@bjoernrochel/sevro 0.1.0-rc.8 → 1.1.0

package/src/{generated-fixture.ts → fixtures/generated.ts}

@@ -1,9 +1,10 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { canonicalJson } from "./identity";
-import { prepareFixtureBin } from "./fixture-bin";
+import { canonicalJson } from "../identity";
+import { prepareFixtureBin } from "./bin";
 import { prepareGitHooks } from "./git-hooks";
 import { fixtureParts } from "./preparation";
+import { runGit } from "../git";
 
 const MAX_COMMITS = 128;
 const MAX_FILES = 1024;
@@ -197,60 +198,16 @@ export function prepareGeneratedFixture(value: unknown): GeneratedFixture {
   return JSON.parse(canonicalJson(fixture)) as GeneratedFixture;
 }
 
-function gitEnvironment() {
-  const nullDevice = process.platform === "win32" ? "NUL" : "/dev/null";
-  return {
-    PATH: process.env.PATH ?? "/usr/bin:/bin",
-    ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
-    GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_GLOBAL: nullDevice,
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_AUTHOR_NAME: "Sevro Fixture",
-    GIT_AUTHOR_EMAIL: "fixture@sevro.invalid",
-    GIT_COMMITTER_NAME: "Sevro Fixture",
-    GIT_COMMITTER_EMAIL: "fixture@sevro.invalid",
-    GIT_AUTHOR_DATE: "2000-01-01T00:00:00+00:00",
-    GIT_COMMITTER_DATE: "2000-01-01T00:00:00+00:00",
-  };
-}
-
 async function git(workspace: string, args: string[]): Promise<void> {
-  async function bounded(stream: ReadableStream<Uint8Array>): Promise<void> {
-    let size = 0;
-    for await (const chunk of stream) {
-      size += chunk.byteLength;
-      if (size > MAX_GIT_OUTPUT)
-        throw new Error("generated fixture Git output is too large");
-    }
-  }
-  const proc = Bun.spawn(
-    [
-      "git",
-      "-c",
-      `core.hooksPath=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
-      ...args,
-    ],
-    {
-      cwd: workspace,
-      stdout: "pipe",
-      stderr: "pipe",
-      env: gitEnvironment(),
-    },
-  );
   try {
-    const [, , code] = await Promise.all([
-      bounded(proc.stdout),
-      bounded(proc.stderr),
-      proc.exited,
-    ]);
-    if (code !== 0) throw new Error();
+    await runGit({
+      cwd: workspace,
+      args,
+      identity: "fixture",
+      label: "generated fixture",
+      maxOutputBytes: MAX_GIT_OUTPUT,
+    });
   } catch (cause) {
-    try {
-      proc.kill("SIGKILL");
-    } catch {
-      // The process may have exited before the failure was observed.
-    }
-    await proc.exited;
     throw new Error("generated fixture Git operation failed", { cause });
   }
 }

package/src/{git-hooks.ts → fixtures/git-hooks.ts}

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { prepareFixtureTools, installFixtureTools } from "./fixture-tools";
+import { prepareFixtureTools, installFixtureTools } from "./tools";
 
 /** Bound hook declarations and keep every name inside Git's hooks directory. */
 export function prepareGitHooks(value: unknown): Record<string, string> | null {

package/src/{preparation.ts → fixtures/preparation.ts}

@@ -1,7 +1,9 @@
-import { isMissingFile } from "./fixture-tools";
-import { sha256 } from "./identity";
+import { isMissingFile } from "./tools";
+import { sha256 } from "../identity";
 import { lstat, mkdir, readFile, realpath, stat } from "node:fs/promises";
-import { isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { insideRoot } from "../paths";
+import { containsControl as containsControlCharacter } from "../value-guards";
 import { fileURLToPath } from "node:url";
 
 const MAX_ARTIFACT_BYTES = 8 * 1024 * 1024;
@@ -114,12 +116,6 @@ function requireArtifactFlags(item: PreparationArtifact): void {
   if (item.executable !== undefined && typeof item.executable !== "boolean")
     throw new Error("preparation artifact executable must be boolean");
 }
-function containsControlCharacter(path: string): boolean {
-  return Array.from(path).some(
-    (character) =>
-      character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,
-  );
-}
 function requireInlineSource(
   item: PreparationArtifact,
 ): asserts item is PreparationArtifact & { contentBase64: string } {
@@ -220,13 +216,7 @@ async function preparationSourcePath(url: string): Promise<string> {
   }
 }
 function requireContainedSource(root: string, path: string): void {
-  const child = relative(root, path);
-  if (
-    !child ||
-    child === ".." ||
-    child.startsWith(`..${sep}`) ||
-    isAbsolute(child)
-  )
+  if (root === path || !insideRoot(root, path))
     throw new Error("preparation source escapes its declared root");
 }
 async function preparationSourceSize(path: string): Promise<number> {

package/src/{repository-fixture.ts → fixtures/repository.ts}

@@ -1,10 +1,12 @@
-import { isRecord, isStringArray } from "./value-guards";
-import { isMissingFile } from "./fixture-tools";
+import { isRecord, isStringArray } from "../value-guards";
+import { isMissingFile } from "./tools";
 import { lstat, mkdir, realpath, stat, writeFile } from "node:fs/promises";
-import { isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { insideRoot } from "../paths";
+import { runGit } from "../git";
 import { fileURLToPath } from "node:url";
-import { canonicalJson } from "./identity";
-import { prepareFixtureBin } from "./fixture-bin";
+import { canonicalJson } from "../identity";
+import { prepareFixtureBin } from "./bin";
 import { prepareGitHooks } from "./git-hooks";
 import type { PreparationSources } from "./preparation";
 import { fixtureParts } from "./preparation";
@@ -167,53 +169,16 @@ export interface RepositorySource {
   revision: string;
 }
 
-async function boundedText(
-  stream: ReadableStream<Uint8Array>,
-): Promise<string> {
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  for await (const chunk of stream) {
-    size += chunk.byteLength;
-    if (size > MAX_GIT_OUTPUT_BYTES)
-      throw new Error("repository fixture Git output is too large");
-    chunks.push(chunk);
-  }
-  return new TextDecoder("utf-8", { fatal: true }).decode(
-    Buffer.concat(chunks),
-  );
-}
-
 async function git(args: string[], cwd: string): Promise<string> {
-  const proc = Bun.spawn(["git", ...args], {
+  const stdout = await runGit({
     cwd,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: {
-      ...process.env,
-      GIT_CONFIG_NOSYSTEM: "1",
-      GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_AUTHOR_NAME: "Sevro Fixture",
-      GIT_AUTHOR_EMAIL: "fixture@sevro.invalid",
-      GIT_COMMITTER_NAME: "Sevro Fixture",
-      GIT_COMMITTER_EMAIL: "fixture@sevro.invalid",
-      GIT_AUTHOR_DATE: "2000-01-01T00:00:00+00:00",
-      GIT_COMMITTER_DATE: "2000-01-01T00:00:00+00:00",
-    },
+    args,
+    identity: "fixture",
+    label: "repository fixture",
+    maxOutputBytes: MAX_GIT_OUTPUT_BYTES,
+    validateUtf8: true,
   });
-  try {
-    const [stdout, , code] = await Promise.all([
-      boundedText(proc.stdout),
-      boundedText(proc.stderr),
-      proc.exited,
-    ]);
-    if (code !== 0) throw new Error("repository fixture Git operation failed");
-    return stdout.trim();
-  } catch (error) {
-    proc.kill("SIGKILL");
-    await proc.exited;
-    throw error;
-  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(stdout).trim();
 }
 
 /** Resolve a declared local repository without accepting a dirty source tree. */
@@ -261,8 +226,7 @@ async function canonicalRepositorySource(selected: {
   }
 }
 function requireContainedRepository(root: string, path: string): void {
-  const child = relative(root, path);
-  if (child === ".." || child.startsWith(`..${sep}`) || isAbsolute(child))
+  if (!insideRoot(root, path))
     throw new Error("repository source escapes its declared root");
 }
 async function repositoryCommit(path: string): Promise<string> {
@@ -272,10 +236,18 @@ async function repositoryCommit(path: string): Promise<string> {
   const revision = await git(["rev-parse", "--verify", "HEAD^{commit}"], path);
   if (!/^[a-f0-9]{40,64}$/.test(revision))
     throw new Error("repository source has no valid commit");
-  if (await git(["status", "--porcelain=v1", "--untracked-files=all"], path))
+  if (
+    await git(
+      [
+        "status",
+        "--porcelain=v1",
+        "--untracked-files=all",
+        "--ignore-submodules=none",
+      ],
+      path,
+    )
+  )
     throw new Error("repository source has uncommitted changes");
-  if (await git(["submodule", "status"], path))
-    throw new Error("repository submodules are not supported");
   return revision;
 }
 function requireRepositorySnapshot(
@@ -306,6 +278,7 @@ export async function cloneRepositorySource(
       "--local",
       "--no-hardlinks",
       "--no-checkout",
+      "--no-recurse-submodules",
       "--quiet",
       current.path,
       workspace,
@@ -375,25 +348,18 @@ export async function applyRepositoryOverlay(
     });
   await stageRepositoryOverlay(fixture, workspace, Object.keys(files));
 }
-function disabledHooksArgs(): string[] {
-  return [
-    "-c",
-    `core.hooksPath=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
-  ];
-}
 async function stageRepositoryOverlay(
   fixture: RepositoryFixture,
   workspace: string,
   paths: string[],
 ): Promise<void> {
-  const noHooks = disabledHooksArgs();
   if (fixture.commitFiles) {
-    await git([...noHooks, "add", "--", ...paths], workspace);
+    await git(["add", "--", ...paths], workspace);
     await git(
-      [...noHooks, "commit", "--quiet", "-m", "Add evaluation scaffolding"],
+      ["commit", "--quiet", "-m", "Add evaluation scaffolding"],
       workspace,
     );
   }
   if (fixture.staged?.length)
-    await git([...noHooks, "add", "--", ...fixture.staged], workspace);
+    await git(["add", "--", ...fixture.staged], workspace);
 }

package/src/{fixture-setup.ts → fixtures/setup.ts}

@@ -1,7 +1,13 @@
-import { mkdtemp, rm } from "node:fs/promises";
+import { spawn, type Subprocess } from "../runtime-process";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { delimiter, isAbsolute, join } from "node:path";
-import { isRecord } from "./value-guards";
+import { isRecord } from "../value-guards";
+import { requireCandidateRuntime } from "../candidate-artifacts";
+import {
+  ProcessDeadline,
+  terminateOwnedProcessGroup,
+} from "../process-lifecycle";
 
 const MAX_COMMAND_BYTES = 64 * 1024;
 const MAX_ENV_BYTES = 16 * 1024;
@@ -103,27 +109,12 @@ export function prepareFixtureSetup(value: unknown): FixtureSetup | null {
   return { command, environment };
 }
 
-function stopProcess(proc: Bun.Subprocess): void {
-  if (process.platform !== "win32") {
-    try {
-      process.kill(-proc.pid, "SIGKILL");
-      return;
-    } catch {
-      // The process group may already be gone.
-    }
-  }
-  try {
-    proc.kill("SIGKILL");
-  } catch {
-    // The process already exited.
-  }
-}
-
 interface FixtureSetupOptions {
   workspace: string;
   projectRoot: string;
   fixtureBinDir?: string;
   signal?: AbortSignal;
+  candidateRuntimeRoot?: string;
 }
 
 function setupPath(directory: string | undefined): string {
@@ -146,7 +137,9 @@ function executionEnvironment(
   );
   return {
     PATH: setupPath(options.fixtureBinDir),
-    HOME: home,
+    HOME: options.candidateRuntimeRoot
+      ? join(options.candidateRuntimeRoot, "home")
+      : home,
     TMPDIR: home,
     LANG: process.env.LANG ?? "C",
     GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
@@ -163,17 +156,27 @@ function executionEnvironment(
 }
 
 class FixtureSetupExecution {
-  private proc: Bun.Subprocess | undefined;
-  private timer: ReturnType<typeof setTimeout> | undefined;
-  private cancel: (() => void) | undefined;
+  private proc: Subprocess | undefined;
+  private readonly deadline: ProcessDeadline;
   constructor(
     private readonly setup: FixtureSetup,
     private readonly options: FixtureSetupOptions,
     private readonly home: string,
-  ) {}
+  ) {
+    this.deadline = new ProcessDeadline({
+      timeoutMs: TIMEOUT_MS,
+      signal: options.signal,
+      interruption: (reason) =>
+        new Error(
+          reason === "timeout"
+            ? "fixture setup timed out"
+            : "fixture setup cancelled",
+        ),
+    });
+  }
 
   async run(): Promise<void> {
-    this.proc = Bun.spawn(this.setup.command, {
+    this.proc = spawn(this.setup.command, {
       cwd: this.options.workspace,
       env: executionEnvironment(this.setup, this.options, this.home),
       detached: process.platform !== "win32",
@@ -181,44 +184,18 @@ class FixtureSetupExecution {
       stdout: "ignore",
       stderr: "ignore",
     });
-    const code = await Promise.race([
-      this.proc.exited,
-      this.timeout(),
-      this.aborted(),
-    ]);
+    const code = await this.deadline.wait(this.proc.exited);
     if (code !== 0) throw new Error(`fixture setup failed (${code})`);
   }
 
-  private timeout(): Promise<never> {
-    return new Promise((_resolve, reject) => {
-      this.timer = setTimeout(() => {
-        reject(new Error("fixture setup timed out"));
-      }, TIMEOUT_MS);
-    });
-  }
-
-  private aborted(): Promise<never> {
-    return new Promise((_resolve, reject) => {
-      const signal = this.options.signal;
-      if (!signal) return;
-      this.cancel = () => {
-        reject(new Error("fixture setup cancelled"));
-      };
-      if (signal.aborted) this.cancel();
-      else signal.addEventListener("abort", this.cancel, { once: true });
-    });
-  }
-
   async stop(): Promise<void> {
     if (!this.proc) return;
-    stopProcess(this.proc);
+    terminateOwnedProcessGroup(this.proc);
     await this.proc.exited;
   }
 
   async dispose(): Promise<void> {
-    if (this.timer) clearTimeout(this.timer);
-    if (this.cancel)
-      this.options.signal?.removeEventListener("abort", this.cancel);
+    this.deadline.dispose();
     await rm(this.home, { recursive: true, force: true });
   }
 }
@@ -229,6 +206,12 @@ export async function runFixtureSetup(
   options: FixtureSetupOptions,
 ): Promise<void> {
   if (options.signal?.aborted) throw new Error("fixture setup cancelled");
+  await requireCandidateRuntime(options.candidateRuntimeRoot);
+  if (options.candidateRuntimeRoot)
+    await mkdir(join(options.candidateRuntimeRoot, "home"), {
+      recursive: true,
+      mode: 0o700,
+    });
   const home = await mkdtemp(join(tmpdir(), "sevro-setup-"));
   const execution = new FixtureSetupExecution(setup, options, home);
   try {

package/src/{fixture-tools.ts → fixtures/tools.ts}

@@ -1,6 +1,6 @@
 import { chmod, lstat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { isRecord } from "./value-guards";
+import { isRecord } from "../value-guards";
 
 export function isMissingFile(error: unknown): boolean {
   return error instanceof Error && "code" in error && error.code === "ENOENT";

package/src/{workspace-state.ts → fixtures/workspace-state.ts}

@@ -17,11 +17,11 @@ import {
   processIdentity,
   validProcessIdentity,
   type ProcessIdentity,
-} from "./run-owner";
-import { isRecord } from "./value-guards";
-import { isMissingFile } from "./fixture-tools";
-import { atomicWriteJson } from "./storage";
-import { clearFixtureContents } from "./fixture-cleanup";
+} from "../run-owner";
+import { isRecord } from "../value-guards";
+import { isMissingFile } from "./tools";
+import { atomicWriteJson } from "../storage";
+import { clearFixtureContents } from "./cleanup";
 
 const RETENTION_MS = 24 * 60 * 60_000;
 interface WorkspaceOwner {

package/src/generated/cli-result.d.cts

@@ -1,3 +1,4 @@
 // Generated by bun run schemas:generate; do not edit.
-declare function validate(value: unknown): boolean;
+import type { ValidateFunction } from "ajv";
+declare const validate: ValidateFunction;
 export = validate;

package/src/generated/extension.d.cts

@@ -1,3 +1,4 @@
 // Generated by bun run schemas:generate; do not edit.
-declare function validate(value: unknown): boolean;
+import type { ValidateFunction } from "ajv";
+declare const validate: ValidateFunction;
 export = validate;