evolcore 0.0.29 → 0.0.30

package/dist/trigger/script-executor.js

@@ -1,5 +1,7 @@
 import { spawn } from 'child_process';
+import { buildTriggerScriptLaunch } from './script-sandbox.js';
 import { previewText, resolveScriptPath, sha256, } from './validation.js';
+const MAX_SCRIPT_OUTPUT_BYTES = 1 * 1024 * 1024;
 export class TriggerScriptExecutor {
     async execute(input) {
         const script = input.trigger.execution.type === 'script'
@@ -19,6 +21,9 @@ export class TriggerScriptExecutor {
                 },
             };
         }
+        if (input.signal?.aborted) {
+            return this.errorResult(Date.now(), Buffer.alloc(0), Buffer.alloc(0), 'SCRIPT_ABORTED', 'script was aborted', 130);
+        }
         const scriptAbs = resolveScriptPath(input.triggerDir, script.path);
         const timeoutMs = script.timeoutMs ?? 30_000;
         const scriptArgs = Array.isArray(script.args) ? script.args.map(arg => String(arg)) : [];
@@ -38,72 +43,157 @@ export class TriggerScriptExecutor {
             },
             args: script.args ?? {},
         };
-        return await this.spawnProcess(script.runtime, [scriptAbs, ...scriptArgs], JSON.stringify(payload), timeoutMs, input.signal);
+        let launch;
+        try {
+            launch = buildTriggerScriptLaunch({
+                trigger: input.trigger,
+                triggerDir: input.triggerDir,
+                scriptPath: scriptAbs,
+                scriptArgs,
+                projectPath: input.projectPath,
+                executionAuthorization: input.executionAuthorization,
+            });
+            await launch.prepare?.(input.signal);
+        }
+        catch (error) {
+            try {
+                launch?.cleanup?.();
+            }
+            catch { }
+            if (input.signal?.aborted) {
+                return this.errorResult(Date.now(), Buffer.alloc(0), Buffer.alloc(0), 'SCRIPT_ABORTED', 'script was aborted', 130);
+            }
+            return this.errorResult(Date.now(), Buffer.alloc(0), Buffer.alloc(0), 'SCRIPT_SANDBOX_UNAVAILABLE', error?.message || String(error), 126);
+        }
+        return await this.spawnProcess(launch, JSON.stringify(payload), timeoutMs, input.signal);
     }
-    spawnProcess(command, args, stdin, timeoutMs, signal) {
+    spawnProcess(launch, stdin, timeoutMs, signal) {
         const startedAt = Date.now();
+        if (signal?.aborted) {
+            try {
+                launch.cleanup?.();
+            }
+            catch { }
+            return Promise.resolve(this.errorResult(startedAt, Buffer.alloc(0), Buffer.alloc(0), 'SCRIPT_ABORTED', 'script was aborted', 130));
+        }
         return new Promise((resolve) => {
             let stdout = Buffer.alloc(0);
             let stderr = Buffer.alloc(0);
             let settled = false;
             let timedOut = false;
             let aborted = false;
-            const cmd = command === 'node' ? process.execPath : command;
-            const child = spawn(cmd, args, {
-                stdio: ['pipe', 'pipe', 'pipe'],
-                shell: false,
-                windowsHide: process.platform === 'win32',
-                env: process.env,
-            });
+            let outputLimitReached = false;
+            let terminationTimer;
+            let child;
+            let timer;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                if (terminationTimer)
+                    clearTimeout(terminationTimer);
+                signal?.removeEventListener('abort', abortHandler);
+                try {
+                    launch.cleanup?.();
+                }
+                catch { }
+                resolve(result);
+            };
             const abortHandler = () => {
                 aborted = true;
-                child.kill('SIGTERM');
-                setTimeout(() => {
-                    if (!settled)
-                        child.kill('SIGKILL');
-                }, 2_000).unref();
+                terminateProcessTree(child, true);
             };
+            try {
+                child = spawn(launch.command, launch.args, {
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                    shell: false,
+                    windowsHide: process.platform === 'win32',
+                    windowsVerbatimArguments: launch.windowsVerbatimArguments,
+                    cwd: launch.cwd,
+                    env: launch.env,
+                    detached: process.platform !== 'win32',
+                });
+            }
+            catch (error) {
+                try {
+                    launch.cleanup?.();
+                }
+                catch { }
+                resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_SPAWN_ERROR', error?.message || String(error), 127));
+                return;
+            }
+            if (!child.stdout || !child.stderr || !child.stdin) {
+                terminateProcessTree(child, true);
+                try {
+                    launch.cleanup?.();
+                }
+                catch { }
+                resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_SPAWN_ERROR', 'script process pipes are unavailable', 127));
+                return;
+            }
+            const childStdout = child.stdout;
+            const childStderr = child.stderr;
+            const childStdin = child.stdin;
             if (signal) {
                 if (signal.aborted)
                     abortHandler();
                 else
                     signal.addEventListener('abort', abortHandler, { once: true });
             }
-            const timer = setTimeout(() => {
-                timedOut = true;
-                child.kill('SIGTERM');
-                setTimeout(() => {
+            const requestTermination = (reason) => {
+                if (timedOut || outputLimitReached || aborted)
+                    return;
+                if (reason === 'timeout')
+                    timedOut = true;
+                if (reason === 'output')
+                    outputLimitReached = true;
+                terminateProcessTree(child, false);
+                terminationTimer = setTimeout(() => {
                     if (!settled)
-                        child.kill('SIGKILL');
-                }, 2_000).unref();
-            }, timeoutMs);
+                        terminateProcessTree(child, true);
+                }, 1_000);
+                terminationTimer.unref();
+            };
+            timer = setTimeout(() => requestTermination('timeout'), timeoutMs);
             timer.unref();
-            child.stdout.on('data', (chunk) => { stdout = Buffer.concat([stdout, Buffer.from(chunk)]); });
-            child.stderr.on('data', (chunk) => { stderr = Buffer.concat([stderr, Buffer.from(chunk)]); });
-            child.on('error', (err) => {
-                if (settled)
+            const appendOutput = (target, chunk) => {
+                const remaining = MAX_SCRIPT_OUTPUT_BYTES - stdout.length - stderr.length;
+                if (remaining <= 0) {
+                    requestTermination('output');
                     return;
-                settled = true;
-                clearTimeout(timer);
-                signal?.removeEventListener('abort', abortHandler);
-                resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_SPAWN_ERROR', err.message, 127));
+                }
+                const accepted = chunk.subarray(0, remaining);
+                if (target === 'stdout')
+                    stdout = Buffer.concat([stdout, accepted]);
+                else
+                    stderr = Buffer.concat([stderr, accepted]);
+                if (accepted.length < chunk.length) {
+                    requestTermination('output');
+                }
+            };
+            childStdout.on('data', (chunk) => appendOutput('stdout', Buffer.from(chunk)));
+            childStderr.on('data', (chunk) => appendOutput('stderr', Buffer.from(chunk)));
+            child.on('error', (err) => {
+                finish(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_SPAWN_ERROR', err.message, 127));
             });
             child.on('close', (code, closeSignal) => {
                 if (settled)
                     return;
-                settled = true;
-                clearTimeout(timer);
-                signal?.removeEventListener('abort', abortHandler);
                 if (aborted) {
-                    resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_ABORTED', 'script was aborted', code ?? 130));
+                    finish(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_ABORTED', 'script was aborted', code ?? 130));
                     return;
                 }
                 if (timedOut) {
-                    resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_TIMEOUT', `script timed out after ${timeoutMs}ms`, code ?? 124));
+                    finish(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_TIMEOUT', `script timed out after ${timeoutMs}ms`, code ?? 124));
+                    return;
+                }
+                if (outputLimitReached) {
+                    finish(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_OUTPUT_LIMIT', `script output exceeded ${MAX_SCRIPT_OUTPUT_BYTES} bytes`, code ?? 1));
                     return;
                 }
-                if ((code ?? 0) !== 0) {
-                    resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_EXIT_NON_ZERO', `script exited with code ${code ?? `signal ${closeSignal}`}`, code ?? 1));
+                if (code !== 0) {
+                    finish(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_EXIT_NON_ZERO', `script exited with code ${code ?? `signal ${closeSignal}`}`, code ?? 1));
                     return;
                 }
                 const text = stdout.toString('utf-8').trim();
@@ -115,10 +205,10 @@ export class TriggerScriptExecutor {
                     }
                 }
                 catch (err) {
-                    resolve(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_RESULT_PARSE_ERROR', err?.message || String(err), 1));
+                    finish(this.errorResult(startedAt, stdout, stderr, 'SCRIPT_RESULT_PARSE_ERROR', err?.message || String(err), 1));
                     return;
                 }
-                resolve({
+                finish({
                     exitCode: 0,
                     durationMs: Date.now() - startedAt,
                     stdoutBytes: stdout.length,
@@ -130,7 +220,8 @@ export class TriggerScriptExecutor {
                     result,
                 });
             });
-            child.stdin.end(stdin);
+            childStdin.on('error', () => { });
+            childStdin.end(stdin);
         });
     }
     errorResult(startedAt, stdout, stderr, code, message, exitCode) {
@@ -154,3 +245,49 @@ export class TriggerScriptExecutor {
         };
     }
 }
+function terminateProcessTree(child, force) {
+    if (!child.pid)
+        return;
+    if (process.platform === 'win32') {
+        const taskkill = process.env.SystemRoot
+            ? `${process.env.SystemRoot}\\System32\\taskkill.exe`
+            : 'taskkill.exe';
+        const args = ['/pid', String(child.pid), '/t', ...(force ? ['/f'] : [])];
+        const killer = spawn(taskkill, args, {
+            stdio: 'ignore',
+            windowsHide: true,
+        });
+        killer.on('error', () => {
+            try {
+                child.kill('SIGKILL');
+            }
+            catch { }
+        });
+        killer.on('close', code => {
+            if (force || code === 0)
+                return;
+            const forceKiller = spawn(taskkill, ['/pid', String(child.pid), '/t', '/f'], {
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            forceKiller.on('error', () => {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { }
+            });
+            forceKiller.unref();
+        });
+        killer.unref();
+        return;
+    }
+    try {
+        process.kill(-(child.pid), force ? 'SIGKILL' : 'SIGTERM');
+    }
+    catch {
+        try {
+            child.kill(force ? 'SIGKILL' : 'SIGTERM');
+        }
+        catch { }
+    }
+}