amsd-pipeline-shared 0.5.28 → 0.5.29

package/orchestrations/scripts/lib/prelaunch.js

@@ -173,6 +173,35 @@ function codelineSets({ install, project, codelines = [], env = {} }) {
   } finally { if (prev === undefined) delete process.env.EPAM_BROWNFIELD; else process.env.EPAM_BROWNFIELD = prev; }
 }
 
+// ── 3b. permissions ─────────────────────────────────────────────────────────────────────────────────────────────
+/**
+ * THE RUN CAN WRITE WHAT IT COPIES (operator, 2026-10-23: "Add permissions check to pre-launch checks"; live run 13 died on EACCES — the
+ * install's codeline sets are locked read-only and the run's copies kept that mode). A trial copy of the install's project (as a run takes
+ * it: without runs/ and prompts/) is made with the launch's OWN copy function into a probe folder, and every copied path must be writable;
+ * and a run folder the launch reuses (a retry) must hold nothing the run cannot write over — every path owned by the user the launch runs as
+ * (the run makes its own paths writable as it clears them; one another user owns, it cannot). No copy function given: not checked — RED.
+ */
+function permissions({ install, project, runDir, copy, uid = process.getuid() }) {
+  if (typeof copy !== 'function') return res('permissions', false, 'not checked: the launch gave no copy function — what the run copies cannot be proven writable');
+  const notWritable = (root) => { const bad = []; const walk = (p) => { let st; try { st = fs.lstatSync(p); } catch { return; } if (st.isSymbolicLink()) return;
+    try { fs.accessSync(p, fs.constants.W_OK); } catch { bad.push(p); } if (st.isDirectory()) { let es = []; try { es = fs.readdirSync(p); } catch { bad.push(p); } for (const n of es) walk(path.join(p, n)); } };
+    walk(root); return bad; };
+  const src = path.join(orchOf(install), 'projects', project);
+  const probe = fs.mkdtempSync(path.join(os.tmpdir(), 'prelaunch-permissions-'));
+  let copied = [];
+  try {
+    for (const n of fs.readdirSync(src)) if (n !== 'runs' && n !== 'prompts') copy(path.join(src, n), path.join(probe, n));
+    copied = notWritable(probe).map((p) => path.relative(probe, p));
+  } catch (e) { copied = [`the trial copy failed: ${e.message}`]; }
+  finally { spawnSync('chmod', ['-R', 'u+rwX', probe]); fs.rmSync(probe, { recursive: true, force: true }); }
+  const notOwned = (root) => { const bad = []; const walk = (p) => { let st; try { st = fs.lstatSync(p); } catch { return; } if (st.uid !== uid) bad.push(p);
+    if (st.isDirectory() && !st.isSymbolicLink()) { let es = []; try { es = fs.readdirSync(p); } catch { return; } for (const n of es) walk(path.join(p, n)); } }; walk(root); return bad; };
+  const left = runDir && fs.existsSync(runDir) ? notOwned(runDir).map((p) => path.relative(runDir, p) || '.') : [];
+  const why = [copied.length && `${copied.length} copied path(s) not writable: ${copied.slice(0, 5).join(', ')}`,
+    left.length && `the run folder holds ${left.length} path(s) another user owns — the run cannot write over them: ${left.slice(0, 5).join(', ')}`].filter(Boolean).join('; ');
+  return res('permissions', !why, why || `the launch's copy of ${project} is writable, and the run folder holds nothing another user owns`, { copied, left });
+}
+
 // ── 4. cost ──────────────────────────────────────────────────────────────────────────────────────────────────────────
 /** Every model a provider set's ladders name (startModel, model, models, from/to), from its own declaration. */
 function ladderModels(install, set) {
@@ -295,6 +324,7 @@ function prelaunch(o) {
   // the variant (brownfield) is the run's, from the env the launch hands over — not this process's own environment
   if (o.codeline) results.push(cache({ install: o.install, project: o.project, codeline: o.codeline, variant: (o.env || {}).EPAM_BROWNFIELD === '1' ? 'brownfield' : '', maxRebuild: o.maxRebuild || 0 }));
   if (Array.isArray(o.codelines)) results.push(codelineSets({ install: o.install, project: o.project, codelines: o.codelines, env: o.env || {} }));
+  if (o.copy) results.push(permissions({ install: o.install, project: o.project, runDir: o.runDir, copy: o.copy }));
   results.push(cost({ install: o.install, set: o.set || o.env.EPAM_PROVIDER_SET || 'claude', tmpDir: o.outDir }));
   results.push(alone({ install: o.install }));
   results.push(memory({ needMb: Number(o.needMb || 4096) }));
@@ -307,7 +337,7 @@ function prelaunch(o) {
   return report;
 }
 
-module.exports = { prelaunch, prelaunchCli, preflight, langfuse, langfuseEnv, seed, cache, codelineSets, cost, ladderModels, alone, memory, noTimeout, checklist, ancestors };
+module.exports = { prelaunch, prelaunchCli, preflight, langfuse, langfuseEnv, seed, cache, codelineSets, permissions, cost, ladderModels, alone, memory, noTimeout, checklist, ancestors };
 
 /**
  * THE COMMAND, for every pipeline:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amsd-pipeline-shared",
-  "version": "0.5.28",
+  "version": "0.5.29",
   "description": "The AMSD pipeline's shared components, one source for the bash pipeline and its Claude workflows: the model-call gateway (llm-handler.sh — retry, ladder, self-heal, cost) and the libraries it runs.",
   "license": "UNLICENSED",
   "bin": {