@validate.qa/runner 1.0.96 → 1.0.98

package/dist/{chunk-2BYRCDXC.mjs → chunk-J4ST6MFT.mjs}

@@ -9220,7 +9220,6 @@ var require_repo_acquire = __commonJS({
     var MAX_TAR_BYTES_AFTER_END = 1024 * 1024;
     var TAR_OVERHEAD_PER_ENTRY = 4096;
     var TAR_OVERHEAD_BASE = 16 * 1024 * 1024;
-    var TAR_COUNTED_TYPES = /* @__PURE__ */ new Set(["File", "OldFile", "ContiguousFile", "Directory", "GNUDumpDir"]);
     function refuseNestedGzip() {
       let head = Buffer.alloc(0);
       return new node_stream_1.Transform({
@@ -9284,7 +9283,7 @@ var require_repo_acquire = __commonJS({
           bad = new Error(`Tar entry too large: ${shownPath} (declared ${size} bytes > ${limits.maxFileBytes} cap)`);
         } else if ((declaredTotal += size) > limits.maxTotalBytes) {
           bad = new Error(`Tar total uncompressed size exceeds ${limits.maxTotalBytes} cap (tar-bomb guard)`);
-        } else if (TAR_COUNTED_TYPES.has(String(entry.type)) && !isUnsafeEntryName(path) && ++entries > limits.maxEntries) {
+        } else if (++entries > limits.maxEntries) {
           bad = new Error(`Tar has too many entries: > ${limits.maxEntries} cap`);
         }
         if (bad)
@@ -9430,11 +9429,22 @@ var require_tar_isolated = __commonJS({
   "../runner-core/dist/services/tar-isolated.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.TAR_ISOLATED_MAX_CHILDREN_PER_TENANT = exports.TAR_ISOLATED_MAX_CHILDREN = exports.TarIsolationError = exports.TarIsolationUnavailableError = exports.TAR_ISOLATION_UNAVAILABLE_MESSAGE = exports.TAR_CHILD_MARKER_ENV = exports.TAR_ISOLATED_MAX_OLD_SPACE_MB = exports.TAR_ISOLATED_TIMEOUT_MS = void 0;
+    exports.IsolationSlots = exports.SlotPool = exports.ISOLATED_MIN_CHILD_HEAP_MB = exports.ISOLATED_MEMORY_MARGIN_MB = exports.TAR_ISOLATED_MAX_CHILDREN_PER_TENANT = exports.TAR_ISOLATED_MAX_CHILDREN = exports.ISOLATED_MAX_CHILDREN = exports.TarIsolationError = exports.TarIsolationUnavailableError = exports.TAR_ISOLATION_UNAVAILABLE_MESSAGE = exports.TAR_CHILD_MARKER_ENV = exports.TAR_ISOLATED_MAX_OLD_SPACE_MB = exports.TAR_ISOLATED_TIMEOUT_MS = void 0;
+    exports.isolatedChildEnv = isolatedChildEnv;
     exports.tarChildEnv = tarChildEnv;
+    exports.resolveIsolatedChildEntry = resolveIsolatedChildEntry;
     exports.resolveTarChildEntry = resolveTarChildEntry;
+    exports.deriveIsolatedChildBudget = deriveIsolatedChildBudget;
+    exports.deriveMaxIsolatedChildren = deriveMaxIsolatedChildren;
+    exports.effectiveChildHeapMb = effectiveChildHeapMb;
+    exports.envHeapCap = envHeapCap;
+    exports.readMemoryLimitBytes = readMemoryLimitBytes;
+    exports.isolatedChildBudget = isolatedChildBudget;
+    exports.maxIsolatedChildren = maxIsolatedChildren;
     exports.tarIsolationLoad = tarIsolationLoad;
+    exports.isolationLoad = isolationLoad;
     exports.runTarJobIsolated = runTarJobIsolated;
+    exports.runIsolatedJob = runIsolatedJob;
     exports.extractTarGzIsolated = extractTarGzIsolated;
     exports.extractZipIsolated = extractZipIsolated;
     exports.slimRepoArchiveIsolated = slimRepoArchiveIsolated;
@@ -9442,8 +9452,10 @@ var require_tar_isolated = __commonJS({
     var node_child_process_1 = __require("child_process");
     var node_fs_1 = __require("fs");
     var promises_1 = __require("fs/promises");
+    var node_os_1 = __require("os");
     var node_path_1 = __require("path");
     var node_url_1 = __require("url");
+    var node_v8_1 = __require("v8");
     var repo_acquire_js_1 = require_repo_acquire();
     exports.TAR_ISOLATED_TIMEOUT_MS = 5 * 60 * 1e3;
     exports.TAR_ISOLATED_MAX_OLD_SPACE_MB = 512;
@@ -9472,23 +9484,26 @@ var require_tar_isolated = __commonJS({
       const n = Number(process.env[name]);
       return Number.isSafeInteger(n) && n > 0 ? n : fallback;
     }
-    function tarChildEnv(source = process.env) {
+    function isolatedChildEnv(markerEnv, source = process.env) {
       const env = {};
       for (const key of CHILD_ENV_ALLOWLIST) {
         const value = source[key];
         if (typeof value === "string")
           env[key] = value;
       }
-      env[exports.TAR_CHILD_MARKER_ENV] = "1";
+      env[markerEnv] = "1";
       return env;
     }
-    function resolveTarChildEntry() {
-      if (typeof __dirname !== "string")
+    function tarChildEnv(source = process.env) {
+      return isolatedChildEnv(exports.TAR_CHILD_MARKER_ENV, source);
+    }
+    function resolveIsolatedChildEntry(dir, basename) {
+      if (typeof dir !== "string")
         return null;
-      const js = (0, node_path_1.join)(__dirname, `${CHILD_BASENAME}.js`);
+      const js = (0, node_path_1.join)(dir, `${basename}.js`);
       if ((0, node_fs_1.existsSync)(js))
         return { file: js, execArgv: [] };
-      const ts = (0, node_path_1.join)(__dirname, `${CHILD_BASENAME}.ts`);
+      const ts = (0, node_path_1.join)(dir, `${basename}.ts`);
       if (!(0, node_fs_1.existsSync)(ts))
         return null;
       try {
@@ -9497,10 +9512,76 @@ var require_tar_isolated = __commonJS({
         return null;
       }
     }
-    exports.TAR_ISOLATED_MAX_CHILDREN = 2;
+    function resolveTarChildEntry() {
+      return resolveIsolatedChildEntry(typeof __dirname === "string" ? __dirname : void 0, CHILD_BASENAME);
+    }
+    exports.ISOLATED_MAX_CHILDREN = 2;
+    exports.TAR_ISOLATED_MAX_CHILDREN = exports.ISOLATED_MAX_CHILDREN;
     exports.TAR_ISOLATED_MAX_CHILDREN_PER_TENANT = 1;
-    function maxChildren() {
-      return positiveIntEnv("REPO_ARCHIVE_EXTRACT_MAX_CHILDREN", exports.TAR_ISOLATED_MAX_CHILDREN);
+    exports.ISOLATED_MEMORY_MARGIN_MB = 256;
+    exports.ISOLATED_MIN_CHILD_HEAP_MB = 256;
+    var MB = 1024 * 1024;
+    function deriveIsolatedChildBudget(input) {
+      const freeMb = (input.memoryLimitBytes - input.heapLimitBytes) / MB - (input.marginMb ?? exports.ISOLATED_MEMORY_MARGIN_MB);
+      const fit = Math.floor(freeMb / Math.max(1, input.childHeapMb));
+      if (Number.isFinite(fit) && fit >= 1)
+        return { children: Math.min(exports.ISOLATED_MAX_CHILDREN, fit), heapLimitMb: null };
+      return { children: 1, heapLimitMb: Math.max(exports.ISOLATED_MIN_CHILD_HEAP_MB, Number.isFinite(freeMb) ? Math.floor(freeMb) : 0) };
+    }
+    function deriveMaxIsolatedChildren(input) {
+      return deriveIsolatedChildBudget(input).children;
+    }
+    function effectiveChildHeapMb(cap, budget) {
+      if (cap.fromEnv || budget.heapLimitMb === null)
+        return cap.mb;
+      return Math.min(cap.mb, budget.heapLimitMb);
+    }
+    function envHeapCap(name, fallback) {
+      const n = Number(process.env[name]);
+      return Number.isSafeInteger(n) && n > 0 ? { mb: n, fromEnv: true } : { mb: fallback, fromEnv: false };
+    }
+    function readMemoryLimitBytes(read = (path) => (0, node_fs_1.readFileSync)(path, "utf8"), total = node_os_1.totalmem) {
+      try {
+        const raw = read("/sys/fs/cgroup/memory.max").trim();
+        const limit = Number(raw);
+        if (raw !== "max" && Number.isSafeInteger(limit) && limit > 0)
+          return Math.min(limit, total());
+      } catch {
+      }
+      return total();
+    }
+    var memoryLimitCache;
+    var childHeapCaps = /* @__PURE__ */ new Set();
+    function isolatedChildBudget() {
+      const override = Number(process.env.ISOLATED_CHILDREN_MAX ?? process.env.REPO_ARCHIVE_EXTRACT_MAX_CHILDREN);
+      if (Number.isSafeInteger(override) && override > 0)
+        return { children: override, heapLimitMb: null };
+      memoryLimitCache ??= readMemoryLimitBytes();
+      let childHeapMb = 0;
+      for (const cap of childHeapCaps)
+        childHeapMb = Math.max(childHeapMb, cap().mb);
+      return deriveIsolatedChildBudget({
+        memoryLimitBytes: memoryLimitCache,
+        heapLimitBytes: (0, node_v8_1.getHeapStatistics)().heap_size_limit,
+        childHeapMb: childHeapMb || exports.TAR_ISOLATED_MAX_OLD_SPACE_MB
+      });
+    }
+    function maxIsolatedChildren() {
+      return isolatedChildBudget().children;
+    }
+    var heapReductionLogged = false;
+    function childHeapMbFor(slots, log) {
+      const cap = slots.heapCap();
+      const budget = isolatedChildBudget();
+      const mb = effectiveChildHeapMb(cap, budget);
+      if (mb < cap.mb && !heapReductionLogged) {
+        heapReductionLogged = true;
+        const floored = budget.heapLimitMb === exports.ISOLATED_MIN_CHILD_HEAP_MB ? ` (the ${exports.ISOLATED_MIN_CHILD_HEAP_MB} MB floor: the ${exports.ISOLATED_MEMORY_MARGIN_MB} MB margin is not fully kept)` : "";
+        const line = `[isolated-child] isolated child heap reduced to ${mb} MB to fit memory${floored}; set ISOLATED_CHILDREN_MAX or the kind's heap env knob to override`;
+        console.warn(line);
+        log?.(line);
+      }
+      return mb;
     }
     var SlotPool = class {
       capacity;
@@ -9542,31 +9623,59 @@ var require_tar_isolated = __commonJS({
           this.inUse -= 1;
       }
     };
-    var globalSlots = new SlotPool(maxChildren);
-    var tenantSlots = /* @__PURE__ */ new Map();
-    function tenantPool(key) {
-      let pool = tenantSlots.get(key);
-      if (!pool) {
-        pool = new SlotPool(() => exports.TAR_ISOLATED_MAX_CHILDREN_PER_TENANT);
-        tenantSlots.set(key, pool);
-      }
-      return pool;
-    }
-    function releaseTenant(key, pool) {
-      pool.release();
-      if (pool.inUse === 0 && pool.queued === 0 && tenantSlots.get(key) === pool)
-        tenantSlots.delete(key);
-    }
+    exports.SlotPool = SlotPool;
+    var processSlots = new SlotPool(maxIsolatedChildren);
+    var IsolationSlots = class {
+      perTenant;
+      heapCap;
+      global = processSlots;
+      /** Per-tenant pools, created on demand and dropped when idle. */
+      tenants = /* @__PURE__ */ new Map();
+      /** This kind's children still running. */
+      live = /* @__PURE__ */ new Set();
+      constructor(perTenant, heapCap) {
+        this.perTenant = perTenant;
+        this.heapCap = heapCap;
+        childHeapCaps.add(heapCap);
+      }
+      tenantPool(key) {
+        let pool = this.tenants.get(key);
+        if (!pool) {
+          pool = new SlotPool(() => this.perTenant);
+          this.tenants.set(key, pool);
+        }
+        return pool;
+      }
+      /** Drop an idle tenant pool (after a release, or a wait that gave up). */
+      forgetIfIdle(key, pool) {
+        if (pool.inUse === 0 && pool.queued === 0 && this.tenants.get(key) === pool)
+          this.tenants.delete(key);
+      }
+      releaseTenant(key, pool) {
+        pool.release();
+        this.forgetIfIdle(key, pool);
+      }
+      /** This kind's live children, process-wide slots held and waiting, and this kind's jobs waiting behind their own tenant. */
+      load() {
+        let tenantQueued = 0;
+        for (const pool of this.tenants.values())
+          tenantQueued += pool.queued;
+        return { children: this.live.size, slots: this.global.inUse, queued: this.global.queued, tenantQueued };
+      }
+    };
+    exports.IsolationSlots = IsolationSlots;
+    var tarSlots = new IsolationSlots(exports.TAR_ISOLATED_MAX_CHILDREN_PER_TENANT, () => envHeapCap("REPO_ARCHIVE_EXTRACT_MAX_OLD_SPACE_MB", exports.TAR_ISOLATED_MAX_OLD_SPACE_MB));
     function tarIsolationLoad() {
-      let tenantQueued = 0;
-      for (const pool of tenantSlots.values())
-        tenantQueued += pool.queued;
-      return { children: liveChildren.size, slots: globalSlots.inUse, queued: globalSlots.queued, tenantQueued };
+      return tarSlots.load();
+    }
+    function isolationLoad() {
+      return { children: liveChildren.size, slots: processSlots.inUse, queued: processSlots.queued };
     }
     var liveChildren = /* @__PURE__ */ new Set();
     var exitHookInstalled = false;
-    function trackChild(child) {
+    function trackChild(child, slots) {
       liveChildren.add(child);
+      slots.live.add(child);
       if (exitHookInstalled)
         return;
       exitHookInstalled = true;
@@ -9575,6 +9684,23 @@ var require_tar_isolated = __commonJS({
           c.kill("SIGKILL");
       });
     }
+    function untrackChild(child, slots) {
+      liveChildren.delete(child);
+      slots.live.delete(child);
+    }
+    var TAR_CHILD_SPEC = {
+      name: CHILD_BASENAME,
+      dir: typeof __dirname === "string" ? __dirname : void 0,
+      resolveEntry: resolveTarChildEntry,
+      markerEnv: exports.TAR_CHILD_MARKER_ENV,
+      slots: tarSlots,
+      defaultTimeoutMs: () => positiveIntEnv("REPO_ARCHIVE_EXTRACT_TIMEOUT_MS", exports.TAR_ISOLATED_TIMEOUT_MS),
+      failureMessage: (subject, detail) => `CONFIG_ISSUE: The ${subject} couldn't be unpacked (${detail}).`,
+      workerName: "archive extractor",
+      childName: "extractor",
+      jobName: "extraction",
+      logPrefix: "[tar-isolated]"
+    };
     function jobCwd(job) {
       switch (job.op) {
         case "extract":
@@ -9588,58 +9714,64 @@ var require_tar_isolated = __commonJS({
       }
     }
     function runTarJobIsolated(job, subject, options = {}) {
-      return runJob(job, subject, options, true);
+      return runJob(TAR_CHILD_SPEC, job, subject, { ...options, cwd: jobCwd(job) }, true);
+    }
+    function runIsolatedJob(spec, job, subject, options = {}) {
+      return runJob(spec, job, subject, options, true);
     }
-    async function runJob(job, subject, options, limited) {
-      const entry = options.testChildFile === void 0 ? resolveTarChildEntry() : options.testChildFile && (0, node_fs_1.existsSync)(options.testChildFile) ? { file: options.testChildFile, execArgv: [] } : null;
+    async function runJob(spec, job, subject, options, limited) {
+      const entry = options.testChildFile === void 0 ? spec.resolveEntry() : options.testChildFile && (0, node_fs_1.existsSync)(options.testChildFile) ? { file: options.testChildFile, execArgv: [] } : null;
       if (!entry)
-        throw new TarIsolationUnavailableError(`${CHILD_BASENAME}.js was not found beside ${typeof __dirname === "string" ? __dirname : "this module"}`);
-      const abortError = () => Object.assign(new Error(`Extraction of the ${subject} was stopped`), { name: "AbortError" });
+        throw new TarIsolationUnavailableError(`${spec.name}.js was not found beside ${spec.dir ?? "this module"}`);
+      const jobTitle = spec.jobName.charAt(0).toUpperCase() + spec.jobName.slice(1);
+      const abortError = () => Object.assign(new Error(`${jobTitle} of the ${subject} was stopped`), { name: "AbortError" });
       if (options.signal?.aborted)
         throw abortError();
-      const timeoutMs = options.timeoutMs ?? positiveIntEnv("REPO_ARCHIVE_EXTRACT_TIMEOUT_MS", exports.TAR_ISOLATED_TIMEOUT_MS);
-      const maxOldSpaceMb = options.maxOldSpaceMb ?? positiveIntEnv("REPO_ARCHIVE_EXTRACT_MAX_OLD_SPACE_MB", exports.TAR_ISOLATED_MAX_OLD_SPACE_MB);
-      const failure = (reason, detail) => new TarIsolationError(reason, `CONFIG_ISSUE: The ${subject} couldn't be unpacked (${detail}).${options.hint ? ` ${options.hint}` : ""}`);
+      const timeoutMs = options.timeoutMs ?? spec.defaultTimeoutMs();
+      const maxOldSpaceMb = options.maxOldSpaceMb ?? childHeapMbFor(spec.slots, options.log);
+      const failure = (reason, detail) => new TarIsolationError(reason, `${spec.failureMessage(subject, detail)}${options.hint ? ` ${options.hint}` : ""}`);
       if (!limited)
-        return runChild(job, entry, timeoutMs, maxOldSpaceMb, options, failure, abortError);
-      const deadline = Date.now() + timeoutMs;
+        return runChild(spec, job, entry, timeoutMs, maxOldSpaceMb, options, failure, abortError);
+      const queueMs = options.queueTimeoutMs ?? timeoutMs;
+      const deadline = Date.now() + queueMs;
       const queueTimeout = () => {
-        const err = failure("timeout", `no archive extractor was free within ${Math.round(timeoutMs / 1e3)} s`);
-        options.log?.(`[tar-isolated] ${err.message}`);
+        const detail = `no ${spec.workerName} was free within ${Math.round(queueMs / 1e3)} s`;
+        const err = spec.busyMessage ? new TarIsolationError("timeout", spec.busyMessage(subject, detail)) : failure("timeout", detail);
+        options.log?.(`${spec.logPrefix} ${err.message}`);
         return err;
       };
-      const tenant = options.tenantKey ? { key: options.tenantKey, pool: tenantPool(options.tenantKey) } : null;
+      const { slots } = spec;
+      const tenant = options.tenantKey ? { key: options.tenantKey, pool: slots.tenantPool(options.tenantKey) } : null;
       if (tenant) {
-        const got = await tenant.pool.acquire(timeoutMs, options.signal);
+        const got = await tenant.pool.acquire(queueMs, options.signal);
         if (got !== "ok") {
-          if (tenant.pool.inUse === 0 && tenant.pool.queued === 0)
-            tenantSlots.delete(tenant.key);
+          slots.forgetIfIdle(tenant.key, tenant.pool);
           throw got === "aborted" ? abortError() : queueTimeout();
         }
       }
       let holdsGlobal = false;
       try {
-        const got = await globalSlots.acquire(deadline - Date.now(), options.signal);
+        const got = await slots.global.acquire(deadline - Date.now(), options.signal);
         if (got !== "ok")
           throw got === "aborted" ? abortError() : queueTimeout();
         holdsGlobal = true;
         if (options.signal?.aborted)
           throw abortError();
-        return await runChild(job, entry, timeoutMs, maxOldSpaceMb, options, failure, abortError);
+        return await runChild(spec, job, entry, timeoutMs, maxOldSpaceMb, options, failure, abortError);
       } finally {
         if (holdsGlobal)
-          globalSlots.release();
+          slots.global.release();
         if (tenant)
-          releaseTenant(tenant.key, tenant.pool);
+          slots.releaseTenant(tenant.key, tenant.pool);
       }
     }
-    function runChild(job, entry, timeoutMs, maxOldSpaceMb, options, failure, abortError) {
+    function runChild(spec, job, entry, timeoutMs, maxOldSpaceMb, options, failure, abortError) {
       return new Promise((resolvePromise, rejectPromise) => {
         let child;
         try {
           child = (0, node_child_process_1.spawn)(process.execPath, [...entry.execArgv, `--max-old-space-size=${maxOldSpaceMb}`, entry.file], {
-            cwd: jobCwd(job),
-            env: tarChildEnv(),
+            cwd: options.cwd,
+            env: isolatedChildEnv(spec.markerEnv),
             stdio: ["ignore", "ignore", "pipe", "ipc"],
             serialization: "json",
             windowsHide: true
@@ -9648,7 +9780,7 @@ var require_tar_isolated = __commonJS({
           rejectPromise(new TarIsolationUnavailableError(err instanceof Error ? err.message : String(err)));
           return;
         }
-        trackChild(child);
+        trackChild(child, spec.slots);
         let started = false;
         let timedOut = false;
         let aborted = false;
@@ -9672,7 +9804,7 @@ var require_tar_isolated = __commonJS({
           settled = true;
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", onAbort);
-          liveChildren.delete(child);
+          untrackChild(child, spec.slots);
           fn();
         };
         child.stderr?.setEncoding("utf8");
@@ -9715,18 +9847,18 @@ var require_tar_isolated = __commonJS({
             }
             const tail = stderr.trim();
             if (tail)
-              options.log?.(`[tar-isolated] extractor stderr: ${tail.replace(/\s+/g, " ").slice(-1e3)}`);
+              options.log?.(`${spec.logPrefix} ${spec.childName} stderr: ${tail.replace(/\s+/g, " ").slice(-1e3)}`);
             let err;
             if (timedOut) {
-              err = failure("timeout", `extraction took longer than ${Math.round(timeoutMs / 1e3)} s and was stopped`);
+              err = failure("timeout", `${spec.jobName} took longer than ${Math.round(timeoutMs / 1e3)} s and was stopped`);
             } else if (outOfMemory) {
-              err = failure("oom", `extraction ran out of memory (${maxOldSpaceMb} MB heap cap)`);
+              err = failure("oom", `${spec.jobName} ran out of memory (${maxOldSpaceMb} MB heap cap)`);
             } else if (signal) {
-              err = failure("signal", `the extractor was killed by ${signal}`);
+              err = failure("signal", `the ${spec.childName} was killed by ${signal}`);
             } else {
-              err = failure("crash", `the extractor crashed (exit code ${code ?? "unknown"})`);
+              err = failure("crash", `the ${spec.childName} crashed (exit code ${code ?? "unknown"})`);
             }
-            options.log?.(`[tar-isolated] ${err.message}`);
+            options.log?.(`${spec.logPrefix} ${err.message}`);
             rejectPromise(err);
           });
         });
@@ -9784,7 +9916,7 @@ var require_tar_isolated = __commonJS({
     }
     async function probeTarIsolation(options = {}) {
       try {
-        await runJob({ op: "ping" }, "archive", { timeoutMs: options.timeoutMs ?? 3e4 }, false);
+        await runJob(TAR_CHILD_SPEC, { op: "ping" }, "archive", { timeoutMs: options.timeoutMs ?? 3e4 }, false);
         return { ok: true, detail: `archives are extracted in a separate process (${resolveTarChildEntry()?.file ?? "unknown"})` };
       } catch (err) {
         return { ok: false, detail: err instanceof Error ? err.message : String(err) };