@markstanden/opencode-test-container 0.0.0-stage → 0.1.1

package/dist/campaign/primary.js

@@ -0,0 +1,189 @@
+/**
+ * Product-supplied primary-check execution.
+ *
+ * A checker is trusted product data staged during preparation. It runs after
+ * the trial in its own container, with the completed workspace and the
+ * pristine workspace mounted read-only and no provider environment. Its
+ * source is never mounted into the trial, so expectations cannot leak to the
+ * subject.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { sha256Bytes } from "../contracts/canonical.js";
+import { normaliseMounts, runContainer, } from "../adapters/podman/container.js";
+/** The container-side checker paths. */
+export const CONTAINER_CHECKER = "/checker";
+/** The container-side completed workspace. */
+export const CONTAINER_CHECKER_LIVE = "/live";
+/** The container-side pristine workspace. */
+export const CONTAINER_CHECKER_PRISTINE = "/pristine";
+/** Classify one completed checker process. */
+function statusOf(result) {
+    if (result.timedOut)
+        return "timeout";
+    if (result.error !== null || result.status === null)
+        return "error";
+    return result.status === 0 ? "pass" : "fail";
+}
+/** Write the checker's minimal environment file. */
+function writeCheckerEnvironment(directory) {
+    mkdirSync(directory, { recursive: true });
+    const path = join(directory, "checker.env");
+    writeFileSync(path, [
+        "HOME=/tmp/checker-home",
+        "XDG_DATA_HOME=/tmp/checker-home/.local/share",
+        "XDG_CACHE_HOME=/tmp/checker-home/.cache",
+    ].join("\n") + "\n", { encoding: "utf8", mode: 0o600 });
+    return path;
+}
+/**
+ * The checker plan: no network, no provider variables, no evidence root.
+ * @param options The resolved paths and identity.
+ * @param options.imageId The frozen image.
+ * @param options.checkerDir The staged checker directory.
+ * @param options.script The suite-relative script.
+ * @param options.workspace The completed trial workspace.
+ * @param options.pristine The prepared pristine workspace.
+ * @param options.envFile The 0600 environment file.
+ * @param options.timeoutMs The wall-clock bound.
+ * @returns The validated container plan.
+ */
+export function primaryCheckPlan(options) {
+    return {
+        imageId: options.imageId,
+        mounts: normaliseMounts([
+            {
+                source: options.workspace,
+                target: CONTAINER_CHECKER_LIVE,
+                readOnly: true,
+            },
+            {
+                source: options.pristine,
+                target: CONTAINER_CHECKER_PRISTINE,
+                readOnly: true,
+            },
+            {
+                source: options.checkerDir,
+                target: CONTAINER_CHECKER,
+                readOnly: true,
+            },
+        ]),
+        workdir: "/tmp",
+        network: "none",
+        argv: [
+            "node",
+            `${CONTAINER_CHECKER}/${options.script}`,
+            CONTAINER_CHECKER_LIVE,
+            CONTAINER_CHECKER_PRISTINE,
+        ],
+        envNames: ["HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME"],
+        envFile: options.envFile,
+        timeoutMs: options.timeoutMs,
+    };
+}
+/**
+ * Run one product primary check against a completed trial.
+ * @param options The case, prepared identities and trial directory.
+ * @param options.root The campaign root.
+ * @param options.testCase The docs case with a declared checker.
+ * @param options.prepared The prepared case record.
+ * @param options.trialDir The trial evidence directory.
+ * @param options.workspace The completed trial workspace.
+ * @param options.imageId The frozen image identity.
+ * @param options.run Process adapter, injected for tests.
+ * @param options.now Injected clock.
+ * @returns The recorded outcome and the readable record.
+ */
+export async function executePrimaryCheck(options) {
+    const spec = options.testCase.primaryCheck;
+    const prepared = options.prepared.primaryCheck;
+    if (spec === undefined || prepared === undefined) {
+        return { ok: true, record: null, problem: null };
+    }
+    const checkerDir = join(options.root, "prepare", prepared.directory);
+    const scriptPath = join(checkerDir, prepared.script);
+    const now = options.now ?? (() => new Date().toISOString());
+    const startedAt = now();
+    const started = Date.now();
+    const base = {
+        schemaVersion: 1,
+        id: prepared.id,
+        script: prepared.script,
+        sourceHash: existsSync(scriptPath)
+            ? sha256Bytes(readFileSync(scriptPath))
+            : "missing",
+        command: "node",
+        args: [
+            `${CONTAINER_CHECKER}/${prepared.script}`,
+            CONTAINER_CHECKER_LIVE,
+            CONTAINER_CHECKER_PRISTINE,
+        ],
+        timeoutMs: prepared.timeoutMs,
+        startedAt,
+    };
+    const finish = (patch) => {
+        const record = {
+            ...base,
+            durationMs: Date.now() - started,
+            ...patch,
+            stdout: patch.stdout.slice(0, 16_000),
+            stderr: patch.stderr.slice(0, 16_000),
+        };
+        writeFileSync(join(options.trialDir, "primary-check.json"), `${JSON.stringify(record, null, 2)}\n`, "utf8");
+        return {
+            ok: record.status === "pass" || record.status === "fail",
+            record,
+            problem: record.status === "timeout" || record.status === "error"
+                ? `primary check ${record.id} ${record.status}: ${record.reason ?? record.stderr.trim()}`
+                : null,
+        };
+    };
+    if (!existsSync(scriptPath)) {
+        return finish({
+            status: "error",
+            exit: null,
+            signal: null,
+            reason: `primary checker ${prepared.script} is missing from the staged payload`,
+            stdout: "",
+            stderr: "",
+        });
+    }
+    const envFile = writeCheckerEnvironment(options.trialDir);
+    const plan = primaryCheckPlan({
+        imageId: options.imageId,
+        checkerDir,
+        script: prepared.script,
+        workspace: options.workspace,
+        pristine: join(options.root, "prepare", "workspaces", options.testCase.caseId),
+        envFile,
+        timeoutMs: prepared.timeoutMs,
+    });
+    const result = await (options.run ?? runContainer)(plan);
+    return finish({
+        status: statusOf(result),
+        exit: result.status,
+        signal: result.signal,
+        reason: result.error,
+        stdout: result.stdout,
+        stderr: result.stderr,
+    });
+}
+/**
+ * Read a recorded primary check without trusting its shape.
+ * @param trialDir The trial evidence directory.
+ * @returns The record, or null when absent or unreadable.
+ */
+export function readPrimaryCheck(trialDir) {
+    const path = join(trialDir, "primary-check.json");
+    if (!existsSync(path))
+        return null;
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return typeof value === "object" && value !== null
+            ? value
+            : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/campaign/run.d.ts

@@ -0,0 +1,151 @@
+import type { ToolIdentity } from "../contracts/version.ts";
+import type { Slot, SuiteCase } from "../contracts/types.ts";
+import { type ContainerPlan } from "../adapters/podman/container.ts";
+import type { CommandResult } from "../adapters/process.ts";
+import { type FrozenRecord } from "./freeze.ts";
+import { type PreparedManifest, type StagedArm } from "./prepare.ts";
+/** The receipt written before any dispatch. */
+export interface LaunchReceipt {
+    /** The schema version value. */
+    schemaVersion: 1;
+    /** The campaign id value. */
+    campaignId: string;
+    /** The slot id value. */
+    slotId: string;
+    /** The case id value. */
+    caseId: string;
+    /** The arm id value. */
+    armId: string;
+    /** The repetition id value. */
+    repetitionId: string;
+    /** The image id value. */
+    imageId: string;
+    /** The prompt sha256 value. */
+    promptSha256: string;
+    /** The config sha256 value. */
+    configSha256: string;
+    /** The started at value. */
+    startedAt: string;
+    /** The argv value. */
+    argv: string[];
+    /** The env names value. */
+    envNames: string[];
+}
+/** The completion record written after the container exits. */
+export interface TrialMeta {
+    /** The schema version value. */
+    schemaVersion: 1;
+    /** The campaign id value. */
+    campaignId: string;
+    /** The slot id value. */
+    slotId: string;
+    /** The case id value. */
+    caseId: string;
+    /** The arm id value. */
+    armId: string;
+    /** The repetition id value. */
+    repetitionId: string;
+    /** The exit value. */
+    exit: number | null;
+    /** The signal value. */
+    signal: string | null;
+    /** The timed out value. */
+    timedOut: boolean;
+    /** The error value. */
+    error: string | null;
+    /** The duration ms value. */
+    durationMs: number;
+    /** The capture valid value. */
+    captureValid: boolean;
+    /** The capture problems value. */
+    captureProblems: string[];
+    /** The text parts value. */
+    textParts: number;
+    /** The last part kind value. */
+    lastPartKind: string | null;
+    /** The parse failures value. */
+    parseFailures: number;
+    /** The events value. */
+    events: number;
+    /** The prompt sha256 value. */
+    promptSha256: string;
+    /** The answer sha256 value. */
+    answerSha256: string;
+    /** The image id value. */
+    imageId: string;
+    /** The completed at value. */
+    completedAt: string;
+}
+/** What one run invocation did. */
+export interface RunSummary {
+    /** The ok value. */
+    ok: boolean;
+    /** The ran value. */
+    ran: string[];
+    /** The refused value. */
+    refused: string[];
+    /** The problems value. */
+    problems: string[];
+}
+/** Dependencies the runner accepts, so ordinary tests need no Podman. */
+export interface RunDeps {
+    /** The run container value. */
+    runContainer?: (plan: ContainerPlan) => Promise<CommandResult>;
+    /** The now value. */
+    now?: () => string;
+    /** The executing tool identity, injected for drift tests. */
+    tool?: ToolIdentity;
+}
+/** Path of one trial's evidence directory. */
+export declare function trialDirectory(root: string, slotId: string): string;
+/**
+ * Build the container plan for one trial without dispatching it. Dry runs and
+ * tests use the same plan the real runner executes.
+ * @param options The resolved trial inputs.
+ * @returns The validated plan, or the problems found while staging.
+ * @param options.root The root value.
+ * @param options.manifest The manifest value.
+ * @param options.frozen The frozen value.
+ * @param options.slot The slot value.
+ * @param options.testCase The testCase value.
+ * @param options.arm The arm value.
+ * @param options.trialDir The trialDir value.
+ * @param options.passthrough The passthrough value.
+ */
+export declare function planTrial(options: {
+    root: string;
+    manifest: PreparedManifest;
+    frozen: FrozenRecord;
+    slot: Slot;
+    testCase: SuiteCase;
+    arm: StagedArm;
+    trialDir: string;
+    passthrough?: readonly string[];
+}): {
+    ok: true;
+    plan: ContainerPlan;
+    argv: string[];
+    configSha256: string;
+} | {
+    ok: false;
+    problems: string[];
+};
+/**
+ * Execute one or more scheduled slots. A launch receipt and ledger event are
+ * written before the container starts, so an interrupted dispatch remains
+ * visibly claimed rather than looking blank.
+ * @param root The frozen campaign root.
+ * @param options Slot selection and dry-run choice.
+ * @param options.slotIds The selected slots.
+ * @param options.dryRun Plan without dispatch.
+ * @param options.passthrough Named environment values to pass through.
+ * @param deps Injected process runner and clock.
+ * @returns What ran and what was refused.
+ */
+export declare function runCampaign(root: string, options?: {
+    slotIds?: readonly string[];
+    dryRun?: boolean;
+    passthrough?: readonly string[];
+}, deps?: RunDeps): Promise<RunSummary>;
+/** The canonical identity of a trial's immutable launch receipt. */
+export declare function launchSha256(launch: LaunchReceipt): string;