code wiki / _hdl_build / nx_surrogate.nx

nx_surrogate.nx

buildroot/runtime/_hdl_build/nx_surrogate.nx

20213 B212 linesdepth 3pulls 3 transitivereach 11 importersview sourcekind librarytopic surrogate
docsdependenciesstructsconstsfunctions

about

nx_surrogate.nx -- the KEYSTONE data structure of the Nishi clean-view sandbox (per the 17-agent browser- hardening-sota spec): a DATA-DRIVEN SURROGATE/ACTION table, superset of nx_web_filter. The winning discipline is SURROGATE-AND-SATISFY, not strip-and-block: every delete/block is read-back-detectable and the hostile page re-walls. Instead, each rule carries (a) an ACTION on a ladder block->synthesize->scrub_forward->allow that nx_extract_heal walks UP on an observed re-wall, and (b) a SURROGATE payload = the engine-native decoy to hand back on "synthesize" (a stub global, a fake-window, a synthesized Response, a filled bait div, a byte-exact source replay). Same [kind,pat,patlen,category] matcher as nx_web_filter, plus action/surrogate/confidence/ heal-origin columns. This is the single SSOT every sandbox behavior reads from. license_tier: ORIGINAL

dependencies 2 imports · 11 importers

nx_syscalls.nx nx_media_signal.nx nx_surrogate.nx nx_archive_daemon.nx nx_jq_realpage.nx nx_jq_run.nx nx_jq_test.nx nx_jq_tree.nx nx_pre_test.nx nx_sniff_net_cli.nx nx_surrogate_gate.nx nx_surrogate_satisfy_gate.nx nx_vk_js.nx

diagram shows first 10 each side; +0 more imports, +1 more importers in the complete lists below.

imports: nx_syscalls.nxnx_media_signal.nx

imported by: nx_archive_daemon.nxnx_jq_realpage.nxnx_jq_run.nxnx_jq_test.nxnx_jq_tree.nxnx_pre_test.nxnx_sniff_net_cli.nxnx_surrogate_gate.nxnx_surrogate_satisfy_gate.nxnx_vk_js.nxnx_wdoc_test.nx

structs

none

consts

13const SM_URL: i64 = 1 // a network request URL (fetch/xhr/beacon/pixel)
14const SM_GLOBAL: i64 = 2 // a global-name read (window.FuckAdBlock, ga, gtag...)
15const SM_SELECTOR: i64 = 3 // a DOM selector (bait ad-div)
16const SM_CNAME: i64 = 4 // a resolved CNAME canonical host
17const SM_POPUP: i64 = 5 // a window.open() target
19const SA_BLOCK: i64 = 1
20const SA_SYNTHESIZE: i64 = 2
21const SA_SCRUB: i64 = 3 // scrub_forward: send the REAL request, PII/exfil-params stripped
22const SA_ALLOW: i64 = 4
24const SK_NONE: i64 = 0
25const SK_GLOBAL_STUB: i64 = 1 // define window.<name> as engine-native no-op(s)
26const SK_FAKE_WINDOW: i64 = 2 // VAL_WINDOWPROXY decoy Window
27const SK_RESPONSE: i64 = 3 // synthesized native Response / true
28const SK_RESTIMING: i64 = 4 // mint a PerformanceResourceTiming entry
29const SK_BAIT_FILL: i64 = 5 // leave bait DOM + force success geometry/attrs
30const SK_SOURCE_REPLAY: i64 = 6 // byte-exact toString replay of a captured lib
31const SK_HIDE: i64 = 7 // hide the element in the rendered clean-view (overlay walls)
33const SC_AD: i64 = 1
34const SC_TRACK: i64 = 2
35const SC_MINER: i64 = 3
36const SC_POPUP: i64 = 4
37const SC_ANTIADBLOCK: i64 = 5
38const SC_OVERLAY: i64 = 6 // full-page wall / interstitial / paywall / cookie-consent overlay (hide in render)
40const SO_SEEDED: i64 = 0
41const SO_LEARNED: i64 = 1
43const SG_STRIDE: i64 = 10 // [match_kind, pat_ptr, patlen, category, action, surr_kind, conf, origin, aux_ptr, aux_len]
44const SG_MAX: i64 = 2048

functions

46func sg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 1: sg_addc
47func sg_new() -> *i64 { let t: *i64 = sys_mmap(8 * (1 + SG_MAX * SG_STRIDE)) as *i64; t[0] = 0; return t }
called by 7: ad_homemainmainmainmainmain+1 calls 1: sys_mmap
48func sg_add(t: *i64, mk: i64, pat: *u8, patlen: i64, cat: i64, action: i64, sk: i64, conf: i64, origin: i64, aux: *u8, auxlen: i64) -> i64
called by 1: sg_addc
56func sg_addc(t: *i64, mk: i64, pat: *u8, cat: i64, action: i64, sk: i64, conf: i64, origin: i64, aux: *u8) -> i64
called by 2: sg_seedsg_learn calls 2: sg_addsg_slen
60func sg_seed(t: *i64) -> i64
called by 7: ad_homemainmainmainmainmain+1 calls 1: sg_addc
100func sg_build_overlay_css(t: *i64, out: *u8, cap: i64) -> i64
called by 1: ad_home calls 1: sg_puts
117func sg_is_wild(pat: *u8, patlen: i64) -> i64 { if patlen == 1 { if (pat[0]&0xff) == 42 { return 1 } } return 0 }
called by 1: sg_match
119func sg_match(t: *i64, mk: i64, key: *u8, keylen: i64) -> i64
called by 5: sg_classify_urlm_urlm_popm_globm_sel calls 2: sg_is_wildxt_find
136func sg_action(t: *i64, row: i64) -> i64 { return t[1 + row*SG_STRIDE + 4] }
called by 2: sg_classify_urlmain
137func sg_surrogate(t: *i64, row: i64) -> i64 { return t[1 + row*SG_STRIDE + 5] }
called by 2: sg_classify_urlmain
138func sg_category(t: *i64, row: i64) -> i64 { return t[1 + row*SG_STRIDE + 3] }
139func sg_conf(t: *i64, row: i64) -> i64 { return t[1 + row*SG_STRIDE + 6] }
140func sg_origin(t: *i64, row: i64) -> i64 { return t[1 + row*SG_STRIDE + 7] }
called by 1: main
141func sg_aux(t: *i64, row: i64) -> *u8 { return (t[1 + row*SG_STRIDE + 8]) as *u8 }
142func sg_aux_len(t: *i64, row: i64) -> i64 { return t[1 + row*SG_STRIDE + 9] }
145func sg_graduate(t: *i64, row: i64) -> i64
151func sg_learn(t: *i64, mk: i64, pat: *u8, cat: i64, sk: i64, aux: *u8) -> i64
calls 1: sg_addc
155func sg_classify_url(t: *i64, url: *u8, ulen: i64, out_action: *i64, out_kind: *i64) -> i64
called by 1: main calls 3: sg_matchsg_actionsg_surrogate
161func sg_puts(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){dst[off]=s[i];off=off+1;i=i+1} return off }
called by 2: sg_build_overlay_csssg_build_preamble
167func sg_build_preamble(t: *i64, out: *u8, cap: i64) -> i64
called by 6: ad_homemainmainmainmainmain calls 1: sg_puts