@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/generated/run-evidence.d.cts

@@ -0,0 +1,3 @@
+// Generated by bun run schemas:generate; do not edit.
+declare function validate(value: unknown): boolean;
+export = validate;

package/src/generated/runtime.cjs

@@ -0,0 +1,2 @@
+// Generated by bun run schemas:generate; do not edit.
+"use strict";module.exports = validate104;module.exports.default = validate104;const schema164 = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"urn:sevro:schema:runtime:v1","title":"Sevro runtime policy v1","type":"object","additionalProperties":false,"required":["format"],"properties":{"codexState":{"type":"boolean"},"network":{"type":"object","additionalProperties":false,"properties":{"localHttp":{"type":"boolean"}}},"nativeTranscripts":{"type":"boolean"},"hooks":{"type":"object","additionalProperties":false,"properties":{"nativeGoal":{"type":"boolean"},"plugins":{"type":"array","maxItems":64,"uniqueItems":true,"items":{"type":"string","pattern":"^[a-z][a-z0-9-]*$","maxLength":128}}}},"runtime":{"type":"object","additionalProperties":false,"properties":{"artifactDirectories":{"type":"array","maxItems":16,"items":{"type":"object","additionalProperties":false,"required":["name","path"],"properties":{"name":{"type":"string","pattern":"^[a-z][a-z0-9_]{0,63}$"},"path":{"type":"string","minLength":1,"maxLength":4096}}}},"sharedCacheDirectories":{"type":"array","maxItems":16,"items":{"type":"object","additionalProperties":false,"required":["source","target","roles"],"properties":{"source":{"type":"string","minLength":1,"maxLength":4096},"target":{"type":"string","pattern":"^[a-z][a-z0-9-]{0,63}$","not":{"enum":["home","tmp"]}},"roles":{"type":"array","minItems":1,"maxItems":5,"uniqueItems":true,"items":{"enum":["candidate","checks","hooks","semantic","advisory"]}}}}},"seedDirectories":{"type":"array","maxItems":16,"items":{"type":"object","additionalProperties":false,"required":["source","target"],"properties":{"source":{"type":"string","minLength":1,"maxLength":4096},"target":{"type":"string","pattern":"^[a-z][a-z0-9-]{0,63}$","not":{"enum":["home","tmp"]}},"roles":{"type":"array","minItems":1,"maxItems":5,"uniqueItems":true,"items":{"enum":["candidate","checks","hooks","semantic","advisory"]}}}}}}},"format":{"const":"sevro.runtime.v1"},"filesystem":{"type":"object","additionalProperties":false,"properties":{"optionalReadOnlyRoots":{"type":"array","maxItems":64,"uniqueItems":true,"items":{"type":"string","minLength":1,"maxLength":4096}},"readOnlyRoots":{"type":"array","maxItems":64,"uniqueItems":true,"items":{"type":"string","minLength":1,"maxLength":4096}}}},"environment":{"type":"object","additionalProperties":false,"properties":{"inherit":{"type":"array","maxItems":64,"uniqueItems":true,"items":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$"}},"set":{"type":"object","maxProperties":64,"propertyNames":{"pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$"},"additionalProperties":{"type":"string","maxLength":8192}}}}}};const func2 = require("ajv/dist/runtime/ucs2length").default;const func0 = require("ajv/dist/runtime/equal").default;const pattern55 = new RegExp("^[a-z][a-z0-9-]*$", "u");const pattern56 = new RegExp("^[a-z][a-z0-9_]{0,63}$", "u");const pattern57 = new RegExp("^[a-z][a-z0-9-]{0,63}$", "u");const pattern59 = new RegExp("^[A-Za-z_][A-Za-z0-9_]{0,127}$", "u");function validate104(data, {instancePath="", parentData, parentDataProperty, rootData=data, dynamicAnchors={}}={}){/*# sourceURL="urn:sevro:schema:runtime:v1" */;let vErrors = null;let errors = 0;const evaluated0 = validate104.evaluated;if(evaluated0.dynamicProps){evaluated0.props = undefined;}if(evaluated0.dynamicItems){evaluated0.items = undefined;}if(errors === 0){if(data && typeof data == "object" && !Array.isArray(data)){let missing0;if((data.format === undefined) && (missing0 = "format")){validate104.errors = [{instancePath,schemaPath:"#/required",keyword:"required",params:{missingProperty: missing0},message:"must have required property '"+missing0+"'"}];return false;}else {const _errs1 = errors;for(const key0 in data){if(!((((((((key0 === "codexState") || (key0 === "network")) || (key0 === "nativeTranscripts")) || (key0 === "hooks")) || (key0 === "runtime")) || (key0 === "format")) || (key0 === "filesystem")) || (key0 === "environment"))){validate104.errors = [{instancePath,schemaPath:"#/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key0},message:"must NOT have additional properties"}];return false;break;}}if(_errs1 === errors){if(data.codexState !== undefined){const _errs2 = errors;if(typeof data.codexState !== "boolean"){validate104.errors = [{instancePath:instancePath+"/codexState",schemaPath:"#/properties/codexState/type",keyword:"type",params:{type: "boolean"},message:"must be boolean"}];return false;}var valid0 = _errs2 === errors;}else {var valid0 = true;}if(valid0){if(data.network !== undefined){let data1 = data.network;const _errs4 = errors;if(errors === _errs4){if(data1 && typeof data1 == "object" && !Array.isArray(data1)){const _errs6 = errors;for(const key1 in data1){if(!(key1 === "localHttp")){validate104.errors = [{instancePath:instancePath+"/network",schemaPath:"#/properties/network/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key1},message:"must NOT have additional properties"}];return false;break;}}if(_errs6 === errors){if(data1.localHttp !== undefined){if(typeof data1.localHttp !== "boolean"){validate104.errors = [{instancePath:instancePath+"/network/localHttp",schemaPath:"#/properties/network/properties/localHttp/type",keyword:"type",params:{type: "boolean"},message:"must be boolean"}];return false;}}}}else {validate104.errors = [{instancePath:instancePath+"/network",schemaPath:"#/properties/network/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid0 = _errs4 === errors;}else {var valid0 = true;}if(valid0){if(data.nativeTranscripts !== undefined){const _errs9 = errors;if(typeof data.nativeTranscripts !== "boolean"){validate104.errors = [{instancePath:instancePath+"/nativeTranscripts",schemaPath:"#/properties/nativeTranscripts/type",keyword:"type",params:{type: "boolean"},message:"must be boolean"}];return false;}var valid0 = _errs9 === errors;}else {var valid0 = true;}if(valid0){if(data.hooks !== undefined){let data4 = data.hooks;const _errs11 = errors;if(errors === _errs11){if(data4 && typeof data4 == "object" && !Array.isArray(data4)){const _errs13 = errors;for(const key2 in data4){if(!((key2 === "nativeGoal") || (key2 === "plugins"))){validate104.errors = [{instancePath:instancePath+"/hooks",schemaPath:"#/properties/hooks/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key2},message:"must NOT have additional properties"}];return false;break;}}if(_errs13 === errors){if(data4.nativeGoal !== undefined){const _errs14 = errors;if(typeof data4.nativeGoal !== "boolean"){validate104.errors = [{instancePath:instancePath+"/hooks/nativeGoal",schemaPath:"#/properties/hooks/properties/nativeGoal/type",keyword:"type",params:{type: "boolean"},message:"must be boolean"}];return false;}var valid2 = _errs14 === errors;}else {var valid2 = true;}if(valid2){if(data4.plugins !== undefined){let data6 = data4.plugins;const _errs16 = errors;if(errors === _errs16){if(Array.isArray(data6)){if(data6.length > 64){validate104.errors = [{instancePath:instancePath+"/hooks/plugins",schemaPath:"#/properties/hooks/properties/plugins/maxItems",keyword:"maxItems",params:{limit: 64},message:"must NOT have more than 64 items"}];return false;}else {var valid3 = true;const len0 = data6.length;for(let i0=0; i0<len0; i0++){let data7 = data6[i0];const _errs18 = errors;if(errors === _errs18){if(typeof data7 === "string"){if(func2(data7) > 128){validate104.errors = [{instancePath:instancePath+"/hooks/plugins/" + i0,schemaPath:"#/properties/hooks/properties/plugins/items/maxLength",keyword:"maxLength",params:{limit: 128},message:"must NOT have more than 128 characters"}];return false;}else {if(!pattern55.test(data7)){validate104.errors = [{instancePath:instancePath+"/hooks/plugins/" + i0,schemaPath:"#/properties/hooks/properties/plugins/items/pattern",keyword:"pattern",params:{pattern: "^[a-z][a-z0-9-]*$"},message:"must match pattern \""+"^[a-z][a-z0-9-]*$"+"\""}];return false;}}}else {validate104.errors = [{instancePath:instancePath+"/hooks/plugins/" + i0,schemaPath:"#/properties/hooks/properties/plugins/items/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid3 = _errs18 === errors;if(!valid3){break;}}if(valid3){let i1 = data6.length;let j0;if(i1 > 1){const indices0 = {};for(;i1--;){let item0 = data6[i1];if(typeof item0 !== "string"){continue;}if(typeof indices0[item0] == "number"){j0 = indices0[item0];validate104.errors = [{instancePath:instancePath+"/hooks/plugins",schemaPath:"#/properties/hooks/properties/plugins/uniqueItems",keyword:"uniqueItems",params:{i: i1, j: j0},message:"must NOT have duplicate items (items ## "+j0+" and "+i1+" are identical)"}];return false;break;}indices0[item0] = i1;}}}}}else {validate104.errors = [{instancePath:instancePath+"/hooks/plugins",schemaPath:"#/properties/hooks/properties/plugins/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid2 = _errs16 === errors;}else {var valid2 = true;}}}}else {validate104.errors = [{instancePath:instancePath+"/hooks",schemaPath:"#/properties/hooks/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid0 = _errs11 === errors;}else {var valid0 = true;}if(valid0){if(data.runtime !== undefined){let data8 = data.runtime;const _errs20 = errors;if(errors === _errs20){if(data8 && typeof data8 == "object" && !Array.isArray(data8)){const _errs22 = errors;for(const key3 in data8){if(!(((key3 === "artifactDirectories") || (key3 === "sharedCacheDirectories")) || (key3 === "seedDirectories"))){validate104.errors = [{instancePath:instancePath+"/runtime",schemaPath:"#/properties/runtime/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key3},message:"must NOT have additional properties"}];return false;break;}}if(_errs22 === errors){if(data8.artifactDirectories !== undefined){let data9 = data8.artifactDirectories;const _errs23 = errors;if(errors === _errs23){if(Array.isArray(data9)){if(data9.length > 16){validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories",schemaPath:"#/properties/runtime/properties/artifactDirectories/maxItems",keyword:"maxItems",params:{limit: 16},message:"must NOT have more than 16 items"}];return false;}else {var valid6 = true;const len1 = data9.length;for(let i2=0; i2<len1; i2++){let data10 = data9[i2];const _errs25 = errors;if(errors === _errs25){if(data10 && typeof data10 == "object" && !Array.isArray(data10)){let missing1;if(((data10.name === undefined) && (missing1 = "name")) || ((data10.path === undefined) && (missing1 = "path"))){validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2,schemaPath:"#/properties/runtime/properties/artifactDirectories/items/required",keyword:"required",params:{missingProperty: missing1},message:"must have required property '"+missing1+"'"}];return false;}else {const _errs27 = errors;for(const key4 in data10){if(!((key4 === "name") || (key4 === "path"))){validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2,schemaPath:"#/properties/runtime/properties/artifactDirectories/items/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key4},message:"must NOT have additional properties"}];return false;break;}}if(_errs27 === errors){if(data10.name !== undefined){let data11 = data10.name;const _errs28 = errors;if(errors === _errs28){if(typeof data11 === "string"){if(!pattern56.test(data11)){validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2+"/name",schemaPath:"#/properties/runtime/properties/artifactDirectories/items/properties/name/pattern",keyword:"pattern",params:{pattern: "^[a-z][a-z0-9_]{0,63}$"},message:"must match pattern \""+"^[a-z][a-z0-9_]{0,63}$"+"\""}];return false;}}else {validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2+"/name",schemaPath:"#/properties/runtime/properties/artifactDirectories/items/properties/name/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid7 = _errs28 === errors;}else {var valid7 = true;}if(valid7){if(data10.path !== undefined){let data12 = data10.path;const _errs30 = errors;if(errors === _errs30){if(typeof data12 === "string"){if(func2(data12) > 4096){validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2+"/path",schemaPath:"#/properties/runtime/properties/artifactDirectories/items/properties/path/maxLength",keyword:"maxLength",params:{limit: 4096},message:"must NOT have more than 4096 characters"}];return false;}else {if(func2(data12) < 1){validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2+"/path",schemaPath:"#/properties/runtime/properties/artifactDirectories/items/properties/path/minLength",keyword:"minLength",params:{limit: 1},message:"must NOT have fewer than 1 characters"}];return false;}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2+"/path",schemaPath:"#/properties/runtime/properties/artifactDirectories/items/properties/path/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid7 = _errs30 === errors;}else {var valid7 = true;}}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories/" + i2,schemaPath:"#/properties/runtime/properties/artifactDirectories/items/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid6 = _errs25 === errors;if(!valid6){break;}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/artifactDirectories",schemaPath:"#/properties/runtime/properties/artifactDirectories/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid5 = _errs23 === errors;}else {var valid5 = true;}if(valid5){if(data8.sharedCacheDirectories !== undefined){let data13 = data8.sharedCacheDirectories;const _errs32 = errors;if(errors === _errs32){if(Array.isArray(data13)){if(data13.length > 16){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/maxItems",keyword:"maxItems",params:{limit: 16},message:"must NOT have more than 16 items"}];return false;}else {var valid8 = true;const len2 = data13.length;for(let i3=0; i3<len2; i3++){let data14 = data13[i3];const _errs34 = errors;if(errors === _errs34){if(data14 && typeof data14 == "object" && !Array.isArray(data14)){let missing2;if((((data14.source === undefined) && (missing2 = "source")) || ((data14.target === undefined) && (missing2 = "target"))) || ((data14.roles === undefined) && (missing2 = "roles"))){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3,schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/required",keyword:"required",params:{missingProperty: missing2},message:"must have required property '"+missing2+"'"}];return false;}else {const _errs36 = errors;for(const key5 in data14){if(!(((key5 === "source") || (key5 === "target")) || (key5 === "roles"))){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3,schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key5},message:"must NOT have additional properties"}];return false;break;}}if(_errs36 === errors){if(data14.source !== undefined){let data15 = data14.source;const _errs37 = errors;if(errors === _errs37){if(typeof data15 === "string"){if(func2(data15) > 4096){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/source",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/source/maxLength",keyword:"maxLength",params:{limit: 4096},message:"must NOT have more than 4096 characters"}];return false;}else {if(func2(data15) < 1){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/source",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/source/minLength",keyword:"minLength",params:{limit: 1},message:"must NOT have fewer than 1 characters"}];return false;}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/source",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/source/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid9 = _errs37 === errors;}else {var valid9 = true;}if(valid9){if(data14.target !== undefined){let data16 = data14.target;const _errs39 = errors;const _errs41 = errors;const _errs42 = errors;if(!((data16 === "home") || (data16 === "tmp"))){const err0 = {};if(vErrors === null){vErrors = [err0];}else {vErrors.push(err0);}errors++;}var valid10 = _errs42 === errors;if(valid10){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/target",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/target/not",keyword:"not",params:{},message:"must NOT be valid"}];return false;}else {errors = _errs41;if(vErrors !== null){if(_errs41){vErrors.length = _errs41;}else {vErrors = null;}}}if(errors === _errs39){if(typeof data16 === "string"){if(!pattern57.test(data16)){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/target",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/target/pattern",keyword:"pattern",params:{pattern: "^[a-z][a-z0-9-]{0,63}$"},message:"must match pattern \""+"^[a-z][a-z0-9-]{0,63}$"+"\""}];return false;}}else {validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/target",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/target/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid9 = _errs39 === errors;}else {var valid9 = true;}if(valid9){if(data14.roles !== undefined){let data17 = data14.roles;const _errs43 = errors;if(errors === _errs43){if(Array.isArray(data17)){if(data17.length > 5){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/roles",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/roles/maxItems",keyword:"maxItems",params:{limit: 5},message:"must NOT have more than 5 items"}];return false;}else {if(data17.length < 1){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/roles",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/roles/minItems",keyword:"minItems",params:{limit: 1},message:"must NOT have fewer than 1 items"}];return false;}else {var valid11 = true;const len3 = data17.length;for(let i4=0; i4<len3; i4++){let data18 = data17[i4];const _errs45 = errors;if(!(((((data18 === "candidate") || (data18 === "checks")) || (data18 === "hooks")) || (data18 === "semantic")) || (data18 === "advisory"))){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/roles/" + i4,schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/roles/items/enum",keyword:"enum",params:{allowedValues: schema164.properties.runtime.properties.sharedCacheDirectories.items.properties.roles.items.enum},message:"must be equal to one of the allowed values"}];return false;}var valid11 = _errs45 === errors;if(!valid11){break;}}if(valid11){let i5 = data17.length;let j1;if(i5 > 1){outer0:for(;i5--;){for(j1 = i5; j1--;){if(func0(data17[i5], data17[j1])){validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/roles",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/roles/uniqueItems",keyword:"uniqueItems",params:{i: i5, j: j1},message:"must NOT have duplicate items (items ## "+j1+" and "+i5+" are identical)"}];return false;break outer0;}}}}}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3+"/roles",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/properties/roles/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid9 = _errs43 === errors;}else {var valid9 = true;}}}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories/" + i3,schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/items/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid8 = _errs34 === errors;if(!valid8){break;}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/sharedCacheDirectories",schemaPath:"#/properties/runtime/properties/sharedCacheDirectories/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid5 = _errs32 === errors;}else {var valid5 = true;}if(valid5){if(data8.seedDirectories !== undefined){let data19 = data8.seedDirectories;const _errs46 = errors;if(errors === _errs46){if(Array.isArray(data19)){if(data19.length > 16){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories",schemaPath:"#/properties/runtime/properties/seedDirectories/maxItems",keyword:"maxItems",params:{limit: 16},message:"must NOT have more than 16 items"}];return false;}else {var valid13 = true;const len4 = data19.length;for(let i6=0; i6<len4; i6++){let data20 = data19[i6];const _errs48 = errors;if(errors === _errs48){if(data20 && typeof data20 == "object" && !Array.isArray(data20)){let missing3;if(((data20.source === undefined) && (missing3 = "source")) || ((data20.target === undefined) && (missing3 = "target"))){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6,schemaPath:"#/properties/runtime/properties/seedDirectories/items/required",keyword:"required",params:{missingProperty: missing3},message:"must have required property '"+missing3+"'"}];return false;}else {const _errs50 = errors;for(const key6 in data20){if(!(((key6 === "source") || (key6 === "target")) || (key6 === "roles"))){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6,schemaPath:"#/properties/runtime/properties/seedDirectories/items/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key6},message:"must NOT have additional properties"}];return false;break;}}if(_errs50 === errors){if(data20.source !== undefined){let data21 = data20.source;const _errs51 = errors;if(errors === _errs51){if(typeof data21 === "string"){if(func2(data21) > 4096){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/source",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/source/maxLength",keyword:"maxLength",params:{limit: 4096},message:"must NOT have more than 4096 characters"}];return false;}else {if(func2(data21) < 1){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/source",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/source/minLength",keyword:"minLength",params:{limit: 1},message:"must NOT have fewer than 1 characters"}];return false;}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/source",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/source/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid14 = _errs51 === errors;}else {var valid14 = true;}if(valid14){if(data20.target !== undefined){let data22 = data20.target;const _errs53 = errors;const _errs55 = errors;const _errs56 = errors;if(!((data22 === "home") || (data22 === "tmp"))){const err1 = {};if(vErrors === null){vErrors = [err1];}else {vErrors.push(err1);}errors++;}var valid15 = _errs56 === errors;if(valid15){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/target",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/target/not",keyword:"not",params:{},message:"must NOT be valid"}];return false;}else {errors = _errs55;if(vErrors !== null){if(_errs55){vErrors.length = _errs55;}else {vErrors = null;}}}if(errors === _errs53){if(typeof data22 === "string"){if(!pattern57.test(data22)){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/target",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/target/pattern",keyword:"pattern",params:{pattern: "^[a-z][a-z0-9-]{0,63}$"},message:"must match pattern \""+"^[a-z][a-z0-9-]{0,63}$"+"\""}];return false;}}else {validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/target",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/target/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid14 = _errs53 === errors;}else {var valid14 = true;}if(valid14){if(data20.roles !== undefined){let data23 = data20.roles;const _errs57 = errors;if(errors === _errs57){if(Array.isArray(data23)){if(data23.length > 5){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/roles",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/roles/maxItems",keyword:"maxItems",params:{limit: 5},message:"must NOT have more than 5 items"}];return false;}else {if(data23.length < 1){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/roles",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/roles/minItems",keyword:"minItems",params:{limit: 1},message:"must NOT have fewer than 1 items"}];return false;}else {var valid16 = true;const len5 = data23.length;for(let i7=0; i7<len5; i7++){let data24 = data23[i7];const _errs59 = errors;if(!(((((data24 === "candidate") || (data24 === "checks")) || (data24 === "hooks")) || (data24 === "semantic")) || (data24 === "advisory"))){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/roles/" + i7,schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/roles/items/enum",keyword:"enum",params:{allowedValues: schema164.properties.runtime.properties.seedDirectories.items.properties.roles.items.enum},message:"must be equal to one of the allowed values"}];return false;}var valid16 = _errs59 === errors;if(!valid16){break;}}if(valid16){let i8 = data23.length;let j2;if(i8 > 1){outer1:for(;i8--;){for(j2 = i8; j2--;){if(func0(data23[i8], data23[j2])){validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/roles",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/roles/uniqueItems",keyword:"uniqueItems",params:{i: i8, j: j2},message:"must NOT have duplicate items (items ## "+j2+" and "+i8+" are identical)"}];return false;break outer1;}}}}}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6+"/roles",schemaPath:"#/properties/runtime/properties/seedDirectories/items/properties/roles/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid14 = _errs57 === errors;}else {var valid14 = true;}}}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories/" + i6,schemaPath:"#/properties/runtime/properties/seedDirectories/items/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid13 = _errs48 === errors;if(!valid13){break;}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime/seedDirectories",schemaPath:"#/properties/runtime/properties/seedDirectories/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid5 = _errs46 === errors;}else {var valid5 = true;}}}}}else {validate104.errors = [{instancePath:instancePath+"/runtime",schemaPath:"#/properties/runtime/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid0 = _errs20 === errors;}else {var valid0 = true;}if(valid0){if(data.format !== undefined){const _errs60 = errors;if("sevro.runtime.v1" !== data.format){validate104.errors = [{instancePath:instancePath+"/format",schemaPath:"#/properties/format/const",keyword:"const",params:{allowedValue: "sevro.runtime.v1"},message:"must be equal to constant"}];return false;}var valid0 = _errs60 === errors;}else {var valid0 = true;}if(valid0){if(data.filesystem !== undefined){let data26 = data.filesystem;const _errs61 = errors;if(errors === _errs61){if(data26 && typeof data26 == "object" && !Array.isArray(data26)){const _errs63 = errors;for(const key7 in data26){if(!((key7 === "optionalReadOnlyRoots") || (key7 === "readOnlyRoots"))){validate104.errors = [{instancePath:instancePath+"/filesystem",schemaPath:"#/properties/filesystem/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key7},message:"must NOT have additional properties"}];return false;break;}}if(_errs63 === errors){if(data26.optionalReadOnlyRoots !== undefined){let data27 = data26.optionalReadOnlyRoots;const _errs64 = errors;if(errors === _errs64){if(Array.isArray(data27)){if(data27.length > 64){validate104.errors = [{instancePath:instancePath+"/filesystem/optionalReadOnlyRoots",schemaPath:"#/properties/filesystem/properties/optionalReadOnlyRoots/maxItems",keyword:"maxItems",params:{limit: 64},message:"must NOT have more than 64 items"}];return false;}else {var valid19 = true;const len6 = data27.length;for(let i9=0; i9<len6; i9++){let data28 = data27[i9];const _errs66 = errors;if(errors === _errs66){if(typeof data28 === "string"){if(func2(data28) > 4096){validate104.errors = [{instancePath:instancePath+"/filesystem/optionalReadOnlyRoots/" + i9,schemaPath:"#/properties/filesystem/properties/optionalReadOnlyRoots/items/maxLength",keyword:"maxLength",params:{limit: 4096},message:"must NOT have more than 4096 characters"}];return false;}else {if(func2(data28) < 1){validate104.errors = [{instancePath:instancePath+"/filesystem/optionalReadOnlyRoots/" + i9,schemaPath:"#/properties/filesystem/properties/optionalReadOnlyRoots/items/minLength",keyword:"minLength",params:{limit: 1},message:"must NOT have fewer than 1 characters"}];return false;}}}else {validate104.errors = [{instancePath:instancePath+"/filesystem/optionalReadOnlyRoots/" + i9,schemaPath:"#/properties/filesystem/properties/optionalReadOnlyRoots/items/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid19 = _errs66 === errors;if(!valid19){break;}}if(valid19){let i10 = data27.length;let j3;if(i10 > 1){const indices1 = {};for(;i10--;){let item1 = data27[i10];if(typeof item1 !== "string"){continue;}if(typeof indices1[item1] == "number"){j3 = indices1[item1];validate104.errors = [{instancePath:instancePath+"/filesystem/optionalReadOnlyRoots",schemaPath:"#/properties/filesystem/properties/optionalReadOnlyRoots/uniqueItems",keyword:"uniqueItems",params:{i: i10, j: j3},message:"must NOT have duplicate items (items ## "+j3+" and "+i10+" are identical)"}];return false;break;}indices1[item1] = i10;}}}}}else {validate104.errors = [{instancePath:instancePath+"/filesystem/optionalReadOnlyRoots",schemaPath:"#/properties/filesystem/properties/optionalReadOnlyRoots/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid18 = _errs64 === errors;}else {var valid18 = true;}if(valid18){if(data26.readOnlyRoots !== undefined){let data29 = data26.readOnlyRoots;const _errs68 = errors;if(errors === _errs68){if(Array.isArray(data29)){if(data29.length > 64){validate104.errors = [{instancePath:instancePath+"/filesystem/readOnlyRoots",schemaPath:"#/properties/filesystem/properties/readOnlyRoots/maxItems",keyword:"maxItems",params:{limit: 64},message:"must NOT have more than 64 items"}];return false;}else {var valid21 = true;const len7 = data29.length;for(let i11=0; i11<len7; i11++){let data30 = data29[i11];const _errs70 = errors;if(errors === _errs70){if(typeof data30 === "string"){if(func2(data30) > 4096){validate104.errors = [{instancePath:instancePath+"/filesystem/readOnlyRoots/" + i11,schemaPath:"#/properties/filesystem/properties/readOnlyRoots/items/maxLength",keyword:"maxLength",params:{limit: 4096},message:"must NOT have more than 4096 characters"}];return false;}else {if(func2(data30) < 1){validate104.errors = [{instancePath:instancePath+"/filesystem/readOnlyRoots/" + i11,schemaPath:"#/properties/filesystem/properties/readOnlyRoots/items/minLength",keyword:"minLength",params:{limit: 1},message:"must NOT have fewer than 1 characters"}];return false;}}}else {validate104.errors = [{instancePath:instancePath+"/filesystem/readOnlyRoots/" + i11,schemaPath:"#/properties/filesystem/properties/readOnlyRoots/items/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid21 = _errs70 === errors;if(!valid21){break;}}if(valid21){let i12 = data29.length;let j4;if(i12 > 1){const indices2 = {};for(;i12--;){let item2 = data29[i12];if(typeof item2 !== "string"){continue;}if(typeof indices2[item2] == "number"){j4 = indices2[item2];validate104.errors = [{instancePath:instancePath+"/filesystem/readOnlyRoots",schemaPath:"#/properties/filesystem/properties/readOnlyRoots/uniqueItems",keyword:"uniqueItems",params:{i: i12, j: j4},message:"must NOT have duplicate items (items ## "+j4+" and "+i12+" are identical)"}];return false;break;}indices2[item2] = i12;}}}}}else {validate104.errors = [{instancePath:instancePath+"/filesystem/readOnlyRoots",schemaPath:"#/properties/filesystem/properties/readOnlyRoots/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid18 = _errs68 === errors;}else {var valid18 = true;}}}}else {validate104.errors = [{instancePath:instancePath+"/filesystem",schemaPath:"#/properties/filesystem/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid0 = _errs61 === errors;}else {var valid0 = true;}if(valid0){if(data.environment !== undefined){let data31 = data.environment;const _errs72 = errors;if(errors === _errs72){if(data31 && typeof data31 == "object" && !Array.isArray(data31)){const _errs74 = errors;for(const key8 in data31){if(!((key8 === "inherit") || (key8 === "set"))){validate104.errors = [{instancePath:instancePath+"/environment",schemaPath:"#/properties/environment/additionalProperties",keyword:"additionalProperties",params:{additionalProperty: key8},message:"must NOT have additional properties"}];return false;break;}}if(_errs74 === errors){if(data31.inherit !== undefined){let data32 = data31.inherit;const _errs75 = errors;if(errors === _errs75){if(Array.isArray(data32)){if(data32.length > 64){validate104.errors = [{instancePath:instancePath+"/environment/inherit",schemaPath:"#/properties/environment/properties/inherit/maxItems",keyword:"maxItems",params:{limit: 64},message:"must NOT have more than 64 items"}];return false;}else {var valid24 = true;const len8 = data32.length;for(let i13=0; i13<len8; i13++){let data33 = data32[i13];const _errs77 = errors;if(errors === _errs77){if(typeof data33 === "string"){if(!pattern59.test(data33)){validate104.errors = [{instancePath:instancePath+"/environment/inherit/" + i13,schemaPath:"#/properties/environment/properties/inherit/items/pattern",keyword:"pattern",params:{pattern: "^[A-Za-z_][A-Za-z0-9_]{0,127}$"},message:"must match pattern \""+"^[A-Za-z_][A-Za-z0-9_]{0,127}$"+"\""}];return false;}}else {validate104.errors = [{instancePath:instancePath+"/environment/inherit/" + i13,schemaPath:"#/properties/environment/properties/inherit/items/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid24 = _errs77 === errors;if(!valid24){break;}}if(valid24){let i14 = data32.length;let j5;if(i14 > 1){const indices3 = {};for(;i14--;){let item3 = data32[i14];if(typeof item3 !== "string"){continue;}if(typeof indices3[item3] == "number"){j5 = indices3[item3];validate104.errors = [{instancePath:instancePath+"/environment/inherit",schemaPath:"#/properties/environment/properties/inherit/uniqueItems",keyword:"uniqueItems",params:{i: i14, j: j5},message:"must NOT have duplicate items (items ## "+j5+" and "+i14+" are identical)"}];return false;break;}indices3[item3] = i14;}}}}}else {validate104.errors = [{instancePath:instancePath+"/environment/inherit",schemaPath:"#/properties/environment/properties/inherit/type",keyword:"type",params:{type: "array"},message:"must be array"}];return false;}}var valid23 = _errs75 === errors;}else {var valid23 = true;}if(valid23){if(data31.set !== undefined){let data34 = data31.set;const _errs79 = errors;if(errors === _errs79){if(data34 && typeof data34 == "object" && !Array.isArray(data34)){if(Object.keys(data34).length > 64){validate104.errors = [{instancePath:instancePath+"/environment/set",schemaPath:"#/properties/environment/properties/set/maxProperties",keyword:"maxProperties",params:{limit: 64},message:"must NOT have more than 64 properties"}];return false;}else {for(const key9 in data34){const _errs81 = errors;if(typeof key9 === "string"){if(!pattern59.test(key9)){const err2 = {instancePath:instancePath+"/environment/set",schemaPath:"#/properties/environment/properties/set/propertyNames/pattern",keyword:"pattern",params:{pattern: "^[A-Za-z_][A-Za-z0-9_]{0,127}$"},message:"must match pattern \""+"^[A-Za-z_][A-Za-z0-9_]{0,127}$"+"\"",propertyName:key9};if(vErrors === null){vErrors = [err2];}else {vErrors.push(err2);}errors++;}}var valid26 = _errs81 === errors;if(!valid26){const err3 = {instancePath:instancePath+"/environment/set",schemaPath:"#/properties/environment/properties/set/propertyNames",keyword:"propertyNames",params:{propertyName: key9},message:"property name must be valid"};if(vErrors === null){vErrors = [err3];}else {vErrors.push(err3);}errors++;validate104.errors = vErrors;return false;break;}}if(valid26){for(const key10 in data34){let data35 = data34[key10];const _errs83 = errors;if(errors === _errs83){if(typeof data35 === "string"){if(func2(data35) > 8192){validate104.errors = [{instancePath:instancePath+"/environment/set/" + key10.replace(/~/g, "~0").replace(/\//g, "~1"),schemaPath:"#/properties/environment/properties/set/additionalProperties/maxLength",keyword:"maxLength",params:{limit: 8192},message:"must NOT have more than 8192 characters"}];return false;}}else {validate104.errors = [{instancePath:instancePath+"/environment/set/" + key10.replace(/~/g, "~0").replace(/\//g, "~1"),schemaPath:"#/properties/environment/properties/set/additionalProperties/type",keyword:"type",params:{type: "string"},message:"must be string"}];return false;}}var valid27 = _errs83 === errors;if(!valid27){break;}}}}}else {validate104.errors = [{instancePath:instancePath+"/environment/set",schemaPath:"#/properties/environment/properties/set/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid23 = _errs79 === errors;}else {var valid23 = true;}}}}else {validate104.errors = [{instancePath:instancePath+"/environment",schemaPath:"#/properties/environment/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}var valid0 = _errs72 === errors;}else {var valid0 = true;}}}}}}}}}}}else {validate104.errors = [{instancePath,schemaPath:"#/type",keyword:"type",params:{type: "object"},message:"must be object"}];return false;}}validate104.errors = vErrors;return errors === 0;}validate104.evaluated = {"props":true,"dynamicProps":false,"dynamicItems":false};

package/src/generated/runtime.d.cts

@@ -0,0 +1,3 @@
+// Generated by bun run schemas:generate; do not edit.
+declare function validate(value: unknown): boolean;
+export = validate;

package/src/graders/artifact.ts

@@ -11,29 +11,37 @@ import {
 const MAX_ARTIFACT_BYTES = 64 * 1024;
 
 export function validateArtifactPath(path: unknown): asserts path is string {
-  if (
-    typeof path !== "string" ||
-    !path.trim() ||
-    path.includes("\\") ||
-    isAbsolute(path) ||
-    path.split("/").some((part) => part === ".." || part === ".git") ||
-    dirname(path).includes("*") ||
-    !/^[^*]*\*?[^*]*$/.test(basename(path))
-  )
+  if (typeof path !== "string" || !validArtifactPath(path))
     throw new Error(
       "semantic artifact path must be relative with at most one basename *",
     );
 }
+
+function validArtifactPath(path: string): boolean {
+  return (
+    safeRelativePath(path) &&
+    !dirname(path).includes("*") &&
+    /^[^*]*\*?[^*]*$/.test(basename(path))
+  );
+}
+
+function safeRelativePath(path: string): boolean {
+  return (
+    Boolean(path.trim()) &&
+    !path.includes("\\") &&
+    !isAbsolute(path) &&
+    !path.split("/").some((part) => part === ".." || part === ".git")
+  );
+}
+
 function within(root: string, path: string): boolean {
   return path === root || path.startsWith(root + sep);
 }
 
-export async function readSemanticArtifact(
-  repoDir: string,
+async function artifactDirectory(
+  root: string,
   pattern: string,
-): Promise<{ path: string; content: string }> {
-  validateArtifactPath(pattern);
-  const root = await realpath(repoDir);
+): Promise<string> {
   const dir = resolve(root, dirname(pattern));
   if (!within(root, dir))
     throw new Error("semantic artifact directory escapes the fixture");
@@ -42,18 +50,30 @@ export async function readSemanticArtifact(
     throw new Error("semantic artifact directory escapes the fixture");
   if (relative(root, directory).split(sep).includes(".git"))
     throw new Error("semantic artifact directory resolves to Git metadata");
-  const name = basename(pattern);
-  const matches = name.includes("*")
-    ? (await readdir(directory)).filter((entry) => {
-        const [prefix, suffix] = name.split("*");
-        return entry.startsWith(prefix!) && entry.endsWith(suffix!);
-      })
-    : [name];
-  if (matches.length !== 1)
+  return directory;
+}
+
+async function artifactMatches(
+  directory: string,
+  name: string,
+): Promise<string[]> {
+  if (!name.includes("*")) return [name];
+  const [prefix = "", suffix = ""] = name.split("*");
+  return (await readdir(directory)).filter(
+    (entry) => entry.startsWith(prefix) && entry.endsWith(suffix),
+  );
+}
+
+function selectedArtifact(directory: string, matches: string[]): string {
+  const [name] = matches;
+  if (matches.length !== 1 || name === undefined)
     throw new Error(
       `semantic artifact pattern matched ${matches.length} files`,
     );
-  const path = join(directory, matches[0]!);
+  return join(directory, name);
+}
+
+async function resolveArtifact(root: string, path: string): Promise<string> {
   const stat = await lstat(path);
   if (!stat.isFile() || stat.size > MAX_ARTIFACT_BYTES)
     throw new Error(
@@ -64,6 +84,19 @@ export async function readSemanticArtifact(
     throw new Error("semantic artifact escapes the fixture");
   if (relative(root, resolved).split(sep).includes(".git"))
     throw new Error("semantic artifact resolves to Git metadata");
+  return resolved;
+}
+
+export async function readSemanticArtifact(
+  repoDir: string,
+  pattern: string,
+): Promise<{ path: string; content: string }> {
+  validateArtifactPath(pattern);
+  const root = await realpath(repoDir);
+  const directory = await artifactDirectory(root, pattern);
+  const matches = await artifactMatches(directory, basename(pattern));
+  const path = selectedArtifact(directory, matches);
+  const resolved = await resolveArtifact(root, path);
   return {
     path: relative(root, resolved),
     content: await readFile(resolved, "utf8"),

package/src/graders/git-head.ts

@@ -1,5 +1,11 @@
+import { isRecord } from "../value-guards";
 import { lstat } from "node:fs/promises";
 import { join } from "node:path";
+import {
+  captureBoundedText,
+  ProcessDeadline,
+  terminateOwnedProcessGroup,
+} from "../process-lifecycle";
 
 const MAX_OUTPUT_BYTES = 128;
 const TIMEOUT_MS = 10_000;
@@ -20,53 +26,87 @@ export function prepareGitHeadChecks(
   declarations: GitHeadCheckDeclaration[],
 ): PreparedGitHeadCheck[] {
   return declarations.map(({ id, configuration }) => {
-    if (
-      !id ||
-      !configuration ||
-      typeof configuration !== "object" ||
-      Object.keys(configuration).some((key) => key !== "kind") ||
-      (configuration.kind !== "changed" &&
-        configuration.kind !== "unchanged" &&
-        configuration.kind !== "base-ancestor")
-    )
+    if (!id || !validGitHeadConfiguration(configuration))
       throw new Error("invalid Git HEAD check declaration");
     return { id, kind: configuration.kind };
   });
 }
 
-async function boundedOutput(
-  stream: ReadableStream<Uint8Array>,
-): Promise<string> {
-  const reader = stream.getReader();
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  while (true) {
-    const { value, done } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > MAX_OUTPUT_BYTES)
-      throw new Error("Git HEAD output is oversized");
-    chunks.push(value);
-  }
-  return new TextDecoder("utf-8", { fatal: true }).decode(
-    Buffer.concat(chunks),
+function validGitHeadKind(
+  value: unknown,
+): value is PreparedGitHeadCheck["kind"] {
+  return (
+    value === "changed" || value === "unchanged" || value === "base-ancestor"
+  );
+}
+
+function validGitHeadConfiguration(
+  value: unknown,
+): value is { kind: PreparedGitHeadCheck["kind"] } {
+  return (
+    isRecord(value) &&
+    !Object.keys(value).some((key) => key !== "kind") &&
+    validGitHeadKind(value.kind)
   );
 }
 
-function stopProcess(proc: Bun.Subprocess): void {
-  if (process.platform !== "win32") {
+function gitEnvironment() {
+  return {
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
+    ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_TERMINAL_PROMPT: "0",
+  };
+}
+
+async function validateGitMetadata(workspace: string): Promise<void> {
+  const directory = await lstat(join(workspace, ".git"));
+  if (!directory.isDirectory() || directory.isSymbolicLink())
+    throw new Error("Git fixture metadata is not a directory");
+}
+
+class GitHeadExecution {
+  private readonly deadline: ProcessDeadline;
+  constructor(
+    private readonly proc: Bun.Subprocess<"ignore", "pipe", "ignore">,
+    signal: AbortSignal | undefined,
+  ) {
+    this.deadline = new ProcessDeadline({
+      timeoutMs: TIMEOUT_MS,
+      signal,
+      interruption: (reason) =>
+        new Error(
+          reason === "timeout"
+            ? "Git HEAD check timed out"
+            : "Git HEAD check cancelled",
+        ),
+    });
+  }
+
+  private complete() {
+    return Promise.all([
+      captureBoundedText(this.proc.stdout, {
+        limit: MAX_OUTPUT_BYTES,
+        overflow: "reject",
+        exceeded: () => new Error("Git HEAD output is oversized"),
+      }),
+      this.proc.exited,
+    ]).then(([output, code]) => ({ output: output.trim(), code }));
+  }
+
+  async run(): Promise<{ output: string; code: number }> {
     try {
-      process.kill(-proc.pid, "SIGKILL");
-      return;
-    } catch {
-      // The process group may already have exited.
+      return await this.deadline.wait(this.complete());
+    } catch (error) {
+      terminateOwnedProcessGroup(this.proc);
+      await this.proc.exited;
+      throw error;
+    } finally {
+      this.deadline.dispose();
     }
   }
-  try {
-    proc.kill("SIGKILL");
-  } catch {
-    // The process already exited.
-  }
 }
 
 async function git(
@@ -75,52 +115,16 @@ async function git(
   signal?: AbortSignal,
 ): Promise<{ code: number; output: string }> {
   if (signal?.aborted) throw new Error("Git HEAD check cancelled");
-  const gitDirectory = await lstat(join(workspace, ".git"));
-  if (!gitDirectory.isDirectory() || gitDirectory.isSymbolicLink())
-    throw new Error("Git fixture metadata is not a directory");
+  await validateGitMetadata(workspace);
   const proc = Bun.spawn(["git", ...args], {
     cwd: workspace,
     stdin: "ignore",
     stdout: "pipe",
     stderr: "ignore",
     detached: process.platform !== "win32",
-    env: {
-      PATH: process.env.PATH ?? "/usr/bin:/bin",
-      ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
-      GIT_CONFIG_NOSYSTEM: "1",
-      GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
-      GIT_NO_REPLACE_OBJECTS: "1",
-      GIT_TERMINAL_PROMPT: "0",
-    },
+    env: gitEnvironment(),
   });
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  let cancel: (() => void) | undefined;
-  try {
-    const complete = Promise.all([
-      boundedOutput(proc.stdout),
-      proc.exited,
-    ]).then(([output, code]) => ({ output: output.trim(), code }));
-    const timeout = new Promise<never>((_resolve, reject) => {
-      timer = setTimeout(
-        () => reject(new Error("Git HEAD check timed out")),
-        TIMEOUT_MS,
-      );
-    });
-    const aborted = new Promise<never>((_resolve, reject) => {
-      if (!signal) return;
-      cancel = () => reject(new Error("Git HEAD check cancelled"));
-      signal.addEventListener("abort", cancel, { once: true });
-      if (signal.aborted) cancel();
-    });
-    return await Promise.race([complete, timeout, aborted]);
-  } catch (error) {
-    stopProcess(proc);
-    await proc.exited;
-    throw error;
-  } finally {
-    if (timer) clearTimeout(timer);
-    if (cancel) signal?.removeEventListener("abort", cancel);
-  }
+  return new GitHeadExecution(proc, signal).run();
 }
 
 export async function gitHeadRevision(