@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.0

package/packages/core/self-dogfood-version.js

@@ -25,42 +25,61 @@ function parseAlphaRef(ref) {
   return Number(match[1]);
 }
 
-export function resolveSelfDogfoodMajor({
+function isExactSha(value) {
+  return /^[0-9a-f]{40}$/u.test(String(value || ""));
+}
+
+export function hasQualifiedSelfDogfoodBootstrapAuthority({
   packageVersion,
   alphaRef,
-  majorBootstrap = false,
+  authority,
 } = {}) {
   const version = parsePackageVersion(packageVersion);
   const acceptedMajor = parseAlphaRef(alphaRef);
-  if (acceptedMajor === version.major) {
-    return {
-      packageMajor: version.major,
-      workflowMajor: acceptedMajor,
-      bootstrap: false,
-    };
-  }
-
-  const stableBootstrap =
-    version.minor === 0 && version.patch === 0 && version.alpha === undefined;
-  const nextAlphaBootstrap =
-    version.minor === 0 && version.patch === 1 && version.alpha !== undefined;
-  if (
-    majorBootstrap === true &&
+  const releaseLine = authority?.releaseLine;
+  const qualification = authority?.qualification;
+  return (
     acceptedMajor + 1 === version.major &&
-    (stableBootstrap || nextAlphaBootstrap)
-  ) {
-    return {
-      packageMajor: version.major,
-      workflowMajor: acceptedMajor,
-      bootstrap: true,
-    };
-  }
-
-  throw new Error(
-    "Buildchain self-dogfood alpha lock must target the current major alpha ref",
+    authority?.contract ===
+      `kungfu-buildchain-v${version.major}-bootstrap-authority` &&
+    releaseLine?.candidateBranch ===
+      `dev/v${version.major}/v${version.major}.0` &&
+    String(releaseLine?.sourceBranch || "").startsWith(
+      `dev/v${acceptedMajor}/v${acceptedMajor}.`,
+    ) &&
+    releaseLine?.status === `qualified-protected-v${version.major}-bootstrap` &&
+    isExactSha(releaseLine?.sourceCommit) &&
+    isExactSha(releaseLine?.bootstrapCommit) &&
+    qualification?.contract ===
+      `kungfu-buildchain-v${version.major}-n-minus-one-qualification` &&
+    qualification?.authorityRevision === releaseLine.sourceCommit &&
+    qualification?.candidateRevision === releaseLine.bootstrapCommit &&
+    qualification?.candidateSelfQualified === false &&
+    qualification?.activeExceptions === 0 &&
+    /^sha256:[0-9a-f]{64}$/u.test(
+      String(qualification?.qualificationRoot || ""),
+    )
   );
 }
 
+export function resolveSelfDogfoodMajor({
+  packageVersion,
+  alphaRef,
+} = {}) {
+  const version = parsePackageVersion(packageVersion);
+  const acceptedMajor = parseAlphaRef(alphaRef);
+  if (acceptedMajor !== version.major) {
+    throw new Error(
+      "Buildchain self-dogfood alpha lock must target the current major alpha ref",
+    );
+  }
+  return {
+    packageMajor: version.major,
+    workflowMajor: acceptedMajor,
+    bootstrap: false,
+  };
+}
+
 export function contractForSelfDogfoodEvaluation({
   currentContract,
   majorResolution,
@@ -68,18 +87,12 @@ export function contractForSelfDogfoodEvaluation({
   if (!currentContract || typeof currentContract !== "object") {
     throw new Error("Buildchain self-dogfood requires a current contract");
   }
-  if (!majorResolution?.bootstrap) {
-    return currentContract;
-  }
-  return {
-    ...currentContract,
-    majorLine: `v${majorResolution.workflowMajor}`,
-  };
+  return currentContract;
 }
 
 export function canAdmitSelfDogfoodLockEvaluation({
   evaluation,
   majorResolution,
 } = {}) {
-  return evaluation?.compatible === true || majorResolution?.bootstrap === true;
+  return evaluation?.compatible === true;
 }

package/packages/core/spawn-command.js

@@ -1,16 +1,66 @@
-import { spawnSync } from "node:child_process";
+import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const WINDOWS_CMD_SHIMS = new Set(["corepack", "npm", "npx", "pnpm", "yarn"]);
+const CMD_META_CHARACTERS = /([()\][%!^`"<>&|;, *?])/g;
+const INTERNAL_PROCESS_TREE_COMMAND = "--buildchain-internal-process-tree-command";
+const TIMEOUT_EXIT_CODE = 124;
+const modulePath = fileURLToPath(import.meta.url);
 
-export function resolveSpawnCommand(command, platform = process.platform) {
-  if (platform !== "win32" || !WINDOWS_CMD_SHIMS.has(command)) {
+function runningStandaloneBundle() {
+  return process.argv[1] && process.argv[2] !== INTERNAL_PROCESS_TREE_COMMAND
+    && import.meta.url === pathToFileURL(process.argv[1]).href;
+}
+
+function pathCommandShim(command, env) {
+  for (const directory of String(env.PATH || "").split(";")) {
+    const candidate = path.join(directory, `${command}.cmd`);
+    if (directory && fs.existsSync(candidate)) return true;
+  }
+  return false;
+}
+
+export function resolveSpawnCommand(command, platform = process.platform, env = process.env) {
+  if (platform !== "win32") {
     return command;
   }
-  return `${command}.cmd`;
+  return pathCommandShim(command, env) || WINDOWS_CMD_SHIMS.has(command)
+    ? `${command}.cmd`
+    : command;
 }
 
-export function usesShellForSpawnCommand(command, platform = process.platform) {
-  return platform === "win32" && WINDOWS_CMD_SHIMS.has(command);
+export function usesShellForSpawnCommand(command, platform = process.platform, env = process.env) {
+  return platform === "win32" && /\.cmd$/i.test(resolveSpawnCommand(command, platform, env));
+}
+
+function cmdEscapeCommand(value) {
+  return String(value).replace(CMD_META_CHARACTERS, "^$1");
+}
+
+function cmdEscapeArgument(value, doubleEscapeMetaCharacters = false) {
+  let text = String(value);
+  text = text.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+  text = text.replace(/(?=(\\+?)?)\1$/g, "$1$1");
+  let escaped = `"${text}"`.replace(CMD_META_CHARACTERS, "^$1");
+  if (doubleEscapeMetaCharacters) {
+    escaped = escaped.replace(CMD_META_CHARACTERS, "^$1");
+  }
+  return escaped;
+}
+
+export function windowsBatchInvocation(command, args, env = process.env) {
+  const shellCommand = [
+    cmdEscapeCommand(command),
+    ...args.map((argument) =>
+      cmdEscapeArgument(argument, /\.cmd$/i.test(command)),
+    ),
+  ].join(" ");
+  return {
+    command: env.ComSpec || env.comspec || process.env.ComSpec || process.env.comspec || "cmd.exe",
+    args: ["/d", "/s", "/c", `"${shellCommand}"`],
+  };
 }
 
 export function spawnSyncCommand(
@@ -19,8 +69,182 @@ export function spawnSyncCommand(
   options = {},
   { platform = process.platform, spawn = spawnSync } = {},
 ) {
-  return spawn(resolveSpawnCommand(command, platform), args, {
+  const env = options.env || process.env;
+  const resolvedCommand = resolveSpawnCommand(command, platform, env);
+  if (
+    platform === "win32" &&
+    /\.cmd$/i.test(resolvedCommand) &&
+    options.shell !== false
+  ) {
+    const invocation = windowsBatchInvocation(resolvedCommand, args, env);
+    return spawn(invocation.command, invocation.args, {
+      ...options,
+      shell: false,
+      windowsVerbatimArguments: true,
+    });
+  }
+  return spawn(resolvedCommand, args, {
     ...options,
-    shell: options.shell ?? usesShellForSpawnCommand(command, platform),
+    shell: options.shell ?? false,
+  });
+}
+
+async function terminateProcessTree(child, graceMs) {
+  if (!child?.pid) return;
+  if (process.platform === "win32") {
+    await new Promise((resolve) => {
+      const killer = spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+        stdio: "ignore",
+        windowsHide: true,
+      });
+      const fallback = setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+          // The process tree may already be gone.
+        }
+        resolve();
+      }, graceMs);
+      killer.once("error", () => {
+        clearTimeout(fallback);
+        try {
+          child.kill("SIGKILL");
+        } catch {
+          // The process tree may already be gone.
+        }
+        resolve();
+      });
+      killer.once("close", () => {
+        clearTimeout(fallback);
+        resolve();
+      });
+    });
+    return;
+  }
+  try {
+    process.kill(-child.pid, "SIGTERM");
+  } catch {
+    return;
+  }
+  await new Promise((resolve) => setTimeout(resolve, graceMs));
+  try {
+    process.kill(-child.pid, "SIGKILL");
+  } catch {
+    // The process group exited during the grace period.
+  }
+}
+
+async function runInternalProcessTreeCommand() {
+  const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+  const child = spawn(payload.command, payload.args, {
+    cwd: payload.cwd,
+    env: process.env,
+    detached: process.platform !== "win32",
+    stdio: ["ignore", "inherit", "inherit"],
+    windowsHide: true,
+    windowsVerbatimArguments: payload.windowsVerbatimArguments === true,
+  });
+  let timedOut = false;
+  let spawnError;
+  const closed = new Promise((resolve) => {
+    child.once("error", (error) => {
+      spawnError = error;
+      resolve({ code: 1, signal: "" });
+    });
+    child.once("close", (code, signal) => resolve({ code, signal }));
+  });
+  const timer = Number.isFinite(payload.timeoutMs) && payload.timeoutMs > 0
+    ? setTimeout(() => {
+      timedOut = true;
+      void terminateProcessTree(child, payload.graceMs);
+    }, payload.timeoutMs)
+    : undefined;
+  const result = await closed;
+  if (timer) clearTimeout(timer);
+  process.exitCode = timedOut
+    ? TIMEOUT_EXIT_CODE
+    : spawnError || result.signal
+      ? 1
+      : (result.code ?? 1);
+}
+
+function shellCommandInvocation(command, shell) {
+  if (typeof shell === "string" && shell.trim()) {
+    return { command: shell, args: ["-c", command] };
+  }
+  if (process.platform === "win32") {
+    return {
+      command: process.env.ComSpec || process.env.comspec || "cmd.exe",
+      args: ["/d", "/s", "/c", `"${command}"`],
+      windowsVerbatimArguments: true,
+    };
+  }
+  return { command: process.env.SHELL || "/bin/sh", args: ["-c", command] };
+}
+
+function standaloneProcessCommand(command, args, options) {
+  const result = spawnSync(command, args, { ...options, windowsHide: true });
+  if (result.error) throw result.error;
+  if (result.status !== 0 || result.signal) {
+    const error = new Error(`process tree command failed with status ${result.status ?? ""}`);
+    error.status = result.status ?? 1;
+    error.signal = result.signal || "";
+    throw error;
+  }
+  return result.stdout;
+}
+
+export function runProcessTreeCommandSync(command, args, {
+  cwd = process.cwd(),
+  env = process.env,
+  stdio = "inherit",
+  timeout,
+  graceMs = 2000,
+  windowsVerbatimArguments = false,
+} = {}) {
+  if (runningStandaloneBundle()) {
+    return standaloneProcessCommand(command, args, { cwd, env, stdio, timeout });
+  }
+  const commandStdio = Array.isArray(stdio)
+    ? ["pipe", stdio[1] || "inherit", stdio[2] || "inherit"]
+    : ["pipe", stdio, stdio];
+  try {
+    return execFileSync(process.execPath, [modulePath, INTERNAL_PROCESS_TREE_COMMAND], {
+      cwd,
+      env,
+      stdio: commandStdio,
+      input: JSON.stringify({
+        command,
+        args,
+        cwd,
+        timeoutMs: timeout,
+        graceMs,
+        windowsVerbatimArguments,
+      }),
+      windowsHide: true,
+    });
+  } catch (error) {
+    if (error?.status === TIMEOUT_EXIT_CODE) error.code = "ETIMEDOUT";
+    throw error;
+  }
+}
+
+export function runShellCommandSync(command, options = {}) {
+  if (runningStandaloneBundle()) return execSync(command, options);
+  const invocation = shellCommandInvocation(command, options.shell);
+  return runProcessTreeCommandSync(invocation.command, invocation.args, {
+    ...options,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+}
+
+if (
+  process.argv[1]
+  && process.argv[2] === INTERNAL_PROCESS_TREE_COMMAND
+  && import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  void runInternalProcessTreeCommand().catch((error) => {
+    console.error(`buildchain: process tree command failed: ${error.message}`);
+    process.exitCode = 1;
   });
 }

package/packages/core/v4-adopter-delivery-parity.js

@@ -0,0 +1,219 @@
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  adopterDeliveryGateDigest,
+  createAdopterDeliveryGate,
+} from "./adopter-delivery-gate.js";
+
+export const V4_ADOPTER_DELIVERY_PARITY_INPUT_CONTRACT =
+  "kungfu-buildchain-v4-adopter-delivery-parity-input";
+export const V4_ADOPTER_DELIVERY_PARITY_PROJECTION_CONTRACT =
+  "buildchain-v4-adopter-delivery-parity-projection/v1";
+
+const HOST_REQUEST_CONTRACT = "kungfu-buildchain-v4-host-request";
+const HOST_RESPONSE_CONTRACT = "kungfu-buildchain-v4-host-response";
+const DRIVER_INTERFACE = "kungfu-buildchain-adopter-protocol-driver/v1";
+const PROFILE_INTERFACE = "kungfu-buildchain-adopter-artifact-profile/v1";
+const REQUIRED_CAPABILITIES = Object.freeze([
+  "canonical-input-v1",
+  "adopter-delivery-parity-projection-v1",
+  "diagnostics-v1",
+  "effects-disabled-v1",
+  "structured-result-v1",
+]);
+const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../..",
+);
+
+export const V4_ADOPTER_DELIVERY_PARITY_SOURCE = Object.freeze({
+  v3Commit: "c3f58d76391c1c6ceddfc900a68e91c7ab82a575",
+  vectorSuiteRoot:
+    "sha256:cf329805d928a9883cbafbdfdf21ef66c6a0889ed8dfe14356b4e0d25d6738f9",
+  kfdPackage: "@kungfu-tech/kfd@1.0.0-alpha.62",
+});
+
+function clone(value) {
+  return structuredClone(value);
+}
+
+function exactKey(definition) {
+  return `${definition.id}@${definition.version}`;
+}
+
+function capture(operation) {
+  try {
+    return { state: "returned", result: clone(operation()) };
+  } catch {
+    return { state: "threw", result: null };
+  }
+}
+
+function definition(definition, execution, { profile = false } = {}) {
+  if (!definition) return null;
+  return {
+    interface: definition.interface,
+    id: definition.id,
+    version: definition.version,
+    ...(profile ? { kinds: [...definition.kinds] } : {}),
+    execution,
+  };
+}
+
+export function createV4AdopterDeliveryParityInput({
+  vectorId,
+  request,
+  context = {},
+  drivers = [],
+  artifactProfiles = [],
+  sourceAuthority = V4_ADOPTER_DELIVERY_PARITY_SOURCE,
+} = {}) {
+  if (typeof vectorId !== "string" || vectorId.length === 0) {
+    throw new TypeError("vectorId must be a non-empty string");
+  }
+  const gate = createAdopterDeliveryGate({ drivers, artifactProfiles });
+  const expectedResult = gate.evaluate(clone(request), clone(context));
+  const driver = drivers.find(
+    (entry) =>
+      exactKey(entry) === `${request.protocol.id}@${request.protocol.version}`,
+  );
+  const artifactProfile = artifactProfiles.find(
+    (entry) =>
+      exactKey(entry) ===
+      `${request.artifactProfile.id}@${request.artifactProfile.version}`,
+  );
+  let profileExecution = null;
+  if (artifactProfile?.kinds.includes(request.artifact.kind)) {
+    profileExecution = capture(() =>
+      artifactProfile.verify(clone(request.artifact)),
+    );
+  }
+  let driverExecution = null;
+  if (
+    driver &&
+    profileExecution?.state === "returned" &&
+    profileExecution.result?.valid === true
+  ) {
+    driverExecution = capture(() =>
+      driver.verify({ request: clone(request), context: clone(context) }),
+    );
+  }
+  return {
+    schemaVersion: 1,
+    contract: V4_ADOPTER_DELIVERY_PARITY_INPUT_CONTRACT,
+    vectorId,
+    sourceAuthority: clone(sourceAuthority),
+    request: clone(request),
+    driver: definition(driver, driverExecution),
+    artifactProfile: definition(artifactProfile, profileExecution, {
+      profile: true,
+    }),
+    expectedResult,
+  };
+}
+
+function hostRequest(input, timeoutMs) {
+  return {
+    schemaVersion: 1,
+    contract: HOST_REQUEST_CONTRACT,
+    protocolVersion: "1.0",
+    requestId: crypto.randomUUID(),
+    command: { id: "adopter-delivery.parity-project", arguments: [] },
+    input: {
+      encoding: "base64",
+      bytes: Buffer.from(JSON.stringify(input), "utf8").toString("base64"),
+    },
+    requiredCapabilities: [...REQUIRED_CAPABILITIES],
+    timeoutMs,
+  };
+}
+
+export function runV4AdopterDeliveryParity(
+  input,
+  {
+    command = process.platform === "win32" ? "cargo.exe" : "cargo",
+    arguments: commandArguments = [
+      "run",
+      "--locked",
+      "--quiet",
+      "--manifest-path",
+      "crates/buildchain-v4-contracts/Cargo.toml",
+      "--",
+      "host",
+    ],
+    cwd = root,
+    timeoutMs = 30_000,
+  } = {},
+) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000) {
+    throw new RangeError("timeoutMs must be between 1 and 30000");
+  }
+  const request = hostRequest(input, timeoutMs);
+  const completed = spawnSync(command, commandArguments, {
+    cwd,
+    input: JSON.stringify(request),
+    encoding: "utf8",
+    timeout: timeoutMs,
+    maxBuffer: MAX_RESPONSE_BYTES,
+    env: process.env,
+  });
+  if (completed.error) {
+    throw new Error(
+      `v4 adopter delivery parity host failed: ${completed.error.message}`,
+    );
+  }
+  if (completed.status !== 0) {
+    throw new Error(
+      `v4 adopter delivery parity host exited ${completed.status}: ${completed.stderr.trim()}`,
+    );
+  }
+  let response;
+  try {
+    response = JSON.parse(completed.stdout);
+  } catch {
+    throw new Error("v4 adopter delivery parity host returned invalid JSON");
+  }
+  if (
+    response.schemaVersion !== 1 ||
+    response.contract !== HOST_RESPONSE_CONTRACT ||
+    response.protocolVersion !== "1.0" ||
+    response.requestId !== request.requestId ||
+    response.command?.id !== request.command.id ||
+    response.status !== "ok"
+  ) {
+    const code = response.diagnostics?.[0]?.code || "invalid-response";
+    throw new Error(`v4 adopter delivery parity failed closed: ${code}`);
+  }
+  const projection = response.structuredResult;
+  if (
+    projection?.schema !== V4_ADOPTER_DELIVERY_PARITY_PROJECTION_CONTRACT ||
+    projection.effectMode !== "disabled" ||
+    projection.vectorId !== input.vectorId ||
+    !/^sha256:[0-9a-f]{64}$/u.test(projection.projectionRoot || "")
+  ) {
+    throw new Error("v4 adopter delivery parity projection is invalid");
+  }
+  return projection;
+}
+
+export function assertV4AdopterDeliveryParity(input, options = {}) {
+  const projection = runV4AdopterDeliveryParity(input, options);
+  if (
+    adopterDeliveryGateDigest(projection.result) !==
+    adopterDeliveryGateDigest(input.expectedResult)
+  ) {
+    throw new Error(
+      "v4 adopter delivery parity result differs from v3 authority",
+    );
+  }
+  return projection;
+}
+
+export const V4_ADOPTER_DELIVERY_PARITY_INTERFACES = Object.freeze({
+  driver: DRIVER_INTERFACE,
+  artifactProfile: PROFILE_INTERFACE,
+});