@deksden-com/dd-flow-cli 0.9.0-beta.1 → 0.9.0-beta.11

package/tools/audit-runtime-fix-boundaries.mjs

@@ -0,0 +1,96 @@
+// Adversarial acceptance checks, independent of the long CLI fixture suite.
+// Run after building: pnpm build && node tools/audit-runtime-fix-boundaries.mjs
+// Uses only disposable local workspaces; no provider or production DB calls.
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { log } from "node:console";
+import { setTimeout, clearTimeout } from "node:timers";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { createContext } from "../dist/runtime/context.js";
+import { getResourceDatabase } from "../dist/storage/database.js";
+import { checksForRunAt, runCodeChecks, checkReceipts } from "../dist/services/code-checks.js";
+import { claimExpiredManagedProcesses, confirmManagedProcess, finishManagedProcess, managedProcessStatus, reconcileExpiredManagedProcesses, registerManagedProcess, reservePorts } from "../dist/services/managed-processes.js";
+import { selectRepairChecks } from "../dist/services/vnext-code.js";
+
+const results = [];
+const observations = {};
+async function check(name, action) {
+  try { await action(); results.push({ name, passed: true }); }
+  catch (error) { results.push({ name, passed: false, expected: error.expected, actual: error.actual, message: error.message }); }
+}
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "dd-flow-fix-audit-"));
+const resources = path.join(root, "resources");
+const context = createContext({ DD_FLOW_HOME: path.join(root, "flow"), DD_FLOW_RESOURCE_HOME: resources });
+const projectRoot = path.join(root, "project");
+fs.mkdirSync(projectRoot);
+try {
+  const request = {
+    projectId: "PRJ-AUDIT", runId: "RUN-AUDIT", runHome: path.join(root, "run"), workspaceRoot: projectRoot, scope: "aggregate",
+    checks: [{ id: "CHK-AUDIT", command: "sleep 0.05", purpose: "concurrent claim audit", run_at: "code", availability: "available" }]
+  };
+  const calls = await Promise.allSettled([runCodeChecks(context, request), runCodeChecks(context, request)]);
+  const rows = checkReceipts(context, { projectId: request.projectId, runId: request.runId });
+  observations.concurrent = calls.map((call) => call.status === "fulfilled" ? { status: call.status, receipts: call.value.map(({ id, status }) => ({ id, status })) } : { status: call.status, code: call.reason.code });
+  await check("a concurrent caller receives check_in_progress during the spawn window", () => assert.equal(calls.filter((call) => call.status === "rejected" && call.reason.code === "check_in_progress").length, 1));
+  await check("returned and persisted terminal check statuses agree", () => {
+    for (const call of calls.filter((call) => call.status === "fulfilled")) {
+      for (const receipt of call.value) assert.equal(rows.find((row) => row.id === receipt.id)?.status, receipt.status);
+    }
+  });
+
+  const source = { id: "CHK-QUALITY", command: "true", purpose: "aggregate quality gate", run_at: "code", availability: "available" };
+  await check("semantic repair retains an aggregate gate for context but does not run it in a Work", () => assert.deepEqual(checksForRunAt(selectRepairChecks({ semanticChecks: [source] }), "work"), []));
+
+  const record = registerManagedProcess(context, { kind: "audit", ownerId: "audit-owner", leaseMs: -1 });
+  const claimed = claimExpiredManagedProcesses(context, "interrupted-reconciler");
+  await check("orphan cleanup can be reclaimed after a reconciler interruption", () => {
+    assert.ok(claimed.some((item) => item.id === record.id));
+    context.now = () => "2099-01-01T00:00:00.000Z";
+    assert.ok(claimExpiredManagedProcesses(context, "next-reconciler").some((item) => item.id === record.id));
+  });
+  context.now = () => new Date().toISOString();
+  const ownedProcess = registerManagedProcess(context, { kind: "audit", ownerId: "audit-with-port" });
+  const allocation = await reservePorts(context, { ownerId: ownedProcess.owner_id, processId: ownedProcess.id, names: ["api"] });
+  try {
+    finishManagedProcess(context, { id: ownedProcess.id, leaseToken: ownedProcess.lease_token, state: "stopped" });
+    await check("terminal process cleanup also releases its durable port claims", () => {
+      const rows = getResourceDatabase(resources).all("SELECT * FROM managed_resources WHERE process_id = ?", [ownedProcess.id]);
+      assert.equal(rows.length, 0);
+    });
+  } finally { allocation.release(); }
+  await check("orphan reconciliation also terminates the process-owned child tree", async () => {
+    // Both processes belong only to this temporary test. A private process
+    // group makes the finally block able to clean up even a failed assertion.
+    const tree = spawn(process.execPath, ["-e", `const {spawn}=require('node:child_process'); const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'}); console.log(child.pid); setInterval(()=>{},1000);`], { detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    const closed = once(tree, "close");
+    let timer;
+    try {
+      const data = await Promise.race([once(tree.stdout, "data"), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("test process did not start")), 2000); })]);
+      clearTimeout(timer);
+      const childPid = Number(String(data[0]).trim());
+      assert.ok(Number.isInteger(childPid) && childPid > 0);
+      const record = registerManagedProcess(context, { kind: "audit-tree", ownerId: "audit-tree-owner" });
+      confirmManagedProcess(context, { id: record.id, leaseToken: record.lease_token, pid: tree.pid, processGroupId: tree.pid });
+      getResourceDatabase(resources).run("UPDATE managed_processes SET lease_expires_at = ? WHERE id = ?", ["2000-01-01T00:00:00.000Z", record.id]);
+      await reconcileExpiredManagedProcesses(context, "audit-tree-cleanup", 20);
+      let alive = true;
+      try { process.kill(childPid, 0); } catch { alive = false; }
+      assert.equal(alive, false);
+    } finally {
+      clearTimeout(timer);
+      try { process.kill(-tree.pid, "SIGKILL"); } catch { /* our group has already stopped */ }
+      await closed;
+    }
+  });
+  await check("the check owner reaches a terminal process state on ordinary completion", () => assert.ok(managedProcessStatus(context).filter((item) => item.kind === "check").every((item) => ["stopped", "failed"].includes(item.state))));
+} finally {
+  context.db.close();
+  getResourceDatabase(resources).close();
+  fs.rmSync(root, { recursive: true, force: true });
+}
+log(JSON.stringify({ checks: results.length, passed: results.filter((item) => item.passed).length, results, observations }, null, 2));
+process.exitCode = results.some((item) => !item.passed) ? 1 : 0;