@hackerrank/astra-cli 0.1.6 → 0.1.8

package/src/verifier-runner.js

@@ -0,0 +1,159 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+
+import { validateVerifierResult } from "./result-contract.js";
+
+function redactOutput(value) {
+  return String(value || "")
+    .replace(/(authorization\s*:\s*bearer\s+)[^\s,;]+/gi, "$1[REDACTED]")
+    .replace(/(--token\s+)[^\s,;]+/gi, "$1[REDACTED]")
+    .slice(-2000);
+}
+
+function runCommand(command, { cwd, env, timeoutSeconds }) {
+  return new Promise((resolve) => {
+    const child = spawn(command, { cwd, env, shell: true, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 250);
+    }, Math.max(1, Number(timeoutSeconds) || 3600) * 1000);
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      resolve({ code, signal, timedOut, stdout, stderr });
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({ code: null, signal: null, timedOut: false, stdout, stderr: `${stderr}${error.message}` });
+    });
+  });
+}
+
+function startProcess(command, { cwd, env }) {
+  return spawn(command, { cwd, env, shell: true, stdio: ["ignore", "ignore", "ignore"] });
+}
+
+async function acquireVerifierLock(projectRoot, timeoutSeconds) {
+  const lockPath = path.join(projectRoot, ".astra", "verifier.lock");
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + Math.max(1, Number(timeoutSeconds) || 3600) * 1000;
+  while (Date.now() < deadline) {
+    try {
+      const descriptor = fs.openSync(lockPath, "wx");
+      fs.writeFileSync(descriptor, `${process.pid}\n`);
+      return () => {
+        try { fs.closeSync(descriptor); } catch {}
+        try { fs.rmSync(lockPath, { force: true }); } catch {}
+      };
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+  }
+  throw new Error("timed out waiting for the task verifier lock");
+}
+
+async function waitReady(url, timeoutSeconds) {
+  const deadline = Date.now() + Math.max(1, Number(timeoutSeconds) || 30) * 1000;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(1000) });
+      if (response.ok) return true;
+    } catch {
+      // Candidate is still starting.
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250));
+  }
+  return false;
+}
+
+export async function runVerifier({ project, cell, runDir, candidateDir, config, expected = {} }) {
+  const started = Date.now();
+  fs.mkdirSync(runDir, { recursive: true });
+  const reportPath = path.resolve(runDir, config.report || "verifier.json");
+  if (reportPath !== path.resolve(runDir) && !reportPath.startsWith(`${path.resolve(runDir)}${path.sep}`)) {
+    return { status: "error", failureOwner: "infrastructure", solvedScore: "NA", durationSeconds: 0, error: "verifier report must stay inside the run directory" };
+  }
+  // Never accept a report left by an earlier interrupted attempt.
+  try { fs.rmSync(reportPath, { force: true }); } catch (error) {
+    return { status: "error", failureOwner: "infrastructure", solvedScore: "NA", durationSeconds: 0, error: `cannot clear previous verifier report: ${error.message}` };
+  }
+  const env = {
+    PATH: process.env.PATH,
+    HOME: process.env.HOME,
+    ...(process.env.DOCKER_HOST ? { DOCKER_HOST: process.env.DOCKER_HOST } : {}),
+    ASTRA_VERIFIER_REPORT: reportPath,
+    ASTRA_CANDIDATE_WORKSPACE: candidateDir,
+    ASTRA_TASK_ID: project.id,
+    ASTRA_TASK_VERSION: String(project.version),
+    ASTRA_TASK_TYPE: project.type || "brownfield",
+    ASTRA_CELL_KEY: cell.cellKey,
+    ASTRA_PROJECT_ROOT: project.root,
+    ...(config.baseUrl ? { SCIM_BASE_URL: config.baseUrl } : {}),
+    ...(config.tokenEnv && process.env[config.tokenEnv] ? { [config.tokenEnv]: process.env[config.tokenEnv] } : {}),
+  };
+  let candidateProcess = null;
+  let releaseLock = null;
+  try {
+    // Candidate Docker Compose files commonly claim fixed host ports. Serialize
+    // verification per task while allowing costly model generation to run in
+    // parallel safely.
+    releaseLock = await acquireVerifierLock(project.root, config.timeoutSeconds);
+    if (config.startCommand) {
+      candidateProcess = startProcess(config.startCommand, { cwd: candidateDir, env });
+      // A cold Docker build legitimately exceeds a minute. Give the candidate
+      // a bounded five-minute startup window, still capped by task timeout.
+      if (config.readinessUrl && !(await waitReady(config.readinessUrl, Math.min(config.timeoutSeconds, 300)))) {
+        return { status: "error", failureOwner: "infrastructure", solvedScore: "NA", durationSeconds: (Date.now() - started) / 1000, error: "candidate readiness timed out" };
+      }
+    }
+    const commandResult = await runCommand(config.command, {
+      cwd: project.root,
+      env,
+      timeoutSeconds: config.timeoutSeconds,
+    });
+    const durationSeconds = (Date.now() - started) / 1000;
+    if (commandResult.timedOut) return { status: "error", failureOwner: "infrastructure", solvedScore: "NA", durationSeconds, error: "verifier timed out" };
+    if (!fs.existsSync(reportPath)) {
+      const detail = redactOutput(commandResult.stderr);
+      return {
+        status: "error",
+        failureOwner: "infrastructure",
+        solvedScore: "NA",
+        durationSeconds,
+        error: detail ? `verifier report was not produced: ${detail}` : "verifier report was not produced",
+        exitCode: commandResult.code,
+      };
+    }
+    let raw;
+    try {
+      raw = JSON.parse(fs.readFileSync(reportPath, "utf8"));
+    } catch (error) {
+      return { status: "error", failureOwner: "infrastructure", solvedScore: "NA", durationSeconds, error: `invalid verifier JSON: ${error.message}`, exitCode: commandResult.code };
+    }
+    const validation = validateVerifierResult(raw, expected);
+    if (!validation.ok) return { status: "error", failureOwner: "infrastructure", solvedScore: "NA", durationSeconds, error: validation.error, exitCode: commandResult.code };
+    return {
+      status: raw.status,
+      failureOwner: raw.status === "failed" ? "candidate" : raw.status === "passed" ? null : "infrastructure",
+      score: raw.score,
+      solvedScore: raw.score?.percentage ?? "NA",
+      criteria: raw.criteria,
+      reportPath,
+      durationSeconds,
+      exitCode: commandResult.code,
+    };
+  } finally {
+    if (config.stopCommand) {
+      await runCommand(config.stopCommand, { cwd: candidateDir, env, timeoutSeconds: Math.min(Number(config.timeoutSeconds) || 30, 30) });
+    }
+    if (candidateProcess && !candidateProcess.killed) candidateProcess.kill("SIGTERM");
+    if (releaseLock) releaseLock();
+  }
+}