@async/pipeline 0.1.3 → 0.1.4

package/dist/internal/node/runner.js

@@ -1,10 +1,12 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { availableParallelism } from "node:os";
+import { posix, relative } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { sh, tasksForJob } from "../core/index.js";
-import { computeTaskCacheKey, createStore, readCacheEntry, writeCacheEntry, writeExecution, writeTaskLog } from "./store.js";
+import { computeTaskCacheKey, createStore, outputFilesExist, readCacheEntry, resolveOutputFiles, restoreCacheOutputs, writeCacheEntry, writeExecution, writeTaskLog } from "./store.js";
 import { createRunPlan, sourceContext } from "./sources.js";
-export class HostRunnerAdapter {
+export class HostCommandExecutor {
     name = "host";
     runShell(command, options) {
         return runProcess(command, { cwd: options.cwd, env: options.env, timeoutMs: options.timeoutMs });
@@ -14,94 +16,297 @@ export class HostRunnerAdapter {
         return result.code === 0;
     }
 }
+export class DockerCommandExecutor {
+    options;
+    name = "docker";
+    constructor(options) {
+        this.options = options;
+    }
+    runShell(command, options) {
+        return runProcess(this.dockerCommand(command, options.cwd, options.env), { cwd: this.options.hostCwd, env: options.env, timeoutMs: options.timeoutMs });
+    }
+    async checkTool(tool) {
+        const result = await runProcess(this.dockerCommand(`command -v ${shellEscape(tool)}`, this.options.hostCwd, process.env), {
+            cwd: this.options.hostCwd,
+            env: process.env,
+            echo: false
+        });
+        return result.code === 0;
+    }
+    dockerCommand(command, cwd, env) {
+        return [
+            "docker",
+            "run",
+            "--rm",
+            "-w",
+            shellEscape(this.containerCwd(cwd)),
+            ...this.options.volumes.flatMap((volume) => ["-v", shellEscape(`${volume.source}:${volume.target}${volume.readonly ? ":ro" : ""}`)]),
+            ...Object.keys(env).filter((key) => env[key] !== undefined).flatMap((key) => ["-e", shellEscape(key)]),
+            shellEscape(this.options.image),
+            "bash",
+            "-lc",
+            shellEscape(command)
+        ].join(" ");
+    }
+    containerCwd(cwd) {
+        const rel = relative(this.options.hostCwd, cwd);
+        if (!rel || rel === ".")
+            return this.options.workdir;
+        if (rel.startsWith(".."))
+            return this.options.workdir;
+        return posix.join(this.options.workdir, rel.split(/[\\/]+/).join("/"));
+    }
+}
+export class LimaCommandExecutor {
+    vm;
+    name = "lima";
+    constructor(vm = "async-pipeline") {
+        this.vm = vm;
+    }
+    runShell(command, options) {
+        const vm = options.task.environment?.vm ?? this.vm;
+        const escaped = shellEscape(`cd ${shellEscape(options.cwd)} && ${command}`);
+        return runProcess(`limactl shell ${shellEscape(vm)} -- bash -lc ${escaped}`, { cwd: options.cwd, env: options.env, timeoutMs: options.timeoutMs });
+    }
+    async checkTool(tool) {
+        const result = await runProcess(`limactl shell ${shellEscape(this.vm)} -- bash -lc ${shellEscape(`command -v ${shellEscape(tool)}`)}`, {
+            cwd: process.cwd(),
+            env: process.env
+        });
+        return result.code === 0;
+    }
+}
+export function hostWorkspace(options = {}) {
+    return {
+        cwd: options.cwd ?? process.cwd(),
+        env: options.env ?? process.env,
+        fs: { kind: "host" },
+        executor: options.executor ?? new HostCommandExecutor(),
+        commands: options.commands
+    };
+}
+export function dockerWorkspace(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const workdir = options.workdir ?? "/workspace";
+    return hostWorkspace({
+        cwd,
+        env: options.env,
+        executor: new DockerCommandExecutor({
+            image: options.image,
+            hostCwd: cwd,
+            workdir,
+            volumes: options.volumes ?? [{ source: cwd, target: workdir }]
+        }),
+        commands: options.commands
+    });
+}
+export function limaWorkspace(options = {}) {
+    return hostWorkspace({
+        cwd: options.cwd,
+        env: options.env,
+        executor: new LimaCommandExecutor(options.vm),
+        commands: options.commands
+    });
+}
+export function commandProxy(policy = { rules: [] }) {
+    const records = [];
+    return {
+        async run(invocation, next) {
+            const startedAt = new Date().toISOString();
+            const started = Date.now();
+            const action = matchingAction(policy, invocation.argv);
+            const status = commandStatus(action);
+            const result = await runCommandAction(action, next);
+            const outputPolicy = action.output ?? policy.output ?? {};
+            if (policy.record) {
+                records.push({
+                    argv: [...invocation.argv],
+                    cwd: invocation.cwd,
+                    status,
+                    code: result.code,
+                    stdout: applyOutputPolicy(result.stdout, outputPolicy, invocation.env),
+                    stderr: applyOutputPolicy(result.stderr, outputPolicy, invocation.env),
+                    startedAt,
+                    finishedAt: new Date().toISOString(),
+                    durationMs: Date.now() - started
+                });
+            }
+            return result;
+        },
+        records() {
+            return records.map((record) => ({
+                ...record,
+                argv: [...record.argv]
+            }));
+        }
+    };
+}
 const memoryCacheEntries = new Map();
+const DEFAULT_MAX_CONCURRENCY = 4;
 export async function runJob(pipeline, options) {
-    const adapter = options.adapter ?? new HostRunnerAdapter();
-    const store = await createStore(options.cwd);
-    const plan = await createRunPlan(pipeline, options.cwd, store);
-    const graph = tasksForJob(plan.pipeline, options.jobId);
+    const workspace = options.workspace ?? hostWorkspace();
+    const store = await createStore(workspace.cwd);
+    const plan = await createRunPlan(pipeline, workspace.cwd, store);
+    const graph = tasksForJob(plan.pipeline, options.id);
     const record = {
         id: `${new Date().toISOString().replaceAll(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`,
         pipelineName: plan.pipeline.name,
-        jobId: options.jobId,
-        cwd: options.cwd,
+        jobId: options.id,
+        cwd: workspace.cwd,
         startedAt: new Date().toISOString(),
         status: "running",
-        mode: options.mode ?? "manual",
+        mode: options.mode ?? (workspace.env.CI ? "ci" : "manual"),
         tasks: [],
         sources: Object.fromEntries(Object.entries(plan.sources).map(([sourceId, resolved]) => [sourceId, resolved.record]))
     };
     await writeExecution(store, record);
-    const preparedSources = new Set();
-    const jobDefinition = plan.pipeline.jobs[options.jobId];
+    const jobDefinition = plan.pipeline.jobs[options.id];
     const envDefinitions = {
         ...plan.pipeline.env,
         ...(jobDefinition?.env ?? {})
     };
-    for (const taskId of graph.executionOrder) {
+    const taskFingerprints = new Map();
+    const concurrency = normalizeTaskConcurrency(options.concurrency);
+    const graphIndex = new Map(graph.executionOrder.map((taskId, index) => [taskId, index]));
+    const graphNodes = new Map(graph.tasks.map((node) => [node.id, node]));
+    const runnableTaskIds = graph.executionOrder.filter((taskId) => Boolean(plan.pipeline.tasks[taskId]));
+    const dependencyCounts = new Map();
+    const sourcePrepareOrder = new Map();
+    const recordedResults = new Map();
+    const sourcePreparePromises = new Map();
+    const recordedPrepareSources = new Set();
+    for (const taskId of runnableTaskIds) {
         const taskDefinition = plan.pipeline.tasks[taskId];
-        if (!taskDefinition)
-            continue;
-        const taskSource = taskDefinition.source?.name ? plan.sources[taskDefinition.source.name] : undefined;
-        if (taskSource && !preparedSources.has(taskSource.id)) {
-            const prepareResult = await runSourcePrepare(taskSource, {
-                adapter,
+        if (taskDefinition?.source?.name && !sourcePrepareOrder.has(taskDefinition.source.name)) {
+            sourcePrepareOrder.set(taskDefinition.source.name, (graphIndex.get(taskId) ?? 0) - 0.25);
+        }
+        const node = graphNodes.get(taskId);
+        dependencyCounts.set(taskId, (node?.dependsOn ?? []).filter((dependency) => Boolean(plan.pipeline.tasks[dependency])).length);
+    }
+    const ready = runnableTaskIds
+        .filter((taskId) => dependencyCounts.get(taskId) === 0)
+        .sort((left, right) => (graphIndex.get(left) ?? 0) - (graphIndex.get(right) ?? 0));
+    const running = new Map();
+    let failed = false;
+    const updateRecord = async () => {
+        record.tasks = [...recordedResults.values()]
+            .sort((left, right) => left.order - right.order || left.result.id.localeCompare(right.result.id))
+            .map((entry) => entry.result);
+        await writeExecution(store, record);
+    };
+    const ensureSourcePrepared = async (source) => {
+        let promise = sourcePreparePromises.get(source.id);
+        if (!promise) {
+            promise = runSourcePrepare(source, {
                 candidate: plan.candidate,
-                rootCwd: options.cwd,
+                executor: workspace.executor,
+                rootCwd: workspace.cwd,
                 runId: record.id,
+                workspaceEnv: workspace.env,
                 store
             });
-            preparedSources.add(taskSource.id);
-            if (prepareResult) {
-                record.tasks.push(prepareResult);
-                await writeExecution(store, record);
-                if (prepareResult.status === "failed") {
-                    record.status = "failed";
-                    record.finishedAt = new Date().toISOString();
-                    await writeExecution(store, record);
-                    return record;
-                }
+            sourcePreparePromises.set(source.id, promise);
+        }
+        const result = await promise;
+        const recordResult = Boolean(result && !recordedPrepareSources.has(source.id));
+        if (recordResult)
+            recordedPrepareSources.add(source.id);
+        return { result, recordResult };
+    };
+    const runScheduledTask = async (taskId) => {
+        const taskDefinition = plan.pipeline.tasks[taskId];
+        if (!taskDefinition)
+            return { taskId, failed: false, results: [] };
+        const results = [];
+        const taskSource = taskDefinition.source?.name ? plan.sources[taskDefinition.source.name] : undefined;
+        if (taskSource) {
+            const prepare = await ensureSourcePrepared(taskSource);
+            if (prepare.result && prepare.recordResult) {
+                results.push({
+                    order: sourcePrepareOrder.get(taskSource.id) ?? ((graphIndex.get(taskId) ?? 0) - 0.25),
+                    result: prepare.result
+                });
+            }
+            if (prepare.result?.status === "failed") {
+                return { taskId, failed: true, results };
             }
         }
         const result = await runTask(plan.pipeline, taskDefinition, {
-            adapter,
             candidate: plan.candidate,
-            cwd: taskDefinition.source?.dir || options.cwd,
-            rootCwd: options.cwd,
+            cwd: taskDefinition.source?.dir || workspace.cwd,
+            executor: workspace.executor,
+            rootCwd: workspace.cwd,
             runId: record.id,
             source: taskDefinition.source,
             envDefinitions,
+            workspaceEnv: workspace.env,
             sourcePrepareCommands: taskSource ? await resolvePrepareCommands(taskSource, {
                 candidate: plan.candidate,
-                rootCwd: options.cwd,
-                runId: record.id
+                rootCwd: workspace.cwd,
+                runId: record.id,
+                workspaceEnv: workspace.env
             }) : [],
+            dependencyFingerprints: Object.fromEntries(taskDefinition.dependsOn.map((dependency) => [
+                dependency,
+                taskFingerprints.get(dependency) ?? null
+            ])),
             store
         });
-        record.tasks.push(result);
-        await writeExecution(store, record);
-        if (result.status === "failed") {
-            record.status = "failed";
-            record.finishedAt = new Date().toISOString();
-            await writeExecution(store, record);
-            return record;
+        results.push({ order: graphIndex.get(taskId) ?? results.length, result });
+        return { taskId, failed: result.status === "failed", results, taskResult: result };
+    };
+    while (ready.length > 0 || running.size > 0) {
+        while (!failed && ready.length > 0 && running.size < concurrency) {
+            const taskId = ready.shift();
+            if (!taskId)
+                break;
+            running.set(taskId, runScheduledTask(taskId));
         }
+        if (running.size === 0)
+            break;
+        const completed = await Promise.race(running.values());
+        running.delete(completed.taskId);
+        for (const entry of completed.results) {
+            recordedResults.set(entry.result.id, entry);
+        }
+        if (completed.taskResult) {
+            taskFingerprints.set(completed.taskId, completed.taskResult.cacheKey ?? `${completed.taskId}:${completed.taskResult.status}`);
+        }
+        await updateRecord();
+        if (completed.failed) {
+            failed = true;
+            ready.length = 0;
+            continue;
+        }
+        if (failed || !completed.taskResult)
+            continue;
+        const node = graphNodes.get(completed.taskId);
+        for (const dependent of node?.dependents ?? []) {
+            if (!plan.pipeline.tasks[dependent])
+                continue;
+            const remaining = Math.max(0, (dependencyCounts.get(dependent) ?? 0) - 1);
+            dependencyCounts.set(dependent, remaining);
+            if (remaining === 0) {
+                ready.push(dependent);
+            }
+        }
+        ready.sort((left, right) => (graphIndex.get(left) ?? 0) - (graphIndex.get(right) ?? 0));
     }
-    record.status = "passed";
+    record.status = failed ? "failed" : "passed";
     record.finishedAt = new Date().toISOString();
     await writeExecution(store, record);
     return record;
 }
-export async function runSingleTask(pipeline, taskId, options) {
+export async function runSingleTask(pipeline, taskId, options = {}) {
     const syntheticJobId = `task:${taskId}`;
     const syntheticPipeline = {
         ...pipeline,
         jobs: {
             ...pipeline.jobs,
-            [syntheticJobId]: { id: syntheticJobId, target: [taskId], trigger: [], mode: options.mode }
+            [syntheticJobId]: { id: syntheticJobId, target: [taskId], trigger: [] }
         }
     };
-    return runJob(syntheticPipeline, { ...options, jobId: syntheticJobId });
+    return runJob(syntheticPipeline, { ...options, id: syntheticJobId });
 }
 async function runTask(pipeline, taskDefinition, options) {
     const started = Date.now();
@@ -110,7 +315,7 @@ async function runTask(pipeline, taskDefinition, options) {
     let combinedLog = "";
     let taskEnv;
     try {
-        taskEnv = buildTaskEnv(process.env, {
+        taskEnv = buildTaskEnv(options.workspaceEnv, {
             candidate: options.candidate,
             envDefinitions: options.envDefinitions,
             rootCwd: options.rootCwd,
@@ -148,6 +353,7 @@ async function runTask(pipeline, taskDefinition, options) {
     const resolvedSteps = await resolveTaskSteps(taskDefinition.steps, context);
     const cacheKey = await computeTaskCacheKey(pipeline, taskDefinition, options.cwd, {
         candidate: options.candidate,
+        dependencyFingerprints: options.dependencyFingerprints,
         prepareCommands: (options.sourcePrepareCommands ?? []).map((command) => command.command),
         source: options.source,
         steps: resolvedSteps
@@ -155,19 +361,23 @@ async function runTask(pipeline, taskDefinition, options) {
     if (taskDefinition.cache.enabled) {
         const cached = await readTaskCacheEntry(taskDefinition, options.store, cacheKey);
         if (cached?.status === "passed") {
-            const result = {
-                ...cached,
-                id: taskDefinition.id,
-                status: "cached",
-                startedAt,
-                finishedAt: new Date().toISOString(),
-                attempts: 0,
-                cacheKey,
-                cacheHit: true,
-                durationMs: Date.now() - started
-            };
-            await writeTaskLog(options.store, options.runId, taskDefinition.id, `[cache hit] ${cacheKey}\n`);
-            return result;
+            const cacheHit = await validateTaskCacheHit(taskDefinition, options.store, cacheKey, options.cwd, cached);
+            if (cacheHit.ok) {
+                const result = {
+                    ...cached,
+                    id: taskDefinition.id,
+                    status: "cached",
+                    startedAt,
+                    finishedAt: new Date().toISOString(),
+                    attempts: 0,
+                    cacheKey,
+                    cacheHit: true,
+                    durationMs: Date.now() - started
+                };
+                await writeTaskLog(options.store, options.runId, taskDefinition.id, `[cache hit] ${cacheKey}\n`);
+                return result;
+            }
+            combinedLog += `[cache miss] ${cacheHit.reason}\n`;
         }
     }
     let attempts = 0;
@@ -177,13 +387,13 @@ async function runTask(pipeline, taskDefinition, options) {
         attempts += 1;
         try {
             for (const requirement of taskDefinition.requires?.tools ?? []) {
-                const ok = await options.adapter.checkTool?.(requirement);
+                const ok = await options.executor.checkTool?.(requirement);
                 if (ok === false) {
                     throw new Error(`Required tool "${requirement}" is not available for task "${taskDefinition.id}".`);
                 }
             }
             for (const secret of taskDefinition.requires?.secrets ?? []) {
-                if (!process.env[secret]) {
+                if (!taskEnv[secret]) {
                     throw new Error(`Required secret "${secret}" is not available for task "${taskDefinition.id}".`);
                 }
             }
@@ -219,7 +429,7 @@ async function runTask(pipeline, taskDefinition, options) {
             };
             await writeTaskLog(options.store, options.runId, taskDefinition.id, combinedLog);
             if (taskDefinition.cache.enabled) {
-                await writeTaskCacheEntry(taskDefinition, options.store, cacheKey, result);
+                await writeTaskCacheEntry(taskDefinition, options.store, cacheKey, result, options.cwd);
             }
             return result;
         }
@@ -247,7 +457,7 @@ async function runTask(pipeline, taskDefinition, options) {
     return result;
 }
 async function runShellStep(step, taskDefinition, options) {
-    return options.adapter.runShell(step.command, {
+    return options.executor.runShell(step.command, {
         cwd: options.cwd,
         env: options.env,
         task: taskDefinition,
@@ -265,7 +475,7 @@ async function runSourcePrepare(source, options) {
     const context = createTaskContext({ id: taskId }, {
         candidate: options.candidate,
         cwd: source.dir,
-        env: buildTaskEnv(process.env, {
+        env: buildTaskEnv(options.workspaceEnv, {
             candidate: options.candidate,
             rootCwd: options.rootCwd,
             source: sourceTaskContext
@@ -288,9 +498,9 @@ async function runSourcePrepare(source, options) {
             if (!isShellCommand(step)) {
                 throw new Error(`Deferred shell step for source "${source.id}" was not resolved.`);
             }
-            const result = await options.adapter.runShell(step.command, {
+            const result = await options.executor.runShell(step.command, {
                 cwd: source.dir,
-                env: buildTaskEnv(process.env, {
+                env: buildTaskEnv(options.workspaceEnv, {
                     candidate: options.candidate,
                     rootCwd: options.rootCwd,
                     source: sourceTaskContext
@@ -335,7 +545,7 @@ async function resolvePrepareCommands(source, options) {
     const context = createTaskContext({ id: `${source.id}:prepare` }, {
         candidate: options.candidate,
         cwd: source.dir,
-        env: buildTaskEnv(process.env, {
+        env: buildTaskEnv(options.workspaceEnv, {
             candidate: options.candidate,
             rootCwd: options.rootCwd,
             source: sourceContext(source)
@@ -441,20 +651,66 @@ async function readTaskCacheEntry(taskDefinition, store, cacheKey) {
     if (storeName === "file")
         return readCacheEntry(store, cacheKey);
     if (storeName === "memory")
-        return memoryCacheEntries.get(cacheKey) ?? null;
-    throw new Error(`Cache store "${storeName}" is registered but this runner cannot execute it. Use "file" or "memory", or provide a runtime-specific adapter.`);
+        return memoryCacheEntries.get(cacheKey)?.result ?? null;
+    throw new Error(`Cache store "${storeName}" is registered but this runner cannot execute it. Use "file" or "memory", or provide a runtime-specific executor.`);
 }
-async function writeTaskCacheEntry(taskDefinition, store, cacheKey, result) {
+async function writeTaskCacheEntry(taskDefinition, store, cacheKey, result, cwd) {
     const storeName = taskDefinition.cache.store ?? "file";
     if (storeName === "file") {
-        await writeCacheEntry(store, cacheKey, result);
+        await writeCacheEntry(store, cacheKey, result, {
+            cwd,
+            outputs: taskDefinition.outputs
+        });
         return;
     }
     if (storeName === "memory") {
-        memoryCacheEntries.set(cacheKey, result);
+        memoryCacheEntries.set(cacheKey, {
+            result,
+            outputFiles: taskDefinition.outputs.length > 0 ? await resolveOutputFiles(cwd, taskDefinition.outputs) : []
+        });
         return;
     }
-    throw new Error(`Cache store "${storeName}" is registered but this runner cannot execute it. Use "file" or "memory", or provide a runtime-specific adapter.`);
+    throw new Error(`Cache store "${storeName}" is registered but this runner cannot execute it. Use "file" or "memory", or provide a runtime-specific executor.`);
+}
+async function validateTaskCacheHit(taskDefinition, store, cacheKey, cwd, cached) {
+    if (!isCacheEntryFresh(cached, taskDefinition.cache.ttlMs)) {
+        return { ok: false, reason: "cache entry expired or has an invalid timestamp" };
+    }
+    if (taskDefinition.outputs.length === 0)
+        return { ok: true };
+    const storeName = taskDefinition.cache.store ?? "file";
+    if (storeName === "file") {
+        const restored = await restoreCacheOutputs(store, cacheKey, cwd, taskDefinition.outputs);
+        return restored
+            ? { ok: true }
+            : { ok: false, reason: "declared outputs were not available in the file cache" };
+    }
+    if (storeName === "memory") {
+        const entry = memoryCacheEntries.get(cacheKey);
+        if (!entry)
+            return { ok: false, reason: "memory cache entry was not available" };
+        const outputsExist = await outputFilesExist(cwd, entry.outputFiles);
+        return outputsExist
+            ? { ok: true }
+            : { ok: false, reason: "declared outputs were missing from the working tree" };
+    }
+    return { ok: false, reason: `cache store "${storeName}" is not executable by this runner` };
+}
+function isCacheEntryFresh(cached, ttlMs) {
+    if (ttlMs === undefined)
+        return true;
+    if (!Number.isFinite(ttlMs) || ttlMs < 0)
+        return false;
+    const finishedAtMs = cached.finishedAt ? Date.parse(cached.finishedAt) : Number.NaN;
+    return Number.isFinite(finishedAtMs) && Date.now() - finishedAtMs <= ttlMs;
+}
+function normalizeTaskConcurrency(concurrency) {
+    if (concurrency === undefined)
+        return Math.max(1, Math.min(DEFAULT_MAX_CONCURRENCY, availableParallelism()));
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+        throw new Error("Task concurrency must be a positive integer.");
+    }
+    return concurrency;
 }
 async function runFunctionStep(step, context, timeoutMs) {
     if (!timeoutMs) {
@@ -521,6 +777,77 @@ function runProcess(command, options) {
         });
     });
 }
+function matchingAction(policy, argv) {
+    for (const rule of policy.rules) {
+        if (matchesCommandRule(rule, argv))
+            return rule.action;
+    }
+    return policy.fallback ?? { kind: "async-pipeline.command.allow" };
+}
+function matchesCommandRule(rule, argv) {
+    if (rule.exact && sameArgs(rule.exact, argv))
+        return true;
+    if (rule.prefix && hasPrefix(argv, rule.prefix))
+        return true;
+    return false;
+}
+function sameArgs(left, right) {
+    return left.length === right.length && left.every((value, index) => right[index] === value);
+}
+function hasPrefix(argv, prefix) {
+    return prefix.length <= argv.length && prefix.every((value, index) => argv[index] === value);
+}
+function commandStatus(action) {
+    if (action.kind === "async-pipeline.command.mock")
+        return "mocked";
+    if (action.kind === "async-pipeline.command.deny")
+        return "denied";
+    if (action.kind === "async-pipeline.command.requireApproval")
+        return "approval-required";
+    return "allowed";
+}
+async function runCommandAction(action, next) {
+    if (action.kind === "async-pipeline.command.allow")
+        return next();
+    if (action.kind === "async-pipeline.command.requireEnvironment")
+        return next();
+    if (action.kind === "async-pipeline.command.mock") {
+        return {
+            code: action.code ?? 0,
+            stdout: action.stdout ?? "",
+            stderr: action.stderr ?? ""
+        };
+    }
+    if (action.kind === "async-pipeline.command.deny") {
+        return {
+            code: 1,
+            stdout: "",
+            stderr: `${action.message ?? "Command denied by async-pipeline command policy."}\n`
+        };
+    }
+    return {
+        code: 1,
+        stdout: "",
+        stderr: `${action.message ?? "Command requires approval by async-pipeline command policy."}\n`
+    };
+}
+function applyOutputPolicy(output, policy, env) {
+    let next = policy.redactSecrets ? redactSecretValues(output, env) : output;
+    const maxBytes = policy.maxBytes;
+    if (maxBytes === undefined || Buffer.byteLength(next, "utf8") <= maxBytes)
+        return next;
+    const truncated = Buffer.from(next).subarray(0, maxBytes).toString("utf8");
+    return `${truncated}\n[async-pipeline] output truncated to ${maxBytes} bytes\n`;
+}
+function redactSecretValues(output, env) {
+    let redacted = output;
+    for (const [key, value] of Object.entries(env)) {
+        if (!value || value.length < 4 || !/(SECRET|TOKEN|PASSWORD|AUTH|KEY)/i.test(key))
+            continue;
+        redacted = redacted.split(value).join("[redacted]");
+    }
+    return redacted;
+}
 function shellEscape(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }