@bjoernrochel/sevro 0.1.0-rc.8 → 1.1.0

package/src/{runtime-seeds.ts → runtime/seeds.ts}

@@ -8,9 +8,9 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { join } from "node:path";
-import { hashJson, sha256 } from "./identity";
-import type { RuntimePolicy } from "./runtime-config";
-import { insideRuntimeRoot } from "./runtime-paths";
+import { hashJson, sha256 } from "../identity";
+import type { RuntimePolicy } from "./config";
+import { insideRuntimeRoot } from "./paths";
 
 class SeedSnapshot {
   private entries = 0;

package/src/runtime/shared-cache.ts

@@ -0,0 +1,130 @@
+import { access, lstat, realpath, symlink } from "node:fs/promises";
+import { constants } from "node:fs";
+import { userInfo } from "node:os";
+import { isAbsolute, join } from "node:path";
+import type { RuntimePolicy, RuntimeRole } from "./config";
+import { declaredRuntimeRoots, requireRuntimeReadRoots } from "./paths";
+
+export interface SharedCacheDirectory {
+  source: string;
+  target: string;
+  roles: RuntimeRole[];
+}
+
+export async function resolveSharedCaches(
+  caches: SharedCacheDirectory[],
+  environment: Record<string, string>,
+  base: string,
+  protectedRoots: string[],
+): Promise<SharedCacheDirectory[]> {
+  return Promise.all(
+    caches.map(async (cache) => {
+      const roots = await declaredRuntimeRoots(
+        [cache.source],
+        environment,
+        base,
+      );
+      requireRuntimeReadRoots(roots, protectedRoots);
+      const [declared] = roots;
+      if (!declared) throw new Error("runtime shared cache source is missing");
+      const source = await realpath(declared);
+      await requireSharedCache(source);
+      return { ...cache, source };
+    }),
+  );
+}
+
+export function selectedSharedCaches(
+  policy: RuntimePolicy | undefined,
+  role: RuntimeRole = "candidate",
+): SharedCacheDirectory[] {
+  return (policy?.sharedCacheDirectories ?? []).filter((cache) =>
+    cache.roles.includes(role),
+  );
+}
+
+export async function sharedCacheRoots(
+  policy: RuntimePolicy | undefined,
+  role: RuntimeRole = "candidate",
+  protectedRoots: string[],
+): Promise<string[]> {
+  const roots = selectedSharedCaches(policy, role).map((cache) => cache.source);
+  return requireWritableCacheRoots(roots, protectedRoots);
+}
+
+export function requireSharedCachePolicy(
+  policy: RuntimePolicy | undefined,
+): void {
+  if (!policy) return;
+  const caches = policy.sharedCacheDirectories ?? [];
+  const protectedRoots = [
+    ...policy.readOnlyRoots,
+    ...(policy.seeds ?? []).map((seed) => seed.source),
+  ];
+  for (const cache of caches) {
+    requireRuntimeReadRoots(
+      [cache.source],
+      [
+        ...protectedRoots,
+        ...caches
+          .filter((other) => other !== cache)
+          .map((other) => other.source),
+      ],
+    );
+  }
+}
+
+export function sharedCacheDenyRoots(
+  policy: RuntimePolicy | undefined,
+  role: RuntimeRole = "candidate",
+): string[] {
+  return (policy?.sharedCacheDirectories ?? [])
+    .filter((cache) => !cache.roles.includes(role))
+    .map((cache) => cache.source);
+}
+
+export async function requireWritableCacheRoots(
+  roots: string[],
+  protectedRoots: string[],
+): Promise<string[]> {
+  requireRuntimeReadRoots(roots, protectedRoots);
+  for (const root of roots) await requireSharedCache(root);
+  return roots;
+}
+
+async function requireSharedCache(source: string): Promise<void> {
+  if (!isAbsolute(source) || (await realpath(source)) !== source)
+    throw new Error("runtime shared cache must be a canonical directory");
+  const info = await lstat(source);
+  if (!info.isDirectory() || info.uid !== userInfo().uid)
+    throw new Error("runtime shared cache must be an owned directory");
+  await access(source, constants.R_OK | constants.W_OK | constants.X_OK);
+}
+
+/** A slot aliases the operator-selected cache; its contents are never copied. */
+export async function linkSharedCaches(
+  policy: RuntimePolicy,
+  role: RuntimeRole,
+  root: string,
+): Promise<void> {
+  for (const cache of selectedSharedCaches(policy, role)) {
+    const target = join(root, cache.target);
+    try {
+      await symlink(cache.source, target, "dir");
+    } catch (cause) {
+      if ((cause as NodeJS.ErrnoException).code !== "EEXIST") throw cause;
+      await requireCacheSlot(target, cache.source, cause);
+    }
+  }
+}
+
+async function requireCacheSlot(
+  target: string,
+  source: string,
+  cause: unknown,
+): Promise<void> {
+  if (!(await lstat(target)).isSymbolicLink())
+    throw new Error("runtime shared cache slot was replaced", { cause });
+  if ((await realpath(target)) !== source)
+    throw new Error("runtime shared cache slot changed its source", { cause });
+}

package/src/{runtime-state.ts → runtime/state.ts}

@@ -1,17 +1,21 @@
 import { mkdir, realpath, stat } from "node:fs/promises";
 import { join } from "node:path";
 import {
-  requireRuntimeEnvironment,
+  requireRuntimePolicy,
   runtimeRoleSeeds,
   type RuntimeRole,
-  requireRuntimeSeedTargets,
   type RuntimePolicy,
-} from "./runtime-config";
-import { materializeRuntimeSeed } from "./runtime-seeds";
-import { requireRuntimeReadRoots } from "./runtime-paths";
-import { hashJson } from "./identity";
+} from "./config";
+import { materializeRuntimeSeed } from "./seeds";
+import { requireRuntimeReadRoots } from "./paths";
+import { hashJson } from "../identity";
+import {
+  linkSharedCaches,
+  sharedCacheRoots,
+  selectedSharedCaches,
+} from "./shared-cache";
 
-export type { RuntimeRole } from "./runtime-config";
+export type { RuntimeRole } from "./config";
 
 export function runtimeObservations(
   policy: RuntimePolicy | undefined,
@@ -29,6 +33,9 @@ export function runtimeObservations(
         environmentNames: Object.keys(policy.environment).sort(),
         readOnlyRoots: policy.readOnlyRoots,
         ...discoveryObservations(policy),
+        ...(policy.sharedCacheDirectories?.length
+          ? { sharedCacheDirectories: selectedSharedCaches(policy, role) }
+          : {}),
         seeds: runtimeRoleSeeds(policy, role).map((seed) => ({
           target: seed.target,
           sha256: seed.sha256,
@@ -57,16 +64,19 @@ function runtimeDigest(policy: RuntimePolicy): string {
   });
 }
 
-/** Each role gets private writable copies while the host inputs stay protected. */
+/** Private role state contains copied seeds and aliases to explicitly shared caches. */
 export async function prepareRuntimeState(
   workspace: string,
   policy: RuntimePolicy,
   role: RuntimeRole,
   privateRoot?: string,
 ) {
-  requireRuntimeEnvironment(policy.environment);
-  requireRuntimeSeedTargets(policy.seeds ?? []);
+  requireRuntimePolicy(policy);
   const root = await runtimeRoot(workspace, role, privateRoot);
+  const writableCacheRoots = await sharedCacheRoots(policy, role, [
+    workspace,
+    root,
+  ]);
   const home = join(root, "home"),
     temp = join(root, "tmp");
   await Promise.all(
@@ -74,6 +84,7 @@ export async function prepareRuntimeState(
   );
   for (const seed of runtimeRoleSeeds(policy, role))
     await copyRuntimeSeed(seed, join(root, seed.target));
+  await linkSharedCaches(policy, role, root);
   const environment = Object.fromEntries(
     Object.entries(policy.environment).map(([name, value]) => [
       name,
@@ -87,7 +98,13 @@ export async function prepareRuntimeState(
     UV_OFFLINE: "1",
     PYTHONDONTWRITEBYTECODE: "1",
   };
-  return { root, home, temp, environment: isolatedEnvironment };
+  return {
+    root,
+    home,
+    temp,
+    environment: isolatedEnvironment,
+    writableCacheRoots,
+  };
 }
 
 async function runtimeRoot(

package/src/runtime-process.ts

@@ -0,0 +1,194 @@
+import {
+  spawn as nodeSpawn,
+  spawnSync as nodeSpawnSync,
+  type ChildProcess,
+} from "node:child_process";
+import { Readable, Writable } from "node:stream";
+import { constants } from "node:os";
+
+interface ProcessWriter {
+  write(data: string | Uint8Array): unknown;
+  end(): unknown;
+}
+
+export interface Subprocess {
+  pid: number;
+  stdin: ProcessWriter | null;
+  stdout: ReadableStream<Uint8Array>;
+  stderr: ReadableStream<Uint8Array>;
+  exited: Promise<number>;
+  readonly signalCode: string | null;
+  kill(signal: NodeJS.Signals): void;
+}
+
+interface SpawnOptions {
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  detached?: boolean;
+  stdin?: "pipe" | "ignore" | Uint8Array;
+  stdout?: "pipe" | "ignore";
+  stderr?: "pipe" | "ignore";
+}
+
+function emptyStream(): ReadableStream<Uint8Array> {
+  return new ReadableStream({
+    start(controller) {
+      controller.close();
+    },
+  });
+}
+
+function readable(stream: Readable | null): ReadableStream<Uint8Array> {
+  // Node and Bun declare different overloads for the same Web Streams API.
+  return stream
+    ? (Readable.toWeb(stream) as unknown as ReadableStream<Uint8Array>)
+    : emptyStream();
+}
+
+function output(
+  stream: ReadableStream<Uint8Array> | null | undefined,
+): ReadableStream<Uint8Array> {
+  return stream ?? emptyStream();
+}
+
+function writer(stream: Writable | null): ProcessWriter | null {
+  if (!stream) return null;
+  const destination = Writable.toWeb(stream).getWriter();
+  return {
+    write: (data) =>
+      destination.write(typeof data === "string" ? Buffer.from(data) : data),
+    end: () => destination.close(),
+  };
+}
+
+function commandName(argv: string[]): string {
+  const name = argv[0];
+  if (!name) throw new Error("process command must be nonempty");
+  return name;
+}
+
+function stdinMode(input: SpawnOptions["stdin"]) {
+  return input === "pipe" || input instanceof Uint8Array ? "pipe" : "ignore";
+}
+
+function processId(child: ChildProcess): number {
+  if (child.pid !== undefined) return child.pid;
+  child.once("error", () => {});
+  throw new Error("could not start process");
+}
+
+function exitCode(code: number | null, signal: NodeJS.Signals | null): number {
+  return code ?? 128 + (signal ? constants.signals[signal] : 0);
+}
+
+function completion(child: ChildProcess): Promise<number> {
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      resolve(exitCode(code, signal));
+    });
+  });
+}
+
+async function initialInput(
+  stdin: ProcessWriter | null,
+  input: SpawnOptions["stdin"],
+) {
+  if (!(input instanceof Uint8Array)) return;
+  if (!stdin) throw new Error("process input pipe unavailable");
+  await stdin.write(input);
+  await stdin.end();
+}
+
+function nodeProcess(argv: string[], options: SpawnOptions): Subprocess {
+  const child = nodeSpawn(commandName(argv), argv.slice(1), {
+    cwd: options.cwd,
+    env: options.env,
+    detached: options.detached,
+    stdio: [
+      stdinMode(options.stdin),
+      options.stdout ?? "pipe",
+      options.stderr ?? "pipe",
+    ],
+  });
+  const pid = processId(child);
+  const exited = completion(child);
+  const stdin = writer(child.stdin);
+  return {
+    pid,
+    stdin,
+    stdout: readable(child.stdout),
+    stderr: readable(child.stderr),
+    exited: Promise.all([exited, initialInput(stdin, options.stdin)]).then(
+      ([code]) => code,
+    ),
+    get signalCode() {
+      return child.signalCode;
+    },
+    kill(signal) {
+      child.kill(signal);
+    },
+  };
+}
+
+function bunProcess(argv: string[], options: SpawnOptions): Subprocess {
+  const child = Bun.spawn(argv, {
+    ...options,
+    stdin: options.stdin ?? "ignore",
+    stderr: options.stderr ?? "pipe",
+  });
+  return {
+    pid: child.pid,
+    stdin: typeof child.stdin === "object" ? child.stdin : null,
+    stdout: output(child.stdout),
+    stderr: output(child.stderr),
+    exited: child.exited,
+    get signalCode() {
+      return child.signalCode ?? null;
+    },
+    kill(signal) {
+      child.kill(signal);
+    },
+  };
+}
+
+/** Keep the runner's process/stream contract independent of its JS runtime. */
+export function spawn(argv: string[], options: SpawnOptions = {}): Subprocess {
+  return process.versions.bun
+    ? bunProcess(argv, options)
+    : nodeProcess(argv, options);
+}
+
+function buffer(bytes: Buffer | null | undefined): Buffer {
+  return bytes ?? Buffer.alloc(0);
+}
+
+function bunSync(argv: string[], options: SpawnOptions) {
+  const result = Bun.spawnSync(argv, options);
+  return {
+    exitCode: result.exitCode,
+    stdout: buffer(result.stdout),
+    stderr: buffer(result.stderr),
+  };
+}
+
+function nodeSync(argv: string[], options: SpawnOptions) {
+  const result = nodeSpawnSync(commandName(argv), argv.slice(1), {
+    cwd: options.cwd,
+    env: options.env,
+    stdio: ["ignore", options.stdout ?? "pipe", options.stderr ?? "pipe"],
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.error) throw result.error;
+  return {
+    exitCode: result.status ?? 1,
+    stdout: buffer(result.stdout),
+    stderr: buffer(result.stderr),
+  };
+}
+
+export function spawnSync(argv: string[], options: SpawnOptions = {}) {
+  return process.versions.bun
+    ? bunSync(argv, options)
+    : nodeSync(argv, options);
+}