@abelxiaoxing/cadence 1.6.0 → 1.8.0

package/src/verification-environment-io.ts

@@ -4,14 +4,15 @@ import {
   lstatSync,
   mkdirSync,
   readdirSync,
+  readlinkSync,
   realpathSync,
-  rmSync,
   symlinkSync,
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
 import type { ExecutionProfile } from "./execution-profile.ts";
 import type { IsolationMount } from "./isolation-backend.ts";
+import { removePathSync } from "./remove-path.ts";
 import type { VerificationRunnerBinding } from "./verification-capability.ts";
 
 const CACHES = [".vite", ".vite-temp"];
@@ -34,9 +35,11 @@ export function prepareVerificationEnvironmentIo(
   checkCancelled: () => void,
   privateRoot: string,
 ) {
-  const cleanup = () => rmSync(privateRoot, { recursive: true, force: true });
+  const cleanup = () =>
+    removePathSync(privateRoot, { recursive: true, force: true });
   try {
-    const local = profile.mode === "local-trusted";
+    const local = profile.mode !== "isolated";
+    const native = profile.mode === "host-trusted";
     if (local && realpathSync(root) === realpathSync(dependencyOwner))
       throw new Error("trusted-candidate-required");
     const mounts: IsolationMount[] = [
@@ -51,11 +54,19 @@ export function prepareVerificationEnvironmentIo(
     ]) {
       mkdirSync(path.join(privateRoot, directory), { mode: 0o700 });
     }
+    if (native) {
+      mkdirSync(path.join(privateRoot, "home/AppData/Roaming"), {
+        recursive: true,
+      });
+      mkdirSync(path.join(privateRoot, "home/AppData/Local"), {
+        recursive: true,
+      });
+    }
     writeFileSync(path.join(privateRoot, "home/user.npmrc"), "");
     writeFileSync(path.join(privateRoot, "home/global.npmrc"), "");
     const dependencies = path.join(dependencyOwner, "node_modules");
     const stat = lstatSync(dependencies, { throwIfNoEntry: false });
-    if (stat) {
+    if (stat && !native) {
       const target = path.join(root, "node_modules");
       const targetStat = lstatSync(target, { throwIfNoEntry: false });
       if (
@@ -133,7 +144,7 @@ export function prepareVerificationEnvironmentIo(
         });
       }
     }
-    if (local && stat) {
+    if (local && stat && !native) {
       // Private copies keep package caches/writes away from consumer dependencies.
       const copyEntry = (name: string) => {
         checkCancelled();
@@ -177,8 +188,77 @@ export function prepareVerificationEnvironmentIo(
         copyEntry(name);
     }
 
+    if (native && stat) {
+      const target = path.join(root, "node_modules");
+      const targetStat = lstatSync(target, { throwIfNoEntry: false });
+      if (
+        !stat.isDirectory() ||
+        stat.isSymbolicLink() ||
+        (targetStat &&
+          (!targetStat.isDirectory() || targetStat.isSymbolicLink()))
+      )
+        throw new Error("dependency-path-unsafe");
+      const owner = realpathSync(dependencyOwner);
+      let count = 0;
+      const copy = (source: string, destination: string) => {
+        checkCancelled();
+        if (++count > 500_000) throw new Error("dependency-view-too-large");
+        const entry = lstatSync(source);
+        if (entry.isSymbolicLink()) {
+          const resolved = realpathSync(source);
+          if (!within(owner, resolved))
+            throw new Error("dependency-path-unsafe");
+          const candidate = path.join(root, path.relative(owner, resolved));
+          if (
+            !within(realpathSync(dependencies), resolved) &&
+            !lstatSync(candidate, { throwIfNoEntry: false })
+          )
+            throw new Error("workspace-dependency-missing");
+          const linked = lstatSync(resolved);
+          if (linked.isDirectory()) {
+            // Junctions do not require Windows Developer Mode/admin privileges.
+            symlinkSync(
+              candidate,
+              destination,
+              process.platform === "win32" ? "junction" : "dir",
+            );
+          } else if (linked.isFile()) {
+            const file = within(realpathSync(dependencies), resolved)
+              ? resolved
+              : candidate;
+            cpSync(file, destination, { mode: constants.COPYFILE_FICLONE });
+          } else throw new Error("dependency-path-unsafe");
+        } else if (entry.isDirectory()) {
+          mkdirSync(destination, { recursive: true });
+          for (const name of readdirSync(source)) {
+            if (source === dependencies && CACHES.includes(name)) {
+              mkdirSync(path.join(destination, name));
+              continue;
+            }
+            copy(path.join(source, name), path.join(destination, name));
+          }
+        } else if (entry.isFile())
+          cpSync(source, destination, { mode: constants.COPYFILE_FICLONE });
+        else throw new Error("dependency-path-unsafe");
+      };
+      removeEntry(target, checkCancelled);
+      copy(dependencies, target);
+    }
     const sources = new Map<string, string>();
     const bindings = runnerBindings.map((binding) => {
+      if (native) {
+        const translate = (value: string) =>
+          path.isAbsolute(value) && within(dependencyOwner, value)
+            ? path.join(root, path.relative(dependencyOwner, value))
+            : value;
+        return {
+          ...binding,
+          executablePath: translate(binding.executablePath),
+          ...(binding.fixedArgs
+            ? { fixedArgs: binding.fixedArgs.map(translate) }
+            : {}),
+        };
+      }
       if (local || !binding.mountSource) return { ...binding };
       const source = path.resolve(binding.mountSource);
       const stat = lstatSync(source);
@@ -200,7 +280,15 @@ export function prepareVerificationEnvironmentIo(
         path.posix.join(target, ...path.relative(source, file).split(path.sep));
       return {
         ...binding,
-        executablePath: translate(executable),
+        // Preserve an installation's relative launcher link (e.g. bin/npm).
+        // Exposing lib/node_modules/npm/bin on PATH selects npm's Windows
+        // installer shell shim during a nested `npm run` on Linux.
+        executablePath: translate(
+          lstatSync(binding.executablePath).isSymbolicLink() &&
+            !path.isAbsolute(readlinkSync(binding.executablePath))
+            ? binding.executablePath
+            : executable,
+        ),
         ...(binding.fixedArgs
           ? {
               fixedArgs: binding.fixedArgs.map((arg) =>
@@ -215,7 +303,7 @@ export function prepareVerificationEnvironmentIo(
     checkCancelled();
     return {
       privateRoot,
-      mounts,
+      mounts: native ? [] : mounts,
       bindings,
       reportRoot: local ? privateRoot : "/cadence",
       environment: {
@@ -228,6 +316,24 @@ export function prepareVerificationEnvironmentIo(
               ),
             )
           : {}),
+        ...(native
+          ? Object.fromEntries(
+              Object.entries(environment).filter(([key]) =>
+                ["SYSTEMROOT", "WINDIR", "COMSPEC", "PATHEXT"].includes(
+                  key.toUpperCase(),
+                ),
+              ),
+            )
+          : {}),
+        ...(native
+          ? {
+              USERPROFILE: path.join(privateRoot, "home"),
+              APPDATA: path.join(privateRoot, "home", "AppData", "Roaming"),
+              LOCALAPPDATA: path.join(privateRoot, "home", "AppData", "Local"),
+              TEMP: path.join(privateRoot, "tmp"),
+              TMP: path.join(privateRoot, "tmp"),
+            }
+          : {}),
         CI: "1",
         HOME: local ? path.join(privateRoot, "home") : "/cadence/home",
         XDG_CACHE_HOME: local
@@ -249,13 +355,13 @@ export function prepareVerificationEnvironmentIo(
             [
               ...bindings.filter((binding) => binding.mountSource),
               ...bindings.filter((binding) => !binding.mountSource),
-            ].map((binding) => path.posix.dirname(binding.executablePath)),
+            ].map((binding) =>
+              (local ? path : path.posix).dirname(binding.executablePath),
+            ),
           ),
           ...(local ? (environment.PATH ?? "").split(path.delimiter) : []),
-          "/usr/local/bin",
-          "/usr/bin",
-          "/bin",
-        ].join(":"),
+          ...(native ? [] : ["/usr/local/bin", "/usr/bin", "/bin"]),
+        ].join(local ? path.delimiter : ":"),
       },
     };
   } catch (error) {
@@ -273,8 +379,11 @@ function removeEntry(file: string, checkCancelled: () => void): void {
   checkCancelled();
   const stat = lstatSync(file, { throwIfNoEntry: false });
   if (!stat) return;
-  if (stat.isDirectory())
+  if (stat.isDirectory() && !stat.isSymbolicLink())
     for (const name of readdirSync(file))
       removeEntry(path.join(file, name), checkCancelled);
-  rmSync(file, { recursive: stat.isDirectory(), force: true });
+  removePathSync(file, {
+    recursive: stat.isDirectory() && !stat.isSymbolicLink(),
+    force: true,
+  });
 }

package/src/verification-environment.ts

@@ -23,6 +23,20 @@ export async function captureVerificationEnvironmentIdentity(
   signal?: AbortSignal,
 ): Promise<string> {
   const roots = [path.join(dependencyOwner, "node_modules")];
+  const unavailable: string[] = [];
+  const profile = executionProfile();
+  if (profile.mode === "host-trusted")
+    roots.push(
+      path.resolve(profile.windowsHelperPath ?? ""),
+      path.resolve(`${profile.windowsHelperPath}.json`),
+    );
+  else roots.push(path.resolve(profile.bwrapPath));
+  if (
+    profile.mode === "host-trusted" &&
+    process.env.ComSpec &&
+    path.isAbsolute(process.env.ComSpec)
+  )
+    roots.push(process.env.ComSpec);
   const node = resolveVerificationRunner("node");
   if (node) roots.push(realpathSync(node.executablePath));
   for (const verification of verifications) {
@@ -32,7 +46,22 @@ export async function captureVerificationEnvironmentIdentity(
       verification,
       { executionWritePaths: VERIFICATION_CONFIGURATION_PATHS },
     );
-    if (!capability.ok) throw new Error("verification-environment-unavailable");
+    if (!capability.ok) {
+      if (
+        ![
+          "runner-missing",
+          "local-executable-missing",
+          "script-missing",
+          "script-command-mismatch",
+          "verification-config-mismatch",
+        ].includes(capability.diagnostic.code)
+      )
+        throw new Error("verification-environment-unavailable");
+      // Missing task capabilities are observable identities. The exact adapter
+      // still rejects that task; independent tasks may use their own runners.
+      unavailable.push(capability.diagnostic.code);
+      continue;
+    }
     roots.push(
       ...verificationRunnerFiles(
         dependencyOwner,
@@ -50,10 +79,22 @@ export async function captureVerificationEnvironmentIdentity(
     args: [roots],
     signal,
   });
-  const profile = executionProfile();
   return createHash("sha256")
     .update(installed)
+    .update(JSON.stringify(unavailable.sort()))
     .update(JSON.stringify(profile))
+    .update(
+      profile.mode === "host-trusted"
+        ? JSON.stringify([
+            process.platform,
+            process.arch,
+            process.versions.node,
+            ["PATH", "SystemRoot", "WINDIR", "ComSpec", "PATHEXT"].map(
+              (name) => [name, process.env[name] ?? null],
+            ),
+          ])
+        : "",
+    )
     .update(
       JSON.stringify(
         profile.inheritEnvironment.map((name) => [
@@ -98,7 +139,13 @@ export async function prepareVerificationEnvironment(
         runnerBindings,
         profile,
         Object.fromEntries(
-          ["PATH", ...profile.inheritEnvironment].flatMap((name) =>
+          [
+            "PATH",
+            ...(profile.mode === "host-trusted"
+              ? ["SystemRoot", "WINDIR", "ComSpec", "PATHEXT"]
+              : []),
+            ...profile.inheritEnvironment,
+          ].flatMap((name) =>
             process.env[name] === undefined ? [] : [[name, process.env[name]]],
           ),
         ),