@junghanacs/entwurf 0.12.0

package/scripts/check-entwurf-v2-spawn-production.ts

@@ -0,0 +1,452 @@
+/**
+ * check-entwurf-v2-spawn-production — DETERMINISTic gate for the 5c-3c production
+ * SpawnBgResumeDeps factory. It proves every injectable seam WITHOUT a real pi spawn,
+ * socket, or timer (the heavy live path is a separate opt-in smoke,
+ * smoke-entwurf-v2-spawn-live, kept OUT of pnpm check — D5):
+ *
+ *   1. socketWatchVerdict (the R2 watch policy, pure): address-conflict → forged (reject,
+ *      never wait); alive → alive (resolve); dead / indeterminate → wait (keep polling).
+ *   2. spawnChild: resolves identity (injected) → buildResumePiArgs(v2-control) → spawnFn.
+ *      The captured argv carries --entwurf-control, NO --no-extensions, -p + prompt final,
+ *      plan.launchArgs (--approve), the ext args, provider/model, and the header cwd.
+ *   3. awaitSocketAlive: connectable → resolve; forged (symlink) → reject WITHOUT connecting
+ *      (probe never called); dead → wait one interval, re-poll → alive resolves; abort
+ *      during the wait → reject.
+ *   4. awaitChildExit: a child 'exit' resolves the code (null on signal); abort rejects and
+ *      removes the exit listener (no leak).
+ *   5. awaitTimeout: schedules via the injected timer; abort clears it and rejects.
+ *   6. killChild: SIGTERM on the shared proc.
+ *   7. releaseLock: delegates to the injected release fn.
+ *   8. mis-wire: a child with no `proc` (not one we spawned) fails loud in killChild /
+ *      awaitChildExit.
+ *
+ * All IO is injected; a controllable scheduler makes the timer/poll paths deterministic.
+ */
+
+import assert from "node:assert/strict";
+import type { LockClaim } from "../pi-extensions/lib/entwurf-v2-lock.ts";
+import {
+	isV2ResumeResidentAuthorized,
+	V2_RESUME_RESIDENT_SESSION_ENV,
+} from "../pi-extensions/lib/entwurf-v2-resume-marker.ts";
+import type { SpawnBgPlan, SpawnBgResumeDeps, SpawnedChild } from "../pi-extensions/lib/entwurf-v2-spawn.ts";
+import {
+	type LaunchIdentity,
+	makeProductionSpawnBgResumeDeps,
+	type ProductionSpawnOpts,
+	type SpawnedProcHandle,
+	socketWatchVerdict,
+} from "../pi-extensions/lib/entwurf-v2-spawn-production.ts";
+import type { LstatLike } from "../pi-extensions/lib/socket-discovery.ts";
+import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const GID = "20260613T091000-98363c";
+const SOCK = `/fake/entwurf-control/${GID}.sock`;
+const flush = (): Promise<void> => new Promise((res) => setImmediate(res));
+
+const IDENTITY: LaunchIdentity = {
+	cwd: "/home/test/repo",
+	explicitExtensionArgs: ["-e", "/path/to/entwurf/index.ts"],
+	provider: "entwurf",
+	model: "claude-opus-4-8",
+};
+
+// True if `p` has NOT settled after a macrotask tick (all pending microtasks drained).
+// Attaches a settled-handler (so a later rejection is never unhandled), then checks.
+async function notSettled(p: Promise<unknown>): Promise<boolean> {
+	let settled = false;
+	void p.then(
+		() => {
+			settled = true;
+		},
+		() => {
+			settled = true;
+		},
+	);
+	await flush();
+	return !settled;
+}
+
+function spawnBgPlan(): SpawnBgPlan {
+	return {
+		transport: "spawn-bg",
+		action: "resume",
+		targetGardenId: GID,
+		sessionId: GID,
+		cwd: "/home/test/repo",
+		prompt: "continue the task",
+		launchArgs: ["--approve"],
+		expectedSocketPath: SOCK,
+		observeTimeoutMs: 30_000,
+		releaseWhen: "socket-alive-or-child-exited",
+	};
+}
+
+function lockClaim(): LockClaim {
+	return {
+		gardenId: GID,
+		pid: 4242,
+		hostname: "test-host",
+		createdAt: "2026-06-13T00:00:00.000Z",
+		nonce: "deadbeefcafef00d",
+		owner: "entwurf_v2",
+		lockPath: `/fake/locks/${GID}.lock`,
+	};
+}
+
+// A controllable scheduler: setTimeoutFn captures callbacks; the gate fires them by hand.
+function makeScheduler() {
+	let nextId = 1;
+	const timers = new Map<number, () => void>();
+	return {
+		setTimeoutFn: ((cb: () => void, _ms: number) => {
+			const id = nextId++;
+			timers.set(id, cb);
+			return id as unknown as ReturnType<typeof setTimeout>;
+		}) as (cb: () => void, ms: number) => ReturnType<typeof setTimeout>,
+		clearTimeoutFn: ((t: ReturnType<typeof setTimeout>) => {
+			timers.delete(t as unknown as number);
+		}) as (t: ReturnType<typeof setTimeout>) => void,
+		fireNext: (): void => {
+			const first = [...timers.entries()][0];
+			if (first) {
+				timers.delete(first[0]);
+				first[1]();
+			}
+		},
+		pending: (): number => timers.size,
+	};
+}
+
+// A fake proc handle (EventEmitter-lite) recording kills and listener churn.
+function fakeProc() {
+	const listeners = new Map<string, Set<(...a: unknown[]) => void>>();
+	const calls = { kills: [] as string[] };
+	const proc: SpawnedProcHandle = {
+		pid: 9191,
+		kill: (sig) => {
+			calls.kills.push(String(sig));
+			return true;
+		},
+		on: (ev, l) => {
+			let set = listeners.get(ev);
+			if (!set) {
+				set = new Set();
+				listeners.set(ev, set);
+			}
+			set.add(l);
+			return proc;
+		},
+		removeListener: (ev, l) => {
+			listeners.get(ev)?.delete(l);
+			return proc;
+		},
+	};
+	return {
+		proc,
+		calls,
+		emit: (ev: string, ...args: unknown[]): void => {
+			for (const l of [...(listeners.get(ev) ?? [])]) l(...args);
+		},
+		listenerCount: (ev: string): number => listeners.get(ev)?.size ?? 0,
+	};
+}
+
+function statLike(kind: "socket" | "symlink" | "other"): LstatLike {
+	return {
+		isSymbolicLink: () => kind === "symlink",
+		isSocket: () => kind === "socket",
+	};
+}
+
+// Spawn a child through the factory (so it carries the eager exitPromise), driving the
+// 'spawn' event so spawnChild resolves. Returns the deps + the started child.
+async function spawnedChild(
+	fp: ReturnType<typeof fakeProc>,
+	opts: ProductionSpawnOpts = {},
+): Promise<{ deps: SpawnBgResumeDeps; child: SpawnedChild }> {
+	const deps = makeProductionSpawnBgResumeDeps({ resolveIdentity: () => IDENTITY, spawnChild: () => fp.proc, ...opts });
+	const p = deps.spawnChild(spawnBgPlan());
+	await flush();
+	fp.emit("spawn");
+	const child = await p;
+	return { deps, child };
+}
+
+async function main(): Promise<void> {
+	// ── 1. socketWatchVerdict (pure R2 policy) ───────────────────────────────────────
+	ok("1 verdict: address-conflict → forged", socketWatchVerdict({ addressConflict: true }) === "forged");
+	ok("1 verdict: alive → alive", socketWatchVerdict({ liveness: "alive", socketPath: SOCK }) === "alive");
+	ok("1 verdict: dead → wait", socketWatchVerdict({ liveness: "dead", socketPath: SOCK }) === "wait");
+	ok("1 verdict: indeterminate → wait", socketWatchVerdict({ liveness: "indeterminate", socketPath: SOCK }) === "wait");
+
+	// ── 2. spawnChild builds the v2-control argv, then WAITS for the 'spawn' event (B1) ─
+	{
+		// A holder (not a closure-assigned `let`) so flow analysis sees the capture.
+		const cap: { value: { cmd: string; args: readonly string[]; cwd: string; env: NodeJS.ProcessEnv } | null } = {
+			value: null,
+		};
+		const fp = fakeProc();
+		const deps = makeProductionSpawnBgResumeDeps({
+			resolveIdentity: () => IDENTITY,
+			spawnChild: (cmd, args, cwd, env) => {
+				cap.value = { cmd, args, cwd, env };
+				return fp.proc;
+			},
+		});
+		const childP = deps.spawnChild(spawnBgPlan());
+		await flush(); // spawnChild has installed exit+spawn+error listeners and is awaiting 'spawn'
+		ok("2 spawnChild does NOT resolve before the 'spawn' event (B1)", await notSettled(childP));
+		fp.emit("spawn"); // a real start is confirmed → spawnChild resolves
+		const child = await childP;
+		ok("2 child carries pid from proc", child.pid === 9191);
+		const captured = cap.value;
+		assert.ok(captured, "spawnChild invoked the injected spawnFn");
+		const args = captured.args;
+		ok("2 spawns the pi binary", captured.cmd === "pi");
+		ok("2 cwd = header authority", captured.cwd === "/home/test/repo");
+		ok("2 argv has --entwurf-control", args.includes("--entwurf-control"));
+		ok("2 argv has NO --no-extensions", !args.includes("--no-extensions"));
+		ok("2 argv keeps -p", args.includes("-p"));
+		ok("2 argv prompt is final positional", args[args.length - 1] === "continue the task");
+		ok("2 argv carries plan.launchArgs (--approve)", args.includes("--approve"));
+		ok("2 argv carries the ext args", args.includes("-e"));
+		ok("2 argv carries provider", args[args.indexOf("--provider") + 1] === "entwurf");
+		ok("2 argv carries model", args[args.indexOf("--model") + 1] === "claude-opus-4-8");
+		ok("2 argv carries session-id", args[args.indexOf("--session-id") + 1] === GID);
+		// the sessionId-bound authorization marker is planted on the child env so the resumed
+		// `--entwurf-control` resident is an AUTHORIZED Entwurf child (entwurf-control.ts guard),
+		// not a "corrupt resident session name" crash. Bound to plan.sessionId exactly.
+		ok(
+			"2 child env carries the v2 resume resident marker = sessionId",
+			captured.env[V2_RESUME_RESIDENT_SESSION_ENV] === GID,
+		);
+	}
+
+	// ── 2b. B1: an 'error' before 'spawn' (ENOENT pi / exec failure) → spawnChild REJECTS ─
+	// so the watcher turns it into spawn-start-failed (release), not a stalled spawn-started.
+	{
+		const fp = fakeProc();
+		const deps = makeProductionSpawnBgResumeDeps({ resolveIdentity: () => IDENTITY, spawnChild: () => fp.proc });
+		const childP = deps.spawnChild(spawnBgPlan());
+		await flush();
+		fp.emit("error", new Error("ENOENT: pi not found"));
+		let threw = false;
+		try {
+			await childP;
+		} catch (e) {
+			threw = e instanceof Error && e.message.includes("ENOENT");
+		}
+		ok("2b spawn-time 'error' before 'spawn' → spawnChild rejects", threw);
+	}
+
+	// ── 3. awaitSocketAlive: connectable resolves; forged rejects without connecting ──
+	{
+		// connectable: socket-file + probe alive → resolve, probe called once.
+		let probes = 0;
+		const deps = makeProductionSpawnBgResumeDeps({
+			lstatFn: async () => statLike("socket"),
+			probeFn: async () => {
+				probes++;
+				return "alive";
+			},
+		});
+		await deps.awaitSocketAlive(SOCK, new AbortController().signal);
+		ok("3 connectable socket resolves", true);
+		ok("3 connectable probed once", probes === 1);
+	}
+	{
+		// forged: a symlink is an address-conflict — reject WITHOUT ever connecting.
+		let probes = 0;
+		const deps = makeProductionSpawnBgResumeDeps({
+			lstatFn: async () => statLike("symlink"),
+			probeFn: async () => {
+				probes++;
+				return "alive";
+			},
+		});
+		let threw = false;
+		try {
+			await deps.awaitSocketAlive(SOCK, new AbortController().signal);
+		} catch (e) {
+			threw = e instanceof Error && e.message.includes("forged");
+		}
+		ok("3 forged (symlink) rejects", threw);
+		ok("3 forged never connects (probe not called)", probes === 0);
+	}
+	{
+		// dead → wait one interval → re-poll alive resolves. The scheduler fires the sleep.
+		const sched = makeScheduler();
+		const seq: SocketLiveness[] = ["dead", "alive"];
+		let i = 0;
+		const deps = makeProductionSpawnBgResumeDeps({
+			lstatFn: async () => statLike("socket"),
+			probeFn: async () => seq[i++] ?? "alive",
+			setTimeoutFn: sched.setTimeoutFn,
+			clearTimeoutFn: sched.clearTimeoutFn,
+		});
+		const p = deps.awaitSocketAlive(SOCK, new AbortController().signal);
+		await flush(); // poll 1 (dead) → schedules the inter-poll sleep
+		ok("3 dead → waits (a sleep is scheduled)", sched.pending() === 1);
+		sched.fireNext(); // sleep elapses → poll 2 (alive)
+		await p;
+		ok("3 dead → wait → alive resolves", true);
+	}
+	{
+		// abort during the wait → reject, scheduled sleep cleared.
+		const sched = makeScheduler();
+		const ctrl = new AbortController();
+		const deps = makeProductionSpawnBgResumeDeps({
+			lstatFn: async () => statLike("socket"),
+			probeFn: async () => "dead",
+			setTimeoutFn: sched.setTimeoutFn,
+			clearTimeoutFn: sched.clearTimeoutFn,
+		});
+		const p = deps.awaitSocketAlive(SOCK, ctrl.signal);
+		await flush(); // poll 1 (dead) → sleeping
+		ctrl.abort();
+		let threw = false;
+		try {
+			await p;
+		} catch {
+			threw = true;
+		}
+		ok("3 abort during wait → rejects", threw);
+		ok("3 abort clears the scheduled sleep", sched.pending() === 0);
+	}
+
+	// ── 4. awaitChildExit reads the EAGER exitPromise (installed at spawn) ────────────
+	{
+		// 4a: exit AFTER awaitChildExit is waiting → resolves the code.
+		const fp = fakeProc();
+		const { deps, child } = await spawnedChild(fp);
+		const p = deps.awaitChildExit(child, new AbortController().signal);
+		fp.emit("exit", 137);
+		ok("4 exit resolves the code", (await p) === 137);
+	}
+	{
+		// 4b: abort → rejects.
+		const fp = fakeProc();
+		const { deps, child } = await spawnedChild(fp);
+		const ctrl = new AbortController();
+		const p = deps.awaitChildExit(child, ctrl.signal);
+		await flush();
+		ctrl.abort();
+		let threw = false;
+		try {
+			await p;
+		} catch {
+			threw = true;
+		}
+		ok("4 abort → rejects", threw);
+	}
+	{
+		// 4c: a signal kill (null code) → null.
+		const fp = fakeProc();
+		const { deps, child } = await spawnedChild(fp);
+		const p = deps.awaitChildExit(child, new AbortController().signal);
+		fp.emit("exit", null);
+		ok("4 signal exit → null code", (await p) === null);
+	}
+	{
+		// 4d (B2): the child exits BEFORE awaitChildExit is even called. The eager exitPromise
+		// captured it at spawn, so awaitChildExit resolves immediately — it does NOT hang into a
+		// timeout→kill→wrongful-retained.
+		const fp = fakeProc();
+		const { deps, child } = await spawnedChild(fp);
+		fp.emit("exit", 0); // exit in the gap, before awaitChildExit
+		const code = await deps.awaitChildExit(child, new AbortController().signal);
+		ok("4d B2: fast exit before awaitChildExit is NOT missed", code === 0);
+	}
+
+	// ── 5. awaitTimeout: schedules; abort clears + rejects ───────────────────────────
+	{
+		const sched = makeScheduler();
+		const ctrl = new AbortController();
+		const deps = makeProductionSpawnBgResumeDeps({
+			setTimeoutFn: sched.setTimeoutFn,
+			clearTimeoutFn: sched.clearTimeoutFn,
+		});
+		const p = deps.awaitTimeout(30_000, ctrl.signal);
+		await flush();
+		ok("5 awaitTimeout schedules a timer", sched.pending() === 1);
+		// fire it → resolves
+		sched.fireNext();
+		await p;
+		ok("5 awaitTimeout resolves when fired", true);
+
+		// abort path clears the timer.
+		const sched2 = makeScheduler();
+		const ctrl2 = new AbortController();
+		const deps2 = makeProductionSpawnBgResumeDeps({
+			setTimeoutFn: sched2.setTimeoutFn,
+			clearTimeoutFn: sched2.clearTimeoutFn,
+		});
+		const q = deps2.awaitTimeout(30_000, ctrl2.signal);
+		await flush();
+		ctrl2.abort();
+		let threw = false;
+		try {
+			await q;
+		} catch {
+			threw = true;
+		}
+		ok("5 abort → awaitTimeout rejects", threw);
+		ok("5 abort clears the timer", sched2.pending() === 0);
+	}
+
+	// ── 6 & 7. killChild SIGTERM; releaseLock delegates ──────────────────────────────
+	{
+		const fp = fakeProc();
+		const holder: { released: LockClaim | null } = { released: null };
+		const { deps, child } = await spawnedChild(fp, { releaseFn: (lock) => (holder.released = lock) });
+		deps.killChild(child);
+		ok("6 killChild sends SIGTERM", fp.calls.kills.length === 1 && fp.calls.kills[0] === "SIGTERM");
+		const lock = lockClaim();
+		deps.releaseLock(lock);
+		ok("7 releaseLock delegates to the injected release fn", holder.released === lock);
+	}
+
+	// ── 8. mis-wire: a child with no proc fails loud ─────────────────────────────────
+	{
+		const deps = makeProductionSpawnBgResumeDeps({});
+		let killThrew = false;
+		try {
+			deps.killChild({ pid: 1 });
+		} catch (e) {
+			killThrew = e instanceof Error && e.message.includes("no proc");
+		}
+		ok("8 killChild on a proc-less child fails loud", killThrew);
+
+		let exitThrew = false;
+		try {
+			await deps.awaitChildExit({ pid: 1 }, new AbortController().signal);
+		} catch (e) {
+			exitThrew = e instanceof Error && e.message.includes("no proc");
+		}
+		ok("8 awaitChildExit on a proc-less child fails loud", exitThrew);
+	}
+	ok(
+		"9 exact sessionId marker → authorized",
+		isV2ResumeResidentAuthorized(GID, { [V2_RESUME_RESIDENT_SESSION_ENV]: GID }),
+	);
+	ok("9 absent marker → NOT authorized", !isV2ResumeResidentAuthorized(GID, {}));
+	ok(
+		"9 wrong-session marker → NOT authorized (binding is to the exact id)",
+		!isV2ResumeResidentAuthorized(GID, { [V2_RESUME_RESIDENT_SESSION_ENV]: "20260101T000000-000000" }),
+	);
+
+	console.log(`\ncheck-entwurf-v2-spawn-production: ${passed} checks passed`);
+}
+
+main().catch((err) => {
+	console.error(err);
+	process.exit(1);
+});