@1aboveio/skills 1.0.6 → 1.0.8

package/skills/app-dev/android-foundation/scripts/device-run.sh

@@ -16,6 +16,13 @@
 # Optional environment:
 #   POSTGRES_IMAGE (postgres:17)  DB_URL_VAR (SHARD_ADMIN_URL)  DB_NAME_VAR (SHARD_DB_NAME)
 #   LOG_DIR (.cache/logs)  BOUNDED_SECONDS (30)  BOOT_ATTEMPTS (60)  KILL_GRACE_SECONDS (10)
+#   JOURNEY_SECONDS (0 = no deadline; caller chooses a positive whole-journey limit)
+#
+# ADB_SERVER_SOCKET / ANDROID_ADB_SERVER_PORT are inherited unchanged. The caller
+# selects a private ADB endpoint before entry; this script never stops that server.
+# Journey children must stay in their process group (no daemonizing / setsid).
+# Send TERM to this launcher and allow cleanup to finish, rather than killing it.
+# A forced kill or host crash cannot clean up; keep the printed resource directory.
 #
 # Exports ANDROID_EMULATOR_SERIAL, $DB_URL_VAR and $DB_NAME_VAR to both commands.
 # Prints `original_stage_exit=<n> cleanup_exit=<n>` last and exits with the
@@ -47,6 +54,26 @@ LOG_DIR="${LOG_DIR:-.cache/logs}"
 BOUNDED_SECONDS="${BOUNDED_SECONDS:-30}"
 BOOT_ATTEMPTS="${BOOT_ATTEMPTS:-60}"
 KILL_GRACE_SECONDS="${KILL_GRACE_SECONDS:-10}"
+JOURNEY_SECONDS="${JOURNEY_SECONDS:-0}"
+
+# Reject invalid limits before creating any owned resources.
+python3 -c 'import math, sys
+for value in sys.argv[1:4]:
+    number = float(value)
+    if not math.isfinite(number) or number < 0: sys.exit("limits must be finite and non-negative")
+if float(sys.argv[1]) == 0: sys.exit("BOUNDED_SECONDS must be positive")
+if not sys.argv[4].isdigit() or int(sys.argv[4]) < 1: sys.exit("BOOT_ATTEMPTS must be a positive integer")' \
+  "$BOUNDED_SECONDS" "$KILL_GRACE_SECONDS" "$JOURNEY_SECONDS" "$BOOT_ATTEMPTS" || exit 2
+for variable in "$DB_URL_VAR" "$DB_NAME_VAR"; do
+  if ! [[ "$variable" =~ ^[a-zA-Z_][a-zA-Z_0-9]*$ ]]; then
+    echo "invalid database environment variable: $variable" >&2
+    exit 2
+  fi
+done
+if test "$DB_URL_VAR" = "$DB_NAME_VAR"; then
+  echo "DB_URL_VAR and DB_NAME_VAR must differ" >&2
+  exit 2
+fi
 
 if ! [[ "$EMULATOR_PORT" =~ ^[0-9]+$ ]] || (( EMULATOR_PORT < 5554 || EMULATOR_PORT > 5584 || EMULATOR_PORT % 2 )); then
   echo "EMULATOR_PORT must be an even port in 5554-5584: $EMULATOR_PORT" >&2
@@ -56,67 +83,139 @@ fi
 mkdir -p "$LOG_DIR"
 run_dir="$(mktemp -d "${TMPDIR:-/tmp}/android-device-run.XXXXXX")"
 emulator_pid=""
+active_pid=""
 db_ready=""
+container_started=""
+launch_in_progress=0
+pending_signal=0
+handle_signal() {
+  pending_signal="$1"
+  # Do not abandon a spawned supervisor before its PID has been recorded.
+  if test "$launch_in_progress" -eq 0; then exit "$pending_signal"; fi
+}
+honor_pending_signal() {
+  if test "$pending_signal" -ne 0; then exit "$pending_signal"; fi
+}
+echo "Owned resource records: $run_dir" >&2
 export ANDROID_EMULATOR_SERIAL="emulator-$EMULATOR_PORT"
 
-bounded() {
-  # Kill the whole process group on timeout: a surviving grandchild would hold
-  # the output pipe open and stall the caller past the deadline.
-  python3 -c 'import os, signal, subprocess, sys
-limit = float(sys.argv[1])
-child = subprocess.Popen(sys.argv[2:], start_new_session=True)
+supervise() {
+  # Only called in a background subshell: exec makes $! the signal-aware owner.
+  # Keep the process group owned even if its original leader exits first.
+  exec python3 -c 'import os, signal, subprocess, sys, time
+limit, grace = map(float, sys.argv[1:3])
+mode = sys.argv[3]
+cancelled = 0
+def cancel(signum, frame):
+    global cancelled
+    cancelled = 128 + signum
+signal.signal(signal.SIGTERM, cancel)
+signal.signal(signal.SIGINT, cancel)
 try:
-    sys.exit(child.wait(timeout=limit))
-except subprocess.TimeoutExpired:
-    os.killpg(child.pid, signal.SIGKILL)
-    child.wait()
-    print("Command exceeded %s seconds: %s" % (sys.argv[1], " ".join(sys.argv[2:])), file=sys.stderr)
-    sys.exit(124)' "$BOUNDED_SECONDS" "$@"
+    child = subprocess.Popen(sys.argv[4:], start_new_session=True)
+except FileNotFoundError as error:
+    print(error, file=sys.stderr)
+    sys.exit(127)
+except OSError as error:
+    print(error, file=sys.stderr)
+    sys.exit(126)
+def group_alive():
+    # Ignore unreapable orphan zombies. macOS can return EPERM, not ESRCH, for
+    # an empty group under a sandbox, so inspect membership before signalling.
+    listing = subprocess.check_output(["ps", "-A", "-o", "pgid=,stat="], text=True)
+    return any(int(parts[0]) == child.pid and not parts[1].startswith("Z")
+               for line in listing.splitlines() if len(parts := line.split()) == 2)
+def send(sig):
+    try: os.killpg(child.pid, sig)
+    except ProcessLookupError: pass
+    except PermissionError:
+        if group_alive(): raise
+end = time.monotonic() + limit if limit else float("inf")
+timed_out = False
+while child.poll() is None and not cancelled:
+    if time.monotonic() >= end:
+        timed_out = True
+        break
+    time.sleep(0.02)
+forced = False
+if timed_out:
+    send(signal.SIGKILL)
+else:
+    send(signal.SIGTERM)
+    stop = time.monotonic() + grace
+    while group_alive() and time.monotonic() < stop:
+        child.poll()
+        time.sleep(0.02)
+    if group_alive():
+        forced = True
+        send(signal.SIGKILL)
+status = child.wait()
+status = 128 - status if status < 0 else status
+if timed_out:
+    print("Command exceeded %s seconds: %s" % (sys.argv[1], " ".join(sys.argv[4:])), file=sys.stderr)
+    sys.exit(124)
+if mode == "emulator" and forced: sys.exit(1)
+sys.exit(cancelled or status or (1 if forced else 0))' "$1" "$KILL_GRACE_SECONDS" "${@:2}"
+}
+
+managed() {
+  local limit="$1" status=0
+  shift
+  launch_in_progress=1
+  supervise "$limit" command "$@" <&0 &
+  active_pid=$!
+  launch_in_progress=0
+  honor_pending_signal
+  # Bash defers signal traps for foreground commands, but not for this wait.
+  wait "$active_pid" || status=$?
+  active_pid=""
+  return "$status"
 }
 
+bounded() { managed "$BOUNDED_SECONDS" "$@"; }
+
 cleanup() {
   original_status=$?
-  trap - EXIT INT TERM
+  trap - EXIT
+  trap '' INT TERM
+  pending_signal=0
+  launch_in_progress=0
   set +e
   cleanup_status=0
+  if test -n "$active_pid"; then
+    kill -TERM "$active_pid" 2>/dev/null
+    wait "$active_pid" || :
+    active_pid=""
+  fi
   if test -n "$db_ready"; then
     bounded "${drop_cmd[@]}" || cleanup_status=1
   fi
   if test -n "$emulator_pid"; then
-    if kill -0 "$emulator_pid" 2>/dev/null; then
-      kill -TERM "$emulator_pid" || cleanup_status=1
-    fi
-    for _ in $(seq 1 "$KILL_GRACE_SECONDS"); do
-      kill -0 "$emulator_pid" 2>/dev/null || break
-      sleep 1
-    done
-    if kill -0 "$emulator_pid" 2>/dev/null; then
-      cleanup_status=1
-      kill -KILL "$emulator_pid"
-      sleep 1
-    fi
-    if kill -0 "$emulator_pid" 2>/dev/null; then
-      cleanup_status=1
-    else
-      wait "$emulator_pid"
-      emulator_status=$?
-      # 0 = clean exit; 143 = ended by our TERM. A KILL was already counted above.
-      case "$emulator_status" in 0|143) ;; *) cleanup_status=1 ;; esac
-    fi
+    kill -TERM "$emulator_pid" 2>/dev/null
+    emulator_status=0
+    wait "$emulator_pid" || emulator_status=$?
+    case "$emulator_status" in 0|143) ;; *) cleanup_status=1 ;; esac
   fi
   if test -s "$run_dir/postgres.cid"; then
     container_id="$(< "$run_dir/postgres.cid")"
     bounded docker rm --force "$container_id" >/dev/null || cleanup_status=1
-    remaining="$(bounded docker ps -a --no-trunc --filter "id=$container_id" --format '{{.ID}}')" || cleanup_status=1
-    test -z "$remaining" || cleanup_status=1
+    bounded docker ps -a --no-trunc --filter "id=$container_id" --format '{{.ID}}' \
+      > "$run_dir/remaining" || cleanup_status=1
+    test ! -s "$run_dir/remaining" || cleanup_status=1
+  elif test -n "$container_started"; then
+    echo "Container startup not acknowledged; ownership unknown, inspect $run_dir before recovery" >&2
+    cleanup_status=1
   fi
-  printf 'original_stage_exit=%s cleanup_exit=%s\n' "$original_status" "$cleanup_status"
+  printf 'original_stage_exit=%s cleanup_exit=%s\n' "$original_status" "$cleanup_status" >&3
   if test "$original_status" -ne 0; then exit "$original_status"; fi
   exit "$cleanup_status"
 }
+# EXIT can run inside a redirected function (notably docker run >/dev/null).
+# Keep the caller's output for the final status line, even on startup failure.
+exec 3>&1
 trap cleanup EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
+trap 'handle_signal 130' INT
+trap 'handle_signal 143' TERM
 
 # Every port this run listens on or dials must be free before anything starts.
 python3 -c 'import socket, sys
@@ -130,21 +229,28 @@ bounded adb start-server
 
 # -memory 4096 overrides the AVD's hw.ramSize, so a reused 2 GB AVD cannot starve the
 # guest kernel's vsock allocations and drop adb mid-journey (references/gotchas.md).
-"$ANDROID_HOME/emulator/emulator" -avd "$SETUP_AVD" -port "$EMULATOR_PORT" -memory 4096 \
+launch_in_progress=1
+supervise 0 emulator "$ANDROID_HOME/emulator/emulator" -avd "$SETUP_AVD" -port "$EMULATOR_PORT" -memory 4096 \
   -no-window -no-audio -no-snapshot -gpu swiftshader_indirect -accel on \
   > "$LOG_DIR/emulator.log" 2>&1 &
 emulator_pid=$!
+launch_in_progress=0
+honor_pending_signal
 
 container_name="android-device-run-$(date +%s)-$$"
+container_started=1
+printf '%s\n' "$container_name" > "$run_dir/container-name"
 bounded docker run --detach --name "$container_name" --cidfile "$run_dir/postgres.cid" \
   --publish 127.0.0.1::5432 --env POSTGRES_USER=postgres \
   --env POSTGRES_PASSWORD=postgres --env POSTGRES_DB=postgres "$POSTGRES_IMAGE" >/dev/null
-db_port="$(bounded docker port "$container_name" 5432/tcp | head -1 | awk -F: '{print $NF}')"
+bounded docker port "$container_name" 5432/tcp > "$run_dir/postgres.port"
+db_port="$(head -1 "$run_dir/postgres.port" | awk -F: '{print $NF}')"
 test -n "$db_port"
 
 boot_state=""
 for _ in $(seq 1 "$BOOT_ATTEMPTS"); do
-  if boot_state="$(bounded adb -s "$ANDROID_EMULATOR_SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r')"; then
+  if bounded adb -s "$ANDROID_EMULATOR_SERIAL" shell getprop sys.boot_completed > "$run_dir/boot" 2>/dev/null; then
+    boot_state="$(tr -d '\r' < "$run_dir/boot")"
     if test "$boot_state" = 1; then break; fi
   else
     probe_status=$?
@@ -173,4 +279,4 @@ export "$DB_URL_VAR=postgresql://postgres:postgres@127.0.0.1:$db_port/postgres"
 export "$DB_NAME_VAR=${DB_NAME_PREFIX}$(date +%s)_$$"
 db_ready=1
 
-"${journey_cmd[@]}"
+managed "$JOURNEY_SECONDS" "${journey_cmd[@]}"