stageflow 0.25.0 → 0.27.0

package/dist/runtime/completionCheckRunner.js

@@ -3,7 +3,12 @@ import { spawn } from "node:child_process";
 import { lstat, readFile } from "node:fs/promises";
 import path from "node:path";
 import { assertEnvelopePayload } from "../envelope/payloadSchema.js";
+import { resolveBashPath } from "../preflight/bash.js";
+import { redactString } from "../logging/redact.js";
+import { getNamedSecrets } from "../logging/namedSecrets.js";
+import { signalProcessGroup } from "./stageProcessLauncher.js";
 const MAX_COMMAND_OUTPUT_BYTES = 64 * 1024;
+const COMMAND_KILL_ESCALATE_MS = 2000;
 function captureOutput(chunks, chunk, currentSize) {
     const remaining = MAX_COMMAND_OUTPUT_BYTES - currentSize;
     if (remaining <= 0)
@@ -23,19 +28,26 @@ export const nodeCommandExecutor = {
             let timedOut = false;
             let settled = false;
             let timeout;
+            let escalateTimer;
             const finish = (result) => {
                 if (settled)
                     return;
                 settled = true;
                 if (timeout)
                     clearTimeout(timeout);
+                // When timed out, keep escalateTimer so SIGKILL still runs after the
+                // grace window even if the parent already exited cooperatively.
+                if (escalateTimer && !timedOut)
+                    clearTimeout(escalateTimer);
                 resolve(result);
             };
             let child;
             try {
-                child = spawn(input.command, {
+                const bash = resolveBashPath(input.env ?? process.env);
+                child = spawn(bash, ["-c", input.command], {
                     cwd: input.cwd,
-                    shell: true,
+                    env: input.env,
+                    detached: true,
                     stdio: ["ignore", "pipe", "pipe"],
                 });
             }
@@ -55,6 +67,12 @@ export const nodeCommandExecutor = {
             child.stderr?.on("data", (data) => {
                 stderrSize = captureOutput(stderr, Buffer.from(data), stderrSize);
             });
+            child.once("exit", () => {
+                if (timedOut) {
+                    // Parent may exit on SIGTERM while SIGTERM-proof grandchildren remain.
+                    signalProcessGroup(child.pid, "SIGKILL");
+                }
+            });
             child.once("error", (error) => {
                 finish({
                     exit_code: null,
@@ -75,7 +93,12 @@ export const nodeCommandExecutor = {
             if (input.timeout_ms !== undefined) {
                 timeout = setTimeout(() => {
                     timedOut = true;
-                    child.kill("SIGTERM");
+                    const pid = child.pid;
+                    signalProcessGroup(pid, "SIGTERM");
+                    escalateTimer = setTimeout(() => {
+                        // Always escalate after the grace window regardless of exited.
+                        signalProcessGroup(pid, "SIGKILL");
+                    }, COMMAND_KILL_ESCALATE_MS);
                 }, input.timeout_ms);
             }
         });
@@ -101,16 +124,31 @@ async function runCommandCheck(check, input) {
     const cwd = resolveCommandCwd(check, base);
     const executor = input.commandExecutor ?? nodeCommandExecutor;
     try {
-        const execution = await executor.run({ command: check.run, cwd, timeout_ms: check.timeout_ms });
+        const execution = await executor.run({
+            command: check.run,
+            cwd,
+            timeout_ms: check.timeout_ms,
+            ...(input.commandEnv !== undefined ? { env: input.commandEnv } : {}),
+        });
         const evidence = {
             kind: "command",
             command: check.run,
             cwd,
             exit_code: execution.exit_code,
-            stdout: execution.stdout,
-            stderr: execution.stderr,
+            stdout: redactString(execution.stdout, {
+                namedSecrets: getNamedSecrets(),
+            }),
+            stderr: redactString(execution.stderr, {
+                namedSecrets: getNamedSecrets(),
+            }),
             timed_out: execution.timed_out,
-            ...(execution.error !== undefined ? { error: execution.error } : {}),
+            ...(execution.error !== undefined
+                ? {
+                    error: redactString(execution.error, {
+                        namedSecrets: getNamedSecrets(),
+                    }),
+                }
+                : {}),
         };
         if (execution.timed_out)
             return result(check, "failed", evidence, "command timed out");

package/dist/runtime/containerLimits.d.ts

@@ -0,0 +1,16 @@
+import os from "node:os";
+export type ContainerLimits = {
+    memoryLimitBytes: number | undefined;
+    maxActiveStageProcesses: number;
+    maxOldSpaceSizeMb: number;
+    source: "cgroup-v2" | "cgroup-v1" | "fallback";
+};
+export declare function readContainerMemoryLimit(roots?: readonly string[]): {
+    bytes: number | undefined;
+    source: ContainerLimits["source"];
+};
+export declare function deriveContainerLimits(memoryLimitBytes: number | undefined, source?: ContainerLimits["source"]): ContainerLimits;
+export declare function getContainerLimits(): ContainerLimits;
+export declare function resetContainerLimitsForTests(): void;
+/** Test hook: prove sizing never consults os.totalmem. */
+export declare function assertNoOsTotalmemInSizing(): typeof os.totalmem;

package/dist/runtime/containerLimits.js

@@ -0,0 +1,84 @@
+import { readFileSync, existsSync } from "node:fs";
+import os from "node:os";
+const HOST_RESERVE_MIB = 512;
+const WORKER_BUDGET_MIB = 512;
+const MAX_CAP = 8;
+const FALLBACK_CAP = 4;
+const FALLBACK_HEAP_MIB = 512;
+const V1_SENTINEL = 9223372036854771712n;
+function parseCgroupMemory(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === "" || trimmed === "max")
+        return undefined;
+    let n;
+    try {
+        n = BigInt(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+    if (n <= 0n || n >= V1_SENTINEL)
+        return undefined;
+    if (n > BigInt(Number.MAX_SAFE_INTEGER))
+        return undefined;
+    return Number(n);
+}
+export function readContainerMemoryLimit(roots = ["/sys/fs/cgroup"]) {
+    for (const root of roots) {
+        const v2 = `${root}/memory.max`;
+        if (existsSync(v2)) {
+            try {
+                const bytes = parseCgroupMemory(readFileSync(v2, "utf8"));
+                return { bytes, source: bytes === undefined ? "fallback" : "cgroup-v2" };
+            }
+            catch {
+                // continue
+            }
+        }
+        const v1 = `${root}/memory/memory.limit_in_bytes`;
+        if (existsSync(v1)) {
+            try {
+                const bytes = parseCgroupMemory(readFileSync(v1, "utf8"));
+                return { bytes, source: bytes === undefined ? "fallback" : "cgroup-v1" };
+            }
+            catch {
+                // continue
+            }
+        }
+    }
+    return { bytes: undefined, source: "fallback" };
+}
+export function deriveContainerLimits(memoryLimitBytes, source = "fallback") {
+    if (memoryLimitBytes === undefined) {
+        return {
+            memoryLimitBytes: undefined,
+            maxActiveStageProcesses: FALLBACK_CAP,
+            maxOldSpaceSizeMb: FALLBACK_HEAP_MIB,
+            source: "fallback",
+        };
+    }
+    const limitMib = Math.floor(memoryLimitBytes / (1024 * 1024));
+    const workerBudget = Math.max(1, limitMib - HOST_RESERVE_MIB);
+    const cap = Math.min(MAX_CAP, Math.max(1, Math.floor(workerBudget / WORKER_BUDGET_MIB)));
+    return {
+        memoryLimitBytes,
+        maxActiveStageProcesses: cap,
+        maxOldSpaceSizeMb: WORKER_BUDGET_MIB,
+        source,
+    };
+}
+let cached;
+export function getContainerLimits() {
+    if (cached === undefined) {
+        const { bytes, source } = readContainerMemoryLimit();
+        cached = deriveContainerLimits(bytes, source);
+    }
+    return cached;
+}
+export function resetContainerLimitsForTests() {
+    cached = undefined;
+}
+/** Test hook: prove sizing never consults os.totalmem. */
+export function assertNoOsTotalmemInSizing() {
+    return os.totalmem;
+}

package/dist/runtime/credentialMaterialisation.d.ts

@@ -0,0 +1,28 @@
+export type MaterialiseCopyResult = {
+    destPath: string;
+    mode: number;
+};
+export declare class CredentialMaterialisationError extends Error {
+    readonly code: "symlink_rejected" | "escape_rejected" | "source_missing" | "not_a_file";
+    constructor(message: string, code: CredentialMaterialisationError["code"]);
+}
+export declare function attemptCredentialsDir(attemptDir: string, secretName: string): string;
+/** Copy a Host source file into attempt credentials with mode 0400. */
+export declare function materialiseCredentialFile(options: {
+    sourcePath: string;
+    destDir: string;
+    destBasename?: string;
+    allowedRoot?: string;
+}): MaterialiseCopyResult;
+export declare function materialiseSecretBytes(options: {
+    contents: string | Buffer;
+    destDir: string;
+    destBasename: string;
+}): MaterialiseCopyResult;
+export declare function cleanupCredentialsDir(attemptDir: string): void;
+export declare function stageAskpassHelperPath(home?: string): string;
+export declare function ensureStageAskpassHelper(home?: string): string;
+export declare function readFileCredentialRegistry(home?: string): Record<string, {
+    source: string;
+    pointerVar: string;
+}>;

package/dist/runtime/credentialMaterialisation.js

@@ -0,0 +1,128 @@
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { ensureGlobalHome, globalStageflowHome } from "../project/globalHome.js";
+export class CredentialMaterialisationError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = "CredentialMaterialisationError";
+        this.code = code;
+    }
+}
+export function attemptCredentialsDir(attemptDir, secretName) {
+    return path.join(attemptDir, "credentials", secretName);
+}
+/** Copy a Host source file into attempt credentials with mode 0400. */
+export function materialiseCredentialFile(options) {
+    const sourcePath = path.resolve(options.sourcePath);
+    let stat;
+    try {
+        stat = lstatSync(sourcePath);
+    }
+    catch {
+        throw new CredentialMaterialisationError(`credential source missing: ${sourcePath}`, "source_missing");
+    }
+    if (stat.isSymbolicLink()) {
+        throw new CredentialMaterialisationError(`credential source must not be a symlink: ${sourcePath}`, "symlink_rejected");
+    }
+    if (!stat.isFile()) {
+        throw new CredentialMaterialisationError(`credential source must be a regular file: ${sourcePath}`, "not_a_file");
+    }
+    const realSource = realpathSync(sourcePath);
+    if (options.allowedRoot !== undefined) {
+        let root = path.resolve(options.allowedRoot);
+        try {
+            root = realpathSync(root);
+        }
+        catch {
+            // allowed root may not exist yet; keep resolved path
+        }
+        if (realSource !== root && !realSource.startsWith(root + path.sep)) {
+            throw new CredentialMaterialisationError(`credential source escapes allowed root: ${sourcePath}`, "escape_rejected");
+        }
+    }
+    mkdirSync(options.destDir, { recursive: true, mode: 0o700 });
+    const destPath = path.join(options.destDir, options.destBasename ?? path.basename(realSource));
+    copyFileSync(realSource, destPath);
+    try {
+        chmodSync(destPath, 0o400);
+    }
+    catch {
+        // best-effort on non-POSIX
+    }
+    return { destPath, mode: 0o400 };
+}
+export function materialiseSecretBytes(options) {
+    mkdirSync(options.destDir, { recursive: true, mode: 0o700 });
+    const destPath = path.join(options.destDir, options.destBasename);
+    writeFileSync(destPath, options.contents, { mode: 0o400 });
+    try {
+        chmodSync(destPath, 0o400);
+    }
+    catch {
+        // best-effort
+    }
+    return { destPath, mode: 0o400 };
+}
+export function cleanupCredentialsDir(attemptDir) {
+    const root = path.join(attemptDir, "credentials");
+    if (!existsSync(root))
+        return;
+    rmSync(root, { recursive: true, force: true });
+}
+const STAGE_ASKPASS_BASENAME = "git-askpass-stage";
+const STAGE_ASKPASS_SCRIPT = `#!/bin/sh
+prompt=\${1-}
+case "\$prompt" in
+  *Username*|*username*)
+    printf '%s\\n' 'x-access-token'
+    ;;
+  *)
+    token=
+    if [ -n "\${STAGEFLOW_GIT_ASKPASS_TOKEN_FILE-}" ] && [ -f "\$STAGEFLOW_GIT_ASKPASS_TOKEN_FILE" ]; then
+      token=\$(cat "\$STAGEFLOW_GIT_ASKPASS_TOKEN_FILE")
+    fi
+    printf '%s\\n' "\$token"
+    ;;
+esac
+`;
+export function stageAskpassHelperPath(home = globalStageflowHome()) {
+    return path.join(home, STAGE_ASKPASS_BASENAME);
+}
+export function ensureStageAskpassHelper(home) {
+    const resolvedHome = home ?? ensureGlobalHome();
+    mkdirSync(resolvedHome, { recursive: true });
+    const askpass = stageAskpassHelperPath(resolvedHome);
+    writeFileSync(askpass, STAGE_ASKPASS_SCRIPT, { encoding: "utf8", mode: 0o700 });
+    try {
+        chmodSync(askpass, 0o700);
+    }
+    catch {
+        // best-effort
+    }
+    return askpass;
+}
+export function readFileCredentialRegistry(home = globalStageflowHome()) {
+    const registryPath = path.join(home, "secrets", "file-credentials.json");
+    if (!existsSync(registryPath))
+        return {};
+    try {
+        const raw = JSON.parse(readFileSync(registryPath, "utf8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return {};
+        const out = {};
+        for (const [name, entry] of Object.entries(raw)) {
+            if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                continue;
+            const e = entry;
+            if (typeof e.source !== "string" || typeof e.pointerVar !== "string") {
+                continue;
+            }
+            out[name] = { source: e.source, pointerVar: e.pointerVar };
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}

package/dist/runtime/gitCheckoutCapability.js

@@ -1,20 +1,14 @@
 import { createHash } from "node:crypto";
-import { execFile } from "node:child_process";
 import { lstat, readFile, readlink } from "node:fs/promises";
 import path from "node:path";
-function runGit(root, args) {
-    return new Promise((resolve, reject) => {
-        execFile("git", ["-C", root, ...args], { encoding: "buffer", maxBuffer: 16 * 1024 * 1024 }, (error, stdout, stderr) => {
-            if (error) {
-                const detail = Buffer.isBuffer(stderr)
-                    ? stderr.toString("utf8").trim()
-                    : "";
-                reject(new Error(detail || error.message));
-                return;
-            }
-            resolve(stdout);
-        });
+import { runGit as execGit } from "../git/exec.js";
+async function runGit(root, args) {
+    const result = await execGit({
+        cwd: root,
+        args,
+        maxBuffer: 16 * 1024 * 1024,
     });
+    return Buffer.from(result.stdout, "utf8");
 }
 function nulPaths(output) {
     return output.toString("utf8").split("\0").filter(Boolean);

package/dist/runtime/pipelineRunner.d.ts

@@ -9,8 +9,28 @@ import type { TaskFile } from "../types/task.js";
 import { type StageExecutionMode } from "./stageConcurrency.js";
 import { StageProcessLauncher } from "./stageProcessLauncher.js";
 import type { OperatorCatalog } from "./stageAttemptBootstrap.js";
+import { type SkillsPayload } from "./runSkills.js";
+import { runPipelinePreflight } from "../preflight/pipelinePreflight.js";
 export { PipelineValidationError } from "./pipelineValidationError.js";
-export type PipelineRunOutcome = "succeeded" | "failed" | "waiting";
+export declare class PipelinePreflightError extends Error {
+    readonly code: string;
+    readonly preflight: Awaited<ReturnType<typeof runPipelinePreflight>>;
+    constructor(code: string, preflight: Awaited<ReturnType<typeof runPipelinePreflight>>);
+    toNetworkBody(): import("../errors/codes.js").NetworkErrorBody;
+}
+export type PipelineRunOutcome = "succeeded" | "failed" | "waiting" | "cancelled";
+export declare class InlinePipelineTooLargeError extends Error {
+    readonly code: "inline_pipeline_too_large";
+    readonly bytes: number;
+    readonly maxBytes: number;
+    constructor(bytes: number, maxBytes: number);
+}
+/** Thrown when queued→running CAS fails (e.g. cancel won the race). */
+export declare class QueuedRunActivationAborted extends Error {
+    readonly runId: string;
+    readonly currentStatus?: string;
+    constructor(runId: string, currentStatus?: string);
+}
 export type PipelineRunResult = {
     ok: boolean;
     outcome: PipelineRunOutcome;
@@ -51,6 +71,9 @@ export type ExecuteStagesOptions = {
     startAtStageIndex?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    schedulingHalt?: {
+        halted: boolean;
+    };
 };
 export declare function executeStages(prepared: PreparedPipeline, options?: ExecuteStagesOptions): Promise<PipelineRunResult>;
 export declare function runPipeline(options: {
@@ -80,14 +103,26 @@ export declare function startPipeline(options: {
     cwd?: string;
     projectRoot?: string;
     checkoutOverride?: string;
+    runId?: string;
+    checkoutRoot?: string;
+    repository?: string;
+    ref?: string;
+    resolvedSha?: string;
+    runBranch?: string;
     gitSha?: string;
     ciPrUrl?: string;
     ciJobUrl?: string;
+    reuseExistingRun?: boolean;
     hitl?: StageHitlController;
     maxActiveStagesPerRun?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
+    schedulingHalt?: {
+        halted: boolean;
+    };
+    callerId?: string | null;
+    skills?: SkillsPayload;
 }): Promise<StartedPipeline>;
 export declare function resolveTaskPath(taskArg: string, cwd?: string): string;