@quenty/nevermore-cli 4.50.1 → 4.52.0

package/src/utils/job-context/batch-script-job-context.ts

@@ -42,6 +42,8 @@ class BatchDeployment implements Deployment {
   ) {}
 }
 
+type BatchBuild = Pick<CombinedProjectResult, 'chunks' | 'primaryTarget'>;
+
 /** One combined place's upload and execution, each started at most once. */
 interface ChunkRun {
   chunk: CombinedPlaceChunk;
@@ -98,7 +100,7 @@ export class BatchScriptJobContext implements JobContext {
   private _reporter?: Reporter;
 
   // Lazy-promise state
-  private _combinedBuildPromise?: Promise<CombinedProjectResult>;
+  private _combinedBuildPromise?: Promise<BatchBuild>;
   private _chunkRuns?: ChunkRun[];
   private _executionPromise?: Promise<BatchExecutionOutcome>;
 
@@ -119,6 +121,12 @@ export class BatchScriptJobContext implements JobContext {
        */
       maxChunkBytes?: number;
       reporter?: Reporter;
+      /**
+       * Places already built by `batch bundle --test`, run instead of building. They
+       * upload to `batchPlaceId` in `batchUniverseId`, which are then required.
+       * The context owns `buildContext` and cleans it up like its own build.
+       */
+      prebuilt?: { chunks: CombinedPlaceChunk[]; buildContext: BuildContext };
     }
   ) {
     this._inner = inner;
@@ -130,6 +138,25 @@ export class BatchScriptJobContext implements JobContext {
     this._maxChunkBytes = options?.maxChunkBytes;
     this._reporter = options?.reporter;
 
+    if (options?.prebuilt) {
+      if (!this._batchPlaceId || !this._batchUniverseId) {
+        throw new Error(
+          'Prebuilt places need batchPlaceId and batchUniverseId to upload to'
+        );
+      }
+      const { chunks, buildContext } = options.prebuilt;
+      this._combinedBuildContext = buildContext;
+      this._chunkRuns = chunks.map((chunk) => ({ chunk }));
+      this._combinedBuildPromise = Promise.resolve({
+        chunks,
+        primaryTarget: {
+          placeId: this._batchPlaceId,
+          universeId: this._batchUniverseId,
+          project: '',
+        },
+      });
+    }
+
     const withBasePlace = batchTargets.filter((t) => t.target.basePlace);
     if (withBasePlace.length > 0) {
       OutputHelper.warn(
@@ -203,6 +230,10 @@ export class BatchScriptJobContext implements JobContext {
     return this._getBatchExecutionAsync();
   }
 
+  async getBuiltChunksAsync(): Promise<CombinedPlaceChunk[]> {
+    return (await this._getChunkRunsAsync()).map((run) => run.chunk);
+  }
+
   async getLogsAsync(deployment: Deployment): Promise<JobLogs> {
     const batchDeployment = deployment as BatchDeployment;
     const { results, stats } = await this._getBatchExecutionAsync();
@@ -249,14 +280,14 @@ export class BatchScriptJobContext implements JobContext {
 
   // ---- Lazy-promise internals ----
 
-  private _getCombinedBuildAsync(): Promise<CombinedProjectResult> {
+  private _getCombinedBuildAsync(): Promise<BatchBuild> {
     if (!this._combinedBuildPromise) {
       this._combinedBuildPromise = this._doCombinedBuildAsync();
     }
     return this._combinedBuildPromise;
   }
 
-  private async _doCombinedBuildAsync(): Promise<CombinedProjectResult> {
+  private async _doCombinedBuildAsync(): Promise<BatchBuild> {
     OutputHelper.verbose('Building combined batch place...');
 
     // Set all packages to "waiting" — they're queued for building

package/src/utils/open-cloud/open-cloud-client.test.ts

@@ -733,6 +733,21 @@ describe('OpenCloudClient asset owner lookups', () => {
   });
 });
 
+describe('OpenCloudClient.createExecutionTaskAsync', () => {
+  it('refuses a script over the 4 MB limit without sending it', async () => {
+    const fakeLimiter = { fetchAsync: vi.fn() };
+    const client = new OpenCloudClient({
+      apiKey: 'key',
+      rateLimiter: fakeLimiter as unknown as RateLimiter,
+    });
+
+    await expect(
+      client.createExecutionTaskAsync(1, 2, 3, 'a'.repeat(4_000_001))
+    ).rejects.toThrow('over the Open Cloud limit of 4 MB');
+    expect(fakeLimiter.fetchAsync).not.toHaveBeenCalled();
+  });
+});
+
 describe('getTaskReturnValues', () => {
   function makeTask(overrides: Partial<LuauTask>): LuauTask {
     return {

package/src/utils/open-cloud/open-cloud-client.ts

@@ -28,6 +28,8 @@ import { recompressPlace } from '../build/place-recompression.js';
  */
 export const PLACE_UPLOAD_MAX_BYTES = 150 * 1024 * 1024;
 
+export const LUAU_EXECUTION_SCRIPT_MAX_BYTES = 4_000_000;
+
 /**
  * One engine message, with the severity Open Cloud reported for it.
  *
@@ -397,6 +399,15 @@ export class OpenCloudClient {
     timeoutMs?: number,
     onRateLimitWait?: (wait: RateLimitWait) => void
   ): Promise<LuauTask> {
+    const scriptBytes = Buffer.byteLength(script, 'utf-8');
+    if (scriptBytes > LUAU_EXECUTION_SCRIPT_MAX_BYTES) {
+      throw new Error(
+        `The script is ${_formatMegabytes(
+          scriptBytes
+        )}, over the Open Cloud limit of 4 MB for a Luau execution script`
+      );
+    }
+
     const apiKey = await this._resolveApiKeyAsync();
     const url = `https://apis.roblox.com/cloud/v2/universes/${universeId}/places/${placeId}/versions/${placeVersion}/luau-execution-session-tasks`;
 

package/src/utils/sourcemap/sourcemap-loader.ts

@@ -4,17 +4,16 @@ import type { SourcemapNode } from './sourcemap-types.js';
 import { SourcemapResolver } from './sourcemap-resolver.js';
 
 /**
- * Try to load a `SourcemapResolver` from `sourcemap.json` in the given
- * directory.
+ * Try to load a `SourcemapResolver` for `repoRoot`, from its `sourcemap.json`
+ * unless another file is given.
  *
  * Returns `undefined` if the file doesn't exist or can't be parsed — callers
  * should fall back to heuristic resolution.
  */
 export function tryLoadSourcemapResolver(
-  repoRoot: string
+  repoRoot: string,
+  sourcemapPath = path.join(repoRoot, 'sourcemap.json')
 ): SourcemapResolver | undefined {
-  const sourcemapPath = path.join(repoRoot, 'sourcemap.json');
-
   let content: string;
   try {
     content = fs.readFileSync(sourcemapPath, 'utf-8');
@@ -22,12 +21,11 @@ export function tryLoadSourcemapResolver(
     return undefined;
   }
 
-  let root: SourcemapNode;
+  // A fork's build supplies this file, so a malformed tree is not fatal.
   try {
-    root = JSON.parse(content) as SourcemapNode;
+    const root = JSON.parse(content) as SourcemapNode;
+    return SourcemapResolver.fromSourcemap(root, repoRoot);
   } catch {
     return undefined;
   }
-
-  return SourcemapResolver.fromSourcemap(root, repoRoot);
 }

package/src/utils/testing/batch-run.e2e.test.ts

@@ -142,6 +142,7 @@ class FakeTransport implements JobContext {
   public scriptContent?: string;
   public scriptContents: string[] = [];
   public deployedPaths: string[] = [];
+  public deployedTargets: unknown[] = [];
   public deployCount = 0;
   public runCount = 0;
   public messagesFor?: (script: string) => TaskLogMessage[];
@@ -160,6 +161,7 @@ class FakeTransport implements JobContext {
   ): Promise<Deployment> {
     this.deployCount++;
     this.deployedPaths.push(options.builtPlace.rbxlPath);
+    this.deployedTargets.push(options.builtPlace.target);
     return {};
   }
 
@@ -506,4 +508,44 @@ describe('an aggregated batch run, end to end', () => {
       ])
     );
   });
+
+  it('runs prebuilt places on the target it was given, without building', async () => {
+    const generate = vi.mocked(
+      (await import('./runner/combined-project-generator.js'))
+        .generateCombinedProjectAsync
+    );
+    generate.mockClear();
+    const { targets } = createBatch();
+    const transport = new FakeTransport(TASK_MESSAGES);
+    const cleanupAsync = vi.fn(async () => {});
+    const batch = new BatchScriptJobContext(transport, targets, {
+      repoRoot: '/repo',
+      batchPlaceId: 900,
+      batchUniverseId: 901,
+      prebuilt: {
+        chunks: [
+          {
+            rbxlPath: '/bundle/place-1.rbxl',
+            slugMap: SLUG_MAP,
+            sizeBytes: 1024,
+          },
+        ],
+        buildContext: { cleanupAsync } as any,
+      },
+    });
+
+    const alpha = await runPackageAsync(batch, '@quenty/alpha');
+    const beta = await runPackageAsync(batch, '@quenty/beta');
+
+    expect(generate).not.toHaveBeenCalled();
+    expect(transport.deployedPaths).toEqual(['/bundle/place-1.rbxl']);
+    expect(transport.deployedTargets).toEqual([
+      { placeId: 900, universeId: 901, project: '' },
+    ]);
+    expect(alpha.success).toBe(true);
+    expect(beta.success).toBe(false);
+
+    await batch.disposeAsync();
+    expect(cleanupAsync).toHaveBeenCalledOnce();
+  });
 });

package/src/utils/testing/runner/prebuilt-batch-bundle.test.ts

@@ -0,0 +1,272 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+import { Header } from 'tar';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import {
+  type PrebuiltBatchBundle,
+  readPrebuiltBatchBundleAsync,
+  writePrebuiltBatchBundleAsync,
+} from './prebuilt-batch-bundle.js';
+
+interface RawEntry {
+  path: string;
+  body?: string;
+  type?: 'File' | 'SymbolicLink' | 'Directory';
+  linkpath?: string;
+}
+
+function rawTar(entries: RawEntry[]): Buffer {
+  const blocks: Buffer[] = [];
+  for (const entry of entries) {
+    const body = Buffer.from(entry.body ?? '');
+    const header = new Header({
+      path: entry.path,
+      type: entry.type ?? 'File',
+      linkpath: entry.linkpath,
+      size: entry.type && entry.type !== 'File' ? 0 : body.length,
+      mode: 0o644,
+      mtime: new Date(0),
+    });
+    header.encode();
+    blocks.push(header.block!);
+    if (!entry.type || entry.type === 'File') {
+      const padded = Buffer.alloc(Math.ceil(body.length / 512) * 512);
+      body.copy(padded);
+      blocks.push(padded);
+    }
+  }
+  blocks.push(Buffer.alloc(1024));
+  return Buffer.concat(blocks);
+}
+
+function validManifest(): any {
+  return {
+    formatVersion: 1,
+    chunks: [
+      {
+        file: 'place-1.rbxl',
+        packages: [
+          { name: '@quenty/rx', slug: 'rx', hasJestConfig: true },
+          { name: '@quenty/maid', slug: 'maid', hasJestConfig: false },
+        ],
+      },
+    ],
+  };
+}
+
+describe('prebuilt batch bundle', () => {
+  let workDir: string;
+  const opened: PrebuiltBatchBundle[] = [];
+
+  beforeEach(async () => {
+    workDir = await fs.mkdtemp(path.join(os.tmpdir(), 'prebuilt-bundle-'));
+  });
+
+  afterEach(async () => {
+    for (const bundle of opened.splice(0)) {
+      await bundle.buildContext.cleanupAsync();
+    }
+    await fs.rm(workDir, { recursive: true, force: true });
+  });
+
+  async function readAsync(file: string) {
+    const bundle = await readPrebuiltBatchBundleAsync(file);
+    opened.push(bundle);
+    return bundle;
+  }
+
+  async function writeRawAsync(entries: RawEntry[]): Promise<string> {
+    const file = path.join(workDir, 'raw.nevermore.tests.tar');
+    await fs.writeFile(file, rawTar(entries));
+    return file;
+  }
+
+  async function writeManifestAsync(manifest: any): Promise<string> {
+    return writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(manifest) },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+    ]);
+  }
+
+  it('round-trips places, slugs and jest.config flags through one file', async () => {
+    const source = path.join(workDir, 'source.rbxl');
+    await fs.writeFile(source, 'place bytes');
+    const file = path.join(workDir, 'out', 'pr-1.nevermore.tests.tar');
+    await writePrebuiltBatchBundleAsync(
+      file,
+      [
+        {
+          rbxlPath: source,
+          slugMap: new Map([
+            ['@quenty/rx', 'rx'],
+            ['@quenty/maid', 'maid'],
+          ]),
+          sizeBytes: 11,
+        },
+      ],
+      new Map([['@quenty/rx', true]])
+    );
+
+    const bundle = await readAsync(file);
+
+    expect(bundle.packages).toEqual([
+      { name: '@quenty/rx', hasJestConfig: true },
+      { name: '@quenty/maid', hasJestConfig: false },
+    ]);
+    expect(bundle.chunks).toHaveLength(1);
+    expect(bundle.chunks[0]!.sizeBytes).toBe(11);
+    expect([...bundle.chunks[0]!.slugMap]).toEqual([
+      ['@quenty/rx', 'rx'],
+      ['@quenty/maid', 'maid'],
+    ]);
+    expect(await fs.readFile(bundle.chunks[0]!.rbxlPath, 'utf-8')).toBe(
+      'place bytes'
+    );
+  });
+
+  it('reads an empty bundle as no packages', async () => {
+    const file = path.join(workDir, 'empty.nevermore.tests.tar');
+    await writePrebuiltBatchBundleAsync(file, [], new Map());
+
+    const bundle = await readAsync(file);
+
+    expect(bundle.packages).toEqual([]);
+    expect(bundle.chunks).toEqual([]);
+  });
+
+  it('removes the unpacked places on cleanup', async () => {
+    const bundle = await readPrebuiltBatchBundleAsync(
+      await writeManifestAsync(validManifest())
+    );
+    const placePath = bundle.chunks[0]!.rbxlPath;
+
+    await bundle.buildContext.cleanupAsync();
+
+    await expect(fs.stat(placePath)).rejects.toThrow();
+  });
+
+  it('never writes outside its own directory for an entry that escapes', async () => {
+    const file = await writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(validManifest()) },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+      { path: '../escaped.rbxl', body: 'evil' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow('unexpected entry');
+    await expect(
+      fs.stat(path.join(os.tmpdir(), 'escaped.rbxl'))
+    ).rejects.toThrow();
+  });
+
+  it('rejects a symlink entry', async () => {
+    const file = await writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(validManifest()) },
+      { path: 'place-1.rbxl', type: 'SymbolicLink', linkpath: '/etc/passwd' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow('not a regular file');
+  });
+
+  it('rejects a place the manifest does not list', async () => {
+    const file = await writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(validManifest()) },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+      { path: 'place-2.rbxl', body: 'extra' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow('every place it holds');
+  });
+
+  it('rejects a manifest that lists a place the bundle does not hold', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].file = 'place-2.rbxl';
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'invalid place file'
+    );
+  });
+
+  it('rejects a file that is not a tar', async () => {
+    const file = path.join(workDir, 'junk.nevermore.tests.tar');
+    await fs.writeFile(file, 'not a tar at all');
+
+    await expect(readAsync(file)).rejects.toThrow();
+  });
+
+  it('rejects a slug that could break out of the batch script', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].packages[0].slug = 'rx"]] print("hi") --';
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'invalid slug'
+    );
+  });
+
+  it('accepts a multi-place target name with a free-form place name', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].packages[0].name = '@quenty/rx - Hub (Test) + Lobby é';
+
+    const bundle = await readAsync(await writeManifestAsync(manifest));
+
+    expect(bundle.packages[0]!.name).toBe('@quenty/rx - Hub (Test) + Lobby é');
+  });
+
+  it.each([
+    '@quenty/rx | injected',
+    '@quenty/rx<img>',
+    '@quenty/rx\nline',
+    '@quenty/rx [Approved](https://evil.example)',
+    '@quenty/rx ![x](p.png)',
+    '@quenty/rx cc @someuser',
+    '@quenty/rx https://evil.example',
+  ])(
+    'rejects a package name that could break the PR comment: %j',
+    async (name) => {
+      const manifest = validManifest();
+      manifest.chunks[0].packages[0].name = name;
+
+      await expect(
+        readAsync(await writeManifestAsync(manifest))
+      ).rejects.toThrow('invalid package name');
+    }
+  );
+
+  it('rejects a package listed twice', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].packages[1].name = '@quenty/rx';
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'more than once'
+    );
+  });
+
+  it('rejects an unknown format version', async () => {
+    const manifest = validManifest();
+    manifest.formatVersion = 2;
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'Unsupported bundle format'
+    );
+  });
+
+  it('names the right command for a deploy bundle, before its unexpected entries', async () => {
+    const file = await writeRawAsync([
+      {
+        path: 'manifest.json',
+        body: JSON.stringify({
+          formatVersion: 1,
+          kind: 'deploy',
+          target: 'integration',
+          places: [],
+        }),
+      },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+      { path: 'project-1.json', body: '{}' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow(
+      'This is a deploy bundle, not a tests bundle. Run it with "nevermore batch deploy --bundle <file>".'
+    );
+  });
+});