSON.stringify(params);
+
+    const QuickJS = await getQuickJS();
+
+    // Each execution gets an isolated context; no host globals are exposed by default.
+    const context = QuickJS.newContext();
     try {
-      // Create a safe execution environment with basic restrictions
-      const executeCode = new Function(
-        'params',
-        `
-        'use strict';
+      // Apply resource limits on the underlying runtime.
+      const runtime = context.runtime;
+      runtime.setMemoryLimit(32 * 1024 * 1024); // 32 MB
+      runtime.setMaxStackSize(512 * 1024); // 512 KB
+      // Interrupt execution if it runs longer than 1 minute.
+      runtime.setInterruptHandler(shouldInterruptAfterDeadline(Date.now() + 60_000));
 
-        ${script.content}
+      // Wrap user code: define main, inject params, call main, return result.
+      const wrappedCode = `
+'use strict';
 
-        // Ensure main function exists
-        if (typeof main !== 'function') {
-          throw new Error('main function is required in the script');
-        }
+${script.content}
 
-        // Execute main function with params
-        return main({ params });
-        `
-      );
+if (typeof main !== 'function') {
+  throw new Error('main function is required in the script');
+}
 
-      // Execute with timeout protection (1 minute)
-      const timeoutPromise = new Promise<never>((_, reject) => {
-        setTimeout(() => {
-          reject(new Error('Code execution timeout: exceeded 1 minute'));
-        }, 1000 * 60);
-      });
+const __params__ = ${serializedParams};
+main({ params: __params__ });
+`;
 
-      // Execute the code with input parameters and timeout
-      const result = await Promise.race([executeCode(params), timeoutPromise]);
+      const evalResult = context.evalCode(wrappedCode);
+      const resultHandle = context.unwrapResult(evalResult);
+
+      let rawResult: unknown;
+
+      try {
+        const promiseState = context.getPromiseState(resultHandle);
+        if (promiseState.type === 'fulfilled') {
+          rawResult = context.dump(promiseState.value);
+          promiseState.value.dispose();
+        } else if (promiseState.type === 'rejected') {
+          const errMsg = context.dump(promiseState.error);
+          promiseState.error.dispose();
+          throw new Error(typeof errMsg === 'string' ? errMsg : JSON.stringify(errMsg));
+        } else {
+          // Pending promise: resolve asynchronously via the QuickJS event loop.
+          const resolvedResult = await context.resolvePromise(resultHandle);
+          const resolvedHandle = context.unwrapResult(resolvedResult);
+          rawResult = context.dump(resolvedHandle);
+          resolvedHandle.dispose();
+        }
+      } finally {
+        resultHandle.dispose();
+      }
 
-      // Ensure result is an object
+      // Ensure result is a plain object.
       const outputs =
-        result && typeof result === 'object' && !Array.isArray(result) ? result : { result };
+        rawResult && typeof rawResult === 'object' && !Array.isArray(rawResult)
+          ? (rawResult as Record<string, unknown>)
+          : { result: rawResult };
 
-      return {
-        outputs,
-      };
+      return { outputs };
     } catch (error: any) {
       throw new Error(`Code execution failed: ${error.message}`);
+    } finally {
+      // Always release WASM memory for this execution context.
+      context.dispose();
     }
   }
 }

packages/runtime/js-core/src/nodes/code/index.ts

@@ -24,7 +24,7 @@ export default defineConfig({
   test: {
     globals: true,
     mockReset: false,
-    environment: 'jsdom',
+    environment: 'node',
     testTimeout: 15000,
     setupFiles: [path.resolve(__dirname, './src/domain/__tests__/setup.ts')],
     include: ['**/?(*.){test,spec}.?(c|m)[jt]s?(x)'],