Replace Duktape 1.0.2 with QuickJS 2026-06-04 (ES2025)

[evgeny-boger]

What

Swaps the ES5-era Duktape 1.0.2 engine for QuickJS 2026-06-04 (latest Bellard release), bringing ES2023/ES2024 and most of ES2025 to rule scripts — classes with private fields, async/await + working promise microtasks, Object.groupBy, iterator helpers, Set algebra, toSorted/findLast, arrow-function rule callbacks, BigInt, and more. See sample-es2025.js.

How

• QuickJS is a pinned git submodule (third_party/quickjs → bellard/quickjs 3d5e064, byte-identical to the official 2026-06-04 tarball). Patches, if ever needed, live as commits on a fork and rebase cleanly against upstream.
• internal/quickjsduk implements the go-duktape API surface wbrules uses, on QuickJS — wired in with a one-line go.mod replace. wbrules engine code is untouched except stack-trace-format parsing in escontext.go. cgo compiles the submodule sources through five one-line wrapper files: no new build system, and armhf/arm64 cross-compilation rides the existing CGO_ENABLED=1 CC=<cross-gcc> flow.
• Duktape semantics preserved where wbrules depends on them: per-file realms, calling-context dispatch for native callbacks, per-realm require() cache with module.static, Duktape's rc-error strings, plus a pending-job pump so promises resolve (Duktape 1.x had none).

Validation

• All 36 wbrules test suites pass against the production wbgo.so (single-process go test ./wbrules/, 49.9 s). Three test-data updates for engine-behavior differences, each documented in PORT-QUICKJS.md.
• Deployed to a WB8 over stock 2.46.2: every production rule file loads with zero script errors; MQTT round-trips verified.
• Measured back-to-back on the same device and ruleset:

metric	Duktape 2.46.2	QuickJS (this PR)
RSS / PSS steady state	37.6 / 36.1 MB	36.7 / 35.3 MB
MQTT reaction latency, median (n=300)	6.98 ms	7.61 ms
ES5 compute bench (sample-bench.js)	~1300 ms	~310 ms (4.2×)

Memory at parity, reaction latency dominated by the MQTT/driver path either way, raw JS ~4× faster.

Notes for review

• PORT-QUICKJS.md is the full engineering log: ported semantics, the three behavior changes, packaging notes (plugin/binary -trimpath pairing, -fuse-ld=bfd for arm64 on binutils ≥ 2.44), and benchmark methodology.
• CI needs git submodule update --init and, for cross-builds, crossbuild-essential-* + foreign-arch libc6 (or the existing sbuild chroots).
• Suggested follow-up: fork bellard/quickjs into the wirenboard org and point .gitmodules there.

🤖 Generated with Claude Code

---

Update: TypeScript support + wild-corpus hardening

TypeScript rules (6c9b649): .ts files in /etc/wb-rules/ transpile on load via a persistent typescript-go child (~1 ms warm) and run immediately; type checking happens in the background and never delays execution ("run first, check later"). Findings land in the rules log (TS check: file:line:col) and as retained JSON on /wbrules/ts-check/<file> for editor integration. Tracebacks map back to .ts source lines through the emitted source map. Ships tsgo (/usr/lib/wb-rules/tsgo) and types/wb-rules.d.ts (builtin API declarations, also used by the homeui editor). New flags: -tsgo, -ts-types, -js-timeout.

Wild-corpus validation (cbe69b3): 663 user scripts harvested from wiki/support/GitHub were loaded through the engine — final sweep: 508 load OK, 5 need user modules not present, 150 fail for script-side reasons (forum-paste fragments, missing /etc configs), 0 crashes/hangs. The corpus is not distributed; every bug it exposed is pinned by a minimal synthetic regression test:

• engine shutdown races with in-flight timer/cron/shell callbacks (sync queue redesign — never closed, syncDone handshake)
• trackMqtt() before any publish crashed the engine MQTT client (lazy start on subscribe)
• runaway JS (while(true)) froze the engine forever → new watchdog via JS_SetInterruptHandler (-js-timeout, default 60 s); stock Duktape wb-rules freezes identically
• 'use strict' scripts threw on every dev/PersistentStorage write (proxy set traps didn't return true)
• exports/module.exports now in scope for plain rule files
• require() of a missing module reports cannot find module "id" instead of rc -100
• spurious stack overflow on valid code: QuickJS's C-stack anchor vs Go goroutine↔OS-thread migration (anchor+operation fused into single cgo calls)
• one data race (-race now viable: checkptr-clean shim, race-built plugin pairing documented)

Validated on a WB8: 2.47.0~quickjs4 deployed, TS demo rules live, checker output verified end to end.

[codacy-production]

Not up to standards ⛔

🔴 Issues 3 critical · 39 high · 53 medium · 5 minor

Alerts:
⚠ 100 issues (≤ 0 issues of at least minor severity)

Results:
100 new issues

Category	Results
UnusedCode	39 medium
BestPractice	1 medium 11 high
ErrorProne	23 high
Security	2 minor 5 high 3 critical 13 medium
CodeStyle	3 minor

View in Codacy

🟢 Metrics 609 complexity · 17 duplication

Metric	Results
Complexity	609
Duplication	17

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[evgeny-boger]

Split per review request into two stacked PRs: #223 (QuickJS engine + wild-corpus hardening, base master) and #224 (TypeScript support, stacked on #223). The quickjs-port branch stays for history; all content is preserved in the split branches (squashed, with original SHAs referenced in the commit messages).