@sproutboat/runtime 0.6.5 → 0.6.6

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @sproutboat/runtime
 
+## 0.6.6
+
+### Patch Changes
+
+- c2b0359: Fix (baronunread/sproutboat#179): `__sbEntry` called `handlers.fetch()` (and
+  the `scheduled`/`queue`/`alarm` trigger paths) with no try/catch at all. Any
+  synchronous throw, or an async handler's rejected promise, propagated all the
+  way up and took down the entire process — not just the request that hit it,
+  but every other in-flight and future request on that sprout, until whatever
+  supervises it restarts the binary.
+  
+  A throw from `fetch()` now returns a 500 instead. `scheduled()` and `alarm()`
+  still reply 204 either way (they had no failure signal before this either).
+  A throw from `queue()` falls through to the existing default-ack pass, the
+  same outcome as a handler that returns without calling `ack()`/`retry()` on
+  every message.
+  
+  `entry-crash.test.js` covers the fetch path: a sync throw, an async
+  rejection, and that a throwing request doesn't stop the next one from being
+  served.
+
 ## 0.6.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/entry-crash.test.js

@@ -0,0 +1,63 @@
+// #179 — an uncaught handler exception must turn into a 500 (or, for
+// scheduled/queue/alarm, a swallowed failure), never a process-crashing
+// throw/rejection out of __sbEntry. Same lift-the-prelude-and-eval approach
+// as client-ip.test.js: the prelude is prepended as text and cannot import.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+
+// oxlint-disable-next-line no-function-constructor -- lifting the whole text-only prelude for test
+const load = new Function(
+  "Porffor",
+  "__envMap",
+  `${src}
+   return { __sbEntry, __sbRegisterDO };`,
+);
+// Every Porffor.c`...` block in the prelude only runs inside a function body
+// (never at load time), so a no-op tag covers all of them: __sbCpuMs and
+// __sbEnv just see an empty result, same as "native op returned nothing."
+const H = load(
+  { c: () => "" },
+  new Proxy({}, { get: () => undefined }),
+);
+
+const req = (overrides = {}) => ({
+  headers: { get: (k) => (overrides.headers && overrides.headers[k.toLowerCase()]) ?? null },
+  cf: undefined,
+  ...overrides,
+});
+
+test("a synchronously-throwing fetch handler returns 500, not a throw", async () => {
+  const handlers = {
+    fetch() {
+      throw new Error("boom");
+    },
+  };
+  const res = await H.__sbEntry(handlers, req());
+  expect(res.status).toBe(500);
+});
+
+test("an async fetch handler whose promise rejects returns 500, not a rejection", async () => {
+  const handlers = {
+    async fetch() {
+      throw new Error("boom");
+    },
+  };
+  const res = await H.__sbEntry(handlers, req());
+  expect(res.status).toBe(500);
+});
+
+test("a throwing fetch handler doesn't stop the next request from being served", async () => {
+  const handlers = {
+    fetch(request) {
+      if (request.boom) throw new Error("boom");
+      return new Response("ok");
+    },
+  };
+  const first = await H.__sbEntry(handlers, req({ boom: true }));
+  expect(first.status).toBe(500);
+  const second = await H.__sbEntry(handlers, req({ boom: false }));
+  expect(await second.text()).toBe("ok");
+});

package/src/native-fetch-prelude.js

@@ -1703,15 +1703,31 @@ async function __sbDrainAll(pending) {
 // one *this* async function creates, not a `.then()` derived from someone
 // else's — see the note below on why that distinction matters here.
 async function __sbFetchWithDrain(res, tasks) {
-  const r = res && __sbIsFn(res.then) ? await res : res;
+  let r;
+  try {
+    r = res && __sbIsFn(res.then) ? await res : res;
+  } catch {
+    // #179 — a rejected handler promise must not take the process down with it.
+    r = __sbErrorResponse();
+  }
   await __sbDrainWaitUntil(tasks);
   return r;
 }
 
+// #179 — turn an uncaught handler exception into a 500 instead of letting it
+// propagate past __sbEntry and crash the whole server.
+function __sbErrorResponse() {
+  return new Response("Internal Server Error", { status: 500 });
+}
+
 // Shared by alarm and scheduled: both reply with an empty 204 once their
 // handler (and anything it queued via `waitUntil`) has settled.
 async function __sb204WithDrain(res, tasks) {
-  if (res && __sbIsFn(res.then)) await res;
+  try {
+    if (res && __sbIsFn(res.then)) await res;
+  } catch {
+    // #179 — same rule as fetch: a rejected scheduled/alarm promise must not crash the process.
+  }
   await __sbDrainWaitUntil(tasks);
   return new Response("", { status: 204 });
 }
@@ -1746,7 +1762,14 @@ globalThis.__sbEntry = function (handlers, request) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
       },
     };
-    const __res = handlers.fetch(request, ctx);
+    let __res;
+    try {
+      __res = handlers.fetch(request, ctx);
+    } catch {
+      // #179 — a synchronous throw anywhere in the handler must not take the
+      // whole process (and every other in-flight request) down with it.
+      return __sbErrorResponse();
+    }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
     if (__sbTasks.length || (__res && __sbIsFn(__res.then))) return __sbFetchWithDrain(__res, __sbTasks);
@@ -1766,10 +1789,16 @@ globalThis.__sbEntry = function (handlers, request) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
       },
     };
-    const __sres = handlers.scheduled(
-      { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} },
-      ctx,
-    );
+    let __sres;
+    try {
+      __sres = handlers.scheduled(
+        { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} },
+        ctx,
+      );
+    } catch {
+      // #179 — same rule as fetch: don't let a throw here crash the process.
+      return new Response("", { status: 204 });
+    }
     if (__sbTasks.length || (__sres && __sbIsFn(__sres.then))) return __sb204WithDrain(__sres, __sbTasks);
     return new Response("", { status: 204 });
   }
@@ -1797,7 +1826,13 @@ globalThis.__sbEntry = function (handlers, request) {
     const body = __sbReadJson(request);
     const inst = __sbGetDOInstance(String(body.cls || ""), String(body.id || ""));
     if (!__sbIsFn(inst.alarm)) return new Response("no alarm handler", { status: 404 });
-    const __ares = inst.alarm();
+    let __ares;
+    try {
+      __ares = inst.alarm();
+    } catch {
+      // #179 — same rule as fetch: don't let a throw here crash the process.
+      return new Response("", { status: 204 });
+    }
     // Was fire-and-forget before: an async `alarm()` and any `state.waitUntil()`
     // it queued were both dropped the moment 204 went out. Await both.
     if (inst.__sbTasks.length || (__ares && __sbIsFn(__ares.then))) return __sb204WithDrain(__ares, inst.__sbTasks);
@@ -1845,11 +1880,18 @@ async function __sbRunQueueBatch(handlers, body, ctx) {
       for (let i = 0; i < messages.length; i++) messages[i].retry();
     },
   };
-  const __qres = handlers.queue(batch, ctx);
-  // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
-  // the response go out) before its own `await`s did, so any ack()/retry()
-  // past the first one never counted.
-  if (__qres && __sbIsFn(__qres.then)) await __qres;
+  try {
+    const __qres = handlers.queue(batch, ctx);
+    // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
+    // the response go out) before its own `await`s did, so any ack()/retry()
+    // past the first one never counted.
+    if (__qres && __sbIsFn(__qres.then)) await __qres;
+  } catch {
+    // #179 — a throw here must not crash the process. Whatever ack()/retry()
+    // calls the handler made before throwing still count; anything it never
+    // touched falls through to the default-ack pass below, same as a handler
+    // that returns without calling ack()/retry() on every message.
+  }
   // default: any message neither acked nor retried is treated as acked
   for (let i = 0; i < messages.length; i++) {
     if (acked.indexOf(messages[i].id) === -1 && retried.indexOf(messages[i].id) === -1) acked.push(messages[i].id);