@bjoernrochel/sevro 0.1.0-rc.8 → 1.1.0

package/dist/src/graders/shell.js

@@ -0,0 +1,321 @@
+import { spawn } from "../runtime-process.js";
+import { runtimeLocalHttpEnabled, runtimeSeedSources } from "../runtime/config.js";
+import { candidateArtifactEnvironment, } from "../candidate-artifacts.js";
+import { mkdir, stat } from "node:fs/promises";
+import { delimiter, join } from "node:path";
+import { prepareIsolatedCommand } from "../hosts/isolation.js";
+import { prepareRuntimeState } from "../runtime/state.js";
+import { sharedCacheDenyRoots } from "../runtime/shared-cache.js";
+import { hashJson } from "../identity.js";
+import { captureBoundedText, ProcessDeadline, terminateOwnedProcessGroup, } from "../process-lifecycle.js";
+const DEFAULT_TIMEOUT_MS = 30_000;
+const MAX_TIMEOUT_MS = 120_000;
+const MAX_OUTPUT_BYTES = 1024 * 1024;
+function requireShellDeclaration(id, value) {
+    if (!id || !value || typeof value !== "object")
+        throw new Error("invalid shell check declaration");
+}
+function requireShellKeys(config) {
+    const allowed = [
+        "run",
+        "expectedExitCode",
+        "timeoutMs",
+        "expectExact",
+        "expectRegex",
+        "notRegex",
+        "flags",
+    ];
+    if (Object.keys(config).some((key) => !allowed.includes(key)))
+        throw new Error("unsupported shell check configuration");
+}
+function requireShellCommand(run) {
+    if (typeof run !== "string" || !run.trim() || run.length > 4096)
+        throw new Error("shell check requires a bounded command");
+}
+function requireExpectedExit(code) {
+    if (typeof code !== "number" ||
+        !Number.isSafeInteger(code) ||
+        code < 0 ||
+        code > 255)
+        throw new Error("invalid expected shell exit code");
+}
+function requireShellTimeout(timeout) {
+    if (typeof timeout !== "number" ||
+        !Number.isSafeInteger(timeout) ||
+        timeout < 1 ||
+        timeout > MAX_TIMEOUT_MS)
+        throw new Error("invalid shell check timeout");
+}
+function requireExactShellOutput(output) {
+    if (output !== undefined &&
+        (typeof output !== "string" ||
+            Buffer.byteLength(output, "utf8") > MAX_OUTPUT_BYTES))
+        throw new Error("invalid exact shell output expectation");
+}
+function requireShellFlags(flags) {
+    if (flags !== "" &&
+        (typeof flags !== "string" ||
+            !/^[isu]*$/.test(flags) ||
+            new Set(flags).size !== flags.length))
+        throw new Error("invalid shell regex flags");
+}
+function requireFlagPattern(flags, expected, forbidden) {
+    if (flags && expected === undefined && forbidden === undefined)
+        throw new Error("shell regex flags require a pattern");
+}
+function shellOptions(config) {
+    const { run, expectedExitCode = 0, timeoutMs = DEFAULT_TIMEOUT_MS, expectExact, expectRegex, notRegex, flags = "", } = config;
+    requireShellCommand(run);
+    requireExpectedExit(expectedExitCode);
+    requireShellTimeout(timeoutMs);
+    requireExactShellOutput(expectExact);
+    requireShellFlags(flags);
+    requireFlagPattern(flags, expectRegex, notRegex);
+    return {
+        run,
+        expectedExitCode,
+        timeoutMs,
+        expectExact,
+        expectRegex,
+        notRegex,
+        flags,
+    };
+}
+function compileShellPattern(value, flags) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length > 4096)
+        throw new Error("invalid shell regex pattern");
+    try {
+        return new RegExp(value, `m${flags}`);
+    }
+    catch (cause) {
+        throw new Error("invalid shell regex pattern or flags", { cause });
+    }
+}
+function prepareShellCheck({ id, configuration, }) {
+    requireShellDeclaration(id, configuration);
+    requireShellKeys(configuration);
+    const config = shellOptions(configuration);
+    const expectRegex = compileShellPattern(config.expectRegex, config.flags), notRegex = compileShellPattern(config.notRegex, config.flags);
+    return {
+        id,
+        run: config.run,
+        expectedExitCode: config.expectedExitCode,
+        timeoutMs: config.timeoutMs,
+        expectExact: config.expectExact,
+        expectRegex,
+        notRegex,
+        captureStdout: config.expectExact !== undefined ||
+            expectRegex !== undefined ||
+            notRegex !== undefined,
+    };
+}
+export function prepareShellChecks(declarations) {
+    return declarations.map(prepareShellCheck);
+}
+/** Grade bounded shell output without exposing it in retained evidence. */
+export function assessShellCheck(check, result) {
+    if (result.exitCode !== check.expectedExitCode)
+        return {
+            passed: false,
+            detail: `exit code ${result.exitCode} (expected ${check.expectedExitCode})`,
+        };
+    if (check.captureStdout && result.stdout === null)
+        throw new Error("shell stdout observation is missing");
+    const detail = shellOutputFailure(check, result.stdout);
+    return assessedShellOutput(detail, result.exitCode);
+}
+function shellOutputFailure(check, out) {
+    return (exactOutputFailure(check, out) ??
+        expectedPatternFailure(check, out) ??
+        forbiddenPatternFailure(check, out));
+}
+function assessedShellOutput(detail, exitCode) {
+    return detail === undefined
+        ? { passed: true, detail: `exit code ${exitCode}` }
+        : { passed: false, detail };
+}
+function exactOutputFailure(check, out) {
+    if (check.expectExact === undefined)
+        return undefined;
+    if (out === null)
+        throw new Error("shell stdout observation is missing");
+    const actual = out.endsWith("\n") ? out.slice(0, -1) : out;
+    return actual === check.expectExact
+        ? undefined
+        : "exact shell output did not match";
+}
+function expectedPatternFailure(check, out) {
+    return check.expectRegex && !check.expectRegex.test(String(out))
+        ? "expected shell output pattern did not match"
+        : undefined;
+}
+function forbiddenPatternFailure(check, out) {
+    return check.notRegex && check.notRegex.test(String(out))
+        ? "forbidden shell output pattern matched"
+        : undefined;
+}
+async function boundedOutput(stream) {
+    return captureBoundedText(stream, {
+        limit: MAX_OUTPUT_BYTES,
+        overflow: "reject",
+        exceeded: () => new Error("shell stdout exceeds 1 MiB"),
+        cancelOnError: true,
+    });
+}
+async function shellRuntime(options) {
+    if (options.runtimePolicy) {
+        const runtime = await prepareRuntimeState(options.workspace, options.runtimePolicy, "checks", join(options.privateStateRoot, "runtime", hashJson(options.workspace)));
+        return {
+            ...runtime,
+            uvCache: join(runtime.root, "uv-cache"),
+            privateRuntimeRoot: runtime.root,
+        };
+    }
+    const root = join(options.privateStateRoot, "runtime", hashJson(options.workspace)), home = join(root, "check-home"), temp = join(root, "check-tmp");
+    await Promise.all([
+        mkdir(home, { recursive: true, mode: 0o700 }),
+        mkdir(temp, { recursive: true, mode: 0o700 }),
+    ]);
+    return {
+        root,
+        home,
+        temp,
+        uvCache: join(options.workspace, ".git", "sevro-runtime", "uv-cache"),
+        environment: {},
+        privateRuntimeRoot: root,
+        writableCacheRoots: [],
+    };
+}
+function shellRuntimeEnvironment(runtime, enabled) {
+    return enabled
+        ? {
+            UV_CACHE_DIR: runtime.uvCache,
+            UV_PROJECT_ENVIRONMENT: join(runtime.root, "project-environment"),
+            UV_OFFLINE: "1",
+            PYTHONDONTWRITEBYTECODE: "1",
+        }
+        : {};
+}
+function shellEnvironment(options, runtime) {
+    return {
+        ...runtime.environment,
+        ...candidateArtifactEnvironment(options.candidateArtifactRoots),
+        ...(options.candidateTranscriptRoot
+            ? { SEVRO_CANDIDATE_TRANSCRIPTS: options.candidateTranscriptRoot }
+            : {}),
+        PATH: [
+            options.fixtureBinDir,
+            options.toolchainBinDir,
+            runtime.environment.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin",
+        ]
+            .filter(Boolean)
+            .join(delimiter),
+        HOME: runtime.home,
+        TMPDIR: runtime.temp,
+        LANG: process.env.LANG ?? "C",
+        GIT_CONFIG_GLOBAL: "/dev/null",
+        GIT_CONFIG_NOSYSTEM: "1",
+        ...shellRuntimeEnvironment(runtime, options.uvRuntimeCache),
+    };
+}
+async function requireShellRuntimeCache(options, runtime) {
+    if (options.uvRuntimeCache && !(await stat(runtime.uvCache)).isDirectory())
+        throw new Error("isolated UV cache is missing");
+}
+function shellStdout(check, output) {
+    if (!check.captureStdout)
+        return null;
+    if (!(output instanceof ReadableStream))
+        throw new Error("shell stdout pipe is unavailable");
+    return output;
+}
+class ShellExecution {
+    check;
+    options;
+    isolation;
+    runtime;
+    proc;
+    deadline;
+    constructor(check, options, isolation, runtime) {
+        this.check = check;
+        this.options = options;
+        this.isolation = isolation;
+        this.runtime = runtime;
+        this.deadline = new ProcessDeadline({
+            timeoutMs: check.timeoutMs,
+            signal: options.signal,
+            interruption: (reason) => new Error(reason === "timeout"
+                ? "shell check timed out"
+                : "shell check cancelled"),
+        });
+    }
+    async run() {
+        try {
+            const running = this.spawn();
+            const stream = shellStdout(this.check, running.stdout);
+            return await this.deadline.wait(() => Promise.all([
+                running.exited,
+                stream ? boundedOutput(stream) : Promise.resolve(null),
+            ]).then(([exitCode, stdout]) => ({ exitCode, stdout })));
+        }
+        catch (error) {
+            await this.stop();
+            throw error;
+        }
+        finally {
+            this.deadline.dispose();
+            await this.isolation.release();
+        }
+    }
+    spawn() {
+        this.proc = spawn(this.isolation.argv, {
+            cwd: this.options.workspace,
+            env: shellEnvironment(this.options, this.runtime),
+            detached: true,
+            stdin: "ignore",
+            stdout: this.check.captureStdout ? "pipe" : "ignore",
+            stderr: "ignore",
+        });
+        return this.proc;
+    }
+    async stop() {
+        const proc = this.proc;
+        if (!proc)
+            return;
+        terminateOwnedProcessGroup(proc);
+        await proc.exited;
+    }
+}
+/** Run a check without inherited credentials or retaining raw process output. */
+export async function runShellCheck(check, options) {
+    if (options.signal?.aborted)
+        throw new Error("shell check cancelled");
+    const runtime = await shellRuntime(options);
+    const isolated = await prepareIsolatedCommand({
+        argv: ["/bin/sh", "-e", "-c", check.run],
+        workspace: options.workspace,
+        protectedRoots: [...options.protectedRoots, ...shellSeedSources(options)],
+        protectedRootsCanonical: options.protectedRootsCanonical,
+        privateStateRoot: options.privateStateRoot,
+        denyNetwork: true,
+        localHttp: runtimeLocalHttpEnabled(options.runtimePolicy, "checks"),
+        readOnlyRoots: options.runtimePolicy?.readOnlyRoots,
+        candidateArtifactRoots: options.candidateArtifactRoots,
+        transcriptReadRoots: options.candidateTranscriptRoot
+            ? [options.candidateTranscriptRoot]
+            : [],
+        writableRuntimeRoot: runtime.privateRuntimeRoot,
+        writableCacheRoots: runtime.writableCacheRoots,
+    });
+    await requireShellRuntimeCache(options, runtime);
+    return new ShellExecution(check, options, isolated, runtime).run();
+}
+function shellSeedSources(options) {
+    return [
+        ...runtimeSeedSources(options.runtimePolicy),
+        ...sharedCacheDenyRoots(options.runtimePolicy, "checks"),
+    ];
+}
+//# sourceMappingURL=shell.js.map

package/dist/src/graders/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAmB,8BAA2B;AAC5D,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,6BAA0B;AAChF,OAAO,EACL,4BAA4B,GAE7B,kCAA+B;AAChC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB;AAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB;AAC5C,OAAO,EAAE,sBAAsB,EAAE,8BAA2B;AAE5D,OAAO,EAAE,mBAAmB,EAAE,4BAAyB;AACvD,OAAO,EAAE,oBAAoB,EAAE,mCAAgC;AAC/D,OAAO,EAAE,QAAQ,EAAE,uBAAoB;AACvC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,0BAA0B,GAC3B,gCAA6B;AAE9B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAmBrC,SAAS,uBAAuB,CAC9B,EAAU,EACV,KAAc;IAEd,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC5C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,gBAAgB,CAAC,MAA+B;IACvD,MAAM,OAAO,GAAG;QACd,KAAK;QACL,kBAAkB;QAClB,WAAW;QACX,aAAa;QACb,aAAa;QACb,UAAU;QACV,OAAO;KACR,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAC7D,CAAC;AACD,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;QAC7D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,mBAAmB,CAAC,IAAa;IACxC,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC;QACR,IAAI,GAAG,GAAG;QAEV,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACxD,CAAC;AACD,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,cAAc;QAExB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;AACnD,CAAC;AACD,SAAS,uBAAuB,CAC9B,MAAe;IAEf,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,OAAO,MAAM,KAAK,QAAQ;YACzB,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC;QAEvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IACE,KAAK,KAAK,EAAE;QACZ,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;QAEvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACjD,CAAC;AACD,SAAS,kBAAkB,CACzB,KAAa,EACb,QAAiB,EACjB,SAAkB;IAElB,IAAI,KAAK,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAC5D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAC3D,CAAC;AACD,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,EACJ,GAAG,EACH,gBAAgB,GAAG,CAAC,EACpB,SAAS,GAAG,kBAAkB,EAC9B,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,GAAG,EAAE,GACX,GAAG,MAAM,CAAC;IACX,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACtC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/B,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACrC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO;QACL,GAAG;QACH,gBAAgB;QAChB,SAAS;QACT,WAAW;QACX,WAAW;QACX,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AACD,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AACD,SAAS,iBAAiB,CAAC,EACzB,EAAE,EACF,aAAa,GACS;IACtB,uBAAuB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3C,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EACvE,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO;QACL,EAAE;QACF,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW;QACX,QAAQ;QACR,aAAa,EACX,MAAM,CAAC,WAAW,KAAK,SAAS;YAChC,WAAW,KAAK,SAAS;YACzB,QAAQ,KAAK,SAAS;KACzB,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,kBAAkB,CAChC,YAAqC;IAErC,OAAO,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC7C,CAAC;AAOD,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAC9B,KAAyB,EACzB,MAAwB;IAExB,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB;QAC5C,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,aAAa,MAAM,CAAC,QAAQ,cAAc,KAAK,CAAC,gBAAgB,GAAG;SAC5E,CAAC;IACJ,IAAI,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAyB,EACzB,GAAkB;IAElB,OAAO,CACL,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC;QAC9B,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC;QAClC,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA0B,EAC1B,QAAgB;IAEhB,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,QAAQ,EAAE,EAAE;QACnD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AACD,SAAS,kBAAkB,CACzB,KAAyB,EACzB,GAAkB;IAElB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,OAAO,MAAM,KAAK,KAAK,CAAC,WAAW;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kCAAkC,CAAC;AACzC,CAAC;AACD,SAAS,sBAAsB,CAC7B,KAAyB,EACzB,GAAkB;IAElB,OAAO,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC,CAAC,6CAA6C;QAC/C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AACD,SAAS,uBAAuB,CAC9B,KAAyB,EACzB,GAAkB;IAElB,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAkC;IAElC,OAAO,kBAAkB,CAAC,MAAM,EAAE;QAChC,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC;QACvD,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;AACL,CAAC;AAeD,KAAK,UAAU,YAAY,CAAC,OAAwB;IAClD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,QAAQ,EACR,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACvE,CAAC;QACF,OAAO;YACL,GAAG,OAAO;YACV,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CACb,OAAO,CAAC,gBAAgB,EACxB,SAAS,EACT,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAC5B,EACD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjC,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC;QACrE,WAAW,EAAE,EAA4B;QACzC,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,EAAE;KACvB,CAAC;AACJ,CAAC;AAGD,SAAS,uBAAuB,CAC9B,OAAqB,EACrB,OAA4B;IAE5B,OAAO,OAAO;QACZ,CAAC,CAAC;YACE,YAAY,EAAE,OAAO,CAAC,OAAO;YAC7B,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC;YACjE,UAAU,EAAE,GAAG;YACf,uBAAuB,EAAE,GAAG;SAC7B;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AACD,SAAS,gBAAgB,CACvB,OAAwB,EACxB,OAAqB;IAErB,OAAO;QACL,GAAG,OAAO,CAAC,WAAW;QACtB,GAAG,4BAA4B,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,uBAAuB;YACjC,CAAC,CAAC,EAAE,2BAA2B,EAAE,OAAO,CAAC,uBAAuB,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE;YACJ,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,eAAe;YACvB,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,+BAA+B;SAC5D;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,SAAS,CAAC;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;QAC7B,iBAAiB,EAAE,WAAW;QAC9B,mBAAmB,EAAE,GAAG;QACxB,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC;KAC5D,CAAC;AACJ,CAAC;AACD,KAAK,UAAU,wBAAwB,CACrC,OAAwB,EACxB,OAAqB;IAErB,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;QACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACpD,CAAC;AACD,SAAS,WAAW,CAClB,KAAyB,EACzB,MAA4B;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,YAAY,cAAc,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,cAAc;IAIR;IACA;IACA;IACA;IANF,IAAI,CAAc;IACT,QAAQ,CAAkB;IAC3C,YACU,KAAyB,EACzB,OAAwB,EACxB,SAAoB,EACpB,OAAqB;QAHrB,UAAK,GAAL,KAAK,CAAoB;QACzB,YAAO,GAAP,OAAO,CAAiB;QACxB,cAAS,GAAT,SAAS,CAAW;QACpB,YAAO,GAAP,OAAO,CAAc;QAE7B,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,IAAI,KAAK,CACP,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,uBAAuB,CAC5B;SACJ,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,GAAG;QACP,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CACnC,OAAO,CAAC,GAAG,CAAC;gBACV,OAAO,CAAC,MAAM;gBACd,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;aACvD,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CACxD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACO,KAAK;QACX,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YACrC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAC3B,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;YACjD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACpD,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACO,KAAK,CAAC,IAAI;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAyB,EACzB,OAAwB;IAExB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;QAC5C,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;QACxD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;QACnE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,mBAAmB,EAAE,OAAO,CAAC,uBAAuB;YAClD,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;YACnC,CAAC,CAAC,EAAE;QACN,mBAAmB,EAAE,OAAO,CAAC,kBAAkB;QAC/C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IACH,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,IAAI,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAwB;IAChD,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;KACzD,CAAC;AACJ,CAAC","sourcesContent":["import { spawn, type Subprocess } from \"../runtime-process\";\nimport { runtimeLocalHttpEnabled, runtimeSeedSources } from \"../runtime/config\";\nimport {\n  candidateArtifactEnvironment,\n  type CandidateArtifactRoots,\n} from \"../candidate-artifacts\";\nimport { mkdir, stat } from \"node:fs/promises\";\nimport { delimiter, join } from \"node:path\";\nimport { prepareIsolatedCommand } from \"../hosts/isolation\";\nimport type { RuntimePolicy } from \"../runtime/config\";\nimport { prepareRuntimeState } from \"../runtime/state\";\nimport { sharedCacheDenyRoots } from \"../runtime/shared-cache\";\nimport { hashJson } from \"../identity\";\nimport {\n  captureBoundedText,\n  ProcessDeadline,\n  terminateOwnedProcessGroup,\n} from \"../process-lifecycle\";\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst MAX_TIMEOUT_MS = 120_000;\nconst MAX_OUTPUT_BYTES = 1024 * 1024;\n\nexport interface ShellCheckDeclaration {\n  id: string;\n  grader: \"sevro.shell\";\n  configuration: Record<string, unknown>;\n}\n\nexport interface PreparedShellCheck {\n  id: string;\n  run: string;\n  expectedExitCode: number;\n  timeoutMs: number;\n  expectExact?: string;\n  expectRegex?: RegExp;\n  notRegex?: RegExp;\n  captureStdout: boolean;\n}\n\nfunction requireShellDeclaration(\n  id: string,\n  value: unknown,\n): asserts value is Record<string, unknown> {\n  if (!id || !value || typeof value !== \"object\")\n    throw new Error(\"invalid shell check declaration\");\n}\nfunction requireShellKeys(config: Record<string, unknown>): void {\n  const allowed = [\n    \"run\",\n    \"expectedExitCode\",\n    \"timeoutMs\",\n    \"expectExact\",\n    \"expectRegex\",\n    \"notRegex\",\n    \"flags\",\n  ];\n  if (Object.keys(config).some((key) => !allowed.includes(key)))\n    throw new Error(\"unsupported shell check configuration\");\n}\nfunction requireShellCommand(run: unknown): asserts run is string {\n  if (typeof run !== \"string\" || !run.trim() || run.length > 4096)\n    throw new Error(\"shell check requires a bounded command\");\n}\nfunction requireExpectedExit(code: unknown): asserts code is number {\n  if (\n    typeof code !== \"number\" ||\n    !Number.isSafeInteger(code) ||\n    code < 0 ||\n    code > 255\n  )\n    throw new Error(\"invalid expected shell exit code\");\n}\nfunction requireShellTimeout(timeout: unknown): asserts timeout is number {\n  if (\n    typeof timeout !== \"number\" ||\n    !Number.isSafeInteger(timeout) ||\n    timeout < 1 ||\n    timeout > MAX_TIMEOUT_MS\n  )\n    throw new Error(\"invalid shell check timeout\");\n}\nfunction requireExactShellOutput(\n  output: unknown,\n): asserts output is string | undefined {\n  if (\n    output !== undefined &&\n    (typeof output !== \"string\" ||\n      Buffer.byteLength(output, \"utf8\") > MAX_OUTPUT_BYTES)\n  )\n    throw new Error(\"invalid exact shell output expectation\");\n}\nfunction requireShellFlags(flags: unknown): asserts flags is string {\n  if (\n    flags !== \"\" &&\n    (typeof flags !== \"string\" ||\n      !/^[isu]*$/.test(flags) ||\n      new Set(flags).size !== flags.length)\n  )\n    throw new Error(\"invalid shell regex flags\");\n}\nfunction requireFlagPattern(\n  flags: string,\n  expected: unknown,\n  forbidden: unknown,\n): void {\n  if (flags && expected === undefined && forbidden === undefined)\n    throw new Error(\"shell regex flags require a pattern\");\n}\nfunction shellOptions(config: Record<string, unknown>) {\n  const {\n    run,\n    expectedExitCode = 0,\n    timeoutMs = DEFAULT_TIMEOUT_MS,\n    expectExact,\n    expectRegex,\n    notRegex,\n    flags = \"\",\n  } = config;\n  requireShellCommand(run);\n  requireExpectedExit(expectedExitCode);\n  requireShellTimeout(timeoutMs);\n  requireExactShellOutput(expectExact);\n  requireShellFlags(flags);\n  requireFlagPattern(flags, expectRegex, notRegex);\n  return {\n    run,\n    expectedExitCode,\n    timeoutMs,\n    expectExact,\n    expectRegex,\n    notRegex,\n    flags,\n  };\n}\nfunction compileShellPattern(\n  value: unknown,\n  flags: string,\n): RegExp | undefined {\n  if (value === undefined) return undefined;\n  if (typeof value !== \"string\" || value.length > 4096)\n    throw new Error(\"invalid shell regex pattern\");\n  try {\n    return new RegExp(value, `m${flags}`);\n  } catch (cause) {\n    throw new Error(\"invalid shell regex pattern or flags\", { cause });\n  }\n}\nfunction prepareShellCheck({\n  id,\n  configuration,\n}: ShellCheckDeclaration): PreparedShellCheck {\n  requireShellDeclaration(id, configuration);\n  requireShellKeys(configuration);\n  const config = shellOptions(configuration);\n  const expectRegex = compileShellPattern(config.expectRegex, config.flags),\n    notRegex = compileShellPattern(config.notRegex, config.flags);\n  return {\n    id,\n    run: config.run,\n    expectedExitCode: config.expectedExitCode,\n    timeoutMs: config.timeoutMs,\n    expectExact: config.expectExact,\n    expectRegex,\n    notRegex,\n    captureStdout:\n      config.expectExact !== undefined ||\n      expectRegex !== undefined ||\n      notRegex !== undefined,\n  };\n}\nexport function prepareShellChecks(\n  declarations: ShellCheckDeclaration[],\n): PreparedShellCheck[] {\n  return declarations.map(prepareShellCheck);\n}\n\nexport interface ShellCheckResult {\n  exitCode: number;\n  stdout: string | null;\n}\n\n/** Grade bounded shell output without exposing it in retained evidence. */\nexport function assessShellCheck(\n  check: PreparedShellCheck,\n  result: ShellCheckResult,\n): { passed: boolean; detail: string } {\n  if (result.exitCode !== check.expectedExitCode)\n    return {\n      passed: false,\n      detail: `exit code ${result.exitCode} (expected ${check.expectedExitCode})`,\n    };\n  if (check.captureStdout && result.stdout === null)\n    throw new Error(\"shell stdout observation is missing\");\n  const detail = shellOutputFailure(check, result.stdout);\n  return assessedShellOutput(detail, result.exitCode);\n}\n\nfunction shellOutputFailure(\n  check: PreparedShellCheck,\n  out: string | null,\n): string | undefined {\n  return (\n    exactOutputFailure(check, out) ??\n    expectedPatternFailure(check, out) ??\n    forbiddenPatternFailure(check, out)\n  );\n}\n\nfunction assessedShellOutput(\n  detail: string | undefined,\n  exitCode: number,\n): { passed: boolean; detail: string } {\n  return detail === undefined\n    ? { passed: true, detail: `exit code ${exitCode}` }\n    : { passed: false, detail };\n}\nfunction exactOutputFailure(\n  check: PreparedShellCheck,\n  out: string | null,\n): string | undefined {\n  if (check.expectExact === undefined) return undefined;\n  if (out === null) throw new Error(\"shell stdout observation is missing\");\n  const actual = out.endsWith(\"\\n\") ? out.slice(0, -1) : out;\n  return actual === check.expectExact\n    ? undefined\n    : \"exact shell output did not match\";\n}\nfunction expectedPatternFailure(\n  check: PreparedShellCheck,\n  out: string | null,\n): string | undefined {\n  return check.expectRegex && !check.expectRegex.test(String(out))\n    ? \"expected shell output pattern did not match\"\n    : undefined;\n}\nfunction forbiddenPatternFailure(\n  check: PreparedShellCheck,\n  out: string | null,\n): string | undefined {\n  return check.notRegex && check.notRegex.test(String(out))\n    ? \"forbidden shell output pattern matched\"\n    : undefined;\n}\n\nasync function boundedOutput(\n  stream: ReadableStream<Uint8Array>,\n): Promise<string> {\n  return captureBoundedText(stream, {\n    limit: MAX_OUTPUT_BYTES,\n    overflow: \"reject\",\n    exceeded: () => new Error(\"shell stdout exceeds 1 MiB\"),\n    cancelOnError: true,\n  });\n}\n\ninterface ShellRunOptions {\n  candidateTranscriptRoot?: string;\n  candidateArtifactRoots?: CandidateArtifactRoots;\n  runtimePolicy?: RuntimePolicy;\n  workspace: string;\n  fixtureBinDir?: string;\n  toolchainBinDir?: string;\n  uvRuntimeCache?: boolean;\n  protectedRoots: string[];\n  protectedRootsCanonical?: boolean;\n  privateStateRoot: string;\n  signal?: AbortSignal;\n}\nasync function shellRuntime(options: ShellRunOptions) {\n  if (options.runtimePolicy) {\n    const runtime = await prepareRuntimeState(\n      options.workspace,\n      options.runtimePolicy,\n      \"checks\",\n      join(options.privateStateRoot, \"runtime\", hashJson(options.workspace)),\n    );\n    return {\n      ...runtime,\n      uvCache: join(runtime.root, \"uv-cache\"),\n      privateRuntimeRoot: runtime.root,\n    };\n  }\n  const root = join(\n      options.privateStateRoot,\n      \"runtime\",\n      hashJson(options.workspace),\n    ),\n    home = join(root, \"check-home\"),\n    temp = join(root, \"check-tmp\");\n  await Promise.all([\n    mkdir(home, { recursive: true, mode: 0o700 }),\n    mkdir(temp, { recursive: true, mode: 0o700 }),\n  ]);\n  return {\n    root,\n    home,\n    temp,\n    uvCache: join(options.workspace, \".git\", \"sevro-runtime\", \"uv-cache\"),\n    environment: {} as Record<string, string>,\n    privateRuntimeRoot: root,\n    writableCacheRoots: [],\n  };\n}\ntype ShellRuntime = Awaited<ReturnType<typeof shellRuntime>>;\ntype Isolation = Awaited<ReturnType<typeof prepareIsolatedCommand>>;\nfunction shellRuntimeEnvironment(\n  runtime: ShellRuntime,\n  enabled: boolean | undefined,\n): Record<string, string> {\n  return enabled\n    ? {\n        UV_CACHE_DIR: runtime.uvCache,\n        UV_PROJECT_ENVIRONMENT: join(runtime.root, \"project-environment\"),\n        UV_OFFLINE: \"1\",\n        PYTHONDONTWRITEBYTECODE: \"1\",\n      }\n    : {};\n}\nfunction shellEnvironment(\n  options: ShellRunOptions,\n  runtime: ShellRuntime,\n): Record<string, string> {\n  return {\n    ...runtime.environment,\n    ...candidateArtifactEnvironment(options.candidateArtifactRoots),\n    ...(options.candidateTranscriptRoot\n      ? { SEVRO_CANDIDATE_TRANSCRIPTS: options.candidateTranscriptRoot }\n      : {}),\n    PATH: [\n      options.fixtureBinDir,\n      options.toolchainBinDir,\n      runtime.environment.PATH ?? \"/usr/bin:/bin:/usr/sbin:/sbin\",\n    ]\n      .filter(Boolean)\n      .join(delimiter),\n    HOME: runtime.home,\n    TMPDIR: runtime.temp,\n    LANG: process.env.LANG ?? \"C\",\n    GIT_CONFIG_GLOBAL: \"/dev/null\",\n    GIT_CONFIG_NOSYSTEM: \"1\",\n    ...shellRuntimeEnvironment(runtime, options.uvRuntimeCache),\n  };\n}\nasync function requireShellRuntimeCache(\n  options: ShellRunOptions,\n  runtime: ShellRuntime,\n): Promise<void> {\n  if (options.uvRuntimeCache && !(await stat(runtime.uvCache)).isDirectory())\n    throw new Error(\"isolated UV cache is missing\");\n}\nfunction shellStdout(\n  check: PreparedShellCheck,\n  output: Subprocess[\"stdout\"],\n): ReadableStream<Uint8Array> | null {\n  if (!check.captureStdout) return null;\n  if (!(output instanceof ReadableStream))\n    throw new Error(\"shell stdout pipe is unavailable\");\n  return output;\n}\nclass ShellExecution {\n  private proc?: Subprocess;\n  private readonly deadline: ProcessDeadline;\n  constructor(\n    private check: PreparedShellCheck,\n    private options: ShellRunOptions,\n    private isolation: Isolation,\n    private runtime: ShellRuntime,\n  ) {\n    this.deadline = new ProcessDeadline({\n      timeoutMs: check.timeoutMs,\n      signal: options.signal,\n      interruption: (reason) =>\n        new Error(\n          reason === \"timeout\"\n            ? \"shell check timed out\"\n            : \"shell check cancelled\",\n        ),\n    });\n  }\n  async run(): Promise<ShellCheckResult> {\n    try {\n      const running = this.spawn();\n      const stream = shellStdout(this.check, running.stdout);\n      return await this.deadline.wait(() =>\n        Promise.all([\n          running.exited,\n          stream ? boundedOutput(stream) : Promise.resolve(null),\n        ]).then(([exitCode, stdout]) => ({ exitCode, stdout })),\n      );\n    } catch (error) {\n      await this.stop();\n      throw error;\n    } finally {\n      this.deadline.dispose();\n      await this.isolation.release();\n    }\n  }\n  private spawn() {\n    this.proc = spawn(this.isolation.argv, {\n      cwd: this.options.workspace,\n      env: shellEnvironment(this.options, this.runtime),\n      detached: true,\n      stdin: \"ignore\",\n      stdout: this.check.captureStdout ? \"pipe\" : \"ignore\",\n      stderr: \"ignore\",\n    });\n    return this.proc;\n  }\n  private async stop(): Promise<void> {\n    const proc = this.proc;\n    if (!proc) return;\n    terminateOwnedProcessGroup(proc);\n    await proc.exited;\n  }\n}\n\n/** Run a check without inherited credentials or retaining raw process output. */\nexport async function runShellCheck(\n  check: PreparedShellCheck,\n  options: ShellRunOptions,\n): Promise<ShellCheckResult> {\n  if (options.signal?.aborted) throw new Error(\"shell check cancelled\");\n  const runtime = await shellRuntime(options);\n  const isolated = await prepareIsolatedCommand({\n    argv: [\"/bin/sh\", \"-e\", \"-c\", check.run],\n    workspace: options.workspace,\n    protectedRoots: [...options.protectedRoots, ...shellSeedSources(options)],\n    protectedRootsCanonical: options.protectedRootsCanonical,\n    privateStateRoot: options.privateStateRoot,\n    denyNetwork: true,\n    localHttp: runtimeLocalHttpEnabled(options.runtimePolicy, \"checks\"),\n    readOnlyRoots: options.runtimePolicy?.readOnlyRoots,\n    candidateArtifactRoots: options.candidateArtifactRoots,\n    transcriptReadRoots: options.candidateTranscriptRoot\n      ? [options.candidateTranscriptRoot]\n      : [],\n    writableRuntimeRoot: runtime.privateRuntimeRoot,\n    writableCacheRoots: runtime.writableCacheRoots,\n  });\n  await requireShellRuntimeCache(options, runtime);\n  return new ShellExecution(check, options, isolated, runtime).run();\n}\n\nfunction shellSeedSources(options: ShellRunOptions): string[] {\n  return [\n    ...runtimeSeedSources(options.runtimePolicy),\n    ...sharedCacheDenyRoots(options.runtimePolicy, \"checks\"),\n  ];\n}\n"]}

package/dist/src/host-diagnostic-redaction.js

@@ -0,0 +1,52 @@
+import { readFile, stat } from "node:fs/promises";
+import { isRecord } from "./value-guards.js";
+function credentialStrings(value) {
+    const pending = [value];
+    const secrets = [];
+    for (let visited = 0; visited < 256; visited++) {
+        const item = pending.pop();
+        if (typeof item === "string") {
+            if (item.length >= 8)
+                secrets.push(item);
+        }
+        else if (isRecord(item))
+            pending.push(...Object.values(item));
+    }
+    return secrets;
+}
+/** Read credentials only for scrubbing; failures belong to the actual host preparation. */
+export async function diagnosticSecrets(path) {
+    try {
+        if ((await stat(path)).size > 1024 * 1024)
+            return [];
+        const text = await readFile(path, "utf8");
+        try {
+            const value = JSON.parse(text);
+            return credentialStrings(value);
+        }
+        catch {
+            return text.trim() ? [text.trim()] : [];
+        }
+    }
+    catch {
+        return [];
+    }
+}
+export function redactDiagnosticText(text, secrets) {
+    for (const secret of secrets) {
+        text = text.replaceAll(secret, "[redacted]");
+        text = redactCredentialSuffix(text, secret);
+    }
+    return text
+        .replace(/(authorization\s*:\s*)[^\r\n]+/gi, "$1[redacted]")
+        .replace(/\bBearer\s+\S+/gi, "Bearer [redacted]")
+        .replace(/\bsk-[A-Za-z0-9_-]+/g, "[redacted]")
+        .replace(/((?:api[_-]?key|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)\S+/gi, "$1[redacted]");
+}
+function redactCredentialSuffix(text, secret) {
+    const start = text.lastIndexOf(secret.slice(0, Math.min(8, secret.length)));
+    if (start >= 0 && secret.startsWith(text.slice(start)))
+        return text.slice(0, start) + "[redacted]";
+    return text;
+}
+//# sourceMappingURL=host-diagnostic-redaction.js.map

package/dist/src/host-diagnostic-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-diagnostic-redaction.js","sourceRoot":"","sources":["host-diagnostic-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB;AAClD,OAAO,EAAE,QAAQ,EAAE,0BAAuB;AAE1C,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAiB;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,GAAG,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI;SACR,OAAO,CAAC,kCAAkC,EAAE,cAAc,CAAC;SAC3D,OAAO,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;SAChD,OAAO,CAAC,sBAAsB,EAAE,YAAY,CAAC;SAC7C,OAAO,CACN,qEAAqE,EACrE,cAAc,CACf,CAAC;AACN,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { readFile, stat } from \"node:fs/promises\";\nimport { isRecord } from \"./value-guards\";\n\nfunction credentialStrings(value: unknown): string[] {\n  const pending: unknown[] = [value];\n  const secrets: string[] = [];\n  for (let visited = 0; visited < 256; visited++) {\n    const item = pending.pop();\n    if (typeof item === \"string\") {\n      if (item.length >= 8) secrets.push(item);\n    } else if (isRecord(item)) pending.push(...Object.values(item));\n  }\n  return secrets;\n}\n\n/** Read credentials only for scrubbing; failures belong to the actual host preparation. */\nexport async function diagnosticSecrets(path: string): Promise<string[]> {\n  try {\n    if ((await stat(path)).size > 1024 * 1024) return [];\n    const text = await readFile(path, \"utf8\");\n    try {\n      const value: unknown = JSON.parse(text);\n      return credentialStrings(value);\n    } catch {\n      return text.trim() ? [text.trim()] : [];\n    }\n  } catch {\n    return [];\n  }\n}\n\nexport function redactDiagnosticText(text: string, secrets: string[]): string {\n  for (const secret of secrets) {\n    text = text.replaceAll(secret, \"[redacted]\");\n    text = redactCredentialSuffix(text, secret);\n  }\n  return text\n    .replace(/(authorization\\s*:\\s*)[^\\r\\n]+/gi, \"$1[redacted]\")\n    .replace(/\\bBearer\\s+\\S+/gi, \"Bearer [redacted]\")\n    .replace(/\\bsk-[A-Za-z0-9_-]+/g, \"[redacted]\")\n    .replace(\n      /((?:api[_-]?key|access[_-]?token|refresh[_-]?token)\\s*[=:]\\s*)\\S+/gi,\n      \"$1[redacted]\",\n    );\n}\n\nfunction redactCredentialSuffix(text: string, secret: string): string {\n  const start = text.lastIndexOf(secret.slice(0, Math.min(8, secret.length)));\n  if (start >= 0 && secret.startsWith(text.slice(start)))\n    return text.slice(0, start) + \"[redacted]\";\n  return text;\n}\n"]}