@naxodev/apnea 0.1.0 → 0.2.0

package/extension/services/vcs.ts

@@ -1,6 +1,13 @@
-import { spawnSync } from "node:child_process"
+import { spawn, spawnSync, type ChildProcess } from "node:child_process"
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
 import * as path from "node:path"
 import { Context, Effect, Layer } from "effect"
+import {
+  formatVerifyBlock,
+  normalizeVerifySource,
+  type VerifyBlock,
+} from "../domain/verify-commands.ts"
 import { VcsError } from "../errors.ts"
 import type { VcsBackend } from "../domain/types.ts"
 import { FileSystem } from "./file-system.ts"
@@ -27,7 +34,7 @@ export interface VcsService {
   ) => Effect.Effect<void>
   readonly runVerify: (
     root: string,
-    commands: readonly string[],
+    blocks: readonly VerifyBlock[],
     timeoutMs: number,
   ) => Effect.Effect<{ ok: boolean; log: string }>
 }
@@ -52,6 +59,300 @@ function run(
   }
 }
 
+function verificationError(
+  error: unknown,
+  temporaryDirectory?: string,
+): string {
+  const message =
+    error instanceof Error ? `${error.name}: ${error.message}` : String(error)
+  return temporaryDirectory
+    ? message.replaceAll(
+        temporaryDirectory,
+        "[temporary verification directory]",
+      )
+    : message
+}
+
+const VERIFY_LOG_LIMIT = 10 * 1024 * 1024
+const VERIFY_KILL_CLOSE_GRACE_MS = 2_500
+const VERIFY_RESULT_RESERVE = 2_048
+const VERIFY_WRAPPER_SOURCE = `exec 2>&1
+exec "$1" -e "$2"
+`
+const VERIFY_DISPLAY_LIMIT_NOTICE = `verification log limit of ${VERIFY_LOG_LIMIT} bytes would be exceeded by the verification block display; block was not executed`
+const VERIFY_LOG_LIMIT_NOTICE = `verification log limit of ${VERIFY_LOG_LIMIT} bytes reached; output was truncated and verification stopped`
+const VERIFY_LIMIT_NOTICE_RESERVE =
+  1 +
+  Math.max(
+    Buffer.byteLength(VERIFY_DISPLAY_LIMIT_NOTICE),
+    Buffer.byteLength(VERIFY_LOG_LIMIT_NOTICE),
+  )
+
+export function utf8BytesAfterAppend(
+  usedBytes: number,
+  limitBytes: number,
+  text: string,
+): number | null {
+  const nextBytes = usedBytes + Buffer.byteLength(text)
+  return nextBytes <= limitBytes ? nextBytes : null
+}
+
+class VerificationLog {
+  readonly #chunks: string[] = []
+  readonly #contentLimit: number
+  #bytes = 0
+  #limited = false
+
+  constructor(readonly limit: number) {
+    this.#contentLimit = Math.max(0, limit - VERIFY_LIMIT_NOTICE_RESERVE)
+  }
+
+  get remaining(): number {
+    return this.#contentLimit - this.#bytes
+  }
+
+  canAppendBytes(bytes: number): boolean {
+    return bytes <= this.remaining
+  }
+
+  append(text: string): boolean {
+    const nextBytes = utf8BytesAfterAppend(
+      this.#bytes,
+      this.#contentLimit,
+      text,
+    )
+    if (nextBytes === null) return false
+    this.#chunks.push(text)
+    this.#bytes = nextBytes
+    return true
+  }
+
+  addLimitNotice(notice: string): void {
+    if (this.#limited) return
+    this.#limited = true
+    const previous = this.#chunks.at(-1)
+    if (this.#bytes > 0 && !previous?.endsWith("\n")) {
+      this.#chunks.push("\n")
+      this.#bytes += 1
+    }
+    this.#chunks.push(notice)
+    this.#bytes += Buffer.byteLength(notice)
+  }
+
+  toString(): string {
+    return this.#chunks.join("").trimEnd()
+  }
+}
+
+export function verifyBlockDisplayByteLength(block: VerifyBlock): number {
+  const source = block.source
+  const bodyEnd = source.endsWith("\n") ? source.length - 1 : source.length
+  let lineCount = 1
+  for (let index = 0; index < bodyEnd; index++) {
+    if (source.charCodeAt(index) === 10) lineCount += 1
+  }
+  const bodyBytes =
+    Buffer.byteLength(source) - (bodyEnd < source.length ? 1 : 0)
+  return (
+    Buffer.byteLength(`${block.interpreter} -e [verification block]\n`) +
+    bodyBytes +
+    lineCount * 2
+  )
+}
+
+async function taskkillTree(pid: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    let settled = false
+    let killer: ChildProcess
+    const finish = (ok: boolean) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      resolve(ok)
+    }
+
+    try {
+      killer = spawn("taskkill", ["/PID", String(pid), "/T", "/F"], {
+        stdio: "ignore",
+        windowsHide: true,
+      })
+    } catch {
+      resolve(false)
+      return
+    }
+
+    const timer = setTimeout(() => {
+      try {
+        killer.kill("SIGKILL")
+      } catch {
+        // The fallback below still targets the verification child.
+      }
+      finish(false)
+    }, 2_000)
+    killer.once("error", () => finish(false))
+    killer.once("close", (code) => finish(code === 0))
+  })
+}
+
+function snapshotProcessDescendants(rootPid: number): number[] {
+  const snapshot = spawnSync("ps", ["-axo", "pid=,ppid="], {
+    encoding: "utf8",
+    maxBuffer: 10 * 1024 * 1024,
+  })
+  if (snapshot.status !== 0 || snapshot.error) return []
+
+  const children = new Map<number, number[]>()
+  for (const line of (snapshot.stdout ?? "").split("\n")) {
+    const match = /^\s*(\d+)\s+(\d+)\s*$/.exec(line)
+    if (!match) continue
+    const pid = Number(match[1])
+    const parentPid = Number(match[2])
+    const siblings = children.get(parentPid)
+    if (siblings) siblings.push(pid)
+    else children.set(parentPid, [pid])
+  }
+
+  const descendants: number[] = []
+  const pending = [...(children.get(rootPid) ?? [])]
+  for (let index = 0; index < pending.length; index++) {
+    const pid = pending[index]!
+    descendants.push(pid)
+    pending.push(...(children.get(pid) ?? []))
+  }
+  return descendants
+}
+
+async function killProcessTree(child: ChildProcess): Promise<void> {
+  const pid = child.pid
+  if (process.platform === "win32" && pid !== undefined) {
+    if (await taskkillTree(pid)) return
+  } else if (pid !== undefined) {
+    const descendants = snapshotProcessDescendants(pid)
+    try {
+      process.kill(-pid, "SIGKILL")
+    } catch {
+      // The process may have exited between timeout and termination.
+    }
+    for (const descendantPid of descendants) {
+      try {
+        process.kill(descendantPid, "SIGKILL")
+      } catch {
+        // Process-group termination may already have killed this descendant.
+      }
+    }
+  }
+
+  // This is also the fallback when Windows taskkill cannot kill the tree.
+  try {
+    child.kill("SIGKILL")
+  } catch {
+    // A concurrently exited child needs no further termination.
+  }
+}
+
+type VerificationProcessResult = {
+  code: number
+  output: string
+  error?: string
+}
+
+function runVerificationProcess(
+  wrapper: string,
+  interpreter: VerifyBlock["interpreter"],
+  script: string,
+  cwd: string,
+  timeoutMs: number,
+  outputLimit: number,
+): Promise<VerificationProcessResult> {
+  return new Promise((resolve) => {
+    let child: ChildProcess
+    try {
+      child = spawn("sh", [wrapper, interpreter, script], {
+        cwd,
+        detached: process.platform !== "win32",
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+      })
+    } catch (error) {
+      resolve({
+        code: 1,
+        output: "",
+        error: verificationError(error),
+      })
+      return
+    }
+
+    const output: Buffer[] = []
+    let outputSize = 0
+    let outputExceeded = false
+    let processError: string | undefined
+    let termination: Promise<void> | undefined
+    let timeout: ReturnType<typeof setTimeout> | undefined
+    let postKillCompletion: ReturnType<typeof setTimeout> | undefined
+    let settled = false
+
+    const terminate = (message: string) => {
+      if (settled) return
+      processError ??= message
+      if (termination) return
+      termination = killProcessTree(child)
+      postKillCompletion = setTimeout(() => {
+        child.stdout?.destroy()
+        finish(1)
+      }, VERIFY_KILL_CLOSE_GRACE_MS)
+    }
+    const capture = (chunk: Buffer) => {
+      if (outputExceeded) return
+      const available = outputLimit - outputSize
+      if (chunk.length > available) {
+        if (available > 0) output.push(chunk.subarray(0, available))
+        outputSize = outputLimit
+        outputExceeded = true
+        terminate(`verification output exceeded ${outputLimit} bytes`)
+        return
+      }
+      output.push(chunk)
+      outputSize += chunk.length
+    }
+    const onStdout = (chunk: Buffer) => capture(chunk)
+    const onError = (error: Error) => {
+      terminate(`verification process error: ${verificationError(error)}`)
+    }
+    const finish = (code: number) => {
+      if (settled) return
+      settled = true
+      if (timeout) clearTimeout(timeout)
+      if (postKillCompletion) clearTimeout(postKillCompletion)
+      child.stdout?.off("data", onStdout)
+      child.off("error", onError)
+      child.off("close", onClose)
+      resolve({
+        code,
+        output: Buffer.concat(output).toString("utf8"),
+        ...(processError === undefined ? {} : { error: processError }),
+      })
+    }
+    const onClose = (code: number | null) => {
+      if (termination) {
+        void termination.then(
+          () => finish(code ?? 1),
+          () => finish(code ?? 1),
+        )
+      } else {
+        finish(code ?? 1)
+      }
+    }
+
+    child.stdout?.on("data", onStdout)
+    child.once("error", onError)
+    child.once("close", onClose)
+
+    timeout = setTimeout(() => {
+      terminate(`verification timed out after ${timeoutMs}ms`)
+    }, timeoutMs)
+  })
+}
+
 /** Drop .apnea/ runtime paths from VCS summaries (artifacts are allowed). */
 export function filterAppPaths(summary: string): string {
   return summary
@@ -205,32 +506,103 @@ export const VcsLive = Layer.effect(
 
     const runVerify = (
       root: string,
-      commands: readonly string[],
+      blocks: readonly VerifyBlock[],
       timeoutMs: number,
     ): Effect.Effect<{ ok: boolean; log: string }> =>
-      Effect.sync(() => {
-        const lines: string[] = []
-        for (const cmd of commands) {
-          lines.push(`$ ${cmd}`)
-          const r = spawnSync("bash", ["-lc", cmd], {
-            cwd: root,
+      Effect.promise(async () => {
+        const log = new VerificationLog(VERIFY_LOG_LIMIT)
+        let temporaryDirectory: string | undefined
+        let ok = true
+        let operation = "create temporary verification directory"
+        try {
+          temporaryDirectory = mkdtempSync(path.join(tmpdir(), "apnea-verify-"))
+          const wrapper = path.join(temporaryDirectory, "run-block.sh")
+          operation = "write verification wrapper"
+          writeFileSync(wrapper, VERIFY_WRAPPER_SOURCE, {
             encoding: "utf8",
-            timeout: timeoutMs,
-            maxBuffer: 10 * 1024 * 1024,
+            mode: 0o600,
           })
-          const out = `${r.stdout ?? ""}${r.stderr ?? ""}`.trimEnd()
-          if (out) lines.push(out)
-          lines.push(`exit=${r.status ?? 1}`)
-          if (r.error) {
-            lines.push(String(r.error))
-            return { ok: false, log: lines.join("\n") }
+          for (const [index, block] of blocks.entries()) {
+            const source = normalizeVerifySource(block.source)
+            const normalizedBlock = { ...block, source }
+            const script = path.join(
+              temporaryDirectory,
+              `block-${index + 1}.${block.interpreter}`,
+            )
+            const displayBytes =
+              2 + verifyBlockDisplayByteLength(normalizedBlock) + 1
+            if (!log.canAppendBytes(displayBytes)) {
+              log.addLimitNotice(VERIFY_DISPLAY_LIMIT_NOTICE)
+              ok = false
+              break
+            }
+            log.append(`$ ${formatVerifyBlock(normalizedBlock)}\n`)
+            operation = `write ${block.interpreter} verification block`
+            writeFileSync(script, source, {
+              encoding: "utf8",
+              mode: 0o600,
+            })
+            operation = `run ${block.interpreter} verification block`
+            const result = await runVerificationProcess(
+              wrapper,
+              block.interpreter,
+              script,
+              root,
+              timeoutMs,
+              Math.max(0, log.remaining - VERIFY_RESULT_RESERVE),
+            )
+            const output = verificationError(
+              result.output.trimEnd(),
+              temporaryDirectory,
+            )
+            if (output && !log.append(`${output}\n`)) {
+              log.addLimitNotice(VERIFY_LOG_LIMIT_NOTICE)
+              ok = false
+              break
+            }
+            if (!log.append(`exit=${result.code}\n`)) {
+              log.addLimitNotice(VERIFY_LOG_LIMIT_NOTICE)
+              ok = false
+              break
+            }
+            if (result.error) {
+              const error = verificationError(result.error, temporaryDirectory)
+              if (!log.append(`${error}\n`)) {
+                log.addLimitNotice(VERIFY_LOG_LIMIT_NOTICE)
+              }
+              ok = false
+              break
+            }
+            if (result.code !== 0) {
+              ok = false
+              break
+            }
+            if (index < blocks.length - 1 && !log.append("\n")) {
+              log.addLimitNotice(VERIFY_LOG_LIMIT_NOTICE)
+              ok = false
+              break
+            }
+          }
+        } catch (error) {
+          const message = `${operation} failed: ${verificationError(error, temporaryDirectory)}\n`
+          if (!log.append(message)) {
+            log.addLimitNotice(VERIFY_LOG_LIMIT_NOTICE)
           }
-          if (r.status !== 0) {
-            return { ok: false, log: lines.join("\n") }
+          ok = false
+        } finally {
+          if (temporaryDirectory) {
+            try {
+              rmSync(temporaryDirectory, { recursive: true, force: true })
+            } catch (error) {
+              const message = `clean up temporary verification directory failed: ${verificationError(error, temporaryDirectory)}\n`
+              if (!log.append(message)) {
+                log.addLimitNotice(VERIFY_LOG_LIMIT_NOTICE)
+              }
+              ok = false
+            }
           }
-          lines.push("")
         }
-        return { ok: true, log: lines.join("\n") }
+        return { ok, log: log.toString() }
       })
 
     return Vcs.of({

package/extension/workflows/commit.ts

@@ -3,7 +3,10 @@ import { Effect, Result } from "effect"
 import { asVerdict, parseFrontMatter } from "../domain/frontmatter.ts"
 import { abs, phaseDir, rel } from "../domain/paths.ts"
 import { nextAfter, toolAllowed } from "../domain/state-machine.ts"
-import { extractVerifyCommands } from "../domain/verify-commands.ts"
+import {
+  extractVerifyBlocks,
+  formatVerifyCommand,
+} from "../domain/verify-commands.ts"
 import {
   ArtifactInvalid,
   GateRefused,
@@ -86,8 +89,8 @@ export const commitWorkflow = (
       })
     }
     const pkgText = yield* fs.readFile(pkgAbs)
-    const cmds = extractVerifyCommands(pkgText)
-    if (!cmds.length) {
+    const blocks = extractVerifyBlocks(pkgText)
+    if (!blocks.length) {
       return yield* new ArtifactInvalid({
         artifact: pkgRel,
         message: "no verify commands found in phase package (need ```sh block)",
@@ -96,7 +99,7 @@ export const commitWorkflow = (
 
     const cfg = yield* config.load(root)
     const verifyTimeout = cfg.timeouts_ms.verify ?? 900_000
-    const verify = yield* vcs.runVerify(root, cmds, verifyTimeout)
+    const verify = yield* vcs.runVerify(root, blocks, verifyTimeout)
 
     const vlog = path.join(path.dirname(reviewAbs), "verify.log")
     yield* fs.mkdir(path.dirname(vlog), { recursive: true })
@@ -104,7 +107,7 @@ export const commitWorkflow = (
 
     if (!verify.ok) {
       return yield* new VerifyFailed({
-        commands: cmds,
+        commands: blocks.map(formatVerifyCommand),
         outputs: [verify.log.slice(-2000)],
         // `outputs` is a tail — point the caller at the full log on disk.
         verify_log: rel(vlog, root),