@jigging/jig 0.1.0-alpha.26 → 0.1.0-alpha.29

package/libexec/linux-rootless-supervisor.js

@@ -20,6 +20,7 @@ var POLICY = Object.freeze(["--no-env-file", "--no-install", "--config=/dev/null
 var SANDBOX_BUN = "/jig-runtime/bun";
 var SANDBOX_LIBRARY_PATH = "/jig-runtime/lib";
 var MAX_CONTROL_BYTES = 64 * 1024;
+var CORE_DUMP_POLL_MS = 250;
 var MODULE_DESTINATION = "/jig/linux-rootless-supervisor.ts";
 var DIGEST = /^sha256:[0-9a-f]{64}$/;
 var OWNER_TOKEN = /^[0-9a-f]{64}$/;
@@ -112,6 +113,9 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
   let exitSignal = null;
   let evidence = emptyEvidence();
   let terminal;
+  let coreDumpTimer;
+  let coreDumpCheck;
+  let monitoringClosed = false;
   try {
     await mkdir(runCgroup, { mode: 493 });
     cgroupCreated = true;
@@ -162,6 +166,19 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
     });
     childExit = childClose(launched);
     child = launched;
+    coreDumpTimer = setInterval(() => {
+      if (monitoringClosed || stopReason !== undefined || coreDumpCheck !== undefined)
+        return;
+      coreDumpCheck = privateHasCoreDumpingProcess(runCgroup, limits.pids).then((dumping) => {
+        if (dumping && !monitoringClosed && stopReason === undefined)
+          stop("core_dump");
+      }).catch(() => {
+        if (!monitoringClosed && stopReason === undefined)
+          stop("setup_failed");
+      }).finally(() => {
+        coreDumpCheck = undefined;
+      });
+    }, CORE_DUMP_POLL_MS);
     launched.stdio[4].on("error", () => stop("setup_failed"));
     const ready = await readReady(launched);
     if (configuration.output) {
@@ -187,12 +204,16 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
       process.stderr.write(`${errorText(error)}
 `);
   } finally {
+    monitoringClosed = true;
+    clearInterval(coreDumpTimer);
     clearTimeout(deadline);
     await outputDirectory?.close();
     let cleanupError;
     try {
       child?.kill("SIGKILL");
       await killRun();
+      if (coreDumpCheck !== undefined)
+        await withinTimeout(coreDumpCheck, limits.cleanupTimeoutMs, "core-dump check did not settle");
       if (childExit !== undefined) {
         await withinTimeout(childExit.catch(() => {
           return;
@@ -225,6 +246,36 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
     control.end();
   }
 }
+async function privateHasCoreDumpingProcess(runCgroup, maxProcesses, readText = (path) => readFile(path, "utf8")) {
+  const processes = (await readText(`${runCgroup}/cgroup.procs`)).trim();
+  const pids = processes === "" ? [] : processes.split(`
+`);
+  if (!positiveInteger(maxProcesses) || pids.length > maxProcesses || pids.some((pid) => !/^[1-9][0-9]*$/.test(pid) || !Number.isSafeInteger(Number(pid))))
+    throw new Error("invalid owned process observation");
+  const membership = `0::${runCgroup.slice("/sys/fs/cgroup".length)}`;
+  for (const pid of pids) {
+    try {
+      const status = await readText(`/proc/${pid}/status`);
+      if (status.length > MAX_CONTROL_BYTES)
+        throw new Error("oversized owned process status");
+      if (!/^CoreDumping:/m.test(status))
+        continue;
+      const dumping = /^CoreDumping:[ \t]+([01])$/m.exec(status);
+      if (dumping === null)
+        throw new Error("kernel core-dump observation is unavailable");
+      if (dumping[1] !== "1")
+        continue;
+      if ((await readText(`/proc/${pid}/cgroup`)).split(`
+`).includes(membership))
+        return true;
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ESRCH")
+        throw error;
+    }
+  }
+  return false;
+}
 async function enterMain(arguments_) {
   requireFixedBunPosture("entry trampoline");
   if (arguments_.length < 7)
@@ -792,3 +843,6 @@ if (import.meta.main) {
     process.exitCode = 70;
   });
 }
+export {
+  privateHasCoreDumpingProcess
+};

package/libexec/macos-native-supervisor.js

@@ -1375,7 +1375,9 @@ function requirePrivateMacosGuardianStorage(storage, files, cwd) {
   if (storage === null || typeof storage !== "object" || Object.keys(storage).sort().join() !== "bytes,collect,mountPath" || typeof storage.mountPath !== "string" || !storage.mountPath.startsWith("/") || storage.mountPath === "/" || posix3.normalize(storage.mountPath) !== storage.mountPath || !Number.isSafeInteger(storage.bytes) || storage.bytes < 16 * 1024 * 1024 || storage.bytes > 512 * 1024 * 1024 || storage.bytes % (1024 * 1024) !== 0 || ![null, "output", "work"].includes(storage.collect))
     throw new TypeError("invalid macOS guardian storage");
   const roots = ["work", "tmp", "output"].map((name) => join5(storage.mountPath, name));
-  if (files.writableTrees.some((path) => !roots.includes(path)) || !roots.some((root) => cwd === root || cwd.startsWith(`${root}/`)))
+  const inputs = join5(storage.mountPath, "inputs");
+  const readOnlyInputCwd = files.writableTrees.length === 0 && storage.collect === null && files.readOnlyTrees.includes(inputs) && (cwd === inputs || cwd.startsWith(`${inputs}/`));
+  if (files.writableTrees.some((path) => !roots.includes(path)) || !roots.some((root) => cwd === root || cwd.startsWith(`${root}/`)) && !readOnlyInputCwd)
     throw new TypeError("macOS writable projection is outside bounded storage");
 }
 async function preparePrivateMacosGuardianStorage(owner, token, storage, signal) {

package/libexec/markdown-runtime.js

@@ -20228,6 +20228,7 @@ async function captureAttempt(root, backing, selection) {
   const directories = new Set([identityKey(root.information)]);
   let totalBytes = 0;
   let directoryCount = 0;
+  const copyBuffer = new Uint8Array(COPY_CHUNK_BYTES);
   async function walk(directory, logicalDirectory) {
     directoryCount += 1;
     if (directoryCount > MAX_DIRECTORIES) {
@@ -20253,7 +20254,7 @@ async function captureAttempt(root, backing, selection) {
           invalid("PACKAGE_LIMIT", "selected dependency source exceeds its capture budget", logicalPath);
         await rejectKnownOversizeFile(entry.handle, entry.information, logicalPath);
         const offset = totalBytes;
-        const size = await copyToBacking(entry.handle, backing, offset, totalBytes, logicalPath, selection?.maximumBytes);
+        const size = await copyToBacking(entry.handle, backing, offset, totalBytes, logicalPath, copyBuffer, selection?.maximumBytes);
         totalBytes += size;
         if (selection !== undefined && totalBytes > selection.maximumBytes)
           invalid("PACKAGE_LIMIT", "selected dependency source exceeds its capture budget", logicalPath);
@@ -20277,10 +20278,9 @@ async function captureAttempt(root, backing, selection) {
   }
   return { records, fingerprints };
 }
-async function copyToBacking(source, backing, backingOffset, priorTotal, logicalPath, maximumBytes = MAX_TOTAL_BYTES2) {
+async function copyToBacking(source, backing, backingOffset, priorTotal, logicalPath, buffer, maximumBytes = MAX_TOTAL_BYTES2) {
   let sourceOffset = 0;
   while (true) {
-    const buffer = new Uint8Array(COPY_CHUNK_BYTES);
     let bytesRead;
     try {
       ({ bytesRead } = await source.read(buffer, 0, buffer.byteLength, sourceOffset));

package/libexec/preparation/bun-native-preparation-worker.js

@@ -188,6 +188,33 @@ function ordinaryRecord(value) {
   return value;
 }
 
+// src/internal/bun-native-inputs.ts
+async function privateBunNativeInputs(input) {
+  const manifests = [
+    "package.json",
+    ...input.members?.map((path) => `${path}/package.json`) ?? []
+  ];
+  const paths = new Set(manifests);
+  if (input.paths.includes("bun.lock"))
+    paths.add("bun.lock");
+  let patches = {};
+  for (const path of manifests) {
+    const bytes = await input.read(path);
+    if (bytes.byteLength > 1024 * 1024)
+      throw new TypeError("oversized native manifest");
+    const manifest = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    requirePrivateBunResolutionManifest(manifest, input.members === undefined ? undefined : path === "package.json" ? "root" : "member");
+    if (path === "package.json")
+      patches = requirePrivateBunPatches(manifest.patchedDependencies);
+  }
+  for (const path of Object.values(patches)) {
+    if ((await input.read(path)).byteLength > 1024 * 1024)
+      throw new TypeError("oversized captured patch");
+    paths.add(path);
+  }
+  return Object.freeze({ paths, patches });
+}
+
 // src/package/normalization-data-15.1.ts
 var CANONICAL_CLASS_15_1 = new Map([
   [768, 230],
@@ -5014,29 +5041,21 @@ try {
   if (!(await iterator.next()).done) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source has trailing data");
   }
-  const inputPaths = new Set([
-    "package.json",
-    "bun.lock",
-    ...workspace?.members.map((path) => `${path}/package.json`) ?? []
-  ]);
+  let inputPaths;
   let patches = {};
   try {
-    for (const path of [
-      "package.json",
-      ...workspace?.members.map((path2) => `${path2}/package.json`) ?? []
-    ]) {
-      const file = source.files.find((file2) => file2.path === path);
-      const manifest = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64(file.content, path)));
-      requirePrivateBunResolutionManifest(manifest, workspace === undefined ? undefined : path === "package.json" ? "root" : "member");
-      if (path === "package.json")
-        patches = requirePrivateBunPatches(manifest.patchedDependencies);
-    }
-    for (const path of Object.values(patches)) {
-      const file = source.files.find((file2) => file2.path === path);
-      if (file === undefined || decodeBase64(file.content, path).byteLength > 1024 * 1024)
-        throw new TypeError("missing or oversized captured patch");
-      inputPaths.add(path);
-    }
+    const native = await privateBunNativeInputs({
+      paths: source.files.map(({ path }) => path),
+      ...workspace === undefined ? {} : { members: workspace.members },
+      read(path) {
+        const file = source.files.find((file2) => file2.path === path);
+        if (file === undefined)
+          throw new TypeError("missing native input");
+        return decodeBase64(file.content, path);
+      }
+    });
+    inputPaths = native.paths;
+    patches = native.patches;
   } catch {
     throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "native manifests or declared patch inputs are unsupported or incomplete");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jigging/jig",
-  "version": "0.1.0-alpha.26",
+  "version": "0.1.0-alpha.29",
   "description": "A local, secure host for admitted FLOW packages",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {