rea-agents 2.0.0 → 2.2.0

package/dist/replay/LinuxJavaScriptReplayRunner.js

@@ -1,433 +1,216 @@
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { open, readFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { digestBytes, digestJson, } from "../application/JavaScriptReplayPlanning.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-import { buildLinuxX64ReplaySeccomp, linuxX64ReplaySeccompDigest, } from "./LinuxSeccompPolicy.js";
+import { readFile } from "node:fs/promises";
+import { digestBytes, } from "../application/JavaScriptReplayPlanning.js";
+import { linuxX64ReplaySeccompDigest } from "./LinuxSeccompPolicy.js";
 import { resolveLinuxRuntimeClosure } from "./LinuxRuntimeClosure.js";
+import { assertRuntimeCommitment, systemdArguments, temporaryFilterHandle, } from "./LinuxJavaScriptReplaySandbox.js";
+import { boundedCollector, killUnit, observeCleanup, observeUnitResult, } from "./ReplayProcessLifecycle.js";
+import { commitOutcomes, compareOutcomes, terminationResult, workerRequest, } from "./ReplayOutcome.js";
 import { parseReplayWorkerResponse, } from "./ReplayWorkerProtocol.js";
 const isAborted = (signal) => signal?.aborted === true;
 /** Run one prepared experiment under the exact Linux ADR-0002 boundary. */
 export class LinuxJavaScriptReplayRunner {
     async execute(prepared, policy, signal) {
         if (isAborted(signal))
-            return terminationResult(prepared, "", "cancelled", {
-                state: "complete",
-                residual_resources: [],
+            return terminationResult({
+                prepared,
+                stderr: "",
+                termination: "cancelled",
+                cleanup: { state: "complete", residual_resources: [] },
             });
         const unit = `rea-replay-${randomBytes(8).toString("hex")}.service`;
-        const workerPath = prepared.publicPlan.runtime.worker.path;
-        const closure = await resolveLinuxRuntimeClosure(policy.nodePath);
-        assertRuntimeCommitment(prepared, closure);
-        if (digestBytes(await readFile(workerPath)) !==
-            prepared.publicPlan.runtime.worker.sha256)
-            throw new TypeError("Replay worker changed after approval");
-        if (linuxX64ReplaySeccompDigest() !==
-            prepared.publicPlan.sandbox.seccomp_sha256)
-            throw new TypeError("Replay seccomp policy changed after approval");
-        const request = workerRequest(prepared);
-        const encoded = Buffer.from(JSON.stringify(request));
-        if (encoded.byteLength > prepared.publicPlan.limits.protocol_bytes)
-            throw new RangeError("Replay worker protocol input exceeds the committed limit");
+        const closure = await validateReplayCommitments(prepared, policy);
+        const encoded = buildWorkerPayload(prepared);
         const filter = await temporaryFilterHandle();
-        const arguments_ = systemdArguments(unit, policy, prepared, workerPath, closure, filter.path);
-        let child;
-        let timeout;
-        let cancelled = false;
-        let timedOut = false;
-        let terminationRequest;
-        const requestTermination = () => {
-            terminationRequest ??= killUnit(policy.systemctlPath, unit);
-            child?.kill("SIGKILL");
-        };
-        const terminate = () => {
-            cancelled = true;
-            requestTermination();
-        };
+        const replayProcess = launchReplayProcess({
+            prepared,
+            policy,
+            encoded,
+            closure,
+            filterPath: filter.path,
+            unit,
+            signal,
+        });
         try {
-            const completion = new Promise((resolve, reject) => {
-                child = spawn(policy.systemdRunPath, arguments_, {
-                    stdio: ["pipe", "pipe", "pipe"],
-                    env: {
-                        PATH: "/usr/bin:/bin",
-                        LANG: "C",
-                        LC_ALL: "C",
-                        TZ: "UTC",
-                        ...(process.env.XDG_RUNTIME_DIR === undefined
-                            ? {}
-                            : { XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR }),
-                        ...(process.env.DBUS_SESSION_BUS_ADDRESS === undefined
-                            ? {}
-                            : {
-                                DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS,
-                            }),
-                    },
-                });
-                const output = boundedCollector(prepared.publicPlan.limits.output_bytes);
-                const diagnostics = boundedCollector(prepared.publicPlan.limits.stderr_bytes);
-                child.stdout?.on("data", output.append);
-                child.stderr?.on("data", diagnostics.append);
-                child.once("error", reject);
-                child.once("close", (code, signalName) => resolve({
-                    code,
-                    signal: signalName,
-                    stdout: output.value(),
-                    stderr: diagnostics.value(),
-                    outputExceeded: output.exceeded(),
-                }));
-                child.stdin?.end(encoded);
-            });
-            signal?.addEventListener("abort", terminate, { once: true });
-            if (isAborted(signal))
-                terminate();
-            timeout = setTimeout(() => {
-                timedOut = true;
-                requestTermination();
-            }, prepared.publicPlan.limits.wall_time_ms);
-            timeout.unref();
-            const collected = await completion;
-            if (terminationRequest !== undefined)
-                await terminationRequest;
+            const collected = await replayProcess.completion;
+            if (replayProcess.terminationRequest !== undefined)
+                await replayProcess.terminationRequest;
             const unitResult = await observeUnitResult(policy.systemctlPath, unit);
             const cleanup = await observeCleanup(policy.systemctlPath, unit);
-            if (cancelled || timedOut)
-                return terminationResult(prepared, collected.stderr, cancelled ? "cancelled" : "timeout", cleanup);
-            if (collected.outputExceeded)
-                return terminationResult(prepared, collected.stderr, "protocol_error", cleanup, "Worker stdout exceeded the committed bound");
-            if (collected.code !== 0)
-                return terminationResult(prepared, collected.stderr, collected.code === 137 || unitResult === "oom-kill" ? "oom" : "crash", cleanup);
-            let response;
-            try {
-                response = parseReplayWorkerResponse(JSON.parse(collected.stdout), prepared.publicPlan.cases, prepared.publicPlan.right !== undefined);
-            }
-            catch {
-                return terminationResult(prepared, collected.stderr, "protocol_error", cleanup);
-            }
-            const outcomes = commitOutcomes(response.left);
-            const right = response.right === undefined
-                ? undefined
-                : commitOutcomes(response.right);
-            return {
-                schema_version: 1,
-                plan_digest: prepared.publicPlan.plan_digest,
-                outcomes: [...outcomes, ...(right ?? [])],
-                ...(right === undefined
-                    ? {}
-                    : { comparison: compareOutcomes(outcomes, right) }),
-                stderr: collected.stderr,
-                termination: "completed",
+            return resolveReplayResult({
+                prepared,
+                collected,
+                unitResult,
                 cleanup,
-                limitations: [
-                    "Controlled replay observes the isolated extracted modules, not the original application runtime.",
-                    "Network and host filesystem access were unavailable; unsupported dependencies may change behavior.",
-                ],
-                reproducer: null,
-            };
+                cancelled: replayProcess.cancelled,
+                timedOut: replayProcess.timedOut,
+            });
         }
         finally {
-            signal?.removeEventListener("abort", terminate);
-            if (timeout !== undefined)
-                clearTimeout(timeout);
-            if (child !== undefined && child.exitCode === null) {
-                requestTermination();
-                await terminationRequest;
+            signal?.removeEventListener("abort", replayProcess.terminate);
+            if (replayProcess.timeout !== undefined)
+                clearTimeout(replayProcess.timeout);
+            if (replayProcess.child !== undefined &&
+                replayProcess.child.exitCode === null) {
+                replayProcess.requestTermination();
+                await replayProcess.terminationRequest;
             }
             await filter.close();
         }
     }
 }
-const workerRequest = (prepared) => ({
-    schemaVersion: 1,
-    left: workerSide(prepared.publicPlan.left, prepared.leftSources),
-    ...(prepared.publicPlan.right === undefined ||
-        prepared.rightSources === undefined
-        ? {}
-        : { right: workerSide(prepared.publicPlan.right, prepared.rightSources) }),
-    cases: prepared.publicPlan.cases.map((item) => ({
-        caseId: item.case_id,
-        arguments: item.arguments,
-        inputSha256: item.sha256,
-    })),
-    determinism: {
-        clockIso: prepared.publicPlan.determinism.clock_iso,
-        randomSeed: prepared.publicPlan.determinism.random_seed,
-    },
-    limits: {
-        resultDepth: prepared.publicPlan.limits.result_depth,
-        resultNodes: prepared.publicPlan.limits.result_nodes,
-        exceptionBytes: Math.min(64 * 1024, prepared.publicPlan.limits.output_bytes),
-    },
-});
-const workerSide = (side, sources) => ({
-    modules: side.modules.map((module) => ({
-        alias: module.alias,
-        format: module.format,
-        dependencies: module.dependencies,
-        source: sources[module.alias] ?? "",
-    })),
-    entryAlias: side.entry_alias,
-    entryExport: side.entry_export,
-});
-const systemdArguments = (unit, policy, prepared, workerPath, closure, filterPath) => {
-    const limits = prepared.publicPlan.limits;
-    const descriptorPaths = [
-        filterPath,
-        ...closure.map(({ sourcePath }) => sourcePath),
-        workerPath,
-    ];
-    const workerFd = descriptorPaths.length + 2;
-    const wrapper = descriptorPaths
-        .map((_, index) => `exec ${String(index + 3)}<"$1"; shift`)
-        .concat('exec "$@"')
-        .join("\n");
-    return [
-        "--user",
-        "--pipe",
-        "--wait",
-        "--service-type=exec",
-        "--quiet",
-        `--unit=${unit}`,
-        `--property=MemoryMax=${String(limits.memory_bytes)}`,
-        "--property=MemorySwapMax=0",
-        `--property=TasksMax=${String(limits.tasks)}`,
-        `--property=CPUQuota=${String(limits.cpu_quota_percent)}%`,
-        "--property=KillMode=control-group",
-        "--property=SendSIGKILL=yes",
-        "--",
-        policy.shellPath,
-        "-c",
-        wrapper,
-        "rea-replay-wrapper",
-        ...descriptorPaths,
-        policy.bubblewrapPath,
-        "--unshare-all",
-        "--unshare-user",
-        "--disable-userns",
-        "--new-session",
-        "--die-with-parent",
-        "--cap-drop",
-        "ALL",
-        "--clearenv",
-        "--setenv",
-        "HOME",
-        "/work",
-        "--setenv",
-        "TMPDIR",
-        "/tmp",
-        "--setenv",
-        "TZ",
-        "UTC",
-        "--setenv",
-        "LANG",
-        "C",
-        "--setenv",
-        "LC_ALL",
-        "C",
-        "--tmpfs",
-        "/",
-        "--dir",
-        "/runtime",
-        "--dir",
-        "/work",
-        "--size",
-        String(limits.tmpfs_bytes),
-        "--tmpfs",
-        "/tmp",
-        ...bindArguments(closure),
-        "--ro-bind-fd",
-        String(workerFd),
-        "/runtime/worker.js",
-        "--proc",
-        "/proc",
-        "--dev",
-        "/dev",
-        "--remount-ro",
-        "/",
-        "--chdir",
-        "/work",
-        "--seccomp",
-        "3",
-        "--",
-        "/runtime/node",
-        `--max-old-space-size=${String(Math.max(8, Math.floor(limits.memory_bytes / 1024 / 1024 / 2)))}`,
-        "--experimental-vm-modules",
-        "--permission",
-        "--allow-fs-read=/runtime/worker.js",
-        "/runtime/worker.js",
-    ];
-};
-const bindArguments = (closure) => {
-    const arguments_ = [];
-    const directories = new Set();
-    for (const [index, item] of closure.entries()) {
-        const destination = item.destinationPath;
-        let parent = dirname(destination);
-        const chain = [];
-        while (parent !== "/" && !directories.has(parent)) {
-            chain.push(parent);
-            parent = dirname(parent);
-        }
-        for (const directory of chain.reverse()) {
-            directories.add(directory);
-            arguments_.push("--dir", directory);
-        }
-        arguments_.push("--ro-bind-fd", String(index + 4), destination);
-    }
-    return arguments_;
+const validateReplayCommitments = async (prepared, policy) => {
+    const closure = await resolveLinuxRuntimeClosure(policy.nodePath);
+    assertRuntimeCommitment(prepared, closure);
+    const workerPath = prepared.publicPlan.runtime.worker.path;
+    if (digestBytes(await readFile(workerPath)) !==
+        prepared.publicPlan.runtime.worker.sha256)
+        throw new TypeError("Replay worker changed after approval");
+    if (linuxX64ReplaySeccompDigest() !== prepared.publicPlan.sandbox.seccomp_sha256)
+        throw new TypeError("Replay seccomp policy changed after approval");
+    return closure;
 };
-const assertRuntimeCommitment = (prepared, closure) => {
-    const observed = closure.map((item) => ({
-        source_path: item.sourcePath,
-        destination_path: item.destinationPath,
-        sha256: item.sha256,
-    }));
-    if (digestJson(observed) !==
-        digestJson(prepared.publicPlan.runtime.read_only_files))
-        throw new TypeError("Replay runtime closure changed after approval");
+const buildWorkerPayload = (prepared) => {
+    const request = workerRequest(prepared);
+    const encoded = Buffer.from(JSON.stringify(request));
+    if (encoded.byteLength > prepared.publicPlan.limits.protocol_bytes)
+        throw new RangeError("Replay worker protocol input exceeds the committed limit");
+    return encoded;
 };
-const temporaryFilterHandle = async () => {
-    const { mkdtemp, writeFile, rm } = await import("node:fs/promises");
-    const { tmpdir } = await import("node:os");
-    const { join } = await import("node:path");
-    const directory = await mkdtemp(join(tmpdir(), "rea-replay-filter-"));
-    const path = join(directory, "seccomp.bpf");
-    await writeFile(path, buildLinuxX64ReplaySeccomp(), { mode: 0o600 });
-    const handle = await open(path, "r");
-    return {
-        path,
-        handle,
-        close: async () => {
-            await handle.close();
-            await rm(directory, { recursive: true, force: true });
-        },
+const launchReplayProcess = (options) => {
+    const { prepared, policy, encoded, closure, filterPath, unit, signal } = options;
+    const arguments_ = systemdArguments({
+        unit,
+        policy,
+        prepared,
+        workerPath: prepared.publicPlan.runtime.worker.path,
+        closure,
+        filterPath,
+    });
+    let child;
+    let timeout;
+    let cancelled = false;
+    let timedOut = false;
+    let terminationRequest;
+    const requestTermination = () => {
+        terminationRequest ??= killUnit(policy.systemctlPath, unit);
+        child?.kill("SIGKILL");
     };
-};
-const boundedCollector = (maximum) => {
-    const chunks = [];
-    let bytes = 0;
-    let overflow = false;
+    const terminate = () => {
+        cancelled = true;
+        requestTermination();
+    };
+    const completion = new Promise((resolve, reject) => {
+        child = spawn(policy.systemdRunPath, arguments_, {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: replayProcessEnvironment(),
+        });
+        const output = boundedCollector(prepared.publicPlan.limits.output_bytes);
+        const diagnostics = boundedCollector(prepared.publicPlan.limits.stderr_bytes);
+        child.stdout?.on("data", output.append);
+        child.stderr?.on("data", diagnostics.append);
+        child.once("error", reject);
+        child.once("close", (code, signalName) => resolve({
+            code,
+            signal: signalName,
+            stdout: output.value(),
+            stderr: diagnostics.value(),
+            outputExceeded: output.exceeded(),
+        }));
+        child.stdin?.end(encoded);
+    });
+    signal?.addEventListener("abort", terminate, { once: true });
+    if (isAborted(signal))
+        terminate();
+    timeout = setTimeout(() => {
+        timedOut = true;
+        requestTermination();
+    }, prepared.publicPlan.limits.wall_time_ms);
+    timeout.unref();
+    if (child === undefined || timeout === undefined)
+        throw new TypeError("Replay process was not launched");
     return {
-        append: (chunk) => {
-            const retained = chunk.subarray(0, Math.max(0, maximum - bytes));
-            if (retained.byteLength > 0)
-                chunks.push(retained);
-            bytes += retained.byteLength;
-            if (retained.byteLength < chunk.byteLength)
-                overflow = true;
+        child,
+        completion,
+        timeout,
+        terminate,
+        requestTermination,
+        get terminationRequest() {
+            return terminationRequest;
+        },
+        get cancelled() {
+            return cancelled;
+        },
+        get timedOut() {
+            return timedOut;
         },
-        value: () => Buffer.concat(chunks).toString("utf8"),
-        exceeded: () => overflow,
     };
 };
-const collect = async (executable, arguments_, maximum) => new Promise((resolve, reject) => {
-    const child = spawn(executable, [...arguments_], {
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    const stdout = boundedCollector(maximum);
-    const stderr = boundedCollector(maximum);
-    const timeout = setTimeout(() => child.kill("SIGKILL"), 5_000);
-    timeout.unref();
-    child.stdout?.on("data", stdout.append);
-    child.stderr?.on("data", stderr.append);
-    child.once("error", (error) => {
-        clearTimeout(timeout);
-        reject(error);
-    });
-    child.once("close", (code) => {
-        clearTimeout(timeout);
-        resolve({ code, stdout: stdout.value(), stderr: stderr.value() });
-    });
+const replayProcessEnvironment = () => ({
+    PATH: "/usr/bin:/bin",
+    LANG: "C",
+    LC_ALL: "C",
+    TZ: "UTC",
+    ...(process.env.XDG_RUNTIME_DIR === undefined
+        ? {}
+        : { XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR }),
+    ...(process.env.DBUS_SESSION_BUS_ADDRESS === undefined
+        ? {}
+        : { DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS }),
 });
-const killUnit = async (systemctl, unit) => {
-    try {
-        await collect(systemctl, ["--user", "kill", "--kill-whom=all", "--signal=SIGKILL", unit], 4096);
-    }
-    catch {
-        /* cleanup continues */
-    }
-};
-const observeCleanup = async (systemctl, unit) => {
+const resolveReplayResult = (options) => {
+    const { prepared, collected, unitResult, cleanup, cancelled, timedOut } = options;
+    if (cancelled || timedOut)
+        return terminationResult({
+            prepared,
+            stderr: collected.stderr,
+            termination: cancelled ? "cancelled" : "timeout",
+            cleanup,
+        });
+    if (collected.outputExceeded)
+        return terminationResult({
+            prepared,
+            stderr: collected.stderr,
+            termination: "protocol_error",
+            cleanup,
+            limitation: "Worker stdout exceeded the committed bound",
+        });
+    if (collected.code !== 0)
+        return terminationResult({
+            prepared,
+            stderr: collected.stderr,
+            termination: collected.code === 137 || unitResult === "oom-kill" ? "oom" : "crash",
+            cleanup,
+        });
+    let response;
     try {
-        const state = await collect(systemctl, ["--user", "show", "--property=ActiveState", "--value", unit], 4096);
-        if (state.code !== 0 ||
-            state.stdout.trim() === "inactive" ||
-            state.stdout.trim() === "failed" ||
-            state.stdout.trim().length === 0) {
-            await collect(systemctl, ["--user", "reset-failed", unit], 4096);
-            return { state: "complete", residual_resources: [] };
-        }
-        return { state: "incomplete", residual_resources: [unit] };
+        const rawResponse = JSON.parse(collected.stdout);
+        response = parseReplayWorkerResponse(rawResponse, prepared.publicPlan.cases, prepared.publicPlan.right !== undefined);
     }
     catch {
-        return { state: "incomplete", residual_resources: [unit] };
+        return terminationResult({
+            prepared,
+            stderr: collected.stderr,
+            termination: "protocol_error",
+            cleanup,
+        });
     }
-};
-const observeUnitResult = async (systemctl, unit) => {
-    try {
-        const result = await collect(systemctl, ["--user", "show", "--property=Result", "--value", unit], 4096);
-        return result.stdout.trim();
-    }
-    catch {
-        return "unknown";
-    }
-};
-const commitOutcomes = (outcomes) => outcomes.map((outcome) => {
-    const semantic = outcome.value === undefined ? (outcome.exception ?? null) : outcome.value;
-    return {
-        case_id: outcome.case_id,
-        outcome: outcome.outcome,
-        ...(outcome.value === undefined
-            ? {}
-            : { value: jsonValueSchema.parse(outcome.value) }),
-        ...(outcome.exception === undefined
-            ? {}
-            : { exception: outcome.exception }),
-        input_sha256: outcome.input_sha256,
-        output_sha256: digestJson(semantic),
-        truncated: false,
-    };
-});
-const compareOutcomes = (left, right) => left.map((item, index) => ({
-    case_id: item.case_id,
-    status: right[index] === undefined
-        ? "unknown"
-        : item.outcome === right[index].outcome &&
-            item.output_sha256 === right[index].output_sha256
-            ? "equal"
-            : "changed",
-    left_index: index,
-    right_index: index,
-}));
-const terminationResult = (prepared, stderr, termination, cleanup, limitation) => {
-    const outcomes = prepared.publicPlan.cases.map((item) => ({
-        case_id: item.case_id,
-        outcome: termination,
-        input_sha256: item.sha256,
-        output_sha256: null,
-        truncated: termination === "protocol_error",
-    }));
-    const differential = prepared.publicPlan.right !== undefined;
+    const outcomes = commitOutcomes(response.left);
+    const right = response.right === undefined ? undefined : commitOutcomes(response.right);
     return {
         schema_version: 1,
         plan_digest: prepared.publicPlan.plan_digest,
-        outcomes: [...outcomes, ...(differential ? outcomes : [])],
-        ...(differential
-            ? {
-                comparison: outcomes.map((item, index) => ({
-                    case_id: item.case_id,
-                    status: "unknown",
-                    left_index: index,
-                    right_index: index,
-                })),
-            }
-            : {}),
-        stderr,
-        termination,
+        outcomes: [...outcomes, ...(right ?? [])],
+        ...(right === undefined
+            ? {}
+            : { comparison: compareOutcomes(outcomes, right) }),
+        stderr: collected.stderr,
+        termination: "completed",
         cleanup,
         limitations: [
-            limitation ??
-                `Replay terminated with ${termination}; the requested functional result remains unknown.`,
+            "Controlled replay observes the isolated extracted modules, not the original application runtime.",
+            "Network and host filesystem access were unavailable; unsupported dependencies may change behavior.",
         ],
         reproducer: null,
     };