mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-09-09 04:02:35 +00:00
Chinesezjc
2e3cf144d5
Adding a published Python backend and reordering `flush_line` left several owning documents stating things that are no longer true. `src/invariant.ts` justified its empty installer with "ships only the fd-3 wire-protocol codec", which the subprocess execution path contradicts. The reason now states the actual one: every relation this backend maintains lives in the CPython child or on the fd-3 wire, so no same-process event sequence is observable from a listener -- the same shape the sibling worker-thread backend uses. The seam's `PORTABLE_RESERVED_WORDS` and `language` JSDoc, the code-runtime README pair, and docs/subsystems/code-runtime both said only TypeScript has a published backend. Corrected in all four, with the generated cordis catalog regenerated for the `language` change. The note attributed the 12x multiple to the settlement flush holding three copies. That stopped being true when `flush_line` was reordered to drop the pending chunks before its push: the binding worst case is the newline path's single near-budget write. Corrected in the note (both sides) and in the test comment that repeated it. The note's Testing section now registers the cases this stack added, and the Chinese side receives the O(depth) entry it never got plus the new ones -- it had drifted from the English. `INTERPRETER_BASELINE_BYTES` argued 64 MiB from a RESIDENT set while RLIMIT_AS bounds address space. It now cites the bootstrap's own measurement (30.23 MiB of mappings for `python3 -I`), making 64 MiB roughly twice the measured baseline. Also: a hardcoded `(:232-235)` comment reference becomes a reference by name, a "which now walks in O(depth) too" change narrative becomes a current-state statement, and a stray double blank line is removed.
4267 lines
206 KiB
TypeScript
4267 lines
206 KiB
TypeScript
import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs'
|
||
import { mkdtemp, writeFile } from 'node:fs/promises'
|
||
import { tmpdir } from 'node:os'
|
||
import { basename, dirname, join } from 'node:path'
|
||
import { describe, expect, it, vi } from 'vitest'
|
||
import { Context } from '@deepseek-ai/cordis'
|
||
import { PythonCodeRuntime, readProcessStart } from '../src/index.ts'
|
||
import { logTruncationMarker } from '../src/protocol.ts'
|
||
import type { Config } from '../src/index.ts'
|
||
import type { CodeBindingFunction, CodeJsonValue, CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
|
||
|
||
/**
|
||
* Names one `py/` script whose `copyFileSync` must fail, for the partial-staging
|
||
* case. A real disk-full or missing-asset failure mid-copy cannot be produced
|
||
* from a test, and the leak only shows when `mkdtempSync` has already succeeded.
|
||
*/
|
||
const { failNextCopyOf } = vi.hoisted(() => ({ failNextCopyOf: { value: undefined as string | undefined } }))
|
||
vi.mock('node:fs', async (importOriginal) => {
|
||
const actual = await importOriginal<typeof import('node:fs')>()
|
||
return {
|
||
...actual,
|
||
copyFileSync(source: string, destination: string): void {
|
||
if (failNextCopyOf.value !== undefined && basename(source) === failNextCopyOf.value) {
|
||
failNextCopyOf.value = undefined
|
||
throw Object.assign(new Error('simulated ENOSPC on copy'), { code: 'ENOSPC' })
|
||
}
|
||
actual.copyFileSync(source, destination)
|
||
},
|
||
}
|
||
})
|
||
|
||
/**
|
||
* Integration suite over REAL python3 subprocesses (no subprocess mocks — it is
|
||
* cheap and local, per docs/testing.md's real-over-mock policy; the only mock is
|
||
* `node:fs.copyFileSync` for the staging-failure cases). Each test builds a fresh
|
||
* runtime so budgets can be tuned per case.
|
||
*/
|
||
async function setup(config: Config = {}) {
|
||
const ctx = new Context()
|
||
const fiber = await ctx.plugin(PythonCodeRuntime, config)
|
||
const runtime = ctx.codeRuntime as PythonCodeRuntime
|
||
return { ctx, fiber, runtime }
|
||
}
|
||
|
||
/** Convenience: one namespace `tools` with the given functions. */
|
||
function tools(functions: Record<string, CodeBindingFunction>) {
|
||
return [{ global: 'tools', functions }]
|
||
}
|
||
|
||
describe('PythonCodeRuntime — seam descriptors and misuse', () => {
|
||
it('registers the seam descriptors', async () => {
|
||
const { runtime } = await setup()
|
||
expect(runtime.language).toBe('python')
|
||
expect(runtime.isolation).toBe('process')
|
||
})
|
||
|
||
it('rejects non-positive config as seam misuse', async () => {
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 0 }))
|
||
.rejects.toThrow(/cpuSeconds must be a positive number/)
|
||
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: -1 }))
|
||
.rejects.toThrow(/maxWallMs must be a positive number/)
|
||
})
|
||
|
||
it('rejects a non-integer cpuSeconds at load (setrlimit needs an int)', async () => {
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 1.5 }))
|
||
.rejects.toThrow(/cpuSeconds must be a positive integer, got 1.5/)
|
||
})
|
||
|
||
it('rejects a non-integer byte budget at load (the child int()-truncates it)', async () => {
|
||
// maxLogBytes/maxValueBytes cross to the child, which reads them through
|
||
// int(...): a float would floor there while the host meters the fraction, so
|
||
// the two sides would enforce different public config. Reject at load.
|
||
const ctxLog = new Context()
|
||
await expect(ctxLog.plugin(PythonCodeRuntime, { maxLogBytes: 3.5 }))
|
||
.rejects.toThrow(/maxLogBytes must be a positive integer/)
|
||
const ctxValue = new Context()
|
||
await expect(ctxValue.plugin(PythonCodeRuntime, { maxValueBytes: 1024.5 }))
|
||
.rejects.toThrow(/maxValueBytes must be a positive integer/)
|
||
})
|
||
|
||
it('rejects finite numeric config that cannot cross as an exact rlimit integer', async () => {
|
||
// `Number.isFinite` and `Number.isInteger` both admit values that cannot
|
||
// round-trip. `addressSpaceMb: 1e308` overflows to `Infinity` once multiplied
|
||
// by 1 MiB, and `encodeJsonPlain` renders that as `null`, so the child gets no
|
||
// limit at all; `cpuSeconds: 1e100` clears `Number.isInteger` while sitting
|
||
// far past the safe range, so `setrlimit` receives a different number than was
|
||
// configured. Both used to end every run in a bootstrap exception instead of
|
||
// failing at load, where a self-contained configuration error belongs.
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, { addressSpaceMb: 1e308 }))
|
||
.rejects.toThrow(/addressSpaceMb must be at most \d+ .*exact integer/)
|
||
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 1e100 }))
|
||
.rejects.toThrow(/cpuSeconds must be at most \d+ .*exact integers/)
|
||
// The boundary values still load: the bound rejects what cannot be encoded,
|
||
// not everything large.
|
||
const okMb = await ctx.plugin(PythonCodeRuntime, { addressSpaceMb: Math.floor(Number.MAX_SAFE_INTEGER / (1024 * 1024)) })
|
||
await okMb.dispose()
|
||
const okCpu = await ctx.plugin(PythonCodeRuntime, { cpuSeconds: Number.MAX_SAFE_INTEGER - 1 })
|
||
await okCpu.dispose()
|
||
})
|
||
|
||
it('rejects an output cap whose payload could not cross the frame ceiling', async () => {
|
||
// The caps budget a payload that must arrive inside ONE fd-3 frame, and the
|
||
// 256 MiB framing ceiling is fixed. A larger cap is unsatisfiable rather
|
||
// than generous: a completion the cap admits arrives as an over-ceiling
|
||
// frame and fails the run as `worker-exit`, inverting the `output-limit`
|
||
// the cap describes. Both budgets are metered in already-escaped serialized
|
||
// bytes, so a payload occupies at most `cap + envelope` on the wire; the
|
||
// bound is `ceiling - envelope`, not `(ceiling - envelope) / 6` (that
|
||
// divided in escape expansion the charge already counts).
|
||
const admissible = 256 * 1024 * 1024 - 64
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, { maxLogBytes: admissible + 1 }))
|
||
.rejects.toThrow(/maxLogBytes must not exceed 268435392 .*fd-3 frame ceiling/)
|
||
await expect(ctx.plugin(PythonCodeRuntime, { maxValueBytes: admissible + 1 }))
|
||
.rejects.toThrow(/maxValueBytes must not exceed 268435392 .*fd-3 frame ceiling/)
|
||
// The boundary value itself loads: the bound is the largest cap a frame can
|
||
// still carry, not one below it. It needs an address space large enough to
|
||
// clear the separate maxValueBytes/addressSpaceMb worst-case gate (the cap
|
||
// times the 12x Unicode expansion must fit), so this pairs it with a 4 GiB
|
||
// addressSpaceMb — the two load-time bounds are independent.
|
||
const boundary = await ctx.plugin(PythonCodeRuntime, { maxValueBytes: admissible, addressSpaceMb: 4096 })
|
||
await boundary.dispose()
|
||
})
|
||
|
||
it('rejects a pythonBin that spawn() would throw on, at load', async () => {
|
||
// Both values pass the string schema and both make `spawn` throw
|
||
// SYNCHRONOUSLY from inside run() — ERR_INVALID_ARG_VALUE for the empty
|
||
// path, ERR_INVALID_ARG_TYPE for the NUL — so run() would REJECT instead of
|
||
// resolving the worker-exit the seam promises for a child that cannot
|
||
// start. Both are self-contained configuration errors, so they fail here.
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, { pythonBin: '' }))
|
||
.rejects.toThrow(/pythonBin must be a non-empty path without NUL bytes/)
|
||
await expect(ctx.plugin(PythonCodeRuntime, { pythonBin: 'py\u0000thon3' }))
|
||
.rejects.toThrow(/pythonBin must be a non-empty path without NUL bytes/)
|
||
})
|
||
|
||
it('rejects a timer budget setTimeout would silently clamp to 1 ms', async () => {
|
||
// Node stores a setTimeout delay as a signed 32-bit value and substitutes
|
||
// 1 ms for anything larger, inverting the knob's meaning: a huge maxWallMs
|
||
// would time every run out at once, and a huge graceMs would SIGKILL one
|
||
// millisecond after SIGTERM. Both must fail at load instead.
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: 2_147_483_648 }))
|
||
.rejects.toThrow(/maxWallMs must not exceed 2147483647/)
|
||
// graceMs is bounded by the close deadline's added margin, not by the raw
|
||
// timer maximum, because that sum is what gets armed.
|
||
await expect(ctx.plugin(PythonCodeRuntime, { graceMs: 2_147_481_648 }))
|
||
.rejects.toThrow(/graceMs must not exceed 2147481647/)
|
||
// The exact maxima still load.
|
||
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: 2_147_483_647, graceMs: 2_147_481_647 }))
|
||
.resolves.toBeDefined()
|
||
})
|
||
|
||
it('rejects loading this Unix-only backend on Windows', async () => {
|
||
// The bootstrap needs the POSIX `resource` module, a positional fd 3, and
|
||
// negative-PID process-group signals — none on Windows. The constructor
|
||
// must throw at load rather than register ctx.codeRuntime and defer the
|
||
// failure to the first run.
|
||
const original = process.platform
|
||
Object.defineProperty(process, 'platform', { value: 'win32', configurable: true })
|
||
try {
|
||
const ctx = new Context()
|
||
await expect(ctx.plugin(PythonCodeRuntime, {})).rejects.toThrow(/requires a Unix platform/)
|
||
} finally {
|
||
Object.defineProperty(process, 'platform', { value: original, configurable: true })
|
||
}
|
||
})
|
||
|
||
it('rejects a binding global that is not a Python identifier or is reserved', async () => {
|
||
const { runtime } = await setup()
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{ global: '1bad', functions: {} }],
|
||
})).rejects.toThrow(/is not a usable Python identifier/)
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{ global: 'class', functions: {} }],
|
||
})).rejects.toThrow(/is not a usable Python identifier/)
|
||
})
|
||
|
||
it('rejects duplicate binding namespaces', async () => {
|
||
const { runtime } = await setup()
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [
|
||
{ global: 'tools', functions: {} },
|
||
{ global: 'tools', functions: {} },
|
||
],
|
||
})).rejects.toThrow(/duplicate binding global/)
|
||
})
|
||
|
||
it('rejects run() after disposal, and unregisters ctx.codeRuntime', async () => {
|
||
const { ctx, fiber, runtime } = await setup()
|
||
await fiber.dispose()
|
||
await expect(runtime.run({ program: 'return 1', bindings: [] }))
|
||
.rejects.toThrow(/after disposal/)
|
||
expect(ctx.get('codeRuntime')).toBeUndefined()
|
||
})
|
||
|
||
it('short-circuits when the request signal is already aborted', async () => {
|
||
const { runtime } = await setup()
|
||
const signal = AbortSignal.abort('already-cancelled')
|
||
const result = await runtime.run({ program: 'return 1', bindings: [], signal })
|
||
expect(result.error?.kind).toBe('abort')
|
||
expect(result.error?.message).toContain('already-cancelled')
|
||
expect(result.logs).toEqual([])
|
||
})
|
||
|
||
it('short-circuits on an already-aborted signal whose reason cannot be converted', async () => {
|
||
// The pre-flight arm converted the reason with a bare `String()`, so a
|
||
// hostile reason threw out of `run()` — the seam promises to reject only for
|
||
// misuse, and a caller's cancellation token is not misuse.
|
||
const { runtime } = await setup()
|
||
const signal = AbortSignal.abort({
|
||
[Symbol.toPrimitive]() { throw new Error('reason blew up') },
|
||
})
|
||
const result = await runtime.run({ program: 'return 1', bindings: [], signal })
|
||
expect(result.error?.kind).toBe('abort')
|
||
expect(result.error?.message).toBe('<unrenderable rejection value>')
|
||
expect(result.logs).toEqual([])
|
||
})
|
||
|
||
it('runs the interpreter from materialized scripts outside the package, and removes them per run', async () => {
|
||
// The interpreter is an EXTERNAL process, so it can only open paths the OS
|
||
// resolves. Inside the single-file Python-SDK executable the packaged `py/`
|
||
// directory lives in pkg's virtual filesystem, which Node reads through its
|
||
// patched `fs` but `python3` cannot see, so spawning from that path fails
|
||
// with ENOENT. The scripts are therefore copied to a real directory first.
|
||
//
|
||
// The path is read from the child's own `__main__` module, so it proves
|
||
// where the interpreter actually loaded the entry script — asserting on a
|
||
// host-side constant would only restate the source. The program namespace
|
||
// seeds `__name__` but no `__file__`, hence the module lookup.
|
||
// `protocol.py` must land in the SAME directory, since `bootstrap.py` puts
|
||
// its own directory on `sys.path` to import it; the run completing at all
|
||
// already exercises that import.
|
||
const { runtime } = await setup()
|
||
const entryOf = async (): Promise<string> => {
|
||
const result = await runtime.run({ program: 'import sys\nreturn sys.modules["__main__"].__file__', bindings: [] })
|
||
expect(result.error).toBeUndefined()
|
||
return result.value as string
|
||
}
|
||
const entry = await entryOf()
|
||
expect(entry.endsWith('/bootstrap.py')).toBe(true)
|
||
const dir = dirname(entry)
|
||
expect(dir.startsWith(realpathSync(tmpdir()))).toBe(true)
|
||
expect(dir).not.toContain('/packages/')
|
||
// Staging is per RUN and removed at settlement, so by the time `run()`
|
||
// resolved the directory is already gone — nothing survives to be rewritten
|
||
// by a later run. `protocol.py` had to be beside the entry script for the run
|
||
// to complete at all, since `bootstrap.py` imports it off `sys.path`.
|
||
expect(existsSync(dir)).toBe(false)
|
||
// A second run stages its own copy rather than reusing the first.
|
||
expect(dirname(await entryOf())).not.toBe(dir)
|
||
})
|
||
|
||
it('contains a program that rewrites its own bootstrap to the run that did it', async () => {
|
||
// The child runs as the same UID as the host, so `0o700` does not stop model
|
||
// code from rewriting the scripts it was started from —
|
||
// `sys.modules['__main__'].__file__` names them. While all runs shared one
|
||
// staged copy, a program that overwrote `bootstrap.py` broke the NEXT run
|
||
// (measured: it settled as `worker-exit`), and substituted code would have
|
||
// run before the resource limits were applied.
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const sabotage = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'path = sys.modules["__main__"].__file__',
|
||
'open(path, "w").write("raise SystemExit(1)\\n")',
|
||
'return path',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(sabotage.error).toBeUndefined()
|
||
// The damage stayed inside the run that caused it.
|
||
const after = await runtime.run({ program: 'return 1 + 1', bindings: [] })
|
||
expect(after.error).toBeUndefined()
|
||
expect(after.value).toBe(2)
|
||
}, 20_000)
|
||
|
||
it('leaves no subprocess or scripts behind when disposal races the first run', async () => {
|
||
// Staging runs SYNCHRONOUSLY so no async boundary opens between `run()` and
|
||
// the point where `execute` registers the run in `live` and installs the
|
||
// abort listener. With an `await` there, a disposal landing in that window
|
||
// saw an empty `live`, returned, removed the script directory, and let the
|
||
// continuation spawn a subprocess after the fiber was gone.
|
||
//
|
||
// `dispose()` is called in the same synchronous turn as `run()`, with no
|
||
// `await` between them, so it lands exactly in that window.
|
||
//
|
||
// The leak assertion compares before and after rather than requiring an
|
||
// empty tmpdir: other tests in this file build runtimes they never dispose,
|
||
// so only the directories this test adds are its own evidence.
|
||
const staged = (): string[] =>
|
||
readdirSync(realpathSync(tmpdir())).filter(name => name.startsWith('dsh-code-runtime-python-'))
|
||
const before = new Set(staged())
|
||
const { fiber, runtime } = await setup({ maxWallMs: 8_000 })
|
||
const pending = runtime.run({ program: 'import time\nwhile True: time.sleep(0.1)', bindings: [] })
|
||
const disposed = fiber.dispose()
|
||
const result = await pending
|
||
await disposed
|
||
// Whatever the run reports, it must be terminal and must not be a success.
|
||
expect(result.value).toBeUndefined()
|
||
expect(['abort', 'worker-exit', 'timeout']).toContain(result.error?.kind)
|
||
// Disposal is to quiescence, so this run's directory is gone once it
|
||
// resolves, and nothing recreated it afterwards.
|
||
expect(staged().filter(name => !before.has(name))).toEqual([])
|
||
}, 15_000)
|
||
|
||
it('settles as abort when the signal fires in the same turn as the first run', async () => {
|
||
// Same window, the other listener. `addEventListener('abort')` does not
|
||
// replay an event that already fired, so an abort landing before the
|
||
// listener was installed used to be missed entirely and the program ran to
|
||
// success or the wall ceiling instead of resolving as `abort`. Synchronous
|
||
// staging keeps the pre-flight check and the listener in one turn, leaving
|
||
// no gap for the signal to slip through.
|
||
const { runtime } = await setup({ maxWallMs: 4_000, graceMs: 200 })
|
||
const controller = new AbortController()
|
||
const pending = runtime.run({
|
||
program: 'import time\nwhile True: time.sleep(0.1)',
|
||
bindings: [],
|
||
signal: controller.signal,
|
||
})
|
||
controller.abort('same-turn-abort')
|
||
const result = await pending
|
||
expect(result.error?.kind).toBe('abort')
|
||
expect(result.error?.message).toContain('same-turn-abort')
|
||
}, 15_000)
|
||
|
||
it('reports a staging failure as worker-exit instead of rejecting run()', async () => {
|
||
// Staging touches the filesystem, so it can fail for reasons that are not
|
||
// the caller's doing: a full or read-only temp filesystem, or a deployment
|
||
// that failed to ship the packaged scripts. Those are SUBSTRATE failures,
|
||
// the same class as a child that cannot start, and the seam reserves
|
||
// rejection for misuse — so `run()` must resolve, not throw.
|
||
//
|
||
// `TMPDIR` is the honest lever: `mkdtempSync` builds its path from
|
||
// `os.tmpdir()`, so pointing it at a path that is not a directory makes the
|
||
// real call fail without stubbing the module under test.
|
||
const previous = process.env.TMPDIR
|
||
const notADirectory = join(await mkdtemp(join(tmpdir(), 'dsh-staging-')), 'file')
|
||
await writeFile(notADirectory, '')
|
||
process.env.TMPDIR = notADirectory
|
||
try {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain('failed to stage the python bootstrap')
|
||
expect(result.logs).toEqual([])
|
||
} finally {
|
||
if (previous === undefined) delete process.env.TMPDIR
|
||
else process.env.TMPDIR = previous
|
||
}
|
||
})
|
||
|
||
it('leaves no staging directory behind when a script copy fails', async () => {
|
||
// `mkdtempSync` succeeding and a later `copyFileSync` failing is its own
|
||
// case: the directory exists but is only partially populated. Recording it
|
||
// before the copies would leak it, because `run` retries staging on the next
|
||
// call and overwrites the single recorded path — teardown could then remove
|
||
// only the newest attempt. Staging must clean up its own partial directory.
|
||
//
|
||
// Only `copyFileSync` is stubbed, and only for the second script, so
|
||
// `mkdtempSync` really runs and the directory under assertion is real.
|
||
const staged = (): string[] =>
|
||
readdirSync(realpathSync(tmpdir())).filter(name => name.startsWith('dsh-code-runtime-python-'))
|
||
const before = new Set(staged())
|
||
failNextCopyOf.value = 'protocol.py'
|
||
try {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain('failed to stage the python bootstrap')
|
||
// The partial directory is gone, so nothing accumulates across retries.
|
||
expect(staged().filter(name => !before.has(name))).toEqual([])
|
||
} finally {
|
||
failNextCopyOf.value = undefined
|
||
}
|
||
}, 15_000)
|
||
})
|
||
|
||
describe('PythonCodeRuntime — process identity', () => {
|
||
it('reads a live process start time and distinguishes it from an absent pid', () => {
|
||
// The teardown guard signals `-child.pid` with a RAW `process.kill`, which
|
||
// (unlike `child.kill()`) has no handle check, so it would reach a recycled
|
||
// pgid during the window between the leader being reaped and `close` firing.
|
||
// A pid alone cannot separate the original from its replacement -- both
|
||
// answer `kill(pid, 0)` -- so the guard compares START TIME, and this pins
|
||
// that the reading is stable for one process and absent for a pid that
|
||
// cannot be read.
|
||
const own = readProcessStart(process.pid)
|
||
if (process.platform === 'linux') {
|
||
// Same process, two reads: the identity must be stable, or the guard would
|
||
// refuse to signal its own live group.
|
||
expect(own).toBeDefined()
|
||
expect(readProcessStart(process.pid)).toBe(own)
|
||
// Pid 0 is never a readable /proc entry, so the guard degrades to
|
||
// undefined rather than throwing on a teardown path.
|
||
expect(readProcessStart(0)).toBeUndefined()
|
||
} else {
|
||
// Darwin has no /proc: the reader reports undefined, and `killGroup` then
|
||
// keeps its pre-existing behavior instead of paying a `ps` fork per signal.
|
||
expect(own).toBeUndefined()
|
||
}
|
||
})
|
||
})
|
||
|
||
describe('PythonCodeRuntime — inherited resource limits', () => {
|
||
it('runs under an inherited hard limit tighter than addressSpaceMb', async () => {
|
||
// An unprivileged process may lower a hard rlimit but never raise it. Under
|
||
// a harness started with `ulimit -v` below `addressSpaceBytes`, requesting
|
||
// the configured cap made `setrlimit` raise `ValueError` and every run
|
||
// returned a bootstrap exception — even though the inherited limit is
|
||
// STRONGER than the one asked for. The bootstrap clamps to the inherited
|
||
// hard limit instead, so the run proceeds under the stricter bound.
|
||
//
|
||
// `pythonBin` is the honest lever: a wrapper that lowers RLIMIT_AS and then
|
||
// execs the real interpreter reproduces the inherited-limit condition
|
||
// without touching this test process's own limits.
|
||
const dir = await mkdtemp(join(tmpdir(), 'dsh-rlimit-'))
|
||
const wrapper = join(dir, 'python3-capped')
|
||
// 256 MiB, half the 512 MiB addressSpaceMb default, so the requested cap is
|
||
// unambiguously above the inherited ceiling.
|
||
await writeFile(wrapper, '#!/bin/sh\nulimit -v 262144\nexec python3 "$@"\n', { mode: 0o755 })
|
||
const { runtime } = await setup({ pythonBin: wrapper })
|
||
const result = await runtime.run({
|
||
program: 'import resource\nreturn resource.getrlimit(resource.RLIMIT_AS)[1]',
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// The applied hard limit is the inherited one, not the configured 512 MiB.
|
||
expect(result.value).toBe(256 * 1024 * 1024)
|
||
}, 15_000)
|
||
|
||
it('rejects at boot when an inherited RLIMIT_AS is too tight for the output budgets', async () => {
|
||
// The host gate validates the output budgets against the CONFIGURED
|
||
// addressSpaceMb, but a launch environment can inherit a STRICTER RLIMIT_AS
|
||
// (a `ulimit -v` wrapper below addressSpaceMb), which the bootstrap clamps the
|
||
// effective limit down to — leaving the budgets sized for a ceiling the child
|
||
// never gets, so a near-budget output would OOM mid-run as an opaque
|
||
// worker-exit. The bootstrap re-checks both budgets against the EFFECTIVE
|
||
// clamped limit and fails loud at boot instead. A 128 MiB inherited limit
|
||
// leaves 64 MiB budgetable (~5 MiB admissible under the 12x multiple), under
|
||
// which a 32 MiB maxLogBytes — admitted by the 512 MiB configured default — is
|
||
// rejected. The rejection surfaces as an 'exception' (bootstrap's
|
||
// setrlimit-phase failure class), not a mid-run OOM. The repro is Linux-only
|
||
// (macOS ignores `ulimit -v`); there the run proceeds.
|
||
const dir = await mkdtemp(join(tmpdir(), 'dsh-rlimit-'))
|
||
const wrapper = join(dir, 'python3-tight')
|
||
await writeFile(wrapper, '#!/bin/sh\nulimit -v 131072\nexec python3 "$@"\n', { mode: 0o755 })
|
||
const { runtime } = await setup({ pythonBin: wrapper, maxLogBytes: 32 * 1024 * 1024, addressSpaceMb: 512 })
|
||
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
||
if (process.platform === 'darwin') {
|
||
expect(result.error).toBeUndefined()
|
||
} else {
|
||
// The re-check raises inside bootstrap's resource-limit block, which
|
||
// reports every setrlimit-phase failure as kind 'exception'; the message
|
||
// discriminates this config rejection from a generic setrlimit error.
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('too large for the inherited RLIMIT_AS')
|
||
}
|
||
}, 15_000)
|
||
|
||
it('applies the configured limits when nothing tighter is inherited', async () => {
|
||
// The clamp must not weaken the normal path: with an infinite inherited hard
|
||
// limit there is nothing to clamp against, and RLIM_INFINITY compares as -1,
|
||
// so treating it as a numeric bound would collapse every limit to -1.
|
||
const { runtime } = await setup({ cpuSeconds: 42, addressSpaceMb: 400 })
|
||
const result = await runtime.run({
|
||
// `getrlimit` returns a tuple, which the lossless-JSON completion check
|
||
// rejects; the pair is listed explicitly rather than converted.
|
||
program: 'import resource\ncpu = resource.getrlimit(resource.RLIMIT_CPU)\nreturn [cpu[0], cpu[1], resource.getrlimit(resource.RLIMIT_AS)[1]]',
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// Soft at cpuSeconds, hard at +1 (the SIGKILL backstop), address space at
|
||
// the configured megabytes — exactly what the unclamped path applied.
|
||
expect(result.value).toEqual([42, 43, 400 * 1024 * 1024])
|
||
}, 15_000)
|
||
|
||
it('preserves an inherited soft limit stricter than the configured cap', async () => {
|
||
// Clamping reads BOTH inherited bounds, not just the hard one. A deployment
|
||
// that inherited a soft rlimit below the configured cap must keep that
|
||
// stricter soft: returning the configured value would RAISE the effective
|
||
// soft limit, loosening containment. The wrapper lowers only the SOFT CPU
|
||
// limit (`ulimit -S -t`) and leaves the hard limit unlimited, so the
|
||
// requested soft (`cpuSeconds`) sits above the inherited soft — the case that
|
||
// exposed the bug. RLIMIT_CPU is used because macOS ignores `ulimit -v`
|
||
// (RLIMIT_AS), which is exactly why the backend skips address space there.
|
||
const dir = await mkdtemp(join(tmpdir(), 'dsh-rlimit-soft-'))
|
||
const wrapper = join(dir, 'python3-soft-capped')
|
||
// Soft CPU 5 s, well below the configured 30 s, hard left unlimited.
|
||
await writeFile(wrapper, '#!/bin/sh\nulimit -S -t 5\nexec python3 "$@"\n', { mode: 0o755 })
|
||
const { runtime } = await setup({ pythonBin: wrapper, cpuSeconds: 30 })
|
||
const result = await runtime.run({
|
||
program: 'import resource\nreturn resource.getrlimit(resource.RLIMIT_CPU)[0]',
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// The applied SOFT limit is the inherited 5 s, not the configured 30 s.
|
||
expect(result.value).toBe(5)
|
||
}, 15_000)
|
||
|
||
it('rechecks CPU at settlement against the effective inherited soft limit', async () => {
|
||
// The settlement-time CPU recheck must compare against the EFFECTIVE soft
|
||
// limit (`_clamped` may have lowered it to a stricter inherited value), not
|
||
// the configured `cpuSeconds`. A program that traps SIGXCPU, burns past the
|
||
// inherited soft, and returns inside the soft-to-hard gap would otherwise be
|
||
// compared to the configured value and falsely reported successful, bypassing
|
||
// the inherited limit. The wrapper sets a 1 s soft CPU limit; the program
|
||
// traps SIGXCPU and busy-loops past it, then returns — the recheck must
|
||
// re-deliver SIGXCPU so the host classifies the run as a timeout.
|
||
const dir = await mkdtemp(join(tmpdir(), 'dsh-cpu-recheck-'))
|
||
const wrapper = join(dir, 'python3-cpu-capped')
|
||
await writeFile(wrapper, '#!/bin/sh\nulimit -S -t 1\nexec python3 "$@"\n', { mode: 0o755 })
|
||
const { runtime } = await setup({ pythonBin: wrapper, cpuSeconds: 30, maxWallMs: 12_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal, time',
|
||
// Trap SIGXCPU so the soft limit does not terminate the program; burn
|
||
// CPU well past the inherited 1 s soft, then return normally.
|
||
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
||
'end = time.process_time() + 2.5',
|
||
'while time.process_time() < end:',
|
||
' pass',
|
||
'return "returned"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
// The recheck compares spent CPU against the effective 1 s soft, not 30 s, so
|
||
// the run is a timeout rather than a false success.
|
||
expect(result.error?.kind).toBe('timeout')
|
||
}, 20_000)
|
||
})
|
||
|
||
describe('PythonCodeRuntime — programs and bindings', () => {
|
||
it('runs a top-level script, captures print output, and returns `result`', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'x = 40',
|
||
'y = 2',
|
||
'print("hello", x + y)',
|
||
'return {"answer": x + y}',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual({ answer: 42 })
|
||
// `print` in Python emits: text, ' ', text, '\n'. Concat the captured
|
||
// fragments and assert the model-visible message survives.
|
||
expect(result.logs.join('')).toContain('hello 42')
|
||
// 15s: this is usually the suite's first real subprocess — a cold python3
|
||
// start (interpreter + asyncio import) on a loaded CI runner can exceed
|
||
// the 5s default alone; later tests reuse the warm page cache.
|
||
}, 15_000)
|
||
|
||
it('bridges binding calls both ways and rejects the program-side call on a host rejection', async () => {
|
||
const { runtime } = await setup()
|
||
const calls: unknown[] = []
|
||
const result = await runtime.run({
|
||
program: [
|
||
'first = await tools.echo({"n": 1})',
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.fail({})',
|
||
'except RuntimeError as e:',
|
||
' caught = str(e)',
|
||
'return {"first": first, "caught": caught}',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
echo: async (args) => { calls.push(args); return { echoed: args as CodeJsonValue } },
|
||
fail: async () => { throw new Error('nope') },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual({ first: { echoed: { n: 1 } }, caught: 'nope' })
|
||
expect(calls).toEqual([{ n: 1 }])
|
||
})
|
||
|
||
it('still answers the call when the rejection value cannot be converted to a string', async () => {
|
||
// `messageOf` calls `String(error)`, which runs the value's own conversion,
|
||
// and this call site is a DETACHED async reply callback. A rejection whose
|
||
// `Symbol.toPrimitive` throws therefore escaped as an unhandled rejection:
|
||
// the reply frame was never written, the program stayed blocked on `await`,
|
||
// and the run degraded to a `maxWallMs` timeout (observed) — a host with no
|
||
// `unhandledRejection` listener would exit instead. The rejection must reach
|
||
// the program as an ordinary error carrying a fixed placeholder.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'try:',
|
||
' await tools.hostile({})',
|
||
'except RuntimeError as e:',
|
||
' return "rejected: " + str(e)',
|
||
'return "no rejection"',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
hostile: async () => {
|
||
throw { [Symbol.toPrimitive]() { throw new Error('toPrimitive blew up') } }
|
||
},
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('rejected: <unrenderable rejection value>')
|
||
}, 15_000)
|
||
|
||
it('still answers the call when an Error carries a cyclic value in place of its message', async () => {
|
||
// `Error.message` is typed `string` but is a plain writable property, so a
|
||
// rejection can carry any value there. Returning it verbatim handed a
|
||
// non-string to `sendReply`, breaching `encodeJsonPlain`'s JSON-plain
|
||
// precondition: a cyclic object grew the encoder stack until the host threw
|
||
// RangeError from the detached reply callback, so no reply frame was written
|
||
// and the run degraded to a `maxWallMs` timeout (observed). The conversion
|
||
// must contain it — `String()` on a cycle throws inside the guard and lands
|
||
// on the placeholder, so the program sees an ordinary error.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'try:',
|
||
' await tools.hostile({})',
|
||
'except RuntimeError as e:',
|
||
' return "rejected: " + str(e)',
|
||
'return "no rejection"',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
hostile: async () => {
|
||
const cyclic: { self?: unknown; [Symbol.toPrimitive]: () => string } = {
|
||
// A cycle alone is inert for `String()`; the throwing conversion is
|
||
// what proves the guard runs rather than the encoder.
|
||
[Symbol.toPrimitive]: () => { throw new Error('cyclic message') },
|
||
}
|
||
cyclic.self = cyclic
|
||
const error = new Error('placeholder')
|
||
// Writable per spec, so no cast is needed to install a non-string.
|
||
;(error as unknown as { message: unknown }).message = cyclic
|
||
throw error
|
||
},
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('rejected: <unrenderable rejection value>')
|
||
}, 15_000)
|
||
|
||
it('renders an Error whose message is a value with no JSON form', async () => {
|
||
// The non-cyclic arm. A number would not discriminate: `scalarJson` renders
|
||
// it as digits and the child `str()`s the field back, so it survives the
|
||
// wire either way. `undefined` is the value that separates the two orders —
|
||
// `scalarJson` emits a bare `undefined` token, so the reply line is not JSON
|
||
// at all, the child's parse drops the frame, and the program stays blocked
|
||
// on `await` until the wall ceiling (observed). Converting first sends the
|
||
// string "undefined", which the program receives as an ordinary rejection.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'try:',
|
||
' await tools.absent({})',
|
||
'except RuntimeError as e:',
|
||
' return "rejected: " + str(e)',
|
||
'return "no rejection"',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
absent: async () => {
|
||
const error = new Error('placeholder')
|
||
;(error as unknown as { message: unknown }).message = undefined
|
||
throw error
|
||
},
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('rejected: undefined')
|
||
}, 15_000)
|
||
|
||
it('runs a program with no await', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'return 2 + 2',
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(4)
|
||
})
|
||
|
||
it('returns JSON null whether the program returns None or falls off the end', async () => {
|
||
// Python has no `undefined`: an async body that returns None and one that
|
||
// never returns both yield None, so both complete as an exact JSON null.
|
||
// (The worker/TS backend can tell `return undefined` from `return null`;
|
||
// Python cannot, and reporting null for both is the honest rendering.)
|
||
const { runtime } = await setup()
|
||
const explicit = await runtime.run({ program: 'return None', bindings: [] })
|
||
expect(explicit.error).toBeUndefined()
|
||
expect(explicit.value).toBeNull()
|
||
const noReturn = await runtime.run({ program: 'x = 1', bindings: [] })
|
||
expect(noReturn.error).toBeUndefined()
|
||
expect(noReturn.value).toBeNull()
|
||
})
|
||
|
||
it('settles with no value on a forged valueless done frame', async () => {
|
||
// The child always sends a value now (return None → JSON null), so a done
|
||
// frame with no value key can only be forged; the host settles it as a
|
||
// value-less completion rather than crashing on the absent field.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'os.write(3, b\'{"type":"done"}\\n\')',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBeUndefined()
|
||
})
|
||
|
||
it('coalesces print arguments into one log line, not per-write fragments', async () => {
|
||
// print("a","b") calls write() per arg/sep/newline; the stream must emit
|
||
// one logical line "a b" so Code Mode's join(newline) does not insert
|
||
// spurious blank lines. Two prints → exactly two entries, no empties.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: ['print("a", "b")', 'print("c")', 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs).toEqual(['a b', 'c'])
|
||
})
|
||
|
||
it('flushes a print with no trailing newline', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: ['print("partial", end="")', 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs).toEqual(['partial'])
|
||
})
|
||
|
||
it('aggregates a large newline-free native write into one log entry, not one per pipe chunk', async () => {
|
||
// A single `os.write` larger than one pipe read arrives as several Node
|
||
// `data` chunks. `logs` entries are joined with `\n` downstream, so pushing
|
||
// one entry per transport chunk would insert model-visible newlines at
|
||
// arbitrary pipe boundaries inside one native write. Stray capture holds a
|
||
// per-stream residual and admits only on a real `\n`, so a 200 KiB blast
|
||
// with no newline reads back as exactly one entry with no interior breaks.
|
||
const { runtime } = await setup({ maxLogBytes: 300_000 })
|
||
const size = 200_000
|
||
const result = await runtime.run({
|
||
program: ['import os', `os.write(1, b"A" * ${size})`, 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs).toEqual(['A'.repeat(size)])
|
||
})
|
||
|
||
it('splits native output on its own newlines, one entry per line', async () => {
|
||
// The complement of the aggregation case: real newlines in a native write
|
||
// still delimit entries, matching the child's line-granular `log` frames.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: ['import os', 'os.write(1, b"one\\ntwo\\nthree")', 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs).toEqual(['one', 'two', 'three'])
|
||
})
|
||
|
||
it('bounds a newline-free native flood by the ledger instead of buffering it whole', async () => {
|
||
// A newline-free write far larger than maxLogBytes must not accumulate in
|
||
// the host-side residual: when the pending residual would cross the budget
|
||
// it is admitted (and truncated) immediately, and once the ledger has
|
||
// truncated, later chunks stop buffering entirely. The run still completes
|
||
// and the captured output ends at the truncation marker rather than
|
||
// retaining the whole flood.
|
||
const { runtime } = await setup({ maxLogBytes: 4096 })
|
||
const result = await runtime.run({
|
||
program: ['import os', 'os.write(1, b"A" * 2_000_000)', 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
||
// The retained output is bounded by the budget, not the 2 MB flood.
|
||
expect(result.logs.join('').length).toBeLessThan(4096)
|
||
})
|
||
|
||
it('bounds a control-char-dense native residual by serialized cost, not raw length', async () => {
|
||
// A newline-free NUL flood passes the cheap `length + 3` lower bound at a
|
||
// raw length well under the budget, but each NUL serializes to ` ` (6
|
||
// bytes), so the true JSON cost is ~6x. The ledger must charge that
|
||
// serialized cost — and `jsonStringCostUpTo` must measure it WITHOUT
|
||
// allocating the escaped copy, so a near-budget line under a large
|
||
// maxLogBytes cannot momentarily allocate a multi-gigabyte `JSON.stringify`
|
||
// result. Under a small budget the residual is truncated once the serialized
|
||
// cost crosses it.
|
||
const { runtime } = await setup({ maxLogBytes: 4096 })
|
||
const result = await runtime.run({
|
||
program: ['import os', 'os.write(1, b"\\x00" * 4000)', 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
||
})
|
||
|
||
it('rejects an output budget that could breach addressSpaceMb during encode at load', async () => {
|
||
// The child builds, charges, and encodes a `maxLogBytes` log entry or a
|
||
// `maxValueBytes` completion value under RLIMIT_AS, and both trigger on
|
||
// character count against a serialized-byte budget — an astral character is
|
||
// one character but ~4 bytes stored and ~4 encoded, and THREE such copies are
|
||
// live at the peak (the caller's write argument, the slice/join handed to
|
||
// push, and the encode copy), so a budget approaching the address space lets a
|
||
// legitimate near-budget output breach it and die as worker-exit. The
|
||
// incompatible pair is rejected at load: each budget times the worst-case
|
||
// multiple (12) must fit the address space LEFT after the fixed interpreter
|
||
// baseline. Against a 256 MiB address space that leaves 192 MiB budgetable
|
||
// (~16 MiB admissible), so a 50 MB cap is far over; the default caps against
|
||
// 512 MiB are not. Both budgets are gated symmetrically — the value case sets
|
||
// a default-fitting maxLogBytes so the maxValueBytes check is what fires.
|
||
const ctxLog = new Context()
|
||
await expect(ctxLog.plugin(PythonCodeRuntime, { maxLogBytes: 50_000_000, addressSpaceMb: 256 }))
|
||
.rejects.toThrow(/maxLogBytes times the 12x worst-case Unicode expansion must fit/)
|
||
const ctxValue = new Context()
|
||
await expect(ctxValue.plugin(PythonCodeRuntime, { maxValueBytes: 50_000_000, addressSpaceMb: 256 }))
|
||
.rejects.toThrow(/maxValueBytes times the 12x worst-case Unicode expansion must fit/)
|
||
// Discriminates 12 from 8: a 48 MiB maxLogBytes against a 512 MiB address
|
||
// space leaves 448 MiB budgetable. 48*8 = 384 MiB fits (the old 8x multiple
|
||
// wrongly ADMITTED this), but 48*12 = 576 MiB does not. The ~12x peak this
|
||
// guards is the NEWLINE path's single near-budget write — the caller's own
|
||
// string, the line slice, and the encode copy live at once. The settlement
|
||
// flush is no longer the binding case: `flush_line` drops the pending chunks
|
||
// before its push, so it holds two copies, not three.
|
||
const ctxTwelve = new Context()
|
||
await expect(ctxTwelve.plugin(PythonCodeRuntime, { maxLogBytes: 48 * 1024 * 1024, addressSpaceMb: 512 }))
|
||
.rejects.toThrow(/maxLogBytes times the 12x worst-case Unicode expansion must fit/)
|
||
// An addressSpaceMb at or below the interpreter baseline leaves nothing
|
||
// budgetable, so no budget value can pass. It is rejected on its own terms:
|
||
// the budget loop would otherwise report "a limit of -1" (or -2796203 at
|
||
// 32 MiB) while naming maxLogBytes, sending the operator to the wrong knob.
|
||
const ctxBaseline = new Context()
|
||
await expect(ctxBaseline.plugin(PythonCodeRuntime, { addressSpaceMb: 64 }))
|
||
.rejects.toThrow(/addressSpaceMb must exceed the 67108864-byte interpreter baseline/)
|
||
const ctxBelow = new Context()
|
||
await expect(ctxBelow.plugin(PythonCodeRuntime, { addressSpaceMb: 32 }))
|
||
.rejects.toThrow(/addressSpaceMb must exceed the 67108864-byte interpreter baseline/)
|
||
// The default caps against the default 512 MiB address space load.
|
||
const ok = new Context()
|
||
const fiber = await ok.plugin(PythonCodeRuntime, { maxLogBytes: 65536, maxValueBytes: 32768, addressSpaceMb: 512 })
|
||
await fiber.dispose()
|
||
})
|
||
|
||
it('bounds an illegal-UTF-8 native residual by its U+FFFD-decoded cost', async () => {
|
||
// Every 0xFF byte is illegal in any UTF-8 sequence, so `toString('utf8')`
|
||
// renders each as U+FFFD (3 serialized bytes). `accrueStrayCost` must charge
|
||
// that 3, not the raw 1: otherwise the newline-free residual grows to a full
|
||
// budget's worth of RAW bytes before flushing — a ~3x undercount that near a
|
||
// large maxLogBytes retains hundreds of MiB then expands toward a ~1 GiB peak
|
||
// in flushStray's concat + toString. Paced single-byte writes (each its own
|
||
// `data` chunk, like the sealing case) expose the sub-chunk accrual: charged
|
||
// at 3 the residual crosses a 3072-byte budget after ~1024 bytes and flushes;
|
||
// charged at 1 it would need ~3072 bytes, so the peak residual triples. The
|
||
// largest merged buffer is the discriminator.
|
||
const realConcat = Buffer.concat.bind(Buffer)
|
||
let maxConcat = 0
|
||
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
||
const merged = realConcat(list, total)
|
||
if (merged.length > maxConcat) maxConcat = merged.length
|
||
return merged
|
||
}
|
||
let result: CodeRunResult
|
||
try {
|
||
const { runtime } = await setup({ maxLogBytes: 3072, maxWallMs: 30_000 })
|
||
result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'for _ in range(6000):',
|
||
' os.write(1, b"\\xff")',
|
||
' os.sched_yield()',
|
||
'return None',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
} finally {
|
||
Buffer.concat = realConcat
|
||
}
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(3072))
|
||
// Charged at 3, the residual flushes around 1024 raw bytes; the largest
|
||
// merged buffer stays well under 2048. A raw-byte undercount would let it
|
||
// reach ~3072 before flushing, so 2048 discriminates.
|
||
expect(maxConcat).toBeLessThan(2048)
|
||
})
|
||
|
||
it('charges a structurally-valid but illegal UTF-8 sequence its U+FFFD-decoded cost', async () => {
|
||
// A CESU-8 lone surrogate `ED A0 80` is structurally well-formed (a 3-byte
|
||
// lead plus two 0x80–0xBF continuations) but ILLEGAL: `toString('utf8')`
|
||
// renders each of the three bytes as its own U+FFFD (serialized cost 9), not
|
||
// one width-3 character. The newline-free flush trigger weighs the residual
|
||
// through `accrueStrayCost`, which must validate each lead's
|
||
// first-continuation range (ED excludes A0–BF) and charge the true 9 — else a
|
||
// CESU flood undercounts 3x and the residual grows toward a full budget's raw
|
||
// bytes before flushing, the same peak-memory vector as the 0xFF case. The
|
||
// bytes are written one at a time (each its own `data` chunk, no pipe
|
||
// coalescing) and `Buffer.concat` is wrapped to measure the peak residual.
|
||
const realConcat = Buffer.concat.bind(Buffer)
|
||
let maxConcat = 0
|
||
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
||
const merged = realConcat(list, total)
|
||
if (merged.length > maxConcat) maxConcat = merged.length
|
||
return merged
|
||
}
|
||
let result: CodeRunResult
|
||
try {
|
||
const { runtime } = await setup({ maxLogBytes: 3072, maxWallMs: 30_000 })
|
||
result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'seq = (0xed, 0xa0, 0x80)',
|
||
'for _ in range(2000):',
|
||
' for b in seq:',
|
||
' os.write(1, bytes((b,)))',
|
||
' os.sched_yield()',
|
||
'return None',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
} finally {
|
||
Buffer.concat = realConcat
|
||
}
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(3072))
|
||
// Each 3-byte sequence costs 9 (three U+FFFD), so single-byte-paced the
|
||
// residual crosses the 3072 budget after ~342 raw bytes and flushes; the
|
||
// largest merged buffer stays well under 2048. Charging the structural width
|
||
// 3 would need ~1024 raw bytes, tripling the peak past 2048.
|
||
expect(maxConcat).toBeLessThan(2048)
|
||
})
|
||
|
||
it('charges a lone surrogate its full six escaped bytes, not three', async () => {
|
||
// A forged `log` frame carrying `\ud800` escapes materializes lone
|
||
// surrogates after JSON.parse. `Buffer.byteLength` of U+FFFD is 3, but
|
||
// ES2019 well-formed `JSON.stringify` emits `\ud800` at 6 bytes, so charging
|
||
// the raw width would admit ~2x the configured budget of serialized bytes
|
||
// (the same family as the NUL-flood undercount, at 2x rather than 6x). The
|
||
// cost walker charges surrogates the full 6, so a flood truncates at budget.
|
||
// Forged on fd 3 because Python stdout will not emit lone surrogates.
|
||
const { runtime } = await setup({ maxLogBytes: 4096 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
// 1000 \ud800 escapes: charged at the buggy raw width 1000 * 3 = 3000
|
||
// bytes fits under 4096 (wrongly admitted), but the correct serialized
|
||
// width 1000 * 6 = 6000 bytes is over budget — so the ledger must
|
||
// truncate. The count sits in the 683..1365 window where the two
|
||
// chargings disagree, making the test discriminate.
|
||
String.raw`frame = b'{"type":"log","text":"' + b'\\ud800' * 1000 + b'"}\n'`,
|
||
'os.write(3, frame)',
|
||
'return None',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
||
})
|
||
|
||
it('drops a second stray line in the same chunk once the first truncated the ledger', async () => {
|
||
// One `os.write` carrying two newline-terminated lines where the first
|
||
// exhausts maxLogBytes: the first line's admit truncates and marks the
|
||
// ledger, and the second line's admit — reached in the same `data` callback
|
||
// — must be the post-truncation no-op. Proves that branch is exercised, so
|
||
// it carries no v8-ignore. Kept to 108 bytes (< the smallest PIPE_BUF, 512 on
|
||
// macOS) so the whole payload lands in ONE atomic write and one `data`
|
||
// callback — the two newlines cannot split across callbacks and leave the
|
||
// branch un-exercised, which would be a hard-to-attribute per-file coverage
|
||
// flake. The first line's 100 bytes already exceed the 64-byte budget, so it truncates.
|
||
const { runtime } = await setup({ maxLogBytes: 64 })
|
||
const result = await runtime.run({
|
||
program: ['import os', 'os.write(1, b"A" * 100 + b"\\nSECOND\\n")', 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(64))
|
||
expect(result.logs.join('\n')).not.toContain('SECOND')
|
||
})
|
||
|
||
it('charges a broken multibyte sequence its U+FFFD bytes, split across pipe chunks', async () => {
|
||
// A 3-byte lead (0xE4) whose continuation never arrives — the next byte is a
|
||
// fresh ASCII 'A' — must be costed as U+FFFD (3) for the orphaned lead, not
|
||
// folded into a phantom character. Driven byte-by-byte so the lead and the
|
||
// breaking byte land in separate `data` chunks, exercising accrueStrayCost's
|
||
// cross-chunk broken-sequence branch. The run completes and the bytes are
|
||
// captured (rendered U+FFFD by toString), proving the walk resynchronizes.
|
||
const { runtime } = await setup({ maxLogBytes: 1024 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'os.write(1, b"\\xe4")',
|
||
'os.sched_yield()',
|
||
'os.write(1, b"A\\n")',
|
||
'return None',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.join('')).toContain('A')
|
||
expect(result.logs.join('')).toContain('�')
|
||
})
|
||
|
||
it('charges the exact serialized cost of short-escape and quote/backslash characters', async () => {
|
||
// Exercises every branch of jsonStringCostUpTo's per-character cost: a tab
|
||
// and other C0 controls with short JSON forms (\t etc., 2 bytes), a quote
|
||
// and backslash (2 bytes each), a `\uXXXX` control (6 bytes), a multibyte
|
||
// BMP character (raw UTF-8 width), and plain ASCII. Under a budget large
|
||
// enough to admit it, the line survives verbatim — proving the cost walker
|
||
// does not over- or under-charge and the string round-trips unescaped.
|
||
const { runtime } = await setup({ maxLogBytes: 4096 })
|
||
const result = await runtime.run({
|
||
program: ['import os', String.raw`os.write(1, "\ta\"b\\c\x01é\n".encode("utf-8"))`, 'return None'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs).toEqual(['\ta"b\\c\x01é'])
|
||
})
|
||
|
||
it('fails a completion dict with a non-string key as invalid-output (no key coercion)', async () => {
|
||
// json.dumps would coerce {1: "a", "1": "b"} to a single "1" key, silently
|
||
// dropping data. The shape validator rejects it before encoding.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'return {1: "first", "1": "second"}',
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('invalid-output')
|
||
expect(result.error?.message).toContain('non-string dict key')
|
||
})
|
||
|
||
it('rejects a binding argument with a non-string dict key before dispatch', async () => {
|
||
const { runtime } = await setup()
|
||
let called = false
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.sink({1: "x"})',
|
||
'except RuntimeError as e:',
|
||
' caught = str(e)',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: tools({ sink: async () => { called = true; return null } }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('lossless JSON')
|
||
expect(called).toBe(false)
|
||
})
|
||
|
||
it('fails a non-JSON completion value as invalid-output (no repr substitution)', async () => {
|
||
// A set is not lossless JSON. The old draft substituted repr(); the seam
|
||
// now requires refusing the run instead.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'return {1, 2, 3}',
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('invalid-output')
|
||
expect(result.error?.message).toContain('lossless JSON')
|
||
expect(result.error?.message).toContain('set')
|
||
})
|
||
|
||
it('fails a negative-zero completion value as invalid-output (sign bit is lossy over JSON)', async () => {
|
||
// JSON serialization turns -0.0 into 0 (or JS -0), silently changing the
|
||
// sign bit; the canonical lossless-JSON boundary rejects it, so the
|
||
// Python side must too — as a completion and as a binding argument.
|
||
const { runtime } = await setup()
|
||
const completion = await runtime.run({
|
||
program: 'return -0.0',
|
||
bindings: [],
|
||
})
|
||
expect(completion.error?.kind).toBe('invalid-output')
|
||
expect(completion.error?.message).toContain('negative zero')
|
||
const argument = await runtime.run({
|
||
program: [
|
||
'try:',
|
||
' await tools.echo(-0.0)',
|
||
' return "accepted"',
|
||
'except RuntimeError as e:',
|
||
' return str(e)',
|
||
].join('\n'),
|
||
bindings: tools({ echo: async args => args as never }),
|
||
})
|
||
expect(argument.error).toBeUndefined()
|
||
expect(argument.value).toContain('negative zero')
|
||
})
|
||
|
||
it('fails a NaN completion value as invalid-output (allow_nan=False)', async () => {
|
||
// json.dumps would happily emit NaN by default, but NaN is not JSON; the
|
||
// bootstrap passes allow_nan=False so it fails as invalid-output.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'return float("nan")',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('invalid-output')
|
||
})
|
||
|
||
it('fails an over-budget completion value as output-limit (child-side check)', async () => {
|
||
const { runtime } = await setup({ maxValueBytes: 64 })
|
||
const result = await runtime.run({
|
||
program: 'return "V" * 5000',
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
expect(result.error?.message).toContain('exceeded 64 bytes')
|
||
})
|
||
|
||
it('meters a control-heavy completion value without materializing its escaped form', async () => {
|
||
// The child's lower bound admits a string by CHARACTER count, then the meter
|
||
// charged what `_dump_string(current).encode()` returned -- building the
|
||
// escaped copy plus its encode. Each NUL escapes to six bytes, so metering a
|
||
// value the budget then REJECTS allocated ~6x the original twice over:
|
||
// measured at 228.9 MiB of peak for a 20M-NUL string, against 19.1 MiB for
|
||
// the counting path that returns the identical 120,000,002 bytes. Past
|
||
// RLIMIT_AS the meter died as `exception: MemoryError`, inverting the
|
||
// `output-limit` this seam promises for an over-budget value.
|
||
//
|
||
// 8M NULs is 8,000,002 raw but 48,000,002 escaped: over the 16 MiB budget
|
||
// only when charged the escaped cost, so this also pins that the cheap
|
||
// character bound alone does not decide the verdict.
|
||
const { runtime } = await setup({ maxValueBytes: 16 * 1024 * 1024, maxWallMs: 60_000 })
|
||
const result = await runtime.run({
|
||
program: 'return "\\x00" * 8_000_000',
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
}, 90_000)
|
||
|
||
it('rejects a wide completion as output-limit before materializing its traversal state', async () => {
|
||
// `[0] * 2000000` sits far above maxValueBytes but well below the frame
|
||
// ceiling. The folded checker must reject it via the pre-enqueue bound —
|
||
// BEFORE pushing two million elements onto the walk — so a small
|
||
// addressSpaceMb does not turn the check itself into an RLIMIT_AS death.
|
||
const { runtime } = await setup({ maxValueBytes: 64, addressSpaceMb: 256, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: 'return [0] * 2000000',
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
expect(result.error?.message).toContain('exceeded 64 bytes')
|
||
}, 20_000)
|
||
|
||
it('rejects a wide dict as output-limit without materializing its items list', async () => {
|
||
// Same pre-enqueue bound on the dict branch: `len(current)` replaces
|
||
// `list(current.items())`, which allocated one tuple per member before the
|
||
// bound could reject the value. Two million entries under a 64-byte cap
|
||
// fits the 256 MiB address space as a dict but not as a dict PLUS a
|
||
// two-million-tuple list.
|
||
const { runtime } = await setup({ maxValueBytes: 64, addressSpaceMb: 256, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: 'return {str(i): 0 for i in range(2000000)}',
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
expect(result.error?.message).toContain('exceeded 64 bytes')
|
||
}, 20_000)
|
||
|
||
it('meters a float completion in the host\'s number spelling', async () => {
|
||
// CPython's repr disagrees with the host's String(number): `1.0` is three
|
||
// bytes here and one there, `1e-07` pads the exponent the host writes as
|
||
// `1e-7`. Both sides meter the SAME budget, so the child must count the
|
||
// bytes the host will receive — otherwise a boundary-sized value is
|
||
// falsely reported as output-limit.
|
||
const { runtime } = await setup({ maxValueBytes: 1 })
|
||
const integral = await runtime.run({ program: 'return 1.0', bindings: [] })
|
||
expect(integral.error).toBeUndefined()
|
||
expect(integral.value).toBe(1)
|
||
|
||
const exponent = await setup({ maxValueBytes: 4 })
|
||
const small = await exponent.runtime.run({ program: 'return 1e-7', bindings: [] })
|
||
expect(small.error).toBeUndefined()
|
||
expect(small.value).toBe(1e-7)
|
||
|
||
// The spelling is a meter input, not a licence to overshoot: `1.5` is three
|
||
// bytes on both sides and still fails a two-byte budget.
|
||
const tight = await setup({ maxValueBytes: 2 })
|
||
const over = await tight.runtime.run({ program: 'return 1.5', bindings: [] })
|
||
expect(over.error?.kind).toBe('output-limit')
|
||
})
|
||
|
||
it('carries floats across the wire in the host\'s number spelling', async () => {
|
||
// The child ENCODES with the same speller it meters with, so the frame the
|
||
// host parses must reproduce every double exactly — including the branches
|
||
// where CPython and ECMAScript disagree (integral floats, sub-1e-6
|
||
// exponents, >= 1e21, and beyond-safe-range integral doubles whose exact
|
||
// digits differ from the shortest round-trip form).
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'return [1.0, 100.0, 1.5, 0.1, 1e-7, 1e-6, 1e-5, 123.456, -2.5e-8, 1e21, float(2**60), 5e-324, 1.7976931348623157e308]',
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual([1, 100, 1.5, 0.1, 1e-7, 1e-6, 1e-5, 123.456, -2.5e-8, 1e21, 2 ** 60, 5e-324, 1.7976931348623157e308])
|
||
})
|
||
|
||
it('rejects a forged non-lossless done value host-side as invalid-output', async () => {
|
||
// A forged done frame bypasses the child's _check_done_value. JSON.parse
|
||
// turns 1e400 into Infinity; validateChildFrame no longer scans done.value,
|
||
// so the host's own checkDoneValue must catch the non-lossless number.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
String.raw`os.write(3, b'{"type":"done","value":1e400}' + b'\n')`,
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('invalid-output')
|
||
expect(result.error?.message).toContain('non-lossless number')
|
||
})
|
||
|
||
it('reports a syntax error as an exception without settling with a value', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: '$$invalid python$$',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('SyntaxError')
|
||
expect(result.value).toBeUndefined()
|
||
})
|
||
|
||
it('reports a runtime raise as an exception with the traceback', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'raise ValueError("intentional")',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('ValueError')
|
||
expect(result.error?.message).toContain('intentional')
|
||
})
|
||
|
||
it('bounds a deep exception cause chain instead of burning the wall budget formatting it', async () => {
|
||
// A chain thousands of links deep would make the rendering walk and
|
||
// format() linear in its length, consuming maxWallMs. Rendering is capped
|
||
// at 100 links with a marker; the run reports the exception well within
|
||
// budget rather than timing out.
|
||
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 20_000 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'err = None',
|
||
'for i in range(3000):',
|
||
' try:',
|
||
' raise ValueError(i) from err',
|
||
' except ValueError as e:',
|
||
' err = e',
|
||
'raise err',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('exception chain truncated at 100 links')
|
||
expect(Date.now() - start).toBeLessThan(15_000)
|
||
}, 25_000)
|
||
|
||
it('bounds an over-cap chain without assigning to the live exception', async () => {
|
||
// The cap used to be applied by severing the over-cap link ON the live
|
||
// exception. An exception class overriding __setattr__ to raise turned that
|
||
// assignment into model code running inside the bootstrap's failure
|
||
// handler; the throw skipped the `done` send that sits after the handler,
|
||
// so the host blocked on fd 3 and reported a maxWallMs timeout instead of
|
||
// the model's own exception. Cutting the chain on the TracebackException
|
||
// COPY touches no model hook, so the marker still appears and the run
|
||
// reports `exception`.
|
||
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 15_000 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'class Sealed(Exception):',
|
||
' def __setattr__(self, name, value):',
|
||
' raise RuntimeError("live mutation refused")',
|
||
'err = None',
|
||
'for i in range(150):',
|
||
' try:',
|
||
' raise Sealed(i) from err',
|
||
' except Sealed as e:',
|
||
' err = e',
|
||
'raise err',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('Sealed')
|
||
expect(result.error?.message).toContain('exception chain truncated at 100 links')
|
||
// The sever attempt is what used to leak: its message must not appear, and
|
||
// the run must settle well inside the wall budget rather than timing out.
|
||
expect(result.error?.message).not.toContain('live mutation refused')
|
||
expect(Date.now() - start).toBeLessThan(10_000)
|
||
}, 20_000)
|
||
|
||
it('still sends done when rendering the diagnostic itself raises', async () => {
|
||
// format() reaches the exception's own __str__, so a model class whose
|
||
// __str__ raises can throw from inside the failure handler. CPython's
|
||
// _safe_string absorbs a raising __str__ during formatting, but the
|
||
// fallback must hold for any throw on that path (a raising __repr__ of an
|
||
// argument, a MemoryError under RLIMIT_AS), so the assertion is the
|
||
// invariant that matters: a `done` frame carrying `exception`, never a
|
||
// timeout, and never the failing renderer's own message.
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'class Unprintable(Exception):',
|
||
' def __str__(self):',
|
||
' raise RuntimeError("str refused")',
|
||
' def __repr__(self):',
|
||
' raise RuntimeError("repr refused")',
|
||
'raise Unprintable()',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('Unprintable')
|
||
expect(result.error?.message).not.toContain('str refused')
|
||
expect(result.error?.message).not.toContain('repr refused')
|
||
}, 15_000)
|
||
|
||
it('sends done with an inert diagnostic when the whole rendering path raises', async () => {
|
||
// Drive the fallback itself. `TracebackException.format` reads the
|
||
// exception class's `__module__` to decide whether to qualify the name, and
|
||
// a metaclass property can raise there — a throw INSIDE the formatter,
|
||
// reached with no rebinding of anything the bootstrap owns. Without the
|
||
// wrapper it escapes the handler, the `done` send never runs, and the host
|
||
// times out at maxWallMs.
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'class Meta(type):',
|
||
' @property',
|
||
' def __module__(cls):',
|
||
' raise RuntimeError("renderer refused")',
|
||
'class Hostile(ValueError, metaclass=Meta):',
|
||
' pass',
|
||
'raise Hostile("original failure")',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
// The inert fallback names the class and a fixed literal; it must not carry
|
||
// the renderer's message, and must not have become a timeout. `__name__` is
|
||
// still a plain str here, so the class name survives.
|
||
expect(result.error?.message).toBe('Hostile: <diagnostic rendering failed>')
|
||
}, 15_000)
|
||
|
||
it('falls back to a placeholder class name when __name__ itself raises', async () => {
|
||
// The fallback reads type(exc).__name__, which a metaclass property can
|
||
// hijack. It must neither run that override's failure into the handler nor
|
||
// format a non-str __name__ into the message. The hostile `__module__` is
|
||
// what drives execution into the fallback in the first place.
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'class Meta(type):',
|
||
' @property',
|
||
' def __module__(cls):',
|
||
' raise RuntimeError("renderer refused")',
|
||
' @property',
|
||
' def __name__(cls):',
|
||
' raise RuntimeError("name refused")',
|
||
'class Nameless(Exception, metaclass=Meta):',
|
||
' pass',
|
||
'raise Nameless()',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toBe('<unknown>: <diagnostic rendering failed>')
|
||
}, 15_000)
|
||
|
||
it('reports the real exception when the program rebinds every name the failure path uses', async () => {
|
||
// The bootstrap IS __main__, so `import __main__; __main__._X = ...` reaches
|
||
// any module global a call-time lookup would read. The failure path is the
|
||
// worst place for that: the reporter, the byte cap, the traceback formatter,
|
||
// the settlement flush and the `done` send all run AFTER the `except` block,
|
||
// so a replacement that raises skips the send, leaves the host blocked on
|
||
// fd 3, and the run reports a maxWallMs timeout instead of the model's own
|
||
// exception. Rebind all of them at once; the run must still carry the real
|
||
// ValueError.
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import __main__',
|
||
'def boom(*a, **k):',
|
||
' raise RuntimeError("hijacked")',
|
||
'__main__._SAFE_MODEL_TRACEBACK = boom',
|
||
'__main__._cap_message = boom',
|
||
'__main__._model_traceback = boom',
|
||
'__main__._UNRENDERABLE_DIAGNOSTIC = boom',
|
||
'__main__._LogStream.flush_line = boom',
|
||
'__main__.ProtocolChannel.send_sync = boom',
|
||
'raise ValueError("real failure")',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('ValueError: real failure')
|
||
expect(result.error?.message).not.toContain('hijacked')
|
||
}, 15_000)
|
||
|
||
it('bounds an over-cap exception-group nesting on the copy', async () => {
|
||
// Exception groups link through `exceptions`, not the cause/context
|
||
// dunders, so the cap has to count that edge too — otherwise a deeply
|
||
// nested group walks past the bound the marker claims to enforce.
|
||
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'group = ValueError("leaf")',
|
||
'for i in range(150):',
|
||
' group = ExceptionGroup(f"g{i}", [group])',
|
||
'raise group',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('exception chain truncated at 100 links')
|
||
}, 20_000)
|
||
|
||
it('filters every bootstrap frame from the traceback of an uncaught binding rejection', async () => {
|
||
// A rejection re-raised by the bootstrap's dispatch adds bootstrap frames
|
||
// AFTER the model's own; only <model> frames may reach model-visible,
|
||
// durable output — a bootstrap.py path would leak host absolutes and make
|
||
// transcripts machine-dependent.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: 'await tools.boom({})',
|
||
bindings: tools({ boom: async () => { throw new Error('exploded') } }),
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('exploded')
|
||
expect(result.error?.message).toContain('<model>')
|
||
expect(result.error?.message).not.toContain('bootstrap.py')
|
||
})
|
||
|
||
it('renders a non-Error thrown value from a host binding as its String form', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.failRaw({})',
|
||
'except RuntimeError as e:',
|
||
' caught = str(e)',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
failRaw: async () => { throw 'raw-nope' },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('raw-nope')
|
||
})
|
||
|
||
it('reassembles a frame split across writes behind a completed one', async () => {
|
||
// One os.write carrying "<frame>\n<partial...>" leaves a non-empty
|
||
// residual after the newline loop; the tail must survive until its own
|
||
// newline arrives and then parse as a normal frame.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'head = json.dumps({"type":"log","text":"first"}).encode()',
|
||
'tail = json.dumps({"type":"log","text":"second"}).encode()',
|
||
'import time',
|
||
'os.write(3, head + b"\\n" + tail[:5])',
|
||
'time.sleep(0.2)',
|
||
'os.write(3, tail[5:] + b"\\n")',
|
||
'return "ok"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('ok')
|
||
expect(result.logs).toContain('first')
|
||
expect(result.logs).toContain('second')
|
||
})
|
||
|
||
it('raises the declared errorClass with the member name on rejection', async () => {
|
||
// Code Mode declares { name: ToolCallError, memberNameProperty: toolName };
|
||
// a host rejection must surface as that class, carrying the failed tool.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.fail({})',
|
||
'except ToolCallError as e:',
|
||
' caught = f"{type(e).__name__}:{e.toolName}:{e}"',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: [{
|
||
global: 'tools',
|
||
functions: { fail: async () => { throw new Error('typed-nope') } },
|
||
errorClass: { name: 'ToolCallError', memberNameProperty: 'toolName' },
|
||
}],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('ToolCallError:fail:typed-nope')
|
||
})
|
||
|
||
it('rejects an errorClass name colliding with its namespace global at the seam', async () => {
|
||
const { runtime } = await setup()
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'tools', memberNameProperty: 'toolName' } }],
|
||
})).rejects.toThrow(/collides with another injected global/)
|
||
})
|
||
|
||
it('rejects a namespace global colliding with a runtime-owned name at the seam', async () => {
|
||
// `__dsh_main__` passes the identifier check, but exec()ing the generated
|
||
// wrapper would silently overwrite the binding after injection. `console`
|
||
// is the WORKER backend's slot — refused here too so a namespace list
|
||
// valid on one backend is valid on all.
|
||
const { runtime } = await setup()
|
||
// `__debug__` is refused for a different reason than a collision: CPython
|
||
// compiles a bare `__debug__` reference to the constant True and refuses to
|
||
// assign the name at compile time, so an injected global under it is
|
||
// unreachable from the program — accepted by the seam, unusable here.
|
||
for (const global of ['__dsh_main__', 'console', '__debug__']) {
|
||
await expect(runtime.run({
|
||
program: 'x = 1',
|
||
bindings: [{ global, functions: {} }],
|
||
})).rejects.toThrow(/collides with a runtime-owned global/)
|
||
}
|
||
})
|
||
|
||
it('accepts a non-identifier memberNameProperty and rejects only an empty one', async () => {
|
||
// The seam permits any non-empty own property except the reserved
|
||
// members; Python setattr/getattr carry exotic names like `tool-name`,
|
||
// and the worker backend accepts them, so this backend must too.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'try:',
|
||
' await tools.boom({})',
|
||
'except ToolCallError as e:',
|
||
' return getattr(e, "tool-name")',
|
||
].join('\n'),
|
||
bindings: [{
|
||
global: 'tools',
|
||
functions: { boom: async () => { throw new Error('nope') } },
|
||
errorClass: { name: 'ToolCallError', memberNameProperty: 'tool-name' },
|
||
}],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('boom')
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'ToolCallError', memberNameProperty: '' } }],
|
||
})).rejects.toThrow(/memberNameProperty must be a non-empty attribute name/)
|
||
})
|
||
|
||
it('resolves a basename pythonBin to an absolute path (runs a real program)', async () => {
|
||
// A bare `python3` basename must resolve against PATH and actually launch
|
||
// under the empty-env spawn — exercises the accessSync success branch.
|
||
const { runtime } = await setup({ pythonBin: 'python3' })
|
||
const result = await runtime.run({ program: 'return 7', bindings: [] })
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(7)
|
||
})
|
||
|
||
it('spawns via an absolute python path resolved from a basename against PATH', async () => {
|
||
// resolvePythonBin turns the default basename into an absolute path before
|
||
// the empty-env spawn; a basename with no PATH match falls through to the
|
||
// normal ENOENT worker-exit rather than throwing.
|
||
const { runtime } = await setup({ pythonBin: 'definitely-no-such-python-xyz' })
|
||
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
})
|
||
|
||
it('rejects a memberNameProperty naming a constrained BaseException attribute', async () => {
|
||
// `__dict__`/`__class__` are constrained descriptors alongside
|
||
// `__traceback__` — setattr of a string raises TypeError while
|
||
// constructing the rejection — so every dunder is refused at the seam.
|
||
const { runtime } = await setup()
|
||
// name/message/stack are the seam's own exclusions (CodeBindingErrorClass
|
||
// forbids replacing them; the worker backend rejects them identically).
|
||
for (const member of ['__traceback__', '__dict__', '__class__', 'args', 'name', 'message', 'stack']) {
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'ToolCallError', memberNameProperty: member } }],
|
||
})).rejects.toThrow(/reserved error member/)
|
||
}
|
||
})
|
||
|
||
it('rejects a lossy binding resolution (NaN) instead of coercing it to null', async () => {
|
||
// JSON.stringify would turn NaN into null and drop undefined fields; the
|
||
// seam requires a descriptive rejection so data cannot silently corrupt.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.bad({})',
|
||
'except RuntimeError as e:',
|
||
' caught = str(e)',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: tools({ bad: async () => Number.NaN }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('lossless JSON')
|
||
})
|
||
|
||
it('contains a forged pathological done value without crashing the host', async () => {
|
||
// A ~20k-deep nested array forged onto fd 3 would overflow a recursive
|
||
// JSON.stringify; the host's iterative encoder measures it stack-safely
|
||
// and fails it deterministically on the byte budget (40 kB > 32 KiB).
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'depth = 20000',
|
||
'payload = "[" * depth + "]" * depth',
|
||
'os.write(3, b\'{"type":"done","value":\' + payload.encode() + b\'}\\n\')',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
})
|
||
|
||
it('preserves a deeply nested completion value below the byte budget', async () => {
|
||
// CodeJsonValue has no depth limit: a 10000-deep nested list is only
|
||
// ~20 kB — under maxValueBytes — and must cross intact. That depth
|
||
// overflows BOTH recursive serializers the pipeline used to rely on
|
||
// (CPython's json.dumps recursion limit ~1000s, V8's JSON.stringify), so
|
||
// it proves the child-side _encode_json_plain and the host-side
|
||
// encodeJsonPlain together. The host JSON.parse of the frame is iterative
|
||
// in V8 for arrays, so only the two encoders were at risk.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'v = None',
|
||
'for _ in range(10000):',
|
||
' v = [v]',
|
||
'return v',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// Walk down iteratively (a recursive toEqual would itself overflow).
|
||
let depth = 0
|
||
let cursor: unknown = result.value
|
||
while (Array.isArray(cursor)) {
|
||
expect(cursor).toHaveLength(1)
|
||
cursor = cursor[0]
|
||
depth++
|
||
}
|
||
expect(depth).toBe(10000)
|
||
expect(cursor).toBeNull()
|
||
})
|
||
|
||
it('bridges a deeply nested binding resolution back into the program stack-safely', async () => {
|
||
// A binding resolution has no seam-level depth or byte cap; neither the
|
||
// host's reply serialization nor the CHILD's reply decode may die on
|
||
// recursion (json.loads raises RecursionError ~10k levels deep; the
|
||
// bootstrap decodes frames iteratively). 12000 levels sits past that
|
||
// limit while staying tiny in bytes.
|
||
const { runtime } = await setup()
|
||
const deep = ((): unknown => {
|
||
let v: unknown = null
|
||
for (let i = 0; i < 12000; i++) v = [v]
|
||
return v
|
||
})()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'v = await tools.deep({})',
|
||
'depth = 0',
|
||
'while isinstance(v, list):',
|
||
' v = v[0]',
|
||
' depth += 1',
|
||
'return depth',
|
||
].join('\n'),
|
||
bindings: tools({ deep: async () => deep as never }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(12000)
|
||
})
|
||
|
||
it('rejects a reserved errorClass name at the seam', async () => {
|
||
const { runtime } = await setup()
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{
|
||
global: 'tools',
|
||
functions: {},
|
||
errorClass: { name: 'class', memberNameProperty: 'toolName' },
|
||
}],
|
||
})).rejects.toThrow(/errorClass.name "class" is not a usable Python identifier/)
|
||
})
|
||
|
||
it('routes a declared inherited-attribute name through the bridge via subscript', async () => {
|
||
// __class__ resolves on `object` before any fallback hook; the proxy's
|
||
// __getattribute__ intercepts declared names first, and subscript access
|
||
// is the SDK-advertised route for underscore names.
|
||
const { runtime } = await setup()
|
||
const seen: string[] = []
|
||
const result = await runtime.run({
|
||
program: [
|
||
'a = await tools["__class__"]({"via": "subscript"})',
|
||
'b = await tools.__class__({"via": "dot"})',
|
||
'return [a, b]',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
'__class__': async () => { seen.push('called'); return 'bridged' },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual(['bridged', 'bridged'])
|
||
expect(seen).toEqual(['called', 'called'])
|
||
})
|
||
|
||
it('rejects NaN binding arguments immediately instead of hanging', async () => {
|
||
// Default json.dumps would emit a non-standard NaN token that the host
|
||
// JSON.parse drops silently, hanging the call until the wall clock;
|
||
// allow_nan=False raises in-program right away.
|
||
const { runtime } = await setup({ maxWallMs: 8000 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.echo({"x": float("nan")})',
|
||
'except RuntimeError as e:',
|
||
' caught = str(e)',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: tools({ echo: async args => args as CodeJsonValue }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('lossless JSON')
|
||
expect(Date.now() - start).toBeLessThan(5000)
|
||
})
|
||
|
||
it('carries large binding arguments well past maxValueBytes', async () => {
|
||
// Binding traffic has no seam byte cap: a call frame far larger than the
|
||
// completion budget must reach the host intact (the fd-3 ceiling is a
|
||
// fixed memory-safety bound, not an output budget).
|
||
const maxValueBytes = 4096
|
||
const { runtime } = await setup({ maxValueBytes })
|
||
let receivedLength = 0
|
||
const result = await runtime.run({
|
||
program: [
|
||
`big = "B" * ${maxValueBytes * 50}`,
|
||
'r = await tools.measure({"payload": big})',
|
||
'return r',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
measure: async (args) => {
|
||
receivedLength = ((args as { payload: string }).payload).length
|
||
return receivedLength
|
||
},
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(receivedLength).toBe(maxValueBytes * 50)
|
||
expect(result.value).toBe(maxValueBytes * 50)
|
||
})
|
||
|
||
it('rejects an unknown binding name inside the program with a matching error', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.nope({})',
|
||
'except (AttributeError, RuntimeError) as e:',
|
||
' caught = str(e)',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: tools({ known: async () => 'ok' }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('nope')
|
||
})
|
||
|
||
it('bounds an unknown-binding diagnostic built from a forged call frame', async () => {
|
||
// `call.global` and `call.name` carry no byte cap of their own, only the
|
||
// 256 MiB fd-3 frame ceiling, and the reply interpolated them raw: one copy
|
||
// into the template result, one into the `JSON.stringify` escape, one into
|
||
// the `encodeJsonPlain` frame, one into the pipe write. Slicing each field
|
||
// to `maxValueBytes` code units first makes an 8 MiB forged name a
|
||
// 128-byte reply. The observable effect is the reply the child then has to
|
||
// READ: its fd-3 reader is unbuffered, so `readline` consumes an oversized
|
||
// reply one `read(2)` per byte and the run's own legitimate call never gets
|
||
// answered — measured under a 60 s ceiling, the 8 MiB case timed out and a
|
||
// 64 MiB case cost the host 509.9 MiB of heap against 120.3 MiB with the
|
||
// slices in place. The child's address space stays generous enough to BUILD
|
||
// the forgery, which is not what is under test.
|
||
const { runtime } = await setup({ maxValueBytes: 128, addressSpaceMb: 1024, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'frame = b\'{"type":"call","id":9001,"global":"tools","name":"\' + b"n" * (8 * 1024 * 1024) + b\'","args":{}}\\n\'',
|
||
// One os.write returns short past the pipe buffer, and a partial frame
|
||
// would glue itself to the next one and be dropped as malformed, so the
|
||
// forgery goes out through a drain loop.
|
||
'view = memoryview(frame)',
|
||
'while view:',
|
||
' view = view[os.write(3, view):]',
|
||
// A legitimate call after the forgery: its reply can only arrive once
|
||
// the child has read past whatever the forged frame was answered with.
|
||
'await tools.known({})',
|
||
'return "settled"',
|
||
].join('\n'),
|
||
bindings: tools({ known: async () => 'ok' }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('settled')
|
||
}, 40_000)
|
||
|
||
it('bridges a binding call reached via subscript access (tools["name"])', async () => {
|
||
// The SDK tells the model `await tools["my-tool"](args)` works for exotic
|
||
// names; the proxy's __getitem__ must route it through the bridge.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'r = await tools["my-tool"]({"n": 7})',
|
||
'return r',
|
||
].join('\n'),
|
||
bindings: tools({ 'my-tool': async args => ({ got: args as CodeJsonValue }) }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual({ got: { n: 7 } })
|
||
})
|
||
|
||
it('raises KeyError for an undeclared subscript name', async () => {
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools["absent"]({})',
|
||
'except KeyError as e:',
|
||
' caught = str(e)',
|
||
'return caught',
|
||
].join('\n'),
|
||
bindings: tools({ known: async () => 'ok' }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('absent')
|
||
})
|
||
})
|
||
|
||
describe('PythonCodeRuntime — budgets, termination, disposal', () => {
|
||
it('kills a wall-clock runaway program via SIGTERM/SIGKILL and reports timeout', async () => {
|
||
const { runtime } = await setup({ maxWallMs: 500, graceMs: 200 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: 'import time\nwhile True: time.sleep(1)',
|
||
bindings: [],
|
||
})
|
||
const elapsed = Date.now() - start
|
||
// The wall timer may fire first or the exit-after-signal may resolve; both are ok.
|
||
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
||
// We got somewhere in the neighborhood of maxWallMs, not the underlying `sleep(1)`.
|
||
expect(elapsed).toBeLessThan(2000)
|
||
}, 5000)
|
||
|
||
it('aborts a run when the outer signal fires mid-flight', async () => {
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const controller = new AbortController()
|
||
const settled: Promise<CodeRunResult> = runtime.run({
|
||
program: 'import time\nwhile True: time.sleep(0.1)',
|
||
bindings: [],
|
||
signal: controller.signal,
|
||
})
|
||
setTimeout(() => { controller.abort('outer-abort') }, 200)
|
||
const result = await settled
|
||
expect(['abort', 'worker-exit']).toContain(result.error?.kind)
|
||
}, 5000)
|
||
|
||
it('settles the run when a mid-flight abort reason cannot be converted', async () => {
|
||
// The listener converted the reason before calling `finish()`, so a hostile
|
||
// reason threw from inside an `AbortSignal` listener. Node reports that as an
|
||
// uncaught exception — it can terminate the host — and `finish()` never ran,
|
||
// so the run stayed live until the wall ceiling and misreported as `timeout`
|
||
// (observed) instead of the caller's cancellation. `maxWallMs` is short so
|
||
// that misreport is a fast assertion failure rather than a suite timeout.
|
||
const uncaught: unknown[] = []
|
||
const record = (error: unknown): void => { uncaught.push(error) }
|
||
process.on('uncaughtException', record)
|
||
try {
|
||
const { runtime } = await setup({ maxWallMs: 4_000, graceMs: 200 })
|
||
const controller = new AbortController()
|
||
const settled: Promise<CodeRunResult> = runtime.run({
|
||
program: 'import time\nwhile True: time.sleep(0.1)',
|
||
bindings: [],
|
||
signal: controller.signal,
|
||
})
|
||
setTimeout(() => {
|
||
controller.abort({ [Symbol.toPrimitive]() { throw new Error('reason blew up') } })
|
||
}, 200)
|
||
const result = await settled
|
||
expect(result.error?.kind).toBe('abort')
|
||
expect(result.error?.message).toBe('<unrenderable rejection value>')
|
||
expect(uncaught).toEqual([])
|
||
} finally {
|
||
process.off('uncaughtException', record)
|
||
}
|
||
}, 15_000)
|
||
|
||
it('disposes to quiescence: an in-flight run resolves as abort and the child exits', async () => {
|
||
const { fiber, runtime } = await setup({ maxWallMs: 10_000 })
|
||
const pending = runtime.run({
|
||
program: 'import time\nwhile True: time.sleep(0.1)',
|
||
bindings: [],
|
||
})
|
||
// Give the process time to spawn and start running.
|
||
await new Promise(resolve => setTimeout(resolve, 200))
|
||
await fiber.dispose()
|
||
const result = await pending
|
||
expect(['abort', 'worker-exit']).toContain(result.error?.kind)
|
||
}, 5000)
|
||
|
||
it('reports a spawn failure via a bogus python binary as worker-exit', async () => {
|
||
const { runtime } = await setup({ pythonBin: '/nonexistent/python-binary', maxWallMs: 3000 })
|
||
const result = await runtime.run({
|
||
program: 'return 1',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
}, 8000)
|
||
|
||
it('applies the strictest of the configured and inherited resource limits', async () => {
|
||
// This case used to drive the bootstrap's `applying resource limits failed`
|
||
// handler with `cpuSeconds: 2 ** 63`, asserting that a cap the child cannot
|
||
// apply fails the run rather than running it uncapped. That premise no longer
|
||
// holds, for two independent reasons, so the test now pins what is actually
|
||
// guaranteed instead of a path no admissible input reaches.
|
||
//
|
||
// First, `2 ** 63` is not a safe integer, so it is now rejected at LOAD as a
|
||
// configuration error — it can never reach the child at all. Second, even the
|
||
// largest admissible values are applied successfully, because `_clamped`
|
||
// bounds every requested pair by the inherited hard limit: an unprivileged
|
||
// process may lower a hard limit but never raise one, so the child keeps the
|
||
// stricter of the two rather than asking for something `setrlimit` refuses.
|
||
// The failure handler remains as a substrate guard (a platform whose kernel
|
||
// refuses the call for its own reasons), but it is no longer reachable from
|
||
// configuration, and a test that pretends otherwise documents a contract the
|
||
// code does not have.
|
||
//
|
||
// What is observable: a very large cap still yields a working run, and the
|
||
// containment it promises is met by the inherited ceiling.
|
||
const { runtime } = await setup({ cpuSeconds: Number.MAX_SAFE_INTEGER - 1, maxWallMs: 10_000 })
|
||
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(1)
|
||
}, 20_000)
|
||
|
||
it('settles as worker-exit when the child exits before sending done (no hang)', async () => {
|
||
// Regression: settlement must key off `close` (process reaped AND stdio
|
||
// drained), not `exit`. With `exit`, finish() re-armed a second exit
|
||
// listener that never fired — run() hung forever whenever the exit event
|
||
// beat the final fd-3 data (deterministic on macOS, a lost race elsewhere).
|
||
const { runtime } = await setup({ maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: 'import os\nos._exit(7)',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain('code=7')
|
||
}, 5000)
|
||
|
||
it('classifies RLIMIT_CPU soft-limit expiry (SIGXCPU) as a timeout', async () => {
|
||
// A CPU hot loop burns the soft limit; the kernel delivers SIGXCPU, whose
|
||
// close signal the host maps to `timeout`. macOS re-delivers SIGXCPU
|
||
// differently, so we assert only kind/message here — CI's darwin leg
|
||
// validates real delivery. cpuSeconds must be an integer for setrlimit.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: 'while True: pass',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('timeout')
|
||
expect(result.error?.message).toContain('CPU time exhausted')
|
||
}, 8000)
|
||
|
||
it('keeps an early self-inflicted SIGKILL a worker-exit, not a CPU timeout', async () => {
|
||
// The unsolicited-SIGKILL-as-timeout classification applies only when the
|
||
// CPU budget could have expired (wall time >= cpuSeconds). A SIGKILL
|
||
// seconds before that (cgroup OOM, an operator, os.kill) is substrate
|
||
// death and stays worker-exit per the orthogonal taxonomy.
|
||
const { runtime } = await setup({ cpuSeconds: 60, maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, signal',
|
||
'os.kill(os.getpid(), signal.SIGKILL)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain('SIGKILL')
|
||
})
|
||
|
||
it('charges a forked descendant against the run CPU budget', async () => {
|
||
// RLIMIT_CPU is per-process and every child inherits a FRESH budget, so a
|
||
// program that shells out multiplies `cpuSeconds` by the number of
|
||
// descendants it starts. Measured before the aggregate meter existed: with
|
||
// cpuSeconds 1, two sequential busy children burned 2.0 CPU-seconds
|
||
// (RUSAGE_CHILDREN) and the run still returned a SUCCESS completion. The
|
||
// settle-time check meters RUSAGE_SELF + RUSAGE_CHILDREN and converts the
|
||
// overrun into the same SIGXCPU the untrapped soft limit sends.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 30_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import subprocess, sys',
|
||
'for _ in range(2):',
|
||
' subprocess.run([sys.executable, "-c", "import time\\nt=time.time()\\nwhile time.time()-t<1.2: pass"])',
|
||
'return "escaped the cpu budget"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
// Darwin's SIGXCPU re-delivery differs, so accept either terminal
|
||
// classification; what must NOT happen is the completion crossing.
|
||
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
||
expect(result.value).toBeUndefined()
|
||
}, 40_000)
|
||
|
||
it('does not charge wall time or a cheap descendant against the CPU budget', async () => {
|
||
// The meter is CPU, not wall clock, and it must not fire on a child that
|
||
// burns almost nothing: a sleeping program and a trivial subprocess both
|
||
// have to complete normally, or the check would reject every program that
|
||
// shells out.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 30_000 })
|
||
const slept = await runtime.run({
|
||
program: 'import time\ntime.sleep(1.5)\nreturn "slept"',
|
||
bindings: [],
|
||
})
|
||
expect(slept.error).toBeUndefined()
|
||
expect(slept.value).toBe('slept')
|
||
const cheap = await runtime.run({
|
||
program: [
|
||
'import subprocess, sys',
|
||
'subprocess.run([sys.executable, "-c", "pass"])',
|
||
'return "cheap child"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(cheap.error).toBeUndefined()
|
||
expect(cheap.value).toBe('cheap child')
|
||
}, 40_000)
|
||
|
||
it('spends no part of addressSpaceMb on bootstrap machinery', async () => {
|
||
// RLIMIT_AS counts RESERVED address space, so anything the bootstrap maps
|
||
// for its own accounting is subtracted from the program's `addressSpaceMb`.
|
||
// A sampling thread for the descendant-CPU meter cost 72 MiB here (an 8 MiB
|
||
// stack plus a 64 MiB glibc per-thread malloc arena reservation) and turned
|
||
// the 2-million-entry dict rejection below into a MemoryError under a
|
||
// 256 MiB cap on a slower runner. Assert the child's own mappings directly
|
||
// rather than inferring the budget from a near-cap allocation, so the bound
|
||
// is read from /proc instead of from how much headroom one machine happens
|
||
// to have; 48 MiB is well above the ~30 MiB a bare interpreter maps and
|
||
// well below the 102 MiB the thread produced. `addressSpaceMb` itself is
|
||
// skipped on darwin (the dyld shared cache makes any practical cap
|
||
// unsettable) and /proc/self/maps does not exist there, so the mapping
|
||
// assertion is Linux-only; the completion path is checked everywhere.
|
||
const { runtime } = await setup({ maxValueBytes: 4096, addressSpaceMb: 256 })
|
||
const mapped = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'if sys.platform != "linux":',
|
||
' return 0',
|
||
'total = 0',
|
||
'with open("/proc/self/maps") as handle:',
|
||
' for line in handle:',
|
||
' low, high = (int(part, 16) for part in line.split(" ", 1)[0].split("-"))',
|
||
' total += high - low',
|
||
'return total // (1024 * 1024)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(mapped.error).toBeUndefined()
|
||
expect(mapped.value).toBeLessThan(48)
|
||
}, 20_000)
|
||
|
||
it('spends no part of addressSpaceMb on the reply pump, across a binding await', async () => {
|
||
// The test above measures BEFORE the program yields, so it could not see the
|
||
// reply pump's cost: `loop.run_in_executor(None, read_frame)` created the
|
||
// default executor's first thread on the first `await tools.*`, and that
|
||
// thread's 8 MiB stack plus a 64 MiB glibc per-thread malloc arena are
|
||
// charged to RLIMIT_AS while the limit is already in force — measured, the
|
||
// child went from 30.34 MiB to 102.39 MiB across one binding call. Under a
|
||
// small `addressSpaceMb` the thread cannot start and a legitimate call hangs
|
||
// to `maxWallMs`; under a larger one an allocation that should have fit dies
|
||
// as MemoryError. `loop.add_reader` watches the fd with no thread at all.
|
||
//
|
||
// Measuring both sides inside one run is what discriminates: a single
|
||
// after-the-fact number cannot separate the pump's cost from the
|
||
// interpreter's own footprint. Linux-only for the same reason as above.
|
||
const { runtime } = await setup({ addressSpaceMb: 256, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'def mapped():',
|
||
' if sys.platform != "linux":',
|
||
' return 0',
|
||
' total = 0',
|
||
' with open("/proc/self/maps") as handle:',
|
||
' for line in handle:',
|
||
' low, high = (int(part, 16) for part in line.split(" ", 1)[0].split("-"))',
|
||
' total += high - low',
|
||
' return total // (1024 * 1024)',
|
||
'before = mapped()',
|
||
'echoed = await tools.echo({"ping": True})',
|
||
'return {"before": before, "after": mapped(), "echoed": echoed}',
|
||
].join('\n'),
|
||
bindings: tools({ echo: async args => args as CodeJsonValue }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
const value = result.value as { before: number; after: number; echoed: unknown }
|
||
// The binding call really happened, so the pump really ran.
|
||
expect(value.echoed).toEqual({ ping: true })
|
||
// Awaiting a binding maps nothing extra. The 8 MiB allowance absorbs ordinary
|
||
// heap growth while staying far below the 72 MiB a pump thread cost.
|
||
expect(value.after - value.before).toBeLessThan(8)
|
||
}, 30_000)
|
||
|
||
it('still terminates a program that ignores SIGXCPU (hard-limit backstop)', async () => {
|
||
// A hot loop under SIG_IGN burns through the soft limit; the kernel's
|
||
// hard limit (cpuSeconds + 1) SIGKILLs it. Only a kernel-authoritative
|
||
// SIGXCPU close classifies as the CPU timeout — a bare SIGKILL is
|
||
// indistinguishable from a cgroup OOM kill, so it reports worker-exit
|
||
// (Darwin re-delivers SIGXCPU instead, where the wall clock settles it
|
||
// as timeout). Either way the run TERMINATES within the budget — the
|
||
// backstop holds even when the classification is the opaque one.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 6_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal',
|
||
'signal.signal(signal.SIGXCPU, signal.SIG_IGN)',
|
||
'while True: pass',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
||
}, 12_000)
|
||
|
||
it('enforces the CPU budget even when the program monkeypatches the enforcement primitives', async () => {
|
||
// The check uses import-time-captured references, so replacing
|
||
// resource.getrusage / signal.signal / os.kill on the modules cannot
|
||
// defang it: a trapping program that also swaps the callables and burns
|
||
// past the budget still dies by the authoritative SIGXCPU.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal, os, resource, time',
|
||
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
||
'resource.getrusage = lambda *a: (_ for _ in ()).throw(RuntimeError("nope"))',
|
||
'os.kill = lambda *a: None',
|
||
'signal.signal = lambda *a: None',
|
||
'deadline = time.process_time() + 1.05',
|
||
'while time.process_time() < deadline: pass',
|
||
'return "escaped"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('timeout')
|
||
expect(result.value).toBeUndefined()
|
||
}, 15_000)
|
||
|
||
it('re-delivers SIGXCPU when a trapping program returns inside the soft-to-hard gap', async () => {
|
||
// A program can trap SIGXCPU and settle during the one-second gap; the
|
||
// bootstrap re-checks the kernel CPU meter (getrusage) after settlement
|
||
// and dies by SIGXCPU with the default disposition restored, so the host
|
||
// still classifies the exhausted budget as a timeout instead of success.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal, time',
|
||
'fired = []',
|
||
'signal.signal(signal.SIGXCPU, lambda *a: fired.append(1))',
|
||
'deadline = time.process_time() + 1.05',
|
||
'while time.process_time() < deadline: pass',
|
||
'return "escaped"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('timeout')
|
||
expect(result.error?.message).toContain('CPU time exhausted')
|
||
expect(result.value).toBeUndefined()
|
||
}, 15_000)
|
||
|
||
it('enforces the CPU budget when the program rebinds the enforcer on __main__', async () => {
|
||
// The bootstrap IS `__main__`, so `import __main__` reaches its globals.
|
||
// The enforcement callable holds its primitives in closure cells (not
|
||
// module attributes) and `_run` reads the callable into a frame local
|
||
// before the program starts, so neither replacing the global nor swapping
|
||
// the module's captured names changes what runs after settlement.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal, time, __main__',
|
||
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
||
'__main__._DIE_IF_CPU_EXHAUSTED = lambda *_: None',
|
||
'deadline = time.process_time() + 1.05',
|
||
'while time.process_time() < deadline: pass',
|
||
'return "escaped"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('timeout')
|
||
expect(result.value).toBeUndefined()
|
||
}, 15_000)
|
||
|
||
it('bounds a program that defeats the post-check by writing its closure cell', async () => {
|
||
// The closure-cell capture raises the cost of defeating the post-check; it
|
||
// does NOT make it unreachable, and nothing in-process could: a cell is
|
||
// writable through `fn.__closure__[i].cell_contents`, and `sys._getframe`
|
||
// reads _run's frame locals. This program does exactly that — walks to
|
||
// _run's frame, takes the enforcement callable, and replaces its captured
|
||
// `getrusage` with one reporting zero CPU used — then burns past cpuSeconds
|
||
// with SIGXCPU trapped. The run must still fail, because the bound that
|
||
// model code cannot forge is outside the interpreter: the RLIMIT_CPU HARD
|
||
// limit at cpuSeconds + 1, whose SIGKILL admits no handler. No success is
|
||
// reportable either way.
|
||
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 20_000 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal, sys, time',
|
||
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
||
// Walk out of __dsh_main__ to _run's frame and take its local.
|
||
'die = None',
|
||
'depth = 1',
|
||
'while depth < 12:',
|
||
' frame = sys._getframe(depth)',
|
||
' if "die_if_cpu_exhausted" in frame.f_locals:',
|
||
' die = frame.f_locals["die_if_cpu_exhausted"]',
|
||
' break',
|
||
' depth += 1',
|
||
'assert die is not None, "enforcer not reachable from the frame chain"',
|
||
'class Zero:',
|
||
' ru_utime = 0.0',
|
||
' ru_stime = 0.0',
|
||
'names = die.__code__.co_freevars',
|
||
'die.__closure__[names.index("getrusage")].cell_contents = lambda *a: Zero()',
|
||
// Burn well past the soft limit into the hard limit's SIGKILL.
|
||
'while True: pass',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
// What holds on EVERY platform: the tampering bought no success. The run
|
||
// failed, carried no value, and the reported kind is one of the two
|
||
// kernel-level outcomes — never a completion.
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind === 'worker-exit' || result.error?.kind === 'timeout').toBe(true)
|
||
if (process.platform === 'linux') {
|
||
// Linux enforces the RLIMIT_CPU HARD limit at cpuSeconds + 1 promptly, so
|
||
// the CPU bound — not the 20 s wall ceiling — is what stops the program.
|
||
// Its SIGKILL is not SIGXCPU, so the orthogonal-failure taxonomy reports
|
||
// `worker-exit`: a bare SIGKILL is not evidence of CPU burn.
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(Date.now() - start).toBeLessThan(15_000)
|
||
} else {
|
||
// Darwin does not deliver the hard limit's SIGKILL on the same schedule;
|
||
// observed on the macOS lane, a program that patches the post-check runs
|
||
// to the WALL ceiling instead. The CPU budget is therefore not the
|
||
// binding constraint against a tampering program there — the wall clock
|
||
// is. Asserted rather than skipped so the difference stays visible.
|
||
expect(result.error?.kind).toBe('timeout')
|
||
}
|
||
}, 30_000)
|
||
|
||
it('keeps a finished-but-not-closed run live so dispose awaits the child\'s death', async () => {
|
||
// finish() no longer drops the run from `live`; settle() (at close) does.
|
||
// A SIGTERM-trapping program with a small graceMs sits in the grace window
|
||
// after finish() fires — dispose() must not resolve until the SIGKILL
|
||
// backstop actually reaps the child. The program prints its pid (captured
|
||
// as a log even on abort); once dispose() resolves, that pid must be dead
|
||
// (process.kill(pid, 0) throws ESRCH).
|
||
const { fiber, runtime } = await setup({ maxWallMs: 10_000, graceMs: 400 })
|
||
// Deterministic readiness: the program reports its pid through a binding
|
||
// AFTER installing the trap, so dispose cannot race the spawn (a fixed
|
||
// sleep lost that race on slow CI runners — SIGTERM landed pre-trap).
|
||
let reportedPid!: (pid: number) => void
|
||
const trapReady = new Promise<number>((resolve) => { reportedPid = resolve })
|
||
const pending = runtime.run({
|
||
program: [
|
||
'import signal, time, os',
|
||
'signal.signal(signal.SIGTERM, lambda *a: None)',
|
||
'await tools.ready({"pid": os.getpid()})',
|
||
'while True: time.sleep(0.05)',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
ready: async (args) => {
|
||
reportedPid((args as { pid: number }).pid)
|
||
return 'ok'
|
||
},
|
||
}),
|
||
})
|
||
const pid = await trapReady
|
||
const start = Date.now()
|
||
await fiber.dispose()
|
||
const elapsed = Date.now() - start
|
||
const result = await pending
|
||
expect(['abort', 'worker-exit', 'timeout']).toContain(result.error?.kind)
|
||
// dispose() returned only after the grace window elapsed (the SIGTERM trap
|
||
// forces the SIGKILL backstop path), proving the run stayed live past finish().
|
||
expect(elapsed).toBeGreaterThanOrEqual(300)
|
||
expect(Number.isInteger(pid) && pid > 0).toBe(true)
|
||
// The child is fully reaped by the time dispose() resolved.
|
||
expect(() => process.kill(pid, 0)).toThrow(/ESRCH/)
|
||
}, 8000)
|
||
|
||
it('settles on the decided result even when a setsid-escaped orphan holds stdio open past close', async () => {
|
||
// `close` only fires once every inherited stdio stream drains. A descendant
|
||
// started with start_new_session=True escapes the child's process group, so
|
||
// the SIGTERM/SIGKILL aimed at that group never reaches it; if it inherited
|
||
// our stdout/stderr/fd 3 and outlives the run, `close` would never fire and
|
||
// run() would hang forever. The close-deadline backstop (graceMs + margin)
|
||
// must force settlement on the value the `done` frame already decided.
|
||
const { runtime } = await setup({ graceMs: 100 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import subprocess, sys',
|
||
// Orphan in a fresh session, inheriting our stdout/stderr/fd 3, alive
|
||
// past the close-deadline so `close` cannot fire on its own. Its own
|
||
// 5 s self-exit is the leak ceiling AND the discriminator: it must stay
|
||
// ABOVE the < 4000 ms upper-bound assertion below, so if the deadline
|
||
// backstop failed to settle, settlement could only come from this
|
||
// self-exit at ~5 s and blow the bound — a sharper signal than the wall
|
||
// ceiling would give.
|
||
'subprocess.Popen([sys.executable, "-c", "import time; time.sleep(5)"],',
|
||
' start_new_session=True)',
|
||
'return "escaped"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
const elapsed = Date.now() - start
|
||
// The done frame decided the value; the deadline settled it despite the
|
||
// orphan pinning the pipes open.
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('escaped')
|
||
// Settlement waited for the backstop (graceMs + CLOSE_REAP_MARGIN_MS ≈ 2.1s),
|
||
// not the orphan's 5 s self-exit — proving the deadline, not a fallback, fired.
|
||
expect(elapsed).toBeGreaterThanOrEqual(1_500)
|
||
expect(elapsed).toBeLessThan(4_000)
|
||
}, 8000)
|
||
|
||
it('flushes a newline-free diagnostic when the closeDeadline forces settlement', async () => {
|
||
// A leader that writes an unterminated diagnostic via `os.write(1, ...)` and
|
||
// then exits, leaving a setsid orphan holding the pipes open, settles through
|
||
// the closeDeadline destroy() path — which fires no `end`. The residual must
|
||
// be flushed before destroy() drops it, or the diagnostic is lost from
|
||
// `logs`. The value is decided by the done frame; the diagnostic must survive.
|
||
const { runtime } = await setup({ graceMs: 100 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, subprocess, sys',
|
||
'os.write(1, b"leader-diagnostic-no-newline")',
|
||
'subprocess.Popen([sys.executable, "-c", "import time; time.sleep(5)"],',
|
||
' start_new_session=True)',
|
||
'return "escaped"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('escaped')
|
||
expect(result.logs).toContain('leader-diagnostic-no-newline')
|
||
}, 8000)
|
||
|
||
it('reaps a same-group child that ignores SIGTERM and releases the pipes before close', async () => {
|
||
// The same-group counterpart to the setsid-orphan case above. A descendant
|
||
// left in the child's OWN process group (no setsid, so `kill(-pid)` reaches
|
||
// it) can ignore SIGTERM yet still release the inherited stdout/stderr/fd 3
|
||
// it does not hold — here by giving the Popen child DEVNULL streams and
|
||
// letting close_fds drop fd 3. The leader then writes `done` and exits, its
|
||
// `close` fires because the pipes drained, and settle() runs while that
|
||
// descendant is still alive. settle() then keeps a REF'd poll alive until the
|
||
// grace-window SIGKILL has emptied the whole process group, so the host cannot
|
||
// exit and reparent the survivor to init: no subprocess outlives the fiber.
|
||
//
|
||
// The descendant must have SIG_IGN installed BEFORE the host sends SIGTERM,
|
||
// or it dies from the default SIGTERM whether the fix is present or not — so
|
||
// it writes a readiness marker after trapping and the leader waits for that
|
||
// marker before returning. While alive it bumps a heartbeat file every 50 ms;
|
||
// the test asserts the heartbeat STOPS, which is what "no longer executing"
|
||
// means whether the killed descendant is reaped or lingers as a zombie (a
|
||
// SIGKILL'd process runs no more code either way). It sleeps 30 s as a safety
|
||
// net so a broken fix cannot leak it forever.
|
||
const handoff = await mkdtemp(join(tmpdir(), 'dsh-samegroup-'))
|
||
const readyMarker = join(handoff, 'ready')
|
||
const heartbeat = join(handoff, 'heartbeat')
|
||
const { runtime } = await setup({ maxWallMs: 10_000, graceMs: 300 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import subprocess, sys, os, time',
|
||
`marker = ${JSON.stringify(readyMarker)}`,
|
||
`heartbeat = ${JSON.stringify(heartbeat)}`,
|
||
// Same group (no start_new_session); ignores SIGTERM; holds none of the
|
||
// leader's pipes (DEVNULL std streams, close_fds drops fd 3). It writes
|
||
// the marker (argv[1]) only AFTER the trap is installed — so the leader
|
||
// cannot return, and the host cannot send SIGTERM, before it is ignored —
|
||
// then rewrites the heartbeat (argv[2]) every 50 ms for up to 30 s.
|
||
'code = ("import signal, sys, time\\n"',
|
||
' "signal.signal(signal.SIGTERM, signal.SIG_IGN)\\n"',
|
||
' "open(sys.argv[1], \'w\').close()\\n"',
|
||
' "end = time.time() + 30\\n"',
|
||
' "while time.time() < end:\\n"',
|
||
' " open(sys.argv[2], \'w\').close()\\n"',
|
||
' " time.sleep(0.05)\\n")',
|
||
'child = subprocess.Popen([sys.executable, "-c", code, marker, heartbeat],',
|
||
' stdin=subprocess.DEVNULL,',
|
||
' stdout=subprocess.DEVNULL,',
|
||
' stderr=subprocess.DEVNULL)',
|
||
'deadline = time.time() + 5',
|
||
'while not os.path.exists(marker) and time.time() < deadline:',
|
||
' time.sleep(0.02)',
|
||
'return "spawned"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('spawned')
|
||
// The trap really installed before the leader returned, so this is the
|
||
// SIGTERM-ignoring descendant, not one that would have died to the default.
|
||
expect(existsSync(readyMarker)).toBe(true)
|
||
// The grace-window SIGKILL (graceMs 300 + reap margin) empties the group. Once
|
||
// it has, the descendant stops bumping the heartbeat. Poll the heartbeat's
|
||
// mtime: two consecutive reads far enough apart with no change means it is no
|
||
// longer executing — true whether it was reaped or lingers as a zombie, so
|
||
// the assertion holds in a container whose init does not wait() orphans. The
|
||
// window (well under the 30 s self-timeout) proves the SIGKILL did the work.
|
||
const mtime = (): number => { try { return statSync(heartbeat).mtimeMs } catch { return 0 } }
|
||
const stopDeadline = Date.now() + 8_000
|
||
let last = mtime()
|
||
let still = false
|
||
while (Date.now() < stopDeadline) {
|
||
await new Promise(resolve => setTimeout(resolve, 400))
|
||
const now = mtime()
|
||
if (now === last && now !== 0) { still = true; break }
|
||
last = now
|
||
}
|
||
expect(still).toBe(true)
|
||
}, 20_000)
|
||
|
||
it('dispose awaits reaping of a same-group survivor from a completed run', async () => {
|
||
// The quiescence contract also holds for a run that ALREADY resolved: the run
|
||
// stays tracked in `live` until its process group is reaped, so a `dispose()`
|
||
// that races a just-returned run() still awaits the survivor rather than
|
||
// snapshotting an empty `live` and returning while it lives. Here the run
|
||
// completes (leaving a SIGTERM-ignoring same-group descendant), then dispose()
|
||
// is called; the heartbeat must be stale BY THE TIME dispose() resolves —
|
||
// proving teardown waited for the reap, not merely that the reap eventually
|
||
// happened.
|
||
const handoff = await mkdtemp(join(tmpdir(), 'dsh-dispose-quiesce-'))
|
||
const readyMarker = join(handoff, 'ready')
|
||
const heartbeat = join(handoff, 'heartbeat')
|
||
const { runtime, fiber } = await setup({ maxWallMs: 10_000, graceMs: 300 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import subprocess, sys, os, time',
|
||
`marker = ${JSON.stringify(readyMarker)}`,
|
||
`heartbeat = ${JSON.stringify(heartbeat)}`,
|
||
'code = ("import signal, sys, time\\n"',
|
||
' "signal.signal(signal.SIGTERM, signal.SIG_IGN)\\n"',
|
||
' "open(sys.argv[1], \'w\').close()\\n"',
|
||
' "end = time.time() + 30\\n"',
|
||
' "while time.time() < end:\\n"',
|
||
' " open(sys.argv[2], \'w\').close()\\n"',
|
||
' " time.sleep(0.05)\\n")',
|
||
'child = subprocess.Popen([sys.executable, "-c", code, marker, heartbeat],',
|
||
' stdin=subprocess.DEVNULL,',
|
||
' stdout=subprocess.DEVNULL,',
|
||
' stderr=subprocess.DEVNULL)',
|
||
'deadline = time.time() + 5',
|
||
'while not os.path.exists(marker) and time.time() < deadline:',
|
||
' time.sleep(0.02)',
|
||
'return "spawned"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(existsSync(readyMarker)).toBe(true)
|
||
// dispose() must not return until the group is reaped. After it resolves, the
|
||
// heartbeat must already be stale: read its mtime, wait past the heartbeat
|
||
// interval, and confirm it did not advance — the descendant is no longer
|
||
// executing (reaped or zombie), so teardown was genuinely quiescent.
|
||
await fiber.dispose()
|
||
const mtime = (): number => { try { return statSync(heartbeat).mtimeMs } catch { return 0 } }
|
||
const afterDispose = mtime()
|
||
// Pin the assertion to a heartbeat that actually ran: mtime() returns 0 when
|
||
// the file never existed, so without this the `toBe` below would pass
|
||
// vacuously (0 === 0) if the survivor never wrote a heartbeat at all.
|
||
expect(afterDispose).toBeGreaterThan(0)
|
||
await new Promise(resolve => setTimeout(resolve, 500))
|
||
expect(mtime()).toBe(afterDispose)
|
||
}, 20_000)
|
||
|
||
it('sends SIGKILL at the poll deadline when the event loop was blocked past both timers', async () => {
|
||
// If the host event loop is blocked (a big synchronous computation) from
|
||
// before the group-reap poll was scheduled until after the deadline, both the
|
||
// poll timer and the grace-window SIGKILL timer are overdue when the loop
|
||
// resumes. Node runs the earlier-scheduled poll first, so the SIGKILL timer
|
||
// may not have fired yet. The deadline arm must then send SIGKILL ITSELF
|
||
// rather than cancel the unfired escalation — otherwise a SIGTERM-ignoring
|
||
// same-group survivor is released for good. A synchronous busy-loop after
|
||
// run() resolves reproduces the block deterministically.
|
||
const handoff = await mkdtemp(join(tmpdir(), 'dsh-deadline-'))
|
||
const readyMarker = join(handoff, 'ready')
|
||
const heartbeat = join(handoff, 'heartbeat')
|
||
const graceMs = 300
|
||
const { runtime } = await setup({ maxWallMs: 10_000, graceMs })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import subprocess, sys, os, time',
|
||
`marker = ${JSON.stringify(readyMarker)}`,
|
||
`heartbeat = ${JSON.stringify(heartbeat)}`,
|
||
'code = ("import signal, sys, time\\n"',
|
||
' "signal.signal(signal.SIGTERM, signal.SIG_IGN)\\n"',
|
||
' "open(sys.argv[1], \'w\').close()\\n"',
|
||
' "end = time.time() + 30\\n"',
|
||
' "while time.time() < end:\\n"',
|
||
' " open(sys.argv[2], \'w\').close()\\n"',
|
||
' " time.sleep(0.05)\\n")',
|
||
'child = subprocess.Popen([sys.executable, "-c", code, marker, heartbeat],',
|
||
' stdin=subprocess.DEVNULL,',
|
||
' stdout=subprocess.DEVNULL,',
|
||
' stderr=subprocess.DEVNULL)',
|
||
'deadline = time.time() + 5',
|
||
'while not os.path.exists(marker) and time.time() < deadline:',
|
||
' time.sleep(0.02)',
|
||
'return "spawned"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(existsSync(readyMarker)).toBe(true)
|
||
// Block the event loop synchronously past graceMs + CLOSE_REAP_MARGIN_MS
|
||
// (2000) with margin, so both timers are overdue when the loop resumes.
|
||
const blockUntil = Date.now() + graceMs + 2_000 + 800
|
||
while (Date.now() < blockUntil) { /* busy-wait, no yield */ }
|
||
// Yield: the overdue poll runs (group still non-empty, deadline passed) and
|
||
// must send SIGKILL itself. The survivor then stops bumping the heartbeat.
|
||
const mtime = (): number => { try { return statSync(heartbeat).mtimeMs } catch { return 0 } }
|
||
const stopDeadline = Date.now() + 5_000
|
||
let last = mtime()
|
||
let stopped = false
|
||
while (Date.now() < stopDeadline) {
|
||
await new Promise(resolve => setTimeout(resolve, 400))
|
||
const now = mtime()
|
||
if (now === last && now !== 0) { stopped = true; break }
|
||
last = now
|
||
}
|
||
expect(stopped).toBe(true)
|
||
}, 20_000)
|
||
})
|
||
|
||
describe('PythonCodeRuntime — hostile peer', () => {
|
||
it('drops garbage bytes and unknown-shape frames posted directly to fd 3', async () => {
|
||
// The model program can reach fd 3 and write anything. We inject a
|
||
// non-JSON line, a valid JSON but unknown-shape frame, and a broken done
|
||
// frame; the host must not crash, and the real `done` still settles the run.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'os.write(3, b"not-json\\n")',
|
||
'os.write(3, b\'{"type":"unknown"}\\n\')',
|
||
'os.write(3, b\'{"type":"done","error":{"message":42}}\\n\')',
|
||
'return "survived"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('survived')
|
||
})
|
||
|
||
it('answers a forged call frame for an unknown binding and never crashes', async () => {
|
||
// The unknown-binding reply path, driven through the id the host expects:
|
||
// the program lets its own first call claim id 0 and forges id 1, which the
|
||
// host answers with the `unknown binding` rejection the honest call would
|
||
// have received. A forged id out of sequence is dropped instead — that is
|
||
// the id-bound test below, not this one.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
let seenLegitCall = false
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'x = await tools.echo({"ping": True})',
|
||
'os.write(3, json.dumps({"type":"call","id":1,"global":"tools","name":"forged","args":{}}).encode() + b"\\n")',
|
||
// The forged frame is answered, but nothing in the child awaits id 1, so
|
||
// the reply is ignored and the run completes on its own value.
|
||
'return x',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
echo: async (args) => { seenLegitCall = true; return args as CodeJsonValue },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual({ ping: true })
|
||
expect(seenLegitCall).toBe(true)
|
||
}, 15_000)
|
||
|
||
it('drops forged call frames whose ids are not the next in sequence, retaining no per-id state', async () => {
|
||
// The host used to remember every answered id in a Set, so a program could
|
||
// write an unbounded run of unique forged ids — each frame far below the
|
||
// 256 MiB ceiling, so nothing rejected them — and grow host memory for the
|
||
// whole run. Ids are consecutive from 0, so one counter replaces the set.
|
||
//
|
||
// The discriminator is that the forgeries must not be answered. Each names a
|
||
// binding that does exist, so a host answering them would run `echo` once
|
||
// per forgery; the count proves only the legitimate call was dispatched.
|
||
// Ids also run DESCENDING, so a high-water-mark test would drop the honest
|
||
// call that follows rather than the forgeries.
|
||
const { runtime } = await setup()
|
||
let echoCalls = 0
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'for i in range(2000, 0, -1):',
|
||
' os.write(3, json.dumps({"type":"call","id":i,"global":"tools","name":"echo","args":{"forged":i}}).encode() + b"\\n")',
|
||
'x = await tools.echo({"ping": True})',
|
||
'return x',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
echo: async (args) => { echoCalls += 1; return args as CodeJsonValue },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual({ ping: true })
|
||
expect(echoCalls).toBe(1)
|
||
}, 15_000)
|
||
|
||
it('keeps answering calls a program makes after one with unserializable arguments', async () => {
|
||
// The child claims an id only once its write succeeds, so a call rejected
|
||
// child-side for non-lossless arguments leaves no gap. Were a gap possible,
|
||
// the host's exact-successor test would drop every later call and the run
|
||
// would hang to the wall ceiling instead of completing.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
const seen: unknown[] = []
|
||
const result = await runtime.run({
|
||
program: [
|
||
'caught = ""',
|
||
'try:',
|
||
' await tools.echo({"bad": float("inf")})',
|
||
'except RuntimeError as e:',
|
||
' caught = str(e)',
|
||
'after = await tools.echo({"ok": True})',
|
||
'return {"caught": caught, "after": after}',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
echo: async (args) => { seen.push(args); return args as CodeJsonValue },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
const value = result.value as { caught: string; after: unknown }
|
||
expect(value.caught).toContain('lossless JSON')
|
||
expect(value.after).toEqual({ ok: true })
|
||
// The rejected call never reached the host; the one after it did.
|
||
expect(seen).toEqual([{ ok: true }])
|
||
}, 15_000)
|
||
|
||
it('drops a forged frame carrying an integer outside JavaScript safe range', async () => {
|
||
// JSON.parse would silently round 9007199254740993 to ...992 BEFORE any
|
||
// validation, corrupting a dispatched argument or completion. The host
|
||
// scans the raw line and drops such frames as hostile traffic; the honest
|
||
// child cannot produce one (its validator rejects unsafe ints).
|
||
const { runtime } = await setup()
|
||
let dispatched: unknown
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
// Forged call frame with an unsafe int argument, then a forged done
|
||
// frame with an unsafe int value — both must be dropped whole.
|
||
'os.write(3, b\'{"type":"call","id":7,"global":"tools","name":"echo","args":9007199254740993}\\n\')',
|
||
'os.write(3, b\'{"type":"done","value":9007199254740993}\\n\')',
|
||
'x = await tools.echo({"ok": True})',
|
||
'return x',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
echo: async (args) => { dispatched = args; return args as CodeJsonValue },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// The forged done did not settle the run; the legit call and completion did.
|
||
expect(result.value).toEqual({ ok: true })
|
||
expect(dispatched).toEqual({ ok: true })
|
||
})
|
||
|
||
it('truncates host-side logs once the budget is exhausted and emits the marker', async () => {
|
||
// Set a tiny host-side budget; the Python side has a much larger one, so
|
||
// its LogBuffer will not truncate — the host ledger fires first.
|
||
const { runtime } = await setup({ maxLogBytes: 32 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'for _ in range(50):',
|
||
' print("aaaaaaaaaa")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
const markers = result.logs.filter(line => line.includes('log capture truncated at 32 bytes'))
|
||
expect(markers.length).toBeGreaterThanOrEqual(1)
|
||
})
|
||
|
||
it('reports an exception whose message holds an unpaired surrogate instead of stranding to the wall clock', async () => {
|
||
// A strict UTF-8 encode of "\ud800" throws while BUILDING the failure
|
||
// frame; the run would then hang to maxWallMs and misreport as timeout.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
const result = await runtime.run({
|
||
program: String.raw`raise Exception("bad \ud800 surrogate")`,
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('bad')
|
||
expect(result.error?.message).toContain('surrogate')
|
||
})
|
||
|
||
it('carries a lone-surrogate completion string across the wire as its JSON escape', async () => {
|
||
// UTF-8 has no encoding for a lone surrogate, but JSON does: the ASCII
|
||
// `\ud800` escape, which JSON.parse reads back as the same UTF-16 code
|
||
// unit. `CodeJsonValue`, `snapshotJsonValue`, and the worker backend all
|
||
// accept such a string, so this backend must not narrow the shared seam.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: String.raw`return {"lone": "a\ud800b", "spelled": "😀"}`,
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// The lone half survives as the code unit itself; a spelled-out high-low
|
||
// PAIR folds into the astral character the host would hold for it.
|
||
expect(result.value).toEqual({ lone: 'a\ud800b', spelled: '\u{1f600}' })
|
||
})
|
||
|
||
it('meters a lone surrogate at its six escaped bytes, matching the host', async () => {
|
||
// The child and the host share maxValueBytes, so the child must charge the
|
||
// escape's six ASCII bytes (plus two quotes): eight fits, nine does not.
|
||
const { runtime } = await setup({ maxValueBytes: 8 })
|
||
const ok = await runtime.run({ program: String.raw`return "\ud800"`, bindings: [] })
|
||
expect(ok.error).toBeUndefined()
|
||
expect(ok.value).toBe('\ud800')
|
||
const over = await setup({ maxValueBytes: 7 })
|
||
const result = await over.runtime.run({ program: String.raw`return "\ud800"`, bindings: [] })
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
})
|
||
|
||
it('passes a lone-surrogate binding argument through instead of failing the call', async () => {
|
||
// The argument validator shared the same over-narrow rejection; a host
|
||
// binding must receive the code unit the program passed.
|
||
const seen: unknown[] = []
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: String.raw`return await tools.echo({"text": "x\udfff"})`,
|
||
bindings: tools({ echo: async (args: unknown) => { seen.push(args); return args as CodeJsonValue } }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(seen).toEqual([{ text: 'x\udfff' }])
|
||
expect(result.value).toEqual({ text: 'x\udfff' })
|
||
})
|
||
|
||
it('meters a non-ASCII completion in UTF-8 JSON bytes, matching the host', async () => {
|
||
// json.dumps' default \uXXXX escaping would count "é" as 8 bytes while
|
||
// the host meter counts its UTF-8 JSON form (4); the shared budget must
|
||
// agree, so a 4-byte-fitting value passes a maxValueBytes of 4.
|
||
const { runtime } = await setup({ maxValueBytes: 4 })
|
||
const ok = await runtime.run({ program: 'return "é"', bindings: [] })
|
||
expect(ok.error).toBeUndefined()
|
||
expect(ok.value).toBe('é')
|
||
const over = await runtime.run({ program: 'return "éx"', bindings: [] })
|
||
expect(over.error?.kind).toBe('output-limit')
|
||
})
|
||
|
||
it('filters bootstrap frames from exception-group members (TaskGroup)', async () => {
|
||
// Python 3.11+ stores member stacks under TracebackException.exceptions;
|
||
// the <model>-frame filter must recurse into them too.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import asyncio, sys',
|
||
'if sys.version_info < (3, 11):',
|
||
' raise ValueError("skip-old <model>")',
|
||
'async def boom():',
|
||
' raise ValueError("group-member")',
|
||
'async with asyncio.TaskGroup() as tg:',
|
||
' tg.create_task(boom())',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('<model>')
|
||
expect(result.error?.message).not.toContain('bootstrap.py')
|
||
})
|
||
|
||
it('keeps frames intact when a model thread floods logs while a large frame drains', async () => {
|
||
// os.write releases the GIL and a frame beyond PIPE_BUF is not atomic:
|
||
// without the writer lock + full-write loop, the printing thread could
|
||
// interleave bytes mid-frame and the host would drop the malformed JSON,
|
||
// hanging the run to the wall clock (or losing the completion).
|
||
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxLogBytes: 4 * 1024 * 1024, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import threading',
|
||
'stop = False',
|
||
'def spam():',
|
||
' while not stop:',
|
||
' print("spam-line-" + "y" * 100)',
|
||
't = threading.Thread(target=spam)',
|
||
't.start()',
|
||
// A ~300 KiB completion — several PIPE_BUF units — while spam runs.
|
||
'big = "x" * (300 * 1024)',
|
||
'stop = True',
|
||
't.join()',
|
||
'return big',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('x'.repeat(300 * 1024))
|
||
}, 20_000)
|
||
|
||
it('settles cleanly while a daemon thread keeps writing unterminated log text', async () => {
|
||
// WARNING regression: the settlement `flush_out()/flush_err()` on the main
|
||
// coroutine read and clear `_LogStream._pending` and the shared LogBuffer
|
||
// ledger with NO lock, while a model daemon thread's `print`/`write` mutate
|
||
// the same state. Capturing the bound method (`out_stream.flush_line`) only
|
||
// fixes WHICH callable runs, not what it reads mid-flight: the flush could
|
||
// interleave with a concurrent write and join a `_pending` list being
|
||
// mutated under it, corrupting the ledger and costing the `done` frame — the
|
||
// run would then strand to the wall clock instead of completing. The shared
|
||
// re-entrant lock serializes them.
|
||
//
|
||
// A pure data race has no single bad input to reject deterministically, so
|
||
// this maximizes overlap: daemon threads emit UNTERMINATED writes (which
|
||
// pile into `_pending` rather than flushing per line) right up to the moment
|
||
// the body returns and settlement flushes. Repeated so the interleave lands.
|
||
for (let attempt = 0; attempt < 5; attempt++) {
|
||
const { runtime, fiber } = await setup({ maxLogBytes: 4 * 1024 * 1024, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys, threading',
|
||
'stop = False',
|
||
'def spam():',
|
||
' while not stop:',
|
||
// No newline: the text accumulates in the stream's `_pending`, which is
|
||
// exactly the state the settlement flush also touches.
|
||
' sys.stdout.write("tail-fragment-" + "z" * 64)',
|
||
'workers = [threading.Thread(target=spam, daemon=True) for _ in range(4)]',
|
||
'for t in workers: t.start()',
|
||
// Let the daemons build up pending writes, then return so settlement
|
||
// flushes while they are still mid-write.
|
||
'import time; time.sleep(0.05)',
|
||
'return "settled"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('settled')
|
||
await fiber.dispose()
|
||
}
|
||
}, 30_000)
|
||
|
||
it('completes a binding called from a worker thread on its own event loop', async () => {
|
||
// A binding reply Future is created on the loop that ran `dispatch`. When the
|
||
// model calls a binding from a worker THREAD via `asyncio.run(tools.x(...))`,
|
||
// that Future belongs to the thread's loop, not the main loop where
|
||
// `_pump_replies` reads the reply. `asyncio.Future` is not thread-safe:
|
||
// completing it from another thread does not wake its own loop, so a direct
|
||
// `set_result` would strand the awaiting thread and the run would degrade to a
|
||
// wall-clock timeout. The pump must schedule completion on the Future's own
|
||
// loop via `call_soon_threadsafe`. The tight maxWallMs makes the pre-fix
|
||
// failure a fast timeout rather than a hang.
|
||
//
|
||
// The main coroutine yields with `await asyncio.sleep` while the worker runs,
|
||
// rather than a synchronous `t.join()`: joining would block the main thread,
|
||
// so the main loop could not run `_pump_replies` and the call would deadlock
|
||
// regardless of the fix — that blocks the pump, not the cross-loop delivery
|
||
// this test pins.
|
||
const { runtime } = await setup({ maxWallMs: 8_000 })
|
||
const seen: unknown[] = []
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import asyncio, threading',
|
||
'result = {}',
|
||
'def worker():',
|
||
// A fresh loop in this thread; the binding Future is created here.
|
||
' result["value"] = asyncio.run(tools.echo({"from": "thread"}))',
|
||
't = threading.Thread(target=worker)',
|
||
't.start()',
|
||
'while t.is_alive():',
|
||
' await asyncio.sleep(0.02)',
|
||
'return result["value"]',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
echo: async (args) => { seen.push(args); return args as CodeJsonValue },
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toEqual({ from: 'thread' })
|
||
// The host binding actually ran (the reply round-tripped), not a timeout.
|
||
expect(seen).toEqual([{ from: 'thread' }])
|
||
}, 15_000)
|
||
|
||
it('keeps the reply pump alive when a late reply targets a closed thread loop', async () => {
|
||
// A binding called from a worker thread that ABANDONS the call (its
|
||
// `asyncio.run` is cancelled) leaves the pending entry holding that thread's
|
||
// loop, which `asyncio.run` closes on return. When the host later answers
|
||
// that call, `_pump_replies` schedules the completion onto the closed loop —
|
||
// `call_soon_threadsafe` raises `RuntimeError('Event loop is closed')`.
|
||
// Unguarded, that RuntimeError ends the pump task and strands every later
|
||
// reply; the guard drops the moot reply and keeps the pump serving.
|
||
//
|
||
// The ordering is a STRUCTURAL guarantee, not a timing window: the worker
|
||
// closes its loop before the main coroutine signals `closed`; the host
|
||
// answers the abandoned `slow` call (hitting the closed loop) before it
|
||
// answers `release`, because `release`'s handler only resolves `slow` first
|
||
// and then yields a microtask. So the pump provably meets the closed loop on
|
||
// `slow`'s reply before it must deliver `release`'s. Fail-before: the pump
|
||
// dies on `slow`, `release`'s reply is never read, and `await tools.release`
|
||
// hangs to the (small) maxWallMs as a timeout.
|
||
let releaseSlow!: () => void
|
||
const slowGate = new Promise<void>((resolve) => { releaseSlow = resolve })
|
||
const { runtime } = await setup({ maxWallMs: 6_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import asyncio, threading',
|
||
'closed = threading.Event()',
|
||
'def worker():',
|
||
' async def body():',
|
||
// Abandon the call: wait_for cancels it, but the pending host-side entry
|
||
// survives (dispatch does not pop on cancellation), holding this loop.
|
||
' try:',
|
||
' await asyncio.wait_for(tools.slow({}), timeout=0.1)',
|
||
' except asyncio.TimeoutError:',
|
||
' pass',
|
||
' asyncio.run(body())', // closes the thread's loop on return
|
||
' closed.set()',
|
||
't = threading.Thread(target=worker)',
|
||
't.start()',
|
||
'while not closed.is_set():',
|
||
' await asyncio.sleep(0.02)',
|
||
// The loop is closed. Now the host answers slow (dead-loop reply) then
|
||
// release; the pump must survive the first to deliver the second.
|
||
'after = await tools.release({})',
|
||
'return after',
|
||
].join('\n'),
|
||
bindings: tools({
|
||
slow: async () => {
|
||
// Answer only once the worker has closed its loop AND the main
|
||
// coroutine is awaiting release, so this reply reaches the pump against
|
||
// the closed loop.
|
||
await slowGate
|
||
return 'late'
|
||
},
|
||
release: async () => {
|
||
// Let slow's reply be written first, then yield a microtask so the
|
||
// pump processes the dead-loop reply before release's own reply lands.
|
||
releaseSlow()
|
||
await new Promise(resolve => setImmediate(resolve))
|
||
return 'released'
|
||
},
|
||
}),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
// The pump survived the closed-loop reply and delivered the later binding.
|
||
expect(result.value).toBe('released')
|
||
}, 15_000)
|
||
|
||
it('round-trips an exactly representable large integer through a binding echo', async () => {
|
||
// The reply serializer must print BigInt digits for a beyond-safe
|
||
// integral double: String(2**60) emits a rounded form, and the child
|
||
// would receive a DIFFERENT integer than the binding resolved.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'v = await tools.echo(2**60)',
|
||
'return v == 2**60',
|
||
].join('\n'),
|
||
bindings: tools({ echo: async args => args as never }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(true)
|
||
})
|
||
|
||
it('preserves an exactly representable large integer and rejects a rounding one', async () => {
|
||
// The canonical boundary accepts every JS-double-exact value: 2**53 and
|
||
// 2**60 round-trip exactly and must cross (matching the worker backend);
|
||
// 2**53+1 rounds and must fail as invalid-output.
|
||
const { runtime } = await setup()
|
||
const exact = await runtime.run({ program: 'return [2**53, 2**60]', bindings: [] })
|
||
expect(exact.error).toBeUndefined()
|
||
expect(exact.value).toEqual([2 ** 53, 2 ** 60])
|
||
const lossy = await runtime.run({ program: 'return 2**53 + 1', bindings: [] })
|
||
expect(lossy.error?.kind).toBe('invalid-output')
|
||
expect(lossy.error?.message).toContain('not exactly representable')
|
||
})
|
||
|
||
it('rejects a container subclass whose overridden methods hide its contents', async () => {
|
||
// A dict subclass returning [] from items() passes an isinstance check but
|
||
// serializes as {}, so the host would receive a value the program did not
|
||
// compute. Exact-type matching fails it as invalid-output instead. The
|
||
// worker backend rejects the prototype-equivalent shapes the same way.
|
||
const { runtime } = await setup()
|
||
const hidden = await runtime.run({
|
||
program: [
|
||
'class Sneaky(dict):',
|
||
' def items(self): return []',
|
||
' def keys(self): return []',
|
||
' def __iter__(self): return iter([])',
|
||
' def __len__(self): return 0',
|
||
'return Sneaky(secret="kept")',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(hidden.error?.kind).toBe('invalid-output')
|
||
expect(hidden.error?.message).toContain('unsupported type (Sneaky)')
|
||
// A list subclass is refused on the same rule.
|
||
const listish = await runtime.run({
|
||
program: ['class L(list):', ' def __iter__(self): return iter([])', 'return L([1, 2, 3])'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(listish.error?.kind).toBe('invalid-output')
|
||
expect(listish.error?.message).toContain('unsupported type (L)')
|
||
// The exact built-in containers still cross unchanged.
|
||
const plain = await runtime.run({ program: 'return {"secret": [1, 2]}', bindings: [] })
|
||
expect(plain.error).toBeUndefined()
|
||
expect(plain.value).toEqual({ secret: [1, 2] })
|
||
})
|
||
|
||
it('rejects a scalar subclass whose overrides disagree with what gets serialized', async () => {
|
||
// The validators checked scalars with isinstance, so a subclass passed
|
||
// every check by its real value while the ENCODER read an override — the
|
||
// host then received a value the walk never approved. Each case below is a
|
||
// distinct override reaching a distinct reader.
|
||
const { runtime } = await setup()
|
||
// _dump_float spells a float from repr(value), so an overridden __repr__
|
||
// decides the digits: F(2.5) serialized as 1.
|
||
const floated = await runtime.run({
|
||
program: [
|
||
'class F(float):',
|
||
' def __repr__(self): return "1.0"',
|
||
'return F(2.5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(floated.error?.kind).toBe('invalid-output')
|
||
expect(floated.error?.message).toContain('unsupported type (F)')
|
||
// The JS-safe-range bound is two comparisons, so overriding them admits an
|
||
// int whose true digits (json.dumps reads the C-level value) the host's
|
||
// JSON.parse rounds: 9007199254740993 arrives as ...992.
|
||
const inted = await runtime.run({
|
||
program: [
|
||
'class I(int):',
|
||
' def __gt__(self, other): return False',
|
||
' def __lt__(self, other): return False',
|
||
'return I(2 ** 53 + 1)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(inted.error?.kind).toBe('invalid-output')
|
||
expect(inted.error?.message).toContain('unsupported type (I)')
|
||
// The pre-encode size bound reads len(), so overriding it to 0 admits a
|
||
// string of any length past maxValueBytes.
|
||
const stringed = await runtime.run({
|
||
program: [
|
||
'class S(str):',
|
||
' def __len__(self): return 0',
|
||
'return S("Q" * 100000)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(stringed.error?.kind).toBe('invalid-output')
|
||
expect(stringed.error?.message).toContain('unsupported type (S)')
|
||
// A str-subclass dict KEY reaches the same len() bound.
|
||
const keyed = await runtime.run({
|
||
program: [
|
||
'class S(str):',
|
||
' def __len__(self): return 0',
|
||
'return {S("Q" * 100000): 1}',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(keyed.error?.kind).toBe('invalid-output')
|
||
expect(keyed.error?.message).toContain('non-string dict key (S)')
|
||
// bool is an int subclass that IS lossless JSON, and the exact scalars all
|
||
// still cross unchanged.
|
||
const plain = await runtime.run({
|
||
program: 'return {"t": True, "f": False, "n": None, "i": 7, "d": 2.5, "s": "ok"}',
|
||
bindings: [],
|
||
})
|
||
expect(plain.error).toBeUndefined()
|
||
expect(plain.value).toEqual({ t: true, f: false, n: null, i: 7, d: 2.5, s: 'ok' })
|
||
})
|
||
|
||
it('rejects a scalar subclass passed as a binding argument', async () => {
|
||
// The uncapped binding-argument validator shares the exact-type rule, so
|
||
// the call fails through its rejection contract instead of dispatching a
|
||
// float whose digits come from an override.
|
||
const { runtime } = await setup()
|
||
const seen: CodeJsonValue[] = []
|
||
const result = await runtime.run({
|
||
program: [
|
||
'class F(float):',
|
||
' def __repr__(self): return "1.0"',
|
||
'try:',
|
||
' await tools.echo({"v": F(2.5)})',
|
||
'except Exception as exc:',
|
||
' return str(exc)',
|
||
].join('\n'),
|
||
bindings: tools({ echo: async (args) => {
|
||
seen.push(args as CodeJsonValue)
|
||
return null
|
||
} }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('unsupported type (F)')
|
||
expect(seen).toEqual([])
|
||
})
|
||
|
||
it('rejects a container subclass passed as a binding argument', async () => {
|
||
// Binding arguments run the uncapped validator, which must apply the same
|
||
// exact-type rule: the call fails descriptively instead of dispatching a
|
||
// value whose serialization disagrees with what was validated.
|
||
const { runtime } = await setup()
|
||
const seen: CodeJsonValue[] = []
|
||
const result = await runtime.run({
|
||
program: [
|
||
'class Sneaky(dict):',
|
||
' def items(self): return []',
|
||
'try:',
|
||
' await tools.echo(Sneaky(secret="kept"))',
|
||
'except Exception as exc:',
|
||
' return str(exc)',
|
||
].join('\n'),
|
||
bindings: tools({ echo: async (args) => {
|
||
seen.push(args as CodeJsonValue)
|
||
return null
|
||
} }),
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toContain('unsupported type (Sneaky)')
|
||
expect(seen).toEqual([])
|
||
})
|
||
|
||
it('fails an oversized completion as output-limit without materializing its encoding', async () => {
|
||
// A 100 MiB string under maxValueBytes: 1024 must fail as output-limit.
|
||
// The address-space cap leaves room for the program to BUILD the string
|
||
// (one copy + interpreter) but not for the old full pre-check encode,
|
||
// which materialized chunk fragments plus the joined copy (~2 more
|
||
// copies) and died on RLIMIT_AS as MemoryError/worker-exit.
|
||
const { runtime } = await setup({ maxValueBytes: 1024, addressSpaceMb: 384, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: 'return "x" * (100 * 1024 * 1024)',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
expect(result.error?.message).toContain('exceeded 1024 bytes')
|
||
}, 20_000)
|
||
|
||
it('rejects a control-heavy oversized completion on its length, not its escaped copy', async () => {
|
||
// Every "\x00" escapes to the six bytes " ", so the escaped form of a
|
||
// 40 MB string is ~240 MB. The walk must refuse on the cheap
|
||
// `len(current) + 2` lower bound; the 384 MiB address space holds the raw
|
||
// string but not its escaped expansion, so a pre-escape check dies on
|
||
// RLIMIT_AS instead of returning output-limit.
|
||
const { runtime } = await setup({ maxValueBytes: 1024, addressSpaceMb: 384, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: 'return "\\x00" * (40 * 1024 * 1024)',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
expect(result.error?.message).toContain('exceeded 1024 bytes')
|
||
}, 20_000)
|
||
|
||
it('truncates a single print far above maxLogBytes instead of dying on the encode', async () => {
|
||
// LogBuffer must reject via the cheap char-count lower bound BEFORE
|
||
// UTF-8-encoding the whole string: the full encode of a ~100 MB line
|
||
// would double the allocation and can breach RLIMIT_AS. 256 MiB
|
||
// address space comfortably holds one copy of the 100 MB string but
|
||
// not the pre-fix double allocation plus interpreter overhead spikes.
|
||
const { runtime } = await setup({ maxLogBytes: 1024, addressSpaceMb: 256, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'print("x" * (100 * 1024 * 1024))',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
||
}, 20_000)
|
||
|
||
it('stops host capture at the child ledger truncation, keeping exactly one marker', async () => {
|
||
// The two ledgers exhaust independently. One child entry larger than
|
||
// `maxLogBytes` sends ONLY the marker, so the host budget is still nearly
|
||
// untouched — and the marker used to arrive as an ordinary `log` frame the
|
||
// host could not tell from program output. Text written afterwards was
|
||
// therefore retained AFTER the marker, contradicting the stop-after-
|
||
// truncation contract, and a later host-side exhaustion could append a
|
||
// second marker. The frame now carries `truncated: true`.
|
||
//
|
||
// `os.write(1, ...)` bypasses the child's own stream, so those bytes reach
|
||
// the host as stray stdout and take the host ledger path rather than the
|
||
// child's — which is exactly the route that leaked past the marker.
|
||
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'print("y" * 70000)',
|
||
'os.write(1, b"AFTER")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
const markers = result.logs.filter(line => line.includes('log capture truncated'))
|
||
expect(markers).toHaveLength(1)
|
||
// The marker is the LAST entry: nothing was retained after truncation.
|
||
expect(result.logs.at(-1)).toBe(markers[0])
|
||
expect(result.logs.join('\n')).not.toContain('AFTER')
|
||
}, 20_000)
|
||
|
||
it('keeps one marker when a program forges repeated truncation frames', async () => {
|
||
// `truncated` is attacker-reachable: the program owns fd 3 and can write the
|
||
// flag itself, so the field is a hostile input rather than a trusted signal.
|
||
// Repeats must collapse to the single marker the contract promises, and only
|
||
// the literal `true` counts — a forged `"yes"` is rebuilt away by
|
||
// validateChildFrame, so that frame stays ordinary text.
|
||
const { runtime } = await setup({ maxLogBytes: 4096, maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'os.write(3, json.dumps({"type":"log","text":"first","truncated":"yes"}).encode() + b"\\n")',
|
||
'os.write(3, json.dumps({"type":"log","text":"MARK-A","truncated":True}).encode() + b"\\n")',
|
||
'os.write(3, json.dumps({"type":"log","text":"MARK-B","truncated":True}).encode() + b"\\n")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
// The non-boolean flag did not truncate, so its text was captured normally.
|
||
expect(result.logs).toContain('first')
|
||
// The first genuine flag stopped capture and emitted the HOST's own marker;
|
||
// the frame's own text is discarded, so neither payload appears.
|
||
expect(result.logs).not.toContain('MARK-A')
|
||
expect(result.logs).not.toContain('MARK-B')
|
||
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
||
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
||
}, 20_000)
|
||
|
||
it('discards the text of a forged truncation frame instead of retaining it', async () => {
|
||
// The marker branch bypasses `admit`, so retaining the frame's own text put
|
||
// attacker-controlled bytes into `logs` with no cap at all: measured, a 1 MiB
|
||
// forged text was retained whole under `maxLogBytes: 64`, and the only bound
|
||
// left was the 256 MiB frame ceiling. The host emits its own marker instead,
|
||
// so the retained size is fixed regardless of what the program sent.
|
||
const forgedBytes = 1024 * 1024
|
||
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
`big = "A" * ${forgedBytes}`,
|
||
'os.write(3, json.dumps({"type":"log","truncated":True,"text":big}).encode() + b"\\n")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
// Only the host marker is kept, so the total stays orders of magnitude below
|
||
// what the forgery carried — and below the cap it was trying to escape.
|
||
expect(result.logs).toEqual([logTruncationMarker(64)])
|
||
expect(result.logs.join('').length).toBeLessThan(forgedBytes / 1000)
|
||
}, 30_000)
|
||
|
||
it('coalesces unframed fd-3 fragments without recopying the sealed prefix', async () => {
|
||
// The frame ceiling meters payload BYTES, but each retained chunk is its own
|
||
// Buffer with object and backing-store overhead the byte count cannot see:
|
||
// 5000 single-byte newline-free writes produced 5000 chunks holding 5031
|
||
// bytes, so a program pacing such writes could accumulate millions of objects
|
||
// inside the wall budget and exhaust the host heap far below 256 MiB.
|
||
//
|
||
// The observable behavior is that the run still completes normally: the
|
||
// fragments are coalesced rather than rejected, since a slow trickle of bytes
|
||
// is not itself a protocol violation.
|
||
//
|
||
// `Buffer.concat` is wrapped for the duration so the cumulative copy volume
|
||
// is measured rather than inferred: that total is what separates sealing into
|
||
// blocks from re-merging the whole buffer, and both shapes pass every
|
||
// behavioral assertion below.
|
||
//
|
||
// The trickle is terminated with its own newline before the real frame is
|
||
// written. Without that, those 5000 bytes prefix the frame on the SAME line,
|
||
// which then parses as junk and is dropped — correct framing behavior, but it
|
||
// would leave this test asserting the wrong thing.
|
||
// Bound at capture: `Buffer.concat` is a static method, and taking a bare
|
||
// reference to one trips no-unbound-method.
|
||
const realConcat = Buffer.concat.bind(Buffer)
|
||
let copied = 0
|
||
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
||
for (const part of list) copied += part.length
|
||
return realConcat(list, total)
|
||
}
|
||
const program = [
|
||
'import os',
|
||
// Newline-free single-byte writes, spaced so each lands as its own read.
|
||
// 60000 rather than 5000: the trickle has to cross the seal threshold
|
||
// enough times for the two shapes to separate. At 5000 writes there are
|
||
// only four seals, so even the quadratic form copies well under a
|
||
// megabyte and the budget below could not tell them apart.
|
||
'for _ in range(60000):',
|
||
' os.write(3, b"x")',
|
||
' os.sched_yield()',
|
||
'os.write(3, b"\\n")',
|
||
// A real frame after the trickle proves framing still works on the
|
||
// coalesced residual.
|
||
'print("after-trickle")',
|
||
'return "done"',
|
||
].join('\n')
|
||
let result: CodeRunResult
|
||
try {
|
||
const { runtime } = await setup({ maxWallMs: 30_000 })
|
||
result = await runtime.run({ program, bindings: [] })
|
||
} finally {
|
||
Buffer.concat = realConcat
|
||
}
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs).toContain('after-trickle')
|
||
// Sealing appends a finished block rather than re-merging everything held, so
|
||
// each byte is copied once. Re-concatenating the whole buffer at every
|
||
// threshold made the cumulative copy volume quadratic — 10 MiB trickled a
|
||
// byte at a time copies 53.7 GB that way. A per-byte-copied budget is the
|
||
// discriminator, and it is measured rather than reasoned about: this shape
|
||
// copies about 119 KB for 60000 trickled bytes, the re-merging shape about
|
||
// 540 KB. 256 KiB sits between them with margin on both sides — most writes
|
||
// are coalesced by the pipe before they reach us, so the observed ratio is
|
||
// smaller than the asymptotic one, and the threshold has to sit where a real
|
||
// measurement lands rather than where the asymptote suggests.
|
||
expect(copied).toBeLessThan(256 * 1024)
|
||
}, 40_000)
|
||
|
||
it('seals trickled stray fragments into blocks without recopying the sealed prefix', async () => {
|
||
// The stray-capture buffer has the same object-overhead exposure as the fd-3
|
||
// reader above: each newline-free `data` chunk is its own Buffer, so a
|
||
// program pacing single-byte `os.write(1, ...)` accumulates one object per
|
||
// write, which the serialized-cost counter cannot see. Past MAX_PENDING_CHUNKS
|
||
// the fragments seal into a finished block; re-merging the whole residual at
|
||
// each threshold instead would copy the sealed prefix again and again, making
|
||
// the cumulative copy volume quadratic. `Buffer.concat` is wrapped to measure
|
||
// that volume — both shapes admit the same final log entry, so the copy total
|
||
// is the discriminator. maxLogBytes is raised so the trickle is retained,
|
||
// not truncated, which is what forces the fragments to accumulate and seal.
|
||
const realConcat = Buffer.concat.bind(Buffer)
|
||
let copied = 0
|
||
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
||
for (const part of list) copied += part.length
|
||
return realConcat(list, total)
|
||
}
|
||
let result: CodeRunResult
|
||
try {
|
||
const { runtime } = await setup({ maxLogBytes: 200_000, maxWallMs: 30_000 })
|
||
result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'for _ in range(60000):',
|
||
' os.write(1, b"x")',
|
||
' os.sched_yield()',
|
||
'os.write(1, b"\\n")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
} finally {
|
||
Buffer.concat = realConcat
|
||
}
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
// The trickle coalesces into one log line (no interior newlines). Its exact
|
||
// length depends on pipe coalescing, but it is one entry and non-empty.
|
||
expect(result.logs.length).toBe(1)
|
||
expect((result.logs[0] as string).length).toBeGreaterThan(0)
|
||
// Sealing appends a finished block rather than re-merging everything held, so
|
||
// each byte is copied a bounded number of times. Re-merging the whole
|
||
// residual at every seal threshold instead makes the cumulative copy volume
|
||
// quadratic. Measured like the fd-3 sibling above rather than reasoned about:
|
||
// this sealed shape copies about 120 KB for 60000 trickled bytes, the
|
||
// re-merging shape about 538 KB (the stray path adds one whole-residual
|
||
// concat at the terminating newline over the fd-3 sibling's 119/540, landing
|
||
// at the same order). 256 KiB sits between them with margin on both sides, so
|
||
// reverting the seal to a re-merge turns this assertion red.
|
||
expect(copied).toBeLessThan(256 * 1024)
|
||
}, 40_000)
|
||
|
||
it('caps a huge exception diagnostic child-side before it crosses the wire', async () => {
|
||
// A program can raise with a multi-megabyte message; the child must cap
|
||
// it at maxValueBytes before formatting/sending, not ship the whole
|
||
// payload for the host to truncate after parsing.
|
||
const { runtime } = await setup({ maxValueBytes: 1024 })
|
||
const result = await runtime.run({
|
||
program: 'raise ValueError("boom-" + "x" * (8 * 1024 * 1024))',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toContain('boom-')
|
||
expect(result.error?.message.endsWith('… [truncated]')).toBe(true)
|
||
expect(Buffer.byteLength(result.error?.message ?? '', 'utf8')).toBeLessThan(2048)
|
||
})
|
||
|
||
it('caps a control-heavy exception diagnostic by its serialized cost, not raw bytes', async () => {
|
||
// The diagnostic crosses fd 3 inside a JSON frame where a control character
|
||
// escapes sixfold (a NUL is one raw byte, six as ` `). Capping by raw
|
||
// UTF-8 length would let a NUL-heavy message near maxValueBytes serialize to
|
||
// ~6x that and breach the frame ceiling — the silent worker-exit inversion
|
||
// the load-time cap check exists to prevent. The child meters the diagnostic
|
||
// by its serialized cost, so a NUL flood is truncated to fit the frame and
|
||
// the run still reports the exception rather than a worker-exit.
|
||
const { runtime } = await setup({ maxValueBytes: 4096 })
|
||
const result = await runtime.run({
|
||
// 512 KiB of NUL: ~3 MiB once escaped, far past the 4 KiB cap.
|
||
program: 'raise ValueError("\\x00" * (512 * 1024))',
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message.endsWith('… [truncated]')).toBe(true)
|
||
// The SERIALIZED form (what the frame carried) fits the budget, so its raw
|
||
// length is well under it too — a raw-byte cap would have admitted ~4 KiB of
|
||
// NULs that serialize to ~24 KiB.
|
||
const serialized = JSON.stringify(result.error?.message ?? '')
|
||
expect(Buffer.byteLength(serialized, 'utf8')).toBeLessThanOrEqual(4096 + 8)
|
||
})
|
||
|
||
it('bounds a newline-free partial-line flood while the program is still running', async () => {
|
||
// print("x", end="") never completes a line, so nothing reaches the
|
||
// Python LogBuffer until settlement — the buffered tail must still hit
|
||
// the budget mid-run instead of growing without bound to RLIMIT/timeout.
|
||
const { runtime } = await setup({ maxLogBytes: 1024, maxWallMs: 15_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'for _ in range(100000):',
|
||
' print("xxxxxxxxxx", end="")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
||
// The retained text is bounded by the budget, not the 1 MB the program wrote.
|
||
expect(result.logs.join('\n').length).toBeLessThan(4096)
|
||
}, 20_000)
|
||
|
||
it('discards empty writes instead of buffering one list slot each', async () => {
|
||
// An empty chunk adds no character, so the mid-run budget check (which
|
||
// compares buffered CHARS against the remaining ledger) can never fire on
|
||
// it. Buffering empty strings therefore grew `_pending` without bound —
|
||
// millions of slots per CPU second — until RLIMIT_AS turned an append into
|
||
// a MemoryError, long after the log ledger was exhausted. Two million
|
||
// empty writes must instead settle normally and contribute NO log entry,
|
||
// proving the chunk was dropped rather than joined at flush_line.
|
||
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 256, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'for _ in range(2000000):',
|
||
' sys.stdout.write("")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs).toEqual([])
|
||
}, 30_000)
|
||
|
||
it('stops scanning a single-write newline flood once the log ledger truncates', async () => {
|
||
// One write carrying half a million newlines: the offset scan must exit the
|
||
// instant LogBuffer truncates rather than re-slicing and pushing every
|
||
// remaining line. If it kept scanning it would exhaust the CPU/wall budget;
|
||
// the run instead settles quickly with exactly one truncation marker.
|
||
const { runtime } = await setup({ maxLogBytes: 256, maxWallMs: 10_000 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: ['print("x\\n" * 500000, end="")', 'return "done"'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
||
expect(Date.now() - start).toBeLessThan(8_000)
|
||
}, 15_000)
|
||
|
||
it('bounds an oversized newline-terminated write before joining and slicing it', async () => {
|
||
// The newline branch slices the first line out of the write before
|
||
// `LogBuffer.push` can apply its cheap budget rejection, so a single
|
||
// over-budget write cost a full extra copy of itself in peak address space —
|
||
// the amplification that bound exists to avoid, applied one layer too late.
|
||
// Measured under a 400 MiB addressSpaceMb with the slice unbounded: writes
|
||
// of 200 MiB and up died on MemoryError inside `sys.stdout.write`, reported
|
||
// as the PROGRAM's own exception rather than the promised truncation marker.
|
||
// `"\\n".rjust(n, "A")` is a single allocation ending in the newline, so the
|
||
// payload itself fits and the only remaining allocation is the stream's own
|
||
// slice; 340 MiB of a 400 MiB cap cannot survive one more copy of it.
|
||
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'payload = "\\n".rjust(340 * 1024 * 1024, "A")',
|
||
'sys.stdout.write(payload)',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs).toEqual([logTruncationMarker(256)])
|
||
}, 40_000)
|
||
|
||
it('bounds a newline-free write against the already-buffered chunks before joining them', async () => {
|
||
// The newline-free arm buffers the write and then compared the buffered
|
||
// CHARACTER COUNT against the ledger — correct — but paid for the comparison
|
||
// with `"".join(self._pending)`, a second full copy of everything held. One
|
||
// buffered character is enough to make that join a copy of the whole
|
||
// following write. Measured under a 400 MiB addressSpaceMb with a 340 MiB
|
||
// second write: the join raised MemoryError inside `sys.stdout.write`, and
|
||
// because the oversized chunks stayed in `_pending` the settlement
|
||
// `flush_line` raised it again — that throw sits after the `except
|
||
// BaseException` block, so it costs the `done` frame and the run came back
|
||
// `timeout: wall-clock ceiling reached (30000ms)` with no logs at all. The
|
||
// bound must be applied BEFORE the join and the chunks dropped on that path,
|
||
// so the run settles with the truncation marker it promises.
|
||
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
// One unterminated character first, so `_pending` is non-empty and the
|
||
// large write cannot take the "buffered text IS the write" shortcut.
|
||
'sys.stdout.write("x")',
|
||
'payload = "A" * (340 * 1024 * 1024)',
|
||
'sys.stdout.write(payload)',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs).toEqual([logTruncationMarker(256)])
|
||
}, 40_000)
|
||
|
||
it('bounds a newline-terminated write against the already-buffered chunks before joining them', async () => {
|
||
// Same allocation, reached through the newline arm: with chunks pending, the
|
||
// whole write used to be appended and joined so the offset scan could run
|
||
// over one string. Only the FIRST line needs those chunks, so a pending
|
||
// chunk plus a 340 MiB newline-terminated write under a 400 MiB
|
||
// addressSpaceMb died on MemoryError in the join before the per-line bound
|
||
// could reject anything, and the retained chunks made the settlement flush
|
||
// die the same way: measured, `timeout: wall-clock ceiling reached
|
||
// (30000ms)`. The reconstructed first line is now checked against the ledger
|
||
// and only a budget-sized prefix of it is copied; the rest of the write is
|
||
// scanned in place.
|
||
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'sys.stdout.write("x")',
|
||
'payload = "\\n".rjust(340 * 1024 * 1024, "A")',
|
||
'sys.stdout.write(payload)',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs).toEqual([logTruncationMarker(256)])
|
||
}, 40_000)
|
||
|
||
it('emits pending text on an explicit flush, before the run can be killed', async () => {
|
||
// `_LogStream` inherits TextIOBase's no-op `flush()`, so an explicit
|
||
// `print(..., flush=True)` or `sys.stdout.flush()` left the text in
|
||
// `_pending` with nothing to drain it but `flush_line` after settlement — a
|
||
// call a hanging or killed run never reaches. Measured: printing
|
||
// "before hang" with flush=True ahead of an infinite loop returned
|
||
// `logs: []`, losing the one diagnostic the program deliberately committed.
|
||
const { runtime } = await setup({ maxWallMs: 4_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'print("before hang", end="", flush=True)',
|
||
'while True: pass',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('timeout')
|
||
expect(result.logs).toContain('before hang')
|
||
}, 15_000)
|
||
|
||
it('marks a dropped tail when the ledger lands on exactly zero remaining', async () => {
|
||
// One 100-character line costs 103 serialized bytes (quotes + separator),
|
||
// consuming a 103-byte budget EXACTLY. Landing on zero never trips
|
||
// LogBuffer's "cost > remaining" branch, so `_truncated` stays unset and the
|
||
// stream's own `remaining > 0` guard silently discarded the unscanned tail —
|
||
// the run reported a complete log while dropping text. The tail must be
|
||
// pushed so the marker is emitted. (This surfaced only after empty writes
|
||
// stopped being buffered: `print` issues a trailing `write("")` whose
|
||
// buffered-empty path used to force the marker out incidentally.) A single
|
||
// wide line is used rather than many narrow ones so the CHILD ledger is the
|
||
// one that lands on zero: the host's identical ledger truncates first when
|
||
// many small entries precede the long marker text.
|
||
const { runtime } = await setup({ maxLogBytes: 103, maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: ['print("y" * 100 + "\\n" + "z" * 10, end="")', 'return "done"'].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs).toContain('y'.repeat(100))
|
||
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
||
// The dropped tail is not retained, but its loss is now reported.
|
||
expect(result.logs.some(line => line.includes('z'))).toBe(false)
|
||
}, 15_000)
|
||
|
||
it('charges the JSON-escaped cost of control characters against the log ledger', async () => {
|
||
// A NUL renders as \u0000 (6 bytes) in the serialized outer logs; the
|
||
// ledger must charge that expansion, or a control-character flood admits
|
||
// 6x the configured cap.
|
||
const { runtime } = await setup({ maxLogBytes: 256 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'for _ in range(500):',
|
||
' print("\\x00" * 10)',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
||
// Serialized (escaped) size of retained entries stays in the budget's
|
||
// neighborhood: well under the ~30 kB an uncharged flood would retain.
|
||
const serialized = Buffer.byteLength(JSON.stringify(result.logs), 'utf8')
|
||
expect(serialized).toBeLessThan(1024)
|
||
})
|
||
|
||
it('charges the serialized cost child-side, so a control-heavy line truncates instead of being admitted whole', async () => {
|
||
// The child's ledger must charge what the entry costs on the wire, not its
|
||
// raw UTF-8 length: a NUL is one raw byte but six as its escape. A 24 MiB NUL
|
||
// line clears the cheap char-count lower bound (24 MiB < 32 MiB budget), so
|
||
// charging raw bytes would ADMIT it and emit a ~144 MiB escaped entry;
|
||
// charging the serialized cost (~144 MiB > the 32 MiB budget) rejects it
|
||
// before any encode and emits the marker instead. The address space (512 MiB,
|
||
// clearing the 12x load gate for a 32 MiB budget) is sized so the run loads;
|
||
// the gate separately guarantees a correctly-charged near-budget entry fits.
|
||
const { runtime } = await setup({ maxLogBytes: 32 * 1024 * 1024, addressSpaceMb: 512, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'print("\\x00" * (24 * 1024 * 1024))',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
||
// Nothing of the line itself was retained: the ledger refused the whole entry.
|
||
expect(result.logs.every(line => !line.includes(String.fromCharCode(0)))).toBe(true)
|
||
}, 30_000)
|
||
|
||
it('bounds a huge unterminated tail after an early newline without copying it whole', async () => {
|
||
// The newline branch of _LogStream.write buffered the whole unterminated
|
||
// tail after the last newline into `_pending` before the flush trigger could
|
||
// bound it, so an early newline followed by a huge tail made a second full
|
||
// copy of the model's own string — a MemoryError the config gate cannot
|
||
// catch (the tail far exceeds maxLogBytes). The tail is now sliced to a
|
||
// budget-sized prefix, so the run truncates and completes. Linux-only RLIMIT_AS
|
||
// repro (Darwin skips the limit); on macOS this asserts the happy path.
|
||
//
|
||
// Sizing: the model builds `tail` (N) then the `"\n" + tail` write argument
|
||
// (another ~N), so construction peaks at ~2N — kept under the 384 MiB address
|
||
// space at N = 150 MiB (~300 MiB). The pre-fix code then buffered the whole
|
||
// ~150 MiB tail again, pushing past 384 MiB; the sliced prefix does not.
|
||
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 384, maxWallMs: 20_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'tail = "A" * (150 * 1024 * 1024)',
|
||
'sys.stdout.write("\\n" + tail)',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('done')
|
||
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
||
}, 30_000)
|
||
|
||
it('flushes logs before framing the value so their peaks do not add against RLIMIT_AS', async () => {
|
||
// The load gate bounds maxLogBytes and maxValueBytes INDEPENDENTLY against the
|
||
// address space, each at the 12x worst case. But the child framed the
|
||
// completion value (materializing its escaped form to meter it, then encoding
|
||
// the frame) while a newline-free log tail still sat unflushed in _pending.
|
||
// Those two peaks added: two budgets each admitted alone could together breach
|
||
// RLIMIT_AS, dying as worker-exit instead of settling. The flush now runs
|
||
// before the value is framed, so the log pending is freed first.
|
||
//
|
||
// Config: 32 MiB each against 512 MiB (each 32*12 = 384 MiB < 448 MiB
|
||
// budgetable, so both load). The program writes ~33M astral chars with no
|
||
// newline (buffered ~132 MB, under the char-count flush trigger) then returns
|
||
// ~33M astral chars — a ~132 MB serialized value that is itself OVER the 32 MiB
|
||
// maxValueBytes, so the correct outcome is `output-limit`. Pre-fix the
|
||
// unflushed 132 MB plus the value's build-and-encode (~396 MB) exceeded 512 MiB
|
||
// and OOM'd (reported as exception/worker-exit); flushing first lets the value
|
||
// check complete (~460 MB alone) and report output-limit. On Darwin (no
|
||
// RLIMIT_AS) the value is over budget too, so output-limit holds either way;
|
||
// the OOM the reorder prevents is the Linux-only failure.
|
||
const { runtime } = await setup({
|
||
maxLogBytes: 32 * 1024 * 1024,
|
||
maxValueBytes: 32 * 1024 * 1024,
|
||
addressSpaceMb: 512,
|
||
maxWallMs: 20_000,
|
||
})
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import sys',
|
||
'sys.stdout.write("\\U0001F600" * 33_000_000)',
|
||
'return "\\U0001F600" * 33_000_000',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
}, 30_000)
|
||
|
||
it('checks and encodes a wide completion value in O(depth), not O(width)', async () => {
|
||
// A wide flat list serializes to ~2 bytes per element but the pre-fix walk
|
||
// enqueued one traversal tuple per element (_check_done_value) and one stack
|
||
// entry plus a separator marker per element (_encode_json_plain) — ~56 bytes
|
||
// per element, ~28x the serialized size. A value the byte meter admits could
|
||
// therefore OOM on the checker's or encoder's own bookkeeping, the inversion
|
||
// the load gate exists to prevent (the gate reserves 12x, not 28x). Both now
|
||
// walk with an O(depth) cursor that pulls one child at a time, so the only
|
||
// width-proportional allocation is the output string the meter bounded.
|
||
//
|
||
// Config: maxValueBytes 20 MiB against 384 MiB (20*12 = 240 MiB < 320 MiB
|
||
// budgetable, so it loads). `[0] * 6_000_000` is ~12 MB of JSON, under the
|
||
// 20 MiB budget, so it must round-trip. Pre-fix the ~400 MB of per-element
|
||
// frames plus the interpreter exceeded 384 MiB and returned MemoryError as an
|
||
// exception. Linux-only RLIMIT_AS repro; on macOS the value round-trips
|
||
// either way, but the fixture stays within the address space so it is honest.
|
||
//
|
||
// `maxWallMs` is 60s, not the 20s the memory assertion alone needs: the O(depth)
|
||
// cursor pulls 6M elements one at a time through Python-level frames, which costs
|
||
// ~11s on an idle machine and more under the coverage lane's V8 instrumentation
|
||
// with several workers sharing a box. This budget bounds the run without letting a
|
||
// loaded runner's scheduling latency read as a `timeout` — what this test asserts
|
||
// is the O(depth) memory shape, not a speed claim.
|
||
const { runtime } = await setup({ maxValueBytes: 20 * 1024 * 1024, addressSpaceMb: 384, maxWallMs: 60_000 })
|
||
const result = await runtime.run({ program: 'return [0] * 6_000_000', bindings: [] })
|
||
expect(result.error).toBeUndefined()
|
||
expect(Array.isArray(result.value)).toBe(true)
|
||
expect((result.value as number[]).length).toBe(6_000_000)
|
||
}, 90_000)
|
||
|
||
it('validates wide binding arguments in O(depth), not O(width)', async () => {
|
||
// The completion-value walks are budgeted; this one is not. `dispatch` runs
|
||
// `_lossless_json_violation` on the arguments the MODEL built, and no
|
||
// child-side byte budget bounds them first: the frame ceiling is the host's
|
||
// and applies only after this validation returns. A per-member traversal
|
||
// frame therefore turned a legitimate call into the program's own
|
||
// MemoryError. Measured with tracemalloc on the two walk shapes over this
|
||
// exact argument (JSON ~17 MB): the cursor peaks at 0.0 MiB of auxiliary
|
||
// state, the pre-fix `stack.extend` at 459.1 MiB -- past the 384 MiB
|
||
// configured below, so the discriminating failure is real. It is Linux-only:
|
||
// Darwin skips RLIMIT_AS, so this case round-trips there either way.
|
||
//
|
||
// The binding echoes its argument's length back, so the assertion proves the
|
||
// call actually round-tripped rather than merely avoiding a crash.
|
||
const { runtime } = await setup({ addressSpaceMb: 384, maxWallMs: 60_000 })
|
||
const result = await runtime.run({
|
||
program: 'return await tools.width([0] * 6_000_000)',
|
||
bindings: [{
|
||
global: 'tools',
|
||
functions: { width: async (items: unknown) => (items as number[]).length },
|
||
}],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(6_000_000)
|
||
}, 90_000)
|
||
|
||
it('decodes a multi-megabyte binding reply without regex backtracking state', async () => {
|
||
// The child parses every host reply with `_decode_json_plain`. Its scalar
|
||
// regex matched strings with a `(?:[^"\\]|\\.)*` repetition, which makes
|
||
// CPython's backtracking engine retain state proportional to the string's
|
||
// WIDTH -- measured at ~146 MiB of engine state for a 1 MiB string and
|
||
// ~558 MiB for 4 MiB. A legitimate multi-megabyte reply therefore raised
|
||
// MemoryError inside `_pump_replies`; because that pump is the only settler
|
||
// of the call's future, the run stranded until the wall clock reported a
|
||
// `timeout` instead of returning the value the binding produced.
|
||
//
|
||
// Strings now scan chunk-to-chunk over a character class (no backtracking
|
||
// state). Measured on this exact 4 MiB reply: the pre-fix regex peaks at
|
||
// 557.8 MiB, past the default 512 MiB address space, while the scanner peaks
|
||
// at the 4.0 MiB result itself. Linux-only, like the other RLIMIT_AS repros:
|
||
// Darwin does not apply the limit, so the spike is merely allocated there.
|
||
const reply = 'A'.repeat(4 * 1024 * 1024)
|
||
const { runtime } = await setup({ maxWallMs: 60_000 })
|
||
const result = await runtime.run({
|
||
program: 'value = await tools.big({})\nreturn len(value)',
|
||
bindings: [{ global: 'tools', functions: { big: async () => reply } }],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe(reply.length)
|
||
}, 90_000)
|
||
|
||
it('bounds a flood of zero-byte log lines through the per-entry separator charge', async () => {
|
||
// Blank print() lines carry zero content bytes; without the +1 separator
|
||
// charge they would bypass maxLogBytes entirely and grow the retained
|
||
// array without bound. Each empty entry costs one byte, so a 64-byte
|
||
// budget retains at most 64 entries before the marker.
|
||
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 10_000 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'for _ in range(10000):',
|
||
' print()',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.length).toBeLessThanOrEqual(65)
|
||
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
||
})
|
||
|
||
it('reassembles multibyte UTF-8 split across stray-output pipe chunks', async () => {
|
||
// A single os.write far past the 64 KiB pipe buffer forces multiple
|
||
// 'data' chunks; when the boundary lands inside a multibyte sequence,
|
||
// per-chunk decoding would corrupt it into replacement characters. Raw bytes
|
||
// are buffered and only decoded once a complete line (or the whole tail at
|
||
// flush) is assembled, so the split sequence is whole by the time it is
|
||
// decoded. The payload spans every valid multibyte lead class so
|
||
// accrueStrayCost's per-lead continuation ranges are all exercised: U+0900
|
||
// (E0 A4 80, the range-restricted E0 lead), U+4F60 and U+597D (E4/E5, plain
|
||
// 3-byte), U+1F600 (F0, the range-restricted F0 lead), and U+10FFFF (F4 8F
|
||
// BF BF, the range-restricted F4 lead).
|
||
const { runtime } = await setup({ maxLogBytes: 1024 * 1024 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
// os.write is one syscall and returns a partial count on a full
|
||
// pipe, so loop until the whole payload (odd prefix -> a chunk
|
||
// boundary lands inside a multibyte sequence) is out.
|
||
String.raw`payload = b"a" * 65535 + "\u0900\u4f60\u597d\U0001f600\U0010ffff".encode("utf-8")`,
|
||
'view = memoryview(payload)',
|
||
'while view:',
|
||
' view = view[os.write(1, view):]',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
const text = result.logs.join('')
|
||
expect(text).toContain('\u0900\u4f60\u597d\u{1f600}\u{10ffff}')
|
||
expect(text).not.toContain('\ufffd')
|
||
})
|
||
|
||
it('flushes a stray-output byte sequence left incomplete when the pipe ends', async () => {
|
||
// The child writes the first two bytes of a 3-byte UTF-8 character to fd 1
|
||
// and exits, so the pipe closes with the sequence unfinished in the raw
|
||
// residual. The 'end' flush decodes the residual with `toString('utf8')`,
|
||
// which renders the stranded bytes as U+FFFD instead of dropping them.
|
||
const { runtime } = await setup({ maxLogBytes: 1024 * 1024 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
// b"\xe4\xbd" is the leading two bytes of U+4F60; no continuation byte
|
||
// follows before exit.
|
||
String.raw`os.write(1, b"\xe4\xbd")`,
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.join('')).toContain('�')
|
||
})
|
||
|
||
it('rejects reserved words of EITHER backend language as binding globals', async () => {
|
||
// The seam's portable contract: `lambda` (Python keyword, legal JS name)
|
||
// and `typeof` (JS keyword, legal Python name) are both refused, so a
|
||
// namespace list valid on one backend is valid on every backend.
|
||
const { runtime } = await setup()
|
||
for (const global of ['lambda', 'typeof']) {
|
||
await expect(runtime.run({
|
||
program: 'return 1',
|
||
bindings: [{ global, functions: {} }],
|
||
})).rejects.toThrow(/is not a usable Python identifier/)
|
||
}
|
||
})
|
||
|
||
it('captures stray stdout bytes the child writes bypassing sys.stdout', async () => {
|
||
// Model code that writes to fd 1 via os.write() bypasses the Python-side
|
||
// LogBuffer, so the host's stray-byte capture on child.stdout is what
|
||
// records it.
|
||
const { runtime } = await setup()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'os.write(1, b"stray stdout\\n")',
|
||
'os.write(2, b"stray stderr\\n")',
|
||
'return "done"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.logs.join('')).toContain('stray stdout')
|
||
expect(result.logs.join('')).toContain('stray stderr')
|
||
})
|
||
|
||
it('escalates to SIGKILL when the program traps SIGTERM and ignores the grace period', async () => {
|
||
// A program that traps SIGTERM should still die: the kill() escalation
|
||
// fires SIGKILL after graceMs. The full run reports either timeout (wall)
|
||
// or worker-exit depending on which finish reason wins the race.
|
||
const { runtime } = await setup({ maxWallMs: 400, graceMs: 200 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import signal, time',
|
||
'signal.signal(signal.SIGTERM, lambda *a: None)',
|
||
'while True: time.sleep(1)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
||
}, 6000)
|
||
|
||
it('bounds the fd-3 receive buffer against a newline-free flood', async () => {
|
||
// A program looping os.write(3, ...) with no newline would grow the host
|
||
// accumulator unbounded (the child's RLIMIT_AS does not cover the host
|
||
// string). The ceiling is a fixed 256 MiB memory-safety invariant —
|
||
// deliberately NOT derived from maxValueBytes, because legitimate binding
|
||
// call frames may be large. We flood slightly past it in 8 MiB writes so
|
||
// the test terminates promptly once the guard trips.
|
||
const ceiling = 256 * 1024 * 1024
|
||
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
|
||
const start = Date.now()
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
`for _ in range(${Math.ceil((ceiling * 1.1) / (8 * 1024 * 1024))}):`,
|
||
' os.write(3, b"A" * (8 * 1024 * 1024))',
|
||
'return "never"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
const elapsed = Date.now() - start
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
|
||
// The breach ends the run before the wall ceiling (the run did not idle
|
||
// out); absolute pipe throughput varies too much under parallel suites
|
||
// for a tight bound.
|
||
expect(elapsed).toBeLessThan(30_000)
|
||
}, 45_000)
|
||
|
||
it('fails a forged oversized done value host-side as output-limit', async () => {
|
||
// The Python-side _done_with_value check is bypassable by writing a done
|
||
// frame straight to fd 3. The host re-enforces maxValueBytes; the seam
|
||
// forbids substituting a truncated value, so the run FAILS as output-limit
|
||
// instead of returning a lie.
|
||
const maxValueBytes = 64
|
||
const { runtime } = await setup({ maxValueBytes })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'big = "B" * 5000',
|
||
'os.write(3, json.dumps({"type":"done","value":big}).encode() + b"\\n")',
|
||
// The real done never sends; the forged one settles the run.
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('output-limit')
|
||
expect(result.error?.message).toContain('exceeded 64 bytes')
|
||
}, 8000)
|
||
|
||
it('drops a forged oversized log frame on its code-unit lower bound, before escaping it', async () => {
|
||
// A forged `log` frame carrying a control-heavy string sits below the
|
||
// 256 MiB fd-3 frame ceiling but escapes several-fold: 24 MiB of NULs
|
||
// becomes ~144 MiB of ` `. Charging it required building that escaped
|
||
// copy first, so a 32-byte maxLogBytes could still force a
|
||
// hundreds-of-megabytes host allocation. The cheap `length + 3` lower bound
|
||
// truncates it instead. The host's own heap is what is under test, so keep
|
||
// the child's address space generous enough to BUILD the frame.
|
||
const { runtime } = await setup({ maxLogBytes: 32, addressSpaceMb: 1024, maxWallMs: 60_000 })
|
||
const before = process.memoryUsage().heapUsed
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
// Written as a raw frame so the child's own ledger never sees it.
|
||
'os.write(3, b\'{"type":"log","text":"\' + b"\\\\u0000" * (24 * 1024 * 1024) + b\'"}\\n\')',
|
||
'return "settled"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('settled')
|
||
// The frame was dropped as one truncation marker, not retained.
|
||
expect(result.logs).toEqual([logTruncationMarker(32)])
|
||
// The escaped copy (~144 MiB) was never materialized.
|
||
expect(process.memoryUsage().heapUsed - before).toBeLessThan(256 * 1024 * 1024)
|
||
}, 90_000)
|
||
|
||
it('charges a forged log frame its escaped cost once past the code-unit lower bound', async () => {
|
||
// The cheap lower bound only rejects what cannot possibly fit; a SHORT
|
||
// control-heavy frame clears it and must still be charged what it costs on
|
||
// the wire. Ten NULs are 13 against the 32-byte lower bound but 63 escaped
|
||
// (six bytes each, two quotes, one separator), so the full charge truncates.
|
||
const { runtime } = await setup({ maxLogBytes: 32 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'os.write(3, b\'{"type":"log","text":"\' + b"\\\\u0000" * 10 + b\'"}\\n\')',
|
||
'return "settled"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error).toBeUndefined()
|
||
expect(result.value).toBe('settled')
|
||
expect(result.logs).toEqual([logTruncationMarker(32)])
|
||
}, 8000)
|
||
|
||
it('caps a forged done error.message from its code-unit prefix, never encoding the whole message', async () => {
|
||
// `Buffer.from(message)` on a message near the frame ceiling allocates a
|
||
// full UTF-8 copy before maxValueBytes applies. Only the first
|
||
// maxValueBytes code units can fit the cap, so only that prefix is encoded
|
||
// — at most 3x the cap in bytes. The message here is 48 MiB of ASCII: its
|
||
// full encode would be another 48 MiB in the host.
|
||
const maxValueBytes = 64
|
||
const { runtime } = await setup({ maxValueBytes, addressSpaceMb: 1024, maxWallMs: 60_000 })
|
||
const before = process.memoryUsage().heapUsed
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'os.write(3, b\'{"type":"done","error":{"kind":"exception","message":"\' + b"E" * (48 * 1024 * 1024) + b\'"}}\\n\')',
|
||
'import time',
|
||
'time.sleep(30)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
const message = result.error?.message ?? ''
|
||
// The marker's 15 bytes come OUT of the 64-byte cap, so 49 E's precede it
|
||
// and the whole string is exactly 64 bytes — not 64 plus the marker.
|
||
expect(message).toBe(`${'E'.repeat(maxValueBytes - 15)}… [truncated]`)
|
||
expect(Buffer.byteLength(message, 'utf8')).toBe(maxValueBytes)
|
||
// JSON.parse already holds the 48 MiB string; the cap must not add a
|
||
// second full-length copy on top of it.
|
||
expect(process.memoryUsage().heapUsed - before).toBeLessThan(256 * 1024 * 1024)
|
||
}, 90_000)
|
||
|
||
it('keeps a capped diagnostic within maxValueBytes, marker included', async () => {
|
||
// The marker is part of the emitted diagnostic, so its bytes are reserved
|
||
// from the cap rather than appended past it — the host meters this same
|
||
// field downstream. Checked on BOTH producers: the child's own _cap_message
|
||
// (a raised exception) and the host's capMessage (a forged done frame).
|
||
const maxValueBytes = 40
|
||
const { runtime } = await setup({ maxValueBytes })
|
||
const raised = await runtime.run({
|
||
program: 'raise ValueError("R" * 100000)',
|
||
bindings: [],
|
||
})
|
||
expect(raised.error?.kind).toBe('exception')
|
||
const raisedMessage = raised.error?.message ?? ''
|
||
expect(raisedMessage.endsWith('… [truncated]')).toBe(true)
|
||
expect(Buffer.byteLength(raisedMessage, 'utf8')).toBeLessThanOrEqual(maxValueBytes)
|
||
const forged = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'msg = "F" * 100000',
|
||
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(forged.error?.kind).toBe('exception')
|
||
const forgedMessage = forged.error?.message ?? ''
|
||
expect(forgedMessage.endsWith('… [truncated]')).toBe(true)
|
||
expect(Buffer.byteLength(forgedMessage, 'utf8')).toBe(maxValueBytes)
|
||
}, 15_000)
|
||
|
||
it('emits the marker alone when the cap is smaller than the marker itself', async () => {
|
||
// With maxValueBytes below the marker's own 15 bytes there is no room for
|
||
// message text; the marker still goes out, so the truncation stays reported
|
||
// instead of the diagnostic silently becoming empty. Both producers agree.
|
||
const { runtime } = await setup({ maxValueBytes: 4 })
|
||
const raised = await runtime.run({ program: 'raise ValueError("R" * 500)', bindings: [] })
|
||
expect(raised.error?.kind).toBe('exception')
|
||
expect(raised.error?.message).toBe('… [truncated]')
|
||
const forged = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":"F" * 500}}).encode() + b"\\n")',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(forged.error?.kind).toBe('exception')
|
||
expect(forged.error?.message).toBe('… [truncated]')
|
||
}, 15_000)
|
||
|
||
it('caps a forged done error.message without splitting a surrogate pair', async () => {
|
||
// At exactly maxValueBytes code units the prefix can end on a high
|
||
// surrogate whose low half sits just outside it. `Buffer.from` encodes that
|
||
// orphan as U+FFFD — the same corruption a mid-sequence byte cut causes —
|
||
// and those three replacement bytes sit past the marker-reserved budget, so
|
||
// the byte trim-back drops them.
|
||
const maxValueBytes = 32
|
||
const { runtime } = await setup({ maxValueBytes })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
// 32 ASCII chars then astral characters: code unit 32 is the first
|
||
// character's high surrogate (Python spells it as one code point, so
|
||
// json.dumps emits the raw 4 bytes the host reads back as a pair).
|
||
'msg = "A" * 32 + "\\U0001f600" * 4',
|
||
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
// 17 A's fill the marker-reserved budget; no orphaned half, no U+FFFD.
|
||
expect(result.error?.message).toBe(`${'A'.repeat(17)}… [truncated]`)
|
||
expect(Buffer.byteLength(result.error?.message ?? '', 'utf8')).toBe(maxValueBytes)
|
||
}, 8000)
|
||
|
||
it('returns a diagnostic under a third of the cap untouched, skipping the encode', async () => {
|
||
// Under maxValueBytes/3 code units a message cannot overflow the cap
|
||
// whatever it holds (3 bytes is the per-code-unit maximum), so the fast
|
||
// path returns it without encoding anything. Non-ASCII proves the bound is
|
||
// the code-unit count, not a byte assumption: 6 characters at 3 bytes each
|
||
// is 18 bytes, inside the 64-byte cap.
|
||
const { runtime } = await setup({ maxValueBytes: 64 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":"中文中文中文"}}).encode() + b"\\n")',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
expect(result.error?.message).toBe('中文中文中文')
|
||
}, 8000)
|
||
|
||
it('re-caps a forged done error.message host-side on a UTF-8 boundary', async () => {
|
||
// A forged done frame can carry an arbitrarily long error message; the
|
||
// host caps it to maxValueBytes and appends the shared marker. The
|
||
// message is emoji-dense and the cap is chosen so the marker-reserved
|
||
// 51-byte cut lands INSIDE a 4-byte sequence (one ASCII byte then 4-byte
|
||
// runs, so only a cut at 1 + 4k is aligned) — the cap must trim back to a
|
||
// code-point boundary rather than decode a replacement character, which
|
||
// would also exceed the cap.
|
||
const maxValueBytes = 66
|
||
const { runtime } = await setup({ maxValueBytes })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os, json',
|
||
'msg = "E" + "\\U0001f600" * 2000',
|
||
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
|
||
'import time',
|
||
'time.sleep(5)',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('exception')
|
||
const message = result.error?.message ?? ''
|
||
expect(message.endsWith('… [truncated]')).toBe(true)
|
||
const marker = '… [truncated]'
|
||
const body = message.slice(0, message.length - marker.length)
|
||
// The WHOLE message, marker included, honors the cap.
|
||
expect(Buffer.byteLength(message, 'utf8')).toBeLessThanOrEqual(maxValueBytes)
|
||
// 'E' plus 12 emoji is 49 bytes: the trim-back walked the 51-byte budget
|
||
// down past two continuation bytes rather than splitting the 13th.
|
||
expect(body).toBe(`E${'\u{1f600}'.repeat(12)}`)
|
||
// The cut landed on a code-point boundary — no replacement character.
|
||
expect(body).not.toContain('\ufffd')
|
||
}, 8000)
|
||
|
||
it('bounds a single oversized newline-terminated line on fd 3', async () => {
|
||
// The same ceiling applies to one giant framed line. Write EXACTLY the
|
||
// ceiling with no newline — at the limit, not past it, so nothing trips —
|
||
// then a small newline tail, which is the chunk that crosses.
|
||
const ceiling = 256 * 1024 * 1024
|
||
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'chunk = b"A" * (8 * 1024 * 1024)',
|
||
`for _ in range(${ceiling / (8 * 1024 * 1024)}):`,
|
||
' os.write(3, chunk)',
|
||
'os.write(3, b"AAAA\\n")',
|
||
'return "never"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
|
||
}, 90_000)
|
||
|
||
it('rejects an over-ceiling fd-3 buffer without first joining it into one line', async () => {
|
||
// The ceiling has to be enforced on the byte COUNTER before Buffer.concat,
|
||
// not on the joined line afterwards: the join is a second copy of
|
||
// everything held, so a program could force roughly twice the advertised
|
||
// 256 MiB of host memory before anything rejected it.
|
||
//
|
||
// This program makes the two orders observably different rather than merely
|
||
// differently sized. It writes exactly the ceiling with no newline (at the
|
||
// limit, so nothing trips), then a newline followed by 8 MiB more. Checking
|
||
// the counter first sees more than the ceiling on the newline-bearing pipe
|
||
// chunk and rejects. Checking the joined line instead produced a FIRST LINE
|
||
// of exactly the ceiling — inside the per-line bound, so it passed as a junk
|
||
// frame — and left an 8 MiB residual well under the bound, so the breach was
|
||
// never reported: measured, the run settled as
|
||
// `python exited (code=0, signal=null) before completing` after the host had
|
||
// held the ceiling AND copied it, which is the doubling this check prevents.
|
||
const ceiling = 256 * 1024 * 1024
|
||
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
|
||
const result = await runtime.run({
|
||
program: [
|
||
'import os',
|
||
'chunk = b"A" * (8 * 1024 * 1024)',
|
||
`for _ in range(${ceiling / (8 * 1024 * 1024)}):`,
|
||
' os.write(3, chunk)',
|
||
// One drain loop: a single os.write past the pipe buffer returns short,
|
||
// and a truncated tail would change which bytes cross the ceiling.
|
||
'view = memoryview(b"\\n" + b"B" * (8 * 1024 * 1024))',
|
||
'while view:',
|
||
' view = view[os.write(3, view):]',
|
||
'return "never"',
|
||
].join('\n'),
|
||
bindings: [],
|
||
})
|
||
expect(result.value).toBeUndefined()
|
||
expect(result.error?.kind).toBe('worker-exit')
|
||
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
|
||
}, 120_000)
|
||
|
||
})
|