mirror of
https://github.com/eigent-ai/eigent.git
synced 2026-08-24 08:03:36 +00:00
54 lines
1.7 KiB
Bash
54 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# Guardrail for web separation:
|
|
# only src/host/createHost.ts may read window.electronAPI/window.ipcRenderer.
|
|
if command -v rg >/dev/null 2>&1; then
|
|
set +e
|
|
violations="$(
|
|
rg -n \
|
|
-e 'window\s*(\?\.)?\s*\.\s*(electronAPI|ipcRenderer)' \
|
|
-e '\(window\s+as\s+any\)\s*\.\s*(electronAPI|ipcRenderer)' \
|
|
-e 'window\s*\[\s*["'\''](electronAPI|ipcRenderer)["'\'']\s*\]' \
|
|
--glob '*.{ts,tsx,js,jsx}' \
|
|
--glob '!src/host/createHost.ts' \
|
|
src
|
|
)"
|
|
search_status=$?
|
|
set -e
|
|
if ((search_status > 1)); then
|
|
echo "Electron window access guard failed to scan source files." >&2
|
|
exit "${search_status}"
|
|
fi
|
|
else
|
|
if [[ ! -d src ]] || ! command -v find >/dev/null 2>&1 || ! command -v grep >/dev/null 2>&1; then
|
|
echo "Electron window access guard is missing its source tree or search tools." >&2
|
|
exit 2
|
|
fi
|
|
set +e
|
|
violations="$(
|
|
find src -type f \
|
|
\( -name '*.ts' -o -name '*.tsx' -o -name '*.js' -o -name '*.jsx' \) \
|
|
! -path 'src/host/createHost.ts' \
|
|
-exec grep -HnE \
|
|
-e 'window[[:space:]]*(\?\.)?[[:space:]]*\.[[:space:]]*(electronAPI|ipcRenderer)' \
|
|
-e '\(window[[:space:]]+as[[:space:]]+any\)[[:space:]]*\.[[:space:]]*(electronAPI|ipcRenderer)' \
|
|
-e "window[[:space:]]*\[[[:space:]]*['\"](electronAPI|ipcRenderer)['\"][[:space:]]*\]" \
|
|
{} +
|
|
)"
|
|
search_status=$?
|
|
set -e
|
|
if ((search_status > 1)); then
|
|
echo "Electron window access guard failed to scan source files." >&2
|
|
exit "${search_status}"
|
|
fi
|
|
fi
|
|
|
|
if [[ -n "${violations}" ]]; then
|
|
echo "Found forbidden direct Electron window access outside Host bridge:"
|
|
echo "${violations}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Electron window access guard passed."
|