@bridge_gpt/mcp-server 0.2.62 → 0.2.66

package/build/executor/process.js

@@ -14,6 +14,7 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
     let escalated = false;
     let disposed = false;
     let graceTimer;
+    const killListeners = [];
     return {
         requestTermination() {
             // A disposed controller belongs to a settled child: signalling it would
@@ -28,6 +29,14 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
                     return;
                 escalated = true;
                 proc.kill("SIGKILL");
+                for (const listener of killListeners.splice(0)) {
+                    try {
+                        listener();
+                    }
+                    catch {
+                        /* a listener must never break the escalation path */
+                    }
+                }
             }, termGraceMs);
         },
         isTerminationRequested() {
@@ -41,6 +50,16 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
                 deps.clearTimer(graceTimer);
                 graceTimer = undefined;
             }
+            killListeners.length = 0;
+        },
+        onKillSent(listener) {
+            if (escalated) {
+                listener();
+                return;
+            }
+            if (disposed)
+                return;
+            killListeners.push(listener);
         },
     };
 }
@@ -55,16 +74,23 @@ function appendBounded(existing, chunk, limitBytes) {
         return combined;
     return Buffer.from(combined, "utf8").subarray(0, limitBytes).toString("utf8");
 }
+/**
+ * Drain one output stream into `onChunk`. Resolves `"eof"` at end of stream and
+ * `"stream_error"` when iteration threw (BAPI-1301 reports which, for the
+ * authoritative stdout path; legacy callers ignore it). A null stream is `"eof"`.
+ */
 async function pump(iterable, onChunk) {
     if (!iterable)
-        return;
+        return "eof";
     try {
         for await (const chunk of iterable) {
             onChunk(typeof chunk === "string" ? chunk : String(chunk));
         }
+        return "eof";
     }
     catch {
         /* stream errors degrade observability, never correctness */
+        return "stream_error";
     }
 }
 /**
@@ -100,10 +126,37 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
     // single grace timer rather than racing three of each.
     const controller = options.terminationController ?? createProcessTerminationController(proc, deps, termGraceMs);
     const terminate = () => controller.requestTermination();
+    // BAPI-1301 (D4a): the authoritative consumer, when supplied. `drainClosed`
+    // flips once the bounded post-exit drain gives up, so a chunk arriving after
+    // the verdict was taken can never mutate the ledger behind the caller's back.
+    const authoritative = options.authoritativeStdout;
+    const supervised = authoritative !== undefined || options.drainDeadlineMs !== undefined;
+    let authoritativeStreamError = false;
+    let drainClosed = false;
     const pumpStdout = pump(proc.stdout, (chunk) => {
+        if (drainClosed)
+            return;
         // Advisory observation ALWAYS runs first and always runs: the tee and the
         // telemetry must see every chunk regardless of what the assertion decides.
-        options.onStdout?.(chunk);
+        if (authoritative !== undefined) {
+            // Guarded only on the authoritative path: an advisory throw must not end
+            // the pump and truncate the stream the ledger depends on.
+            try {
+                options.onStdout?.(chunk);
+            }
+            catch {
+                /* advisory — never affects the run */
+            }
+            try {
+                authoritative(chunk);
+            }
+            catch {
+                authoritativeStreamError = true;
+            }
+        }
+        else {
+            options.onStdout?.(chunk);
+        }
         stdoutExcerpt = appendBounded(stdoutExcerpt, chunk, limit);
         if (options.onStdoutTerminationCheck?.(chunk) === true && !terminationRequested) {
             terminationRequested = true;
@@ -120,14 +173,58 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         // races an already-requested termination a no-op rather than a double signal.
         terminate();
     }, timeoutSeconds * 1000);
-    const { exitCode, signal } = await proc.wait();
+    // BAPI-1301 (D4a): bounded waits, only when a drain deadline was supplied.
+    // Every timer created here is cleared before returning.
+    const drainMs = options.drainDeadlineMs === undefined ? undefined : Math.max(0, options.drainDeadlineMs);
+    const drainTimers = [];
+    const after = (ms) => new Promise((resolve) => {
+        drainTimers.push(deps.setTimer(resolve, ms));
+    });
+    let exitCode;
+    let signal;
+    let exitUnconfirmed = false;
+    if (drainMs === undefined) {
+        ({ exitCode, signal } = await proc.wait());
+    }
+    else {
+        const racers = [
+            proc.wait().then((r) => ({ kind: "closed", ...r })),
+        ];
+        // The process `exit`, independent of its pipes: a descendant holding stdout
+        // open must not stop supervision from noticing the child itself is gone.
+        if (proc.exited)
+            racers.push(proc.exited().then((r) => ({ kind: "exited", ...r })));
+        // After SIGKILL, `wait()` gets at most `drainMs` more before the exit is
+        // reported unconfirmed rather than awaited forever.
+        racers.push(new Promise((resolve) => controller.onKillSent?.(resolve))
+            .then(() => after(drainMs))
+            .then(() => ({ kind: "kill_bound", exitCode: null, signal: null })));
+        const settled = await Promise.race(racers);
+        exitCode = settled.exitCode;
+        signal = settled.signal;
+        exitUnconfirmed = settled.kind === "kill_bound";
+    }
     deps.clearTimer(timeoutTimer);
     // The child has settled, so any outstanding escalation is now aimed at a
     // finished process. Disposal is idempotent and safe for a controller this call
     // did not create — the job runner's `finally` may dispose it again.
     controller.dispose();
-    await pumpStdout;
-    await pumpStderr;
+    let stdoutEnd;
+    if (drainMs === undefined) {
+        stdoutEnd = await pumpStdout;
+        await pumpStderr;
+    }
+    else {
+        const drained = await Promise.race([
+            Promise.all([pumpStdout, pumpStderr]).then(([out]) => out),
+            after(drainMs).then(() => "drain_deadline"),
+        ]);
+        if (drained === "drain_deadline")
+            drainClosed = true;
+        stdoutEnd = drained;
+        for (const handle of drainTimers)
+            deps.clearTimer(handle);
+    }
     let classification;
     if (timedOut) {
         classification = "timeout";
@@ -145,6 +242,11 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         stdoutExcerpt,
         stderrExcerpt,
         ...(terminationRequested ? { terminationRequested: true } : {}),
+        // BAPI-1301 fields appear only for callers that opted in, so every legacy
+        // result keeps its exact shape.
+        ...(supervised ? { stdoutEnd } : {}),
+        ...(authoritativeStreamError ? { authoritativeStreamError: true } : {}),
+        ...(exitUnconfirmed ? { exitUnconfirmed: true } : {}),
     };
 }
 /**
@@ -155,3 +257,131 @@ export function killOwnedProcess(proc, reason) {
     proc.kill("SIGKILL");
     return { classification: "killed", reason };
 }
+/**
+ * Wait for `success` on `stdin`, bounded by abort, deadline, `close`, and `error`.
+ * `action` runs AFTER every listener is registered, so an implementation (or a
+ * fake) that emits synchronously inside `end()` is still observed. Every
+ * listener and timer is removed on settle. Never rejects.
+ */
+function awaitStdinOutcome(stdin, success, options, action) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        const registered = [];
+        const onAbort = () => finish({ ok: false, reason: "aborted" });
+        function finish(result) {
+            if (settled)
+                return;
+            settled = true;
+            if (timer !== undefined)
+                options.deps.clearTimer(timer);
+            for (const [event, listener] of registered) {
+                try {
+                    stdin.off?.(event, listener);
+                }
+                catch {
+                    /* best-effort listener cleanup */
+                }
+            }
+            options.signal?.removeEventListener("abort", onAbort);
+            resolve(result);
+        }
+        const listen = (event, result) => {
+            const listener = () => finish(result);
+            registered.push([event, listener]);
+            try {
+                stdin.once(event, listener);
+            }
+            catch {
+                finish({ ok: false, reason: "write_error" });
+            }
+        };
+        listen(success, { ok: true });
+        listen("error", { ok: false, reason: "write_error" });
+        listen("close", { ok: false, reason: "closed" });
+        if (settled)
+            return;
+        if (options.signal) {
+            if (options.signal.aborted) {
+                finish({ ok: false, reason: "aborted" });
+                return;
+            }
+            options.signal.addEventListener("abort", onAbort, { once: true });
+        }
+        const remaining = options.deadlineAtMs - options.deps.now();
+        if (remaining <= 0) {
+            finish({ ok: false, reason: "deadline" });
+            return;
+        }
+        timer = options.deps.setTimer(() => {
+            timer = undefined;
+            finish({ ok: false, reason: "deadline" });
+        }, remaining);
+        if (action) {
+            try {
+                action();
+            }
+            catch {
+                finish({ ok: false, reason: "write_error" });
+            }
+        }
+    });
+}
+/** Pre-checks shared by write and close: stdin present, not aborted, deadline not passed. */
+function stdinPrecheck(proc, options) {
+    const stdin = proc.stdin;
+    if (!stdin)
+        return { failure: { ok: false, reason: "no_stdin" } };
+    if (options.signal?.aborted)
+        return { failure: { ok: false, reason: "aborted" } };
+    if (options.deps.now() >= options.deadlineAtMs)
+        return { failure: { ok: false, reason: "deadline" } };
+    return { stdin };
+}
+/**
+ * Write `data` to a held child stdin, observing Node backpressure (BAPI-1301).
+ *
+ * When `write()` accepts the data below the high-water mark this resolves at
+ * once. When it returns `false`, it awaits `drain` — but only until the attempt
+ * deadline, the abort signal, the pipe closing, or a pipe error, whichever comes
+ * first. It NEVER throws: every failure is a normalized
+ * {@link StdinTransportResult} the caller turns into an evidence fact
+ * (`transport_failed_before_work` / `transport_failed_after_progress`).
+ */
+export async function writeStdinBounded(proc, data, options) {
+    const checked = stdinPrecheck(proc, options);
+    if ("failure" in checked)
+        return checked.failure;
+    const { stdin } = checked;
+    if (stdin.destroyed === true || stdin.writableEnded === true) {
+        return { ok: false, reason: "closed" };
+    }
+    let accepted;
+    try {
+        accepted = stdin.write(data);
+    }
+    catch {
+        return { ok: false, reason: "write_error" };
+    }
+    if (accepted)
+        return { ok: true };
+    return awaitStdinOutcome(stdin, "drain", options);
+}
+/**
+ * Half-close a held child stdin — EOF for the child — bounded the same way
+ * (BAPI-1301). Tolerates an already-ended pipe (`{ ok: true }`: EOF was already
+ * delivered); a destroyed pipe is `closed`. Waits for `finish` (the flush) only
+ * until deadline/abort/close/error. Never throws.
+ */
+export async function closeStdinBounded(proc, options) {
+    // An already-ended pipe is success even past the deadline: EOF was delivered.
+    if (proc.stdin?.writableEnded === true)
+        return { ok: true };
+    const checked = stdinPrecheck(proc, options);
+    if ("failure" in checked)
+        return checked.failure;
+    const { stdin } = checked;
+    if (stdin.destroyed === true)
+        return { ok: false, reason: "closed" };
+    return awaitStdinOutcome(stdin, "finish", options, () => stdin.end());
+}