@bjoernrochel/sevro 0.1.0-rc.8 → 1.0.0

package/src/graders/shell.ts

@@ -1,4 +1,4 @@
-import { runtimeSeedSources } from "../runtime-config";
+import { runtimeLocalHttpEnabled, runtimeSeedSources } from "../runtime/config";
 import {
   candidateArtifactEnvironment,
   type CandidateArtifactRoots,
@@ -6,9 +6,15 @@ import {
 import { mkdir, stat } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 import { prepareIsolatedCommand } from "../hosts/isolation";
-import type { RuntimePolicy } from "../runtime-config";
-import { prepareRuntimeState } from "../runtime-state";
+import type { RuntimePolicy } from "../runtime/config";
+import { prepareRuntimeState } from "../runtime/state";
+import { sharedCacheDenyRoots } from "../runtime/shared-cache";
 import { hashJson } from "../identity";
+import {
+  captureBoundedText,
+  ProcessDeadline,
+  terminateOwnedProcessGroup,
+} from "../process-lifecycle";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 120_000;
@@ -239,32 +245,12 @@ function forbiddenPatternFailure(
 async function boundedOutput(
   stream: ReadableStream<Uint8Array>,
 ): Promise<string> {
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  for await (const chunk of stream) {
-    size += chunk.byteLength;
-    if (size > MAX_OUTPUT_BYTES) throw new Error("shell stdout exceeds 1 MiB");
-    chunks.push(chunk);
-  }
-  return new TextDecoder("utf-8", { fatal: true }).decode(
-    Buffer.concat(chunks),
-  );
-}
-
-function stopProcess(proc: Bun.Subprocess): void {
-  if (process.platform !== "win32") {
-    try {
-      process.kill(-proc.pid, "SIGKILL");
-      return;
-    } catch {
-      // The group may already be gone.
-    }
-  }
-  try {
-    proc.kill("SIGKILL");
-  } catch {
-    // The process already exited.
-  }
+  return captureBoundedText(stream, {
+    limit: MAX_OUTPUT_BYTES,
+    overflow: "reject",
+    exceeded: () => new Error("shell stdout exceeds 1 MiB"),
+    cancelOnError: true,
+  });
 }
 
 interface ShellRunOptions {
@@ -294,7 +280,11 @@ async function shellRuntime(options: ShellRunOptions) {
       privateRuntimeRoot: runtime.root,
     };
   }
-  const root = join(options.workspace, ".git", "sevro-runtime"),
+  const root = join(
+      options.privateStateRoot,
+      "runtime",
+      hashJson(options.workspace),
+    ),
     home = join(root, "check-home"),
     temp = join(root, "check-tmp");
   await Promise.all([
@@ -305,9 +295,10 @@ async function shellRuntime(options: ShellRunOptions) {
     root,
     home,
     temp,
-    uvCache: join(root, "uv-cache"),
+    uvCache: join(options.workspace, ".git", "sevro-runtime", "uv-cache"),
     environment: {} as Record<string, string>,
-    privateRuntimeRoot: undefined,
+    privateRuntimeRoot: root,
+    writableCacheRoots: [],
   };
 }
 type ShellRuntime = Awaited<ReturnType<typeof shellRuntime>>;
@@ -368,30 +359,39 @@ function shellStdout(
 }
 class ShellExecution {
   private proc?: Bun.Subprocess;
-  private timer?: ReturnType<typeof setTimeout>;
-  private cancel?: () => void;
+  private readonly deadline: ProcessDeadline;
   constructor(
     private check: PreparedShellCheck,
     private options: ShellRunOptions,
     private isolation: Isolation,
     private runtime: ShellRuntime,
-  ) {}
+  ) {
+    this.deadline = new ProcessDeadline({
+      timeoutMs: check.timeoutMs,
+      signal: options.signal,
+      interruption: (reason) =>
+        new Error(
+          reason === "timeout"
+            ? "shell check timed out"
+            : "shell check cancelled",
+        ),
+    });
+  }
   async run(): Promise<ShellCheckResult> {
     try {
       const running = this.spawn();
       const stream = shellStdout(this.check, running.stdout);
-      const timeout = this.deadline();
-      const aborted = this.cancellation();
-      const completed = Promise.all([
-        running.exited,
-        stream ? boundedOutput(stream) : Promise.resolve(null),
-      ]).then(([exitCode, stdout]) => ({ exitCode, stdout }));
-      return await Promise.race([completed, timeout, aborted]);
+      return await this.deadline.wait(() =>
+        Promise.all([
+          running.exited,
+          stream ? boundedOutput(stream) : Promise.resolve(null),
+        ]).then(([exitCode, stdout]) => ({ exitCode, stdout })),
+      );
     } catch (error) {
       await this.stop();
       throw error;
     } finally {
-      this.releaseListeners();
+      this.deadline.dispose();
       await this.isolation.release();
     }
   }
@@ -406,35 +406,12 @@ class ShellExecution {
     });
     return this.proc;
   }
-  private deadline(): Promise<never> {
-    return new Promise((_resolve, reject) => {
-      this.timer = setTimeout(() => {
-        reject(new Error("shell check timed out"));
-      }, this.check.timeoutMs);
-    });
-  }
-  private cancellation(): Promise<never> {
-    return new Promise((_resolve, reject) => {
-      const signal = this.options.signal;
-      if (!signal) return;
-      this.cancel = () => {
-        reject(new Error("shell check cancelled"));
-      };
-      if (signal.aborted) this.cancel();
-      else signal.addEventListener("abort", this.cancel, { once: true });
-    });
-  }
   private async stop(): Promise<void> {
     const proc = this.proc;
     if (!proc) return;
-    stopProcess(proc);
+    terminateOwnedProcessGroup(proc);
     await proc.exited;
   }
-  private releaseListeners(): void {
-    if (this.timer) clearTimeout(this.timer);
-    if (this.cancel)
-      this.options.signal?.removeEventListener("abort", this.cancel);
-  }
 }
 
 /** Run a check without inherited credentials or retaining raw process output. */
@@ -451,17 +428,22 @@ export async function runShellCheck(
     protectedRootsCanonical: options.protectedRootsCanonical,
     privateStateRoot: options.privateStateRoot,
     denyNetwork: true,
+    localHttp: runtimeLocalHttpEnabled(options.runtimePolicy, "checks"),
     readOnlyRoots: options.runtimePolicy?.readOnlyRoots,
     candidateArtifactRoots: options.candidateArtifactRoots,
     transcriptReadRoots: options.candidateTranscriptRoot
       ? [options.candidateTranscriptRoot]
       : [],
     writableRuntimeRoot: runtime.privateRuntimeRoot,
+    writableCacheRoots: runtime.writableCacheRoots,
   });
   await requireShellRuntimeCache(options, runtime);
   return new ShellExecution(check, options, isolated, runtime).run();
 }
 
 function shellSeedSources(options: ShellRunOptions): string[] {
-  return runtimeSeedSources(options.runtimePolicy);
+  return [
+    ...runtimeSeedSources(options.runtimePolicy),
+    ...sharedCacheDenyRoots(options.runtimePolicy, "checks"),
+  ];
 }

package/src/host-diagnostic-redaction.ts

@@ -0,0 +1,52 @@
+import { readFile, stat } from "node:fs/promises";
+import { isRecord } from "./value-guards";
+
+function credentialStrings(value: unknown): string[] {
+  const pending: unknown[] = [value];
+  const secrets: string[] = [];
+  for (let visited = 0; visited < 256; visited++) {
+    const item = pending.pop();
+    if (typeof item === "string") {
+      if (item.length >= 8) secrets.push(item);
+    } else if (isRecord(item)) pending.push(...Object.values(item));
+  }
+  return secrets;
+}
+
+/** Read credentials only for scrubbing; failures belong to the actual host preparation. */
+export async function diagnosticSecrets(path: string): Promise<string[]> {
+  try {
+    if ((await stat(path)).size > 1024 * 1024) return [];
+    const text = await readFile(path, "utf8");
+    try {
+      const value: unknown = JSON.parse(text);
+      return credentialStrings(value);
+    } catch {
+      return text.trim() ? [text.trim()] : [];
+    }
+  } catch {
+    return [];
+  }
+}
+
+export function redactDiagnosticText(text: string, secrets: string[]): string {
+  for (const secret of secrets) {
+    text = text.replaceAll(secret, "[redacted]");
+    text = redactCredentialSuffix(text, secret);
+  }
+  return text
+    .replace(/(authorization\s*:\s*)[^\r\n]+/gi, "$1[redacted]")
+    .replace(/\bBearer\s+\S+/gi, "Bearer [redacted]")
+    .replace(/\bsk-[A-Za-z0-9_-]+/g, "[redacted]")
+    .replace(
+      /((?:api[_-]?key|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)\S+/gi,
+      "$1[redacted]",
+    );
+}
+
+function redactCredentialSuffix(text: string, secret: string): string {
+  const start = text.lastIndexOf(secret.slice(0, Math.min(8, secret.length)));
+  if (start >= 0 && secret.startsWith(text.slice(start)))
+    return text.slice(0, start) + "[redacted]";
+  return text;
+}

package/src/host-diagnostics.ts

@@ -0,0 +1,331 @@
+import type { HostResult } from "./evaluation/types";
+import type { RuntimeRole } from "./runtime/state";
+import {
+  diagnosticSecrets,
+  redactDiagnosticText,
+} from "./host-diagnostic-redaction";
+
+const MAX_TEXT_BYTES = 64 * 1024;
+interface ProcessDiagnostic {
+  code: number | null;
+  out: string;
+  stderr: Uint8Array;
+  stderrTruncated: boolean;
+  signal: string | null;
+  durationMs: number;
+  stdoutTruncated?: boolean;
+  reason: "exit" | "timeout" | "cancelled" | "error" | "spawn";
+}
+
+export type ProcessFailureReason = ProcessDiagnostic["reason"];
+
+export class HostDiagnosticPersistenceError extends Error {
+  constructor(persistenceCause: unknown, hostCause: unknown) {
+    super("host diagnostic persistence failed", {
+      cause: new AggregateError(
+        [hostCause, persistenceCause],
+        "host and persistence failures",
+      ),
+    });
+  }
+}
+
+export function rethrowDiagnosticPersistenceError(cause: unknown): void {
+  if (cause instanceof HostDiagnosticPersistenceError) throw cause;
+}
+
+/** Drain observers capture only a prefix; completion records actual native termination. */
+export class HostProcessDiagnostics {
+  readonly stdout = new DiagnosticStream();
+  readonly stderr = new DiagnosticStream();
+  private started = performance.now();
+  constructor(private diagnostics: HostDiagnostics) {}
+  recordUnstarted(): void {
+    if (!this.diagnostics.enabled) return;
+    this.diagnostics.process({
+      code: null,
+      signal: null,
+      durationMs: performance.now() - this.started,
+      out: "",
+      stderr: new Uint8Array(),
+      stderrTruncated: false,
+      reason: "spawn",
+    });
+  }
+  async record(
+    process: { exited: Promise<number | null>; signalCode?: string | null },
+    reason: ProcessFailureReason = "exit",
+  ): Promise<void> {
+    if (!this.diagnostics.enabled) return;
+    this.diagnostics.process({
+      code: await process.exited,
+      signal: process.signalCode ?? null,
+      durationMs: performance.now() - this.started,
+      out: this.stdout.bytes().toString("utf8"),
+      stdoutTruncated: this.stdout.truncated,
+      stderr: this.stderr.bytes(),
+      stderrTruncated: this.stderr.truncated,
+      reason,
+    });
+  }
+}
+
+function boundedText(bytes: Uint8Array, secrets: string[]) {
+  const redacted = Buffer.from(
+    redactDiagnosticText(
+      Buffer.from(bytes.subarray(0, MAX_TEXT_BYTES)).toString("utf8"),
+      secrets,
+    ),
+  );
+  return {
+    text: new TextDecoder().decode(redacted.subarray(0, MAX_TEXT_BYTES), {
+      stream: true,
+    }),
+    truncated:
+      bytes.byteLength > MAX_TEXT_BYTES || redacted.byteLength > MAX_TEXT_BYTES,
+  };
+}
+
+/** Keep a byte-bounded prefix while the owning transport continues draining. */
+export class DiagnosticStream {
+  private chunks: Uint8Array[] = [];
+  private size = 0;
+  truncated = false;
+  add(bytes: Uint8Array): void {
+    const retained = bytes.subarray(0, Math.max(0, MAX_TEXT_BYTES - this.size));
+    if (retained.byteLength) this.chunks.push(Buffer.from(retained));
+    this.size += retained.byteLength;
+    this.truncated ||= retained.byteLength !== bytes.byteLength;
+  }
+  bytes(): Buffer {
+    return Buffer.concat(this.chunks);
+  }
+}
+
+function errorCode(cause: Error): { code?: string | number } {
+  if (!("code" in cause)) return {};
+  const code: unknown = cause.code;
+  return typeof code === "string" || typeof code === "number" ? { code } : {};
+}
+
+function errorEvidence(
+  cause: unknown,
+  secrets: string[],
+): Record<string, unknown> {
+  return errorChain(cause, secrets, new Set());
+}
+
+function errorChain(
+  cause: unknown,
+  secrets: string[],
+  seen: Set<Error>,
+): Record<string, unknown> {
+  if (!(cause instanceof Error))
+    return {
+      name: "NonError",
+      message: redactDiagnosticText(String(cause).slice(0, 8192), secrets),
+    };
+  if (seen.has(cause) || seen.size === 8) return { truncated: true };
+  seen.add(cause);
+  return {
+    ...errorDetails(cause, secrets),
+    ...(cause.cause === undefined
+      ? {}
+      : { cause: errorChain(cause.cause, secrets, seen) }),
+  };
+}
+
+function errorDetails(cause: Error, secrets: string[]) {
+  return {
+    name: redactDiagnosticText(cause.name.slice(0, 200), secrets),
+    message: redactDiagnosticText(cause.message.slice(0, 8192), secrets),
+    stack: redactDiagnosticText(cause.stack?.slice(0, 8192) ?? "", secrets),
+    ...errorCode(cause),
+  };
+}
+
+/** A cleanup exception must not replace an already captured host/persistence failure. */
+export async function cleanupNativeState(
+  diagnostics: HostDiagnostics,
+  cleanup: () => Promise<void>,
+): Promise<void> {
+  beginNativeCleanup(diagnostics);
+  try {
+    await cleanup();
+  } catch (cause) {
+    if (!diagnostics.failureCaptured) throw cause;
+    console.warn(
+      "native state cleanup failed; original host failure preserved",
+    );
+  }
+}
+
+function beginNativeCleanup(diagnostics: HostDiagnostics): void {
+  if (!diagnostics.failureCaptured) diagnostics.stage = "cleanup";
+}
+
+export function diagnosticConfiguration(enabled: boolean | undefined) {
+  return enabled ? { "sevro.host.retain-diagnostics": true } : {};
+}
+
+export function createHostDiagnostics(
+  host: "codex" | "claude",
+  enabled: boolean | undefined,
+  request: {
+    runtimeRole?: RuntimeRole;
+    retainHostDiagnostics?: (bytes: Uint8Array) => Promise<void>;
+  },
+): HostDiagnostics {
+  return enabled
+    ? new RetainedHostDiagnostics(
+        host,
+        request.runtimeRole,
+        request.retainHostDiagnostics,
+      )
+    : new DisabledHostDiagnostics();
+}
+
+export async function diagnoseHostRequest(
+  diagnostics: HostDiagnostics,
+  execute: () => Promise<HostResult>,
+): Promise<HostResult> {
+  try {
+    return await execute();
+  } catch (cause) {
+    if (cause instanceof HostDiagnosticPersistenceError) throw cause;
+    if (!diagnostics.enabled) throw cause;
+    const result: HostResult = {
+      finalMessage: null,
+      complete: false,
+      executionFailed: true,
+      actualCondition: "passive",
+    };
+    await diagnostics.retain(result, cause);
+    return result;
+  }
+}
+
+export interface HostDiagnostics {
+  readonly enabled: boolean;
+  stage: string;
+  failure: unknown;
+  readonly failureCaptured: boolean;
+  readCredentials(path: string | undefined): Promise<void>;
+  registerCredentials(
+    environment: Record<string, string>,
+    names: readonly string[],
+  ): void;
+  process(result: ProcessDiagnostic): void;
+  retain(result: HostResult, cause: unknown): Promise<void>;
+  retainFailure(result: HostResult, message: string): Promise<void>;
+}
+
+class DisabledHostDiagnostics implements HostDiagnostics {
+  readonly enabled = false;
+  stage = "preparation";
+  failure: unknown;
+  readonly failureCaptured = false;
+
+  readCredentials(): Promise<void> {
+    return Promise.resolve();
+  }
+
+  registerCredentials(): void {}
+
+  process(): void {}
+
+  retain(): Promise<void> {
+    return Promise.resolve();
+  }
+
+  retainFailure(): Promise<void> {
+    return Promise.resolve();
+  }
+}
+
+/** Private failure evidence, independent of native sessions and transcript access. */
+class RetainedHostDiagnostics implements HostDiagnostics {
+  readonly enabled = true;
+  stage = "preparation";
+  failure: unknown;
+  failureCaptured = false;
+  private processes: Record<string, unknown>[] = [];
+  private processesDropped = 0;
+  private secrets: string[] = [];
+  constructor(
+    private host: "codex" | "claude",
+    private role: RuntimeRole = "candidate",
+    private persist?: (bytes: Uint8Array) => Promise<void>,
+  ) {}
+
+  async readCredentials(path: string | undefined): Promise<void> {
+    if (path) this.secrets.push(...(await diagnosticSecrets(path)));
+  }
+
+  registerCredentials(
+    environment: Record<string, string>,
+    names: readonly string[],
+  ): void {
+    for (const name of names) {
+      const value = environment[name];
+      if (value) this.secrets.push(value);
+    }
+  }
+
+  process(result: ProcessDiagnostic): void {
+    const stdout = boundedText(Buffer.from(result.out), this.secrets);
+    const stderr = boundedText(result.stderr, this.secrets);
+    this.addProcess({
+      stage: this.stage,
+      code: result.code,
+      signal: result.signal,
+      durationMs: result.durationMs,
+      reason: result.reason,
+      stdout: stdout.text,
+      stdoutTruncated: stdout.truncated || result.stdoutTruncated === true,
+      stderr: stderr.text,
+      stderrTruncated: stderr.truncated || result.stderrTruncated,
+    });
+  }
+
+  private addProcess(receipt: Record<string, unknown>): void {
+    this.processes.push(receipt);
+    while (
+      this.processes.length > 32 ||
+      Buffer.byteLength(JSON.stringify(this.processes)) > 2 * 1024 * 1024
+    ) {
+      this.processes.shift();
+      this.processesDropped++;
+    }
+  }
+
+  async retainFailure(result: HostResult, message: string): Promise<void> {
+    if (result.executionFailed)
+      await this.retain(result, this.failure ?? new Error(message));
+  }
+
+  async retain(result: HostResult, cause: unknown): Promise<void> {
+    this.failureCaptured = true;
+    const bytes = Buffer.from(
+      JSON.stringify({
+        format: "sevro.host-diagnostics.v1",
+        host: this.host,
+        role: this.role,
+        stage: this.stage,
+        error: errorEvidence(cause, this.secrets),
+        processes: this.processes,
+        processesDropped: this.processesDropped,
+      }),
+    );
+    if (this.persist) {
+      try {
+        await this.persist(bytes);
+      } catch (persistenceCause) {
+        throw new HostDiagnosticPersistenceError(persistenceCause, cause);
+      }
+      return;
+    }
+    result.artifacts ??= [];
+    result.artifacts.push({ id: "sevro.host.diagnostics", bytes });
+  }
+}