start-command 0.35.4 → 0.37.0

package/src/lib/log-sanitizer.js

@@ -0,0 +1,267 @@
+/** Bounded byte-wise sanitization for logs prepared for publication. */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const BLOCK_SIZE = 64 * 1024;
+const MARKER = '[REDACTED]';
+const SECRET_ENV_NAME =
+  /(?:^|_)(?:TOKEN|(?:API|ACCESS|PRIVATE)?KEY|SECRET|PASSWORD|PASSWD|CREDENTIALS?|AUTH|PAT)(?:_|$)/i;
+
+// Prefixes intentionally match even truncated tokens. Unbounded values retain a
+// continuation state, so a token or header larger than a block cannot leak its
+// suffix. Latin-1 provides a reversible byte mapping, including invalid UTF-8.
+const RULES = [
+  {
+    pattern:
+      /\b[A-Za-z0-9_-]{2,512}\.[A-Za-z0-9_-]{2,512}\.[A-Za-z0-9_-]{0,512}/g,
+    validate: (value) => {
+      try {
+        return (
+          typeof JSON.parse(
+            Buffer.from(value.split('.')[0], 'base64url').toString()
+          ).alg === 'string'
+        );
+      } catch {
+        return false;
+      }
+    },
+    continuation: /[A-Za-z0-9_.-]/,
+  },
+  {
+    pattern: /[A-Za-z0-9_-]{512,}[A-Za-z0-9_.-]*/g,
+    continuation: /[A-Za-z0-9_.-]/,
+  },
+  {
+    pattern: /(?:gh[pousr]_|github_pat_|sk-)[A-Za-z0-9_-]*/g,
+    continuation: /[A-Za-z0-9_-]/,
+  },
+  { pattern: /(?:AKIA|ASIA)[A-Z0-9]{16}/g },
+  { pattern: /eyJ[A-Za-z0-9_.-]*/g, continuation: /[A-Za-z0-9_.-]/ },
+  {
+    pattern: /(?:Proxy-)?Authorization[ \t]{0,32}:[^\r\n]*/gi,
+    continuation: /[^\r\n]/,
+  },
+  {
+    pattern:
+      /(?:AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)[ \t]{0,32}[=:][ \t]*["']?[^\s"';,]*/g,
+    continuation: /[^\s"';,]/,
+  },
+  {
+    pattern: /(?:https?|git|ssh):\/\/[^\s:/@]{1,256}:[^\s@]*/g,
+    continuation: /[^\s@]/,
+  },
+];
+
+class StreamingSanitizer {
+  constructor(env = process.env) {
+    this.secrets = [
+      ...new Set(
+        Object.entries(env)
+          .filter(
+            ([name, value]) =>
+              SECRET_ENV_NAME.test(name) &&
+              typeof value === 'string' &&
+              value.length
+          )
+          .map(([, value]) => Buffer.from(value).toString('latin1'))
+      ),
+    ].sort((a, b) => b.length - a.length);
+    if (this.secrets.some((value) => value.length > BLOCK_SIZE)) {
+      throw new Error(
+        'Known environment secret is too large for bounded sanitization.'
+      );
+    }
+    this.holdback = this.secrets.reduce(
+      (size, value) => Math.max(size, value.length),
+      2048
+    );
+    this.pending = '';
+    this.continuation = null;
+    this.redactions = 0;
+  }
+
+  get pendingBytes() {
+    return this.pending.length;
+  }
+
+  findMatches(input) {
+    const matches = [];
+    for (const rule of RULES) {
+      rule.pattern.lastIndex = 0;
+      for (
+        let match = rule.pattern.exec(input);
+        match;
+        match = rule.pattern.exec(input)
+      ) {
+        if (!rule.validate || rule.validate(match[0])) {
+          matches.push({
+            index: match.index,
+            end: match.index + match[0].length,
+            continuation: rule.continuation,
+          });
+        }
+      }
+    }
+    for (const secret of this.secrets) {
+      for (
+        let index = input.indexOf(secret);
+        index >= 0;
+        index = input.indexOf(secret, index + 1)
+      ) {
+        matches.push({ index, end: index + secret.length });
+      }
+    }
+    matches.sort((a, b) => a.index - b.index || b.end - a.end);
+    const merged = [];
+    for (const match of matches) {
+      const previous = merged[merged.length - 1];
+      if (previous && match.index <= previous.end) {
+        if (match.end > previous.end) {
+          previous.end = match.end;
+          previous.continuation = match.continuation;
+        } else if (match.end === previous.end && match.continuation) {
+          // Nested tokens must not narrow a containing header/URL's suffix.
+          const retained = previous.continuation;
+          const additional = match.continuation;
+          previous.continuation = retained
+            ? { test: (byte) => retained.test(byte) || additional.test(byte) }
+            : additional;
+        }
+      } else {
+        merged.push({ ...match });
+      }
+    }
+    return merged;
+  }
+
+  push(block, final = false) {
+    let input = this.pending + block.toString('latin1');
+    this.pending = '';
+    if (this.continuation) {
+      let end = 0;
+      while (end < input.length && this.continuation.test(input[end])) {
+        end++;
+      }
+      input = input.slice(end);
+      if (!input.length && !final) {
+        return Buffer.alloc(0);
+      }
+      this.continuation = null;
+    }
+    const safeEnd = final
+      ? input.length
+      : Math.max(0, input.length - this.holdback);
+    let offset = 0;
+    const output = [];
+    for (const match of this.findMatches(input)) {
+      if (match.index >= safeEnd) {
+        break;
+      }
+      output.push(input.slice(offset, match.index), MARKER);
+      this.redactions++;
+      offset = match.end;
+      if (offset === input.length && match.continuation && !final) {
+        this.continuation = match.continuation;
+        break;
+      }
+    }
+    const end = Math.max(offset, safeEnd);
+    output.push(input.slice(offset, end));
+    this.pending = input.slice(end);
+    return Buffer.from(output.join(''), 'latin1');
+  }
+}
+
+/** Returns a private copy plus cleanup; every preparation error blocks upload. */
+function sanitizeLogToTemp(sourcePath, options = {}) {
+  let directory;
+  let source;
+  let destination;
+  let ready = false;
+  let stage = 'environment';
+  try {
+    const sanitizer = new StreamingSanitizer(options.env || process.env);
+    stage = 'source';
+    source = fs.openSync(sourcePath, 'r');
+    if (!fs.fstatSync(source).isFile()) {
+      throw new Error('Source must be a regular file.');
+    }
+    stage = 'private-file';
+    directory = fs.mkdtempSync(path.join(os.tmpdir(), 'start-sanitized-'));
+    fs.chmodSync(directory, 0o700);
+    const target = path.join(directory, 'execution.log');
+    destination = fs.openSync(target, 'wx', 0o600);
+    fs.fchmodSync(destination, 0o600);
+    const buffer = Buffer.alloc(BLOCK_SIZE);
+    let bytes = 0;
+    const write = (output) => {
+      stage = 'write';
+      let offset = 0;
+      while (offset < output.length) {
+        const written = fs.writeSync(
+          destination,
+          output,
+          offset,
+          output.length - offset
+        );
+        if (!written) {
+          throw new Error('No progress writing sanitized log.');
+        }
+        offset += written;
+      }
+    };
+    for (;;) {
+      stage = 'read';
+      const length = fs.readSync(source, buffer, 0, buffer.length, null);
+      if (!length) {
+        break;
+      }
+      bytes += length;
+      stage = 'scan';
+      write(sanitizer.push(buffer.subarray(0, length)));
+    }
+    write(sanitizer.push(Buffer.alloc(0), true));
+    stage = 'sync';
+    fs.fsyncSync(destination);
+    fs.closeSync(destination);
+    destination = undefined;
+    fs.closeSync(source);
+    source = undefined;
+    if (options.verbose) {
+      console.log(
+        `Prepared private sanitized log: ${bytes} bytes scanned, ${sanitizer.redactions} redactions.`
+      );
+    }
+    ready = true;
+    return {
+      path: target,
+      cleanup: () => fs.rmSync(directory, { recursive: true, force: true }),
+    };
+  } catch {
+    if (options.verbose) {
+      console.log(`Log sanitization failed at stage: ${stage}.`);
+    }
+    // Do not echo error messages: paths and exception details can carry secrets.
+    throw new Error('Log sanitization failed; upload blocked.');
+  } finally {
+    for (const fd of [destination, source]) {
+      if (fd !== undefined) {
+        try {
+          fs.closeSync(fd);
+        } catch {
+          /* Best effort after failure. */
+        }
+      }
+    }
+    if (directory && !ready) {
+      try {
+        fs.rmSync(directory, { recursive: true, force: true });
+      } catch {
+        /* Upload remains blocked. */
+      }
+    }
+  }
+}
+
+module.exports = { StreamingSanitizer, sanitizeLogToTemp };

package/src/lib/log-uploader.js

@@ -6,6 +6,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { sanitizeLogToTemp } = require('./log-sanitizer');
 
 function isExecutable(filePath) {
   try {
@@ -135,7 +136,7 @@ function ensureGhUploadLogAvailable() {
   };
 }
 
-function uploadLogPath(logPath) {
+function uploadLogPath(logPath, options = {}) {
   if (!logPath) {
     return {
       success: false,
@@ -146,29 +147,47 @@ function uploadLogPath(logPath) {
     return { success: false, error: `Log file not found: ${logPath}` };
   }
 
-  const availability = ensureGhUploadLogAvailable();
-  if (!availability.success) {
-    return availability;
-  }
-
-  const result = runCommand(availability.command, [logPath], {
-    stdio: 'inherit',
-  });
-
-  const exitCode =
-    result.status !== null && result.status !== undefined ? result.status : 1;
-  if (exitCode !== 0) {
+  let prepared;
+  try {
+    if (!options.noSanitize) {
+      // Wrapper options.env holds Docker arguments, not the process secrets.
+      prepared = sanitizeLogToTemp(logPath, { verbose: options.verbose });
+    }
+    const availability = ensureGhUploadLogAvailable();
+    if (!availability.success) {
+      return availability;
+    }
+    const result = runCommand(
+      availability.command,
+      [prepared ? prepared.path : logPath, '--private'],
+      {
+        stdio: 'inherit',
+      }
+    );
+    const exitCode =
+      result.status !== null && result.status !== undefined ? result.status : 1;
+    if (exitCode !== 0) {
+      return {
+        success: false,
+        exitCode,
+        error: `gh-upload-log exited with code ${exitCode}`,
+      };
+    }
+    return { success: true, exitCode: 0 };
+  } catch {
     return {
       success: false,
-      exitCode,
-      error: `gh-upload-log exited with code ${exitCode}`,
+      exitCode: 1,
+      error: 'Log preparation or upload failed; upload blocked.',
     };
+  } finally {
+    if (prepared) {
+      prepared.cleanup();
+    }
   }
-
-  return { success: true, exitCode: 0 };
 }
 
-function uploadExecutionLog(store, identifier) {
+function uploadExecutionLog(store, identifier, options = {}) {
   if (!store) {
     return { success: false, error: 'Execution tracking is disabled.' };
   }
@@ -181,7 +200,7 @@ function uploadExecutionLog(store, identifier) {
     };
   }
 
-  return uploadLogPath(record.logPath);
+  return uploadLogPath(record.logPath, options);
 }
 
 module.exports = {

package/src/lib/query-commands.js

@@ -38,8 +38,8 @@ function handleListQuery(store, outputFormat, options = {}) {
   return reportResult(listExecutions(store, outputFormat, options));
 }
 
-function handleUploadLogQuery(store, identifier) {
-  const result = uploadExecutionLog(store, identifier);
+function handleUploadLogQuery(store, identifier, options = {}) {
+  const result = uploadExecutionLog(store, identifier, options);
   if (result.success) {
     return result.exitCode || 0;
   }
@@ -55,9 +55,20 @@ function handleAttachQuery(store, identifier, readOnly) {
   return reportResult(attachExecution(store, identifier, { readOnly }));
 }
 
-async function handleResumeQuery(store, identifier, command, outputFormat) {
+async function handleResumeQuery(
+  store,
+  identifier,
+  command,
+  outputFormat,
+  resourceOptions = {}
+) {
   return reportResult(
-    await resumeExecution(store, identifier, { command, outputFormat })
+    await resumeExecution(store, identifier, {
+      command,
+      outputFormat,
+      resourceOptions,
+      removeOriginal: resourceOptions.removeOriginal === true,
+    })
   );
 }
 
@@ -154,7 +165,7 @@ async function dispatchQueryCommand(options, context = {}) {
     return handleListQuery(store, outputFormat, { running: options.running });
   }
   if (hasValue(options.uploadLog)) {
-    return handleUploadLogQuery(store, options.uploadLog);
+    return handleUploadLogQuery(store, options.uploadLog, options);
   }
   if (hasValue(options.stop)) {
     return handleControlQuery(store, options.stop, ControlAction.STOP);
@@ -174,7 +185,8 @@ async function dispatchQueryCommand(options, context = {}) {
       store,
       options.resume,
       context.command || null,
-      outputFormat
+      outputFormat,
+      options
     );
   }
   if (options.resumeAll) {

package/src/lib/resume-resources.js

@@ -0,0 +1,88 @@
+const {
+  normalizeResourceLimits,
+  cpuCount,
+  withCpuLimit,
+  readDockerResourceLimits,
+} = require('./docker-resource-limits');
+const { resolveResourceOptions } = require('./docker-resource-options');
+
+// Temporary penalty quotas must never become a resumed execution's base quota.
+function restoreBaseCpu(limits, options) {
+  if (!options.cpuPenaltyConfig) {
+    return limits;
+  }
+  const base = normalizeResourceLimits(
+    options.baseResourceLimits || options.resourceLimits
+  );
+  return [
+    ...limits.filter((s) => !/^--(?:cpus|cpu-quota|cpu-period)=/.test(s)),
+    ...base.filter((s) => /^--(?:cpus|cpu-quota|cpu-period)=/.test(s)),
+  ];
+}
+
+function prepareResumeResources(record, probe, overrides, runner, random) {
+  const options = record.options || {};
+  if (options.isolated !== 'docker') {
+    if (
+      ['memory', 'memorySwap', 'cpus'].some(
+        (k) => overrides[k] !== null && overrides[k] !== undefined
+      )
+    ) {
+      throw new Error('Resource overrides require a Docker execution');
+    }
+    return null;
+  }
+  const live =
+    probe.state === 'stopped'
+      ? readDockerResourceLimits(options.sessionName, runner)
+      : null;
+  const base = restoreBaseCpu(
+    normalizeResourceLimits(live || options.resourceLimits),
+    options
+  );
+  const oldMemory = base.find((s) => s.startsWith('--memory='))?.slice(9);
+  const result = resolveResourceOptions(
+    { ...overrides, resourceLimits: base },
+    runner,
+    random
+  );
+  if (overrides.cpus && probe.state === 'stopped') {
+    // Docker cannot switch an existing legacy quota to NanoCPUs in place.
+    const cpu = withCpuLimit(base, result.resolvedLimits.cpus);
+    result.resourceLimits = [
+      ...result.resourceLimits.filter(
+        (s) => !/^--(?:cpus|cpu-quota|cpu-period)=/.test(s)
+      ),
+      ...cpu.filter((s) => /^--(?:cpus|cpu-quota|cpu-period)=/.test(s)),
+    ];
+  }
+  result.oldMemory = oldMemory
+    ? require('./docker-resource-options').parseResourceSpec(oldMemory).amount
+    : 'unlimited';
+  result.resolvedLimits = {
+    ...options.resolvedLimits,
+    ...result.resolvedLimits,
+  };
+  result.resourceLimitSpecs = {
+    ...options.resourceLimitSpecs,
+    ...result.resourceLimitSpecs,
+  };
+  result.update =
+    probe.state === 'stopped' &&
+    (['memory', 'memorySwap', 'cpus'].some(
+      (k) => overrides[k] !== null && overrides[k] !== undefined
+    ) ||
+      Boolean(options.cpuPenaltyConfig));
+  if (options.cpuPenaltyConfig && !overrides.cpus) {
+    result.resourceLimits = clampCpuToDaemon(result.resourceLimits, runner);
+    result.resolvedLimits.cpus = cpuCount(result.resourceLimits);
+  }
+  return result;
+}
+
+function clampCpuToDaemon(limits, runner) {
+  const { readDaemonCapacity } = require('./docker-resource-options');
+  const capacity = readDaemonCapacity(runner).cpus;
+  return withCpuLimit(limits, Math.min(cpuCount(limits) || capacity, capacity));
+}
+module.exports = { prepareResumeResources, restoreBaseCpu, clampCpuToDaemon };

package/src/lib/shell-utils.js

@@ -86,6 +86,10 @@ function splitShellWords(command, style = defaultShellQuotingStyle()) {
       if (i + 1 >= command.length) {
         return null;
       }
+      if (quote === '"' && !'$`"\\\n'.includes(command[i + 1])) {
+        current += char;
+        continue;
+      }
       current += command[++i];
       continue;
     }
@@ -121,10 +125,69 @@ function toShellWords(command) {
   );
 }
 
+/**
+ * Return literal argv only when no outer shell evaluation is needed. Operators,
+ * expansions and comments belong to the outer command line, not the -c script.
+ * Single quotes protect their contents; double quotes still permit expansion.
+ */
+function simpleShellWords(command) {
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i];
+    if (char === '\\' && quote !== "'") {
+      if (command[i + 1] === '\n') {
+        return null;
+      }
+      if (quote !== '"' || '$`"\\\n'.includes(command[i + 1])) {
+        i++;
+      }
+      continue;
+    }
+    if (quote === "'") {
+      if (char === "'") {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '$' || char === '`') {
+      return null;
+    }
+    if (quote === '"') {
+      if (char === '"') {
+        quote = null;
+      }
+      continue;
+    }
+    if (';&|<>(){}\n\r*?[]~#'.includes(char)) {
+      return null;
+    }
+    if (/\s/.test(char) && !' \t'.includes(char)) {
+      return null;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+    }
+  }
+  return splitShellWords(command, 'posix');
+}
+
+function shellScriptIndex(parts) {
+  if (!parts || !SHELL_NAMES.includes(path.basename(parts[0] || ''))) {
+    return -1;
+  }
+  const index = parts.indexOf('-c');
+  return index > 0 &&
+    index + 1 < parts.length &&
+    parts.slice(1, index).every((part) => /^--?[a-zA-Z][a-zA-Z-]*$/.test(part))
+    ? index
+    : -1;
+}
+
 /** True if command is a bare shell invocation (no -c); avoids bash-inside-bash (issue #84). */
 function isInteractiveShellCommand(command) {
-  const parts = toShellWords(command);
+  const parts = simpleShellWords(command);
   return (
+    parts !== null &&
     parts.length > 0 &&
     SHELL_NAMES.includes(path.basename(parts[0])) &&
     !parts.includes('-c')
@@ -133,25 +196,12 @@ function isInteractiveShellCommand(command) {
 
 /** True if command is a shell invocation with -c (e.g. `bash -i -c "cmd"`); avoids double-wrapping (issue #91). */
 function isShellInvocationWithArgs(command) {
-  const parts = toShellWords(command);
-  return (
-    parts.length > 0 &&
-    SHELL_NAMES.includes(path.basename(parts[0])) &&
-    parts.includes('-c')
-  );
+  return shellScriptIndex(simpleShellWords(command)) !== -1;
 }
 
-/** Build argv for shell-with-c command; everything after -c is one script argument. */
+/** Preserve the script word and every positional argument as separate argv. */
 function buildShellWithArgsCmdArgs(command) {
-  const parts = toShellWords(command);
-  const cIdx = parts.indexOf('-c');
-  if (cIdx === -1) {
-    return parts;
-  }
-  const scriptArg = parts.slice(cIdx + 1).join(' ');
-  return scriptArg.length > 0
-    ? [...parts.slice(0, cIdx + 1), scriptArg]
-    : parts.slice(0, cIdx + 1);
+  return simpleShellWords(command) || toShellWords(command);
 }
 
 /** Quote an argument for display only, keeping the user-facing double-quoted form (issue #91). */

package/src/lib/status-formatter.js

@@ -326,6 +326,9 @@ function applyEndTime(enriched, dockerState, footerFinishedAt) {
 }
 
 function resolveDetachedStatus(record, logTail) {
+  if (require('./launch-owner').hasActiveLaunch(record)) {
+    return record;
+  }
   const footer = parseFooterFromTail(logTail);
   const footerExit = footer.exitCode;
   const dockerState = isDetachedDockerRecord(record)
@@ -444,6 +447,7 @@ function attachExitReason(record, logTail) {
     logTail,
     oomKilled: record.oomKilled,
     cgroupMemory: record.cgroupMemory,
+    exitEvidence: record.options?.exitEvidence,
   });
 
   if (!exitReason) {
@@ -490,9 +494,22 @@ function attachMemoryExhaustion(record, logTail) {
     logTail,
     oomKilled: record.oomKilled,
     cgroupMemory: record.cgroupMemory,
+    exitEvidence: record.options?.exitEvidence,
   });
 
   if (!memory) {
+    if (
+      record.memoryExhaustedReason?.startsWith('Docker reported') ||
+      record.memoryExhaustedReason?.startsWith('cgroup memory.events')
+    ) {
+      const cleared = Object.assign(
+        Object.create(Object.getPrototypeOf(record)),
+        record
+      );
+      delete cleared.memoryExhausted;
+      delete cleared.memoryExhaustedReason;
+      return cleared;
+    }
     return record;
   }
 
@@ -517,6 +534,14 @@ function enrichDetachedStatus(record) {
   if (!record) {
     return record;
   }
+  const cpuPenalty = require('./cpu-penalty-monitor').readState(record);
+  if (cpuPenalty) {
+    record = Object.assign(
+      Object.create(Object.getPrototypeOf(record)),
+      record
+    );
+    record.cpuPenalty = cpuPenalty;
+  }
   const {
     readAttemptActivity,
     readAttemptLogTail,
@@ -693,6 +718,9 @@ function formatRecordAsText(record) {
     ...(formatCgroupMemory(obj.cgroupMemory)
       ? [`Cgroup Memory:     ${formatCgroupMemory(obj.cgroupMemory)}`]
       : []),
+    ...(obj.cpuPenalty
+      ? [`CPU Penalty:       ${JSON.stringify(obj.cpuPenalty)}`]
+      : []),
     `PID:               ${obj.pid !== null ? obj.pid : 'N/A'}`,
     `Working Directory: ${obj.workingDirectory}`,
     `Shell:             ${obj.shell}`,