@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/runtime/isolation/types.js

@@ -0,0 +1 @@
+// @bun

package/dist/src/control-plane/runtime/isolation/worktree.js

@@ -0,0 +1,509 @@
+// @bun
+// packages/runtime/src/control-plane/runtime/isolation/worktree.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, rmSync as rmSync3 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+
+// packages/runtime/src/control-plane/runtime/isolation/shared.ts
+import { existsSync as existsSync2, readFileSync, rmSync as rmSync2 } from "fs";
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync, existsSync, mkdirSync, renameSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, resolve } from "path";
+var sharedNativeRuntimeOutputDir = resolve(tmpdir(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve(cursor, "native", `${process.platform}-${process.arch}`, name), resolve(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve(cursor, "native", name), resolve(cursor, "native", "lib", name));
+    }
+    const parent = dirname(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve(execDir, platformSpecific) : "",
+    execDir ? resolve(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve(execDir, "..", platformSpecific) : "",
+    execDir ? resolve(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync(bundled) ? bundled : null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync(dirname(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync(outputPath) || statSync(sourcePath).mtimeMs > statSync(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync(tempOutputPath)) {
+      rmSync(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+var scopeRegexCache = new Map;
+
+// packages/runtime/src/control-plane/runtime/isolation/shared.ts
+var generatedCredentialFiles = new Set;
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveHostGitBinary() {
+  const candidates = [
+    process.env.RIG_GIT_BIN?.trim() || "",
+    "/usr/bin/git",
+    "/opt/homebrew/bin/git",
+    "/usr/local/bin/git"
+  ];
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved)) {
+    candidates.push(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (!candidate || isRuntimeGatewayGitPath(candidate)) {
+      continue;
+    }
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  return "git";
+}
+async function runGitCommand(repoRoot, args) {
+  const gitBinary = resolveHostGitBinary();
+  return Bun.$`${gitBinary} -C ${repoRoot} ${args}`.quiet().nothrow();
+}
+async function readGitConfigValue(repoRoot, key, global = false) {
+  const args = ["config", ...global ? ["--global"] : [], "--get", key];
+  const result = await runGitCommand(repoRoot, args);
+  if (result.exitCode !== 0) {
+    return "";
+  }
+  return String(result.stdout).trim();
+}
+async function readGitStdout(repoRoot, args) {
+  const result = await runGitCommand(repoRoot, args);
+  if (result.exitCode !== 0) {
+    throw new Error(`git -C ${repoRoot} ${args.join(" ")} failed: ${result.stderr || result.stdout}`);
+  }
+  return String(result.stdout).trim();
+}
+async function hasGitRemote(repoRoot, remote) {
+  const result = await runGitCommand(repoRoot, ["remote", "get-url", remote]);
+  return result.exitCode === 0;
+}
+async function ensureFullGitHistory(repoRoot) {
+  const shallow = await runGitCommand(repoRoot, ["rev-parse", "--is-shallow-repository"]);
+  if (shallow.exitCode !== 0 || String(shallow.stdout).trim() !== "true") {
+    return;
+  }
+  const unshallow = await runGitCommand(repoRoot, ["fetch", "--unshallow", "--tags", "origin"]);
+  if (unshallow.exitCode === 0) {
+    return;
+  }
+  const output = `${unshallow.stderr}
+${unshallow.stdout}`.trim();
+  if (/--unshallow on a complete repository|does not make sense/i.test(output)) {
+    return;
+  }
+  throw new Error(`Failed to expand git history for ${repoRoot}: ${output}`);
+}
+async function refreshRemoteBranch(repoRoot, remote, branch) {
+  if (!await hasGitRemote(repoRoot, remote)) {
+    return;
+  }
+  try {
+    await ensureFullGitHistory(repoRoot);
+    const fetch = await runGitCommand(repoRoot, [
+      "fetch",
+      "--prune",
+      "--tags",
+      remote,
+      `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`
+    ]);
+    if (fetch.exitCode !== 0) {
+      return;
+    }
+  } catch {
+    return;
+  }
+}
+function sanitizeRuntimeRefSegment(value) {
+  const sanitized = value.trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return (sanitized || "runtime").slice(0, 64);
+}
+function runtimeBranchBackupName(branch) {
+  const branchId = branch.replace(/^rig\//, "");
+  return `rig-backup/${sanitizeRuntimeRefSegment(branchId)}-${Date.now()}`;
+}
+function taskRuntimeId(taskId) {
+  return `task-${taskId}`;
+}
+
+// packages/runtime/src/control-plane/runtime/isolation/worktree.ts
+async function resolveMonorepoBaseRef(monorepoRoot) {
+  const explicit = process.env.RIG_RUNTIME_BASE_REF?.trim();
+  if (explicit) {
+    const exists = await runGitCommand(monorepoRoot, ["rev-parse", "--verify", "--quiet", explicit]);
+    if (exists.exitCode !== 0) {
+      throw new Error(`RIG_RUNTIME_BASE_REF=${explicit} does not resolve at ${monorepoRoot}.`);
+    }
+    return explicit;
+  }
+  for (const remote of await preferredBaseRemotes(monorepoRoot)) {
+    await refreshRemoteBranch(monorepoRoot, remote, "main");
+    const remoteMain = await runGitCommand(monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/remotes/${remote}/main`]);
+    if (remoteMain.exitCode === 0) {
+      return `${remote}/main`;
+    }
+  }
+  const localMain = await runGitCommand(monorepoRoot, ["show-ref", "--verify", "--quiet", "refs/heads/main"]);
+  if (localMain.exitCode === 0) {
+    return "main";
+  }
+  throw new Error(`Failed to resolve a monorepo base ref at ${monorepoRoot}. Expected local main or a remote main ref.`);
+}
+function ensureProvisioningHostProjectRootEnv(projectRoot) {
+  if (!projectRoot.trim()) {
+    return;
+  }
+  if (!process.env.RIG_HOST_PROJECT_ROOT?.trim()) {
+    process.env.RIG_HOST_PROJECT_ROOT = projectRoot;
+  }
+  if (!process.env.PROJECT_RIG_ROOT?.trim()) {
+    process.env.PROJECT_RIG_ROOT = projectRoot;
+  }
+}
+async function provisionRuntimeWorktree(config) {
+  const branch = runtimeBranchName(config.taskId, config.runtimeId);
+  let hasValidWorktree = existsSync3(resolve2(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
+  if (existsSync3(config.workspaceDir) && !hasValidWorktree) {
+    rmSync3(config.workspaceDir, { recursive: true, force: true });
+  }
+  if (!hasValidWorktree) {
+    mkdirSync2(dirname2(config.workspaceDir), { recursive: true });
+    const branchExists = await runGitCommand(config.monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
+    const add = branchExists.exitCode === 0 ? await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", config.workspaceDir, branch]) : await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", "-b", branch, config.workspaceDir, config.baseRef]);
+    if (add.exitCode !== 0) {
+      throw new Error(`Failed to create monorepo worktree for ${config.runtimeId}: ${add.stderr.toString() || add.stdout.toString()}`);
+    }
+    hasValidWorktree = true;
+  }
+  await ensureRuntimeBranch(config.workspaceDir, branch, config.baseRef);
+}
+async function cleanupRuntimeWorktree(monorepoRoot, workspaceDir) {
+  await runGitCommand(monorepoRoot, ["worktree", "remove", "--force", workspaceDir]);
+}
+async function configureRuntimeGitIdentity(projectRoot, repoRoot) {
+  const userName = process.env.RIG_GIT_USER_NAME?.trim() || await readGitConfigValue(projectRoot, "user.name") || await readGitConfigValue(projectRoot, "user.name", true) || process.env.GIT_AUTHOR_NAME?.trim() || process.env.GIT_COMMITTER_NAME?.trim() || "rig-agent";
+  const userEmail = process.env.RIG_GIT_USER_EMAIL?.trim() || await readGitConfigValue(projectRoot, "user.email") || await readGitConfigValue(projectRoot, "user.email", true) || process.env.GIT_AUTHOR_EMAIL?.trim() || process.env.GIT_COMMITTER_EMAIL?.trim() || "rig-agent@users.noreply.github.com";
+  for (const [key, value] of [
+    ["user.name", userName],
+    ["user.email", userEmail]
+  ]) {
+    await runGitCommand(repoRoot, ["config", "--local", key, value]);
+  }
+}
+async function resolveMonorepoBaseCommit(monorepoRoot, baseRef) {
+  return readGitStdout(monorepoRoot, ["rev-parse", baseRef]);
+}
+async function ensureRuntimeBranch(repoRoot, branch, baseRef) {
+  const pruneWorktrees = async () => {
+    await runGitCommand(repoRoot, ["worktree", "prune", "--expire", "now"]);
+  };
+  await pruneWorktrees();
+  await clearInterruptedRuntimeGitState(repoRoot, branch);
+  const current = await runGitCommand(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (current.exitCode === 0 && current.stdout.toString().trim() === branch) {
+    await repairDisconnectedRuntimeBranch(repoRoot, branch, baseRef);
+    await clearInterruptedRuntimeGitState(repoRoot, branch);
+    return;
+  }
+  let checkout = await runGitCommand(repoRoot, ["checkout", "-B", branch]);
+  const checkoutError = checkout.stderr.toString() || checkout.stdout.toString();
+  if (checkout.exitCode !== 0 && checkoutError.includes("already used by worktree")) {
+    await pruneWorktrees();
+    checkout = await runGitCommand(repoRoot, ["checkout", "-B", branch]);
+  }
+  if (checkout.exitCode !== 0 && /resolve your current index first|would be overwritten by checkout/i.test(checkoutError)) {
+    await discardTrackedRuntimeChanges(repoRoot, branch, checkoutError);
+    checkout = await runGitCommand(repoRoot, ["checkout", "-B", branch]);
+  }
+  if (checkout.exitCode !== 0) {
+    throw new Error(`Failed to prepare runtime branch ${branch} in ${repoRoot}: ${checkout.stderr.toString() || checkout.stdout.toString()}`);
+  }
+  await repairDisconnectedRuntimeBranch(repoRoot, branch, baseRef);
+  await clearInterruptedRuntimeGitState(repoRoot, branch);
+}
+async function repairDisconnectedRuntimeBranch(repoRoot, branch, baseRef) {
+  const mergeBase = await runGitCommand(repoRoot, ["merge-base", "HEAD", baseRef]);
+  if (mergeBase.exitCode === 0) {
+    const counts = await runGitCommand(repoRoot, ["rev-list", "--left-right", "--count", `HEAD...${baseRef}`]);
+    if (counts.exitCode === 0) {
+      const [aheadRaw = "0", behindRaw = "0"] = String(counts.stdout).trim().split(/\s+/);
+      const ahead = Number.parseInt(aheadRaw, 10);
+      const behind = Number.parseInt(behindRaw, 10);
+      if (Number.isFinite(ahead) && Number.isFinite(behind) && ahead === 0 && behind > 0) {
+        const reset = await runGitCommand(repoRoot, ["reset", "--hard", baseRef]);
+        if (reset.exitCode !== 0) {
+          throw new Error(`Failed to reset stale runtime branch ${branch} to ${baseRef} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+        }
+        console.log(`[rig-agent] Reset stale runtime branch ${branch} to ${baseRef} in ${repoRoot}`);
+      }
+    }
+    return;
+  }
+  const backupBranch = runtimeBranchBackupName(branch);
+  const rename = await runGitCommand(repoRoot, ["branch", "-m", backupBranch]);
+  if (rename.exitCode !== 0) {
+    throw new Error(`Failed to archive disconnected runtime branch ${branch} in ${repoRoot}: ${rename.stderr.toString() || rename.stdout.toString()}`);
+  }
+  const recreate = await runGitCommand(repoRoot, ["checkout", "-B", branch, baseRef]);
+  if (recreate.exitCode !== 0) {
+    throw new Error(`Failed to recreate runtime branch ${branch} from ${baseRef} in ${repoRoot}: ${recreate.stderr.toString() || recreate.stdout.toString()}`);
+  }
+  console.log(`[rig-agent] Recreated disconnected runtime branch ${branch} from ${baseRef}; archived as ${backupBranch}`);
+}
+async function clearInterruptedRuntimeGitState(repoRoot, branch) {
+  let cleared = false;
+  for (const [sentinel, abortArgs] of [
+    ["MERGE_HEAD", ["merge", "--abort"]],
+    ["REBASE_HEAD", ["rebase", "--abort"]],
+    ["CHERRY_PICK_HEAD", ["cherry-pick", "--abort"]]
+  ]) {
+    const state = await runGitCommand(repoRoot, ["rev-parse", "--verify", "--quiet", sentinel]);
+    if (state.exitCode !== 0) {
+      continue;
+    }
+    cleared = true;
+    const abort = await runGitCommand(repoRoot, [...abortArgs]);
+    if (abort.exitCode === 0) {
+      continue;
+    }
+    const reset = await runGitCommand(repoRoot, ["reset", "--hard", "HEAD"]);
+    if (reset.exitCode !== 0) {
+      throw new Error(`Failed to recover interrupted git state for runtime branch ${branch} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+    }
+  }
+  const unmerged = await runGitCommand(repoRoot, ["ls-files", "-u"]);
+  if (unmerged.exitCode === 0 && String(unmerged.stdout).trim()) {
+    cleared = true;
+    const reset = await runGitCommand(repoRoot, ["reset", "--hard", "HEAD"]);
+    if (reset.exitCode !== 0) {
+      throw new Error(`Failed to clear unmerged files for runtime branch ${branch} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+    }
+  }
+  if (cleared) {
+    console.log(`[rig-agent] Reset interrupted git state in runtime branch ${branch} at ${repoRoot}`);
+  }
+}
+async function discardTrackedRuntimeChanges(repoRoot, branch, reason) {
+  const status = await runGitCommand(repoRoot, ["status", "--porcelain"]);
+  if (status.exitCode !== 0) {
+    throw new Error(`Failed to inspect runtime worktree state for ${branch} in ${repoRoot}: ${status.stderr.toString() || status.stdout.toString()}`);
+  }
+  const trackedChanges = String(status.stdout).split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean).filter((line) => !line.startsWith("?? "));
+  if (trackedChanges.length === 0) {
+    return;
+  }
+  const reset = await runGitCommand(repoRoot, ["reset", "--hard", "HEAD"]);
+  if (reset.exitCode !== 0) {
+    throw new Error(`Failed to discard tracked runtime changes for ${branch} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+  }
+  console.log(`[rig-agent] Reset tracked runtime changes in ${branch} at ${repoRoot} after checkout failed: ${reason.trim()}`);
+}
+function runtimeBranchName(taskId, runtimeId) {
+  if (runtimeId === taskRuntimeId(taskId)) {
+    return `rig/${taskId}`;
+  }
+  return `rig/${taskId}-${sanitizeRuntimeRefSegment(runtimeId)}`;
+}
+function runtimeWorktreeName(taskId, runtimeId) {
+  if (runtimeId === taskRuntimeId(taskId)) {
+    return taskId;
+  }
+  return sanitizeRuntimeRefSegment(runtimeId);
+}
+function runtimeWorktreeNameFromRuntimeId(runtimeId) {
+  return sanitizeRuntimeRefSegment(runtimeId.replace(/^task-/, ""));
+}
+async function preferredBaseRemotes(repoRoot) {
+  const remotesResult = await runGitCommand(repoRoot, ["remote"]);
+  if (remotesResult.exitCode !== 0) {
+    return [];
+  }
+  const remotes = String(remotesResult.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (remotes.length === 0) {
+    return [];
+  }
+  const preferred = [];
+  const pushRemote = (remote) => {
+    if (!preferred.includes(remote)) {
+      preferred.push(remote);
+    }
+  };
+  if (await hasGitRemote(repoRoot, "github")) {
+    pushRemote("github");
+  }
+  for (const remote of remotes) {
+    if (remote === "github") {
+      continue;
+    }
+    const urlResult = await runGitCommand(repoRoot, ["remote", "get-url", remote]);
+    const url = urlResult.exitCode === 0 ? String(urlResult.stdout).trim() : "";
+    if (/github\.com[:/]/i.test(url)) {
+      pushRemote(remote);
+    }
+  }
+  for (const remote of remotes) {
+    pushRemote(remote);
+  }
+  return preferred;
+}
+export {
+  runtimeWorktreeNameFromRuntimeId,
+  runtimeWorktreeName,
+  runtimeBranchName,
+  resolveMonorepoBaseRef,
+  resolveMonorepoBaseCommit,
+  provisionRuntimeWorktree,
+  ensureProvisioningHostProjectRootEnv,
+  configureRuntimeGitIdentity,
+  cleanupRuntimeWorktree
+};