[APPS-2792] Add: reject Node built-in imports in backend files

[tyffical]

Motivation

• Part of APPS-2792 — local Node execution for App Builder backend functions. Backend functions run in a restricted environment with no unrestricted filesystem/process/network access — under today's v1 runtime, that includes no raw network access at all (not even fetch); everything must go through an Action Platform action ($.Actions or an @datadog/action-catalog typed wrapper).
• Static imports of Node built-in modules (fs, child_process, net, etc.) in .backend.ts files are rejected at build time, so an author gets immediate, actionable feedback instead of code that silently behaves differently (or breaks) once local Node execution lands.
• Network-capable globals (fetch, XMLHttpRequest, WebSocket, EventSource) need a separate check: they're bare globals, not imports, so import-specifier restriction can't catch them. This closes a real trap: fetch works fine during local dev (nothing stopped it before this check existed) but fails once the app is published, since production's sandbox blocks it.
• A separate, complementary effort (web-ui#340206) adds AI-authoring guidance steering generated code away from fetch in the first place. That reduces how often this gets written at all, but only this build-time check guarantees it never ships, regardless of whether the code came from an AI, a human, or a copy-pasted snippet. Both layers exist for a reason — this PR isn't superseded by that guidance work.
• This restriction (and the AI-authoring guidance) is v1-specific: backend functions' planned v2 (Terrapin-based) sandbox will lift it. Legacy (pre-v2) apps are the ones that need it.
• These are the two "Layer 2" static defenses proposed in the design doc's Sandboxing section; the companion item (ambient TypeScript globals for $ that omit Node-specific types) is deferred — see Out of Scope below.

Changes

What changed	File
Added rejectNodeBuiltinImports, which walks a .backend.ts file's static ImportDeclarations and throws if any source is a Node built-in (via node: prefix or Node's own builtinModules list).	reject-node-builtin-imports.ts
Added rejectRestrictedGlobals, an eslint-scope-based check that throws on any unshadowed reference to fetch/XMLHttpRequest/WebSocket/EventSource — i.e. any reference that doesn't resolve to a local declaration or import sharing the same name, meaning it falls through to the real ambient global.	reject-restricted-globals.ts
Corrected rejectNodeBuiltinImports' doc comment and error message, which previously pointed to fetch-based/isomorphic APIs as the allowed escape hatch — no longer accurate now that fetch itself is blocked too.	reject-node-builtin-imports.ts
Wired both checks into the Vite transform hook, right after this.parse(code) and before export extraction.	vite/index.ts
Added unit tests covering allowed imports (relative, scoped, ordinary npm packages), rejected imports (node:fs, bare fs, child_process, net, fs/promises), and edge cases (type-only imports, non-import statements).	reject-node-builtin-imports.test.ts
Added unit tests covering rejected global references (bare fetch() calls, referencing fetch without calling it, new XMLHttpRequest()/WebSocket()/EventSource()), and allowed cases (an imported action-catalog function, a locally-declared function or parameter that happens to be named fetch — shadowing-safe).	reject-restricted-globals.test.ts
Added an end-to-end test that runs a real .backend.ts file with a node:fs import through the actual transform handler (using rollup's real parseAst, not a hand-built AST) to confirm the rejection fires through the genuine pipeline.	vite/index.test.ts

QA Instructions

Build the plugin and link it into a scratch Vite project, then confirm a backend file importing a Node built-in — or referencing fetch — is rejected while an ordinary backend file still transforms correctly.

# 1. Build and link the plugin from this branchcd~/dd/build-plugins/packages/published/vite-plugin
yarn build
npm link
# 2. Scaffold a throwaway consumer project
mkdir -p ~/import-restriction-qa/src &&cd~/import-restriction-qa
cat > package.json <<'EOF'{ "name": "import-restriction-qa", "private": true, "type": "module", "devDependencies": { "vite": "^5.0.0" } }EOF
cat > vite.config.ts <<'EOF'import { datadogVitePlugin } from '@datadog/vite-plugin/dist/src';import { defineConfig } from 'vite';export default defineConfig({ plugins: [datadogVitePlugin({ apps: { identifier: 'qa-app-id', name: 'import-restriction-qa', dryRun: true } })],});EOF
cat > src/badImport.backend.ts <<'EOF'import fs from 'node:fs';export function readSecret() { return fs.readFileSync('/etc/passwd', 'utf8'); }EOF
cat > src/badFetch.backend.ts <<'EOF'export async function callExternal() { return fetch('https://example.com'); }EOF
cat > src/goodImport.backend.ts <<'EOF'export function doubleNumber(input: number) { return input * 2; }EOF
npm install && npm link @datadog/vite-plugin
# 3. Confirm the bad Node-builtin import is rejected with a clear error
npx vite --port 5199 --strictPort &
sleep 3
curl -s http://localhost:5199/src/badImport.backend.ts | grep -o 'Importing Node built-in module.*not supported in .backend.ts files'# Expected: Importing Node built-in module "node:fs" is not supported in .backend.ts files ✅ VERIFIEDkill %1
# 4. Confirm the bad fetch reference is rejected with a clear error
npx vite --port 5197 --strictPort &
sleep 3
curl -s http://localhost:5197/src/badFetch.backend.ts | grep -o 'Using "fetch" is not supported in .backend.ts files'# Expected: Using "fetch" is not supported in .backend.ts files ✅ VERIFIEDkill %1
# 5. Confirm an ordinary backend file still transforms into a working proxy
npx vite --port 5198 --strictPort &
sleep 3
curl -s http://localhost:5198/src/goodImport.backend.ts
# Expected: export async function doubleNumber(...args) { return globalThis.DD_APPS_RUNTIME.executeBackendFunction(...); } ✅ VERIFIEDkill %1

# Automated pass
yarn test:unit packages/plugins/apps
# Expected: Test Suites: 24 passed, 24 total / Tests: 306 passed, 306 total ✅ VERIFIED
yarn workspace @dd/apps-plugin run typecheck
# Expected: no output, exit 0 ✅ VERIFIED

Blast Radius

• Scoped to .backend.ts files' static imports and top-level global references only. No feature flag — this is a build-time compile error for a pattern (Node built-ins, or raw network globals) that wasn't previously usable in production anyway, since production's real sandbox already blocks both.
• Best-effort, defense-in-depth: the import check only catches static import specifiers (not require() or a dynamically computed import()); the global-reference check only catches references eslint-scope can't resolve to a local declaration/import of the same name.
• Risk: low. No behavioral change for any existing .backend.ts file that doesn't import a Node built-in or reference one of the four restricted globals directly (306/306 existing apps-plugin tests pass unchanged).

Out of Scope / Follow-ups

Item	Status	Next step
Ship backend-function-globals.d.ts (ambient TypeScript type for $ that omits Deno/process/Node-builtin globals)	Deferred	Editor-only DX polish, not an enforced guarantee — this PR's checks already enforce the restriction regardless of what types an author's editor shows. Getting a hand-written .d.ts into the published dist/ tarball requires new build-tooling wiring in packages/tools/src/rollupConfig.mjs (shared by all 5 published bundler plugins), which is disproportionate scope for this PR. Revisit once a scaffold tool exists to actually wire the type into a consumer's tsconfig.json.
Revisit/remove both checks once backend-functions v2 ships	Deferred	v2's Terrapin-based sandbox will allow fetch; not blocking today's v1 rollout

Documentation

• Local design-doc mirror: .plans/high-code-apps-local-node-execution-design.md (dd-source repo)
• RFC: Confluence page 7012712651
• Kickoff doc: Confluence page 7025394455
• Related: web-ui#340206 — the complementary AI-authoring guidance change

[tyffical]

@cursor review
@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:e17c9c8754

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Friend, this PR adds build-time restrictions for unsupported Node built-ins and network globals in backend functions.

Changes:

• Adds AST validation for Node built-in imports and restricted globals.
• Integrates validation into the Vite backend transform.
• Adds unit and transform-level tests.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
packages/plugins/apps/src/vite/index.ts	Runs backend restrictions during transformation.
packages/plugins/apps/src/vite/index.test.ts	Tests transform-level built-in rejection.
packages/plugins/apps/src/backend/ast-parsing/reject-restricted-globals.ts	Detects unresolved restricted globals.
packages/plugins/apps/src/backend/ast-parsing/reject-restricted-globals.test.ts	Tests global detection and shadowing.
packages/plugins/apps/src/backend/ast-parsing/reject-node-builtin-imports.ts	Detects Node built-in imports.
packages/plugins/apps/src/backend/ast-parsing/reject-node-builtin-imports.test.ts	Tests import restrictions and exceptions.

Suppressed comments (2)

packages/plugins/apps/src/backend/ast-parsing/reject-node-builtin-imports.ts:40

• The suggested remedy is inaccurate for non-privileged built-ins such as path, util, or events: an Action Platform action is not a replacement for those APIs. Mention standard JavaScript or a runtime-neutral package for portable functionality, reserving the Action Platform guidance for privileged operations, so the error remains actionable for every module this guard rejects.

 `Backend functions run in a restricted environment and must use an Action ` +
`Platform action ($.Actions or an @datadog/action-catalog typed wrapper) instead: ${filePath}`,

packages/plugins/apps/src/backend/ast-parsing/reject-node-builtin-imports.test.ts:84

• Repository guidance disallows passing a function call directly into another call. Store the import declaration first so this test follows that rule.

 const ast = program([importDecl(source)]);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tyffical]

@codex review

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

packages/plugins/apps/src/backend/ast-parsing/reject-node-builtin-imports.ts:33

• A literal dynamic import still bypasses this check: await import('node:fs') is represented as an ImportExpression (or Rollup's import CallExpression), while this loop only visits top-level declarations. Because the specifier is static, this can be rejected at build time just like an ImportDeclaration; otherwise the built-in reaches the backend bundle and fails only at runtime. Walk both dynamic-import AST representations and reject literal restricted sources, while retaining the documented exemption for computed specifiers.

 for (const node of program.body) {
if (node.type === 'ImportDeclaration' && !isTypeOnly(node)) {
rejectIfRestrictedSource(node.source, filePath);
continue;

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:b32490a571

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject built-ins re-exported with export star

When a reachable helper contains export * from 'node:fs' or export * as fs from 'node:fs', Rollup represents it as an ExportAllDeclaration, so this named-export-only branch never validates the source and the restricted built-in can still enter the backend bundle. Handle non-type ExportAllDeclaration sources alongside named re-exports.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Respect locally shadowed globalThis bindings

When backend code shadows globalThis, such as function run(globalThis) { return globalThis.fetch(); }, this name-only test rejects the local object's method even though no ambient network global is accessed. Resolve the object identifier through the existing scope analysis and reject it only when it is the unresolved ambient globalThis; the destructuring check needs the same distinction.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Inspect computed globalThis destructuring keys

When code uses const { ['fetch']: request } = globalThis, this condition skips the computed property and the later request reference resolves locally, so neither validation rejects the raw network access. The fresh evidence after the prior fix is the newly added property.computed skip here; inspect computed string-literal keys just as the member-expression path does.

Useful? React with 👍 / 👎.