@norskvideo/ctl-test-harness 0.1.40 → 0.1.41

package/demo/run.d.ts

@@ -217,6 +217,28 @@ export interface SessionOptions {
     /** Containers teardown must also wait out — an overridden proxy's pair. */
     extraContainers?: string[];
 }
+/** The host a demo's daemon-port URLs name.
+ *
+ *  NORSK_TEST_HOST is a STUDIO-port setting: on a docker-outside-of-docker
+ *  runner the test process sits in a container while the studio it launched
+ *  published its port on the HOST, reachable only via the host-gateway alias.
+ *  A PRIVATE daemon is the opposite case -- this process starts it, and its
+ *  proxy, so its ports are on this process's own loopback. studio-state.ts
+ *  states the invariant plainly ("daemon-port fetches are deliberately left on
+ *  localhost"); letting the env reach them here aimed playout's visualiser gate
+ *  at the host gateway, where nothing listens on the private proxy port, and
+ *  `demo -- check` missed `video_compose advancing` on every poll for 180s
+ *  while the compositor was advancing perfectly well (2026-09-03). It passed
+ *  only where a runner's network happened to route back, which is what made it
+ *  read as a flake rather than a wrong address.
+ *
+ *  `reuse` keeps the alias: that daemon is a process this one did not start and
+ *  may genuinely be the host sibling. An explicit --public-host always wins. */
+export declare function demoUrlHost(opts: {
+    publicHost: string | undefined;
+    daemon: DemoDaemonPolicy;
+    env?: NodeJS.ProcessEnv;
+}): string;
 /** The pieces of a run that `runDemo`, `runExportCheck` and the dev-loop
  *  share: the daemon (private on its band, or the developer's), the dev
  *  backend on the driver's port, the registration, and the template (built

package/demo/run.js

@@ -311,6 +311,31 @@ export function defaultDemoDeps(cwd) {
         log: (line) => console.log(`[demo] ${line}`),
     };
 }
+/** The host a demo's daemon-port URLs name.
+ *
+ *  NORSK_TEST_HOST is a STUDIO-port setting: on a docker-outside-of-docker
+ *  runner the test process sits in a container while the studio it launched
+ *  published its port on the HOST, reachable only via the host-gateway alias.
+ *  A PRIVATE daemon is the opposite case -- this process starts it, and its
+ *  proxy, so its ports are on this process's own loopback. studio-state.ts
+ *  states the invariant plainly ("daemon-port fetches are deliberately left on
+ *  localhost"); letting the env reach them here aimed playout's visualiser gate
+ *  at the host gateway, where nothing listens on the private proxy port, and
+ *  `demo -- check` missed `video_compose advancing` on every poll for 180s
+ *  while the compositor was advancing perfectly well (2026-09-03). It passed
+ *  only where a runner's network happened to route back, which is what made it
+ *  read as a flake rather than a wrong address.
+ *
+ *  `reuse` keeps the alias: that daemon is a process this one did not start and
+ *  may genuinely be the host sibling. An explicit --public-host always wins. */
+export function demoUrlHost(opts) {
+    if (opts.publicHost !== undefined)
+        return opts.publicHost;
+    const envHost = (opts.env ?? process.env).NORSK_TEST_HOST;
+    if (opts.daemon === "reuse" && envHost)
+        return envHost;
+    return "localhost";
+}
 /** The pieces of a run that `runDemo`, `runExportCheck` and the dev-loop
  *  share: the daemon (private on its band, or the developer's), the dev
  *  backend on the driver's port, the registration, and the template (built
@@ -346,7 +371,7 @@ export class DemoSession {
         this.mode = opts.mode;
         this.policy = opts.daemon;
         this.publicHost = opts.publicHost;
-        const host = opts.publicHost ?? process.env.NORSK_TEST_HOST ?? "localhost";
+        const host = demoUrlHost({ publicHost: opts.publicHost, daemon: opts.daemon });
         this.host = host;
         if (opts.daemon === "reuse") {
             const daemonPort = opts.daemonPort ?? (Number(process.env.NORSK_CTL_PORT) || DEFAULT_DAEMON_PORT);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.40",
+  "version": "0.1.41",
   "type": "module",
   "exports": {
     ".": {

package/root-nuke.d.ts

@@ -1,8 +1,22 @@
-/** Minimal shape of `spawnSync` this needs, so tests can inject. */
+/** Minimal shape of `spawnSync` this needs, so tests can inject. `stdout` is
+ *  optional because only the container-scan calls read it. */
 export type NukeSpawn = (cmd: string, argv: string[], opts?: unknown) => {
     error?: unknown;
     status?: number | null;
+    stdout?: string | Buffer | null;
 };
+/** Container ids whose bind-mount sources sit at or under `dir`.
+ *
+ *  Matching on the mount SOURCE rather than a label is the point. The
+ *  containers that strand a temp dir are exactly the ones no teardown ever
+ *  tracked -- a run killed mid-flight (CI cancel, timeout, SIGKILL) never
+ *  labels or records them -- so a label filter finds nothing. The mount is the
+ *  one thing that is always true of a container holding the path open. */
+export declare function containersHoldingMountsUnder(dir: string, spawn?: NukeSpawn): string[];
+/** Remove the containers pinning `dir` so a nuke can actually unlink it.
+ *  Returns the ids it tried to reap. Best-effort: a docker that cannot list is
+ *  a docker that cannot nuke either, and the caller reports that separately. */
+export declare function reapContainersUnder(dir: string, spawn?: NukeSpawn, log?: (line: string) => void): string[];
 /** Refuse a target that would turn the nuke into something catastrophic.
  *
  *  `allowedBase` is the containment: the target must sit strictly INSIDE it.

package/root-nuke.js

@@ -10,6 +10,52 @@ import { lstatSync, readdirSync } from "node:fs";
 import { basename, dirname, isAbsolute, resolve, sep } from "node:path";
 const NUKE_IMAGE = "alpine:3";
 const NUKE_TIMEOUT_MS = 60_000;
+const REAP_TIMEOUT_MS = 30_000;
+function spawnOut(spawn, argv) {
+    const r = spawn("docker", argv, { timeout: REAP_TIMEOUT_MS, encoding: "utf8" });
+    if (r?.error || (r?.status ?? 0) !== 0)
+        return undefined;
+    return String(r.stdout ?? "");
+}
+function lines(out) {
+    return out
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+/** Container ids whose bind-mount sources sit at or under `dir`.
+ *
+ *  Matching on the mount SOURCE rather than a label is the point. The
+ *  containers that strand a temp dir are exactly the ones no teardown ever
+ *  tracked -- a run killed mid-flight (CI cancel, timeout, SIGKILL) never
+ *  labels or records them -- so a label filter finds nothing. The mount is the
+ *  one thing that is always true of a container holding the path open. */
+export function containersHoldingMountsUnder(dir, spawn = spawnSync) {
+    const prefix = dir.endsWith(sep) ? dir : dir + sep;
+    const listed = spawnOut(spawn, ["ps", "-aq"]);
+    if (listed === undefined)
+        return [];
+    const held = [];
+    for (const id of lines(listed)) {
+        const mounts = spawnOut(spawn, ["inspect", "-f", "{{range .Mounts}}{{println .Source}}{{end}}", id]);
+        if (mounts === undefined)
+            continue;
+        if (lines(mounts).some((src) => src === dir || src.startsWith(prefix)))
+            held.push(id);
+    }
+    return held;
+}
+/** Remove the containers pinning `dir` so a nuke can actually unlink it.
+ *  Returns the ids it tried to reap. Best-effort: a docker that cannot list is
+ *  a docker that cannot nuke either, and the caller reports that separately. */
+export function reapContainersUnder(dir, spawn = spawnSync, log) {
+    const held = containersHoldingMountsUnder(dir, spawn);
+    if (held.length === 0)
+        return held;
+    log?.(`reaping ${held.length} container(s) pinning ${dir}: ${held.join(" ")}`);
+    spawn("docker", ["rm", "-f", ...held], { timeout: REAP_TIMEOUT_MS });
+    return held;
+}
 /** Refuse a target that would turn the nuke into something catastrophic.
  *
  *  `allowedBase` is the containment: the target must sit strictly INSIDE it.
@@ -83,6 +129,13 @@ export function nukeArgv(target) {
  *  Throws only for an unsafe target -- see {@link assertNukeTarget}. */
 export function nukePathAsRoot(target, allowedBase, spawn = spawnSync) {
     assertNukeTarget(target, allowedBase);
+    // A container still bind-mounting something under `target` makes that path
+    // unlinkable even for root -- the kernel returns EBUSY, `rm -rf` reports it
+    // as a plain non-zero exit, and the nuke silently no-ops. The litter then
+    // outlives every later run and eventually wedges an innocent job's checkout
+    // (2026-09-03: a leaked guide-composition studio, five days up, took
+    // commentary's checks AND integration red). Clear the holders first.
+    reapContainersUnder(target, spawn);
     const r = spawn("docker", nukeArgv(target), { timeout: NUKE_TIMEOUT_MS });
     if (r?.error)
         return false;