@specific.dev/spectest 0.91.2 → 0.92.1

package/src/daemon.ts

@@ -1,3 +1,4 @@
+import { generateHostCert as mintHostCert } from "./harness/certificate.js";
 import { componentBuildTasks, COMPONENT_RUNTIME } from "./harness/component-images.js";
 import { waitForAll } from "./harness/concurrency.js";
 import { androidScope, androidRecordingChunk, releaseAndroidRecording, isAndroidApp, type AndroidRecording } from "./android.js";
@@ -89,7 +90,7 @@ import {
   serviceDockerignore as composeServiceDockerignore,
   unionDockerignore,
 } from "./harness/build-context.js";
-import { validateServiceGraph as validateGraph } from "./harness/service-graph.js";
+import { startServices } from "./harness/service-graph.js";
 import {
   casesMetadata as catalogueCases,
   groupsMetadata as catalogueGroups,
@@ -103,7 +104,9 @@ import {
   sanitizeSegment,
 } from "./harness/volume-paths.js";
 import { pollUntilReady } from "./harness/ready-poll.js";
-import { fsUsageDiagnostics, runWrapperRules } from "./harness/wrapper-rules.js";
+import { fsUsageDiagnostics } from "./harness/wrapper-rules.js";
+import { runTypecheck, type TypecheckReport } from "./harness/typecheck.js";
+import { evaluateChecked } from "./harness/eval-typecheck.js";
 import type { WrapperDiagnostic } from "./harness/wrapper-rules.js";
 import { cpus, tmpdir } from "node:os";
 import { APP_DIR, WORKSPACE, resolveExistingProjectPath, resolveProjectPath, takeProjectReads } from "./project-files.js";
@@ -1857,35 +1860,6 @@ async function withContainerPostMortem(name: string, err: unknown): Promise<unkn
   }
 }
 
-/** Validate the `dependsOn` graph and return the name→service map used to
- *  walk it. Rules live in `harness/service-graph.ts`. */
-function validateServiceGraph(services: NamedService[]): Map<string, NamedService> {
-  return validateGraph(services);
-}
-
-async function startServices(
-  services: NamedService[],
-  startOne: (svc: NamedService) => Promise<void>,
-): Promise<void> {
-  const byName = validateServiceGraph(services);
-  const started = new Map<string, Promise<void>>();
-  const start = (svc: NamedService): Promise<void> => {
-    const existing = started.get(svc.name);
-    if (existing) return existing;
-    const p = (async () => {
-      await Promise.all(
-        (svc.dependsOn ?? [])
-          .filter((d) => byName.has(d))
-          .map((d) => start(byName.get(d)!)),
-      );
-      await startOne(svc);
-    })();
-    started.set(svc.name, p);
-    return p;
-  };
-  await Promise.all(services.map(start));
-}
-
 // ────────────────────────────────────────────────────────────────────────
 // Ingress — in-daemon HTTP/HTTPS listeners that route by Host header.
 //
@@ -2055,72 +2029,6 @@ function buildIngress(project: Project): void {
   }
 }
 
-/**
- * Generate a leaf cert + key for one ingress route (fake or service
- * proxy), signed by the in-VM root CA at {CA_PATH}. SANs cover every
- * hostname the route answers to, so a client connecting with TLS
- * verifies cleanly regardless of which hostname it used. Shells out
- * to `openssl req -x509 -CA ... -CAkey ...` (OpenSSL 3.0+; Debian
- * bookworm ships 3.0.x).
- *
- * `label` is a short tag baked into the cert Subject CN and the temp
- * file names — only used for diagnostics, not for TLS verification.
- */
-async function generateHostCert(
-  label: string,
-  hostnames: string[],
-): Promise<{ cert: string; key: string }> {
-  const id = `spectest-host-${sanitizeSegment(label)}-${randomUUID().slice(0, 8)}`;
-  const keyPath = path.join("/tmp", `${id}.key`);
-  const crtPath = path.join("/tmp", `${id}.crt`);
-  const sans = hostnames.map((h) => `DNS:${h}`).join(",");
-  const args = [
-    "req",
-    "-newkey",
-    "rsa:2048",
-    "-nodes",
-    "-keyout",
-    keyPath,
-    "-out",
-    crtPath,
-    "-x509",
-    "-CA",
-    CA_PATH,
-    "-CAkey",
-    CA_KEY_PATH,
-    "-days",
-    "3650",
-    "-subj",
-    `/CN=spectest-${label}`,
-    "-addext",
-    `subjectAltName=${sans}`,
-    "-addext",
-    "basicConstraints=CA:FALSE",
-    "-addext",
-    "extendedKeyUsage=serverAuth",
-    "-addext",
-    "keyUsage=digitalSignature,keyEncipherment",
-  ];
-  const r = await shx("openssl", args, 30_000);
-  if (r.code !== 0) {
-    throw new Error(
-      `openssl req for ${label} failed (rc=${r.code}): ${r.stderr.trim() || r.stdout.trim()}`,
-    );
-  }
-  try {
-    const [cert, key] = await Promise.all([
-      fs.readFile(crtPath, "utf8"),
-      fs.readFile(keyPath, "utf8"),
-    ]);
-    return { cert, key };
-  } finally {
-    await Promise.all([
-      fs.unlink(keyPath).catch(() => {}),
-      fs.unlink(crtPath).catch(() => {}),
-    ]);
-  }
-}
-
 /** Resolve the spectest-net bridge gateway IP — the address containers
  * use to reach the VM host. Asks dockerd via the docker CLI; cached for
  * the daemon's life because the network is recreated only on reload. */
@@ -2163,7 +2071,11 @@ type Route = IngressRoute<FakeRuntime>;
  */
 const NATIVE_FETCH: typeof fetch = globalThis.fetch.bind(globalThis);
 
-/** Hop-by-hop headers per RFC 7230 §6.1 — never forwarded by a proxy. */
+/** Mint ingress and container certificates with the environment CA. */
+function generateHostCert(label: string, hostnames: string[]): Promise<{ cert: string; key: string }> {
+  return mintHostCert(label, hostnames, CA_PATH, CA_KEY_PATH);
+}
+
 async function startIngress(): Promise<void> {
   const hasIngress =
     FAKES.size > 0 ||
@@ -3517,9 +3429,13 @@ async function bootstrap(prepared?: PreparedImages): Promise<BootstrapTimings> {
   // hook's — into the boot log, so GET /boot-log can explain a slow or
   // finished boot. Restored in the finally at the end.
   const restoreBootLog = captureConsole(BOOT_LOG_SINK);
+  // One dispatcher for the whole bootstrap: service hooks run concurrently.
+  // Only each hook's async scope opts into wrapped fetch responses.
+  const restoreFetch = installFetchWrapper();
   try {
     return await bootstrapInner(prepared);
   } finally {
+    restoreFetch();
     restoreBootLog();
   }
 }
@@ -3693,20 +3609,25 @@ async function bootstrapInner(prepared?: PreparedImages, identity?: string): Pro
     await waitForAll([...builds.map(task => prep.get(task.name)!), (async () => {
       if (svc.setup) {
         progressService(svc.name, { status: "probing", detail: "running setup" });
-        const helpers = await ensureHelpers(svc.name, svc);
+        const fetchScope = createInstrumentationScope(false);
         try {
-          await svc.setup({
-            name: svc.name,
-            helpers,
-            ...(await spectestContext({ service: svc.name, includeSelf: true })),
-            ...{ [COMPONENT_RUNTIME]: {
-              images: builds.map(task => ({ source: imageTag(task.name), reference: task.reference, ready: prep.get(task.name)! })),
-              gateway: await bridgeGatewayIp(),
-              caBundle: await ensureCaBundle(),
-            } },
+          await runInstrumented(fetchScope, async () => {
+            const helpers = await ensureHelpers(svc.name, svc);
+            await svc.setup!({
+              name: svc.name,
+              helpers,
+              ...(await spectestContext({ service: svc.name, includeSelf: true })),
+              ...{ [COMPONENT_RUNTIME]: {
+                images: builds.map(task => ({ source: imageTag(task.name), reference: task.reference, ready: prep.get(task.name)! })),
+                gateway: await bridgeGatewayIp(),
+                caBundle: await ensureCaBundle(),
+              } },
+            });
           });
         } catch (err) {
           throw await withContainerPostMortem(svc.name, err);
+        } finally {
+          fetchScope.active = false;
         }
       }
     })()]);
@@ -4855,7 +4776,7 @@ async function spectestContext(scope: ContextScope = {}): Promise<SpectestContex
     exec: (service, command, opts) =>
       componentExec(service, command, opts, execTimeoutMs),
     // Read `globalThis.fetch` at call time: the wrapper is installed for
-    // the duration of a test / eval / project setup, so a context built
+    // the duration of bootstrap / a test / eval / project setup, so a context built
     // before it lands still gets the wrapped one.
     fetch: ((input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) =>
       globalThis.fetch(input, init)) as unknown as SpectestContext["fetch"],
@@ -6246,7 +6167,12 @@ async function evalCode(code: string): Promise<EvalResult> {
     filePath = path.join(EVAL_DIR, `${randomUUID()}.ts`);
     await fs.writeFile(filePath, prepared.code);
     const moduleUrl = pathToFileURL(filePath).href;
-    const mod = (await runInstrumented(fetchScope, () => import(moduleUrl))) as { default?: unknown };
+    const mod = await evaluateChecked(
+      { file: filePath, appDir: APP_DIR, typecheckDir: TYPECHECK_DIR, run: shx,
+        projectEntry: loaded ? resolveEntry() : undefined },
+      (text) => { chunks.push(text); },
+      () => runInstrumented(fetchScope, () => import(moduleUrl)) as Promise<{ default?: unknown }>,
+    );
     outcome = { ok: true, result: safeSerialize(mod.default) };
   } catch (err) {
     const e = err as Error;
@@ -6327,46 +6253,11 @@ async function evalCode(code: string): Promise<EvalResult> {
  *  blocking rules, which always use THIS copy rather than the project's own —
  *  can be driven outside a VM. */
 const TYPECHECK_DIR = process.env.SPECTEST_TYPECHECK_DIR ?? "/opt/spectest/typecheck";
-/** Cap on errors shipped in the report; `totalErrors` carries the true count. */
-const TYPECHECK_ERROR_CAP = 50;
-
-interface TypecheckError {
-  /** Path relative to the project's spectest/ dir (e.g. `tests/checkout.ts`). */
-  file: string;
-  line: number;
-  column: number;
-  /** `TS2345` from the compiler, or a `SPECTEST….` rule code. */
-  code: string;
-  message: string;
-}
-
-interface TypecheckReport {
-  status: "ok" | "errors" | "skipped" | "failed";
-  errors: TypecheckError[];
-  totalErrors: number;
-  durationMs: number;
-  /** Why the check was skipped / how it failed. */
-  detail?: string;
-  /**
-   * Findings that FAIL the run, as opposed to `errors`, which only advise.
-   * A diagnostic qualifies only when it is true of the program that runs
-   * rather than of the declared types alone — see `harness/wrapper-rules.ts`
-   * for why no `tsc` code can be in here and why these can.
-   *
-   * The list is the rollout mechanism as well as the payload: an older SDK
-   * never sends the field, `#[serde(default)]` leaves it empty on the server,
-   * and the gate is inert for every project that has not moved to a version
-   * carrying it. The version a project runs is already its own choice
-   * (`sdk.rs` honours the declared lower bound), so the bump is the consent.
-   */
-  blocking?: TypecheckError[];
-}
-
 let TYPECHECK: Promise<TypecheckReport> | null = null;
 
 /** Fire-and-forget kickoff; the promise is parked for POST /typecheck. */
 function startTypecheck(): void {
-  TYPECHECK = runTypecheck().catch((err) => ({
+  TYPECHECK = runProjectTypecheck().catch((err) => ({
     status: "failed" as const,
     errors: [],
     totalErrors: 0,
@@ -6377,149 +6268,9 @@ function startTypecheck(): void {
   TYPECHECK.catch(() => {});
 }
 
-/** The tsconfig used when the project doesn't ship its own. `lib` is left to
- *  the target default (which includes DOM — browser.evaluate callbacks
- *  reference `document`); `types` pulls Bun's ambient globals from the baked
- *  install via `typeRoots` (the walk-up from APP_DIR never reaches it). */
-function generatedTsconfig(): string {
-  return JSON.stringify(
-    {
-      compilerOptions: {
-        target: "esnext",
-        module: "esnext",
-        moduleResolution: "bundler",
-        strict: true,
-        noEmit: true,
-        skipLibCheck: true,
-        esModuleInterop: true,
-        resolveJsonModule: true,
-        jsx: "react-jsx",
-        types: ["bun"],
-        typeRoots: [
-          path.join(APP_DIR, "node_modules", "@types"),
-          path.join(TYPECHECK_DIR, "node_modules", "@types"),
-        ],
-      },
-      include: ["**/*.ts", "**/*.tsx"],
-      exclude: ["node_modules"],
-    },
-    null,
-    2,
-  );
-}
-
-/** Parse `--pretty false` tsc output: `file(line,col): error TScode: msg`,
- *  with indented elaboration lines folded into the preceding error. */
-function parseTscOutput(output: string): {
-  errors: TypecheckError[];
-  total: number;
-  suppressed: number;
-} {
-  const errors: TypecheckError[] = [];
-  let total = 0;
-  let suppressed = 0;
-  let last: TypecheckError | null = null;
-  for (const line of output.split("\n")) {
-    const m = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.*)$/.exec(line);
-    if (!m) {
-      // Elaboration lines are indented; fold them into the last kept error.
-      if (last && /^\s+\S/.test(line)) last.message += `\n${line.trimEnd()}`;
-      continue;
-    }
-    const [, rawFile, ln, col, code, message] = m;
-    // Keep only diagnostics in the user's files. tsc runs with cwd=APP_DIR
-    // (the daemon's cwd), so project files come out relative ("tests/x.ts")
-    // and anything outside — the SDK at /opt/spectest/sdk, node_modules —
-    // is `../…` or absolute. Errors in our own SDK are ours to fix, not the
-    // user's to read.
-    const abs = path.resolve(APP_DIR, rawFile!);
-    const inApp = abs.startsWith(APP_DIR + path.sep) && !abs.includes(`${path.sep}node_modules${path.sep}`);
-    if (!inApp) {
-      suppressed += 1;
-      last = null;
-      continue;
-    }
-    total += 1;
-    const err: TypecheckError = {
-      file: path.relative(APP_DIR, abs),
-      line: Number(ln),
-      column: Number(col),
-      code: code!,
-      message: message!,
-    };
-    if (errors.length < TYPECHECK_ERROR_CAP) {
-      errors.push(err);
-      last = err;
-    } else {
-      last = null;
-    }
-  }
-  return { errors, total, suppressed };
-}
-
-async function runTypecheck(): Promise<TypecheckReport> {
-  const started = Date.now();
-  // The project's own typescript wins over the baked copy.
-  const tsc = [
-    path.join(APP_DIR, "node_modules", "typescript", "bin", "tsc"),
-    path.join(TYPECHECK_DIR, "node_modules", "typescript", "bin", "tsc"),
-  ].find((p) => existsSync(p));
-  if (!tsc) {
-    return {
-      status: "skipped",
-      errors: [],
-      totalErrors: 0,
-      durationMs: 0,
-      detail: "typescript is not installed (base image predates the baked typechecker)",
-    };
-  }
-  let config = path.join(APP_DIR, "tsconfig.json");
-  if (!existsSync(config)) {
-    config = path.join(APP_DIR, ".spectest-tsconfig.json");
-    await fs.writeFile(config, generatedTsconfig());
-  }
-  const res = await shx(process.execPath, [tsc, "--noEmit", "--pretty", "false", "-p", config], 120_000);
-  const durationMs = Date.now() - started;
-  if (res.code === 124) {
-    return { status: "failed", errors: [], totalErrors: 0, durationMs, detail: "typecheck timed out" };
-  }
-  const { errors, total, suppressed } = parseTscOutput(res.stdout + res.stderr);
-  const wrapper = [...(await runWrapperRulesReport(config)), ...(await rawFsReport())];
-  const strip = ({ file, line, column, code, message }: WrapperDiagnostic): TypecheckError => ({
-    file,
-    line,
-    column,
-    code,
-    message,
-  });
-  const blocking = wrapper.filter((d) => d.blocking).map(strip);
-  const advisory = wrapper.filter((d) => !d.blocking).map(strip);
-  if (errors.length === 0 && wrapper.length === 0) {
-    // Exit 0 → clean. Non-zero with no *user-file* diagnostics is either
-    // all-suppressed (still ok from the user's perspective) or a compiler
-    // crash (config not found, OOM) — surface the latter.
-    if (res.code !== 0 && suppressed === 0) {
-      const tail = (res.stderr || res.stdout).trim().split("\n").slice(-5).join("\n");
-      return { status: "failed", errors: [], totalErrors: 0, durationMs, detail: tail || `tsc exited ${res.code}` };
-    }
-    if (suppressed > 0) {
-      console.warn(`[typecheck] ${suppressed} diagnostic(s) outside the project suppressed`);
-    }
-    return { status: "ok", errors: [], totalErrors: 0, durationMs };
-  }
-  // The wrapper findings ride the same list the CLI and the dashboard already
-  // render; `blocking` is a second view of the ones that also fail the run, so
-  // nothing has to learn a new shape to show them. Blocking leads, because
-  // `errors` is capped and the entries that stopped the run must never be the
-  // ones the cap drops.
-  const all = [...blocking, ...advisory, ...errors];
-  return {
-    status: "errors",
-    errors: all.slice(0, TYPECHECK_ERROR_CAP),
-    totalErrors: total + wrapper.length,
-    durationMs,
-    ...(blocking.length > 0 ? { blocking } : {}),
-  };
+async function runProjectTypecheck(): Promise<TypecheckReport> {
+  return runTypecheck({ appDir: APP_DIR, typecheckDir: TYPECHECK_DIR, run: shx,
+    projectEntry: loaded ? resolveEntry() : undefined, extraDiagnostics: rawFsReport });
 }
 
 /**
@@ -6545,37 +6296,6 @@ async function rawFsReport(): Promise<WrapperDiagnostic[]> {
   }
 }
 
-/**
- * The blocking rules, run against the BAKED compiler whatever the project
- * pins. Best-effort in every direction: an install that predates the API, a
- * config the rules cannot open, or a throw from `typescript/unstable/*` all
- * yield no findings, so a run proceeds exactly as it does today. Only a
- * definite finding can stop one.
- */
-async function runWrapperRulesReport(config: string): Promise<WrapperDiagnostic[]> {
-  const typescriptDir = path.join(TYPECHECK_DIR, "node_modules", "typescript");
-  if (!existsSync(path.join(typescriptDir, "dist", "api", "async", "api.js"))) return [];
-  try {
-    const run = await runWrapperRules({
-      typescriptDir,
-      configFile: config,
-      appDir: APP_DIR,
-      readFile: (f) => fs.readFile(f, "utf8"),
-      relative: path.relative,
-      join: path.join,
-      dirname: path.dirname,
-    });
-    if (run.status !== "ok") {
-      console.warn(`[typecheck] wrapper rules ${run.status}: ${run.detail ?? "no detail"}`);
-      return [];
-    }
-    return run.diagnostics;
-  } catch (err) {
-    console.warn(`[typecheck] wrapper rules threw: ${(err as Error)?.message ?? err}`);
-    return [];
-  }
-}
-
 // ────────────────────────────────────────────────────────────────────────
 // HTTP server
 // ────────────────────────────────────────────────────────────────────────

package/src/harness/certificate.test.ts

@@ -0,0 +1,31 @@
+import { expect, test } from "bun:test";
+import { X509Certificate } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { generateHostCert } from "./certificate.js";
+
+test("long ingress names retain their full SAN while the diagnostic CN stays bounded", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "spectest-leaf-"));
+  const ca = join(dir, "ca.crt");
+  const key = join(dir, "ca.key");
+  try {
+    const root = Bun.spawnSync(["openssl", "req", "-x509", "-newkey", "rsa:2048",
+      "-nodes", "-days", "1", "-subj", "/CN=test-ca", "-keyout", key, "-out", ca]);
+    expect(root.exitCode, root.stderr.toString()).toBe(0);
+    // Long enough to exceed both the former CN and temporary filename limits.
+    const host = `${"a".repeat(63)}.${"b".repeat(63)}.${"c".repeat(63)}.${"d".repeat(61)}`;
+    const { cert, key: leafKey } = await generateHostCert(host, [host, "*.example.test"], ca, key);
+    const leaf = new X509Certificate(cert);
+    expect(leaf.subject.length).toBeLessThanOrEqual(67); // "CN=" + 64 bytes
+    expect(leaf.checkHost(host)).toBe(host);
+    expect(leaf.checkHost("api.example.test")).toBe("*.example.test");
+    expect(leafKey).toContain("PRIVATE KEY");
+    const file = join(dir, "leaf.crt");
+    await writeFile(file, cert);
+    const verified = Bun.spawnSync(["openssl", "verify", "-CAfile", ca, "-verify_hostname", host, file]);
+    expect(verified.exitCode, verified.stderr.toString()).toBe(0);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}, 10_000);

package/src/harness/certificate.ts

@@ -0,0 +1,73 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * Generate a leaf cert + key for one ingress route (fake or service
+ * proxy), signed by the in-VM root CA. SANs cover every
+ * hostname the route answers to, so a client connecting with TLS
+ * verifies cleanly regardless of which hostname it used. Shells out
+ * to `openssl req -x509 -CA ... -CAkey ...` (OpenSSL 3.0+; Debian
+ * bookworm ships 3.0.x).
+ *
+ * `label` is a diagnostic tag baked into the cert Subject CN and the temp
+ * file names — only used for diagnostics, not for TLS verification.
+ */
+export async function generateHostCert(
+  label: string,
+  hostnames: string[],
+  caPath: string,
+  caKeyPath: string,
+): Promise<{ cert: string; key: string }> {
+  // CN is diagnostic only; SANs retain the full hostnames. Bound the label
+  // for both OpenSSL's 64-byte CN limit and filesystem component limits.
+  const commonName = `spectest-${label.replace(/[^a-zA-Z0-9.-]/g, "_").slice(0, 55)}`;
+  const id = `${commonName}-${randomUUID()}`;
+  const keyPath = path.join("/tmp", `${id}.key`);
+  const crtPath = path.join("/tmp", `${id}.crt`);
+  const sans = hostnames.map((h) => `DNS:${h}`).join(",");
+  const args = [
+    "req",
+    "-newkey",
+    "rsa:2048",
+    "-nodes",
+    "-keyout",
+    keyPath,
+    "-out",
+    crtPath,
+    "-x509",
+    "-CA",
+    caPath,
+    "-CAkey",
+    caKeyPath,
+    "-days",
+    "3650",
+    "-subj",
+    `/CN=${commonName}`,
+    "-addext",
+    `subjectAltName=${sans}`,
+    "-addext",
+    "basicConstraints=CA:FALSE",
+    "-addext",
+    "extendedKeyUsage=serverAuth",
+    "-addext",
+    "keyUsage=digitalSignature,keyEncipherment",
+  ];
+  try {
+    await execFileAsync("openssl", args, { timeout: 30_000 });
+    const [cert, key] = await Promise.all([
+      fs.readFile(crtPath, "utf8"),
+      fs.readFile(keyPath, "utf8"),
+    ]);
+    return { cert, key };
+  } finally {
+    await Promise.all([
+      fs.unlink(keyPath).catch(() => {}),
+      fs.unlink(crtPath).catch(() => {}),
+    ]);
+  }
+}