@opengeni/runtime 4.6.0 → 4.7.0-canary.37090756480001

package/src/sandbox/provider-command-session.ts

@@ -54,6 +54,64 @@ export class ProviderCommandStartOutcomeUnknownError extends Error {
   }
 }
 
+/** A reserved stdin byte range was sent once but its acknowledgement was lost.
+ * The original process remains observation authority, never input replay authority. */
+export class ProviderCommandInputOutcomeUnknownError extends Error {
+  constructor(
+    readonly command: SandboxProviderCommand,
+    readonly byteOffset: number,
+    readonly byteLength: number,
+    cause: unknown,
+  ) {
+    super(
+      "Provider command stdin outcome is unknown; the input was not resent. Do not resend stdin; inspect the original command with empty input.",
+      { cause },
+    );
+    this.name = "ProviderCommandInputOutcomeUnknownError";
+  }
+}
+
+/** An already-dispatched invocation could not be observed within this read's
+ * budget. The exact locator is read authority, never Start/input replay authority. */
+export class ProviderCommandObservationUnavailableError extends Error {
+  constructor(
+    readonly command: SandboxProviderCommand,
+    cause: unknown,
+    /** Mixed or unreadable provider graphs can contain observation failure
+     * without proving that an automatic read retry is safe. */
+    readonly readRetryAllowed = true,
+  ) {
+    super("Provider command observation unavailable; do not replay the invocation", { cause });
+    this.name = "ProviderCommandObservationUnavailableError";
+  }
+}
+
+export function isProviderCommandObservationUnavailableError(error: unknown): boolean {
+  const pending = [error];
+  const seen = new Set<object>();
+  for (let count = 0; pending.length && count < 32; count++) {
+    const current = pending.pop();
+    if (!current || typeof current !== "object" || seen.has(current)) continue;
+    seen.add(current);
+    if (current instanceof ProviderCommandObservationUnavailableError) return true;
+    try {
+      for (const key of ["cause", "error"] as const) {
+        const property = Object.getOwnPropertyDescriptor(current, key);
+        if (property && "value" in property) pending.push(property.value);
+      }
+      const errors = Object.getOwnPropertyDescriptor(current, "errors");
+      if (errors && "value" in errors && Array.isArray(errors.value) && errors.value.length <= 16)
+        for (let index = 0; index < errors.value.length; index++) {
+          const item = Object.getOwnPropertyDescriptor(errors.value, String(index));
+          if (item && "value" in item) pending.push(item.value);
+        }
+    } catch {
+      /* Unknown error graphs do not acquire observation authority. */
+    }
+  }
+  return false;
+}
+
 export type ProviderCommandSession = {
   verifyCommandSupervisionCapability?(): Promise<{ sandboxId: string; taskId: string }>;
   releaseSupervisedCommand?(handle: number): Promise<void>;

package/src/sandbox/provider-errors.ts

@@ -18,6 +18,11 @@ export type ProviderSandboxFailure = {
 
 const GRPC_TRANSIENT = new Set([1, 2, 4, 13, 14]);
 const TRANSIENT_CODES = new Set([
+  "1",
+  "2",
+  "4",
+  "13",
+  "14",
   "CANCELLED",
   "UNKNOWN",
   "DEADLINE_EXCEEDED",
@@ -36,21 +41,39 @@ type ErrorSignals = {
   numbers: number[];
   codes: string[];
   messages: string[];
+  incomplete: boolean;
 };
 
+const UNREADABLE_ERROR_SIGNAL = Symbol("unreadable-error-signal");
+
 function safeRead(record: object, key: string): unknown {
   try {
-    return Reflect.get(record, key);
+    const descriptor = Object.getOwnPropertyDescriptor(record, key);
+    return descriptor
+      ? "value" in descriptor
+        ? descriptor.value
+        : UNREADABLE_ERROR_SIGNAL
+      : undefined;
   } catch {
-    return undefined;
+    return UNREADABLE_ERROR_SIGNAL;
   }
 }
 
 function collectSignals(value: unknown): ErrorSignals {
-  const out: ErrorSignals = { numbers: [], codes: [], messages: [] };
+  const out: ErrorSignals = { numbers: [], codes: [], messages: [], incomplete: false };
   const seen = new Set<object>();
+  const read = (record: object, key: string): unknown => {
+    const signal = safeRead(record, key);
+    if (signal !== UNREADABLE_ERROR_SIGNAL) return signal;
+    out.incomplete = true;
+    return undefined;
+  };
   const visit = (current: unknown, depth: number): void => {
-    if (depth > 3 || current === null || current === undefined) return;
+    if (current === null || current === undefined) return;
+    if (depth > 6 || seen.size >= 64) {
+      out.incomplete = true;
+      return;
+    }
     if (typeof current === "string") {
       if (current.length <= 512) out.messages.push(current);
       return;
@@ -66,7 +89,7 @@ function collectSignals(value: unknown): ErrorSignals {
       "errorCode",
       "code",
     ]) {
-      const signal = safeRead(current, key);
+      const signal = read(current, key);
       if (typeof signal === "number" && Number.isFinite(signal)) out.numbers.push(signal);
       if (typeof signal === "string") {
         const code = signal.trim().toUpperCase();
@@ -74,12 +97,22 @@ function collectSignals(value: unknown): ErrorSignals {
       }
     }
     for (const key of ["name", "message", "details", "cause"]) {
-      const signal = safeRead(current, key);
+      const signal = read(current, key);
       if (typeof signal === "string" && signal.length <= 512) out.messages.push(signal);
       else visit(signal, depth + 1);
     }
-    visit(safeRead(current, "response"), depth + 1);
-    visit(safeRead(current, "error"), depth + 1);
+    visit(read(current, "response"), depth + 1);
+    visit(read(current, "error"), depth + 1);
+    const errors = read(current, "errors");
+    if (errors !== undefined) {
+      if (!Array.isArray(errors) || !errors.length || errors.length > 16) out.incomplete = true;
+      else
+        for (let index = 0; index < errors.length; index++) {
+          const nested = read(errors, String(index));
+          if (!nested || typeof nested !== "object") out.incomplete = true;
+          visit(nested, depth + 1);
+        }
+    }
   };
   visit(value, 0);
   return out;
@@ -140,6 +173,7 @@ export function classifyProviderSandboxFailure(
   if (hasTransientSignal(signals)) {
     return { kind: "transient_transport", diagnostic };
   }
+  if (signals.incomplete) return { kind: "other", diagnostic };
   if (
     signals.numbers.some((status) => status === 404) ||
     signals.codes.some((code) => NOT_FOUND_CODES.has(code))
@@ -233,7 +267,7 @@ export function isProviderSandboxGoneDuringRoutedOperation(
 ): boolean {
   if (backendId === "selfhosted" || !error) return false;
   const signals = collectSignals(error);
-  if (hasTransientSignal(signals)) return false;
+  if (hasTransientSignal(signals) || signals.incomplete) return false;
   if (signals.codes.includes("SANDBOX_NOT_FOUND")) return true;
   return backendId === "modal" && hasModalTerminalSandboxMessage(signals);
 }

package/src/sandbox/providers/modal-command-argv.ts

@@ -0,0 +1,20 @@
+import type { ChannelAExecArgs } from "../channel-a";
+
+/** Keep the command payload once in argv. Embedding it in each run-as branch
+ * multiplies large lifecycle scripts past the provider's aggregate limit. */
+export function modalCommandArgv(args: ChannelAExecArgs): string[] {
+  const command = [
+    args.shell ?? "/bin/sh",
+    args.shell && (args.login ?? true) ? "-lc" : "-c",
+    args.cmd,
+  ];
+  if (!args.runAs) return command;
+  return [
+    "/bin/sh",
+    "-c",
+    'user=$1; shift; if [ "$(id -u)" = "$user" ] || [ "$(id -un 2>/dev/null)" = "$user" ]; then exec "$@"; elif [ "$(id -u)" = 0 ]; then exec su -s /bin/sh -c \'exec "$@"\' -- "$user" sh "$@"; else exec sudo -n -u "$user" -- "$@"; fi',
+    "opengeni-run-as",
+    args.runAs,
+    ...command,
+  ];
+}