@norskvideo/ctl-test-harness 0.1.35 → 0.1.37

package/demo/dev-loop.js

@@ -199,7 +199,18 @@ export async function devLoopDown(product, deps = defaultDemoDeps(process.cwd())
     }
     if (state.devPid !== undefined)
         deps.killPid?.(state.devPid);
-    deps.nukeStoreAsRoot(state.storeDir);
+    // Never let the nuke strand the state record: it sits one line before
+    // state.remove, and the containment guard throws for a store outside THIS
+    // process's temp base -- which is a cross-process fact (the `up` shell's
+    // NORSK_CTL_TEST_TMP need not be the `down` shell's), not a bug in the run
+    // being torn down. Refusing to delete it is right; failing to forget it
+    // means `down` breaks identically on every retry.
+    try {
+        deps.nukeStoreAsRoot(state.storeDir);
+    }
+    catch (e) {
+        deps.log(`nuke skipped: ${e instanceof Error ? e.message : String(e)}`);
+    }
     deps.state.remove(product, "dev-loop");
     deps.log(`${product} dev-loop torn down (the workdir ${state.workdir ?? ""} is untouched)`);
 }

package/demo/run.js

@@ -36,7 +36,7 @@ import { ctlSupportsNoPublish, runnerContainerUser } from "../launch.js";
 import { pollUntil } from "../poll.js";
 import { nukePathAsRoot, reportForeignOwners } from "../root-nuke.js";
 import { startSrtSources } from "../source-pump.js";
-import { makeStoreDir } from "../temp-dir.js";
+import { makeStoreDir, TEST_TMP_BASE } from "../temp-dir.js";
 const DEMO_PORT_BASE = 35000;
 const DEMO_BAND_WIDTH = 20;
 const DEMO_BANDS = 50;
@@ -290,7 +290,7 @@ export function defaultDemoDeps(cwd) {
                 await h.stop();
         },
         cleanup: (opts) => cleanupDaemon({ ...opts, stopProxy: async () => { }, proxy: false }),
-        nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir),
+        nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir, TEST_TMP_BASE),
         storeExists: (storeDir) => existsSync(storeDir),
         ensureNetwork: () => ensureRunnerOnNetwork(),
         supportsNoPublish: ctlSupportsNoPublish,
@@ -733,8 +733,19 @@ export async function demoDown(product, deps = defaultDemoDeps(process.cwd())) {
         deps.docker(["rm", "-f", name]);
     if (state.devPid !== undefined)
         deps.killPid?.(state.devPid);
-    if (state.daemon !== "reuse")
-        deps.nukeStoreAsRoot(state.storeDir);
+    // Never let the nuke strand the state record: it sits one line before
+    // state.remove, and the containment guard throws for a store outside THIS
+    // process's temp base -- which is a cross-process fact (the `up` shell's
+    // NORSK_CTL_TEST_TMP need not be the `down` shell's), not a bug in the run
+    // being torn down. Refusing to delete it is right; failing to forget it
+    // means `down` breaks identically on every retry.
+    try {
+        if (state.daemon !== "reuse")
+            deps.nukeStoreAsRoot(state.storeDir);
+    }
+    catch (e) {
+        deps.log(`nuke skipped: ${e instanceof Error ? e.message : String(e)}`);
+    }
     deps.state.remove(product);
     deps.log(`${product} demo torn down${state.daemon === "reuse" ? " (your daemon and its registration are untouched)" : ""}`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "type": "module",
   "exports": {
     ".": {

package/root-nuke.d.ts

@@ -3,12 +3,20 @@ export type NukeSpawn = (cmd: string, argv: string[], opts?: unknown) => {
     error?: unknown;
     status?: number | null;
 };
-/** Refuse a target that would turn the nuke into something catastrophic. The
- *  mount is the target's PARENT, so a target with no leaf ("/" or a trailing
- *  slash) means "delete the mount", and a relative path resolves against a cwd
- *  the container does not share. These are programming errors, not runtime
- *  conditions: throw loudly rather than run a root rm against a guess. */
-export declare function assertNukeTarget(target: string): void;
+/** Refuse a target that would turn the nuke into something catastrophic.
+ *
+ *  `allowedBase` is the containment: the target must sit strictly INSIDE it.
+ *  Nothing else here is sufficient on its own, because the worst case passes
+ *  every structural check. Under `--daemon reuse` the harness's storeDir is the
+ *  developer's real `~/.norsk-ctl` -- absolute, ordinary leaf, no glob,
+ *  non-root parent -- and nuking it mounts $HOME into a root container and
+ *  removes the daemon's entire state: config, products, templates, instances.
+ *  Today only an early return in teardown keeps the nuke away from it, and a
+ *  guard that depends on a `return` staying put is not a guard.
+ *
+ *  The base itself is refused too: it is shared by concurrently running tiers,
+ *  so removing it would delete sibling runs' live stores. */
+export declare function assertNukeTarget(target: string, allowedBase: string): void;
 /** Docker argv for the nuke. Two things matter here:
  *
  *  1. The PARENT is mounted and the leaf removed by name -- mounting the target
@@ -19,11 +27,16 @@ export declare function assertNukeTarget(target: string): void;
  *     directory called `x; rm -rf /base` would otherwise wipe every sibling --
  *     including a live sibling run -- from inside a root container. */
 export declare function nukeArgv(target: string): string[];
-/** Remove `target` as root. Returns whether the nuke actually ran: `spawnSync`
- *  reports a missing docker in its RESULT rather than throwing, and a caller
- *  that retries a doomed spawn forever (silently) is the failure mode to avoid.
+/** Remove `target` as root. Returns whether the nuke actually SUCCEEDED.
+ *
+ *  Both halves matter. `spawnSync` reports a missing docker in its RESULT
+ *  rather than throwing, and a docker that is present but failing -- daemon
+ *  stopped, image unpullable, mount refused -- reports only a non-zero status
+ *  with no `error` at all. Reading `error` alone calls that a success, so a
+ *  caller latching on the return value never latches and re-spawns a doomed
+ *  60-second docker on every attempt, forever and silently.
  *  Throws only for an unsafe target -- see {@link assertNukeTarget}. */
-export declare function nukePathAsRoot(target: string, spawn?: NukeSpawn): boolean;
+export declare function nukePathAsRoot(target: string, allowedBase: string, spawn?: NukeSpawn): boolean;
 export interface OwnerScanDeps {
     readdir: (path: string) => string[];
     isDir: (path: string) => boolean;

package/root-nuke.js

@@ -7,27 +7,44 @@
 // prevention half.
 import { spawnSync } from "node:child_process";
 import { lstatSync, readdirSync } from "node:fs";
-import { basename, dirname, isAbsolute } from "node:path";
+import { basename, dirname, isAbsolute, resolve, sep } from "node:path";
 const NUKE_IMAGE = "alpine:3";
 const NUKE_TIMEOUT_MS = 60_000;
-/** Refuse a target that would turn the nuke into something catastrophic. The
- *  mount is the target's PARENT, so a target with no leaf ("/" or a trailing
- *  slash) means "delete the mount", and a relative path resolves against a cwd
- *  the container does not share. These are programming errors, not runtime
- *  conditions: throw loudly rather than run a root rm against a guess. */
-export function assertNukeTarget(target) {
+/** Refuse a target that would turn the nuke into something catastrophic.
+ *
+ *  `allowedBase` is the containment: the target must sit strictly INSIDE it.
+ *  Nothing else here is sufficient on its own, because the worst case passes
+ *  every structural check. Under `--daemon reuse` the harness's storeDir is the
+ *  developer's real `~/.norsk-ctl` -- absolute, ordinary leaf, no glob,
+ *  non-root parent -- and nuking it mounts $HOME into a root container and
+ *  removes the daemon's entire state: config, products, templates, instances.
+ *  Today only an early return in teardown keeps the nuke away from it, and a
+ *  guard that depends on a `return` staying put is not a guard.
+ *
+ *  The base itself is refused too: it is shared by concurrently running tiers,
+ *  so removing it would delete sibling runs' live stores. */
+export function assertNukeTarget(target, allowedBase) {
     if (!isAbsolute(target))
         throw new Error(`refusing to nuke a relative path: ${target}`);
     const leaf = basename(target);
     if (leaf === "" || leaf === "." || leaf === "..")
         throw new Error(`refusing to nuke a path with no leaf: ${target}`);
-    if (leaf === "*" || leaf.includes("*"))
+    if (leaf.includes("*"))
         throw new Error(`refusing to nuke a glob: ${target}`);
     // dirname is what gets bind-mounted; "/" would hand the whole host to a root
-    // container. Every real target (a store under test-temp) is nested deeper.
+    // container. Every real target (a store under the temp base) is nested deeper.
     if (dirname(target) === "/" || dirname(target) === target) {
         throw new Error(`refusing to nuke a top-level path (its parent would be the mount): ${target}`);
     }
+    // resolve() first so `..` cannot walk out, and compare with a trailing
+    // separator so `/x/test-temp-evil` does not pass as inside `/x/test-temp`.
+    const t = resolve(target);
+    const base = resolve(allowedBase);
+    if (t === base)
+        throw new Error(`refusing to nuke the temp base itself (concurrent runs live here): ${t}`);
+    if (!t.startsWith(base.endsWith(sep) ? base : base + sep)) {
+        throw new Error(`refusing to nuke ${t}: outside the test temp base ${base}`);
+    }
 }
 /** Docker argv for the nuke. Two things matter here:
  *
@@ -55,14 +72,21 @@ export function nukeArgv(target) {
         basename(target),
     ];
 }
-/** Remove `target` as root. Returns whether the nuke actually ran: `spawnSync`
- *  reports a missing docker in its RESULT rather than throwing, and a caller
- *  that retries a doomed spawn forever (silently) is the failure mode to avoid.
+/** Remove `target` as root. Returns whether the nuke actually SUCCEEDED.
+ *
+ *  Both halves matter. `spawnSync` reports a missing docker in its RESULT
+ *  rather than throwing, and a docker that is present but failing -- daemon
+ *  stopped, image unpullable, mount refused -- reports only a non-zero status
+ *  with no `error` at all. Reading `error` alone calls that a success, so a
+ *  caller latching on the return value never latches and re-spawns a doomed
+ *  60-second docker on every attempt, forever and silently.
  *  Throws only for an unsafe target -- see {@link assertNukeTarget}. */
-export function nukePathAsRoot(target, spawn = spawnSync) {
-    assertNukeTarget(target);
+export function nukePathAsRoot(target, allowedBase, spawn = spawnSync) {
+    assertNukeTarget(target, allowedBase);
     const r = spawn("docker", nukeArgv(target), { timeout: NUKE_TIMEOUT_MS });
-    return !r?.error;
+    if (r?.error)
+        return false;
+    return r?.status === 0 || r?.status === undefined;
 }
 /** Paths under `dir` owned by a uid that is not `selfUid`, with the owning uid.
  *

package/smoke.js

@@ -28,7 +28,7 @@ import { pollUntil } from "./poll.js";
 import { nukePathAsRoot, reportForeignOwners } from "./root-nuke.js";
 import { startSrtSources } from "./source-pump.js";
 import { applyTestHost, fetchComponentState, fetchComponents, fetchStreamMappings, isSrtListenerState, } from "./studio-state.js";
-import { makeStoreDir } from "./temp-dir.js";
+import { makeStoreDir, TEST_TMP_BASE } from "./temp-dir.js";
 const SMOKE_PORT_BASE = 33000;
 const SMOKE_BAND_WIDTH = 20;
 const SMOKE_BANDS = 50;
@@ -62,7 +62,7 @@ export const defaultSmokeDeps = {
         fetch: (url) => fetch(url, { signal: AbortSignal.timeout(5000) }),
     },
     cleanup: (opts) => cleanupDaemon({ ...opts, stopProxy: async () => { }, proxy: false }),
-    nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir),
+    nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir, TEST_TMP_BASE),
     storeExists: (storeDir) => existsSync(storeDir),
     ensureNetwork: () => ensureRunnerOnNetwork(),
     supportsNoPublish: ctlSupportsNoPublish,

package/temp-dir.js

@@ -122,7 +122,7 @@ function pruneStaleTempDirs(base) {
         nukeAsRoot: (p) => {
             if (nukeKnownUnavailable)
                 return false;
-            const ran = nukePathAsRoot(p);
+            const ran = nukePathAsRoot(p, base);
             if (!ran)
                 nukeKnownUnavailable = true;
             return ran;