@vzn/vx 0.0.596 → 0.0.598

package/src/exec/runner.ts

@@ -4,7 +4,8 @@
 // process exits. cpuMs / peakRssBytes are then surfaced on RunResult and
 // folded into the v11 `runs` table by the orchestrator.
 
-import { existsSync, readFileSync } from 'node:fs'
+import type { Pointer } from 'bun:ffi'
+import { closeSync, existsSync, readFileSync } from 'node:fs'
 import { constants as osConstants } from 'node:os'
 import {
   shellArgv,
@@ -18,8 +19,8 @@ import {
   closeSignalChannel,
   holdGroups,
   killTree,
-  markGroupIfGone,
   releaseGroup,
+  releaseServerGroup,
   signalThrough,
   guardLine,
   spawnGuarded,
@@ -98,11 +99,164 @@ export interface RunOptions {
   terminal?: boolean
 }
 
+type Fd = 'inherit' | 'ignore' | 'pipe' | number
+
 /** A child's descriptors 0–2: vx's own for a task that holds the terminal. */
-function taskStdio(terminal: boolean | undefined, stdin: 'ignore' | 'pipe') {
-  return terminal === true
-    ? (['inherit', 'inherit', 'inherit'] as const)
-    : ([stdin, 'pipe', 'pipe'] as const)
+function taskStdio(
+  terminal: boolean | undefined,
+  stdin: 'ignore' | 'pipe',
+  pipes: TaskPipes,
+): [Fd, Fd, Fd] {
+  return terminal === true ? ['inherit', 'inherit', 'inherit'] : [stdin, ...pipes.stdio]
+}
+
+const O_NONBLOCK = 0o4000
+const O_CLOEXEC = 0o2000000
+const F_SETFL = 4
+const F_SETPIPE_SZ = 1031
+/**
+ * A pipe holds 64 KiB by default, and a 200 MB stdout drained 13% slower
+ * through one than through Bun's socketpair (min of 7: 293 vs 259 ms);
+ * at 256 KiB it drained in 230. Past the user's pipe quota the kernel
+ * refuses the resize and the pipe keeps its 64 KiB.
+ */
+const PIPE_BYTES = 256 * 1024
+
+type PipeCalls = {
+  pipe2: (fds: Pointer, flags: number) => number
+  fcntl: (fd: number, cmd: number, arg: number) => number
+  ptr: (view: Int32Array, byteOffset?: number) => Pointer
+}
+let pipeCalls: PipeCalls | null | undefined
+
+/** libc's `pipe2` and `fcntl`, bound once; null off Linux or where libc will not load. */
+function linuxPipeCalls(): PipeCalls | null {
+  if (pipeCalls !== undefined) return pipeCalls
+  pipeCalls = null
+  if (process.platform !== 'linux') return null
+  try {
+    // Loaded at the first spawn, not with the module: a static import cost
+    // every vx start 0.3 ms, a warm run that spawns nothing included.
+    const { dlopen, FFIType, ptr } = require('bun:ffi') as typeof import('bun:ffi')
+    // glibc's soname; musl's loader answers any `libc.` name with itself
+    // (ldso/dynlink.c's reserved names).
+    const { symbols } = dlopen('libc.so.6', {
+      pipe2: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
+      fcntl: { args: [FFIType.i32, FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+    })
+    pipeCalls = { pipe2: symbols.pipe2, fcntl: symbols.fcntl, ptr }
+  } catch {
+    // Bun's socketpair, as before: only `/dev/stdout` by path fails on it.
+  }
+  return pipeCalls
+}
+
+/**
+ * Two pipes, `[out read, out write, err read, err write]`, or undefined
+ * when libc is not bound or a descriptor is not to be had (Bun's own
+ * socketpair then fails the spawn with the reason).
+ */
+function realPipes(): Int32Array | undefined {
+  const calls = linuxPipeCalls()
+  if (calls === null) return undefined
+  const fds = new Int32Array(4)
+  // Bun's spawn closes every descriptor it is not handed (probed, Bun
+  // 1.4.2); O_CLOEXEC keeps any other exec from holding a write end open.
+  if (calls.pipe2(calls.ptr(fds), O_CLOEXEC) !== 0) return undefined
+  if (calls.pipe2(calls.ptr(fds, 8), O_CLOEXEC) !== 0) {
+    closeSync(fds[0]!)
+    closeSync(fds[1]!)
+    return undefined
+  }
+  // vx's ends only: a task whose stdout is non-blocking fails its writes with EAGAIN.
+  calls.fcntl(fds[0]!, F_SETFL, O_NONBLOCK)
+  calls.fcntl(fds[2]!, F_SETFL, O_NONBLOCK)
+  calls.fcntl(fds[0]!, F_SETPIPE_SZ, PIPE_BYTES)
+  calls.fcntl(fds[2]!, F_SETPIPE_SZ, PIPE_BYTES)
+  return fds
+}
+
+/**
+ * A task's stdout and stderr. Bun's `'pipe'` is a socketpair, and Linux
+ * opens `/dev/stdout` through `/proc/self/fd/1`, which a socket refuses
+ * (ENXIO): `echo x > /dev/stdout` and `cmd | tee /dev/stderr` failed in
+ * every task, where a terminal or Turbo hands real pipes (X-113). So on
+ * Linux vx makes the pipes (`pipe2` through `bun:ffi`) and hands the child
+ * the write ends. macOS opens `/dev/fd/N` as a dup of the descriptor,
+ * which a socket allows, so Bun's pipe stays there.
+ */
+export class TaskPipes {
+  /** Descriptors 1 and 2 for `Bun.spawn`'s `stdio`. */
+  readonly stdio: readonly [number | 'pipe', number | 'pipe']
+  readonly #read: readonly number[]
+
+  constructor(terminal?: boolean) {
+    const fds = terminal === true ? undefined : realPipes()
+    this.stdio = fds === undefined ? ['pipe', 'pipe'] : [fds[1]!, fds[3]!]
+    this.#read = fds === undefined ? [] : [fds[0]!, fds[2]!]
+  }
+
+  /**
+   * Close vx's copies of the write ends once the spawn has returned or
+   * thrown: the child holds its own, and one left here is a writer the
+   * reader's EOF would wait for.
+   */
+  spawned(): void {
+    for (const fd of this.stdio) if (typeof fd === 'number') closeSync(fd)
+  }
+
+  /** The child's stdout and stderr. */
+  streams(
+    child: ReturnType<typeof Bun.spawn>,
+  ): [
+    ReadableStream<Uint8Array> | number | undefined,
+    ReadableStream<Uint8Array> | number | undefined,
+  ] {
+    const [out, err] = this.#read
+    return out === undefined
+      ? [child.stdout, child.stderr]
+      : [Bun.file(out).stream(), Bun.file(err!).stream()]
+  }
+
+  /**
+   * Close the read ends, once both streams have ended or been cancelled.
+   * Bun reads a dup of each, but takes it on the stream's first pull: a
+   * number closed before then was reused by the next spawn's pipe, and
+   * the stream read THAT (probed, Bun 1.4.2).
+   */
+  close(): void {
+    for (const fd of this.#read) closeSync(fd)
+  }
+}
+
+/**
+ * Read the terminal's modes before a task that holds it runs, and return
+ * what puts them back once it exits: a task killed in raw mode (or one
+ * that never undid its `stty raw -echo`) left the user's terminal with no
+ * echo and no Ctrl-C. Bun restores them at exit only when vx's stdout is
+ * the terminal, so `vx run … > log` kept them, and the rest of a run
+ * printed in them. `detached`, as the task is: a vx in a background job
+ * would be stopped by SIGTTOU on the set.
+ */
+function keepTerminalModes(): (() => void) | undefined {
+  const saved = stty('-g')
+  if (saved === undefined) return undefined
+  return () => {
+    if (stty('-g') !== saved) stty(saved)
+  }
+}
+
+function stty(arg: string): string | undefined {
+  try {
+    const out = Bun.spawnSync(['stty', arg], {
+      stdio: ['inherit', 'pipe', 'ignore'],
+      detached: true,
+    })
+    return out.success ? out.stdout.toString().trim() : undefined
+  } catch {
+    // No stty: the modes stay the task's, as before.
+    return undefined
+  }
 }
 
 export function shellQuote(arg: string): string {
@@ -485,12 +639,14 @@ const READY_MATCH_WINDOW_CHARS = 64 * 1024
 
 /**
  * Terminal escapes a `readyWhen` pattern is matched without: CSI (colour,
- * cursor), OSC (titles, links) and the two-byte forms. Vite under
+ * cursor), OSC (titles, links), charset picks (`tput sgr0` writes
+ * `\x1b(B\x1b[m`) and the two-byte forms. Vite under
  * `FORCE_COLOR` prints `\x1b[1mLocal\x1b[22m:`, which `Local:` never matched
  * (item 1059). The streamed bytes keep them; only the tested text drops them.
  */
-// eslint-disable-next-line no-control-regex -- ESC is the point
-const TERMINAL_ESCAPE_RE = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g
+const TERMINAL_ESCAPE_RE =
+  // eslint-disable-next-line no-control-regex -- ESC is the point
+  /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[ -/]+[0-~]|[@-Z\\-_])/g
 
 /**
  * Why a persistent task never became ready — the reason every label and
@@ -566,6 +722,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const readyRe = opts.readyWhen !== undefined ? new RegExp(opts.readyWhen) : undefined
 
   let child: ReturnType<typeof Bun.spawn>
+  const pipes = new TaskPipes(opts.terminal)
+  const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     const signalFd = opts.signalChannel === true
     child = spawnGuarded((guard) =>
@@ -586,7 +744,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
           // The one-shot spawn below keeps 'ignore', so a task that reads
           // stdin can never hang CI.
           stdio: [
-            ...taskStdio(opts.terminal, 'pipe'),
+            ...taskStdio(opts.terminal, 'pipe', pipes),
             ...(signalFd ? ['pipe' as const] : []),
             ...(guard === undefined ? [] : [guard]),
           ],
@@ -597,12 +755,14 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
         },
       ),
     )
+    if (restoreModes !== undefined) void child.exited.then(restoreModes)
     if (signalFd) {
       signalThrough(child, child.stdio[3] as number)
       const spawned = child
       void spawned.exited.then(() => closeSignalChannel(spawned))
     }
   } catch (err) {
+    pipes.close()
     const message = err instanceof Error ? err.message : String(err)
     return {
       child: undefined as unknown as ReturnType<typeof Bun.spawn>,
@@ -611,6 +771,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
       ),
       readyMs: () => Date.now() - start,
     }
+  } finally {
+    pipes.spawned()
   }
 
   let resolveReady!: () => void
@@ -621,7 +783,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   })
 
   const markReady = (): void => {
-    if (readyAt === undefined) {
+    // A marker printed on the way down, once the wait gave up, is not ready.
+    if (readyAt === undefined && gaveUpAt === undefined) {
       readyAt = Date.now()
       if (readyTimer !== undefined) clearTimeout(readyTimer)
       resolveReady()
@@ -703,46 +866,50 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
 
   // Wire up readers. We deliberately don't await them — they run for
   // the child's lifetime. The `ready` promise resolves out-of-band.
-  void consumeChunks(child.stdout, false)
-  void consumeChunks(child.stderr, true)
+  const [stdout, stderr] = pipes.streams(child)
+  void Promise.all([consumeChunks(stdout, false), consumeChunks(stderr, true)]).finally(() =>
+    pipes.close(),
+  )
 
   opts.liveChildren?.add(child)
   opts.onSpawn?.(child.pid)
 
-  // Readiness deadline. Reject FIRST so the failure reads as a
-  // timeout, then SIGTERM — the exit handler's later reject is a
-  // no-op on the settled promise. Cleared the moment ready fires so
-  // a healthy server is never killed by a stale timer.
+  // Readiness deadline: SIGTERM, wait the grace for the GROUP, SIGKILL
+  // what is left, and only then reject. The caller's teardown used to
+  // signal the group again a turn after this SIGTERM, and a server whose
+  // handler is a one-shot (`process.once('SIGTERM')`, a trap that resets
+  // itself) died on the second mid-cleanup. Cleared the moment ready
+  // fires so a healthy server is never killed by a stale timer.
   let readyTimer: ReturnType<typeof setTimeout> | undefined
   if (readyRe && opts.timeoutMs !== undefined) {
-    const giveUp = (): void => {
-      if (readyAt === undefined) {
-        gaveUpAt = Date.now()
-        rejectReady(
-          new PersistentReadyError(
-            `persistent task not ready within ${opts.timeoutMs}ms — ` +
-              `readyWhen pattern never matched; child killed`,
-            'timeout',
-          ),
-        )
-        // Listed on the group guard until the SIGKILL: the shell may die
-        // on the SIGTERM and let the group go while the server runs out
-        // the grace, and a vx that exits inside it (the timer is unref'd)
-        // leaves the server to the guard (kill-tree.ts, item 865).
-        const letGo = holdGroups([child])
+    const giveUp = async (): Promise<void> => {
+      if (readyAt !== undefined) return
+      gaveUpAt = Date.now()
+      // Listed on the group guard until the SIGKILL: the shell may die on
+      // the SIGTERM and let the group go while the server runs out the
+      // grace, and a vx killed inside it leaves the server to the guard
+      // (kill-tree.ts, item 865).
+      const letGo = holdGroups([child])
+      try {
         killTree(child, 'SIGTERM')
-        // Same escalation as `armTimeout`: a server that traps TERM and
-        // never became ready is not in the persistent registry, so nothing
-        // else would ever kill it — it outlived the run under init.
-        const killTimer = setTimeout(() => {
-          killTree(child, 'SIGKILL')
-          letGo()
-        }, killGraceMs(TIMEOUT_SIGKILL_GRACE_MS))
-        killTimer.unref?.()
+        // A server that traps TERM and never became ready is not in the
+        // persistent registry, so nothing else would ever kill it.
+        const left = await untilGroupsGone([child], killGraceMs(TIMEOUT_SIGKILL_GRACE_MS))
+        for (const c of left) killTree(c, 'SIGKILL')
+        await child.exited
+      } finally {
+        letGo()
       }
+      rejectReady(
+        new PersistentReadyError(
+          `persistent task not ready within ${opts.timeoutMs}ms — ` +
+            `readyWhen pattern never matched; child killed`,
+          'timeout',
+        ),
+      )
     }
     readyTimer = setTimeout(() => {
-      readyTimer = afterPendingExits(giveUp)
+      readyTimer = afterPendingExits(() => void giveUp())
     }, opts.timeoutMs)
   }
 
@@ -750,10 +917,9 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   // — reject the ready promise so the caller can surface it.
   void child.exited.then((code) => {
     opts.liveChildren?.delete(child)
-    markGroupIfGone(child)
-    releaseGroup(child)
+    releaseServerGroup(child)
     if (readyTimer !== undefined) clearTimeout(readyTimer)
-    if (readyAt === undefined) {
+    if (readyAt === undefined && gaveUpAt === undefined) {
       rejectReady(
         new PersistentReadyError(
           `persistent task exited before becoming ready (exit ${code ?? '?'})` +
@@ -798,13 +964,18 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   const fullCommand = withForwardArgs(opts.command, opts.forwardArgs)
 
   let proc: ReturnType<typeof Bun.spawn>
+  const pipes = new TaskPipes(opts.terminal)
+  const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     proc = spawnGuarded((guard) =>
       Bun.spawn(shellArgv((guard === undefined ? '' : guardLine(3)) + execWrap(fullCommand)), {
         ...SH_ARGV0,
         cwd: opts.cwd,
         env: opts.env as Record<string, string>,
-        stdio: [...taskStdio(opts.terminal, 'ignore'), ...(guard === undefined ? [] : [guard])],
+        stdio: [
+          ...taskStdio(opts.terminal, 'ignore', pipes),
+          ...(guard === undefined ? [] : [guard]),
+        ],
         // Its own session and process group, so a kill reaches what it
         // forked (kill-tree.ts). A terminal handed over is not this
         // session's controlling one, so no read stops the group.
@@ -812,19 +983,23 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
       }),
     )
   } catch (err) {
+    pipes.close()
     const stderr = spawnFailureText(err, opts.cwd)
     opts.onStderr?.(stderr)
     return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr, spawnFailed: true }
+  } finally {
+    pipes.spawned()
   }
 
   opts.liveChildren?.add(proc)
   opts.onSpawn?.(proc.pid)
   const timeout = armTimeout(proc, opts.timeoutMs)
   const ac = new AbortController()
+  const [out, err] = pipes.streams(proc)
   const streams = Promise.all([
-    streamToString(proc.stdout, opts.onStdout, ac.signal, opts.capture?.stdout ?? true),
-    streamToString(proc.stderr, opts.onStderr, ac.signal, opts.capture?.stderr ?? true),
-  ])
+    streamToString(out, opts.onStdout, ac.signal, opts.capture?.stdout ?? true),
+    streamToString(err, opts.onStderr, ac.signal, opts.capture?.stderr ?? true),
+  ]).finally(() => pipes.close())
   // Gate on the child's own exit, not on stream EOF: an orphaned grandchild
   // can keep the pipe open past the child's exit (a timeout SIGTERM leaves the
   // grandchild alive; a NORMAL exit of `server & echo up` does too), so EOF may
@@ -832,6 +1007,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   // lets a clean exit EOF immediately and only cuts off a stuck reader after a
   // brief grace — without this the run hangs forever.
   await proc.exited
+  restoreModes?.()
   await timeout.settle()
   let cut = false
   if (timeout.timedOut()) ac.abort()

package/src/exec/sandbox-paths.ts

@@ -27,6 +27,17 @@ export function isMountableLiteral(grant: string): boolean {
   return !MOUNT_WILDCARDS.test(grant)
 }
 
+/**
+ * The one path a grant names, or undefined for a pattern. A grant whose
+ * only brackets are escaped (`out/\[id\]`) names `out/[id]` as surely as a
+ * literal does, though it is still scanned and matched as a glob.
+ */
+export function namedPath(grant: string): string | undefined {
+  if (isMountableLiteral(grant)) return grant
+  const escaped = /\\([[\]])/g
+  return isMountableLiteral(grant.replace(escaped, '')) ? grant.replace(escaped, '$1') : undefined
+}
+
 /**
  * Canonicalize a path with realpath, tolerating paths that don't exist
  * yet: resolve the longest existing ancestor and re-append the rest.