fix(search): catch variable-bound dynamic imports in the dormant boundary audit and use sleep for the probe wait

Author: waleedlatif1

apps/sim/lib/sim-search/indexed/retrieval/projection-fill.ts

@@ -1,5 +1,6 @@
 import { SOURCE_ACL_PROJECTIONS, type SourceAclProjection } from '@sim/db/knowledge-projection'
 import { embeddingKeywordTin, embeddingSearch } from '@sim/db/schema'
+import { sleep } from '@sim/utils/helpers'
 import { sql } from 'drizzle-orm'
 import { LRUCache } from 'lru-cache'
 import { runSearchQuery, type SearchBudget } from '@/lib/knowledge/search/budget'
@@ -88,15 +89,8 @@ export async function isProjectionFilled(
     0,
     Math.min(PROJECTION_FILLED_PROBE_BUDGET_MS, budget.deadline - performance.now())
   )
-  let timer: ReturnType<typeof setTimeout> | undefined
-  const unanswered = new Promise<undefined>((resolve) => {
-    timer = setTimeout(resolve, waitMs, undefined)
-  })
-  try {
-    return (await Promise.race([answer.catch(() => undefined), unanswered])) ?? false
-  } finally {
-    clearTimeout(timer)
-  }
+  const unanswered = sleep(waitMs).then(() => undefined)
+  return (await Promise.race([answer.catch(() => undefined), unanswered])) ?? false
 }
 
 /** Forgets whether the projections were filled; the memo is per process and otherwise expires on its own. */

scripts/check-indexed-org-search-boundary.test.ts

@@ -104,6 +104,23 @@ describe('indexed organization search boundary audit', () => {
     ])
   })
 
+  it('catches a dynamic import whose target is held in a variable', () => {
+    expect(
+      findBoundaryViolations([
+        {
+          file: 'apps/sim/lib/other/loader.ts',
+          source: `const target = '${USE_CASE_BARREL}'\nexport const load = () => import(target)`,
+        },
+      ])
+    ).toEqual([
+      expect.objectContaining({
+        file: 'apps/sim/lib/other/loader.ts',
+        specifier: USE_CASE_BARREL,
+        reason: `is not an allowlisted entry point for ${USE_CASE_BARREL}`,
+      }),
+    ])
+  })
+
   it('accepts a gate called under an aliased import', () => {
     expect(
       findBoundaryViolations([

scripts/check-indexed-org-search-boundary.ts

@@ -92,20 +92,30 @@ export function moduleSpecifiers(
     const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile))
     found.push({ specifier, line: line + 1 })
   }
+  const consumed = new Set<ts.Node>()
   const visit = (node: ts.Node): void => {
     if (
       (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
       node.moduleSpecifier &&
       ts.isStringLiteralLike(node.moduleSpecifier)
     ) {
       record(node, node.moduleSpecifier.text)
+      consumed.add(node.moduleSpecifier)
     } else if (ts.isCallExpression(node)) {
       const isDynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword
       const isRequire = ts.isIdentifier(node.expression) && node.expression.text === 'require'
       const argument = node.arguments[0]
       if ((isDynamicImport || isRequire) && argument && ts.isStringLiteralLike(argument)) {
         record(node, argument.text)
+        consumed.add(argument)
       }
+    } else if (ts.isStringLiteralLike(node) && !consumed.has(node)) {
+      /**
+       * Any other string naming a module is a specifier too: a dynamic import or `require` of a
+       * variable is only as safe as the strings that variable can hold, so the string is where
+       * the reach into the dormant directory is caught.
+       */
+      record(node, node.text)
     }
     ts.forEachChild(node, visit)
   }