@abelxiaoxing/cadence 1.4.1 → 1.5.1

package/src/verification-environment.ts

@@ -1,26 +1,20 @@
-import {
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readdirSync,
-  readlinkSync,
-  realpathSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { mkdtemp } from "node:fs/promises";
 import path from "node:path";
 import {
   type StructuredVerificationContract,
   VERIFICATION_CONFIGURATION_PATHS,
 } from "./contracts.ts";
-import type { IsolationMount } from "./isolation-backend.ts";
+import { executionProfile } from "./execution-profile.ts";
 import {
   resolveVerificationRunner,
   type VerificationRunnerBinding,
   validateVerificationAdapterCapability,
   verificationRunnerFiles,
 } from "./verification-capability.ts";
+import type { prepareVerificationEnvironmentIo } from "./verification-environment-io.ts";
+import type { WorkspaceIoMetrics } from "./workspace-io.ts";
 import { runWorkspaceIo } from "./workspace-io.ts";
 
 export async function captureVerificationEnvironmentIdentity(
@@ -49,165 +43,73 @@ export async function captureVerificationEnvironmentIdentity(
     for (const binding of capability.runnerBindings)
       if (binding.mountSource) roots.push(binding.mountSource);
   }
-  return runWorkspaceIo<string>({
+  const installed = await runWorkspaceIo<string>({
     root: dependencyOwner,
     artifactRoot: dependencyOwner,
     operation: "verificationIdentity",
     args: [roots],
     signal,
   });
+  const profile = executionProfile();
+  return createHash("sha256")
+    .update(installed)
+    .update(JSON.stringify(profile))
+    .update(
+      JSON.stringify(
+        profile.inheritEnvironment.map((name) => [
+          name,
+          process.env[name] ?? null,
+        ]),
+      ),
+    )
+    .digest("hex");
 }
 
-const CACHES = [".vite", ".vite-temp"];
-function within(root: string, candidate: string): boolean {
-  const relative = path.relative(root, candidate);
-  return (
-    relative !== ".." &&
-    !relative.startsWith(`..${path.sep}`) &&
-    !path.isAbsolute(relative)
-  );
-}
-
-/** A disposable dependency view: immutable packages and independently writable caches. */
-export function prepareVerificationEnvironment(
+/** All dependency traversal/copy/removal runs outside the host event loop. */
+export async function prepareVerificationEnvironment(
   root: string,
   dependencyOwner: string,
   runnerBindings: readonly VerificationRunnerBinding[],
+  signal?: AbortSignal,
+  onMetrics?: (metrics: WorkspaceIoMetrics) => void,
 ) {
-  const privateRoot = mkdtempSync(
+  signal?.throwIfAborted();
+  const profile = executionProfile();
+  const privateRoot = await mkdtemp(
     path.join(path.dirname(root), ".cadence-verification-"),
   );
-  const cleanup = () => rmSync(privateRoot, { recursive: true, force: true });
-  try {
-    const mounts: IsolationMount[] = [
-      { source: privateRoot, target: "/cadence", writable: true },
-    ];
-    for (const directory of [
-      "home",
-      "cache",
-      "tmp",
-      "reports",
-      "dependencies",
-    ]) {
-      mkdirSync(path.join(privateRoot, directory), { mode: 0o700 });
-    }
-    writeFileSync(path.join(privateRoot, "home/user.npmrc"), "");
-    writeFileSync(path.join(privateRoot, "home/global.npmrc"), "");
-    const dependencies = path.join(dependencyOwner, "node_modules");
-    const stat = lstatSync(dependencies, { throwIfNoEntry: false });
-    if (stat) {
-      const target = path.join(root, "node_modules");
-      const targetStat = lstatSync(target, { throwIfNoEntry: false });
-      if (
-        !stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        (targetStat &&
-          (!targetStat.isDirectory() || targetStat.isSymbolicLink()))
-      ) {
-        throw new Error("dependency-path-unsafe");
-      }
-      if (!targetStat) mkdirSync(target, { mode: 0o700 });
-      const view = path.join(privateRoot, "dependencies");
-      mounts.push({ source: view, target: "/workspace/node_modules" });
-      const entries = readdirSync(dependencies);
-      if (entries.length > 20_000) throw new Error("dependency-view-too-large");
-      const canonical = realpathSync(dependencies);
-      for (const name of entries) {
-        if (CACHES.includes(name)) continue;
-        const source = path.join(dependencies, name);
-        const placeholder = path.join(view, name);
-        const entry = lstatSync(source);
-        if (entry.isSymbolicLink()) {
-          const link = readlinkSync(source);
-          if (
-            path.isAbsolute(link) ||
-            !within(canonical, realpathSync(source))
-          ) {
-            throw new Error("dependency-path-unsafe");
-          }
-          symlinkSync(link, placeholder);
-        } else {
-          if (entry.isDirectory()) mkdirSync(placeholder);
-          else if (entry.isFile()) writeFileSync(placeholder, "");
-          else throw new Error("dependency-path-unsafe");
-          mounts.push({ source, target: `/workspace/node_modules/${name}` });
-        }
-      }
-      for (const cache of CACHES) {
-        mkdirSync(path.join(view, cache));
-        const source = path.join(privateRoot, "cache", cache);
-        mkdirSync(source);
-        mounts.push({
-          source,
-          target: `/workspace/node_modules/${cache}`,
-          writable: true,
-        });
-      }
-    }
-    const sources = new Map<string, string>();
-    const bindings = runnerBindings.map((binding) => {
-      if (!binding.mountSource) return { ...binding };
-      const source = path.resolve(binding.mountSource);
-      const stat = lstatSync(source);
-      const executable = realpathSync(binding.executablePath);
-      if (
-        !stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        !within(source, executable)
-      ) {
-        throw new Error("runner-mount-unavailable");
-      }
-      let target = sources.get(source);
-      if (!target) {
-        target = `/cadence-runners/${sources.size}`;
-        sources.set(source, target);
-        mounts.push({ source, target });
-      }
-      const translate = (file: string) =>
-        path.posix.join(target, ...path.relative(source, file).split(path.sep));
-      return {
-        ...binding,
-        executablePath: translate(executable),
-        ...(binding.fixedArgs
-          ? {
-              fixedArgs: binding.fixedArgs.map((arg) =>
-                path.isAbsolute(arg) && within(source, arg)
-                  ? translate(arg)
-                  : arg,
-              ),
-            }
-          : {}),
-      };
+  const cleanup = () =>
+    runWorkspaceIo<void>({
+      root,
+      artifactRoot: root,
+      operation: "cleanupVerification",
+      args: [privateRoot],
     });
-    return {
-      privateRoot,
-      mounts,
-      bindings,
-      cleanup,
-      environment: {
-        CI: "1",
-        HOME: "/cadence/home",
-        XDG_CACHE_HOME: "/cadence/cache",
-        TMPDIR: "/cadence/tmp",
-        npm_config_cache: "/cadence/cache/npm",
-        npm_config_userconfig: "/cadence/home/user.npmrc",
-        npm_config_globalconfig: "/cadence/home/global.npmrc",
-        PATH: [
-          ...new Set(
-            // Honor explicitly resolved private runtimes before system fallbacks.
-            [
-              ...bindings.filter((binding) => binding.mountSource),
-              ...bindings.filter((binding) => !binding.mountSource),
-            ].map((binding) => path.posix.dirname(binding.executablePath)),
+  try {
+    const prepared = await runWorkspaceIo<
+      ReturnType<typeof prepareVerificationEnvironmentIo>
+    >({
+      root,
+      artifactRoot: root,
+      operation: "prepareVerification",
+      args: [
+        root,
+        dependencyOwner,
+        runnerBindings,
+        profile,
+        Object.fromEntries(
+          ["PATH", ...profile.inheritEnvironment].flatMap((name) =>
+            process.env[name] === undefined ? [] : [[name, process.env[name]]],
           ),
-          "/usr/local/bin",
-          "/usr/bin",
-          "/bin",
-        ].join(":"),
-      },
-    };
+        ),
+        privateRoot,
+      ],
+      signal,
+      onMetrics,
+    });
+    return { ...prepared, cleanup };
   } catch (error) {
-    cleanup();
+    await cleanup();
     throw error;
   }
 }

package/src/verification-scan.ts

@@ -0,0 +1,64 @@
+/** Only callers admitted before I/O begins share a scan. A later currentness check
+ * must observe bytes after its own admission, not join an older in-flight scan.
+ * Last cancellation drains
+ * the worker before returning; a cancelled scan never admits a new subscriber. */
+export function coalesceVerificationScans<P>(
+  scan: (plan: P, signal: AbortSignal) => Promise<string>,
+) {
+  type Pending = {
+    controller: AbortController;
+    promise: Promise<string>;
+    subscribers: number;
+    started: boolean;
+  };
+  const pending = new Map<string, Pending>();
+  return (plan: P, signal?: AbortSignal): Promise<string> => {
+    signal?.throwIfAborted();
+    const key = JSON.stringify(plan);
+    let entry = pending.get(key);
+    if (!entry || entry.started || entry.controller.signal.aborted) {
+      const controller = new AbortController();
+      const created: Pending = {
+        controller,
+        subscribers: 0,
+        started: false,
+        promise: Promise.resolve(""),
+      };
+      created.promise = Promise.resolve()
+        .then(() => {
+          created.started = true;
+          return scan(plan, controller.signal);
+        })
+        .finally(() => {
+          if (pending.get(key) === created) pending.delete(key);
+        });
+      entry = created;
+      pending.set(key, entry);
+    }
+    const shared = entry;
+    shared.subscribers++;
+    return new Promise((resolve, reject) => {
+      let cancelled = false;
+      const abort = () => {
+        if (cancelled) return;
+        cancelled = true;
+        if (--shared.subscribers === 0) shared.controller.abort(signal?.reason);
+      };
+      signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted) abort();
+      const settle = (value?: string, error?: unknown) => {
+        signal?.removeEventListener("abort", abort);
+        if (!cancelled) shared.subscribers--;
+        if (cancelled)
+          reject(signal?.reason ?? new DOMException("cancelled", "AbortError"));
+        else if (error !== undefined) reject(error);
+        else if (value !== undefined) resolve(value);
+        else reject(new Error("verification-scan-result-unavailable"));
+      };
+      shared.promise.then(
+        (value) => settle(value),
+        (error) => settle(undefined, error),
+      );
+    });
+  };
+}

package/src/worker-broker.ts

@@ -178,6 +178,8 @@ function capable(
 function safeFailureCode(error: unknown): string {
   if (error instanceof RouteAttemptStop || error instanceof TransportTimeout)
     return error.code;
+  if (error instanceof Error && error.message === "child-provider-rate-limited")
+    return error.message;
   return "transport-failure";
 }
 

package/src/workspace-io-entry.mjs

@@ -1,5 +1,7 @@
+import { rmSync } from "node:fs";
 import { parentPort, workerData } from "node:worker_threads";
 import { ArtifactStore } from "./artifact-store.ts";
+import { prepareVerificationEnvironmentIo } from "./verification-environment-io.ts";
 import { verificationEnvironmentDigest } from "./verification-identity.ts";
 import { WorkspaceStore } from "./workspace-store.ts";
 
@@ -10,7 +12,23 @@ const checkCancelled = () => {
   if (Atomics.load(flag, 0)) throw new Error("cancelled");
 };
 try {
-  if (workerData.operation === "verificationIdentity") {
+  if (workerData.operation === "prepareVerification") {
+    const [root, owner, bindings, profile, environment, scratch] =
+      workerData.args;
+    const result = prepareVerificationEnvironmentIo(
+      root,
+      owner,
+      bindings,
+      profile,
+      environment,
+      checkCancelled,
+      scratch,
+    );
+    parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
+  } else if (workerData.operation === "cleanupVerification") {
+    rmSync(workerData.args[0], { recursive: true, force: true });
+    parentPort.postMessage({ ok: true, files: 0, bytes: 0 });
+  } else if (workerData.operation === "verificationIdentity") {
     const result = verificationEnvironmentDigest(
       workerData.args[0],
       checkCancelled,