owlrunkit 0.18.2 → 0.18.4

package/scripts/runkit-contract/quick-metrics.mjs

@@ -59,7 +59,7 @@ function trustedReceiptRoot(workspaceRoot) {
   return { status: "valid", root };
 }
 
-export function readLocalQuickMetrics(workspaceRoot) {
+export function readLocalQuickMetrics(workspaceRoot, { verbose = false } = {}) {
   const selected = trustedReceiptRoot(workspaceRoot);
   if (selected.status === "invalid") {
     return {
@@ -68,7 +68,7 @@ export function readLocalQuickMetrics(workspaceRoot) {
       schemaVersion: "OwlCodaRunKitLocalMetricsV1",
       telemetry: false,
       networkRequests: 0,
-      inputs: [],
+      ...(verbose ? { inputs: [] } : {}),
       quick: {
         total: 0,
         passed: 0,
@@ -117,7 +117,7 @@ export function readLocalQuickMetrics(workspaceRoot) {
     schemaVersion: "OwlCodaRunKitLocalMetricsV1",
     telemetry: false,
     networkRequests: 0,
-    inputs: receiptPaths,
+    ...(verbose ? { inputs: receiptPaths } : {}),
     quick: totals,
     authorizationGranted: false,
   };

package/scripts/runkit-contract/quick-receipt.mjs

@@ -97,20 +97,36 @@ function cleanOutputLine(line) {
     .trim();
 }
 
-function summarizeOutputBytes(bytes) {
-  const start = Math.max(0, bytes.byteLength - OUTPUT_SUMMARY_BYTES);
-  let text = bytes.subarray(start).toString("utf8");
-  if (start > 0) {
-    const firstLineBreak = text.indexOf("\n");
-    if (firstLineBreak >= 0) text = text.slice(firstLineBreak + 1);
-  }
-  const lines = text
+function cleanOutputLines(text) {
+  return text
     .split(/\r?\n/u)
     .map(cleanOutputLine)
     .filter(Boolean);
+}
+
+function summarizeOutputBytes(bytes) {
+  if (bytes.byteLength <= OUTPUT_SUMMARY_BYTES) {
+    const lines = cleanOutputLines(bytes.toString("utf8"));
+    return {
+      headLines: lines.slice(0, OUTPUT_SUMMARY_LINES),
+      tailLines: lines.slice(-OUTPUT_SUMMARY_LINES),
+      truncated: lines.length > OUTPUT_SUMMARY_LINES * 2,
+    };
+  }
+
+  const windowBytes = Math.floor(OUTPUT_SUMMARY_BYTES / 2);
+  let headText = bytes.subarray(0, windowBytes).toString("utf8");
+  const lastHeadBreak = headText.lastIndexOf("\n");
+  if (lastHeadBreak >= 0) headText = headText.slice(0, lastHeadBreak + 1);
+
+  let tailText = bytes.subarray(bytes.byteLength - windowBytes).toString("utf8");
+  const firstTailBreak = tailText.indexOf("\n");
+  if (firstTailBreak >= 0) tailText = tailText.slice(firstTailBreak + 1);
+
   return {
-    lines: lines.slice(-OUTPUT_SUMMARY_LINES),
-    truncated: start > 0 || lines.length > OUTPUT_SUMMARY_LINES,
+    headLines: cleanOutputLines(headText).slice(0, OUTPUT_SUMMARY_LINES),
+    tailLines: cleanOutputLines(tailText).slice(-OUTPUT_SUMMARY_LINES),
+    truncated: true,
   };
 }
 
@@ -145,10 +161,59 @@ function validateQuickReceiptStore(workspaceRoot, store) {
   assertStorePath(root, store.receiptRoot, store.receiptRootIdentity, "directory");
   assertStorePath(root, store.stdoutPath, store.stdoutIdentity, "file");
   assertStorePath(root, store.stderrPath, store.stderrIdentity, "file");
+  if (store.stdinPath !== undefined) {
+    assertStorePath(root, store.stdinPath, store.stdinIdentity, "file");
+    const bytes = readFileSync(store.stdinPath);
+    if (
+      bytes.byteLength !== store.stdinArtifact.sizeBytes
+      || sha256Bytes(bytes) !== store.stdinArtifact.sha256
+    ) {
+      throw new Error(`Quick receipt store stdin material changed: ${store.stdinPath}`);
+    }
+  }
+}
+
+export function persistQuickInputArtifact({ workspaceRoot, store, bytes }) {
+  if (!Buffer.isBuffer(bytes)) throw new Error("Quick stdin material must be bytes.");
+  validateQuickReceiptStore(workspaceRoot, store);
+  const stdinPath = path.join(store.receiptRoot, "stdin.bin");
+  writeFileSync(stdinPath, bytes, { flag: "wx", mode: 0o600 });
+  const stat = lstatSync(stdinPath);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`Quick receipt store stdin material is not trusted: ${stdinPath}`);
+  }
+  const root = realpathSync(workspaceRoot);
+  const resolved = realpathSync(stdinPath);
+  if (!withinRoot(root, resolved)) {
+    throw new Error(`Quick receipt store stdin material escapes the workspace: ${stdinPath}`);
+  }
+  store.stdinPath = stdinPath;
+  store.stdinIdentity = { dev: stat.dev, ino: stat.ino };
+  store.stdinArtifact = {
+    path: path.relative(root, resolved).split(path.sep).join("/"),
+    sha256: sha256Bytes(bytes),
+    sizeBytes: bytes.byteLength,
+  };
+  return {
+    artifact: store.stdinArtifact,
+    inputPath: stdinPath,
+  };
 }
 
 export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
   validateQuickReceiptStore(workspaceRoot, store);
+  const receiptStdin = receipt.inputArtifacts?.stdin;
+  if (
+    (store.stdinArtifact === undefined) !== (receiptStdin === undefined)
+    || store.stdinArtifact !== undefined
+      && (
+        receiptStdin.path !== store.stdinArtifact.path
+        || receiptStdin.sha256 !== store.stdinArtifact.sha256
+        || receiptStdin.sizeBytes !== store.stdinArtifact.sizeBytes
+      )
+  ) {
+    throw new Error("Quick receipt stdin binding does not match the persisted material.");
+  }
   const stdout = outputArtifact(workspaceRoot, store.stdoutPath);
   const stderr = outputArtifact(workspaceRoot, store.stderrPath);
   const complete = {
@@ -164,8 +229,10 @@ export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
     receiptPath: store.receiptPath,
     receiptSha256: sha256Bytes(readFileSync(store.receiptPath)),
     outputSummary: {
-      stdoutTail: stdout.summary.lines,
-      stderrTail: stderr.summary.lines,
+      stdoutHead: stdout.summary.headLines,
+      stdoutTail: stdout.summary.tailLines,
+      stderrHead: stderr.summary.headLines,
+      stderrTail: stderr.summary.tailLines,
       stdoutTruncated: stdout.summary.truncated,
       stderrTruncated: stderr.summary.truncated,
     },

package/scripts/runkit-contract/quick-verify.mjs

@@ -1,10 +1,18 @@
 import { spawn } from "node:child_process";
-import { realpathSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  openSync,
+  realpathSync,
+} from "node:fs";
+import path from "node:path";
 
+import { readFileBytesBounded } from "../../packages/attest/src/formal.mjs";
 import { currentCoreIdentity } from "./core-contract.mjs";
 import {
   closeQuickOutputFiles,
   createQuickReceiptStore,
+  persistQuickInputArtifact,
   persistQuickReceipt,
 } from "./quick-receipt.mjs";
 import { captureWorkspaceSnapshot } from "./quick-workspace-snapshot.mjs";
@@ -14,18 +22,34 @@ function shellQuote(value) {
 }
 
 function quickAttestCommand(workspaceRoot, receiptPath) {
-  return `owlrunkit quick-attest --workspace ${shellQuote(workspaceRoot)} --receipt ${shellQuote(receiptPath)}`;
+  return `npx --no-install owlrunkit quick-attest --workspace ${shellQuote(workspaceRoot)} --receipt ${shellQuote(receiptPath)}`;
 }
 
-function runExactCommand({ executable, argv, cwd, stdoutFd, stderrFd }) {
+function runExactCommand({ executable, argv, cwd, stdinPath, stdoutFd, stderrFd }) {
   return new Promise((resolve) => {
     let settled = false;
-    const child = spawn(executable, argv, {
-      cwd,
-      shell: false,
-      stdio: ["ignore", stdoutFd, stderrFd],
-      env: process.env,
-    });
+    let stdinFd;
+    let child;
+    try {
+      stdinFd = stdinPath === undefined
+        ? undefined
+        : openSync(stdinPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+      child = spawn(executable, argv, {
+        cwd,
+        shell: false,
+        stdio: [stdinFd ?? "ignore", stdoutFd, stderrFd],
+        env: process.env,
+      });
+    } catch (error) {
+      if (stdinFd !== undefined) closeSync(stdinFd);
+      resolve({
+        exitCode: null,
+        signal: null,
+        launchError: error instanceof Error ? error.message : String(error),
+      });
+      return;
+    }
+    if (stdinFd !== undefined) closeSync(stdinFd);
     child.once("error", (error) => {
       if (settled) return;
       settled = true;
@@ -39,7 +63,13 @@ function runExactCommand({ executable, argv, cwd, stdoutFd, stderrFd }) {
   });
 }
 
-export async function runQuickVerification({ workspaceRoot, commandArgv }) {
+function inputArtifactResult(stdinArtifact) {
+  return stdinArtifact === null
+    ? {}
+    : { inputArtifacts: { stdin: stdinArtifact } };
+}
+
+export async function runQuickVerification({ workspaceRoot, commandArgv, stdinFile }) {
   if (!Array.isArray(commandArgv) || commandArgv.length === 0 || !commandArgv.every((value) => typeof value === "string")) {
     return {
       status: "quick_verification_input_invalid",
@@ -60,12 +90,49 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     };
   }
 
+  let stdinBytes;
+  if (stdinFile !== undefined) {
+    if (typeof stdinFile !== "string" || stdinFile.length === 0) {
+      return {
+        status: "quick_verification_input_invalid",
+        exitCode: 3,
+        issues: ["--stdin-file requires a non-empty regular file path."],
+        authorizationGranted: false,
+      };
+    }
+    try {
+      const selected = path.isAbsolute(stdinFile)
+        ? stdinFile
+        : path.resolve(root, stdinFile);
+      stdinBytes = readFileBytesBounded(selected).bytes;
+    } catch (error) {
+      return {
+        status: "quick_verification_input_invalid",
+        exitCode: 3,
+        issues: [`Quick stdin file is invalid: ${error instanceof Error ? error.message : String(error)}`],
+        authorizationGranted: false,
+      };
+    }
+  }
+
   let workspaceBefore;
   let store;
+  let stdinArtifact = null;
+  let persistedStdinPath;
   try {
     workspaceBefore = captureWorkspaceSnapshot(root);
     store = createQuickReceiptStore(root);
+    if (stdinBytes !== undefined) {
+      const persistedInput = persistQuickInputArtifact({
+        workspaceRoot: root,
+        store,
+        bytes: stdinBytes,
+      });
+      stdinArtifact = persistedInput.artifact;
+      persistedStdinPath = persistedInput.inputPath;
+    }
   } catch (error) {
+    if (store !== undefined) closeQuickOutputFiles(store);
     return {
       status: "quick_verification_input_invalid",
       exitCode: 3,
@@ -80,6 +147,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     executable,
     argv,
     cwd: root,
+    stdinPath: persistedStdinPath,
     stdoutFd: store.stdoutFd,
     stderrFd: store.stderrFd,
   });
@@ -101,7 +169,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
   }
 
   const sourceMutated = workspaceBefore.sourceFingerprint !== workspaceAfter.sourceFingerprint;
-  const issueCodes = ["quick_ignored_artifact_unbound"];
+  const issueCodes = [];
   if (sourceMutated) issueCodes.push("source_mutated_during_verification");
   let persisted;
   try {
@@ -109,7 +177,9 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       workspaceRoot: root,
       store,
       receipt: {
-      schemaVersion: "OwlCodaQuickVerificationReceiptV1",
+      schemaVersion: stdinArtifact === null
+        ? "OwlCodaQuickVerificationReceiptV1"
+        : "OwlCodaQuickVerificationReceiptV2",
       receiptId: store.receiptId,
       assurance: "captured_verification",
       authorizationGranted: false,
@@ -124,6 +194,9 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
         argv,
         cwd: root,
       },
+      ...(stdinArtifact === null
+        ? {}
+        : { inputArtifacts: { stdin: stdinArtifact } }),
       verificationContext: {
         platform: process.platform,
         architecture: process.arch,
@@ -154,6 +227,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
         ? "invalidated_by_command_source_mutation"
         : "source_unchanged",
       issueCodes: [...issueCodes, "quick_receipt_store_invalid"],
+      ...inputArtifactResult(stdinArtifact),
       issues: [error instanceof Error ? error.message : String(error)],
       nextAllowedAction: "repair_quick_receipt_store_and_rerun",
       authorizationGranted: false,
@@ -173,6 +247,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "invalidated_by_command_source_mutation",
       issueCodes,
+      ...inputArtifactResult(stdinArtifact),
       outputSummary,
       attestCommand,
       issues: [],
@@ -191,6 +266,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes,
+      ...inputArtifactResult(stdinArtifact),
       outputSummary,
       attestCommand,
       issues: execution.launchError ? [execution.launchError] : [],
@@ -208,6 +284,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     commandExitCode: 0,
     mutationDecision: "source_unchanged",
     issueCodes,
+    ...inputArtifactResult(stdinArtifact),
     outputSummary,
     attestCommand,
     issues: [],

package/scripts/runkit-contract/runkit-bootstrap.mjs

@@ -22,6 +22,10 @@ function comparablePath(value) {
   return existsSync(resolved) ? realpathSync(resolved) : resolved;
 }
 
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
 function workspaceFromArgv(argv, cwd) {
   const index = argv.indexOf("--workspace");
   if (index < 0) return path.resolve(cwd);
@@ -103,7 +107,8 @@ export function runBootstrapV1({
       `project_local_cli_unavailable:${selected.binding.issueCodes.join(",")}.`,
       "The current/global package did not execute this project command.",
       "Repair the exact dependency, lockfile, and local install binding,",
-      `or use the bootstrap recovery path: owlrunkit init --workspace ${selected.workspaceRoot}`,
+      "or use the bootstrap recovery path: npx --no-install owlrunkit init "
+        + `--workspace ${shellQuote(selected.workspaceRoot)}`,
     ].join(" "));
   }
   const commandArgv = selected.commandArgv ?? [