start-command 0.35.4 → 0.37.0

package/test/javascript-first-ci.js

@@ -0,0 +1,216 @@
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { readdirSync, readFileSync } = require('node:fs');
+const { resolve } = require('node:path');
+const { YAML } = require('bun');
+const { spawnSync } = require('node:child_process');
+const {
+  checkJavaScriptFirst,
+} = require('../../scripts/check-javascript-first.mjs');
+const {
+  checkFeatureChanges,
+} = require('../../scripts/check-feature-parity.mjs');
+
+const root = resolve(__dirname, '../..');
+function workflows() {
+  return Object.fromEntries(
+    readdirSync(resolve(root, '.github/workflows'))
+      .filter((name) => name.endsWith('.yml'))
+      .map((name) => [
+        name,
+        YAML.parse(
+          readFileSync(resolve(root, '.github/workflows', name), 'utf8')
+        ),
+      ])
+  );
+}
+
+describe('JavaScript first CI gate', () => {
+  it('validates every current workflow using parsed YAML', () => {
+    assert.deepEqual(checkJavaScriptFirst(workflows()), []);
+  });
+
+  for (const [name, mutate] of [
+    [
+      'independent Rust PR trigger',
+      (files) => {
+        files['rust.yml'].on.pull_request = {};
+      },
+    ],
+    [
+      'removed successful-stage condition',
+      (files) => {
+        files['js.yml'].jobs['rust-stage'].if = 'always()';
+      },
+    ],
+    [
+      'an alternative that bypasses the successful stage',
+      (files) => {
+        files['js.yml'].jobs['rust-stage'].if =
+          "${{ !cancelled() && needs.pipeline-status.result == 'success' || true }}";
+      },
+    ],
+    [
+      'Rust-only path filter',
+      (files) => {
+        files['js.yml'].on.pull_request.paths = ['js/**'];
+      },
+    ],
+    [
+      'Rust security matrix bypass',
+      (files) => {
+        files['security.yml'].jobs.codeql.strategy.matrix.language.push('rust');
+      },
+    ],
+    [
+      'direct Rust CodeQL bypass',
+      (files) => {
+        files['new.yml'] = {
+          jobs: {
+            scan: {
+              steps: [
+                {
+                  uses: 'github/codeql-action/init@v4',
+                  with: { languages: 'rust' },
+                },
+              ],
+            },
+          },
+        };
+      },
+    ],
+    [
+      'comma-delimited Rust CodeQL bypass',
+      (files) => {
+        files['new.yml'] = {
+          jobs: {
+            scan: {
+              steps: [
+                {
+                  uses: 'github/codeql-action/init@v4',
+                  with: { languages: 'javascript-typescript,rust' },
+                },
+              ],
+            },
+          },
+        };
+      },
+    ],
+    [
+      'Rust CodeQL matrix include bypass',
+      (files) => {
+        files['security.yml'].jobs.codeql.strategy.matrix = {
+          include: [{ language: 'rust' }],
+        };
+      },
+    ],
+    [
+      'independent Rustup tooling',
+      (files) => {
+        files['new.yml'] = {
+          jobs: {
+            install: {
+              steps: [{ run: 'rustup toolchain install stable' }],
+            },
+          },
+        };
+      },
+    ],
+    [
+      'release key outside main environment',
+      (files) => {
+        delete files['js.yml'].jobs.release.environment;
+      },
+    ],
+    [
+      'a new ungated Rust workflow',
+      (files) => {
+        files['new.yml'] = {
+          on: { push: {} },
+          jobs: { build: { steps: [{ run: 'cargo build' }] } },
+        };
+      },
+    ],
+    [
+      'conditional parity',
+      (files) => {
+        files['js.yml'].jobs.parity.if = 'false';
+      },
+    ],
+  ]) {
+    it(`rejects ${name}`, () => {
+      const files = workflows();
+      mutate(files);
+      assert.ok(checkJavaScriptFirst(files).length > 0);
+    });
+  }
+
+  for (const result of ['failure', 'cancelled', 'skipped']) {
+    it(`rejects a ${result} required JavaScript check`, () => {
+      const check = spawnSync(
+        process.execPath,
+        [resolve(root, 'scripts/check-stage-status.mjs'), '--required', 'test'],
+        {
+          env: {
+            ...process.env,
+            NEEDS_JSON: JSON.stringify({ test: { result } }),
+          },
+        }
+      );
+      assert.equal(check.status, 1);
+    });
+  }
+
+  it('opens the gate only after all required checks succeed', () => {
+    const check = spawnSync(
+      process.execPath,
+      [resolve(root, 'scripts/check-stage-status.mjs'), '--required', 'test'],
+      {
+        env: {
+          ...process.env,
+          NEEDS_JSON: JSON.stringify({
+            test: { result: 'success' },
+            release: { result: 'skipped' },
+          }),
+        },
+      }
+    );
+    assert.equal(check.status, 0);
+  });
+
+  it('rejects a change to only one implementation of a feature', () => {
+    const features = [
+      {
+        id: 'sample',
+        javascript: { implementation: ['js/source.js'], tests: ['js/test.js'] },
+        rust: { implementation: ['rust/source.rs'], tests: ['rust/test.rs'] },
+      },
+    ];
+    assert.equal(checkFeatureChanges(features, ['rust/source.rs']).length, 1);
+    assert.equal(checkFeatureChanges(features, ['js/source.js']).length, 1);
+    assert.deepEqual(
+      checkFeatureChanges(features, ['js/source.js', 'rust/test.rs']),
+      []
+    );
+  });
+
+  it('makes Rust callable only after the complete JavaScript stage', () => {
+    const files = workflows();
+    assert.deepEqual(Object.keys(files['rust.yml'].on), ['workflow_call']);
+    const call = files['js.yml'].jobs['rust-stage'];
+    assert.equal(call.uses, './.github/workflows/rust.yml');
+    assert.deepEqual(call.needs, ['pipeline-status']);
+    assert.match(call.if, /needs\.pipeline-status\.result == 'success'/);
+    assert.equal(call.concurrency['cancel-in-progress'], false);
+  });
+
+  it('always runs JavaScript and its behavioral parity gate on Rust-only changes', () => {
+    const js = workflows()['js.yml'];
+    for (const trigger of ['push', 'pull_request']) {
+      assert.equal(js.on[trigger].paths, undefined);
+      assert.equal(js.on[trigger]['paths-ignore'], undefined);
+    }
+    assert.ok(js.jobs.parity);
+    assert.equal(js.jobs.parity.if, undefined);
+  });
+});

package/test/log-sanitizer.js

@@ -0,0 +1,306 @@
+#!/usr/bin/env bun
+const { describe, it } = require('node:test');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const {
+  sanitizeLogToTemp,
+  StreamingSanitizer,
+} = require('../src/lib/log-sanitizer');
+
+function credentials() {
+  return [
+    ...'pousr'.split('').map((kind) => `gh${kind}_${'a'.repeat(36)}`),
+    `github_` + `pat_${'b'.repeat(82)}`,
+    `sk-${'c'.repeat(48)}`,
+    `sk-` + `proj-${'d'.repeat(90)}`,
+    `sk-` + `ant-api03-${'e'.repeat(90)}`,
+    `AK` + `IA${'F'.repeat(16)}`,
+    `AS` + `IA${'G'.repeat(16)}`,
+    'ey' + 'JhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.signature',
+    'Authorization: Bearer arbitrary-credential',
+    'Proxy-Authorization: Basic encoded-credential',
+    'https://user:password@example.test/repo.git',
+    'AWS_SECRET_ACCESS_KEY=arbitrary-aws-secret',
+    'custom-secret-value',
+    `${Buffer.from(' \n{"alg":"HS256"}').toString('base64url')}.${Buffer.from('{"sub":"x"}').toString('base64url')}.signature`,
+  ];
+}
+
+function sanitize(input, blockSize) {
+  const sanitizer = new StreamingSanitizer({
+    START_TEST_SECRET: 'custom-secret-value',
+  });
+  const blocks = [];
+  for (let offset = 0; offset < input.length; offset += blockSize) {
+    blocks.push(sanitizer.push(input.subarray(offset, offset + blockSize)));
+  }
+  blocks.push(sanitizer.push(Buffer.alloc(0), true));
+  return Buffer.concat(blocks);
+}
+
+describe('log sanitization', () => {
+  it('redacts required formats and environment values at every chunk boundary', () => {
+    const secrets = credentials();
+    for (const size of [1, 7, 31, 256, 1024, 65536]) {
+      const input = Buffer.from(
+        `ordinary utf8: café 😀\n${' '.repeat(Math.max(0, size - 43))}${secrets.join('\n')}\n${'padding\n'.repeat(400)}finished\n`
+      );
+      const output = sanitize(input, size).toString();
+      for (const secret of secrets) {
+        assert.ok(!output.includes(secret));
+      }
+      for (const value of [
+        'arbitrary-credential',
+        'encoded-credential',
+        'password',
+        'arbitrary-aws-secret',
+      ]) {
+        assert.ok(!output.includes(value));
+      }
+      assert.ok(output.startsWith('ordinary utf8: café 😀\n'));
+      assert.ok(output.endsWith('\nfinished\n'));
+    }
+  });
+
+  it('bounds memory for long tokens and authorization values without releasing suffixes', () => {
+    for (const prefix of ['gh' + 'p_', 'Authorization: Bearer ']) {
+      const sanitizer = new StreamingSanitizer({});
+      let output = sanitizer.push(Buffer.from(prefix));
+      for (let i = 0; i < 128; i++) {
+        output = Buffer.concat([
+          output,
+          sanitizer.push(Buffer.alloc(16384, 97)),
+        ]);
+        assert.ok(sanitizer.pendingBytes <= 65536);
+      }
+      output = Buffer.concat([
+        output,
+        sanitizer.push(Buffer.from('\nordinary\n'), true),
+      ]);
+      assert.strictEqual(output.toString(), '[REDACTED]\nordinary\n');
+    }
+  });
+
+  it('retains full header continuation when an inner token reaches the same block boundary', () => {
+    const sanitizer = new StreamingSanitizer({});
+    const input = Buffer.from(
+      `Authorization: Bearer gh${'p_'}${'a'.repeat(131072)} trailing-private-value\nordinary\n`
+    );
+    const output = [];
+    for (let offset = 0; offset < input.length; offset += 65536) {
+      output.push(sanitizer.push(input.subarray(offset, offset + 65536)));
+    }
+    output.push(sanitizer.push(Buffer.alloc(0), true));
+    assert.strictEqual(
+      Buffer.concat(output).toString(),
+      '[REDACTED]\nordinary\n'
+    );
+  });
+
+  it('redacts AWS assignment values enclosed in either quote style', () => {
+    const sanitizer = new StreamingSanitizer({});
+    const output = sanitizer
+      .push(
+        Buffer.from(
+          `AWS_SECRET_ACCESS_KEY="quoted-aws-secret"\nAWS_SESSION_TOKEN='quoted-session-value'\n`
+        ),
+        true
+      )
+      .toString();
+    assert.ok(!output.includes('quoted-aws-secret'));
+    assert.ok(!output.includes('quoted-session-value'));
+  });
+
+  it('redacts multiline and short known secrets, preserving unrelated bytes', () => {
+    const sanitizer = new StreamingSanitizer({
+      GH_TOKEN: 'abc\nxyz',
+      TEST_PASSWORD: '!',
+    });
+    const output = sanitizer
+      .push(Buffer.from('safe abc\nxyz value !'), true)
+      .toString();
+    assert.strictEqual(output, 'safe [REDACTED] value [REDACTED]');
+  });
+
+  it('merges overlapping environment secrets and preserves ordinary domain names', () => {
+    const sanitizer = new StreamingSanitizer({
+      GH_TOKEN: 'abcde',
+      TEST_PASSWORD: 'cdefg',
+      GITHUB_PAT: 'opaque-known-pat',
+    });
+    assert.strictEqual(
+      sanitizer
+        .push(
+          Buffer.from('abcdefg opaque-known-pat example.test.invalid'),
+          true
+        )
+        .toString(),
+      '[REDACTED] [REDACTED] example.test.invalid'
+    );
+    const short = new StreamingSanitizer({ GH_TOKEN: 'a' });
+    assert.strictEqual(
+      short.push(Buffer.alloc(65536, 97), true).toString(),
+      '[REDACTED]'
+    );
+  });
+
+  it('creates a private sanitized copy and removes it without changing the source', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-test-'));
+    const source = path.join(dir, 'source.log');
+    const input = `gh` + `p_${'x'.repeat(36)}`;
+    fs.writeFileSync(source, input);
+    try {
+      const copy = sanitizeLogToTemp(source, { env: {} });
+      assert.notStrictEqual(copy.path, source);
+      assert.strictEqual(fs.readFileSync(copy.path, 'utf8'), '[REDACTED]');
+      if (process.platform !== 'win32') {
+        assert.strictEqual(fs.statSync(copy.path).mode & 0o777, 0o600);
+        assert.strictEqual(
+          fs.statSync(path.dirname(copy.path)).mode & 0o777,
+          0o700
+        );
+      }
+      assert.strictEqual(fs.readFileSync(source, 'utf8'), input);
+      copy.cleanup();
+      assert.ok(!fs.existsSync(copy.path));
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('enforces private permissions at creation even with a permissive umask', () => {
+    if (process.platform === 'win32') {
+      return;
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-creation-'));
+    const source = path.join(dir, 'source.log');
+    fs.writeFileSync(source, 'ordinary output');
+    const originalOpen = fs.openSync;
+    const originalUmask = process.umask(0);
+    let creationChecked = false;
+    let copy;
+    fs.openSync = (...args) => {
+      if (args[1] !== 'wx') {
+        return originalOpen(...args);
+      }
+      assert.strictEqual(
+        fs.statSync(path.dirname(args[0])).mode & 0o777,
+        0o700
+      );
+      const descriptor = originalOpen(...args);
+      assert.strictEqual(fs.fstatSync(descriptor).mode & 0o777, 0o600);
+      creationChecked = true;
+      return descriptor;
+    };
+    try {
+      copy = sanitizeLogToTemp(source, { env: {} });
+      assert.ok(creationChecked);
+      assert.strictEqual(fs.readFileSync(copy.path, 'utf8'), 'ordinary output');
+    } finally {
+      fs.openSync = originalOpen;
+      process.umask(originalUmask);
+      copy?.cleanup();
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('fails closed on invalid source and excessive environment secret sizes', () => {
+    assert.throws(
+      () => sanitizeLogToTemp('/does-not-exist', { env: {} }),
+      /sanitization failed/i
+    );
+    assert.throws(
+      () => new StreamingSanitizer({ GH_TOKEN: 'a'.repeat(65537) }),
+      /too large/i
+    );
+  });
+
+  it('blocks both upload paths on read or write failure and does not expose exception text', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-errors-'));
+    const source = path.join(dir, 'source.log');
+    fs.writeFileSync(source, 'ordinary log');
+    const { uploadLogPath } = require('../src/lib/log-uploader');
+    const { uploadLog } = require('../src/lib/failure-handler');
+    const messages = [];
+    const originalLog = console.log;
+    console.log = (message) => messages.push(message);
+    try {
+      for (const method of ['readSync', 'writeSync', 'fsyncSync']) {
+        const original = fs[method];
+        fs[method] = () => {
+          throw new Error('sensitive error details');
+        };
+        try {
+          assert.strictEqual(uploadLogPath(source).success, false);
+          assert.strictEqual(uploadLog(source), null);
+        } finally {
+          fs[method] = original;
+        }
+      }
+      assert.ok(
+        messages.every(
+          (message) => !message.includes('sensitive error details')
+        )
+      );
+    } finally {
+      console.log = originalLog;
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('sanitizes manual and automatic uploads, explicitly requests private visibility, and cleans copies', () => {
+    if (process.platform === 'win32') {
+      return;
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'upload-sanitize-test-'));
+    const log = path.join(dir, 'source.log');
+    fs.writeFileSync(log, `gh` + `p_${'x'.repeat(36)}`);
+    fs.writeFileSync(
+      path.join(dir, 'gh-upload-log'),
+      '#!/bin/sh\nprintf "%s\\n" "$@" > "$CAPTURE_ARGS"\ncat "$1" > "$CAPTURE_LOG"\nls -ld "$1" | cut -c1-10 > "$CAPTURE_MODE"\necho https://gist.github.com/test/id\n',
+      { mode: 0o755 }
+    );
+    try {
+      for (const kind of ['manual', 'automatic', 'optout']) {
+        const script =
+          kind === 'automatic'
+            ? `require(${JSON.stringify(require.resolve('../src/lib/failure-handler'))}).uploadLog(process.env.SOURCE_LOG)`
+            : `require(${JSON.stringify(require.resolve('../src/lib/log-uploader'))}).uploadLogPath(process.env.SOURCE_LOG, { noSanitize: ${kind === 'optout'} })`;
+        execFileSync(process.execPath, ['-e', script], {
+          env: {
+            ...process.env,
+            PATH: `${dir}${path.delimiter}${process.env.PATH}`,
+            SOURCE_LOG: log,
+            CAPTURE_ARGS: path.join(dir, 'args'),
+            CAPTURE_LOG: path.join(dir, 'uploaded'),
+            CAPTURE_MODE: path.join(dir, 'mode'),
+            GH_UPLOAD_PUBLIC: 'true',
+          },
+          stdio: 'pipe',
+        });
+        const args = fs
+          .readFileSync(path.join(dir, 'args'), 'utf8')
+          .trim()
+          .split('\n');
+        assert.strictEqual(args[1], '--private');
+        assert.strictEqual(
+          fs.readFileSync(path.join(dir, 'uploaded'), 'utf8'),
+          kind === 'optout' ? fs.readFileSync(log, 'utf8') : '[REDACTED]'
+        );
+        if (kind !== 'optout') {
+          assert.notStrictEqual(args[0], log);
+          assert.ok(!fs.existsSync(args[0]));
+          assert.strictEqual(
+            fs.readFileSync(path.join(dir, 'mode'), 'utf8').trim(),
+            '-rw-------'
+          );
+        }
+      }
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/test/regression-174.js

@@ -100,9 +100,11 @@ function runWatcher({ policy, running, state, withLog = true }) {
     [
       '#!/bin/sh',
       `dir='${dir}'`,
+      '[ "$START_COMMAND_CGROUP_SAMPLING" = 1 ] && exit 1',
       'case "$1" in',
       '  inspect)',
       '    case "$3" in',
+      '      *HostConfig*) exit 1 ;;',
       '      *State.Running*)',
       '        answer=$(head -n 1 "$dir/running")',
       '        if [ "$(wc -l < "$dir/running")" -gt 1 ]; then',
@@ -173,7 +175,7 @@ describe('issue #174: docker logs -f returning is not the container exiting', ()
     });
 
     expect(run.status).toBe(0);
-    expect(run.calls).toContain('wait');
+    expect(run.calls).toContain('inspect-running false');
     expect(run.calls.indexOf('wait')).toBeGreaterThan(
       run.calls.indexOf('logs')
     );

package/test/regression-176.js

@@ -127,6 +127,12 @@ function fakeRunner(hostConfig, failures = {}) {
     if (args[0] === 'inspect' && args.includes('{{json .HostConfig}}')) {
       return ok(`${JSON.stringify(hostConfig)}\n`);
     }
+    if (args.includes('--size')) {
+      return ok('1024');
+    }
+    if (args[0] === 'info') {
+      return ok(JSON.stringify({ DockerRootDir: os.tmpdir() }));
+    }
     return ok('cid\n');
   };
   runner.calls = calls;
@@ -300,6 +306,7 @@ describe('issue #176: snapshot resume keeps the resource limits', () => {
       command: 'npm run build',
       probe: stoppedProbe,
       runner,
+      snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
       startWatcher: (...args) => watchers.push(args),
     });
     expect(result.success).toBe(true);

package/test/regression-180.js

@@ -70,20 +70,20 @@ describe('issue #180: the sticky OOMKilled flag is not an exit reason', () => {
     {
       exitCode: 137,
       oomKilled: true,
-      reason: CGROUP_OOM_EXIT_REASON,
-      memory: true,
+      reason: 'signal (SIGKILL; cause unknown)',
+      memory: false,
     },
     {
       exitCode: 137,
       oomKilled: false,
-      reason: 'signal (SIGKILL)',
+      reason: 'signal (SIGKILL; cause unknown)',
       memory: false,
     },
     {
       exitCode: -1,
       oomKilled: true,
-      reason: CGROUP_OOM_EXIT_REASON,
-      memory: true,
+      reason: null,
+      memory: false,
     },
     {
       exitCode: 139,
@@ -104,10 +104,17 @@ describe('issue #180: the sticky OOMKilled flag is not an exit reason', () => {
     });
   }
 
-  it('blames the flag on the command only for SIGKILL or an unknown exit', () => {
-    expect(isOomKillOfCommand({ exitCode: 137, oomKilled: true })).toBe(true);
-    expect(isOomKillOfCommand({ exitCode: null, oomKilled: true })).toBe(true);
-    expect(isOomKillOfCommand({ exitCode: -1, oomKilled: true })).toBe(true);
+  it('requires fresh attribution in addition to SIGKILL or an unknown exit', () => {
+    expect(isOomKillOfCommand({ exitCode: 137, oomKilled: true })).toBe(false);
+    expect(
+      isOomKillOfCommand({
+        exitCode: 137,
+        oomKilled: true,
+        exitEvidence: { mainOom: true },
+      })
+    ).toBe(true);
+    expect(isOomKillOfCommand({ exitCode: null, oomKilled: true })).toBe(false);
+    expect(isOomKillOfCommand({ exitCode: -1, oomKilled: true })).toBe(false);
     expect(isOomKillOfCommand({ exitCode: 0, oomKilled: true })).toBe(false);
     expect(isOomKillOfCommand({ exitCode: 1, oomKilled: true })).toBe(false);
     expect(isOomKillOfCommand({ exitCode: 137, oomKilled: false })).toBe(false);
@@ -191,6 +198,6 @@ describe('issue #180: the sticky OOMKilled flag is not an exit reason', () => {
       oomKilled: true,
       logPath: null,
     });
-    expect(main).toContain('Docker reports it was OOM-killed.');
+    expect(main).toContain('Docker reports a process in it was OOM-killed.');
   });
 });

package/test/regression-182.js

@@ -285,9 +285,13 @@ describe('issue #182: the watcher samples the cgroup while the container runs',
       timeout: 20000,
     });
     expect(result.status).toBe(0);
-    expect(fs.readFileSync(path.join(host.dir, 'sample'), 'utf8')).toBe(
-      OOM_SAMPLE
-    );
+    expect(
+      fs
+        .readFileSync(path.join(host.dir, 'sample'), 'utf8')
+        .split(' ')
+        .slice(0, 4)
+        .join(' ')
+    ).toBe(OOM_SAMPLE);
     expect(fs.readFileSync(logPath, 'utf8')).toBe(
       `${formatCgroupMemoryLogLine(OOM_SAMPLE)}\n`
     );

package/test/regression-185.js

@@ -97,15 +97,10 @@ describe('issue #185: counter-only OOM scope is unknown', () => {
     }
     for (const exitCode of [137, null, -1]) {
       const input = { exitCode, oomKilled: false, cgroupMemory };
-      expect(resolveExitReason(input)).toBe(CGROUP_OOM_EXIT_REASON);
-      expect(resolveMemoryExhaustion(input)).toEqual(
-        exitCode === null
-          ? null
-          : {
-              memoryExhausted: true,
-              memoryExhaustedReason: 'cgroup memory.events reported oom_kill=3',
-            }
-      );
+      expect(resolveExitReason(input)).not.toBe(CGROUP_OOM_EXIT_REASON);
+      expect(resolveMemoryExhaustion(input)).toBeNull();
+      const attributed = { ...input, exitEvidence: { mainOom: true } };
+      expect(resolveExitReason(attributed)).toBe(CGROUP_OOM_EXIT_REASON);
     }
   });
 });

package/test/regression-187.js

@@ -76,7 +76,15 @@ function fixture() {
 }
 
 const stopped = () => ({ alive: false, state: SessionState.STOPPED });
-const accepted = () => ({ success: true, stdout: 'container-id\n', status: 0 });
+const accepted = (_bin, args = []) => ({
+  success: true,
+  stdout: args.includes('--size')
+    ? '1024'
+    : args[0] === 'info'
+      ? JSON.stringify({ DockerRootDir: os.tmpdir() })
+      : 'container-id\n',
+  status: 0,
+});
 
 describe('issue #187: explicit resume attempts', () => {
   it('reattaches the current attempt without enabling kill recovery for snapshot commands', async () => {
@@ -368,7 +376,8 @@ esac
       probe: () => ({ alive: false, state: SessionState.MISSING }),
       runIsolated: (backend, command, options) => {
         expect(options.deferCompletionWatcher).toBe(true);
-        expect(store.get(record.uuid).status).toBe('executed');
+        expect(store.get(record.uuid).status).toBe('executing');
+        expect(store.get(record.uuid).options.launchPending).toBe(true);
         return { success: true, containerId: 'replacement-container' };
       },
       startWatcher: () => {