代码执行沙箱设计：安全边界、超时熔断与虚拟文件系统隔离

// 经典原型链沙箱逃逸演示（切勿在生产环境裸跑 vm.runInNewContext）：
// const ForeignFunction = this.constructor.constructor
// const hostProcess = ForeignFunction('return process')()

// 1. 静态安全扫描器：拦截原型链逃逸与宿主环境访问关键字
const FORBIDDEN_PATTERNS = [
  { pattern: /\b(process|require|globalThis|global|Function|eval)\b/, reason: '禁止访问宿主全局对象或动态构造器' },
  { pattern: /\b(__proto__|prototype|constructor)\b/, reason: '禁止访问原型链属性（防御沙箱逃逸）' },
  { pattern: /\bimport\s*\(/, reason: '禁止动态加载外部模块' }
]

export function validateSandboxCode(code) {
  const src = String(code || '')
  for (const rule of FORBIDDEN_PATTERNS) {
    const match = rule.pattern.exec(src)
    if (match) {
      return { safe: false, reason: `${rule.reason}（命中关键字: "${match[0]}"）` }
    }
  }
  return { safe: true }
}

// 2. 带虚拟文件系统（VFS）与输出限额的受控执行环境
export function createVirtualFs(initialFiles = {}) {
  const store = new Map(Object.entries(initialFiles))
  return Object.freeze({
    readFile(path) {
      if (!store.has(path)) throw new Error(`VFS 文件不存在: ${path}`)
      return store.get(path)
    },
    writeFile(path, content) {
      if (store.size >= 50 && !store.has(path)) throw new Error('超出虚拟文件系统最大文件数限制 (50)')
      const str = String(content)
      if (str.length > 100_000) throw new Error('单文件体积超出 100KB 限制')
      store.set(path, str)
      return { writtenBytes: str.length }
    },
    listFiles() {
      return [...store.keys()]
    }
  })
}

// 3. 沙箱工具封装：捕获日志、限制输出体积并返回结构化执行结果
export async function executeInSandbox(code, { vfs, maxOutputChars = 4096 } = {}) {
  const check = validateSandboxCode(code)
  if (!check.safe) {
    return { ok: false, error: `安全门禁拦截：${check.reason}`, logs: [] }
  }

  const logs = []
  let totalChars = 0
  const appendLog = (level, args) => {
    const line = `[${level}] ` + args.map((a) => (typeof a === 'object' ? JSON.stringify(a) : String(a))).join(' ')
    if (totalChars + line.length <= maxOutputChars) {
      logs.push(line)
      totalChars += line.length
    } else if (!logs.at(-1)?.startsWith('[TRUNCATED]')) {
      logs.push('[TRUNCATED] 输出日志超过 4KB 配额，后续输出已截断')
    }
  }

  const safeConsole = Object.freeze({
    log: (...args) => appendLog('LOG', args),
    warn: (...args) => appendLog('WARN', args),
    error: (...args) => appendLog('ERROR', args)
  })

  try {
    // 注入受控的 console 与 vfs，屏蔽外部作用域
    const runner = new AsyncFunction('console', 'vfs', `"use strict";\n${code}`)
    const returnValue = await runner(safeConsole, vfs)
    return { ok: true, returnValue, logs }
  } catch (err) {
    return { ok: false, error: `${err.name}: ${err.message}`, logs }
  }
}

const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor