@cloud-cli/on 1.2.2 → 1.2.3

package/dist/drivers/standard-process.driver.js

@@ -1,156 +0,0 @@
-import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-export class StandardProcessDriver {
-    name = 'standard-process';
-    async isSupported() {
-        return true; // Supported on all OS platforms
-    }
-    async execute(ctx) {
-        const startTime = Date.now();
-        let logFd = null;
-        let logFilePath = '';
-        // 1. Guard Log Directory & File Handle Creation
-        try {
-            const logDir = path.join(ctx.workspacePath, '.logs');
-            fs.mkdirSync(logDir, { recursive: true });
-            logFilePath = path.join(logDir, `step-${ctx.stepId}.log`);
-            logFd = fs.openSync(logFilePath, 'a');
-        }
-        catch (err) {
-            return {
-                done: Promise.resolve({
-                    exitCode: 1,
-                    durationMs: 0,
-                    error: new Error(`Failed to initialize step log file: ${err.message}`),
-                }),
-                cancel: async () => { },
-                logFilePath: '',
-            };
-        }
-        // 2. Format Execution Command
-        let cmd;
-        let args;
-        if (ctx.image) {
-            cmd = 'docker';
-            args = [
-                'run',
-                '--rm',
-                '--init',
-                '-v',
-                `${ctx.workspacePath}:/workspace`,
-                '-w',
-                '/workspace',
-                '--entrypoint',
-                'sh',
-                ctx.image,
-                '-c',
-                ctx.command,
-            ];
-        }
-        else {
-            cmd = 'sh';
-            args = ['-c', ctx.command];
-        }
-        // 3. Spawn Detached Child Process
-        let child;
-        try {
-            child = spawn(cmd, args, {
-                cwd: ctx.workspacePath,
-                env: { ...process.env, ...ctx.env },
-                detached: true, // Creates separate Process Group ID
-                stdio: ['ignore', logFd, logFd],
-            });
-        }
-        catch (spawnErr) {
-            try {
-                if (logFd !== null)
-                    fs.closeSync(logFd);
-            }
-            catch { }
-            return {
-                done: Promise.resolve({
-                    exitCode: 1,
-                    durationMs: Date.now() - startTime,
-                    error: new Error(`Failed to spawn process: ${spawnErr.message}`),
-                }),
-                cancel: async () => { },
-                logFilePath,
-            };
-        }
-        let isCancelled = false;
-        let timeoutTimer = null;
-        // 4. Safe Promise Resolution & Lifecycle Tracking
-        const done = new Promise((resolve) => {
-            let isResolved = false;
-            const safeResolve = (result) => {
-                if (isResolved)
-                    return; // Prevent double-resolution
-                isResolved = true;
-                if (timeoutTimer)
-                    clearTimeout(timeoutTimer);
-                // Always close log File Descriptor safely
-                try {
-                    if (logFd !== null)
-                        fs.closeSync(logFd);
-                }
-                catch { }
-                resolve(result);
-            };
-            // Optional step timeout
-            if (ctx.timeoutMs) {
-                timeoutTimer = setTimeout(() => {
-                    isCancelled = true;
-                    this.killProcessGroup(child);
-                }, ctx.timeoutMs);
-                // CRUCIAL: Unref timer so it doesn't hold event loop open
-                timeoutTimer.unref();
-            }
-            child.on('close', (code) => {
-                safeResolve({
-                    exitCode: code ?? (isCancelled ? 130 : 1),
-                    durationMs: Date.now() - startTime,
-                    error: isCancelled ? new Error('Step timed out or was cancelled by user') : undefined,
-                });
-            });
-            child.on('error', (err) => {
-                safeResolve({
-                    exitCode: 1,
-                    durationMs: Date.now() - startTime,
-                    error: err,
-                });
-            });
-        });
-        // 5. Cancellation Hook
-        const cancel = async () => {
-            isCancelled = true;
-            this.killProcessGroup(child);
-        };
-        return { done, cancel, logFilePath };
-    }
-    /**
-     * Kills the entire process group tree (-PID) with unref escalation
-     */
-    killProcessGroup(child) {
-        if (child.pid && !child.killed) {
-            try {
-                // Send SIGTERM to entire process group (-PID)
-                process.kill(-child.pid, 'SIGTERM');
-                // Escalate to SIGKILL after 5 seconds if process tree is still alive
-                const killTimer = setTimeout(() => {
-                    try {
-                        if (child.pid && !child.killed) {
-                            process.kill(-child.pid, 'SIGKILL');
-                        }
-                    }
-                    catch { }
-                }, 5000);
-                // CRUCIAL: Unref escalation timer so Node process can exit cleanly
-                killTimer.unref();
-            }
-            catch {
-                // Process group may already be dead
-            }
-        }
-    }
-}

package/dist/drivers/systemd.driver.js

@@ -1,151 +0,0 @@
-import { spawn, exec } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { promisify } from 'node:util';
-const execAsync = promisify(exec);
-export class SystemdDriver {
-    name = 'systemd';
-    /**
-     * Check if systemd bus is available on Linux host
-     */
-    async isSupported() {
-        try {
-            return fs.existsSync('/run/systemd/system');
-        }
-        catch {
-            return false;
-        }
-    }
-    async execute(ctx) {
-        const startTime = Date.now();
-        let logFd = null;
-        let logFilePath = '';
-        // 1. Guard Log Directory & File Handle Creation
-        try {
-            const logDir = path.join(ctx.workspacePath, '.logs');
-            fs.mkdirSync(logDir, { recursive: true });
-            logFilePath = path.join(logDir, `step-${ctx.stepId}.log`);
-            logFd = fs.openSync(logFilePath, 'a');
-        }
-        catch (err) {
-            return {
-                done: Promise.resolve({
-                    exitCode: 1,
-                    durationMs: 0,
-                    error: new Error(`Failed to initialize step log file: ${err.message}`),
-                }),
-                cancel: async () => { },
-                logFilePath: '',
-            };
-        }
-        // 2. Format Sanitized Systemd Unit Name
-        const unitName = `workflow-${ctx.jobId}-${ctx.stepId}`.replace(/[^a-zA-Z0-9_-]/g, '_');
-        // 3. Build systemd-run Flags
-        const systemdFlags = [
-            `--unit=${unitName}`,
-            '--wait', // Block until unit completes
-            '--pipe', // Stream stdio directly to file handle
-            `--working-directory=${ctx.workspacePath}`,
-        ];
-        if (ctx.env) {
-            for (const [key, val] of Object.entries(ctx.env)) {
-                systemdFlags.push(`--setenv=${key}=${val}`);
-            }
-        }
-        if (ctx.timeoutMs) {
-            const timeoutSec = Math.ceil(ctx.timeoutMs / 1000);
-            systemdFlags.push(`--property=RuntimeMaxSec=${timeoutSec}`);
-        }
-        // 4. Construct Command
-        let commandArgs;
-        if (ctx.image) {
-            commandArgs = [
-                'docker',
-                'run',
-                '--rm',
-                '--init',
-                `--name=${unitName}`, // Predictable container name for stopping
-                '-v',
-                `${ctx.workspacePath}:/workspace`,
-                '-w',
-                '/workspace',
-                ctx.image,
-                'sh',
-                '-c',
-                ctx.command,
-            ];
-        }
-        else {
-            commandArgs = ['sh', '-c', ctx.command];
-        }
-        // 5. Spawn systemd-run
-        let child;
-        try {
-            child = spawn('systemd-run', [...systemdFlags, '--', ...commandArgs], {
-                stdio: ['ignore', logFd, logFd],
-            });
-        }
-        catch (spawnErr) {
-            try {
-                if (logFd !== null)
-                    fs.closeSync(logFd);
-            }
-            catch { }
-            return {
-                done: Promise.resolve({
-                    exitCode: 1,
-                    durationMs: Date.now() - startTime,
-                    error: new Error(`Failed to spawn systemd-run: ${spawnErr.message}`),
-                }),
-                cancel: async () => { },
-                logFilePath,
-            };
-        }
-        let isCancelled = false;
-        // 6. Safe Promise Resolution & File Handle Cleanup
-        const done = new Promise((resolve) => {
-            let isResolved = false;
-            const safeResolve = (result) => {
-                if (isResolved)
-                    return; // Prevent double-resolution
-                isResolved = true;
-                try {
-                    if (logFd !== null)
-                        fs.closeSync(logFd);
-                }
-                catch { }
-                resolve(result);
-            };
-            child.on('close', (code) => {
-                safeResolve({
-                    exitCode: code ?? (isCancelled ? 130 : 1),
-                    durationMs: Date.now() - startTime,
-                    error: isCancelled ? new Error('Step cancelled by user or systemd timeout') : undefined,
-                });
-            });
-            child.on('error', (err) => {
-                safeResolve({
-                    exitCode: 1,
-                    durationMs: Date.now() - startTime,
-                    error: err,
-                });
-            });
-        });
-        // 7. Systemd / Docker Graceful Cancellation
-        const cancel = async () => {
-            isCancelled = true;
-            try {
-                if (ctx.image) {
-                    // Stop docker container gracefully if running
-                    await execAsync(`docker stop -t 2 ${unitName}`).catch(() => { });
-                }
-                // Stop systemd transient unit (sends SIGTERM -> SIGKILL to Cgroup tree)
-                await execAsync(`systemctl stop ${unitName}.service`).catch(() => { });
-            }
-            catch {
-                // Unit or container may already be stopped
-            }
-        };
-        return { done, cancel, logFilePath };
-    }
-}

package/dist/evaluator/safe-eval.js

@@ -1,213 +0,0 @@
-import * as acorn from 'acorn';
-export const BUILTIN_HELPERS = {
-    String: (val) => String(val ?? ''),
-    Number: (val) => Number(val),
-    Boolean: (val) => Boolean(val),
-    JSON: {
-        parse: (str) => JSON.parse(str),
-        stringify: (obj) => JSON.stringify(obj, null, 2),
-    },
-};
-export class SafeExpressionEvaluator {
-    /**
-     * Deterministic Value Evaluator (Used for `env:`, `name:`, `image:`, `concurrency:`)
-     * - Native non-string types (booleans, numbers, objects) pass through untouched.
-     * - Strings WITHOUT `${` are returned as 100% literal strings (zero JS AST overhead).
-     * - Strings WITH `${` are evaluated strictly as ES Template Literals.
-     */
-    static async evaluateValue(val, context = {}) {
-        if (typeof val !== 'string') {
-            return val;
-        }
-        // 1. Literal Passthrough: String does not contain `${`
-        if (!val.includes('${')) {
-            return val;
-        }
-        // 2. Dynamic Template Interpolation: Evaluates as ES Template Literal
-        const templateExpr = `\`${val}\``;
-        return this.evaluateExpression(templateExpr, context);
-    }
-    /**
-     * Deterministic Condition Evaluator (Used for `if:`)
-     * Strictly parses code as a JavaScript expression and coerces result to boolean.
-     * Throws an explicit AST Parse Error on invalid syntax (fails fast and loud).
-     */
-    static async evaluateCondition(code, context = {}) {
-        const result = await this.evaluateExpression(code, context);
-        return Boolean(result);
-    }
-    /**
-     * Evaluates direct JS code (Used for `eval:` steps or internal expression resolution).
-     */
-    static async evaluateExpression(code, context = {}) {
-        if (!code || typeof code !== 'string') {
-            return code;
-        }
-        const trimmed = code.trim();
-        let ast;
-        try {
-            ast = acorn.parseExpressionAt(trimmed, 0, {
-                ecmaVersion: 2020,
-                allowAwaitOutsideFunction: false,
-            });
-        }
-        catch (parseErr) {
-            throw new Error(`Invalid expression syntax in '${trimmed}': ${parseErr.message}`);
-        }
-        return this.evalNodeAsync(ast, context);
-    }
-    /**
-     * Alias wrapper for backward compatibility with step runners
-     */
-    static async evaluateAsync(code, context = {}) {
-        return this.evaluateExpression(code, context);
-    }
-    /**
-     * Asynchronous AST Node Walker with Security Guards
-     */
-    static async evalNodeAsync(node, ctx) {
-        switch (node.type) {
-            // Primitive Literals: 123, "hello", true, null
-            case 'Literal':
-                return node.value;
-            // Variables / Identifiers: inputs, steps, String
-            case 'Identifier':
-                if (node.name in ctx)
-                    return ctx[node.name];
-                if (node.name in BUILTIN_HELPERS)
-                    return BUILTIN_HELPERS[node.name];
-                return undefined;
-            // Property Access: inputs.branch or secrets["TOKEN"]
-            case 'MemberExpression': {
-                const object = await this.evalNodeAsync(node.object, ctx);
-                if (object == null)
-                    return undefined;
-                const property = node.computed ? await this.evalNodeAsync(node.property, ctx) : node.property.name;
-                // SECURITY GUARD: Block Prototype Pollution Escapes
-                if (['constructor', '__proto__', 'prototype'].includes(property)) {
-                    throw new Error(`Security Guard Violation: Access to '${property}' is blocked.`);
-                }
-                return object[property];
-            }
-            // Function & Method Calls: slack_notify(...) or url.replace(...)
-            case 'CallExpression': {
-                let fn;
-                let targetObj = null;
-                if (node.callee.type === 'MemberExpression') {
-                    targetObj = await this.evalNodeAsync(node.callee.object, ctx);
-                    const prop = node.callee.computed
-                        ? await this.evalNodeAsync(node.callee.property, ctx)
-                        : node.callee.property.name;
-                    if (['constructor', '__proto__', 'prototype'].includes(prop)) {
-                        throw new Error(`Security Guard Violation: Invoking method '${prop}' is blocked.`);
-                    }
-                    if (targetObj != null && typeof targetObj[prop] === 'function') {
-                        fn = targetObj[prop];
-                    }
-                    else {
-                        throw new Error(`Property '${prop}' is not a callable function on target object.`);
-                    }
-                }
-                else if (node.callee.type === 'Identifier') {
-                    const fnName = node.callee.name;
-                    fn = ctx[fnName] ?? BUILTIN_HELPERS[fnName];
-                    if (!fn || typeof fn !== 'function') {
-                        throw new Error(`Unknown function helper '${fnName}'.`);
-                    }
-                }
-                if (!fn) {
-                    throw new Error('Invalid function invocation target.');
-                }
-                const args = await Promise.all(node.arguments.map((arg) => this.evalNodeAsync(arg, ctx)));
-                return await fn.apply(targetObj, args);
-            }
-            // Binary Operators: a === b, x + y, p > q
-            case 'BinaryExpression': {
-                const left = await this.evalNodeAsync(node.left, ctx);
-                const right = await this.evalNodeAsync(node.right, ctx);
-                switch (node.operator) {
-                    case '===':
-                    case '==':
-                        return left == right;
-                    case '!==':
-                    case '!=':
-                        return left != right;
-                    case '>':
-                        return left > right;
-                    case '<':
-                        return left < right;
-                    case '>=':
-                        return left >= right;
-                    case '<=':
-                        return left <= right;
-                    case '+':
-                        return left + right;
-                    case '-':
-                        return left - right;
-                    case '*':
-                        return left * right;
-                    case '/':
-                        return left / right;
-                    default:
-                        throw new Error(`Unsupported binary operator: ${node.operator}`);
-                }
-            }
-            // Logical Operators: a && b, x || y
-            case 'LogicalExpression': {
-                const left = await this.evalNodeAsync(node.left, ctx);
-                if (node.operator === '&&') {
-                    return left ? await this.evalNodeAsync(node.right, ctx) : left;
-                }
-                if (node.operator === '||') {
-                    return left ? left : await this.evalNodeAsync(node.right, ctx);
-                }
-                throw new Error(`Unsupported logical operator: ${node.operator}`);
-            }
-            // Unary Operators: !x, -y
-            case 'UnaryExpression': {
-                const argument = await this.evalNodeAsync(node.argument, ctx);
-                if (node.operator === '!')
-                    return !argument;
-                if (node.operator === '-')
-                    return -argument;
-                if (node.operator === '+')
-                    return +argument;
-                throw new Error(`Unsupported unary operator: ${node.operator}`);
-            }
-            // Template Strings: `node:${matrix.version}-alpine`
-            case 'TemplateLiteral': {
-                const quasis = node.quasis.map((q) => q.value.cooked);
-                const expressions = await Promise.all(node.expressions.map((e) => this.evalNodeAsync(e, ctx)));
-                let result = '';
-                for (let i = 0; i < quasis.length; i++) {
-                    result += quasis[i];
-                    if (i < expressions.length) {
-                        result += expressions[i] ?? '';
-                    }
-                }
-                return result;
-            }
-            // Array Literals: [1, 2, "three"]
-            case 'ArrayExpression': {
-                return Promise.all(node.elements.map((elem) => this.evalNodeAsync(elem, ctx)));
-            }
-            // Object Literals: { a: 1, b: "hello" }
-            case 'ObjectExpression': {
-                const obj = {};
-                for (const prop of node.properties) {
-                    if (prop.type === 'Property') {
-                        const key = prop.key.type === 'Identifier' ? prop.key.name : await this.evalNodeAsync(prop.key, ctx);
-                        obj[key] = await this.evalNodeAsync(prop.value, ctx);
-                    }
-                }
-                return obj;
-            }
-            // Optional Chaining: inputs?.repo
-            case 'ChainExpression': {
-                return this.evalNodeAsync(node.expression, ctx);
-            }
-            default:
-                throw new Error(`Security Guard Violation: AST Node type '${node.type}' is disallowed.`);
-        }
-    }
-}

package/dist/index.js

@@ -1,145 +0,0 @@
-#!/usr/bin/env node
-import { parseArgs } from 'node:util';
-import path from 'node:path';
-import fs, { statSync } from 'node:fs';
-import { QueueManager } from './queue/dispatcher.js';
-import { SecretStore } from './secrets/store.js';
-import { WebhookServer } from './ingress/server.js';
-import { WorkflowIncludeResolver } from './parser/include-resolver.js';
-import { expandMatrix } from './parser/matrix-expander.js';
-import { startWorkers } from './worker.js';
-import { YamlLoader } from './parser/yaml-loader.js';
-import { resolveConfig } from './config.js';
-const { values, positionals } = parseArgs({
-    allowPositionals: true,
-    options: {
-        config: { type: 'string', short: 'c', default: process.env.RUNNER_CONFIG_PATH || './runner.config.mjs' },
-        database: { type: 'string', short: 'd', default: process.env.RUNNER_DATABASE_URL },
-        workflows: { type: 'string', short: 'w', default: process.env.RUNNER_WORKFLOWS_PATH || '.on/' },
-        port: { type: 'string', short: 'p', default: String(process.env.PORT || '11235') },
-        workers: { type: 'string', short: 'k', default: process.env.RUNNER_WORKERS || '5' },
-        help: { type: 'boolean', short: 'h' },
-    },
-});
-function printHelp() {
-    console.log(`
-🏃 Runner CLI 🏃
-
-Usage:
-  npx -y @cloud-cli/on <command> [options]
-  pnpm dlx -y @cloud-cli/on <command> [options]
-
-Commands:
-  start           Runs both Webhook Ingress Server and Workers (Default)
-  start-server    Runs Webhook Ingress Server only (API Gateway mode)
-  start-workers   Runs Worker Polling loops only (Scalable Worker mode)
-  validate        Parses and validates workflow YAML files without running
-
-Options:
-  -c, --config     Path to runner.config.mjs (default: ./runner.config.mjs, env: RUNNER_CONFIG_PATH)
-  -d, --database   SQLite Database URL (env: RUNNER_DATABASE_URL)
-  -w, --workflows  Path to where your workflows are defined (default: .on/, env: RUNNER_WORKFLOWS_PATH)
-  -p, --port       Port for Webhook Ingress Server (default: 11235, env: PORT)
-  -k, --workers    Number of worker thread loops to spawn (default: 5, env: RUNNER_WORKERS)
-  -h, --help       Show this help message
-  `);
-}
-if (values.help) {
-    printHelp();
-    process.exit(0);
-}
-async function loadConfig() {
-    const cliOverrides = {
-        port: Number(values.port),
-        sqliteUrl: values.database,
-        workflowsDir: values.workflows,
-        workersCount: values.workers ? Number(values.workers) : undefined,
-    };
-    let userFileConfig = {};
-    const configPath = path.resolve(values.config);
-    if (fs.existsSync(configPath) && statSync(configPath).isFile()) {
-        userFileConfig = (await import(configPath)).default || {};
-    }
-    // Merge CLI flags over file config over defaults
-    const finalConfig = resolveConfig({
-        ...userFileConfig,
-        ...cliOverrides,
-    });
-    if (!fs.existsSync(finalConfig.workflowsDir)) {
-        console.warn(`⚠️ Warning: Workflows directory '${finalConfig.workflowsDir}' not found.`);
-        return null;
-    }
-    return finalConfig;
-}
-function onValidate(config) {
-    console.log('🔍 Validating Workflows in:', config.workflowsDir);
-    const resolver = new WorkflowIncludeResolver(config.workflowsDir);
-    const files = fs.readdirSync(config.workflowsDir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
-    for (const file of files) {
-        const resolved = resolver.resolve(file);
-        const expanded = expandMatrix(resolved);
-        console.log(`  ✅ ${file} -> Valid! (${expanded.length} job matrix variant(s) generated)`);
-    }
-}
-async function onServe(config, workflows) {
-    const { queue, secrets } = await init();
-    WebhookServer.withPort({
-        queue,
-        secrets,
-        adminToken: config.adminToken,
-        workflows,
-        port: config.port,
-    });
-}
-async function onWorkers(config) {
-    const { queue, secrets } = await init();
-    startWorkers(config.workersCount, queue, secrets, config);
-}
-async function init() {
-    const secrets = new SecretStore('./.env');
-    const queue = new QueueManager('cli-node');
-    await queue.init();
-    return { secrets, queue };
-}
-async function main() {
-    const command = positionals[0] || 'start';
-    const config = await loadConfig();
-    if (!config) {
-        process.exit(1);
-    }
-    switch (command) {
-        case 'validate': {
-            onValidate(config);
-            break;
-        }
-        case 'start-server': {
-            console.log('🌐 Starting Ingress Gateway...');
-            onServe(config, []);
-            break;
-        }
-        case 'start-workers': {
-            console.log(`⚙️ Starting ${config.workersCount} Worker Loop(s)...`);
-            onWorkers(config);
-            break;
-        }
-        case 'start': {
-            console.log('🚀 Starting Full Runner Engine (Ingress + Workers)...');
-            const workflows = YamlLoader.from(config.workflowsDir);
-            onServe(config, workflows);
-            onWorkers(config);
-            break;
-        }
-        default:
-            console.error(`❌ Unknown command: '${command}'`);
-            printHelp();
-            process.exit(1);
-    }
-}
-const cleanupAndExit = async (signal) => {
-    console.log(`\n🛑 Received ${signal}. Gracefully shutting down workers...`);
-    // Cancel active jobs / close DB connections here
-    process.exit(0);
-};
-process.on('SIGINT', () => cleanupAndExit('SIGINT'));
-process.on('SIGTERM', () => cleanupAndExit('SIGTERM'));
-main().catch(console.error);

package/dist/ingress/preprocessors/github.js

@@ -1,30 +0,0 @@
-import crypto from 'node:crypto';
-export class GitHubPreprocessor {
-    name = 'github';
-    parse(headers, body, rawBodyBuffer, secret) {
-        // 1. HMAC Signature Verification
-        let isValid = true;
-        const signature = headers['x-hub-signature-256'];
-        if (secret && signature) {
-            const hmac = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBodyBuffer).digest('hex');
-            isValid = crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(hmac));
-        }
-        // 2. Normalize GitHub Event & Headers
-        const event = headers['x-github-event'] || 'unknown';
-        const ref = body.ref || '';
-        const branch = ref.replace('refs/heads/', '').replace('refs/tags/', '');
-        return {
-            isValid,
-            event,
-            inputs: {
-                event,
-                branch,
-                clone_url: body.repository?.clone_url,
-                commit_sha: body.after || body.head_commit?.id,
-                author: body.pusher?.name || body.sender?.login,
-                action: body.action, // e.g., 'opened', 'synchronize' for PRs
-            },
-            rawBody: body,
-        };
-    }
-}