@abelxiaoxing/cadence 1.4.1 → 1.5.0

package/src/workspace-io-worker.mjs

@@ -1,5 +1,6 @@
 // Generated by scripts/build-workspace-io.mjs; edit workspace-io-entry.mjs and its source modules.
 // src/workspace-io-entry.mjs
+import { rmSync as rmSync2 } from "node:fs";
 import { parentPort, workerData } from "node:worker_threads";
 
 // src/artifact-store.ts
@@ -196,19 +197,229 @@ class ArtifactStore {
   }
 }
 
+// src/verification-environment-io.ts
+import {
+  constants as constants2,
+  cpSync,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import path2 from "node:path";
+var CACHES = [".vite", ".vite-temp"];
+function within(root, candidate) {
+  const relative = path2.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
+}
+function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings, profile, environment, checkCancelled, privateRoot) {
+  const cleanup = () => rmSync(privateRoot, { recursive: true, force: true });
+  try {
+    const local = profile.mode === "local-trusted";
+    if (local && realpathSync(root) === realpathSync(dependencyOwner))
+      throw new Error("trusted-candidate-required");
+    const mounts = [
+      { source: privateRoot, target: "/cadence", writable: true }
+    ];
+    for (const directory of [
+      "home",
+      "cache",
+      "tmp",
+      "reports",
+      "dependencies"
+    ]) {
+      mkdirSync2(path2.join(privateRoot, directory), { mode: 448 });
+    }
+    writeFileSync2(path2.join(privateRoot, "home/user.npmrc"), "");
+    writeFileSync2(path2.join(privateRoot, "home/global.npmrc"), "");
+    const dependencies = path2.join(dependencyOwner, "node_modules");
+    const stat = lstatSync2(dependencies, { throwIfNoEntry: false });
+    if (stat) {
+      const target = path2.join(root, "node_modules");
+      const targetStat = lstatSync2(target, { throwIfNoEntry: false });
+      if (!stat.isDirectory() || stat.isSymbolicLink() || targetStat && (!targetStat.isDirectory() || targetStat.isSymbolicLink())) {
+        throw new Error("dependency-path-unsafe");
+      }
+      if (!targetStat)
+        mkdirSync2(target, { mode: 448 });
+      const view = path2.join(privateRoot, "dependencies");
+      mounts.push({ source: view, target: "/workspace/node_modules" });
+      const entries = readdirSync(dependencies);
+      if (entries.length > 20000)
+        throw new Error("dependency-view-too-large");
+      const canonical = realpathSync(dependencies);
+      let viewEntries = 0;
+      const projectEntry = (name) => {
+        checkCancelled();
+        if (++viewEntries > 20000)
+          throw new Error("dependency-view-too-large");
+        if (CACHES.includes(name))
+          return;
+        const source = path2.join(dependencies, name);
+        const placeholder = path2.join(view, name);
+        const entry = lstatSync2(source);
+        if (entry.isSymbolicLink()) {
+          const resolved = realpathSync(source);
+          if (within(canonical, resolved)) {
+            symlinkSync(path2.relative(path2.dirname(source), resolved), placeholder);
+          } else if (within(realpathSync(dependencyOwner), resolved)) {
+            const relative = path2.relative(realpathSync(dependencyOwner), resolved);
+            const candidate = path2.join(root, relative);
+            if (!lstatSync2(candidate, { throwIfNoEntry: false }))
+              throw new Error("workspace-dependency-missing");
+            symlinkSync(local ? candidate : `/workspace/${relative.split(path2.sep).join("/")}`, placeholder);
+          } else
+            throw new Error("dependency-path-unsafe");
+        } else if (entry.isDirectory() && name.startsWith("@") && !name.includes(path2.sep)) {
+          mkdirSync2(placeholder);
+          for (const child of readdirSync(source))
+            projectEntry(path2.join(name, child));
+        } else {
+          if (entry.isDirectory())
+            mkdirSync2(placeholder);
+          else if (entry.isFile())
+            writeFileSync2(placeholder, "");
+          else
+            throw new Error("dependency-path-unsafe");
+          mounts.push({
+            source,
+            target: `/workspace/node_modules/${name.split(path2.sep).join("/")}`
+          });
+        }
+      };
+      for (const name of entries)
+        projectEntry(name);
+      for (const cache of CACHES) {
+        mkdirSync2(path2.join(view, cache));
+        const source = path2.join(privateRoot, "cache", cache);
+        mkdirSync2(source);
+        mounts.push({
+          source,
+          target: `/workspace/node_modules/${cache}`,
+          writable: true
+        });
+      }
+    }
+    if (local && stat) {
+      const copyEntry = (name) => {
+        checkCancelled();
+        const source = path2.join(dependencies, name);
+        const destination = path2.join(root, "node_modules", name);
+        if (CACHES.includes(name)) {
+          mkdirSync2(destination, { recursive: true });
+          return;
+        }
+        removeEntry(destination, checkCancelled);
+        const stat2 = lstatSync2(source);
+        if (stat2.isSymbolicLink()) {
+          const resolved = realpathSync(source);
+          const translated = within(canonicalRoot(dependencyOwner), resolved) ? path2.join(root, path2.relative(canonicalRoot(dependencyOwner), resolved)) : resolved;
+          symlinkSync(translated, destination);
+        } else if (stat2.isDirectory() && name.startsWith("@") && !name.includes(path2.sep)) {
+          mkdirSync2(destination);
+          for (const child of readdirSync(source))
+            copyEntry(path2.join(name, child));
+        } else
+          cpSync(source, destination, {
+            recursive: true,
+            filter: () => {
+              checkCancelled();
+              return true;
+            },
+            mode: constants2.COPYFILE_FICLONE,
+            verbatimSymlinks: true
+          });
+      };
+      for (const name of readdirSync(path2.join(privateRoot, "dependencies")))
+        copyEntry(name);
+    }
+    const sources = new Map;
+    const bindings = runnerBindings.map((binding) => {
+      if (local || !binding.mountSource)
+        return { ...binding };
+      const source = path2.resolve(binding.mountSource);
+      const stat2 = lstatSync2(source);
+      const executable = realpathSync(binding.executablePath);
+      if (!stat2.isDirectory() || stat2.isSymbolicLink() || !within(source, executable)) {
+        throw new Error("runner-mount-unavailable");
+      }
+      let target = sources.get(source);
+      if (!target) {
+        target = `/cadence-runners/${sources.size}`;
+        sources.set(source, target);
+        mounts.push({ source, target });
+      }
+      const translate = (file) => path2.posix.join(target, ...path2.relative(source, file).split(path2.sep));
+      return {
+        ...binding,
+        executablePath: translate(executable),
+        ...binding.fixedArgs ? {
+          fixedArgs: binding.fixedArgs.map((arg) => path2.isAbsolute(arg) && within(source, arg) ? translate(arg) : arg)
+        } : {}
+      };
+    });
+    checkCancelled();
+    return {
+      privateRoot,
+      mounts,
+      bindings,
+      reportRoot: local ? privateRoot : "/cadence",
+      environment: {
+        ...local ? Object.fromEntries(profile.inheritEnvironment.flatMap((name) => environment[name] === undefined ? [] : [[name, environment[name] ?? ""]])) : {},
+        CI: "1",
+        HOME: local ? path2.join(privateRoot, "home") : "/cadence/home",
+        XDG_CACHE_HOME: local ? path2.join(privateRoot, "cache") : "/cadence/cache",
+        TMPDIR: local ? path2.join(privateRoot, "tmp") : "/cadence/tmp",
+        npm_config_cache: local ? path2.join(privateRoot, "cache/npm") : "/cadence/cache/npm",
+        npm_config_userconfig: local ? path2.join(privateRoot, "home/user.npmrc") : "/cadence/home/user.npmrc",
+        npm_config_globalconfig: local ? path2.join(privateRoot, "home/global.npmrc") : "/cadence/home/global.npmrc",
+        PATH: [
+          ...new Set([
+            ...bindings.filter((binding) => binding.mountSource),
+            ...bindings.filter((binding) => !binding.mountSource)
+          ].map((binding) => path2.posix.dirname(binding.executablePath))),
+          ...local ? (environment.PATH ?? "").split(path2.delimiter) : [],
+          "/usr/local/bin",
+          "/usr/bin",
+          "/bin"
+        ].join(":")
+      }
+    };
+  } catch (error) {
+    cleanup();
+    throw error;
+  }
+}
+function canonicalRoot(root) {
+  return realpathSync(root);
+}
+function removeEntry(file, checkCancelled) {
+  checkCancelled();
+  const stat = lstatSync2(file, { throwIfNoEntry: false });
+  if (!stat)
+    return;
+  if (stat.isDirectory())
+    for (const name of readdirSync(file))
+      removeEntry(path2.join(file, name), checkCancelled);
+  rmSync(file, { recursive: stat.isDirectory(), force: true });
+}
+
 // src/verification-identity.ts
 import { createHash as createHash2 } from "node:crypto";
 import {
   closeSync as closeSync2,
-  constants as constants2,
+  constants as constants3,
   fstatSync,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   openSync as openSync2,
-  readdirSync,
+  readdirSync as readdirSync2,
   readlinkSync,
   readSync
 } from "node:fs";
-import path2 from "node:path";
+import path3 from "node:path";
 function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
   const digest2 = createHash2("sha256");
   let entries = 0;
@@ -219,7 +430,7 @@ function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
     checkCancelled();
     if (++entries > 500000 || Date.now() - started > 60000)
       throw new Error("verification-environment-limit");
-    const stat = lstatSync2(file, { throwIfNoEntry: false });
+    const stat = lstatSync3(file, { throwIfNoEntry: false });
     digest2.update(JSON.stringify([relative, stat ? stat.mode & 511 : null]));
     if (!stat) {
       digest2.update("absent");
@@ -231,16 +442,16 @@ function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
     }
     if (stat.isDirectory()) {
       digest2.update("directory");
-      for (const name of readdirSync(file).sort()) {
+      for (const name of readdirSync2(file).sort()) {
         if (dependencyRoot && [".vite", ".vite-temp"].includes(name))
           continue;
-        visit(path2.join(file, name), `${relative}/${name}`, false);
+        visit(path3.join(file, name), `${relative}/${name}`, false);
       }
       return;
     }
     if (!stat.isFile())
       throw new Error("verification-environment-unsafe");
-    const fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    const fd = openSync2(file, constants3.O_RDONLY | constants3.O_NOFOLLOW);
     try {
       const before = fstatSync(fd);
       if (before.ino !== stat.ino || before.dev !== stat.dev)
@@ -265,7 +476,7 @@ function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
     }
   };
   for (const root of [...new Set(roots)].sort())
-    visit(root, root, path2.basename(root) === "node_modules");
+    visit(root, root, path3.basename(root) === "node_modules");
   return digest2.digest("hex");
 }
 
@@ -275,17 +486,17 @@ import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   closeSync as closeSync3,
-  constants as constants3,
+  constants as constants4,
   fsyncSync as fsyncSync2,
-  lstatSync as lstatSync4,
-  mkdirSync as mkdirSync2,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync3,
   openSync as openSync3,
   readFileSync as readFileSync2,
   renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 import { promisify } from "node:util";
 
 // src/canonical.ts
@@ -404,15 +615,15 @@ function isValidRelativePath(p) {
 }
 
 // src/safe-path.ts
-import { lstatSync as lstatSync3 } from "node:fs";
-import path3 from "node:path";
+import { lstatSync as lstatSync4 } from "node:fs";
+import path4 from "node:path";
 function observeSafePath(root, relative) {
   if (!isValidRelativePath(relative)) {
     return { kind: "unsafe", reason: "invalid-path" };
   }
   try {
-    const resolvedRoot = path3.resolve(root);
-    const rootStat = lstatSync3(resolvedRoot, { throwIfNoEntry: false });
+    const resolvedRoot = path4.resolve(root);
+    const rootStat = lstatSync4(resolvedRoot, { throwIfNoEntry: false });
     if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
       return { kind: "unsafe", reason: "root-unavailable" };
     }
@@ -421,11 +632,11 @@ function observeSafePath(root, relative) {
     let current = resolvedRoot;
     const parts = relative.split("/");
     for (const [index, part] of parts.entries()) {
-      current = path3.join(current, part);
-      if (!current.startsWith(`${resolvedRoot}${path3.sep}`)) {
+      current = path4.join(current, part);
+      if (!current.startsWith(`${resolvedRoot}${path4.sep}`)) {
         return { kind: "unsafe", reason: "invalid-path" };
       }
-      const stat = lstatSync3(current, { throwIfNoEntry: false });
+      const stat = lstatSync4(current, { throwIfNoEntry: false });
       if (!stat)
         return { kind: "absent" };
       if (stat.isSymbolicLink()) {
@@ -528,7 +739,7 @@ function revisionId(parentRevisionId, manifest) {
   return hash("cadence-workspace-revision", parentRevisionId ?? "", manifest);
 }
 function ensureDirectory2(directory) {
-  const stat = lstatSync4(directory, { throwIfNoEntry: false });
+  const stat = lstatSync5(directory, { throwIfNoEntry: false });
   if (stat) {
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       throw new Error("unsafe-workspace-path");
@@ -536,26 +747,26 @@ function ensureDirectory2(directory) {
     chmodSync2(directory, 448);
     return;
   }
-  let cursor = path4.dirname(directory);
-  while (cursor !== path4.dirname(cursor)) {
-    const ancestor = lstatSync4(cursor, { throwIfNoEntry: false });
+  let cursor = path5.dirname(directory);
+  while (cursor !== path5.dirname(cursor)) {
+    const ancestor = lstatSync5(cursor, { throwIfNoEntry: false });
     if (ancestor) {
       if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
         throw new Error("unsafe-workspace-path");
       }
       break;
     }
-    cursor = path4.dirname(cursor);
+    cursor = path5.dirname(cursor);
   }
-  mkdirSync2(directory, { recursive: true, mode: 448 });
-  const created = lstatSync4(directory);
+  mkdirSync3(directory, { recursive: true, mode: 448 });
+  const created = lstatSync5(directory);
   if (created.isSymbolicLink() || !created.isDirectory()) {
     throw new Error("unsafe-workspace-path");
   }
   chmodSync2(directory, 448);
 }
 function syncDirectory2(directory) {
-  const descriptor = openSync3(directory, constants3.O_RDONLY);
+  const descriptor = openSync3(directory, constants4.O_RDONLY);
   try {
     fsyncSync2(descriptor);
   } finally {
@@ -563,12 +774,12 @@ function syncDirectory2(directory) {
   }
 }
 function writeAtomic2(target, bytes) {
-  const directory = path4.dirname(target);
+  const directory = path5.dirname(target);
   ensureDirectory2(directory);
-  const temporary = path4.join(directory, `.${path4.basename(target)}.${process.pid}.${randomUUID2()}.tmp`);
-  const descriptor = openSync3(temporary, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
+  const temporary = path5.join(directory, `.${path5.basename(target)}.${process.pid}.${randomUUID2()}.tmp`);
+  const descriptor = openSync3(temporary, constants4.O_CREAT | constants4.O_EXCL | constants4.O_WRONLY, 384);
   try {
-    writeFileSync2(descriptor, bytes);
+    writeFileSync3(descriptor, bytes);
     fsyncSync2(descriptor);
   } finally {
     closeSync3(descriptor);
@@ -649,10 +860,10 @@ class WorkspaceStore {
   constructor(root, artifacts, options = {}) {
     this.#checkCancelled = options.checkCancelled ?? (() => {});
     this.#onMetrics = options.onMetrics;
-    if (!path4.isAbsolute(root))
+    if (!path5.isAbsolute(root))
       throw new Error("workspace-store-root-invalid");
-    this.root = path4.resolve(root);
-    this.#revisions = path4.join(this.root, "revisions");
+    this.root = path5.resolve(root);
+    this.#revisions = path5.join(this.root, "revisions");
     this.#artifacts = artifacts;
     ensureDirectory2(this.root);
     ensureDirectory2(this.#revisions);
@@ -660,7 +871,7 @@ class WorkspaceStore {
   #revisionPath(id) {
     if (!SHA2562.test(id))
       throw new Error("workspace-revision-id-invalid");
-    return path4.join(this.#revisions, id.slice(0, 2), `${id}.json`);
+    return path5.join(this.#revisions, id.slice(0, 2), `${id}.json`);
   }
   #storeRevision(parentRevisionId, rawEntries) {
     const entries = stableEntries(rawEntries);
@@ -673,7 +884,7 @@ class WorkspaceStore {
       entries
     };
     const target = this.#revisionPath(id);
-    const existing = lstatSync4(target, { throwIfNoEntry: false });
+    const existing = lstatSync5(target, { throwIfNoEntry: false });
     if (existing) {
       const stored = this.getRevision(id);
       if (JSON.stringify(stored) !== JSON.stringify(revision)) {
@@ -705,8 +916,8 @@ class WorkspaceStore {
     return false;
   }
   captureBaseline(input) {
-    const consumerRoot = path4.resolve(input.consumerRoot);
-    const rootStat = lstatSync4(consumerRoot, { throwIfNoEntry: false });
+    const consumerRoot = path5.resolve(input.consumerRoot);
+    const rootStat = lstatSync5(consumerRoot, { throwIfNoEntry: false });
     if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
       throw new Error("unsafe-workspace-path");
     }
@@ -719,7 +930,7 @@ class WorkspaceStore {
     const timeout = input.gitTimeoutMs ?? 30000;
     if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000)
       throw new Error("workspace-git-timeout-invalid");
-    const consumerRoot = path4.resolve(input.consumerRoot);
+    const consumerRoot = path5.resolve(input.consumerRoot);
     let tracked;
     try {
       tracked = parseNullSeparated(execFileSync("git", ["ls-files", "-z", "--cached"], {
@@ -753,10 +964,10 @@ class WorkspaceStore {
       }
       if (observation.kind !== "file")
         throw new Error("unsafe-workspace-path");
-      const absolute = path4.join(consumerRoot, ...relative.split("/"));
+      const absolute = path5.join(consumerRoot, ...relative.split("/"));
       const bytes = readFileSync2(absolute);
       const artifact = this.#artifacts.put(bytes);
-      const stat = lstatSync4(absolute);
+      const stat = lstatSync5(absolute);
       entries[relative] = {
         kind: "file",
         hash: artifact.hash,
@@ -777,7 +988,7 @@ class WorkspaceStore {
   }
   getRevision(id) {
     const target = this.#revisionPath(id);
-    const stat = lstatSync4(target, { throwIfNoEntry: false });
+    const stat = lstatSync5(target, { throwIfNoEntry: false });
     if (!stat?.isFile() || stat.isSymbolicLink()) {
       throw new Error("workspace-revision-unavailable");
     }
@@ -856,7 +1067,7 @@ class WorkspaceStore {
   }
   materialize(revisionIdValue, destination) {
     const revision = this.getRevision(revisionIdValue);
-    const root = path4.resolve(destination);
+    const root = path5.resolve(destination);
     ensureDirectory2(root);
     for (const [relative, entry] of Object.entries(revision.entries)) {
       this.#checkCancelled();
@@ -875,10 +1086,10 @@ class WorkspaceStore {
       const segments = relative.split("/");
       let parent = root;
       for (const segment of segments.slice(0, -1)) {
-        parent = path4.join(parent, segment);
+        parent = path5.join(parent, segment);
         ensureDirectory2(parent);
       }
-      const target = path4.join(root, ...segments);
+      const target = path5.join(root, ...segments);
       if (observation.kind !== "absent") {
         throw new Error("workspace-materialize-conflict");
       }
@@ -890,8 +1101,8 @@ class WorkspaceStore {
   }
   async captureBaselineWithGit(input, signal) {
     signal?.throwIfAborted();
-    const consumerRoot = path4.resolve(input.consumerRoot);
-    const stat = lstatSync4(consumerRoot, { throwIfNoEntry: false });
+    const consumerRoot = path5.resolve(input.consumerRoot);
+    const stat = lstatSync5(consumerRoot, { throwIfNoEntry: false });
     if (!stat?.isDirectory() || stat.isSymbolicLink())
       throw new Error("unsafe-workspace-path");
     const excluded = [".git", "node_modules", ...input.excludedPaths ?? []];
@@ -951,7 +1162,14 @@ var checkCancelled = () => {
     throw new Error("cancelled");
 };
 try {
-  if (workerData.operation === "verificationIdentity") {
+  if (workerData.operation === "prepareVerification") {
+    const [root, owner, bindings, profile, environment, scratch] = workerData.args;
+    const result = prepareVerificationEnvironmentIo(root, owner, bindings, profile, environment, checkCancelled, scratch);
+    parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
+  } else if (workerData.operation === "cleanupVerification") {
+    rmSync2(workerData.args[0], { recursive: true, force: true });
+    parentPort.postMessage({ ok: true, files: 0, bytes: 0 });
+  } else if (workerData.operation === "verificationIdentity") {
     const result = verificationEnvironmentDigest(workerData.args[0], checkCancelled);
     parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
   } else {

package/src/workspace-io.ts

@@ -1,7 +1,12 @@
 import { Worker } from "node:worker_threads";
 
 export interface WorkspaceIoMetrics {
-  operation: "captureBaseline" | "materialize" | "verificationIdentity";
+  operation:
+    | "captureBaseline"
+    | "materialize"
+    | "verificationIdentity"
+    | "prepareVerification"
+    | "cleanupVerification";
   elapsedMs: number;
   files: number;
   bytes: number;