@bjoernrochel/sevro 0.1.0-rc.7 → 1.0.0

package/src/{repository-fixture.ts → fixtures/repository.ts}

@@ -1,10 +1,12 @@
-import { isRecord, isStringArray } from "./value-guards";
-import { isMissingFile } from "./fixture-tools";
+import { isRecord, isStringArray } from "../value-guards";
+import { isMissingFile } from "./tools";
 import { lstat, mkdir, realpath, stat, writeFile } from "node:fs/promises";
-import { isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { insideRoot } from "../paths";
+import { runGit } from "../git";
 import { fileURLToPath } from "node:url";
-import { canonicalJson } from "./identity";
-import { prepareFixtureBin } from "./fixture-bin";
+import { canonicalJson } from "../identity";
+import { prepareFixtureBin } from "./bin";
 import { prepareGitHooks } from "./git-hooks";
 import type { PreparationSources } from "./preparation";
 import { fixtureParts } from "./preparation";
@@ -167,53 +169,16 @@ export interface RepositorySource {
   revision: string;
 }
 
-async function boundedText(
-  stream: ReadableStream<Uint8Array>,
-): Promise<string> {
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  for await (const chunk of stream) {
-    size += chunk.byteLength;
-    if (size > MAX_GIT_OUTPUT_BYTES)
-      throw new Error("repository fixture Git output is too large");
-    chunks.push(chunk);
-  }
-  return new TextDecoder("utf-8", { fatal: true }).decode(
-    Buffer.concat(chunks),
-  );
-}
-
 async function git(args: string[], cwd: string): Promise<string> {
-  const proc = Bun.spawn(["git", ...args], {
+  const stdout = await runGit({
     cwd,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: {
-      ...process.env,
-      GIT_CONFIG_NOSYSTEM: "1",
-      GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_AUTHOR_NAME: "Sevro Fixture",
-      GIT_AUTHOR_EMAIL: "fixture@sevro.invalid",
-      GIT_COMMITTER_NAME: "Sevro Fixture",
-      GIT_COMMITTER_EMAIL: "fixture@sevro.invalid",
-      GIT_AUTHOR_DATE: "2000-01-01T00:00:00+00:00",
-      GIT_COMMITTER_DATE: "2000-01-01T00:00:00+00:00",
-    },
+    args,
+    identity: "fixture",
+    label: "repository fixture",
+    maxOutputBytes: MAX_GIT_OUTPUT_BYTES,
+    validateUtf8: true,
   });
-  try {
-    const [stdout, , code] = await Promise.all([
-      boundedText(proc.stdout),
-      boundedText(proc.stderr),
-      proc.exited,
-    ]);
-    if (code !== 0) throw new Error("repository fixture Git operation failed");
-    return stdout.trim();
-  } catch (error) {
-    proc.kill("SIGKILL");
-    await proc.exited;
-    throw error;
-  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(stdout).trim();
 }
 
 /** Resolve a declared local repository without accepting a dirty source tree. */
@@ -261,8 +226,7 @@ async function canonicalRepositorySource(selected: {
   }
 }
 function requireContainedRepository(root: string, path: string): void {
-  const child = relative(root, path);
-  if (child === ".." || child.startsWith(`..${sep}`) || isAbsolute(child))
+  if (!insideRoot(root, path))
     throw new Error("repository source escapes its declared root");
 }
 async function repositoryCommit(path: string): Promise<string> {
@@ -272,10 +236,18 @@ async function repositoryCommit(path: string): Promise<string> {
   const revision = await git(["rev-parse", "--verify", "HEAD^{commit}"], path);
   if (!/^[a-f0-9]{40,64}$/.test(revision))
     throw new Error("repository source has no valid commit");
-  if (await git(["status", "--porcelain=v1", "--untracked-files=all"], path))
+  if (
+    await git(
+      [
+        "status",
+        "--porcelain=v1",
+        "--untracked-files=all",
+        "--ignore-submodules=none",
+      ],
+      path,
+    )
+  )
     throw new Error("repository source has uncommitted changes");
-  if (await git(["submodule", "status"], path))
-    throw new Error("repository submodules are not supported");
   return revision;
 }
 function requireRepositorySnapshot(
@@ -306,6 +278,7 @@ export async function cloneRepositorySource(
       "--local",
       "--no-hardlinks",
       "--no-checkout",
+      "--no-recurse-submodules",
       "--quiet",
       current.path,
       workspace,
@@ -375,25 +348,18 @@ export async function applyRepositoryOverlay(
     });
   await stageRepositoryOverlay(fixture, workspace, Object.keys(files));
 }
-function disabledHooksArgs(): string[] {
-  return [
-    "-c",
-    `core.hooksPath=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
-  ];
-}
 async function stageRepositoryOverlay(
   fixture: RepositoryFixture,
   workspace: string,
   paths: string[],
 ): Promise<void> {
-  const noHooks = disabledHooksArgs();
   if (fixture.commitFiles) {
-    await git([...noHooks, "add", "--", ...paths], workspace);
+    await git(["add", "--", ...paths], workspace);
     await git(
-      [...noHooks, "commit", "--quiet", "-m", "Add evaluation scaffolding"],
+      ["commit", "--quiet", "-m", "Add evaluation scaffolding"],
       workspace,
     );
   }
   if (fixture.staged?.length)
-    await git([...noHooks, "add", "--", ...fixture.staged], workspace);
+    await git(["add", "--", ...fixture.staged], workspace);
 }

package/src/{fixture-setup.ts → fixtures/setup.ts}

@@ -1,7 +1,12 @@
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { delimiter, isAbsolute, join } from "node:path";
-import { isRecord } from "./value-guards";
+import { isRecord } from "../value-guards";
+import { requireCandidateRuntime } from "../candidate-artifacts";
+import {
+  ProcessDeadline,
+  terminateOwnedProcessGroup,
+} from "../process-lifecycle";
 
 const MAX_COMMAND_BYTES = 64 * 1024;
 const MAX_ENV_BYTES = 16 * 1024;
@@ -103,27 +108,12 @@ export function prepareFixtureSetup(value: unknown): FixtureSetup | null {
   return { command, environment };
 }
 
-function stopProcess(proc: Bun.Subprocess): void {
-  if (process.platform !== "win32") {
-    try {
-      process.kill(-proc.pid, "SIGKILL");
-      return;
-    } catch {
-      // The process group may already be gone.
-    }
-  }
-  try {
-    proc.kill("SIGKILL");
-  } catch {
-    // The process already exited.
-  }
-}
-
 interface FixtureSetupOptions {
   workspace: string;
   projectRoot: string;
   fixtureBinDir?: string;
   signal?: AbortSignal;
+  candidateRuntimeRoot?: string;
 }
 
 function setupPath(directory: string | undefined): string {
@@ -146,7 +136,9 @@ function executionEnvironment(
   );
   return {
     PATH: setupPath(options.fixtureBinDir),
-    HOME: home,
+    HOME: options.candidateRuntimeRoot
+      ? join(options.candidateRuntimeRoot, "home")
+      : home,
     TMPDIR: home,
     LANG: process.env.LANG ?? "C",
     GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
@@ -164,13 +156,23 @@ function executionEnvironment(
 
 class FixtureSetupExecution {
   private proc: Bun.Subprocess | undefined;
-  private timer: ReturnType<typeof setTimeout> | undefined;
-  private cancel: (() => void) | undefined;
+  private readonly deadline: ProcessDeadline;
   constructor(
     private readonly setup: FixtureSetup,
     private readonly options: FixtureSetupOptions,
     private readonly home: string,
-  ) {}
+  ) {
+    this.deadline = new ProcessDeadline({
+      timeoutMs: TIMEOUT_MS,
+      signal: options.signal,
+      interruption: (reason) =>
+        new Error(
+          reason === "timeout"
+            ? "fixture setup timed out"
+            : "fixture setup cancelled",
+        ),
+    });
+  }
 
   async run(): Promise<void> {
     this.proc = Bun.spawn(this.setup.command, {
@@ -181,44 +183,18 @@ class FixtureSetupExecution {
       stdout: "ignore",
       stderr: "ignore",
     });
-    const code = await Promise.race([
-      this.proc.exited,
-      this.timeout(),
-      this.aborted(),
-    ]);
+    const code = await this.deadline.wait(this.proc.exited);
     if (code !== 0) throw new Error(`fixture setup failed (${code})`);
   }
 
-  private timeout(): Promise<never> {
-    return new Promise((_resolve, reject) => {
-      this.timer = setTimeout(() => {
-        reject(new Error("fixture setup timed out"));
-      }, TIMEOUT_MS);
-    });
-  }
-
-  private aborted(): Promise<never> {
-    return new Promise((_resolve, reject) => {
-      const signal = this.options.signal;
-      if (!signal) return;
-      this.cancel = () => {
-        reject(new Error("fixture setup cancelled"));
-      };
-      if (signal.aborted) this.cancel();
-      else signal.addEventListener("abort", this.cancel, { once: true });
-    });
-  }
-
   async stop(): Promise<void> {
     if (!this.proc) return;
-    stopProcess(this.proc);
+    terminateOwnedProcessGroup(this.proc);
     await this.proc.exited;
   }
 
   async dispose(): Promise<void> {
-    if (this.timer) clearTimeout(this.timer);
-    if (this.cancel)
-      this.options.signal?.removeEventListener("abort", this.cancel);
+    this.deadline.dispose();
     await rm(this.home, { recursive: true, force: true });
   }
 }
@@ -229,6 +205,12 @@ export async function runFixtureSetup(
   options: FixtureSetupOptions,
 ): Promise<void> {
   if (options.signal?.aborted) throw new Error("fixture setup cancelled");
+  await requireCandidateRuntime(options.candidateRuntimeRoot);
+  if (options.candidateRuntimeRoot)
+    await mkdir(join(options.candidateRuntimeRoot, "home"), {
+      recursive: true,
+      mode: 0o700,
+    });
   const home = await mkdtemp(join(tmpdir(), "sevro-setup-"));
   const execution = new FixtureSetupExecution(setup, options, home);
   try {

package/src/{fixture-tools.ts → fixtures/tools.ts}

@@ -1,6 +1,6 @@
 import { chmod, lstat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { isRecord } from "./value-guards";
+import { isRecord } from "../value-guards";
 
 export function isMissingFile(error: unknown): boolean {
   return error instanceof Error && "code" in error && error.code === "ENOENT";

package/src/fixtures/workspace-state.ts

@@ -0,0 +1,212 @@
+import { realpathSync } from "node:fs";
+import type { Stats } from "node:fs";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  realpath,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir, userInfo } from "node:os";
+import { basename, dirname, join } from "node:path";
+import {
+  ownerStatus,
+  processIdentity,
+  validProcessIdentity,
+  type ProcessIdentity,
+} from "../run-owner";
+import { isRecord } from "../value-guards";
+import { isMissingFile } from "./tools";
+import { atomicWriteJson } from "../storage";
+import { clearFixtureContents } from "./cleanup";
+
+const RETENTION_MS = 24 * 60 * 60_000;
+interface WorkspaceOwner {
+  format: "sevro.workspace-owner.v1";
+  owner: ProcessIdentity;
+  state: "active" | "retained";
+  timestamp: number;
+}
+
+/** One stable boundary protects both existing and subsequently allocated peers. */
+export function workspaceStatePath(): string {
+  const base = process.platform === "linux" ? "/var/tmp" : tmpdir();
+  return join(realpathSync(base), "sevro-workspaces-private");
+}
+
+export async function workspaceStateParent(): Promise<string> {
+  const root = workspaceStatePath();
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const info = await lstat(root);
+  if (
+    !info.isDirectory() ||
+    info.uid !== userInfo().uid ||
+    (info.mode & 0o077) !== 0
+  )
+    throw new Error("workspace namespace must be an owned private directory");
+  return realpath(root);
+}
+
+export async function allocateWorkspace(): Promise<string> {
+  const owner = processIdentity(process.pid);
+  if (!owner) throw new Error("cannot verify workspace owner identity");
+  const parent = await workspaceStateParent();
+  await workspaceMetadataDirectory(parent);
+  const workspace = await realpath(await mkdtemp(join(parent, "case-")));
+  try {
+    await writeFile(
+      workspaceOwnerPath(workspace),
+      JSON.stringify({
+        format: "sevro.workspace-owner.v1",
+        owner,
+        state: "active",
+        timestamp: Date.now(),
+      }),
+      { mode: 0o600, flag: "wx" },
+    );
+    return workspace;
+  } catch (cause) {
+    await rm(workspace, { recursive: true, force: true });
+    throw cause;
+  }
+}
+
+async function workspaceMetadataDirectory(parent: string): Promise<string> {
+  const root = join(parent, ".owners");
+  await mkdir(root, { mode: 0o700, recursive: true });
+  const metadata = await lstat(root);
+  if (!ownedDirectory(metadata) || (metadata.mode & 0o077) !== 0)
+    throw new Error("workspace metadata must be an owned private directory");
+  return root;
+}
+
+function workspaceOwnerPath(workspace: string): string {
+  return join(dirname(workspace), ".owners", `${basename(workspace)}.json`);
+}
+
+function validWorkspaceLifecycle(value: Record<string, unknown>): boolean {
+  return (
+    (value.state === "active" || value.state === "retained") &&
+    typeof value.timestamp === "number" &&
+    Number.isFinite(value.timestamp)
+  );
+}
+
+function validWorkspaceOwner(value: unknown): value is WorkspaceOwner {
+  return (
+    isRecord(value) &&
+    value.format === "sevro.workspace-owner.v1" &&
+    validWorkspaceLifecycle(value) &&
+    validProcessIdentity(value.owner)
+  );
+}
+
+function privateOwnerFile(info: Stats): boolean {
+  return (
+    info.isFile() &&
+    info.uid === userInfo().uid &&
+    info.size <= 4096 &&
+    (info.mode & 0o077) === 0
+  );
+}
+
+async function readWorkspaceOwner(workspace: string): Promise<unknown> {
+  const path = workspaceOwnerPath(workspace);
+  if (!privateOwnerFile(await lstat(path))) return null;
+  return JSON.parse(await readFile(path, "utf8")) as unknown;
+}
+
+async function workspaceOwner(
+  workspace: string,
+): Promise<WorkspaceOwner | null> {
+  try {
+    const value = await readWorkspaceOwner(workspace);
+    return validWorkspaceOwner(value) ? value : null;
+  } catch {
+    // Unreadable or malformed ownership cannot authorize temporary-data deletion.
+    return null;
+  }
+}
+
+export async function retainWorkspace(workspace: string): Promise<void> {
+  if (!workspaceBoundaryException(workspaceStatePath(), workspace).length)
+    return;
+  const record = await workspaceOwner(workspace);
+  if (!record || record.state === "retained") return;
+  await atomicWriteJson(workspaceOwnerPath(workspace), {
+    ...record,
+    state: "retained",
+    timestamp: Date.now(),
+  });
+}
+
+export async function removeWorkspace(workspace: string): Promise<void> {
+  await rm(workspace, { recursive: true, force: true });
+  if (workspaceBoundaryException(workspaceStatePath(), workspace).length)
+    await rm(workspaceOwnerPath(workspace), { force: true });
+}
+
+async function expireWorkspace(
+  workspace: string,
+  cutoff: number,
+): Promise<void> {
+  const record = await workspaceOwner(workspace);
+  if (!record || !expiredOwner(record, cutoff)) return;
+  const info = await lstat(workspace).catch((cause: unknown) => {
+    if (isMissingFile(cause)) return null;
+    throw cause;
+  });
+  if (info && !ownedDirectory(info)) return;
+  await clearExpiredWorkspace(workspace, info);
+}
+
+async function clearExpiredWorkspace(
+  workspace: string,
+  info: Stats | null,
+): Promise<void> {
+  if (info) await clearFixtureContents(workspace);
+  await removeWorkspace(workspace);
+}
+
+function ownedDirectory(info: Stats): boolean {
+  return info.isDirectory() && info.uid === userInfo().uid;
+}
+
+function expiredOwner(record: WorkspaceOwner, cutoff: number): boolean {
+  return (
+    record.timestamp < cutoff &&
+    (record.state === "retained" || ownerStatus(record.owner) === "dead")
+  );
+}
+
+/** Reclaim only owned inactive temporary data; evidence directories are never scanned. */
+export async function cleanupExpiredWorkspaces(): Promise<void> {
+  const parent = await workspaceStateParent();
+  const metadata = await workspaceMetadataDirectory(parent);
+  const cutoff = Date.now() - RETENTION_MS;
+  for (const entry of await readdir(metadata, { withFileTypes: true }))
+    if (entry.isFile() && /^case-[a-zA-Z0-9]+\.json$/.test(entry.name)) {
+      const workspace = join(parent, entry.name.slice(0, -5));
+      await expireWorkspace(workspace, cutoff).catch((cause: unknown) => {
+        if (!isMissingFile(cause))
+          console.warn(
+            `temporary workspace cleanup did not complete: ${workspace}`,
+          );
+      });
+    }
+}
+
+/** Only a runner-owned direct child can be an exception to this deny boundary. */
+export function workspaceBoundaryException(
+  root: string,
+  workspace?: string,
+): string[] {
+  return root === workspaceStatePath() &&
+    workspace !== undefined &&
+    dirname(workspace) === root
+    ? [workspace]
+    : [];
+}

package/src/generated/cli-result.d.cts

@@ -1,3 +1,4 @@
 // Generated by bun run schemas:generate; do not edit.
-declare function validate(value: unknown): boolean;
+import type { ValidateFunction } from "ajv";
+declare const validate: ValidateFunction;
 export = validate;

package/src/generated/extension.d.cts

@@ -1,3 +1,4 @@
 // Generated by bun run schemas:generate; do not edit.
-declare function validate(value: unknown): boolean;
+import type { ValidateFunction } from "ajv";
+declare const validate: ValidateFunction;
 export = validate;