feat(builtins): add embedded TypeScript/JS runtime via ZapCode#940
Merged
feat(builtins): add embedded TypeScript/JS runtime via ZapCode#940
Conversation
Add embedded TypeScript/JavaScript execution powered by zapcode-core, following the same pattern as the Python/Monty builtin. - Feature flag: `typescript` (opt-in via `Bash::builder().typescript()`) - Commands: ts, typescript, node, deno, bun (all aliases) - VFS bridging: readFile, writeFile, exists, readDir, mkdir, remove, stat - Resource limits: TypeScriptLimits (duration, memory, stack depth, allocations) - External function support for host-provided capabilities - 30 unit tests covering basic execution, VFS bridging, and error handling - Spec: specs/015-zapcode-runtime.md
…d threat model - Examples: typescript_scripts.rs, typescript_external_functions.rs (CI runs typescript_external_functions) - Security tests: 45 tests in typescript_security_tests.rs covering blocked features (eval/import/require), resource exhaustion, VFS security, error handling, bash integration, opt-in verification, prototype attacks, and custom limits - Threat model: TM-TS section in specs/006-threat-model.md with 23 threat entries, blocked features table, VFS bridge properties, and explicit opt-in documentation - Integration: 39 spec test cases (37 passing, 2 skipped) covering expressions, control flow, functions, aliases, VFS bridging, pipelines, and command substitution - Threat model tests: 8 TM-TS tests in threat_model_tests.rs
…supported mode hints - TypeScriptConfig: configurable compat_aliases (default: true) and unsupported_mode_hint (default: true) - When hints enabled, unsupported flags (--inspect, --watch) and subcommands (deno run, bun install) show helpful text explaining this is ZapCode, not a full runtime, with usage examples - Interactive mode (no args) also shows hints when enabled - compat_aliases(false) registers only ts/typescript, not node/deno/bun - New builder: .typescript_with_config(TypeScriptConfig) - Error messages now use the actual command name (node:, deno:, etc.) - 8 new unit tests, 5 new security tests
- README: add TypeScript feature, install instructions, usage section with inline code, VFS bridging, and TypeScriptConfig examples - Rustdoc: crates/bashkit/docs/typescript.md with full guide (quick start, VFS bridging, resource limits, config, LLM integration, limitations, security) - lib.rs: typescript_guide module with include_str! doc embedding - specs/009-implementation-status: add ts/node/deno/bun builtins
…integration tests - docs/builtin_typescript.md: comprehensive user-facing guide with examples for inline code, script files, VFS bridging, data processing pipelines, JSON workflows, configuration, and security - Compiled doc examples: TypeScriptLimits and TypeScriptConfig have rustdoc examples that compile and run (not rust,ignore) - crates/bashkit/docs/typescript.md: fix BashTool example (rust,ignore) - Integration tests (typescript_integration_tests.rs): 14 tests covering bash→ts file sharing, ts→bash, roundtrip, mkdir, CSV processing, JSON, command substitution, pipelines, conditionals, .ts/.js file execution via all aliases, VFS state persistence - Spec test cases: 6 new cross-runtime tests (file execution, bash→ts data flow, JSON roundtrip)
Deduplicate the VmState::Complete/Suspended handling by using a single loop instead of matching the initial state separately and then looping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
typescript) and opt-in via builder (.typescript()) — not available by defaultts,typescript,node,deno,buncommands (compat aliases configurable)readFile,writeFile,exists,readDir,mkdir,remove,statTypeScriptLimits), compat alias toggle, and unsupported-mode hints (TypeScriptConfig)node --inspectordeno run, helpful hint text explains this is ZapCode and shows supported usage patternsWhat's included
crates/bashkit/src/builtins/typescript.rs(~1300 lines)specs/016-zapcode-runtime.mdspecs/006-threat-model.md(23 threats)typescript_security_tests.rs(50 tests)typescript_integration_tests.rs(14 tests)spec_cases/typescript/typescript.test.sh(45 cases)threat_model_tests.rstypescript.rstypescript_scripts.rs,typescript_external_functions.rs(CI)docs/builtin_typescript.md,crates/bashkit/docs/typescript.md(rustdoc)Test plan
cargo test --features typescript -p bashkit— all 2000+ tests passcargo test --features typescript -p bashkit --test typescript_security_tests— 50 security testscargo test --features typescript -p bashkit --test typescript_integration_tests— 14 cross-runtime testscargo clippy --all-targets --all-features -- -D warnings— cleancargo fmt --check— cleancargo run --features typescript --example typescript_external_functions— runs successfully