Bundler support (POC)

library/agent/Agent.ts

@@ -77,8 +77,11 @@ export class Agent {
     private readonly api: ReportingAPI,
     private readonly token: Token | undefined,
     private readonly serverless: string | undefined,
+    // Use the new instrumentation system (CJS & ESM) using registerHook
     private readonly newInstrumentation: boolean = false,
-    private readonly fetchListsAPI: FetchListsAPI
+    private readonly fetchListsAPI: FetchListsAPI,
+    // Set to true during the bundling process when the bundler plugin is used to disable certain features
+    private readonly isBundlingProcess: boolean = false
   ) {
     if (typeof this.serverless === "string" && this.serverless.length === 0) {
       throw new Error("Serverless cannot be an empty string");
@@ -497,22 +500,28 @@ export class Agent {
 
     this.started = true;
 
-    this.logger.log(`Starting agent v${getAgentVersion()}...`);
+    if (!this.isBundlingProcess) {
+      this.logger.log(`Starting agent v${getAgentVersion()}...`);
 
-    if (!this.block) {
-      this.logger.log("Dry mode enabled, no requests will be blocked!");
-    }
+      if (!this.block) {
+        this.logger.log("Dry mode enabled, no requests will be blocked!");
+      }
 
-    if (this.token) {
-      this.logger.log("Found token, reporting enabled!");
-    } else {
-      this.logger.log("No token provided, disabling reporting.");
+      if (this.token) {
+        this.logger.log("Found token, reporting enabled!");
+      } else {
+        this.logger.log("No token provided, disabling reporting.");
 
-      if (!this.block && !isAikidoCI()) {
-        console.log(
-          "AIKIDO: Running in monitoring only mode without reporting to Aikido Cloud. Set AIKIDO_BLOCK=true to enable blocking."
-        );
+        if (!this.block && !isAikidoCI()) {
+          console.log(
+            "AIKIDO: Running in monitoring only mode without reporting to Aikido Cloud. Set AIKIDO_BLOCK=true to enable blocking."
+          );
+        }
       }
+    } else {
+      this.logger.log(
+        `Starting agent v${getAgentVersion()} in bundling mode...`
+      );
     }
 
     // When our library is required, we are not intercepting `require` calls yet
@@ -521,6 +530,11 @@ export class Agent {
 
     wrapInstalledPackages(wrappers, this.newInstrumentation, this.serverless);
 
+    if (this.isBundlingProcess) {
+      // No need to report events during the bundling process
+      return;
+    }
+
     // Send startup event and wait for config
     // Then start heartbeats and polling for config changes
     this.onStart()

library/agent/hooks/instrumentation/loadHook.ts

@@ -66,7 +66,7 @@ export function onModuleLoad(
   }
 }
 
-function patchPackage(
+export function patchPackage(
   path: string,
   previousLoadResult: ReturnType<LoadFunction>
 ) {

library/agent/protect.ts

@@ -103,9 +103,11 @@ function getTokenFromEnv(): Token | undefined {
 function startAgent({
   serverless,
   newInstrumentation,
+  isBundlingProcess,
 }: {
   serverless: string | undefined;
   newInstrumentation: boolean;
+  isBundlingProcess: boolean;
 }) {
   const current = getInstance();
 
@@ -120,7 +122,8 @@ function startAgent({
     getTokenFromEnv(),
     serverless,
     newInstrumentation,
-    getFetchListsAPI()
+    getFetchListsAPI(),
+    isBundlingProcess
   );
 
   setInstance(agent);
@@ -178,13 +181,15 @@ export function protect() {
   startAgent({
     serverless: undefined,
     newInstrumentation: false,
+    isBundlingProcess: false,
   });
 }
 
 export function lambda(): (handler: Handler) => Handler {
   startAgent({
     serverless: "lambda",
     newInstrumentation: false,
+    isBundlingProcess: false,
   });
 
   return createLambdaWrapper;
@@ -194,6 +199,7 @@ export function cloudFunction(): (handler: HttpFunction) => HttpFunction {
   startAgent({
     serverless: "gcp",
     newInstrumentation: false,
+    isBundlingProcess: false,
   });
 
   return createCloudFunctionWrapper;
@@ -203,5 +209,14 @@ export function protectWithNewInstrumentation() {
   startAgent({
     serverless: undefined,
     newInstrumentation: true,
+    isBundlingProcess: false,
+  });
+}
+
+export function protectDuringBundling() {
+  startAgent({
+    serverless: undefined,
+    newInstrumentation: true,
+    isBundlingProcess: true,
   });
 }

library/bundler/index.ts

@@ -1,3 +1,6 @@
 import { externals } from "./externals";
+import { basePlugin } from "./unplugin";
 
-export { externals };
+const zenEsbuildPlugin = basePlugin.esbuild;
+
+export { externals, zenEsbuildPlugin };

library/bundler/unplugin.ts

@@ -0,0 +1,55 @@
+import { createUnplugin, type UnpluginInstance } from "unplugin";
+import { protectDuringBundling } from "../agent/protect";
+import { patchPackage } from "../agent/hooks/instrumentation/loadHook";
+
+type UserOptions = {
+  execlude?: string | string[];
+  inlineWebAssembly?: boolean;
+};
+
+export const basePlugin: UnpluginInstance<UserOptions | undefined, false> =
+  createUnplugin(() => {
+    return {
+      name: "zen-js-bundler-plugin",
+
+      buildStart() {
+        protectDuringBundling();
+      },
+
+      transform: {
+        filter: {
+          id: /\.(js|ts|cjs|mjs|jsx|tsx)$/,
+        },
+        handler(code, id) {
+          const result = patchPackage(id, {
+            source: code,
+            format: "unambiguous",
+            shortCircuit: false,
+          });
+
+          // Todo fix SCA not reporting packages patched during bundling
+
+          if (typeof result.source !== "string") {
+            return {
+              code: new TextDecoder("utf-8").decode(result.source),
+            };
+          }
+
+          return {
+            code: result.source,
+          };
+        },
+      },
+      esbuild: {
+        config: (options) => {
+          if (!options.external) {
+            options.external = ["@aikidosec/firewall"];
+          } else if (Array.isArray(options.external)) {
+            options.external.push("@aikidosec/firewall");
+          } else {
+            throw new Error("esbuild external option is not an array");
+          }
+        },
+      },
+    };
+  });