@abelxiaoxing/cadence 1.8.3 → 2.0.0

package/src/verification-environment-io.ts

@@ -1,389 +0,0 @@
-import {
-  constants,
-  cpSync,
-  lstatSync,
-  mkdirSync,
-  readdirSync,
-  readlinkSync,
-  realpathSync,
-  symlinkSync,
-  writeFileSync,
-} from "node:fs";
-import path from "node:path";
-import type { ExecutionProfile } from "./execution-profile.ts";
-import type { IsolationMount } from "./isolation-backend.ts";
-import { removePathSync } from "./remove-path.ts";
-import type { VerificationRunnerBinding } from "./verification-capability.ts";
-
-const CACHES = [".vite", ".vite-temp"];
-function within(root: string, candidate: string): boolean {
-  const relative = path.relative(root, candidate);
-  return (
-    relative !== ".." &&
-    !relative.startsWith(`..${path.sep}`) &&
-    !path.isAbsolute(relative)
-  );
-}
-
-/** A disposable dependency view: immutable packages and independently writable caches. */
-export function prepareVerificationEnvironmentIo(
-  root: string,
-  dependencyOwner: string,
-  runnerBindings: readonly VerificationRunnerBinding[],
-  profile: ExecutionProfile,
-  environment: NodeJS.ProcessEnv,
-  checkCancelled: () => void,
-  privateRoot: string,
-) {
-  const cleanup = () =>
-    removePathSync(privateRoot, { recursive: true, force: true });
-  try {
-    const local = profile.mode !== "isolated";
-    const native = profile.mode === "host-trusted";
-    if (local && realpathSync(root) === realpathSync(dependencyOwner))
-      throw new Error("trusted-candidate-required");
-    const mounts: IsolationMount[] = [
-      { source: privateRoot, target: "/cadence", writable: true },
-    ];
-    for (const directory of [
-      "home",
-      "cache",
-      "tmp",
-      "reports",
-      "dependencies",
-    ]) {
-      mkdirSync(path.join(privateRoot, directory), { mode: 0o700 });
-    }
-    if (native) {
-      mkdirSync(path.join(privateRoot, "home/AppData/Roaming"), {
-        recursive: true,
-      });
-      mkdirSync(path.join(privateRoot, "home/AppData/Local"), {
-        recursive: true,
-      });
-    }
-    writeFileSync(path.join(privateRoot, "home/user.npmrc"), "");
-    writeFileSync(path.join(privateRoot, "home/global.npmrc"), "");
-    const dependencies = path.join(dependencyOwner, "node_modules");
-    const stat = lstatSync(dependencies, { throwIfNoEntry: false });
-    if (stat && !native) {
-      const target = path.join(root, "node_modules");
-      const targetStat = lstatSync(target, { throwIfNoEntry: false });
-      if (
-        !stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        (targetStat &&
-          (!targetStat.isDirectory() || targetStat.isSymbolicLink()))
-      ) {
-        throw new Error("dependency-path-unsafe");
-      }
-      if (!targetStat) mkdirSync(target, { mode: 0o700 });
-      const view = path.join(privateRoot, "dependencies");
-      mounts.push({ source: view, target: "/workspace/node_modules" });
-      const entries = readdirSync(dependencies);
-      if (entries.length > 20_000) throw new Error("dependency-view-too-large");
-      const canonical = realpathSync(dependencies);
-      let viewEntries = 0;
-      const projectEntry = (name: string) => {
-        checkCancelled();
-        if (++viewEntries > 20_000)
-          throw new Error("dependency-view-too-large");
-        if (CACHES.includes(name)) return;
-        const source = path.join(dependencies, name);
-        const placeholder = path.join(view, name);
-        const entry = lstatSync(source);
-        if (entry.isSymbolicLink()) {
-          const resolved = realpathSync(source);
-          if (within(canonical, resolved)) {
-            symlinkSync(
-              path.relative(path.dirname(source), resolved),
-              placeholder,
-            );
-          } else if (within(realpathSync(dependencyOwner), resolved)) {
-            const relative = path.relative(
-              realpathSync(dependencyOwner),
-              resolved,
-            );
-            const candidate = path.join(root, relative);
-            if (!lstatSync(candidate, { throwIfNoEntry: false }))
-              throw new Error("workspace-dependency-missing");
-            symlinkSync(
-              local
-                ? candidate
-                : `/workspace/${relative.split(path.sep).join("/")}`,
-              placeholder,
-            );
-          } else throw new Error("dependency-path-unsafe");
-        } else if (
-          entry.isDirectory() &&
-          name.startsWith("@") &&
-          !name.includes(path.sep)
-        ) {
-          mkdirSync(placeholder);
-          for (const child of readdirSync(source))
-            projectEntry(path.join(name, child));
-        } else {
-          if (entry.isDirectory()) mkdirSync(placeholder);
-          else if (entry.isFile()) writeFileSync(placeholder, "");
-          else throw new Error("dependency-path-unsafe");
-          mounts.push({
-            source,
-            target: `/workspace/node_modules/${name.split(path.sep).join("/")}`,
-          });
-        }
-      };
-      for (const name of entries) projectEntry(name);
-      for (const cache of CACHES) {
-        mkdirSync(path.join(view, cache));
-        const source = path.join(privateRoot, "cache", cache);
-        mkdirSync(source);
-        mounts.push({
-          source,
-          target: `/workspace/node_modules/${cache}`,
-          writable: true,
-        });
-      }
-    }
-    if (local && stat && !native) {
-      // Private copies keep package caches/writes away from consumer dependencies.
-      const copyEntry = (name: string) => {
-        checkCancelled();
-        const source = path.join(dependencies, name);
-        const destination = path.join(root, "node_modules", name);
-        if (CACHES.includes(name)) {
-          mkdirSync(destination, { recursive: true });
-          return;
-        }
-        removeEntry(destination, checkCancelled);
-        const stat = lstatSync(source);
-        if (stat.isSymbolicLink()) {
-          const resolved = realpathSync(source);
-          const translated = within(canonicalRoot(dependencyOwner), resolved)
-            ? path.join(
-                root,
-                path.relative(canonicalRoot(dependencyOwner), resolved),
-              )
-            : resolved;
-          symlinkSync(translated, destination);
-        } else if (
-          stat.isDirectory() &&
-          name.startsWith("@") &&
-          !name.includes(path.sep)
-        ) {
-          mkdirSync(destination);
-          for (const child of readdirSync(source))
-            copyEntry(path.join(name, child));
-        } else
-          cpSync(source, destination, {
-            recursive: true,
-            filter: () => {
-              checkCancelled();
-              return true;
-            },
-            mode: constants.COPYFILE_FICLONE,
-            verbatimSymlinks: true,
-          });
-      };
-      for (const name of readdirSync(path.join(privateRoot, "dependencies")))
-        copyEntry(name);
-    }
-
-    if (native && stat) {
-      const target = path.join(root, "node_modules");
-      const targetStat = lstatSync(target, { throwIfNoEntry: false });
-      if (
-        !stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        (targetStat &&
-          (!targetStat.isDirectory() || targetStat.isSymbolicLink()))
-      )
-        throw new Error("dependency-path-unsafe");
-      const owner = realpathSync(dependencyOwner);
-      let count = 0;
-      const copy = (source: string, destination: string) => {
-        checkCancelled();
-        if (++count > 500_000) throw new Error("dependency-view-too-large");
-        const entry = lstatSync(source);
-        if (entry.isSymbolicLink()) {
-          const resolved = realpathSync(source);
-          if (!within(owner, resolved))
-            throw new Error("dependency-path-unsafe");
-          const candidate = path.join(root, path.relative(owner, resolved));
-          if (
-            !within(realpathSync(dependencies), resolved) &&
-            !lstatSync(candidate, { throwIfNoEntry: false })
-          )
-            throw new Error("workspace-dependency-missing");
-          const linked = lstatSync(resolved);
-          if (linked.isDirectory()) {
-            // Junctions do not require Windows Developer Mode/admin privileges.
-            symlinkSync(
-              candidate,
-              destination,
-              process.platform === "win32" ? "junction" : "dir",
-            );
-          } else if (linked.isFile()) {
-            const file = within(realpathSync(dependencies), resolved)
-              ? resolved
-              : candidate;
-            cpSync(file, destination, { mode: constants.COPYFILE_FICLONE });
-          } else throw new Error("dependency-path-unsafe");
-        } else if (entry.isDirectory()) {
-          mkdirSync(destination, { recursive: true });
-          for (const name of readdirSync(source)) {
-            if (source === dependencies && CACHES.includes(name)) {
-              mkdirSync(path.join(destination, name));
-              continue;
-            }
-            copy(path.join(source, name), path.join(destination, name));
-          }
-        } else if (entry.isFile())
-          cpSync(source, destination, { mode: constants.COPYFILE_FICLONE });
-        else throw new Error("dependency-path-unsafe");
-      };
-      removeEntry(target, checkCancelled);
-      copy(dependencies, target);
-    }
-    const sources = new Map<string, string>();
-    const bindings = runnerBindings.map((binding) => {
-      if (native) {
-        const translate = (value: string) =>
-          path.isAbsolute(value) && within(dependencyOwner, value)
-            ? path.join(root, path.relative(dependencyOwner, value))
-            : value;
-        return {
-          ...binding,
-          executablePath: translate(binding.executablePath),
-          ...(binding.fixedArgs
-            ? { fixedArgs: binding.fixedArgs.map(translate) }
-            : {}),
-        };
-      }
-      if (local || !binding.mountSource) return { ...binding };
-      const source = path.resolve(binding.mountSource);
-      const stat = lstatSync(source);
-      const executable = realpathSync(binding.executablePath);
-      if (
-        !stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        !within(source, executable)
-      ) {
-        throw new Error("runner-mount-unavailable");
-      }
-      let target = sources.get(source);
-      if (!target) {
-        target = `/cadence-runners/${sources.size}`;
-        sources.set(source, target);
-        mounts.push({ source, target });
-      }
-      const translate = (file: string) =>
-        path.posix.join(target, ...path.relative(source, file).split(path.sep));
-      return {
-        ...binding,
-        // Preserve an installation's relative launcher link (e.g. bin/npm).
-        // Exposing lib/node_modules/npm/bin on PATH selects npm's Windows
-        // installer shell shim during a nested `npm run` on Linux.
-        executablePath: translate(
-          lstatSync(binding.executablePath).isSymbolicLink() &&
-            !path.isAbsolute(readlinkSync(binding.executablePath))
-            ? binding.executablePath
-            : executable,
-        ),
-        ...(binding.fixedArgs
-          ? {
-              fixedArgs: binding.fixedArgs.map((arg) =>
-                path.isAbsolute(arg) && within(source, arg)
-                  ? translate(arg)
-                  : arg,
-              ),
-            }
-          : {}),
-      };
-    });
-    checkCancelled();
-    return {
-      privateRoot,
-      mounts: native ? [] : mounts,
-      bindings,
-      reportRoot: local ? privateRoot : "/cadence",
-      environment: {
-        ...(local
-          ? Object.fromEntries(
-              profile.inheritEnvironment.flatMap((name) =>
-                environment[name] === undefined
-                  ? []
-                  : [[name, environment[name] ?? ""]],
-              ),
-            )
-          : {}),
-        ...(native
-          ? Object.fromEntries(
-              Object.entries(environment).filter(([key]) =>
-                ["SYSTEMROOT", "WINDIR", "COMSPEC", "PATHEXT"].includes(
-                  key.toUpperCase(),
-                ),
-              ),
-            )
-          : {}),
-        ...(native
-          ? {
-              USERPROFILE: path.join(privateRoot, "home"),
-              APPDATA: path.join(privateRoot, "home", "AppData", "Roaming"),
-              LOCALAPPDATA: path.join(privateRoot, "home", "AppData", "Local"),
-              TEMP: path.join(privateRoot, "tmp"),
-              TMP: path.join(privateRoot, "tmp"),
-            }
-          : {}),
-        CI: "1",
-        HOME: local ? path.join(privateRoot, "home") : "/cadence/home",
-        XDG_CACHE_HOME: local
-          ? path.join(privateRoot, "cache")
-          : "/cadence/cache",
-        TMPDIR: local ? path.join(privateRoot, "tmp") : "/cadence/tmp",
-        npm_config_cache: local
-          ? path.join(privateRoot, "cache/npm")
-          : "/cadence/cache/npm",
-        npm_config_userconfig: local
-          ? path.join(privateRoot, "home/user.npmrc")
-          : "/cadence/home/user.npmrc",
-        npm_config_globalconfig: local
-          ? path.join(privateRoot, "home/global.npmrc")
-          : "/cadence/home/global.npmrc",
-        PATH: [
-          ...new Set(
-            // Honor explicitly resolved private runtimes before system fallbacks.
-            [
-              ...bindings.filter((binding) => binding.mountSource),
-              ...bindings.filter((binding) => !binding.mountSource),
-            ].map((binding) =>
-              (local ? path : path.posix).dirname(binding.executablePath),
-            ),
-          ),
-          ...(local ? (environment.PATH ?? "").split(path.delimiter) : []),
-          ...(native ? [] : ["/usr/local/bin", "/usr/bin", "/bin"]),
-        ].join(local ? path.delimiter : ":"),
-      },
-    };
-  } catch (error) {
-    cleanup();
-    throw error;
-  }
-}
-
-function canonicalRoot(root: string): string {
-  return realpathSync(root);
-}
-
-/** Per-entry cancellation, including replacement of an earlier dependency view. */
-function removeEntry(file: string, checkCancelled: () => void): void {
-  checkCancelled();
-  const stat = lstatSync(file, { throwIfNoEntry: false });
-  if (!stat) return;
-  if (stat.isDirectory() && !stat.isSymbolicLink())
-    for (const name of readdirSync(file))
-      removeEntry(path.join(file, name), checkCancelled);
-  removePathSync(file, {
-    recursive: stat.isDirectory() && !stat.isSymbolicLink(),
-    force: true,
-  });
-}

package/src/verification-environment.ts

@@ -1,162 +0,0 @@
-import { createHash } from "node:crypto";
-import { realpathSync } from "node:fs";
-import { mkdtemp } from "node:fs/promises";
-import path from "node:path";
-import {
-  type StructuredVerificationContract,
-  VERIFICATION_CONFIGURATION_PATHS,
-} from "./contracts.ts";
-import { executionProfile } from "./execution-profile.ts";
-import {
-  resolveVerificationRunner,
-  type VerificationRunnerBinding,
-  validateVerificationAdapterCapability,
-  verificationRunnerFiles,
-} from "./verification-capability.ts";
-import type { prepareVerificationEnvironmentIo } from "./verification-environment-io.ts";
-import type { WorkspaceIoMetrics } from "./workspace-io.ts";
-import { runWorkspaceIo } from "./workspace-io.ts";
-
-export async function captureVerificationEnvironmentIdentity(
-  dependencyOwner: string,
-  verifications: readonly StructuredVerificationContract[],
-  signal?: AbortSignal,
-): Promise<string> {
-  const roots = [path.join(dependencyOwner, "node_modules")];
-  const unavailable: string[] = [];
-  const profile = executionProfile();
-  if (profile.mode === "host-trusted")
-    roots.push(
-      path.resolve(profile.windowsHelperPath ?? ""),
-      path.resolve(`${profile.windowsHelperPath}.json`),
-    );
-  else roots.push(path.resolve(profile.bwrapPath));
-  if (
-    profile.mode === "host-trusted" &&
-    process.env.ComSpec &&
-    path.isAbsolute(process.env.ComSpec)
-  )
-    roots.push(process.env.ComSpec);
-  const node = resolveVerificationRunner("node");
-  if (node) roots.push(realpathSync(node.executablePath));
-  for (const verification of verifications) {
-    // Identity describes installed tools; admission/execution separately owns config authorization.
-    const capability = validateVerificationAdapterCapability(
-      dependencyOwner,
-      verification,
-      { executionWritePaths: VERIFICATION_CONFIGURATION_PATHS },
-    );
-    if (!capability.ok) {
-      if (
-        ![
-          "runner-missing",
-          "local-executable-missing",
-          "script-missing",
-          "script-command-mismatch",
-          "verification-config-mismatch",
-        ].includes(capability.diagnostic.code)
-      )
-        throw new Error("verification-environment-unavailable");
-      // Missing task capabilities are observable identities. The exact adapter
-      // still rejects that task; independent tasks may use their own runners.
-      unavailable.push(capability.diagnostic.code);
-      continue;
-    }
-    roots.push(
-      ...verificationRunnerFiles(
-        dependencyOwner,
-        verification,
-        capability.runnerBindings,
-      ),
-    );
-    for (const binding of capability.runnerBindings)
-      if (binding.mountSource) roots.push(binding.mountSource);
-  }
-  const installed = await runWorkspaceIo<string>({
-    root: dependencyOwner,
-    artifactRoot: dependencyOwner,
-    operation: "verificationIdentity",
-    args: [roots],
-    signal,
-  });
-  return createHash("sha256")
-    .update(installed)
-    .update(JSON.stringify(unavailable.sort()))
-    .update(JSON.stringify(profile))
-    .update(
-      profile.mode === "host-trusted"
-        ? JSON.stringify([
-            process.platform,
-            process.arch,
-            process.versions.node,
-            ["PATH", "SystemRoot", "WINDIR", "ComSpec", "PATHEXT"].map(
-              (name) => [name, process.env[name] ?? null],
-            ),
-          ])
-        : "",
-    )
-    .update(
-      JSON.stringify(
-        profile.inheritEnvironment.map((name) => [
-          name,
-          process.env[name] ?? null,
-        ]),
-      ),
-    )
-    .digest("hex");
-}
-
-/** All dependency traversal/copy/removal runs outside the host event loop. */
-export async function prepareVerificationEnvironment(
-  root: string,
-  dependencyOwner: string,
-  runnerBindings: readonly VerificationRunnerBinding[],
-  signal?: AbortSignal,
-  onMetrics?: (metrics: WorkspaceIoMetrics) => void,
-) {
-  signal?.throwIfAborted();
-  const profile = executionProfile();
-  const privateRoot = await mkdtemp(
-    path.join(path.dirname(root), ".cadence-verification-"),
-  );
-  const cleanup = () =>
-    runWorkspaceIo<void>({
-      root,
-      artifactRoot: root,
-      operation: "cleanupVerification",
-      args: [privateRoot],
-    });
-  try {
-    const prepared = await runWorkspaceIo<
-      ReturnType<typeof prepareVerificationEnvironmentIo>
-    >({
-      root,
-      artifactRoot: root,
-      operation: "prepareVerification",
-      args: [
-        root,
-        dependencyOwner,
-        runnerBindings,
-        profile,
-        Object.fromEntries(
-          [
-            "PATH",
-            ...(profile.mode === "host-trusted"
-              ? ["SystemRoot", "WINDIR", "ComSpec", "PATHEXT"]
-              : []),
-            ...profile.inheritEnvironment,
-          ].flatMap((name) =>
-            process.env[name] === undefined ? [] : [[name, process.env[name]]],
-          ),
-        ),
-        privateRoot,
-      ],
-      signal,
-      onMetrics,
-    });
-    return { ...prepared, cleanup };
-  } catch (error) {
-    await cleanup();
-    throw error;
-  }
-}

package/src/verification-identity.ts

@@ -1,77 +0,0 @@
-import { createHash } from "node:crypto";
-import {
-  closeSync,
-  constants,
-  fstatSync,
-  lstatSync,
-  openSync,
-  readdirSync,
-  readlinkSync,
-  readSync,
-} from "node:fs";
-import path from "node:path";
-
-/** Content identity, including executable modes and links. Never follows dependency links. */
-export function verificationEnvironmentDigest(
-  roots: readonly string[],
-  checkCancelled: () => void = () => {},
-) {
-  const digest = createHash("sha256");
-  let entries = 0;
-  let bytes = 0;
-  const started = Date.now();
-  const buffer = Buffer.alloc(256 * 1024);
-  const visit = (file: string, relative: string, dependencyRoot: boolean) => {
-    checkCancelled();
-    if (++entries > 500_000 || Date.now() - started > 60_000)
-      throw new Error("verification-environment-limit");
-    const stat = lstatSync(file, { throwIfNoEntry: false });
-    digest.update(JSON.stringify([relative, stat ? stat.mode & 0o777 : null]));
-    if (!stat) {
-      digest.update("absent");
-      return;
-    }
-    if (stat.isSymbolicLink()) {
-      digest.update(JSON.stringify(["link", readlinkSync(file)]));
-      return;
-    }
-    if (stat.isDirectory()) {
-      digest.update("directory");
-      for (const name of readdirSync(file).sort()) {
-        if (dependencyRoot && [".vite", ".vite-temp"].includes(name)) continue;
-        visit(path.join(file, name), `${relative}/${name}`, false);
-      }
-      return;
-    }
-    if (!stat.isFile()) throw new Error("verification-environment-unsafe");
-    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-      const before = fstatSync(fd);
-      if (before.ino !== stat.ino || before.dev !== stat.dev)
-        throw new Error("verification-environment-changed");
-      const content = createHash("sha256");
-      for (;;) {
-        const count = readSync(fd, buffer, 0, buffer.length, null);
-        if (count === 0) break;
-        checkCancelled();
-        bytes += count;
-        if (bytes > 16 * 1024 ** 3 || Date.now() - started > 60_000)
-          throw new Error("verification-environment-limit");
-        content.update(buffer.subarray(0, count));
-      }
-      const after = fstatSync(fd);
-      if (
-        before.size !== after.size ||
-        before.mtimeMs !== after.mtimeMs ||
-        before.ctimeMs !== after.ctimeMs
-      )
-        throw new Error("verification-environment-changed");
-      digest.update(JSON.stringify(["file", content.digest("hex")]));
-    } finally {
-      closeSync(fd);
-    }
-  };
-  for (const root of [...new Set(roots)].sort())
-    visit(root, root, path.basename(root) === "node_modules");
-  return digest.digest("hex");
-}

package/src/verification-scan.ts

@@ -1,64 +0,0 @@
-/** Only callers admitted before I/O begins share a scan. A later currentness check
- * must observe bytes after its own admission, not join an older in-flight scan.
- * Last cancellation drains
- * the worker before returning; a cancelled scan never admits a new subscriber. */
-export function coalesceVerificationScans<P>(
-  scan: (plan: P, signal: AbortSignal) => Promise<string>,
-) {
-  type Pending = {
-    controller: AbortController;
-    promise: Promise<string>;
-    subscribers: number;
-    started: boolean;
-  };
-  const pending = new Map<string, Pending>();
-  return (plan: P, signal?: AbortSignal): Promise<string> => {
-    signal?.throwIfAborted();
-    const key = JSON.stringify(plan);
-    let entry = pending.get(key);
-    if (!entry || entry.started || entry.controller.signal.aborted) {
-      const controller = new AbortController();
-      const created: Pending = {
-        controller,
-        subscribers: 0,
-        started: false,
-        promise: Promise.resolve(""),
-      };
-      created.promise = Promise.resolve()
-        .then(() => {
-          created.started = true;
-          return scan(plan, controller.signal);
-        })
-        .finally(() => {
-          if (pending.get(key) === created) pending.delete(key);
-        });
-      entry = created;
-      pending.set(key, entry);
-    }
-    const shared = entry;
-    shared.subscribers++;
-    return new Promise((resolve, reject) => {
-      let cancelled = false;
-      const abort = () => {
-        if (cancelled) return;
-        cancelled = true;
-        if (--shared.subscribers === 0) shared.controller.abort(signal?.reason);
-      };
-      signal?.addEventListener("abort", abort, { once: true });
-      if (signal?.aborted) abort();
-      const settle = (value?: string, error?: unknown) => {
-        signal?.removeEventListener("abort", abort);
-        if (!cancelled) shared.subscribers--;
-        if (cancelled)
-          reject(signal?.reason ?? new DOMException("cancelled", "AbortError"));
-        else if (error !== undefined) reject(error);
-        else if (value !== undefined) resolve(value);
-        else reject(new Error("verification-scan-result-unavailable"));
-      };
-      shared.promise.then(
-        (value) => settle(value),
-        (error) => settle(undefined, error),
-      );
-    });
-  };
-}