start-command 0.36.0 → 0.37.0

package/test/javascript-first-ci.js

@@ -0,0 +1,216 @@
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { readdirSync, readFileSync } = require('node:fs');
+const { resolve } = require('node:path');
+const { YAML } = require('bun');
+const { spawnSync } = require('node:child_process');
+const {
+  checkJavaScriptFirst,
+} = require('../../scripts/check-javascript-first.mjs');
+const {
+  checkFeatureChanges,
+} = require('../../scripts/check-feature-parity.mjs');
+
+const root = resolve(__dirname, '../..');
+function workflows() {
+  return Object.fromEntries(
+    readdirSync(resolve(root, '.github/workflows'))
+      .filter((name) => name.endsWith('.yml'))
+      .map((name) => [
+        name,
+        YAML.parse(
+          readFileSync(resolve(root, '.github/workflows', name), 'utf8')
+        ),
+      ])
+  );
+}
+
+describe('JavaScript first CI gate', () => {
+  it('validates every current workflow using parsed YAML', () => {
+    assert.deepEqual(checkJavaScriptFirst(workflows()), []);
+  });
+
+  for (const [name, mutate] of [
+    [
+      'independent Rust PR trigger',
+      (files) => {
+        files['rust.yml'].on.pull_request = {};
+      },
+    ],
+    [
+      'removed successful-stage condition',
+      (files) => {
+        files['js.yml'].jobs['rust-stage'].if = 'always()';
+      },
+    ],
+    [
+      'an alternative that bypasses the successful stage',
+      (files) => {
+        files['js.yml'].jobs['rust-stage'].if =
+          "${{ !cancelled() && needs.pipeline-status.result == 'success' || true }}";
+      },
+    ],
+    [
+      'Rust-only path filter',
+      (files) => {
+        files['js.yml'].on.pull_request.paths = ['js/**'];
+      },
+    ],
+    [
+      'Rust security matrix bypass',
+      (files) => {
+        files['security.yml'].jobs.codeql.strategy.matrix.language.push('rust');
+      },
+    ],
+    [
+      'direct Rust CodeQL bypass',
+      (files) => {
+        files['new.yml'] = {
+          jobs: {
+            scan: {
+              steps: [
+                {
+                  uses: 'github/codeql-action/init@v4',
+                  with: { languages: 'rust' },
+                },
+              ],
+            },
+          },
+        };
+      },
+    ],
+    [
+      'comma-delimited Rust CodeQL bypass',
+      (files) => {
+        files['new.yml'] = {
+          jobs: {
+            scan: {
+              steps: [
+                {
+                  uses: 'github/codeql-action/init@v4',
+                  with: { languages: 'javascript-typescript,rust' },
+                },
+              ],
+            },
+          },
+        };
+      },
+    ],
+    [
+      'Rust CodeQL matrix include bypass',
+      (files) => {
+        files['security.yml'].jobs.codeql.strategy.matrix = {
+          include: [{ language: 'rust' }],
+        };
+      },
+    ],
+    [
+      'independent Rustup tooling',
+      (files) => {
+        files['new.yml'] = {
+          jobs: {
+            install: {
+              steps: [{ run: 'rustup toolchain install stable' }],
+            },
+          },
+        };
+      },
+    ],
+    [
+      'release key outside main environment',
+      (files) => {
+        delete files['js.yml'].jobs.release.environment;
+      },
+    ],
+    [
+      'a new ungated Rust workflow',
+      (files) => {
+        files['new.yml'] = {
+          on: { push: {} },
+          jobs: { build: { steps: [{ run: 'cargo build' }] } },
+        };
+      },
+    ],
+    [
+      'conditional parity',
+      (files) => {
+        files['js.yml'].jobs.parity.if = 'false';
+      },
+    ],
+  ]) {
+    it(`rejects ${name}`, () => {
+      const files = workflows();
+      mutate(files);
+      assert.ok(checkJavaScriptFirst(files).length > 0);
+    });
+  }
+
+  for (const result of ['failure', 'cancelled', 'skipped']) {
+    it(`rejects a ${result} required JavaScript check`, () => {
+      const check = spawnSync(
+        process.execPath,
+        [resolve(root, 'scripts/check-stage-status.mjs'), '--required', 'test'],
+        {
+          env: {
+            ...process.env,
+            NEEDS_JSON: JSON.stringify({ test: { result } }),
+          },
+        }
+      );
+      assert.equal(check.status, 1);
+    });
+  }
+
+  it('opens the gate only after all required checks succeed', () => {
+    const check = spawnSync(
+      process.execPath,
+      [resolve(root, 'scripts/check-stage-status.mjs'), '--required', 'test'],
+      {
+        env: {
+          ...process.env,
+          NEEDS_JSON: JSON.stringify({
+            test: { result: 'success' },
+            release: { result: 'skipped' },
+          }),
+        },
+      }
+    );
+    assert.equal(check.status, 0);
+  });
+
+  it('rejects a change to only one implementation of a feature', () => {
+    const features = [
+      {
+        id: 'sample',
+        javascript: { implementation: ['js/source.js'], tests: ['js/test.js'] },
+        rust: { implementation: ['rust/source.rs'], tests: ['rust/test.rs'] },
+      },
+    ];
+    assert.equal(checkFeatureChanges(features, ['rust/source.rs']).length, 1);
+    assert.equal(checkFeatureChanges(features, ['js/source.js']).length, 1);
+    assert.deepEqual(
+      checkFeatureChanges(features, ['js/source.js', 'rust/test.rs']),
+      []
+    );
+  });
+
+  it('makes Rust callable only after the complete JavaScript stage', () => {
+    const files = workflows();
+    assert.deepEqual(Object.keys(files['rust.yml'].on), ['workflow_call']);
+    const call = files['js.yml'].jobs['rust-stage'];
+    assert.equal(call.uses, './.github/workflows/rust.yml');
+    assert.deepEqual(call.needs, ['pipeline-status']);
+    assert.match(call.if, /needs\.pipeline-status\.result == 'success'/);
+    assert.equal(call.concurrency['cancel-in-progress'], false);
+  });
+
+  it('always runs JavaScript and its behavioral parity gate on Rust-only changes', () => {
+    const js = workflows()['js.yml'];
+    for (const trigger of ['push', 'pull_request']) {
+      assert.equal(js.on[trigger].paths, undefined);
+      assert.equal(js.on[trigger]['paths-ignore'], undefined);
+    }
+    assert.ok(js.jobs.parity);
+    assert.equal(js.jobs.parity.if, undefined);
+  });
+});

package/test/log-sanitizer.js

@@ -0,0 +1,306 @@
+#!/usr/bin/env bun
+const { describe, it } = require('node:test');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const {
+  sanitizeLogToTemp,
+  StreamingSanitizer,
+} = require('../src/lib/log-sanitizer');
+
+function credentials() {
+  return [
+    ...'pousr'.split('').map((kind) => `gh${kind}_${'a'.repeat(36)}`),
+    `github_` + `pat_${'b'.repeat(82)}`,
+    `sk-${'c'.repeat(48)}`,
+    `sk-` + `proj-${'d'.repeat(90)}`,
+    `sk-` + `ant-api03-${'e'.repeat(90)}`,
+    `AK` + `IA${'F'.repeat(16)}`,
+    `AS` + `IA${'G'.repeat(16)}`,
+    'ey' + 'JhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.signature',
+    'Authorization: Bearer arbitrary-credential',
+    'Proxy-Authorization: Basic encoded-credential',
+    'https://user:password@example.test/repo.git',
+    'AWS_SECRET_ACCESS_KEY=arbitrary-aws-secret',
+    'custom-secret-value',
+    `${Buffer.from(' \n{"alg":"HS256"}').toString('base64url')}.${Buffer.from('{"sub":"x"}').toString('base64url')}.signature`,
+  ];
+}
+
+function sanitize(input, blockSize) {
+  const sanitizer = new StreamingSanitizer({
+    START_TEST_SECRET: 'custom-secret-value',
+  });
+  const blocks = [];
+  for (let offset = 0; offset < input.length; offset += blockSize) {
+    blocks.push(sanitizer.push(input.subarray(offset, offset + blockSize)));
+  }
+  blocks.push(sanitizer.push(Buffer.alloc(0), true));
+  return Buffer.concat(blocks);
+}
+
+describe('log sanitization', () => {
+  it('redacts required formats and environment values at every chunk boundary', () => {
+    const secrets = credentials();
+    for (const size of [1, 7, 31, 256, 1024, 65536]) {
+      const input = Buffer.from(
+        `ordinary utf8: café 😀\n${' '.repeat(Math.max(0, size - 43))}${secrets.join('\n')}\n${'padding\n'.repeat(400)}finished\n`
+      );
+      const output = sanitize(input, size).toString();
+      for (const secret of secrets) {
+        assert.ok(!output.includes(secret));
+      }
+      for (const value of [
+        'arbitrary-credential',
+        'encoded-credential',
+        'password',
+        'arbitrary-aws-secret',
+      ]) {
+        assert.ok(!output.includes(value));
+      }
+      assert.ok(output.startsWith('ordinary utf8: café 😀\n'));
+      assert.ok(output.endsWith('\nfinished\n'));
+    }
+  });
+
+  it('bounds memory for long tokens and authorization values without releasing suffixes', () => {
+    for (const prefix of ['gh' + 'p_', 'Authorization: Bearer ']) {
+      const sanitizer = new StreamingSanitizer({});
+      let output = sanitizer.push(Buffer.from(prefix));
+      for (let i = 0; i < 128; i++) {
+        output = Buffer.concat([
+          output,
+          sanitizer.push(Buffer.alloc(16384, 97)),
+        ]);
+        assert.ok(sanitizer.pendingBytes <= 65536);
+      }
+      output = Buffer.concat([
+        output,
+        sanitizer.push(Buffer.from('\nordinary\n'), true),
+      ]);
+      assert.strictEqual(output.toString(), '[REDACTED]\nordinary\n');
+    }
+  });
+
+  it('retains full header continuation when an inner token reaches the same block boundary', () => {
+    const sanitizer = new StreamingSanitizer({});
+    const input = Buffer.from(
+      `Authorization: Bearer gh${'p_'}${'a'.repeat(131072)} trailing-private-value\nordinary\n`
+    );
+    const output = [];
+    for (let offset = 0; offset < input.length; offset += 65536) {
+      output.push(sanitizer.push(input.subarray(offset, offset + 65536)));
+    }
+    output.push(sanitizer.push(Buffer.alloc(0), true));
+    assert.strictEqual(
+      Buffer.concat(output).toString(),
+      '[REDACTED]\nordinary\n'
+    );
+  });
+
+  it('redacts AWS assignment values enclosed in either quote style', () => {
+    const sanitizer = new StreamingSanitizer({});
+    const output = sanitizer
+      .push(
+        Buffer.from(
+          `AWS_SECRET_ACCESS_KEY="quoted-aws-secret"\nAWS_SESSION_TOKEN='quoted-session-value'\n`
+        ),
+        true
+      )
+      .toString();
+    assert.ok(!output.includes('quoted-aws-secret'));
+    assert.ok(!output.includes('quoted-session-value'));
+  });
+
+  it('redacts multiline and short known secrets, preserving unrelated bytes', () => {
+    const sanitizer = new StreamingSanitizer({
+      GH_TOKEN: 'abc\nxyz',
+      TEST_PASSWORD: '!',
+    });
+    const output = sanitizer
+      .push(Buffer.from('safe abc\nxyz value !'), true)
+      .toString();
+    assert.strictEqual(output, 'safe [REDACTED] value [REDACTED]');
+  });
+
+  it('merges overlapping environment secrets and preserves ordinary domain names', () => {
+    const sanitizer = new StreamingSanitizer({
+      GH_TOKEN: 'abcde',
+      TEST_PASSWORD: 'cdefg',
+      GITHUB_PAT: 'opaque-known-pat',
+    });
+    assert.strictEqual(
+      sanitizer
+        .push(
+          Buffer.from('abcdefg opaque-known-pat example.test.invalid'),
+          true
+        )
+        .toString(),
+      '[REDACTED] [REDACTED] example.test.invalid'
+    );
+    const short = new StreamingSanitizer({ GH_TOKEN: 'a' });
+    assert.strictEqual(
+      short.push(Buffer.alloc(65536, 97), true).toString(),
+      '[REDACTED]'
+    );
+  });
+
+  it('creates a private sanitized copy and removes it without changing the source', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-test-'));
+    const source = path.join(dir, 'source.log');
+    const input = `gh` + `p_${'x'.repeat(36)}`;
+    fs.writeFileSync(source, input);
+    try {
+      const copy = sanitizeLogToTemp(source, { env: {} });
+      assert.notStrictEqual(copy.path, source);
+      assert.strictEqual(fs.readFileSync(copy.path, 'utf8'), '[REDACTED]');
+      if (process.platform !== 'win32') {
+        assert.strictEqual(fs.statSync(copy.path).mode & 0o777, 0o600);
+        assert.strictEqual(
+          fs.statSync(path.dirname(copy.path)).mode & 0o777,
+          0o700
+        );
+      }
+      assert.strictEqual(fs.readFileSync(source, 'utf8'), input);
+      copy.cleanup();
+      assert.ok(!fs.existsSync(copy.path));
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('enforces private permissions at creation even with a permissive umask', () => {
+    if (process.platform === 'win32') {
+      return;
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-creation-'));
+    const source = path.join(dir, 'source.log');
+    fs.writeFileSync(source, 'ordinary output');
+    const originalOpen = fs.openSync;
+    const originalUmask = process.umask(0);
+    let creationChecked = false;
+    let copy;
+    fs.openSync = (...args) => {
+      if (args[1] !== 'wx') {
+        return originalOpen(...args);
+      }
+      assert.strictEqual(
+        fs.statSync(path.dirname(args[0])).mode & 0o777,
+        0o700
+      );
+      const descriptor = originalOpen(...args);
+      assert.strictEqual(fs.fstatSync(descriptor).mode & 0o777, 0o600);
+      creationChecked = true;
+      return descriptor;
+    };
+    try {
+      copy = sanitizeLogToTemp(source, { env: {} });
+      assert.ok(creationChecked);
+      assert.strictEqual(fs.readFileSync(copy.path, 'utf8'), 'ordinary output');
+    } finally {
+      fs.openSync = originalOpen;
+      process.umask(originalUmask);
+      copy?.cleanup();
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('fails closed on invalid source and excessive environment secret sizes', () => {
+    assert.throws(
+      () => sanitizeLogToTemp('/does-not-exist', { env: {} }),
+      /sanitization failed/i
+    );
+    assert.throws(
+      () => new StreamingSanitizer({ GH_TOKEN: 'a'.repeat(65537) }),
+      /too large/i
+    );
+  });
+
+  it('blocks both upload paths on read or write failure and does not expose exception text', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-errors-'));
+    const source = path.join(dir, 'source.log');
+    fs.writeFileSync(source, 'ordinary log');
+    const { uploadLogPath } = require('../src/lib/log-uploader');
+    const { uploadLog } = require('../src/lib/failure-handler');
+    const messages = [];
+    const originalLog = console.log;
+    console.log = (message) => messages.push(message);
+    try {
+      for (const method of ['readSync', 'writeSync', 'fsyncSync']) {
+        const original = fs[method];
+        fs[method] = () => {
+          throw new Error('sensitive error details');
+        };
+        try {
+          assert.strictEqual(uploadLogPath(source).success, false);
+          assert.strictEqual(uploadLog(source), null);
+        } finally {
+          fs[method] = original;
+        }
+      }
+      assert.ok(
+        messages.every(
+          (message) => !message.includes('sensitive error details')
+        )
+      );
+    } finally {
+      console.log = originalLog;
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('sanitizes manual and automatic uploads, explicitly requests private visibility, and cleans copies', () => {
+    if (process.platform === 'win32') {
+      return;
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'upload-sanitize-test-'));
+    const log = path.join(dir, 'source.log');
+    fs.writeFileSync(log, `gh` + `p_${'x'.repeat(36)}`);
+    fs.writeFileSync(
+      path.join(dir, 'gh-upload-log'),
+      '#!/bin/sh\nprintf "%s\\n" "$@" > "$CAPTURE_ARGS"\ncat "$1" > "$CAPTURE_LOG"\nls -ld "$1" | cut -c1-10 > "$CAPTURE_MODE"\necho https://gist.github.com/test/id\n',
+      { mode: 0o755 }
+    );
+    try {
+      for (const kind of ['manual', 'automatic', 'optout']) {
+        const script =
+          kind === 'automatic'
+            ? `require(${JSON.stringify(require.resolve('../src/lib/failure-handler'))}).uploadLog(process.env.SOURCE_LOG)`
+            : `require(${JSON.stringify(require.resolve('../src/lib/log-uploader'))}).uploadLogPath(process.env.SOURCE_LOG, { noSanitize: ${kind === 'optout'} })`;
+        execFileSync(process.execPath, ['-e', script], {
+          env: {
+            ...process.env,
+            PATH: `${dir}${path.delimiter}${process.env.PATH}`,
+            SOURCE_LOG: log,
+            CAPTURE_ARGS: path.join(dir, 'args'),
+            CAPTURE_LOG: path.join(dir, 'uploaded'),
+            CAPTURE_MODE: path.join(dir, 'mode'),
+            GH_UPLOAD_PUBLIC: 'true',
+          },
+          stdio: 'pipe',
+        });
+        const args = fs
+          .readFileSync(path.join(dir, 'args'), 'utf8')
+          .trim()
+          .split('\n');
+        assert.strictEqual(args[1], '--private');
+        assert.strictEqual(
+          fs.readFileSync(path.join(dir, 'uploaded'), 'utf8'),
+          kind === 'optout' ? fs.readFileSync(log, 'utf8') : '[REDACTED]'
+        );
+        if (kind !== 'optout') {
+          assert.notStrictEqual(args[0], log);
+          assert.ok(!fs.existsSync(args[0]));
+          assert.strictEqual(
+            fs.readFileSync(path.join(dir, 'mode'), 'utf8').trim(),
+            '-rw-------'
+          );
+        }
+      }
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/test/regression-176.js

@@ -127,6 +127,12 @@ function fakeRunner(hostConfig, failures = {}) {
     if (args[0] === 'inspect' && args.includes('{{json .HostConfig}}')) {
       return ok(`${JSON.stringify(hostConfig)}\n`);
     }
+    if (args.includes('--size')) {
+      return ok('1024');
+    }
+    if (args[0] === 'info') {
+      return ok(JSON.stringify({ DockerRootDir: os.tmpdir() }));
+    }
     return ok('cid\n');
   };
   runner.calls = calls;
@@ -300,6 +306,7 @@ describe('issue #176: snapshot resume keeps the resource limits', () => {
       command: 'npm run build',
       probe: stoppedProbe,
       runner,
+      snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
       startWatcher: (...args) => watchers.push(args),
     });
     expect(result.success).toBe(true);

package/test/regression-187.js

@@ -76,7 +76,15 @@ function fixture() {
 }
 
 const stopped = () => ({ alive: false, state: SessionState.STOPPED });
-const accepted = () => ({ success: true, stdout: 'container-id\n', status: 0 });
+const accepted = (_bin, args = []) => ({
+  success: true,
+  stdout: args.includes('--size')
+    ? '1024'
+    : args[0] === 'info'
+      ? JSON.stringify({ DockerRootDir: os.tmpdir() })
+      : 'container-id\n',
+  status: 0,
+});
 
 describe('issue #187: explicit resume attempts', () => {
   it('reattaches the current attempt without enabling kill recovery for snapshot commands', async () => {

package/test/regression-191.js

@@ -33,9 +33,16 @@ function fixture() {
     if (args[0] === 'info') {
       return {
         success: true,
-        stdout: JSON.stringify({ MemTotal: 1073741824, NCPU: 4 }),
+        stdout: JSON.stringify({
+          MemTotal: 1073741824,
+          NCPU: 4,
+          DockerRootDir: os.tmpdir(),
+        }),
       };
     }
+    if (args.includes('--size')) {
+      return { success: true, stdout: '1024' };
+    }
     if (args[0] === 'inspect') {
       return {
         success: true,
@@ -78,6 +85,7 @@ it('manual snapshot override applies limits to the new container at creation', a
   try {
     const result = await resumeExecution(f.store, f.record.uuid, {
       command: 'new',
+      snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
       resourceOptions: { memory: '128m' },
       runner: f.runner,
       probe: () => ({ alive: false, state: SessionState.STOPPED }),

package/test/regression-193.js

@@ -64,13 +64,23 @@ describe('issue #193: durable store locks and resume', () => {
     };
     const result = await resumeExecution(store, record.uuid, {
       command: 'new',
+      snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
       probe: () => ({ alive: false, state: SessionState.STOPPED }),
       runner: (_cmd, args) => {
         if (args[0] !== 'inspect') {
           expect(saved?.options.sessionName).toBe('task-resume-1');
           expect(saved?.attempt.launchAcceptedAt).toBeNull();
         }
-        return { success: true, stdout: args[0] === 'inspect' ? '{}' : 'id' };
+        return {
+          success: true,
+          stdout: args.includes('--size')
+            ? '1024'
+            : args[0] === 'info'
+              ? JSON.stringify({ DockerRootDir: '/docker' })
+              : args[0] === 'inspect'
+                ? '{}'
+                : 'id',
+        };
       },
       startWatcher: () => true,
     });