software-defence-factory 0.3.2 → 0.3.3

package/factory/executor.mjs

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, lstatSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, lstatSync, chmodSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
 import { ROOT, configAt, run, save, json, digest, instanceLabel, stopContainers } from './lib.mjs';
@@ -44,6 +44,15 @@ function safeRead(path) {
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) throw new Error('Expected a regular report under 1 MiB');
   return readFileSync(path, 'utf8');
 }
+// Called only after the container has stopped. Builds may leave read-only cache
+// directories; make owned directories traversable without following symlinks.
+function removeScratch(path) {
+  if (lstatSync(path).isDirectory()) {
+    chmodSync(path, 0o700);
+    for (const name of readdirSync(path)) removeScratch(join(path, name));
+  }
+  rmSync(path, { recursive: true, force: true });
+}
 async function container(mode, input, command, writable = false, credentials = false) {
   const name = `sdf-${instanceLabel(state)}-${attempt}-${mode}`;
   const reportDir = join(folder, attempt, mode);
@@ -84,8 +93,10 @@ async function container(mode, input, command, writable = false, credentials = f
     const probe = run('docker',['ps','-aq','--filter',`name=^/${name}$`]);
     if (probe) throw error;
   }
-  if (scratch) rmSync(scratch, { recursive: true, force: true });
-  if (code !== 0) throw new Error(`${mode} exited ${code}; private log: ${logPath}`);
+  let cleanupError;
+  try { if (scratch) removeScratch(scratch); } catch (error) { cleanupError = error; }
+  if (code !== 0) throw new Error(`${mode} exited ${code}; private log: ${logPath}${cleanupError ? `; scratch cleanup requires recovery: ${cleanupError.message}` : ''}`);
+  if (cleanupError) throw cleanupError;
   return reportDir;
 }
 function brief(instruction) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "software-defence-factory",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Scoped software delivery and defence investigations with isolated jobs, evidence and review",
   "type": "module",
   "license": "MIT",

package/scripts/probe-platform.mjs

@@ -45,6 +45,20 @@ try {
   await cli('approve',native.id);await waitState(native.id,'succeeded');setConfig({});
   record('native build scratch exceeds 1 GiB without changing the candidate; limits and cleanup verified');
 
+  for (const exitCode of [0, 17]) {
+    setConfig({check:`mkdir -p cache/nested && echo cache > cache/nested/value && ln -s /workspace cache/candidate && chmod 000 cache/nested cache && exit ${exitCode}`});
+    const readonly=await work(`Synthetic read-only cache cleanup, exit ${exitCode}`);
+    await waitState(readonly.id,exitCode===0?'awaiting_approval':'failed');
+    const run=(await snapshot(readonly.id)).runs.find(r=>r.command==='verify');
+    assert(!existsSync(join(state,'jobs',readonly.id,run.id,'check-workspace')));
+    assert.equal(readFileSync(join(state,'jobs',readonly.id,'checkout/value.txt'),'utf8'),'fixed\n');
+    assert.equal(readFileSync(join(original.repo,'value.txt'),'utf8'),'broken\n');
+    if(exitCode===0){await cli('approve',readonly.id);await waitState(readonly.id,'succeeded');}
+    else assert.match(run.error,/verify exited 17/);
+    record(`read-only cache cleanup after exit ${exitCode}; candidate symlink not followed and exit preserved`);
+  }
+  setConfig({});
+
   const changed=await work('Synthetic changed revision guard');await waitState(changed.id,'awaiting_approval');
   writeFileSync(join(state,'jobs',changed.id,'checkout/value.txt'),'changed after review\n');
   await cli('approve',changed.id);await waitState(changed.id,'failed');