mengzhx/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness.git synced 2026-09-08 04:01:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
538ad4d3dc0d8cf172cfc7e2e89dffa721923c2a
deepseek-harness/packages/code-runtime/code-runtime-python/tests/runtime.spec.ts
T
Chinesezjc c388169cff feat(code-runtime-python): add the CPython subprocess backend 
Land the PythonCodeRuntime implementation on top of the fd-3 protocol
seam: python3 -I per run, binding namespace over fd 3, RLIMIT_CPU/AS,
wall-clock timer, and SIGTERM->grace->SIGKILL process-group teardown,
with the real-subprocess integration suite.

Fixes three defects surfaced on the source PR's review before they ship:
- boot-write failure resolved a worker-exit through finish()/settle()
  that read wallTimer/onAbort/live in their TDZ, rejecting run() instead;
  the boot write now runs after those bindings and the v8-ignore that hid
  the branch is removed.
- log capture serialized against settlement with no lock while model
  daemon threads keep writing; LogBuffer now owns one shared re-entrant
  lock taken by write/flush_line/push.
- the fd-3 line residual was a subarray view pinning the whole joined
  frame; it is copied into a right-sized Buffer via detachResidual so
  pendingBytes measures what is retained.
2026-08-31 14:14:32 +08:00

3288 lines
153 KiB
TypeScript
Raw Blame History

import { existsSync, readdirSync, realpathSync } from 'node:fs'
import { mkdtemp, writeFile } from 'node:fs/promises'
import { tmpdir } from 'node:os'
import { basename, dirname, join } from 'node:path'
import { describe, expect, it, vi } from 'vitest'
import { Context } from 'cordis'
import { PythonCodeRuntime } from '../src/index.ts'
import { logTruncationMarker } from '../src/protocol.ts'
import type { Config } from '../src/index.ts'
import type { CodeBindingFunction, CodeJsonValue, CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
/**
* Names one `py/` script whose `copyFileSync` must fail, for the partial-staging
* case. A real disk-full or missing-asset failure mid-copy cannot be produced
* from a test, and the leak only shows when `mkdtempSync` has already succeeded.
*/
const { failNextCopyOf } = vi.hoisted(() => ({ failNextCopyOf: { value: undefined as string | undefined } }))
vi.mock('node:fs', async (importOriginal) => {
const actual = await importOriginal<typeof import('node:fs')>()
return {
...actual,
copyFileSync(source: string, destination: string): void {
if (failNextCopyOf.value !== undefined && basename(source) === failNextCopyOf.value) {
failNextCopyOf.value = undefined
throw Object.assign(new Error('simulated ENOSPC on copy'), { code: 'ENOSPC' })
}
actual.copyFileSync(source, destination)
},
}
})
/**
* Integration suite over REAL python3 subprocesses (no mocks — subprocess is
* cheap and local, per docs/testing.md's real-over-mock policy). Each test
* builds a fresh runtime so budgets can be tuned per case.
*/
async function setup(config: Config = {}) {
const ctx = new Context()
const fiber = await ctx.plugin(PythonCodeRuntime, config)
const runtime = ctx.codeRuntime as PythonCodeRuntime
return { ctx, fiber, runtime }
}
/** Convenience: one namespace `tools` with the given functions. */
function tools(functions: Record<string, CodeBindingFunction>) {
return [{ global: 'tools', functions }]
}
describe('PythonCodeRuntime — seam descriptors and misuse', () => {
it('registers the seam descriptors', async () => {
const { runtime } = await setup()
expect(runtime.language).toBe('python')
expect(runtime.isolation).toBe('process')
})
it('rejects non-positive config as seam misuse', async () => {
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 0 }))
.rejects.toThrow(/cpuSeconds must be a positive number/)
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: -1 }))
.rejects.toThrow(/maxWallMs must be a positive number/)
})
it('rejects a non-integer cpuSeconds at load (setrlimit needs an int)', async () => {
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 1.5 }))
.rejects.toThrow(/cpuSeconds must be a positive integer, got 1.5/)
})
it('rejects finite numeric config that cannot cross as an exact rlimit integer', async () => {
// `Number.isFinite` and `Number.isInteger` both admit values that cannot
// round-trip. `addressSpaceMb: 1e308` overflows to `Infinity` once multiplied
// by 1 MiB, and `encodeJsonPlain` renders that as `null`, so the child gets no
// limit at all; `cpuSeconds: 1e100` clears `Number.isInteger` while sitting
// far past the safe range, so `setrlimit` receives a different number than was
// configured. Both used to end every run in a bootstrap exception instead of
// failing at load, where a self-contained configuration error belongs.
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, { addressSpaceMb: 1e308 }))
.rejects.toThrow(/addressSpaceMb must be at most \d+ .*exact integer/)
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 1e100 }))
.rejects.toThrow(/cpuSeconds must be at most \d+ .*exact integers/)
// The boundary values still load: the bound rejects what cannot be encoded,
// not everything large.
const okMb = await ctx.plugin(PythonCodeRuntime, { addressSpaceMb: Math.floor(Number.MAX_SAFE_INTEGER / (1024 * 1024)) })
await okMb.dispose()
const okCpu = await ctx.plugin(PythonCodeRuntime, { cpuSeconds: Number.MAX_SAFE_INTEGER - 1 })
await okCpu.dispose()
})
it('rejects an output cap whose payload could not cross the frame ceiling', async () => {
// The caps budget a payload that must arrive inside ONE fd-3 frame, and the
// 256 MiB framing ceiling is fixed. A larger cap is unsatisfiable rather
// than generous: a completion the cap admits arrives as an over-ceiling
// frame and fails the run as `worker-exit`, inverting the `output-limit`
// the cap describes. The bound is `(ceiling - envelope) / 6`, since a
// control character escapes to six bytes.
const admissible = Math.floor((256 * 1024 * 1024 - 64) / 6)
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, { maxLogBytes: admissible + 1 }))
.rejects.toThrow(/maxLogBytes must not exceed 44739232 .*fd-3 frame ceiling/)
await expect(ctx.plugin(PythonCodeRuntime, { maxValueBytes: admissible + 1 }))
.rejects.toThrow(/maxValueBytes must not exceed 44739232 .*fd-3 frame ceiling/)
// The boundary value itself loads: the bound is the largest cap a frame can
// still carry, not one below it.
const boundary = await ctx.plugin(PythonCodeRuntime, { maxValueBytes: admissible })
await boundary.dispose()
})
it('rejects a pythonBin that spawn() would throw on, at load', async () => {
// Both values pass the string schema and both make `spawn` throw
// SYNCHRONOUSLY from inside run() — ERR_INVALID_ARG_VALUE for the empty
// path, ERR_INVALID_ARG_TYPE for the NUL — so run() would REJECT instead of
// resolving the worker-exit the seam promises for a child that cannot
// start. Both are self-contained configuration errors, so they fail here.
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, { pythonBin: '' }))
.rejects.toThrow(/pythonBin must be a non-empty path without NUL bytes/)
await expect(ctx.plugin(PythonCodeRuntime, { pythonBin: 'py\u0000thon3' }))
.rejects.toThrow(/pythonBin must be a non-empty path without NUL bytes/)
})
it('rejects a timer budget setTimeout would silently clamp to 1 ms', async () => {
// Node stores a setTimeout delay as a signed 32-bit value and substitutes
// 1 ms for anything larger, inverting the knob's meaning: a huge maxWallMs
// would time every run out at once, and a huge graceMs would SIGKILL one
// millisecond after SIGTERM. Both must fail at load instead.
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: 2_147_483_648 }))
.rejects.toThrow(/maxWallMs must not exceed 2147483647/)
// graceMs is bounded by the close deadline's added margin, not by the raw
// timer maximum, because that sum is what gets armed.
await expect(ctx.plugin(PythonCodeRuntime, { graceMs: 2_147_481_648 }))
.rejects.toThrow(/graceMs must not exceed 2147481647/)
// The exact maxima still load.
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: 2_147_483_647, graceMs: 2_147_481_647 }))
.resolves.toBeDefined()
})
it('rejects loading this Unix-only backend on Windows', async () => {
// The bootstrap needs the POSIX `resource` module, a positional fd 3, and
// negative-PID process-group signals — none on Windows. The constructor
// must throw at load rather than register ctx.codeRuntime and defer the
// failure to the first run.
const original = process.platform
Object.defineProperty(process, 'platform', { value: 'win32', configurable: true })
try {
const ctx = new Context()
await expect(ctx.plugin(PythonCodeRuntime, {})).rejects.toThrow(/requires a Unix platform/)
} finally {
Object.defineProperty(process, 'platform', { value: original, configurable: true })
}
})
it('rejects a binding global that is not a Python identifier or is reserved', async () => {
const { runtime } = await setup()
await expect(runtime.run({
program: 'return 1',
bindings: [{ global: '1bad', functions: {} }],
})).rejects.toThrow(/is not a usable Python identifier/)
await expect(runtime.run({
program: 'return 1',
bindings: [{ global: 'class', functions: {} }],
})).rejects.toThrow(/is not a usable Python identifier/)
})
it('rejects duplicate binding namespaces', async () => {
const { runtime } = await setup()
await expect(runtime.run({
program: 'return 1',
bindings: [
{ global: 'tools', functions: {} },
{ global: 'tools', functions: {} },
],
})).rejects.toThrow(/duplicate binding global/)
})
it('rejects run() after disposal, and unregisters ctx.codeRuntime', async () => {
const { ctx, fiber, runtime } = await setup()
await fiber.dispose()
await expect(runtime.run({ program: 'return 1', bindings: [] }))
.rejects.toThrow(/after disposal/)
expect(ctx.get('codeRuntime')).toBeUndefined()
})
it('short-circuits when the request signal is already aborted', async () => {
const { runtime } = await setup()
const signal = AbortSignal.abort('already-cancelled')
const result = await runtime.run({ program: 'return 1', bindings: [], signal })
expect(result.error?.kind).toBe('abort')
expect(result.error?.message).toContain('already-cancelled')
expect(result.logs).toEqual([])
})
it('short-circuits on an already-aborted signal whose reason cannot be converted', async () => {
// The pre-flight arm converted the reason with a bare `String()`, so a
// hostile reason threw out of `run()` — the seam promises to reject only for
// misuse, and a caller's cancellation token is not misuse.
const { runtime } = await setup()
const signal = AbortSignal.abort({
[Symbol.toPrimitive]() { throw new Error('reason blew up') },
})
const result = await runtime.run({ program: 'return 1', bindings: [], signal })
expect(result.error?.kind).toBe('abort')
expect(result.error?.message).toBe('<unrenderable rejection value>')
expect(result.logs).toEqual([])
})
it('runs the interpreter from materialized scripts outside the package, and removes them per run', async () => {
// The interpreter is an EXTERNAL process, so it can only open paths the OS
// resolves. Inside the single-file Python-SDK executable the packaged `py/`
// directory lives in pkg's virtual filesystem, which Node reads through its
// patched `fs` but `python3` cannot see, so spawning from that path fails
// with ENOENT. The scripts are therefore copied to a real directory first.
//
// The path is read from the child's own `__main__` module, so it proves
// where the interpreter actually loaded the entry script — asserting on a
// host-side constant would only restate the source. The program namespace
// seeds `__name__` but no `__file__`, hence the module lookup.
// `protocol.py` must land in the SAME directory, since `bootstrap.py` puts
// its own directory on `sys.path` to import it; the run completing at all
// already exercises that import.
const { runtime } = await setup()
const entryOf = async (): Promise<string> => {
const result = await runtime.run({ program: 'import sys\nreturn sys.modules["__main__"].__file__', bindings: [] })
expect(result.error).toBeUndefined()
return result.value as string
}
const entry = await entryOf()
expect(entry.endsWith('/bootstrap.py')).toBe(true)
const dir = dirname(entry)
expect(dir.startsWith(realpathSync(tmpdir()))).toBe(true)
expect(dir).not.toContain('/packages/')
// Staging is per RUN and removed at settlement, so by the time `run()`
// resolved the directory is already gone — nothing survives to be rewritten
// by a later run. `protocol.py` had to be beside the entry script for the run
// to complete at all, since `bootstrap.py` imports it off `sys.path`.
expect(existsSync(dir)).toBe(false)
// A second run stages its own copy rather than reusing the first.
expect(dirname(await entryOf())).not.toBe(dir)
})
it('contains a program that rewrites its own bootstrap to the run that did it', async () => {
// The child runs as the same UID as the host, so `0o700` does not stop model
// code from rewriting the scripts it was started from —
// `sys.modules['__main__'].__file__` names them. While all runs shared one
// staged copy, a program that overwrote `bootstrap.py` broke the NEXT run
// (measured: it settled as `worker-exit`), and substituted code would have
// run before the resource limits were applied.
const { runtime } = await setup({ maxWallMs: 10_000 })
const sabotage = await runtime.run({
program: [
'import sys',
'path = sys.modules["__main__"].__file__',
'open(path, "w").write("raise SystemExit(1)\\n")',
'return path',
].join('\n'),
bindings: [],
})
expect(sabotage.error).toBeUndefined()
// The damage stayed inside the run that caused it.
const after = await runtime.run({ program: 'return 1 + 1', bindings: [] })
expect(after.error).toBeUndefined()
expect(after.value).toBe(2)
}, 20_000)
it('leaves no subprocess or scripts behind when disposal races the first run', async () => {
// Staging runs SYNCHRONOUSLY so no async boundary opens between `run()` and
// the point where `execute` registers the run in `live` and installs the
// abort listener. With an `await` there, a disposal landing in that window
// saw an empty `live`, returned, removed the script directory, and let the
// continuation spawn a subprocess after the fiber was gone.
//
// `dispose()` is called in the same synchronous turn as `run()`, with no
// `await` between them, so it lands exactly in that window.
//
// The leak assertion compares before and after rather than requiring an
// empty tmpdir: other tests in this file build runtimes they never dispose,
// so only the directories this test adds are its own evidence.
const staged = (): string[] =>
readdirSync(realpathSync(tmpdir())).filter(name => name.startsWith('dsh-code-runtime-python-'))
const before = new Set(staged())
const { fiber, runtime } = await setup({ maxWallMs: 8_000 })
const pending = runtime.run({ program: 'import time\nwhile True: time.sleep(0.1)', bindings: [] })
const disposed = fiber.dispose()
const result = await pending
await disposed
// Whatever the run reports, it must be terminal and must not be a success.
expect(result.value).toBeUndefined()
expect(['abort', 'worker-exit', 'timeout']).toContain(result.error?.kind)
// Disposal is to quiescence, so this run's directory is gone once it
// resolves, and nothing recreated it afterwards.
expect(staged().filter(name => !before.has(name))).toEqual([])
}, 15_000)
it('settles as abort when the signal fires in the same turn as the first run', async () => {
// Same window, the other listener. `addEventListener('abort')` does not
// replay an event that already fired, so an abort landing before the
// listener was installed used to be missed entirely and the program ran to
// success or the wall ceiling instead of resolving as `abort`. Synchronous
// staging keeps the pre-flight check and the listener in one turn, leaving
// no gap for the signal to slip through.
const { runtime } = await setup({ maxWallMs: 4_000, graceMs: 200 })
const controller = new AbortController()
const pending = runtime.run({
program: 'import time\nwhile True: time.sleep(0.1)',
bindings: [],
signal: controller.signal,
})
controller.abort('same-turn-abort')
const result = await pending
expect(result.error?.kind).toBe('abort')
expect(result.error?.message).toContain('same-turn-abort')
}, 15_000)
it('reports a staging failure as worker-exit instead of rejecting run()', async () => {
// Staging touches the filesystem, so it can fail for reasons that are not
// the caller's doing: a full or read-only temp filesystem, or a deployment
// that failed to ship the packaged scripts. Those are SUBSTRATE failures,
// the same class as a child that cannot start, and the seam reserves
// rejection for misuse — so `run()` must resolve, not throw.
//
// `TMPDIR` is the honest lever: `mkdtempSync` builds its path from
// `os.tmpdir()`, so pointing it at a path that is not a directory makes the
// real call fail without stubbing the module under test.
const previous = process.env.TMPDIR
const notADirectory = join(await mkdtemp(join(tmpdir(), 'dsh-staging-')), 'file')
await writeFile(notADirectory, '')
process.env.TMPDIR = notADirectory
try {
const { runtime } = await setup()
const result = await runtime.run({ program: 'return 1', bindings: [] })
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain('failed to stage the python bootstrap')
expect(result.logs).toEqual([])
} finally {
if (previous === undefined) delete process.env.TMPDIR
else process.env.TMPDIR = previous
}
})
it('leaves no staging directory behind when a script copy fails', async () => {
// `mkdtempSync` succeeding and a later `copyFileSync` failing is its own
// case: the directory exists but is only partially populated. Recording it
// before the copies would leak it, because `run` retries staging on the next
// call and overwrites the single recorded path — teardown could then remove
// only the newest attempt. Staging must clean up its own partial directory.
//
// Only `copyFileSync` is stubbed, and only for the second script, so
// `mkdtempSync` really runs and the directory under assertion is real.
const staged = (): string[] =>
readdirSync(realpathSync(tmpdir())).filter(name => name.startsWith('dsh-code-runtime-python-'))
const before = new Set(staged())
failNextCopyOf.value = 'protocol.py'
try {
const { runtime } = await setup()
const result = await runtime.run({ program: 'return 1', bindings: [] })
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain('failed to stage the python bootstrap')
// The partial directory is gone, so nothing accumulates across retries.
expect(staged().filter(name => !before.has(name))).toEqual([])
} finally {
failNextCopyOf.value = undefined
}
}, 15_000)
})
describe('PythonCodeRuntime — inherited resource limits', () => {
it('runs under an inherited hard limit tighter than addressSpaceMb', async () => {
// An unprivileged process may lower a hard rlimit but never raise it. Under
// a harness started with `ulimit -v` below `addressSpaceBytes`, requesting
// the configured cap made `setrlimit` raise `ValueError` and every run
// returned a bootstrap exception — even though the inherited limit is
// STRONGER than the one asked for. The bootstrap clamps to the inherited
// hard limit instead, so the run proceeds under the stricter bound.
//
// `pythonBin` is the honest lever: a wrapper that lowers RLIMIT_AS and then
// execs the real interpreter reproduces the inherited-limit condition
// without touching this test process's own limits.
const dir = await mkdtemp(join(tmpdir(), 'dsh-rlimit-'))
const wrapper = join(dir, 'python3-capped')
// 256 MiB, half the 512 MiB addressSpaceMb default, so the requested cap is
// unambiguously above the inherited ceiling.
await writeFile(wrapper, '#!/bin/sh\nulimit -v 262144\nexec python3 "$@"\n', { mode: 0o755 })
const { runtime } = await setup({ pythonBin: wrapper })
const result = await runtime.run({
program: 'import resource\nreturn resource.getrlimit(resource.RLIMIT_AS)[1]',
bindings: [],
})
expect(result.error).toBeUndefined()
// The applied hard limit is the inherited one, not the configured 512 MiB.
expect(result.value).toBe(256 * 1024 * 1024)
}, 15_000)
it('applies the configured limits when nothing tighter is inherited', async () => {
// The clamp must not weaken the normal path: with an infinite inherited hard
// limit there is nothing to clamp against, and RLIM_INFINITY compares as -1,
// so treating it as a numeric bound would collapse every limit to -1.
const { runtime } = await setup({ cpuSeconds: 42, addressSpaceMb: 400 })
const result = await runtime.run({
// `getrlimit` returns a tuple, which the lossless-JSON completion check
// rejects; the pair is listed explicitly rather than converted.
program: 'import resource\ncpu = resource.getrlimit(resource.RLIMIT_CPU)\nreturn [cpu[0], cpu[1], resource.getrlimit(resource.RLIMIT_AS)[1]]',
bindings: [],
})
expect(result.error).toBeUndefined()
// Soft at cpuSeconds, hard at +1 (the SIGKILL backstop), address space at
// the configured megabytes — exactly what the unclamped path applied.
expect(result.value).toEqual([42, 43, 400 * 1024 * 1024])
}, 15_000)
})
describe('PythonCodeRuntime — programs and bindings', () => {
it('runs a top-level script, captures print output, and returns `result`', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: [
'x = 40',
'y = 2',
'print("hello", x + y)',
'return {"answer": x + y}',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual({ answer: 42 })
// `print` in Python emits: text, ' ', text, '\n'. Concat the captured
// fragments and assert the model-visible message survives.
expect(result.logs.join('')).toContain('hello 42')
// 15s: this is usually the suite's first real subprocess — a cold python3
// start (interpreter + asyncio import) on a loaded CI runner can exceed
// the 5s default alone; later tests reuse the warm page cache.
}, 15_000)
it('bridges binding calls both ways and rejects the program-side call on a host rejection', async () => {
const { runtime } = await setup()
const calls: unknown[] = []
const result = await runtime.run({
program: [
'first = await tools.echo({"n": 1})',
'caught = ""',
'try:',
' await tools.fail({})',
'except RuntimeError as e:',
' caught = str(e)',
'return {"first": first, "caught": caught}',
].join('\n'),
bindings: tools({
echo: async (args) => { calls.push(args); return { echoed: args as CodeJsonValue } },
fail: async () => { throw new Error('nope') },
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual({ first: { echoed: { n: 1 } }, caught: 'nope' })
expect(calls).toEqual([{ n: 1 }])
})
it('still answers the call when the rejection value cannot be converted to a string', async () => {
// `messageOf` calls `String(error)`, which runs the value's own conversion,
// and this call site is a DETACHED async reply callback. A rejection whose
// `Symbol.toPrimitive` throws therefore escaped as an unhandled rejection:
// the reply frame was never written, the program stayed blocked on `await`,
// and the run degraded to a `maxWallMs` timeout (observed) — a host with no
// `unhandledRejection` listener would exit instead. The rejection must reach
// the program as an ordinary error carrying a fixed placeholder.
const { runtime } = await setup({ maxWallMs: 8_000 })
const result = await runtime.run({
program: [
'try:',
' await tools.hostile({})',
'except RuntimeError as e:',
' return "rejected: " + str(e)',
'return "no rejection"',
].join('\n'),
bindings: tools({
hostile: async () => {
throw { [Symbol.toPrimitive]() { throw new Error('toPrimitive blew up') } }
},
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('rejected: <unrenderable rejection value>')
}, 15_000)
it('still answers the call when an Error carries a cyclic value in place of its message', async () => {
// `Error.message` is typed `string` but is a plain writable property, so a
// rejection can carry any value there. Returning it verbatim handed a
// non-string to `sendReply`, breaching `encodeJsonPlain`'s JSON-plain
// precondition: a cyclic object grew the encoder stack until the host threw
// RangeError from the detached reply callback, so no reply frame was written
// and the run degraded to a `maxWallMs` timeout (observed). The conversion
// must contain it — `String()` on a cycle throws inside the guard and lands
// on the placeholder, so the program sees an ordinary error.
const { runtime } = await setup({ maxWallMs: 8_000 })
const result = await runtime.run({
program: [
'try:',
' await tools.hostile({})',
'except RuntimeError as e:',
' return "rejected: " + str(e)',
'return "no rejection"',
].join('\n'),
bindings: tools({
hostile: async () => {
const cyclic: { self?: unknown; [Symbol.toPrimitive]: () => string } = {
// A cycle alone is inert for `String()`; the throwing conversion is
// what proves the guard runs rather than the encoder.
[Symbol.toPrimitive]: () => { throw new Error('cyclic message') },
}
cyclic.self = cyclic
const error = new Error('placeholder')
// Writable per spec, so no cast is needed to install a non-string.
;(error as unknown as { message: unknown }).message = cyclic
throw error
},
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('rejected: <unrenderable rejection value>')
}, 15_000)
it('renders an Error whose message is a value with no JSON form', async () => {
// The non-cyclic arm. A number would not discriminate: `scalarJson` renders
// it as digits and the child `str()`s the field back, so it survives the
// wire either way. `undefined` is the value that separates the two orders —
// `scalarJson` emits a bare `undefined` token, so the reply line is not JSON
// at all, the child's parse drops the frame, and the program stays blocked
// on `await` until the wall ceiling (observed). Converting first sends the
// string "undefined", which the program receives as an ordinary rejection.
const { runtime } = await setup({ maxWallMs: 8_000 })
const result = await runtime.run({
program: [
'try:',
' await tools.absent({})',
'except RuntimeError as e:',
' return "rejected: " + str(e)',
'return "no rejection"',
].join('\n'),
bindings: tools({
absent: async () => {
const error = new Error('placeholder')
;(error as unknown as { message: unknown }).message = undefined
throw error
},
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('rejected: undefined')
}, 15_000)
it('runs a program with no await', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: 'return 2 + 2',
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe(4)
})
it('returns JSON null whether the program returns None or falls off the end', async () => {
// Python has no `undefined`: an async body that returns None and one that
// never returns both yield None, so both complete as an exact JSON null.
// (The worker/TS backend can tell `return undefined` from `return null`;
// Python cannot, and reporting null for both is the honest rendering.)
const { runtime } = await setup()
const explicit = await runtime.run({ program: 'return None', bindings: [] })
expect(explicit.error).toBeUndefined()
expect(explicit.value).toBeNull()
const noReturn = await runtime.run({ program: 'x = 1', bindings: [] })
expect(noReturn.error).toBeUndefined()
expect(noReturn.value).toBeNull()
})
it('settles with no value on a forged valueless done frame', async () => {
// The child always sends a value now (return None → JSON null), so a done
// frame with no value key can only be forged; the host settles it as a
// value-less completion rather than crashing on the absent field.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import os',
'os.write(3, b\'{"type":"done"}\\n\')',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBeUndefined()
})
it('coalesces print arguments into one log line, not per-write fragments', async () => {
// print("a","b") calls write() per arg/sep/newline; the stream must emit
// one logical line "a b" so Code Mode's join(newline) does not insert
// spurious blank lines. Two prints → exactly two entries, no empties.
const { runtime } = await setup()
const result = await runtime.run({
program: ['print("a", "b")', 'print("c")', 'return None'].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.logs).toEqual(['a b', 'c'])
})
it('flushes a print with no trailing newline', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: ['print("partial", end="")', 'return None'].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.logs).toEqual(['partial'])
})
it('fails a completion dict with a non-string key as invalid-output (no key coercion)', async () => {
// json.dumps would coerce {1: "a", "1": "b"} to a single "1" key, silently
// dropping data. The shape validator rejects it before encoding.
const { runtime } = await setup()
const result = await runtime.run({
program: 'return {1: "first", "1": "second"}',
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('invalid-output')
expect(result.error?.message).toContain('non-string dict key')
})
it('rejects a binding argument with a non-string dict key before dispatch', async () => {
const { runtime } = await setup()
let called = false
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.sink({1: "x"})',
'except RuntimeError as e:',
' caught = str(e)',
'return caught',
].join('\n'),
bindings: tools({ sink: async () => { called = true; return null } }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('lossless JSON')
expect(called).toBe(false)
})
it('fails a non-JSON completion value as invalid-output (no repr substitution)', async () => {
// A set is not lossless JSON. The old draft substituted repr(); the seam
// now requires refusing the run instead.
const { runtime } = await setup()
const result = await runtime.run({
program: 'return {1, 2, 3}',
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('invalid-output')
expect(result.error?.message).toContain('lossless JSON')
expect(result.error?.message).toContain('set')
})
it('fails a negative-zero completion value as invalid-output (sign bit is lossy over JSON)', async () => {
// JSON serialization turns -0.0 into 0 (or JS -0), silently changing the
// sign bit; the canonical lossless-JSON boundary rejects it, so the
// Python side must too — as a completion and as a binding argument.
const { runtime } = await setup()
const completion = await runtime.run({
program: 'return -0.0',
bindings: [],
})
expect(completion.error?.kind).toBe('invalid-output')
expect(completion.error?.message).toContain('negative zero')
const argument = await runtime.run({
program: [
'try:',
' await tools.echo(-0.0)',
' return "accepted"',
'except RuntimeError as e:',
' return str(e)',
].join('\n'),
bindings: tools({ echo: async args => args as never }),
})
expect(argument.error).toBeUndefined()
expect(argument.value).toContain('negative zero')
})
it('fails a NaN completion value as invalid-output (allow_nan=False)', async () => {
// json.dumps would happily emit NaN by default, but NaN is not JSON; the
// bootstrap passes allow_nan=False so it fails as invalid-output.
const { runtime } = await setup()
const result = await runtime.run({
program: 'return float("nan")',
bindings: [],
})
expect(result.error?.kind).toBe('invalid-output')
})
it('fails an over-budget completion value as output-limit (child-side check)', async () => {
const { runtime } = await setup({ maxValueBytes: 64 })
const result = await runtime.run({
program: 'return "V" * 5000',
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('output-limit')
expect(result.error?.message).toContain('exceeded 64 bytes')
})
it('rejects a wide completion as output-limit before materializing its traversal state', async () => {
// `[0] * 2000000` sits far above maxValueBytes but well below the frame
// ceiling. The folded checker must reject it via the pre-enqueue bound —
// BEFORE pushing two million elements onto the walk — so a small
// addressSpaceMb does not turn the check itself into an RLIMIT_AS death.
const { runtime } = await setup({ maxValueBytes: 64, addressSpaceMb: 256, maxWallMs: 15_000 })
const result = await runtime.run({
program: 'return [0] * 2000000',
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('output-limit')
expect(result.error?.message).toContain('exceeded 64 bytes')
}, 20_000)
it('rejects a wide dict as output-limit without materializing its items list', async () => {
// Same pre-enqueue bound on the dict branch: `len(current)` replaces
// `list(current.items())`, which allocated one tuple per member before the
// bound could reject the value. Two million entries under a 64-byte cap
// fits the 256 MiB address space as a dict but not as a dict PLUS a
// two-million-tuple list.
const { runtime } = await setup({ maxValueBytes: 64, addressSpaceMb: 256, maxWallMs: 15_000 })
const result = await runtime.run({
program: 'return {str(i): 0 for i in range(2000000)}',
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('output-limit')
expect(result.error?.message).toContain('exceeded 64 bytes')
}, 20_000)
it('meters a float completion in the host\'s number spelling', async () => {
// CPython's repr disagrees with the host's String(number): `1.0` is three
// bytes here and one there, `1e-07` pads the exponent the host writes as
// `1e-7`. Both sides meter the SAME budget, so the child must count the
// bytes the host will receive — otherwise a boundary-sized value is
// falsely reported as output-limit.
const { runtime } = await setup({ maxValueBytes: 1 })
const integral = await runtime.run({ program: 'return 1.0', bindings: [] })
expect(integral.error).toBeUndefined()
expect(integral.value).toBe(1)
const exponent = await setup({ maxValueBytes: 4 })
const small = await exponent.runtime.run({ program: 'return 1e-7', bindings: [] })
expect(small.error).toBeUndefined()
expect(small.value).toBe(1e-7)
// The spelling is a meter input, not a licence to overshoot: `1.5` is three
// bytes on both sides and still fails a two-byte budget.
const tight = await setup({ maxValueBytes: 2 })
const over = await tight.runtime.run({ program: 'return 1.5', bindings: [] })
expect(over.error?.kind).toBe('output-limit')
})
it('carries floats across the wire in the host\'s number spelling', async () => {
// The child ENCODES with the same speller it meters with, so the frame the
// host parses must reproduce every double exactly — including the branches
// where CPython and ECMAScript disagree (integral floats, sub-1e-6
// exponents, >= 1e21, and beyond-safe-range integral doubles whose exact
// digits differ from the shortest round-trip form).
const { runtime } = await setup()
const result = await runtime.run({
program: 'return [1.0, 100.0, 1.5, 0.1, 1e-7, 1e-6, 1e-5, 123.456, -2.5e-8, 1e21, float(2**60), 5e-324, 1.7976931348623157e308]',
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual([1, 100, 1.5, 0.1, 1e-7, 1e-6, 1e-5, 123.456, -2.5e-8, 1e21, 2 ** 60, 5e-324, 1.7976931348623157e308])
})
it('rejects a forged non-lossless done value host-side as invalid-output', async () => {
// A forged done frame bypasses the child's _check_done_value. JSON.parse
// turns 1e400 into Infinity; validateChildFrame no longer scans done.value,
// so the host's own checkDoneValue must catch the non-lossless number.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import os',
String.raw`os.write(3, b'{"type":"done","value":1e400}' + b'\n')`,
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('invalid-output')
expect(result.error?.message).toContain('non-lossless number')
})
it('reports a syntax error as an exception without settling with a value', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: '$$invalid python$$',
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('SyntaxError')
expect(result.value).toBeUndefined()
})
it('reports a runtime raise as an exception with the traceback', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: 'raise ValueError("intentional")',
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('ValueError')
expect(result.error?.message).toContain('intentional')
})
it('bounds a deep exception cause chain instead of burning the wall budget formatting it', async () => {
// A chain thousands of links deep would make the rendering walk and
// format() linear in its length, consuming maxWallMs. Rendering is capped
// at 100 links with a marker; the run reports the exception well within
// budget rather than timing out.
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 20_000 })
const start = Date.now()
const result = await runtime.run({
program: [
'err = None',
'for i in range(3000):',
' try:',
' raise ValueError(i) from err',
' except ValueError as e:',
' err = e',
'raise err',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('exception chain truncated at 100 links')
expect(Date.now() - start).toBeLessThan(15_000)
}, 25_000)
it('bounds an over-cap chain without assigning to the live exception', async () => {
// The cap used to be applied by severing the over-cap link ON the live
// exception. An exception class overriding __setattr__ to raise turned that
// assignment into model code running inside the bootstrap's failure
// handler; the throw skipped the `done` send that sits after the handler,
// so the host blocked on fd 3 and reported a maxWallMs timeout instead of
// the model's own exception. Cutting the chain on the TracebackException
// COPY touches no model hook, so the marker still appears and the run
// reports `exception`.
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 15_000 })
const start = Date.now()
const result = await runtime.run({
program: [
'class Sealed(Exception):',
' def __setattr__(self, name, value):',
' raise RuntimeError("live mutation refused")',
'err = None',
'for i in range(150):',
' try:',
' raise Sealed(i) from err',
' except Sealed as e:',
' err = e',
'raise err',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('Sealed')
expect(result.error?.message).toContain('exception chain truncated at 100 links')
// The sever attempt is what used to leak: its message must not appear, and
// the run must settle well inside the wall budget rather than timing out.
expect(result.error?.message).not.toContain('live mutation refused')
expect(Date.now() - start).toBeLessThan(10_000)
}, 20_000)
it('still sends done when rendering the diagnostic itself raises', async () => {
// format() reaches the exception's own __str__, so a model class whose
// __str__ raises can throw from inside the failure handler. CPython's
// _safe_string absorbs a raising __str__ during formatting, but the
// fallback must hold for any throw on that path (a raising __repr__ of an
// argument, a MemoryError under RLIMIT_AS), so the assertion is the
// invariant that matters: a `done` frame carrying `exception`, never a
// timeout, and never the failing renderer's own message.
const { runtime } = await setup({ maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'class Unprintable(Exception):',
' def __str__(self):',
' raise RuntimeError("str refused")',
' def __repr__(self):',
' raise RuntimeError("repr refused")',
'raise Unprintable()',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('Unprintable')
expect(result.error?.message).not.toContain('str refused')
expect(result.error?.message).not.toContain('repr refused')
}, 15_000)
it('sends done with an inert diagnostic when the whole rendering path raises', async () => {
// Drive the fallback itself. `TracebackException.format` reads the
// exception class's `__module__` to decide whether to qualify the name, and
// a metaclass property can raise there — a throw INSIDE the formatter,
// reached with no rebinding of anything the bootstrap owns. Without the
// wrapper it escapes the handler, the `done` send never runs, and the host
// times out at maxWallMs.
const { runtime } = await setup({ maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'class Meta(type):',
' @property',
' def __module__(cls):',
' raise RuntimeError("renderer refused")',
'class Hostile(ValueError, metaclass=Meta):',
' pass',
'raise Hostile("original failure")',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
// The inert fallback names the class and a fixed literal; it must not carry
// the renderer's message, and must not have become a timeout. `__name__` is
// still a plain str here, so the class name survives.
expect(result.error?.message).toBe('Hostile: <diagnostic rendering failed>')
}, 15_000)
it('falls back to a placeholder class name when __name__ itself raises', async () => {
// The fallback reads type(exc).__name__, which a metaclass property can
// hijack. It must neither run that override's failure into the handler nor
// format a non-str __name__ into the message. The hostile `__module__` is
// what drives execution into the fallback in the first place.
const { runtime } = await setup({ maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'class Meta(type):',
' @property',
' def __module__(cls):',
' raise RuntimeError("renderer refused")',
' @property',
' def __name__(cls):',
' raise RuntimeError("name refused")',
'class Nameless(Exception, metaclass=Meta):',
' pass',
'raise Nameless()',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toBe('<unknown>: <diagnostic rendering failed>')
}, 15_000)
it('reports the real exception when the program rebinds every name the failure path uses', async () => {
// The bootstrap IS __main__, so `import __main__; __main__._X = ...` reaches
// any module global a call-time lookup would read. The failure path is the
// worst place for that: the reporter, the byte cap, the traceback formatter,
// the settlement flush and the `done` send all run AFTER the `except` block,
// so a replacement that raises skips the send, leaves the host blocked on
// fd 3, and the run reports a maxWallMs timeout instead of the model's own
// exception. Rebind all of them at once; the run must still carry the real
// ValueError.
const { runtime } = await setup({ maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'import __main__',
'def boom(*a, **k):',
' raise RuntimeError("hijacked")',
'__main__._SAFE_MODEL_TRACEBACK = boom',
'__main__._cap_message = boom',
'__main__._model_traceback = boom',
'__main__._UNRENDERABLE_DIAGNOSTIC = boom',
'__main__._LogStream.flush_line = boom',
'__main__.ProtocolChannel.send_sync = boom',
'raise ValueError("real failure")',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('ValueError: real failure')
expect(result.error?.message).not.toContain('hijacked')
}, 15_000)
it('bounds an over-cap exception-group nesting on the copy', async () => {
// Exception groups link through `exceptions`, not the cause/context
// dunders, so the cap has to count that edge too — otherwise a deeply
// nested group walks past the bound the marker claims to enforce.
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'group = ValueError("leaf")',
'for i in range(150):',
' group = ExceptionGroup(f"g{i}", [group])',
'raise group',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('exception chain truncated at 100 links')
}, 20_000)
it('filters every bootstrap frame from the traceback of an uncaught binding rejection', async () => {
// A rejection re-raised by the bootstrap's dispatch adds bootstrap frames
// AFTER the model's own; only <model> frames may reach model-visible,
// durable output — a bootstrap.py path would leak host absolutes and make
// transcripts machine-dependent.
const { runtime } = await setup()
const result = await runtime.run({
program: 'await tools.boom({})',
bindings: tools({ boom: async () => { throw new Error('exploded') } }),
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('exploded')
expect(result.error?.message).toContain('<model>')
expect(result.error?.message).not.toContain('bootstrap.py')
})
it('renders a non-Error thrown value from a host binding as its String form', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.failRaw({})',
'except RuntimeError as e:',
' caught = str(e)',
'return caught',
].join('\n'),
bindings: tools({
failRaw: async () => { throw 'raw-nope' },
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('raw-nope')
})
it('reassembles a frame split across writes behind a completed one', async () => {
// One os.write carrying "<frame>\n<partial...>" leaves a non-empty
// residual after the newline loop; the tail must survive until its own
// newline arrives and then parse as a normal frame.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import os, json',
'head = json.dumps({"type":"log","text":"first"}).encode()',
'tail = json.dumps({"type":"log","text":"second"}).encode()',
'import time',
'os.write(3, head + b"\\n" + tail[:5])',
'time.sleep(0.2)',
'os.write(3, tail[5:] + b"\\n")',
'return "ok"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('ok')
expect(result.logs).toContain('first')
expect(result.logs).toContain('second')
})
it('raises the declared errorClass with the member name on rejection', async () => {
// Code Mode declares { name: ToolCallError, memberNameProperty: toolName };
// a host rejection must surface as that class, carrying the failed tool.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.fail({})',
'except ToolCallError as e:',
' caught = f"{type(e).__name__}:{e.toolName}:{e}"',
'return caught',
].join('\n'),
bindings: [{
global: 'tools',
functions: { fail: async () => { throw new Error('typed-nope') } },
errorClass: { name: 'ToolCallError', memberNameProperty: 'toolName' },
}],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('ToolCallError:fail:typed-nope')
})
it('rejects an errorClass name colliding with its namespace global at the seam', async () => {
const { runtime } = await setup()
await expect(runtime.run({
program: 'return 1',
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'tools', memberNameProperty: 'toolName' } }],
})).rejects.toThrow(/collides with another injected global/)
})
it('rejects a namespace global colliding with a runtime-owned name at the seam', async () => {
// `__dsh_main__` passes the identifier check, but exec()ing the generated
// wrapper would silently overwrite the binding after injection. `console`
// is the WORKER backend's slot — refused here too so a namespace list
// valid on one backend is valid on all.
const { runtime } = await setup()
// `__debug__` is refused for a different reason than a collision: CPython
// compiles a bare `__debug__` reference to the constant True and refuses to
// assign the name at compile time, so an injected global under it is
// unreachable from the program — accepted by the seam, unusable here.
for (const global of ['__dsh_main__', 'console', '__debug__']) {
await expect(runtime.run({
program: 'x = 1',
bindings: [{ global, functions: {} }],
})).rejects.toThrow(/collides with a runtime-owned global/)
}
})
it('accepts a non-identifier memberNameProperty and rejects only an empty one', async () => {
// The seam permits any non-empty own property except the reserved
// members; Python setattr/getattr carry exotic names like `tool-name`,
// and the worker backend accepts them, so this backend must too.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'try:',
' await tools.boom({})',
'except ToolCallError as e:',
' return getattr(e, "tool-name")',
].join('\n'),
bindings: [{
global: 'tools',
functions: { boom: async () => { throw new Error('nope') } },
errorClass: { name: 'ToolCallError', memberNameProperty: 'tool-name' },
}],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('boom')
await expect(runtime.run({
program: 'return 1',
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'ToolCallError', memberNameProperty: '' } }],
})).rejects.toThrow(/memberNameProperty must be a non-empty attribute name/)
})
it('resolves a basename pythonBin to an absolute path (runs a real program)', async () => {
// A bare `python3` basename must resolve against PATH and actually launch
// under the empty-env spawn — exercises the accessSync success branch.
const { runtime } = await setup({ pythonBin: 'python3' })
const result = await runtime.run({ program: 'return 7', bindings: [] })
expect(result.error).toBeUndefined()
expect(result.value).toBe(7)
})
it('spawns via an absolute python path resolved from a basename against PATH', async () => {
// resolvePythonBin turns the default basename into an absolute path before
// the empty-env spawn; a basename with no PATH match falls through to the
// normal ENOENT worker-exit rather than throwing.
const { runtime } = await setup({ pythonBin: 'definitely-no-such-python-xyz' })
const result = await runtime.run({ program: 'return 1', bindings: [] })
expect(result.error?.kind).toBe('worker-exit')
})
it('rejects a memberNameProperty naming a constrained BaseException attribute', async () => {
// `__dict__`/`__class__` are constrained descriptors alongside
// `__traceback__` — setattr of a string raises TypeError while
// constructing the rejection — so every dunder is refused at the seam.
const { runtime } = await setup()
// name/message/stack are the seam's own exclusions (CodeBindingErrorClass
// forbids replacing them; the worker backend rejects them identically).
for (const member of ['__traceback__', '__dict__', '__class__', 'args', 'name', 'message', 'stack']) {
await expect(runtime.run({
program: 'return 1',
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'ToolCallError', memberNameProperty: member } }],
})).rejects.toThrow(/reserved error member/)
}
})
it('rejects a lossy binding resolution (NaN) instead of coercing it to null', async () => {
// JSON.stringify would turn NaN into null and drop undefined fields; the
// seam requires a descriptive rejection so data cannot silently corrupt.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.bad({})',
'except RuntimeError as e:',
' caught = str(e)',
'return caught',
].join('\n'),
bindings: tools({ bad: async () => Number.NaN }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('lossless JSON')
})
it('contains a forged pathological done value without crashing the host', async () => {
// A ~20k-deep nested array forged onto fd 3 would overflow a recursive
// JSON.stringify; the host's iterative encoder measures it stack-safely
// and fails it deterministically on the byte budget (40 kB > 32 KiB).
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import os, json',
'depth = 20000',
'payload = "[" * depth + "]" * depth',
'os.write(3, b\'{"type":"done","value":\' + payload.encode() + b\'}\\n\')',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('output-limit')
})
it('preserves a deeply nested completion value below the byte budget', async () => {
// CodeJsonValue has no depth limit: a 10000-deep nested list is only
// ~20 kB — under maxValueBytes — and must cross intact. That depth
// overflows BOTH recursive serializers the pipeline used to rely on
// (CPython's json.dumps recursion limit ~1000s, V8's JSON.stringify), so
// it proves the child-side _encode_json_plain and the host-side
// encodeJsonPlain together. The host JSON.parse of the frame is iterative
// in V8 for arrays, so only the two encoders were at risk.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'v = None',
'for _ in range(10000):',
' v = [v]',
'return v',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
// Walk down iteratively (a recursive toEqual would itself overflow).
let depth = 0
let cursor: unknown = result.value
while (Array.isArray(cursor)) {
expect(cursor).toHaveLength(1)
cursor = cursor[0]
depth++
}
expect(depth).toBe(10000)
expect(cursor).toBeNull()
})
it('bridges a deeply nested binding resolution back into the program stack-safely', async () => {
// A binding resolution has no seam-level depth or byte cap; neither the
// host's reply serialization nor the CHILD's reply decode may die on
// recursion (json.loads raises RecursionError ~10k levels deep; the
// bootstrap decodes frames iteratively). 12000 levels sits past that
// limit while staying tiny in bytes.
const { runtime } = await setup()
const deep = ((): unknown => {
let v: unknown = null
for (let i = 0; i < 12000; i++) v = [v]
return v
})()
const result = await runtime.run({
program: [
'v = await tools.deep({})',
'depth = 0',
'while isinstance(v, list):',
' v = v[0]',
' depth += 1',
'return depth',
].join('\n'),
bindings: tools({ deep: async () => deep as never }),
})
expect(result.error).toBeUndefined()
expect(result.value).toBe(12000)
})
it('rejects a reserved errorClass name at the seam', async () => {
const { runtime } = await setup()
await expect(runtime.run({
program: 'return 1',
bindings: [{
global: 'tools',
functions: {},
errorClass: { name: 'class', memberNameProperty: 'toolName' },
}],
})).rejects.toThrow(/errorClass.name "class" is not a usable Python identifier/)
})
it('routes a declared inherited-attribute name through the bridge via subscript', async () => {
// __class__ resolves on `object` before any fallback hook; the proxy's
// __getattribute__ intercepts declared names first, and subscript access
// is the SDK-advertised route for underscore names.
const { runtime } = await setup()
const seen: string[] = []
const result = await runtime.run({
program: [
'a = await tools["__class__"]({"via": "subscript"})',
'b = await tools.__class__({"via": "dot"})',
'return [a, b]',
].join('\n'),
bindings: tools({
'__class__': async () => { seen.push('called'); return 'bridged' },
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual(['bridged', 'bridged'])
expect(seen).toEqual(['called', 'called'])
})
it('rejects NaN binding arguments immediately instead of hanging', async () => {
// Default json.dumps would emit a non-standard NaN token that the host
// JSON.parse drops silently, hanging the call until the wall clock;
// allow_nan=False raises in-program right away.
const { runtime } = await setup({ maxWallMs: 8000 })
const start = Date.now()
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.echo({"x": float("nan")})',
'except RuntimeError as e:',
' caught = str(e)',
'return caught',
].join('\n'),
bindings: tools({ echo: async args => args as CodeJsonValue }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('lossless JSON')
expect(Date.now() - start).toBeLessThan(5000)
})
it('carries large binding arguments well past maxValueBytes', async () => {
// Binding traffic has no seam byte cap: a call frame far larger than the
// completion budget must reach the host intact (the fd-3 ceiling is a
// fixed memory-safety bound, not an output budget).
const maxValueBytes = 4096
const { runtime } = await setup({ maxValueBytes })
let receivedLength = 0
const result = await runtime.run({
program: [
`big = "B" * ${maxValueBytes * 50}`,
'r = await tools.measure({"payload": big})',
'return r',
].join('\n'),
bindings: tools({
measure: async (args) => {
receivedLength = ((args as { payload: string }).payload).length
return receivedLength
},
}),
})
expect(result.error).toBeUndefined()
expect(receivedLength).toBe(maxValueBytes * 50)
expect(result.value).toBe(maxValueBytes * 50)
})
it('rejects an unknown binding name inside the program with a matching error', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.nope({})',
'except (AttributeError, RuntimeError) as e:',
' caught = str(e)',
'return caught',
].join('\n'),
bindings: tools({ known: async () => 'ok' }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('nope')
})
it('bounds an unknown-binding diagnostic built from a forged call frame', async () => {
// `call.global` and `call.name` carry no byte cap of their own, only the
// 256 MiB fd-3 frame ceiling, and the reply interpolated them raw: one copy
// into the template result, one into the `JSON.stringify` escape, one into
// the `encodeJsonPlain` frame, one into the pipe write. Slicing each field
// to `maxValueBytes` code units first makes an 8 MiB forged name a
// 128-byte reply. The observable effect is the reply the child then has to
// READ: its fd-3 reader is unbuffered, so `readline` consumes an oversized
// reply one `read(2)` per byte and the run's own legitimate call never gets
// answered — measured under a 60 s ceiling, the 8 MiB case timed out and a
// 64 MiB case cost the host 509.9 MiB of heap against 120.3 MiB with the
// slices in place. The child's address space stays generous enough to BUILD
// the forgery, which is not what is under test.
const { runtime } = await setup({ maxValueBytes: 128, addressSpaceMb: 1024, maxWallMs: 20_000 })
const result = await runtime.run({
program: [
'import os',
'frame = b\'{"type":"call","id":9001,"global":"tools","name":"\' + b"n" * (8 * 1024 * 1024) + b\'","args":{}}\\n\'',
// One os.write returns short past the pipe buffer, and a partial frame
// would glue itself to the next one and be dropped as malformed, so the
// forgery goes out through a drain loop.
'view = memoryview(frame)',
'while view:',
' view = view[os.write(3, view):]',
// A legitimate call after the forgery: its reply can only arrive once
// the child has read past whatever the forged frame was answered with.
'await tools.known({})',
'return "settled"',
].join('\n'),
bindings: tools({ known: async () => 'ok' }),
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('settled')
}, 40_000)
it('bridges a binding call reached via subscript access (tools["name"])', async () => {
// The SDK tells the model `await tools["my-tool"](args)` works for exotic
// names; the proxy's __getitem__ must route it through the bridge.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'r = await tools["my-tool"]({"n": 7})',
'return r',
].join('\n'),
bindings: tools({ 'my-tool': async args => ({ got: args as CodeJsonValue }) }),
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual({ got: { n: 7 } })
})
it('raises KeyError for an undeclared subscript name', async () => {
const { runtime } = await setup()
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools["absent"]({})',
'except KeyError as e:',
' caught = str(e)',
'return caught',
].join('\n'),
bindings: tools({ known: async () => 'ok' }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('absent')
})
})
describe('PythonCodeRuntime — budgets, termination, disposal', () => {
it('kills a wall-clock runaway program via SIGTERM/SIGKILL and reports timeout', async () => {
const { runtime } = await setup({ maxWallMs: 500, graceMs: 200 })
const start = Date.now()
const result = await runtime.run({
program: 'import time\nwhile True: time.sleep(1)',
bindings: [],
})
const elapsed = Date.now() - start
// The wall timer may fire first or the exit-after-signal may resolve; both are ok.
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
// We got somewhere in the neighborhood of maxWallMs, not the underlying `sleep(1)`.
expect(elapsed).toBeLessThan(2000)
}, 5000)
it('aborts a run when the outer signal fires mid-flight', async () => {
const { runtime } = await setup({ maxWallMs: 10_000 })
const controller = new AbortController()
const settled: Promise<CodeRunResult> = runtime.run({
program: 'import time\nwhile True: time.sleep(0.1)',
bindings: [],
signal: controller.signal,
})
setTimeout(() => { controller.abort('outer-abort') }, 200)
const result = await settled
expect(['abort', 'worker-exit']).toContain(result.error?.kind)
}, 5000)
it('settles the run when a mid-flight abort reason cannot be converted', async () => {
// The listener converted the reason before calling `finish()`, so a hostile
// reason threw from inside an `AbortSignal` listener. Node reports that as an
// uncaught exception — it can terminate the host — and `finish()` never ran,
// so the run stayed live until the wall ceiling and misreported as `timeout`
// (observed) instead of the caller's cancellation. `maxWallMs` is short so
// that misreport is a fast assertion failure rather than a suite timeout.
const uncaught: unknown[] = []
const record = (error: unknown): void => { uncaught.push(error) }
process.on('uncaughtException', record)
try {
const { runtime } = await setup({ maxWallMs: 4_000, graceMs: 200 })
const controller = new AbortController()
const settled: Promise<CodeRunResult> = runtime.run({
program: 'import time\nwhile True: time.sleep(0.1)',
bindings: [],
signal: controller.signal,
})
setTimeout(() => {
controller.abort({ [Symbol.toPrimitive]() { throw new Error('reason blew up') } })
}, 200)
const result = await settled
expect(result.error?.kind).toBe('abort')
expect(result.error?.message).toBe('<unrenderable rejection value>')
expect(uncaught).toEqual([])
} finally {
process.off('uncaughtException', record)
}
}, 15_000)
it('disposes to quiescence: an in-flight run resolves as abort and the child exits', async () => {
const { fiber, runtime } = await setup({ maxWallMs: 10_000 })
const pending = runtime.run({
program: 'import time\nwhile True: time.sleep(0.1)',
bindings: [],
})
// Give the process time to spawn and start running.
await new Promise(resolve => setTimeout(resolve, 200))
await fiber.dispose()
const result = await pending
expect(['abort', 'worker-exit']).toContain(result.error?.kind)
}, 5000)
it('reports a spawn failure via a bogus python binary as worker-exit', async () => {
const { runtime } = await setup({ pythonBin: '/nonexistent/python-binary', maxWallMs: 3000 })
const result = await runtime.run({
program: 'return 1',
bindings: [],
})
expect(result.error?.kind).toBe('worker-exit')
}, 8000)
it('applies the strictest of the configured and inherited resource limits', async () => {
// This case used to drive the bootstrap's `applying resource limits failed`
// handler with `cpuSeconds: 2 ** 63`, asserting that a cap the child cannot
// apply fails the run rather than running it uncapped. That premise no longer
// holds, for two independent reasons, so the test now pins what is actually
// guaranteed instead of a path no admissible input reaches.
//
// First, `2 ** 63` is not a safe integer, so it is now rejected at LOAD as a
// configuration error — it can never reach the child at all. Second, even the
// largest admissible values are applied successfully, because `_clamped`
// bounds every requested pair by the inherited hard limit: an unprivileged
// process may lower a hard limit but never raise one, so the child keeps the
// stricter of the two rather than asking for something `setrlimit` refuses.
// The failure handler remains as a substrate guard (a platform whose kernel
// refuses the call for its own reasons), but it is no longer reachable from
// configuration, and a test that pretends otherwise documents a contract the
// code does not have.
//
// What is observable: a very large cap still yields a working run, and the
// containment it promises is met by the inherited ceiling.
const { runtime } = await setup({ cpuSeconds: Number.MAX_SAFE_INTEGER - 1, maxWallMs: 10_000 })
const result = await runtime.run({ program: 'return 1', bindings: [] })
expect(result.error).toBeUndefined()
expect(result.value).toBe(1)
}, 20_000)
it('settles as worker-exit when the child exits before sending done (no hang)', async () => {
// Regression: settlement must key off `close` (process reaped AND stdio
// drained), not `exit`. With `exit`, finish() re-armed a second exit
// listener that never fired — run() hung forever whenever the exit event
// beat the final fd-3 data (deterministic on macOS, a lost race elsewhere).
const { runtime } = await setup({ maxWallMs: 10_000 })
const result = await runtime.run({
program: 'import os\nos._exit(7)',
bindings: [],
})
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain('code=7')
}, 5000)
it('classifies RLIMIT_CPU soft-limit expiry (SIGXCPU) as a timeout', async () => {
// A CPU hot loop burns the soft limit; the kernel delivers SIGXCPU, whose
// close signal the host maps to `timeout`. macOS re-delivers SIGXCPU
// differently, so we assert only kind/message here — CI's darwin leg
// validates real delivery. cpuSeconds must be an integer for setrlimit.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 20_000 })
const result = await runtime.run({
program: 'while True: pass',
bindings: [],
})
expect(result.error?.kind).toBe('timeout')
expect(result.error?.message).toContain('CPU budget')
}, 8000)
it('keeps an early self-inflicted SIGKILL a worker-exit, not a CPU timeout', async () => {
// The unsolicited-SIGKILL-as-timeout classification applies only when the
// CPU budget could have expired (wall time >= cpuSeconds). A SIGKILL
// seconds before that (cgroup OOM, an operator, os.kill) is substrate
// death and stays worker-exit per the orthogonal taxonomy.
const { runtime } = await setup({ cpuSeconds: 60, maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'import os, signal',
'os.kill(os.getpid(), signal.SIGKILL)',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain('SIGKILL')
})
it('charges a forked descendant against the run CPU budget', async () => {
// RLIMIT_CPU is per-process and every child inherits a FRESH budget, so a
// program that shells out multiplies `cpuSeconds` by the number of
// descendants it starts. Measured before the aggregate meter existed: with
// cpuSeconds 1, two sequential busy children burned 2.0 CPU-seconds
// (RUSAGE_CHILDREN) and the run still returned a SUCCESS completion. The
// settle-time check meters RUSAGE_SELF + RUSAGE_CHILDREN and converts the
// overrun into the same SIGXCPU the untrapped soft limit sends.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 30_000 })
const result = await runtime.run({
program: [
'import subprocess, sys',
'for _ in range(2):',
' subprocess.run([sys.executable, "-c", "import time\\nt=time.time()\\nwhile time.time()-t<1.2: pass"])',
'return "escaped the cpu budget"',
].join('\n'),
bindings: [],
})
// Darwin's SIGXCPU re-delivery differs, so accept either terminal
// classification; what must NOT happen is the completion crossing.
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
expect(result.value).toBeUndefined()
}, 40_000)
it('does not charge wall time or a cheap descendant against the CPU budget', async () => {
// The meter is CPU, not wall clock, and it must not fire on a child that
// burns almost nothing: a sleeping program and a trivial subprocess both
// have to complete normally, or the check would reject every program that
// shells out.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 30_000 })
const slept = await runtime.run({
program: 'import time\ntime.sleep(1.5)\nreturn "slept"',
bindings: [],
})
expect(slept.error).toBeUndefined()
expect(slept.value).toBe('slept')
const cheap = await runtime.run({
program: [
'import subprocess, sys',
'subprocess.run([sys.executable, "-c", "pass"])',
'return "cheap child"',
].join('\n'),
bindings: [],
})
expect(cheap.error).toBeUndefined()
expect(cheap.value).toBe('cheap child')
}, 40_000)
it('spends no part of addressSpaceMb on bootstrap machinery', async () => {
// RLIMIT_AS counts RESERVED address space, so anything the bootstrap maps
// for its own accounting is subtracted from the program's `addressSpaceMb`.
// A sampling thread for the descendant-CPU meter cost 72 MiB here (an 8 MiB
// stack plus a 64 MiB glibc per-thread malloc arena reservation) and turned
// the 2-million-entry dict rejection below into a MemoryError under a
// 256 MiB cap on a slower runner. Assert the child's own mappings directly
// rather than inferring the budget from a near-cap allocation, so the bound
// is read from /proc instead of from how much headroom one machine happens
// to have; 48 MiB is well above the ~30 MiB a bare interpreter maps and
// well below the 102 MiB the thread produced. `addressSpaceMb` itself is
// skipped on darwin (the dyld shared cache makes any practical cap
// unsettable) and /proc/self/maps does not exist there, so the mapping
// assertion is Linux-only; the completion path is checked everywhere.
const { runtime } = await setup({ maxValueBytes: 4096, addressSpaceMb: 256 })
const mapped = await runtime.run({
program: [
'import sys',
'if sys.platform != "linux":',
' return 0',
'total = 0',
'with open("/proc/self/maps") as handle:',
' for line in handle:',
' low, high = (int(part, 16) for part in line.split(" ", 1)[0].split("-"))',
' total += high - low',
'return total // (1024 * 1024)',
].join('\n'),
bindings: [],
})
expect(mapped.error).toBeUndefined()
expect(mapped.value).toBeLessThan(48)
}, 20_000)
it('spends no part of addressSpaceMb on the reply pump, across a binding await', async () => {
// The test above measures BEFORE the program yields, so it could not see the
// reply pump's cost: `loop.run_in_executor(None, read_frame)` created the
// default executor's first thread on the first `await tools.*`, and that
// thread's 8 MiB stack plus a 64 MiB glibc per-thread malloc arena are
// charged to RLIMIT_AS while the limit is already in force — measured, the
// child went from 30.34 MiB to 102.39 MiB across one binding call. Under a
// small `addressSpaceMb` the thread cannot start and a legitimate call hangs
// to `maxWallMs`; under a larger one an allocation that should have fit dies
// as MemoryError. `loop.add_reader` watches the fd with no thread at all.
//
// Measuring both sides inside one run is what discriminates: a single
// after-the-fact number cannot separate the pump's cost from the
// interpreter's own footprint. Linux-only for the same reason as above.
const { runtime } = await setup({ addressSpaceMb: 256, maxWallMs: 20_000 })
const result = await runtime.run({
program: [
'import sys',
'def mapped():',
' if sys.platform != "linux":',
' return 0',
' total = 0',
' with open("/proc/self/maps") as handle:',
' for line in handle:',
' low, high = (int(part, 16) for part in line.split(" ", 1)[0].split("-"))',
' total += high - low',
' return total // (1024 * 1024)',
'before = mapped()',
'echoed = await tools.echo({"ping": True})',
'return {"before": before, "after": mapped(), "echoed": echoed}',
].join('\n'),
bindings: tools({ echo: async args => args as CodeJsonValue }),
})
expect(result.error).toBeUndefined()
const value = result.value as { before: number; after: number; echoed: unknown }
// The binding call really happened, so the pump really ran.
expect(value.echoed).toEqual({ ping: true })
// Awaiting a binding maps nothing extra. The 8 MiB allowance absorbs ordinary
// heap growth while staying far below the 72 MiB a pump thread cost.
expect(value.after - value.before).toBeLessThan(8)
}, 30_000)
it('still terminates a program that ignores SIGXCPU (hard-limit backstop)', async () => {
// A hot loop under SIG_IGN burns through the soft limit; the kernel's
// hard limit (cpuSeconds + 1) SIGKILLs it. Only a kernel-authoritative
// SIGXCPU close classifies as the CPU timeout — a bare SIGKILL is
// indistinguishable from a cgroup OOM kill, so it reports worker-exit
// (Darwin re-delivers SIGXCPU instead, where the wall clock settles it
// as timeout). Either way the run TERMINATES within the budget — the
// backstop holds even when the classification is the opaque one.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 6_000 })
const result = await runtime.run({
program: [
'import signal',
'signal.signal(signal.SIGXCPU, signal.SIG_IGN)',
'while True: pass',
].join('\n'),
bindings: [],
})
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
}, 12_000)
it('enforces the CPU budget even when the program monkeypatches the enforcement primitives', async () => {
// The check uses import-time-captured references, so replacing
// resource.getrusage / signal.signal / os.kill on the modules cannot
// defang it: a trapping program that also swaps the callables and burns
// past the budget still dies by the authoritative SIGXCPU.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'import signal, os, resource, time',
'signal.signal(signal.SIGXCPU, lambda *a: None)',
'resource.getrusage = lambda *a: (_ for _ in ()).throw(RuntimeError("nope"))',
'os.kill = lambda *a: None',
'signal.signal = lambda *a: None',
'deadline = time.process_time() + 1.05',
'while time.process_time() < deadline: pass',
'return "escaped"',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('timeout')
expect(result.value).toBeUndefined()
}, 15_000)
it('re-delivers SIGXCPU when a trapping program returns inside the soft-to-hard gap', async () => {
// A program can trap SIGXCPU and settle during the one-second gap; the
// bootstrap re-checks the kernel CPU meter (getrusage) after settlement
// and dies by SIGXCPU with the default disposition restored, so the host
// still classifies the exhausted budget as a timeout instead of success.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'import signal, time',
'fired = []',
'signal.signal(signal.SIGXCPU, lambda *a: fired.append(1))',
'deadline = time.process_time() + 1.05',
'while time.process_time() < deadline: pass',
'return "escaped"',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('timeout')
expect(result.error?.message).toContain('CPU budget')
expect(result.value).toBeUndefined()
}, 15_000)
it('enforces the CPU budget when the program rebinds the enforcer on __main__', async () => {
// The bootstrap IS `__main__`, so `import __main__` reaches its globals.
// The enforcement callable holds its primitives in closure cells (not
// module attributes) and `_run` reads the callable into a frame local
// before the program starts, so neither replacing the global nor swapping
// the module's captured names changes what runs after settlement.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'import signal, time, __main__',
'signal.signal(signal.SIGXCPU, lambda *a: None)',
'__main__._DIE_IF_CPU_EXHAUSTED = lambda *_: None',
'deadline = time.process_time() + 1.05',
'while time.process_time() < deadline: pass',
'return "escaped"',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('timeout')
expect(result.value).toBeUndefined()
}, 15_000)
it('bounds a program that defeats the post-check by writing its closure cell', async () => {
// The closure-cell capture raises the cost of defeating the post-check; it
// does NOT make it unreachable, and nothing in-process could: a cell is
// writable through `fn.__closure__[i].cell_contents`, and `sys._getframe`
// reads _run's frame locals. This program does exactly that — walks to
// _run's frame, takes the enforcement callable, and replaces its captured
// `getrusage` with one reporting zero CPU used — then burns past cpuSeconds
// with SIGXCPU trapped. The run must still fail, because the bound that
// model code cannot forge is outside the interpreter: the RLIMIT_CPU HARD
// limit at cpuSeconds + 1, whose SIGKILL admits no handler. No success is
// reportable either way.
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 20_000 })
const start = Date.now()
const result = await runtime.run({
program: [
'import signal, sys, time',
'signal.signal(signal.SIGXCPU, lambda *a: None)',
// Walk out of __dsh_main__ to _run's frame and take its local.
'die = None',
'depth = 1',
'while depth < 12:',
' frame = sys._getframe(depth)',
' if "die_if_cpu_exhausted" in frame.f_locals:',
' die = frame.f_locals["die_if_cpu_exhausted"]',
' break',
' depth += 1',
'assert die is not None, "enforcer not reachable from the frame chain"',
'class Zero:',
' ru_utime = 0.0',
' ru_stime = 0.0',
'names = die.__code__.co_freevars',
'die.__closure__[names.index("getrusage")].cell_contents = lambda *a: Zero()',
// Burn well past the soft limit into the hard limit's SIGKILL.
'while True: pass',
].join('\n'),
bindings: [],
})
// What holds on EVERY platform: the tampering bought no success. The run
// failed, carried no value, and the reported kind is one of the two
// kernel-level outcomes — never a completion.
expect(result.value).toBeUndefined()
expect(result.error?.kind === 'worker-exit' || result.error?.kind === 'timeout').toBe(true)
if (process.platform === 'linux') {
// Linux enforces the RLIMIT_CPU HARD limit at cpuSeconds + 1 promptly, so
// the CPU bound — not the 20 s wall ceiling — is what stops the program.
// Its SIGKILL is not SIGXCPU, so the orthogonal-failure taxonomy reports
// `worker-exit`: a bare SIGKILL is not evidence of CPU burn.
expect(result.error?.kind).toBe('worker-exit')
expect(Date.now() - start).toBeLessThan(15_000)
} else {
// Darwin does not deliver the hard limit's SIGKILL on the same schedule;
// observed on the macOS lane, a program that patches the post-check runs
// to the WALL ceiling instead. The CPU budget is therefore not the
// binding constraint against a tampering program there — the wall clock
// is. Asserted rather than skipped so the difference stays visible.
expect(result.error?.kind).toBe('timeout')
}
}, 30_000)
it('keeps a finished-but-not-closed run live so dispose awaits the child\'s death', async () => {
// finish() no longer drops the run from `live`; settle() (at close) does.
// A SIGTERM-trapping program with a small graceMs sits in the grace window
// after finish() fires — dispose() must not resolve until the SIGKILL
// backstop actually reaps the child. The program prints its pid (captured
// as a log even on abort); once dispose() resolves, that pid must be dead
// (process.kill(pid, 0) throws ESRCH).
const { fiber, runtime } = await setup({ maxWallMs: 10_000, graceMs: 400 })
// Deterministic readiness: the program reports its pid through a binding
// AFTER installing the trap, so dispose cannot race the spawn (a fixed
// sleep lost that race on slow CI runners — SIGTERM landed pre-trap).
let reportedPid!: (pid: number) => void
const trapReady = new Promise<number>((resolve) => { reportedPid = resolve })
const pending = runtime.run({
program: [
'import signal, time, os',
'signal.signal(signal.SIGTERM, lambda *a: None)',
'await tools.ready({"pid": os.getpid()})',
'while True: time.sleep(0.05)',
].join('\n'),
bindings: tools({
ready: async (args) => {
reportedPid((args as { pid: number }).pid)
return 'ok'
},
}),
})
const pid = await trapReady
const start = Date.now()
await fiber.dispose()
const elapsed = Date.now() - start
const result = await pending
expect(['abort', 'worker-exit', 'timeout']).toContain(result.error?.kind)
// dispose() returned only after the grace window elapsed (the SIGTERM trap
// forces the SIGKILL backstop path), proving the run stayed live past finish().
expect(elapsed).toBeGreaterThanOrEqual(300)
expect(Number.isInteger(pid) && pid > 0).toBe(true)
// The child is fully reaped by the time dispose() resolved.
expect(() => process.kill(pid, 0)).toThrow(/ESRCH/)
}, 8000)
it('settles on the decided result even when a setsid-escaped orphan holds stdio open past close', async () => {
// `close` only fires once every inherited stdio stream drains. A descendant
// started with start_new_session=True escapes the child's process group, so
// the SIGTERM/SIGKILL aimed at that group never reaches it; if it inherited
// our stdout/stderr/fd 3 and outlives the run, `close` would never fire and
// run() would hang forever. The close-deadline backstop (graceMs + margin)
// must force settlement on the value the `done` frame already decided.
const { runtime } = await setup({ graceMs: 100 })
const start = Date.now()
const result = await runtime.run({
program: [
'import subprocess, sys',
// Orphan in a fresh session, inheriting our stdout/stderr/fd 3, alive
// well past the close-deadline so `close` cannot fire on its own.
'subprocess.Popen([sys.executable, "-c", "import time; time.sleep(10)"],',
' start_new_session=True)',
'return "escaped"',
].join('\n'),
bindings: [],
})
const elapsed = Date.now() - start
// The done frame decided the value; the deadline settled it despite the
// orphan pinning the pipes open.
expect(result.error).toBeUndefined()
expect(result.value).toBe('escaped')
// Settlement waited for the backstop (graceMs + CLOSE_REAP_MARGIN_MS ≈ 2.1s),
// not the wall-clock ceiling — proving the deadline, not the ceiling, fired.
expect(elapsed).toBeGreaterThanOrEqual(1_500)
expect(elapsed).toBeLessThan(5_000)
}, 8000)
})
describe('PythonCodeRuntime — hostile peer', () => {
it('drops garbage bytes and unknown-shape frames posted directly to fd 3', async () => {
// The model program can reach fd 3 and write anything. We inject a
// non-JSON line, a valid JSON but unknown-shape frame, and a broken done
// frame; the host must not crash, and the real `done` still settles the run.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import os',
'os.write(3, b"not-json\\n")',
'os.write(3, b\'{"type":"unknown"}\\n\')',
'os.write(3, b\'{"type":"done","error":{"message":42}}\\n\')',
'return "survived"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('survived')
})
it('answers a forged call frame for an unknown binding and never crashes', async () => {
// The unknown-binding reply path, driven through the id the host expects:
// the program lets its own first call claim id 0 and forges id 1, which the
// host answers with the `unknown binding` rejection the honest call would
// have received. A forged id out of sequence is dropped instead — that is
// the id-bound test below, not this one.
const { runtime } = await setup({ maxWallMs: 8_000 })
let seenLegitCall = false
const result = await runtime.run({
program: [
'import os, json',
'x = await tools.echo({"ping": True})',
'os.write(3, json.dumps({"type":"call","id":1,"global":"tools","name":"forged","args":{}}).encode() + b"\\n")',
// The forged frame is answered, but nothing in the child awaits id 1, so
// the reply is ignored and the run completes on its own value.
'return x',
].join('\n'),
bindings: tools({
echo: async (args) => { seenLegitCall = true; return args as CodeJsonValue },
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual({ ping: true })
expect(seenLegitCall).toBe(true)
}, 15_000)
it('drops forged call frames whose ids are not the next in sequence, retaining no per-id state', async () => {
// The host used to remember every answered id in a Set, so a program could
// write an unbounded run of unique forged ids — each frame far below the
// 256 MiB ceiling, so nothing rejected them — and grow host memory for the
// whole run. Ids are consecutive from 0, so one counter replaces the set.
//
// The discriminator is that the forgeries must not be answered. Each names a
// binding that does exist, so a host answering them would run `echo` once
// per forgery; the count proves only the legitimate call was dispatched.
// Ids also run DESCENDING, so a high-water-mark test would drop the honest
// call that follows rather than the forgeries.
const { runtime } = await setup()
let echoCalls = 0
const result = await runtime.run({
program: [
'import os, json',
'for i in range(2000, 0, -1):',
' os.write(3, json.dumps({"type":"call","id":i,"global":"tools","name":"echo","args":{"forged":i}}).encode() + b"\\n")',
'x = await tools.echo({"ping": True})',
'return x',
].join('\n'),
bindings: tools({
echo: async (args) => { echoCalls += 1; return args as CodeJsonValue },
}),
})
expect(result.error).toBeUndefined()
expect(result.value).toEqual({ ping: true })
expect(echoCalls).toBe(1)
}, 15_000)
it('keeps answering calls a program makes after one with unserializable arguments', async () => {
// The child claims an id only once its write succeeds, so a call rejected
// child-side for non-lossless arguments leaves no gap. Were a gap possible,
// the host's exact-successor test would drop every later call and the run
// would hang to the wall ceiling instead of completing.
const { runtime } = await setup({ maxWallMs: 8_000 })
const seen: unknown[] = []
const result = await runtime.run({
program: [
'caught = ""',
'try:',
' await tools.echo({"bad": float("inf")})',
'except RuntimeError as e:',
' caught = str(e)',
'after = await tools.echo({"ok": True})',
'return {"caught": caught, "after": after}',
].join('\n'),
bindings: tools({
echo: async (args) => { seen.push(args); return args as CodeJsonValue },
}),
})
expect(result.error).toBeUndefined()
const value = result.value as { caught: string; after: unknown }
expect(value.caught).toContain('lossless JSON')
expect(value.after).toEqual({ ok: true })
// The rejected call never reached the host; the one after it did.
expect(seen).toEqual([{ ok: true }])
}, 15_000)
it('drops a forged frame carrying an integer outside JavaScript safe range', async () => {
// JSON.parse would silently round 9007199254740993 to ...992 BEFORE any
// validation, corrupting a dispatched argument or completion. The host
// scans the raw line and drops such frames as hostile traffic; the honest
// child cannot produce one (its validator rejects unsafe ints).
const { runtime } = await setup()
let dispatched: unknown
const result = await runtime.run({
program: [
'import os',
// Forged call frame with an unsafe int argument, then a forged done
// frame with an unsafe int value — both must be dropped whole.
'os.write(3, b\'{"type":"call","id":7,"global":"tools","name":"echo","args":9007199254740993}\\n\')',
'os.write(3, b\'{"type":"done","value":9007199254740993}\\n\')',
'x = await tools.echo({"ok": True})',
'return x',
].join('\n'),
bindings: tools({
echo: async (args) => { dispatched = args; return args as CodeJsonValue },
}),
})
expect(result.error).toBeUndefined()
// The forged done did not settle the run; the legit call and completion did.
expect(result.value).toEqual({ ok: true })
expect(dispatched).toEqual({ ok: true })
})
it('truncates host-side logs once the budget is exhausted and emits the marker', async () => {
// Set a tiny host-side budget; the Python side has a much larger one, so
// its LogBuffer will not truncate — the host ledger fires first.
const { runtime } = await setup({ maxLogBytes: 32 })
const result = await runtime.run({
program: [
'for _ in range(50):',
' print("aaaaaaaaaa")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
const markers = result.logs.filter(line => line.includes('log capture truncated at 32 bytes'))
expect(markers.length).toBeGreaterThanOrEqual(1)
})
it('reports an exception whose message holds an unpaired surrogate instead of stranding to the wall clock', async () => {
// A strict UTF-8 encode of "\ud800" throws while BUILDING the failure
// frame; the run would then hang to maxWallMs and misreport as timeout.
const { runtime } = await setup({ maxWallMs: 8_000 })
const result = await runtime.run({
program: String.raw`raise Exception("bad \ud800 surrogate")`,
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('bad')
expect(result.error?.message).toContain('surrogate')
})
it('carries a lone-surrogate completion string across the wire as its JSON escape', async () => {
// UTF-8 has no encoding for a lone surrogate, but JSON does: the ASCII
// `\ud800` escape, which JSON.parse reads back as the same UTF-16 code
// unit. `CodeJsonValue`, `snapshotJsonValue`, and the worker backend all
// accept such a string, so this backend must not narrow the shared seam.
const { runtime } = await setup()
const result = await runtime.run({
program: String.raw`return {"lone": "a\ud800b", "spelled": "😀"}`,
bindings: [],
})
expect(result.error).toBeUndefined()
// The lone half survives as the code unit itself; a spelled-out high-low
// PAIR folds into the astral character the host would hold for it.
expect(result.value).toEqual({ lone: 'a\ud800b', spelled: '\u{1f600}' })
})
it('meters a lone surrogate at its six escaped bytes, matching the host', async () => {
// The child and the host share maxValueBytes, so the child must charge the
// escape's six ASCII bytes (plus two quotes): eight fits, nine does not.
const { runtime } = await setup({ maxValueBytes: 8 })
const ok = await runtime.run({ program: String.raw`return "\ud800"`, bindings: [] })
expect(ok.error).toBeUndefined()
expect(ok.value).toBe('\ud800')
const over = await setup({ maxValueBytes: 7 })
const result = await over.runtime.run({ program: String.raw`return "\ud800"`, bindings: [] })
expect(result.error?.kind).toBe('output-limit')
})
it('passes a lone-surrogate binding argument through instead of failing the call', async () => {
// The argument validator shared the same over-narrow rejection; a host
// binding must receive the code unit the program passed.
const seen: unknown[] = []
const { runtime } = await setup()
const result = await runtime.run({
program: String.raw`return await tools.echo({"text": "x\udfff"})`,
bindings: tools({ echo: async (args: unknown) => { seen.push(args); return args as CodeJsonValue } }),
})
expect(result.error).toBeUndefined()
expect(seen).toEqual([{ text: 'x\udfff' }])
expect(result.value).toEqual({ text: 'x\udfff' })
})
it('meters a non-ASCII completion in UTF-8 JSON bytes, matching the host', async () => {
// json.dumps' default \uXXXX escaping would count "é" as 8 bytes while
// the host meter counts its UTF-8 JSON form (4); the shared budget must
// agree, so a 4-byte-fitting value passes a maxValueBytes of 4.
const { runtime } = await setup({ maxValueBytes: 4 })
const ok = await runtime.run({ program: 'return "é"', bindings: [] })
expect(ok.error).toBeUndefined()
expect(ok.value).toBe('é')
const over = await runtime.run({ program: 'return "éx"', bindings: [] })
expect(over.error?.kind).toBe('output-limit')
})
it('filters bootstrap frames from exception-group members (TaskGroup)', async () => {
// Python 3.11+ stores member stacks under TracebackException.exceptions;
// the <model>-frame filter must recurse into them too.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import asyncio, sys',
'if sys.version_info < (3, 11):',
' raise ValueError("skip-old <model>")',
'async def boom():',
' raise ValueError("group-member")',
'async with asyncio.TaskGroup() as tg:',
' tg.create_task(boom())',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('<model>')
expect(result.error?.message).not.toContain('bootstrap.py')
})
it('keeps frames intact when a model thread floods logs while a large frame drains', async () => {
// os.write releases the GIL and a frame beyond PIPE_BUF is not atomic:
// without the writer lock + full-write loop, the printing thread could
// interleave bytes mid-frame and the host would drop the malformed JSON,
// hanging the run to the wall clock (or losing the completion).
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxLogBytes: 4 * 1024 * 1024, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'import threading',
'stop = False',
'def spam():',
' while not stop:',
' print("spam-line-" + "y" * 100)',
't = threading.Thread(target=spam)',
't.start()',
// A ~300 KiB completion — several PIPE_BUF units — while spam runs.
'big = "x" * (300 * 1024)',
'stop = True',
't.join()',
'return big',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('x'.repeat(300 * 1024))
}, 20_000)
it('settles cleanly while a daemon thread keeps writing unterminated log text', async () => {
// WARNING regression: the settlement `flush_out()/flush_err()` on the main
// coroutine read and clear `_LogStream._pending` and the shared LogBuffer
// ledger with NO lock, while a model daemon thread's `print`/`write` mutate
// the same state. Capturing the bound method (`out_stream.flush_line`) only
// fixes WHICH callable runs, not what it reads mid-flight: the flush could
// interleave with a concurrent write and join a `_pending` list being
// mutated under it, corrupting the ledger and costing the `done` frame — the
// run would then strand to the wall clock instead of completing. The shared
// re-entrant lock serializes them.
//
// A pure data race has no single bad input to reject deterministically, so
// this maximizes overlap: daemon threads emit UNTERMINATED writes (which
// pile into `_pending` rather than flushing per line) right up to the moment
// the body returns and settlement flushes. Repeated so the interleave lands.
for (let attempt = 0; attempt < 5; attempt++) {
const { runtime, fiber } = await setup({ maxLogBytes: 4 * 1024 * 1024, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'import sys, threading',
'stop = False',
'def spam():',
' while not stop:',
// No newline: the text accumulates in the stream's `_pending`, which is
// exactly the state the settlement flush also touches.
' sys.stdout.write("tail-fragment-" + "z" * 64)',
'workers = [threading.Thread(target=spam, daemon=True) for _ in range(4)]',
'for t in workers: t.start()',
// Let the daemons build up pending writes, then return so settlement
// flushes while they are still mid-write.
'import time; time.sleep(0.05)',
'return "settled"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('settled')
await fiber.dispose()
}
}, 30_000)
it('round-trips an exactly representable large integer through a binding echo', async () => {
// The reply serializer must print BigInt digits for a beyond-safe
// integral double: String(2**60) emits a rounded form, and the child
// would receive a DIFFERENT integer than the binding resolved.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'v = await tools.echo(2**60)',
'return v == 2**60',
].join('\n'),
bindings: tools({ echo: async args => args as never }),
})
expect(result.error).toBeUndefined()
expect(result.value).toBe(true)
})
it('preserves an exactly representable large integer and rejects a rounding one', async () => {
// The canonical boundary accepts every JS-double-exact value: 2**53 and
// 2**60 round-trip exactly and must cross (matching the worker backend);
// 2**53+1 rounds and must fail as invalid-output.
const { runtime } = await setup()
const exact = await runtime.run({ program: 'return [2**53, 2**60]', bindings: [] })
expect(exact.error).toBeUndefined()
expect(exact.value).toEqual([2 ** 53, 2 ** 60])
const lossy = await runtime.run({ program: 'return 2**53 + 1', bindings: [] })
expect(lossy.error?.kind).toBe('invalid-output')
expect(lossy.error?.message).toContain('not exactly representable')
})
it('rejects a container subclass whose overridden methods hide its contents', async () => {
// A dict subclass returning [] from items() passes an isinstance check but
// serializes as {}, so the host would receive a value the program did not
// compute. Exact-type matching fails it as invalid-output instead. The
// worker backend rejects the prototype-equivalent shapes the same way.
const { runtime } = await setup()
const hidden = await runtime.run({
program: [
'class Sneaky(dict):',
' def items(self): return []',
' def keys(self): return []',
' def __iter__(self): return iter([])',
' def __len__(self): return 0',
'return Sneaky(secret="kept")',
].join('\n'),
bindings: [],
})
expect(hidden.error?.kind).toBe('invalid-output')
expect(hidden.error?.message).toContain('unsupported type (Sneaky)')
// A list subclass is refused on the same rule.
const listish = await runtime.run({
program: ['class L(list):', ' def __iter__(self): return iter([])', 'return L([1, 2, 3])'].join('\n'),
bindings: [],
})
expect(listish.error?.kind).toBe('invalid-output')
expect(listish.error?.message).toContain('unsupported type (L)')
// The exact built-in containers still cross unchanged.
const plain = await runtime.run({ program: 'return {"secret": [1, 2]}', bindings: [] })
expect(plain.error).toBeUndefined()
expect(plain.value).toEqual({ secret: [1, 2] })
})
it('rejects a scalar subclass whose overrides disagree with what gets serialized', async () => {
// The validators checked scalars with isinstance, so a subclass passed
// every check by its real value while the ENCODER read an override — the
// host then received a value the walk never approved. Each case below is a
// distinct override reaching a distinct reader.
const { runtime } = await setup()
// _dump_float spells a float from repr(value), so an overridden __repr__
// decides the digits: F(2.5) serialized as 1.
const floated = await runtime.run({
program: [
'class F(float):',
' def __repr__(self): return "1.0"',
'return F(2.5)',
].join('\n'),
bindings: [],
})
expect(floated.error?.kind).toBe('invalid-output')
expect(floated.error?.message).toContain('unsupported type (F)')
// The JS-safe-range bound is two comparisons, so overriding them admits an
// int whose true digits (json.dumps reads the C-level value) the host's
// JSON.parse rounds: 9007199254740993 arrives as ...992.
const inted = await runtime.run({
program: [
'class I(int):',
' def __gt__(self, other): return False',
' def __lt__(self, other): return False',
'return I(2 ** 53 + 1)',
].join('\n'),
bindings: [],
})
expect(inted.error?.kind).toBe('invalid-output')
expect(inted.error?.message).toContain('unsupported type (I)')
// The pre-encode size bound reads len(), so overriding it to 0 admits a
// string of any length past maxValueBytes.
const stringed = await runtime.run({
program: [
'class S(str):',
' def __len__(self): return 0',
'return S("Q" * 100000)',
].join('\n'),
bindings: [],
})
expect(stringed.error?.kind).toBe('invalid-output')
expect(stringed.error?.message).toContain('unsupported type (S)')
// A str-subclass dict KEY reaches the same len() bound.
const keyed = await runtime.run({
program: [
'class S(str):',
' def __len__(self): return 0',
'return {S("Q" * 100000): 1}',
].join('\n'),
bindings: [],
})
expect(keyed.error?.kind).toBe('invalid-output')
expect(keyed.error?.message).toContain('non-string dict key (S)')
// bool is an int subclass that IS lossless JSON, and the exact scalars all
// still cross unchanged.
const plain = await runtime.run({
program: 'return {"t": True, "f": False, "n": None, "i": 7, "d": 2.5, "s": "ok"}',
bindings: [],
})
expect(plain.error).toBeUndefined()
expect(plain.value).toEqual({ t: true, f: false, n: null, i: 7, d: 2.5, s: 'ok' })
})
it('rejects a scalar subclass passed as a binding argument', async () => {
// The uncapped binding-argument validator shares the exact-type rule, so
// the call fails through its rejection contract instead of dispatching a
// float whose digits come from an override.
const { runtime } = await setup()
const seen: CodeJsonValue[] = []
const result = await runtime.run({
program: [
'class F(float):',
' def __repr__(self): return "1.0"',
'try:',
' await tools.echo({"v": F(2.5)})',
'except Exception as exc:',
' return str(exc)',
].join('\n'),
bindings: tools({ echo: async (args) => {
seen.push(args as CodeJsonValue)
return null
} }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('unsupported type (F)')
expect(seen).toEqual([])
})
it('rejects a container subclass passed as a binding argument', async () => {
// Binding arguments run the uncapped validator, which must apply the same
// exact-type rule: the call fails descriptively instead of dispatching a
// value whose serialization disagrees with what was validated.
const { runtime } = await setup()
const seen: CodeJsonValue[] = []
const result = await runtime.run({
program: [
'class Sneaky(dict):',
' def items(self): return []',
'try:',
' await tools.echo(Sneaky(secret="kept"))',
'except Exception as exc:',
' return str(exc)',
].join('\n'),
bindings: tools({ echo: async (args) => {
seen.push(args as CodeJsonValue)
return null
} }),
})
expect(result.error).toBeUndefined()
expect(result.value).toContain('unsupported type (Sneaky)')
expect(seen).toEqual([])
})
it('fails an oversized completion as output-limit without materializing its encoding', async () => {
// A 100 MiB string under maxValueBytes: 1024 must fail as output-limit.
// The address-space cap leaves room for the program to BUILD the string
// (one copy + interpreter) but not for the old full pre-check encode,
// which materialized chunk fragments plus the joined copy (~2 more
// copies) and died on RLIMIT_AS as MemoryError/worker-exit.
const { runtime } = await setup({ maxValueBytes: 1024, addressSpaceMb: 384, maxWallMs: 15_000 })
const result = await runtime.run({
program: 'return "x" * (100 * 1024 * 1024)',
bindings: [],
})
expect(result.error?.kind).toBe('output-limit')
expect(result.error?.message).toContain('exceeded 1024 bytes')
}, 20_000)
it('rejects a control-heavy oversized completion on its length, not its escaped copy', async () => {
// Every "\x00" escapes to the six bytes "", so the escaped form of a
// 40 MB string is ~240 MB. The walk must refuse on the cheap
// `len(current) + 2` lower bound; the 384 MiB address space holds the raw
// string but not its escaped expansion, so a pre-escape check dies on
// RLIMIT_AS instead of returning output-limit.
const { runtime } = await setup({ maxValueBytes: 1024, addressSpaceMb: 384, maxWallMs: 15_000 })
const result = await runtime.run({
program: 'return "\\x00" * (40 * 1024 * 1024)',
bindings: [],
})
expect(result.error?.kind).toBe('output-limit')
expect(result.error?.message).toContain('exceeded 1024 bytes')
}, 20_000)
it('truncates a single print far above maxLogBytes instead of dying on the encode', async () => {
// LogBuffer must reject via the cheap char-count lower bound BEFORE
// UTF-8-encoding the whole string: the full encode of a ~100 MB line
// would double the allocation and can breach RLIMIT_AS. 256 MiB
// address space comfortably holds one copy of the 100 MB string but
// not the pre-fix double allocation plus interpreter overhead spikes.
const { runtime } = await setup({ maxLogBytes: 1024, addressSpaceMb: 256, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'print("x" * (100 * 1024 * 1024))',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
}, 20_000)
it('stops host capture at the child ledger truncation, keeping exactly one marker', async () => {
// The two ledgers exhaust independently. One child entry larger than
// `maxLogBytes` sends ONLY the marker, so the host budget is still nearly
// untouched — and the marker used to arrive as an ordinary `log` frame the
// host could not tell from program output. Text written afterwards was
// therefore retained AFTER the marker, contradicting the stop-after-
// truncation contract, and a later host-side exhaustion could append a
// second marker. The frame now carries `truncated: true`.
//
// `os.write(1, ...)` bypasses the child's own stream, so those bytes reach
// the host as stray stdout and take the host ledger path rather than the
// child's — which is exactly the route that leaked past the marker.
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'import os',
'print("y" * 70000)',
'os.write(1, b"AFTER")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
const markers = result.logs.filter(line => line.includes('log capture truncated'))
expect(markers).toHaveLength(1)
// The marker is the LAST entry: nothing was retained after truncation.
expect(result.logs.at(-1)).toBe(markers[0])
expect(result.logs.join('\n')).not.toContain('AFTER')
}, 20_000)
it('keeps one marker when a program forges repeated truncation frames', async () => {
// `truncated` is attacker-reachable: the program owns fd 3 and can write the
// flag itself, so the field is a hostile input rather than a trusted signal.
// Repeats must collapse to the single marker the contract promises, and only
// the literal `true` counts — a forged `"yes"` is rebuilt away by
// validateChildFrame, so that frame stays ordinary text.
const { runtime } = await setup({ maxLogBytes: 4096, maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'import os, json',
'os.write(3, json.dumps({"type":"log","text":"first","truncated":"yes"}).encode() + b"\\n")',
'os.write(3, json.dumps({"type":"log","text":"MARK-A","truncated":True}).encode() + b"\\n")',
'os.write(3, json.dumps({"type":"log","text":"MARK-B","truncated":True}).encode() + b"\\n")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
// The non-boolean flag did not truncate, so its text was captured normally.
expect(result.logs).toContain('first')
// The first genuine flag stopped capture and emitted the HOST's own marker;
// the frame's own text is discarded, so neither payload appears.
expect(result.logs).not.toContain('MARK-A')
expect(result.logs).not.toContain('MARK-B')
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
}, 20_000)
it('discards the text of a forged truncation frame instead of retaining it', async () => {
// The marker branch bypasses `admit`, so retaining the frame's own text put
// attacker-controlled bytes into `logs` with no cap at all: measured, a 1 MiB
// forged text was retained whole under `maxLogBytes: 64`, and the only bound
// left was the 256 MiB frame ceiling. The host emits its own marker instead,
// so the retained size is fixed regardless of what the program sent.
const forgedBytes = 1024 * 1024
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 20_000 })
const result = await runtime.run({
program: [
'import os, json',
`big = "A" * ${forgedBytes}`,
'os.write(3, json.dumps({"type":"log","truncated":True,"text":big}).encode() + b"\\n")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
// Only the host marker is kept, so the total stays orders of magnitude below
// what the forgery carried — and below the cap it was trying to escape.
expect(result.logs).toEqual([logTruncationMarker(64)])
expect(result.logs.join('').length).toBeLessThan(forgedBytes / 1000)
}, 30_000)
it('coalesces unframed fd-3 fragments without recopying the sealed prefix', async () => {
// The frame ceiling meters payload BYTES, but each retained chunk is its own
// Buffer with object and backing-store overhead the byte count cannot see:
// 5000 single-byte newline-free writes produced 5000 chunks holding 5031
// bytes, so a program pacing such writes could accumulate millions of objects
// inside the wall budget and exhaust the host heap far below 256 MiB.
//
// The observable behavior is that the run still completes normally: the
// fragments are coalesced rather than rejected, since a slow trickle of bytes
// is not itself a protocol violation.
//
// `Buffer.concat` is wrapped for the duration so the cumulative copy volume
// is measured rather than inferred: that total is what separates sealing into
// blocks from re-merging the whole buffer, and both shapes pass every
// behavioral assertion below.
//
// The trickle is terminated with its own newline before the real frame is
// written. Without that, those 5000 bytes prefix the frame on the SAME line,
// which then parses as junk and is dropped — correct framing behavior, but it
// would leave this test asserting the wrong thing.
// Bound at capture: `Buffer.concat` is a static method, and taking a bare
// reference to one trips no-unbound-method.
const realConcat = Buffer.concat.bind(Buffer)
let copied = 0
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
for (const part of list) copied += part.length
return realConcat(list, total)
}
const program = [
'import os',
// Newline-free single-byte writes, spaced so each lands as its own read.
// 60000 rather than 5000: the trickle has to cross the seal threshold
// enough times for the two shapes to separate. At 5000 writes there are
// only four seals, so even the quadratic form copies well under a
// megabyte and the budget below could not tell them apart.
'for _ in range(60000):',
' os.write(3, b"x")',
' os.sched_yield()',
'os.write(3, b"\\n")',
// A real frame after the trickle proves framing still works on the
// coalesced residual.
'print("after-trickle")',
'return "done"',
].join('\n')
let result: CodeRunResult
try {
const { runtime } = await setup({ maxWallMs: 30_000 })
result = await runtime.run({ program, bindings: [] })
} finally {
Buffer.concat = realConcat
}
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs).toContain('after-trickle')
// Sealing appends a finished block rather than re-merging everything held, so
// each byte is copied once. Re-concatenating the whole buffer at every
// threshold made the cumulative copy volume quadratic — 10 MiB trickled a
// byte at a time copies 53.7 GB that way. A per-byte-copied budget is the
// discriminator, and it is measured rather than reasoned about: this shape
// copies about 119 KB for 60000 trickled bytes, the re-merging shape about
// 540 KB. 256 KiB sits between them with margin on both sides — most writes
// are coalesced by the pipe before they reach us, so the observed ratio is
// smaller than the asymptotic one, and the threshold has to sit where a real
// measurement lands rather than where the asymptote suggests.
expect(copied).toBeLessThan(256 * 1024)
}, 40_000)
it('caps a huge exception diagnostic child-side before it crosses the wire', async () => {
// A program can raise with a multi-megabyte message; the child must cap
// it at maxValueBytes before formatting/sending, not ship the whole
// payload for the host to truncate after parsing.
const { runtime } = await setup({ maxValueBytes: 1024 })
const result = await runtime.run({
program: 'raise ValueError("boom-" + "x" * (8 * 1024 * 1024))',
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toContain('boom-')
expect(result.error?.message.endsWith('… [truncated]')).toBe(true)
expect(Buffer.byteLength(result.error?.message ?? '', 'utf8')).toBeLessThan(2048)
})
it('bounds a newline-free partial-line flood while the program is still running', async () => {
// print("x", end="") never completes a line, so nothing reaches the
// Python LogBuffer until settlement — the buffered tail must still hit
// the budget mid-run instead of growing without bound to RLIMIT/timeout.
const { runtime } = await setup({ maxLogBytes: 1024, maxWallMs: 15_000 })
const result = await runtime.run({
program: [
'for _ in range(100000):',
' print("xxxxxxxxxx", end="")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
// The retained text is bounded by the budget, not the 1 MB the program wrote.
expect(result.logs.join('\n').length).toBeLessThan(4096)
}, 20_000)
it('discards empty writes instead of buffering one list slot each', async () => {
// An empty chunk adds no character, so the mid-run budget check (which
// compares buffered CHARS against the remaining ledger) can never fire on
// it. Buffering empty strings therefore grew `_pending` without bound —
// millions of slots per CPU second — until RLIMIT_AS turned an append into
// a MemoryError, long after the log ledger was exhausted. Two million
// empty writes must instead settle normally and contribute NO log entry,
// proving the chunk was dropped rather than joined at flush_line.
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 256, maxWallMs: 20_000 })
const result = await runtime.run({
program: [
'import sys',
'for _ in range(2000000):',
' sys.stdout.write("")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs).toEqual([])
}, 30_000)
it('stops scanning a single-write newline flood once the log ledger truncates', async () => {
// One write carrying half a million newlines: the offset scan must exit the
// instant LogBuffer truncates rather than re-slicing and pushing every
// remaining line. If it kept scanning it would exhaust the CPU/wall budget;
// the run instead settles quickly with exactly one truncation marker.
const { runtime } = await setup({ maxLogBytes: 256, maxWallMs: 10_000 })
const start = Date.now()
const result = await runtime.run({
program: ['print("x\\n" * 500000, end="")', 'return "done"'].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
expect(Date.now() - start).toBeLessThan(8_000)
}, 15_000)
it('bounds an oversized newline-terminated write before joining and slicing it', async () => {
// The newline branch slices the first line out of the write before
// `LogBuffer.push` can apply its cheap budget rejection, so a single
// over-budget write cost a full extra copy of itself in peak address space —
// the amplification that bound exists to avoid, applied one layer too late.
// Measured under a 400 MiB addressSpaceMb with the slice unbounded: writes
// of 200 MiB and up died on MemoryError inside `sys.stdout.write`, reported
// as the PROGRAM's own exception rather than the promised truncation marker.
// `"\\n".rjust(n, "A")` is a single allocation ending in the newline, so the
// payload itself fits and the only remaining allocation is the stream's own
// slice; 340 MiB of a 400 MiB cap cannot survive one more copy of it.
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
const result = await runtime.run({
program: [
'import sys',
'payload = "\\n".rjust(340 * 1024 * 1024, "A")',
'sys.stdout.write(payload)',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs).toEqual([logTruncationMarker(256)])
}, 40_000)
it('bounds a newline-free write against the already-buffered chunks before joining them', async () => {
// The newline-free arm buffers the write and then compared the buffered
// CHARACTER COUNT against the ledger — correct — but paid for the comparison
// with `"".join(self._pending)`, a second full copy of everything held. One
// buffered character is enough to make that join a copy of the whole
// following write. Measured under a 400 MiB addressSpaceMb with a 340 MiB
// second write: the join raised MemoryError inside `sys.stdout.write`, and
// because the oversized chunks stayed in `_pending` the settlement
// `flush_line` raised it again — that throw sits after the `except
// BaseException` block, so it costs the `done` frame and the run came back
// `timeout: wall-clock ceiling reached (30000ms)` with no logs at all. The
// bound must be applied BEFORE the join and the chunks dropped on that path,
// so the run settles with the truncation marker it promises.
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
const result = await runtime.run({
program: [
'import sys',
// One unterminated character first, so `_pending` is non-empty and the
// large write cannot take the "buffered text IS the write" shortcut.
'sys.stdout.write("x")',
'payload = "A" * (340 * 1024 * 1024)',
'sys.stdout.write(payload)',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs).toEqual([logTruncationMarker(256)])
}, 40_000)
it('bounds a newline-terminated write against the already-buffered chunks before joining them', async () => {
// Same allocation, reached through the newline arm: with chunks pending, the
// whole write used to be appended and joined so the offset scan could run
// over one string. Only the FIRST line needs those chunks, so a pending
// chunk plus a 340 MiB newline-terminated write under a 400 MiB
// addressSpaceMb died on MemoryError in the join before the per-line bound
// could reject anything, and the retained chunks made the settlement flush
// die the same way: measured, `timeout: wall-clock ceiling reached
// (30000ms)`. The reconstructed first line is now checked against the ledger
// and only a budget-sized prefix of it is copied; the rest of the write is
// scanned in place.
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
const result = await runtime.run({
program: [
'import sys',
'sys.stdout.write("x")',
'payload = "\\n".rjust(340 * 1024 * 1024, "A")',
'sys.stdout.write(payload)',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs).toEqual([logTruncationMarker(256)])
}, 40_000)
it('emits pending text on an explicit flush, before the run can be killed', async () => {
// `_LogStream` inherits TextIOBase's no-op `flush()`, so an explicit
// `print(..., flush=True)` or `sys.stdout.flush()` left the text in
// `_pending` with nothing to drain it but `flush_line` after settlement — a
// call a hanging or killed run never reaches. Measured: printing
// "before hang" with flush=True ahead of an infinite loop returned
// `logs: []`, losing the one diagnostic the program deliberately committed.
const { runtime } = await setup({ maxWallMs: 4_000 })
const result = await runtime.run({
program: [
'import sys',
'print("before hang", end="", flush=True)',
'while True: pass',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('timeout')
expect(result.logs).toContain('before hang')
}, 15_000)
it('marks a dropped tail when the ledger lands on exactly zero remaining', async () => {
// One 100-character line costs 103 serialized bytes (quotes + separator),
// consuming a 103-byte budget EXACTLY. Landing on zero never trips
// LogBuffer's "cost > remaining" branch, so `_truncated` stays unset and the
// stream's own `remaining > 0` guard silently discarded the unscanned tail —
// the run reported a complete log while dropping text. The tail must be
// pushed so the marker is emitted. (This surfaced only after empty writes
// stopped being buffered: `print` issues a trailing `write("")` whose
// buffered-empty path used to force the marker out incidentally.) A single
// wide line is used rather than many narrow ones so the CHILD ledger is the
// one that lands on zero: the host's identical ledger truncates first when
// many small entries precede the long marker text.
const { runtime } = await setup({ maxLogBytes: 103, maxWallMs: 10_000 })
const result = await runtime.run({
program: ['print("y" * 100 + "\\n" + "z" * 10, end="")', 'return "done"'].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs).toContain('y'.repeat(100))
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
// The dropped tail is not retained, but its loss is now reported.
expect(result.logs.some(line => line.includes('z'))).toBe(false)
}, 15_000)
it('charges the JSON-escaped cost of control characters against the log ledger', async () => {
// A NUL renders as \u0000 (6 bytes) in the serialized outer logs; the
// ledger must charge that expansion, or a control-character flood admits
// 6x the configured cap.
const { runtime } = await setup({ maxLogBytes: 256 })
const result = await runtime.run({
program: [
'for _ in range(500):',
' print("\\x00" * 10)',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
// Serialized (escaped) size of retained entries stays in the budget's
// neighborhood: well under the ~30 kB an uncharged flood would retain.
const serialized = Buffer.byteLength(JSON.stringify(result.logs), 'utf8')
expect(serialized).toBeLessThan(1024)
})
it('charges the serialized cost child-side, so a control-heavy line truncates instead of breaching the address space', async () => {
// The child's ledger must charge what the entry costs on the wire, not its
// raw UTF-8 length: a NUL is one raw byte but six as its escape. A 24 MiB NUL
// line clears the cheap char-count lower bound (24 MiB < 32 MiB budget), so
// charging raw bytes would ADMIT it and then encode a ~144 MiB escaped
// payload plus its UTF-8 copy — past the 384 MiB address space, killing the
// child (surfaced host-side as `worker-exit`) instead of truncating.
// Charging the serialized cost rejects it before any encode.
const { runtime } = await setup({ maxLogBytes: 32 * 1024 * 1024, addressSpaceMb: 384, maxWallMs: 20_000 })
const result = await runtime.run({
program: [
'print("\\x00" * (24 * 1024 * 1024))',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('done')
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
// Nothing of the line itself was retained: the ledger refused the whole entry.
expect(result.logs.every(line => !line.includes(String.fromCharCode(0)))).toBe(true)
}, 30_000)
it('bounds a flood of zero-byte log lines through the per-entry separator charge', async () => {
// Blank print() lines carry zero content bytes; without the +1 separator
// charge they would bypass maxLogBytes entirely and grow the retained
// array without bound. Each empty entry costs one byte, so a 64-byte
// budget retains at most 64 entries before the marker.
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 10_000 })
const result = await runtime.run({
program: [
'for _ in range(10000):',
' print()',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.logs.length).toBeLessThanOrEqual(65)
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
})
it('reassembles multibyte UTF-8 split across stray-output pipe chunks', async () => {
// A single os.write far past the 64 KiB pipe buffer forces multiple
// 'data' chunks; when the boundary lands inside the emoji's 4-byte
// sequence, per-chunk decoding would corrupt it into replacement
// characters. The streaming decoder must reassemble it.
const { runtime } = await setup({ maxLogBytes: 1024 * 1024 })
const result = await runtime.run({
program: [
'import os',
// os.write is one syscall and returns a partial count on a full
// pipe, so loop until the whole payload (odd prefix -> a chunk
// boundary lands inside the emoji's 4-byte sequence) is out.
String.raw`payload = b"a" * 65535 + "\u4f60\u597d\U0001f600".encode("utf-8")`,
'view = memoryview(payload)',
'while view:',
' view = view[os.write(1, view):]',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
const text = result.logs.join('')
expect(text).toContain('\u4f60\u597d\u{1f600}')
expect(text).not.toContain('\ufffd')
})
it('flushes a stray-output byte sequence left incomplete when the pipe ends', async () => {
// The child writes the first two bytes of a 3-byte UTF-8 character to fd 1
// and exits, so the pipe closes with the sequence unfinished inside the
// streaming decoder. The 'end' flush must render the stranded bytes as
// U+FFFD instead of dropping the evidence with the decoder.
const { runtime } = await setup({ maxLogBytes: 1024 * 1024 })
const result = await runtime.run({
program: [
'import os',
// b"\xe4\xbd" is the leading two bytes of U+4F60; no continuation byte
// follows before exit.
String.raw`os.write(1, b"\xe4\xbd")`,
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.logs.join('')).toContain('�')
})
it('rejects reserved words of EITHER backend language as binding globals', async () => {
// The seam's portable contract: `lambda` (Python keyword, legal JS name)
// and `typeof` (JS keyword, legal Python name) are both refused, so a
// namespace list valid on one backend is valid on every backend.
const { runtime } = await setup()
for (const global of ['lambda', 'typeof']) {
await expect(runtime.run({
program: 'return 1',
bindings: [{ global, functions: {} }],
})).rejects.toThrow(/is not a usable Python identifier/)
}
})
it('captures stray stdout bytes the child writes bypassing sys.stdout', async () => {
// Model code that writes to fd 1 via os.write() bypasses the Python-side
// LogBuffer, so the host's stray-byte capture on child.stdout is what
// records it.
const { runtime } = await setup()
const result = await runtime.run({
program: [
'import os',
'os.write(1, b"stray stdout\\n")',
'os.write(2, b"stray stderr\\n")',
'return "done"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.logs.join('')).toContain('stray stdout')
expect(result.logs.join('')).toContain('stray stderr')
})
it('escalates to SIGKILL when the program traps SIGTERM and ignores the grace period', async () => {
// A program that traps SIGTERM should still die: the kill() escalation
// fires SIGKILL after graceMs. The full run reports either timeout (wall)
// or worker-exit depending on which finish reason wins the race.
const { runtime } = await setup({ maxWallMs: 400, graceMs: 200 })
const result = await runtime.run({
program: [
'import signal, time',
'signal.signal(signal.SIGTERM, lambda *a: None)',
'while True: time.sleep(1)',
].join('\n'),
bindings: [],
})
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
}, 6000)
it('bounds the fd-3 receive buffer against a newline-free flood', async () => {
// A program looping os.write(3, ...) with no newline would grow the host
// accumulator unbounded (the child's RLIMIT_AS does not cover the host
// string). The ceiling is a fixed 256 MiB memory-safety invariant —
// deliberately NOT derived from maxValueBytes, because legitimate binding
// call frames may be large. We flood slightly past it in 8 MiB writes so
// the test terminates promptly once the guard trips.
const ceiling = 256 * 1024 * 1024
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
const start = Date.now()
const result = await runtime.run({
program: [
'import os',
`for _ in range(${Math.ceil((ceiling * 1.1) / (8 * 1024 * 1024))}):`,
' os.write(3, b"A" * (8 * 1024 * 1024))',
'return "never"',
].join('\n'),
bindings: [],
})
const elapsed = Date.now() - start
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
// The breach ends the run before the wall ceiling (the run did not idle
// out); absolute pipe throughput varies too much under parallel suites
// for a tight bound.
expect(elapsed).toBeLessThan(30_000)
}, 45_000)
it('fails a forged oversized done value host-side as output-limit', async () => {
// The Python-side _done_with_value check is bypassable by writing a done
// frame straight to fd 3. The host re-enforces maxValueBytes; the seam
// forbids substituting a truncated value, so the run FAILS as output-limit
// instead of returning a lie.
const maxValueBytes = 64
const { runtime } = await setup({ maxValueBytes })
const result = await runtime.run({
program: [
'import os, json',
'big = "B" * 5000',
'os.write(3, json.dumps({"type":"done","value":big}).encode() + b"\\n")',
// The real done never sends; the forged one settles the run.
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('output-limit')
expect(result.error?.message).toContain('exceeded 64 bytes')
}, 8000)
it('drops a forged oversized log frame on its code-unit lower bound, before escaping it', async () => {
// A forged `log` frame carrying a control-heavy string sits below the
// 256 MiB fd-3 frame ceiling but escapes several-fold: 24 MiB of NULs
// becomes ~144 MiB of ``. Charging it required building that escaped
// copy first, so a 32-byte maxLogBytes could still force a
// hundreds-of-megabytes host allocation. The cheap `length + 3` lower bound
// truncates it instead. The host's own heap is what is under test, so keep
// the child's address space generous enough to BUILD the frame.
const { runtime } = await setup({ maxLogBytes: 32, addressSpaceMb: 1024, maxWallMs: 60_000 })
const before = process.memoryUsage().heapUsed
const result = await runtime.run({
program: [
'import os',
// Written as a raw frame so the child's own ledger never sees it.
'os.write(3, b\'{"type":"log","text":"\' + b"\\\\u0000" * (24 * 1024 * 1024) + b\'"}\\n\')',
'return "settled"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('settled')
// The frame was dropped as one truncation marker, not retained.
expect(result.logs).toEqual([logTruncationMarker(32)])
// The escaped copy (~144 MiB) was never materialized.
expect(process.memoryUsage().heapUsed - before).toBeLessThan(256 * 1024 * 1024)
}, 90_000)
it('charges a forged log frame its escaped cost once past the code-unit lower bound', async () => {
// The cheap lower bound only rejects what cannot possibly fit; a SHORT
// control-heavy frame clears it and must still be charged what it costs on
// the wire. Ten NULs are 13 against the 32-byte lower bound but 63 escaped
// (six bytes each, two quotes, one separator), so the full charge truncates.
const { runtime } = await setup({ maxLogBytes: 32 })
const result = await runtime.run({
program: [
'import os',
'os.write(3, b\'{"type":"log","text":"\' + b"\\\\u0000" * 10 + b\'"}\\n\')',
'return "settled"',
].join('\n'),
bindings: [],
})
expect(result.error).toBeUndefined()
expect(result.value).toBe('settled')
expect(result.logs).toEqual([logTruncationMarker(32)])
}, 8000)
it('caps a forged done error.message from its code-unit prefix, never encoding the whole message', async () => {
// `Buffer.from(message)` on a message near the frame ceiling allocates a
// full UTF-8 copy before maxValueBytes applies. Only the first
// maxValueBytes code units can fit the cap, so only that prefix is encoded
// — at most 3x the cap in bytes. The message here is 48 MiB of ASCII: its
// full encode would be another 48 MiB in the host.
const maxValueBytes = 64
const { runtime } = await setup({ maxValueBytes, addressSpaceMb: 1024, maxWallMs: 60_000 })
const before = process.memoryUsage().heapUsed
const result = await runtime.run({
program: [
'import os',
'os.write(3, b\'{"type":"done","error":{"kind":"exception","message":"\' + b"E" * (48 * 1024 * 1024) + b\'"}}\\n\')',
'import time',
'time.sleep(30)',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
const message = result.error?.message ?? ''
// The marker's 15 bytes come OUT of the 64-byte cap, so 49 E's precede it
// and the whole string is exactly 64 bytes — not 64 plus the marker.
expect(message).toBe(`${'E'.repeat(maxValueBytes - 15)}… [truncated]`)
expect(Buffer.byteLength(message, 'utf8')).toBe(maxValueBytes)
// JSON.parse already holds the 48 MiB string; the cap must not add a
// second full-length copy on top of it.
expect(process.memoryUsage().heapUsed - before).toBeLessThan(256 * 1024 * 1024)
}, 90_000)
it('keeps a capped diagnostic within maxValueBytes, marker included', async () => {
// The marker is part of the emitted diagnostic, so its bytes are reserved
// from the cap rather than appended past it — the host meters this same
// field downstream. Checked on BOTH producers: the child's own _cap_message
// (a raised exception) and the host's capMessage (a forged done frame).
const maxValueBytes = 40
const { runtime } = await setup({ maxValueBytes })
const raised = await runtime.run({
program: 'raise ValueError("R" * 100000)',
bindings: [],
})
expect(raised.error?.kind).toBe('exception')
const raisedMessage = raised.error?.message ?? ''
expect(raisedMessage.endsWith('… [truncated]')).toBe(true)
expect(Buffer.byteLength(raisedMessage, 'utf8')).toBeLessThanOrEqual(maxValueBytes)
const forged = await runtime.run({
program: [
'import os, json',
'msg = "F" * 100000',
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(forged.error?.kind).toBe('exception')
const forgedMessage = forged.error?.message ?? ''
expect(forgedMessage.endsWith('… [truncated]')).toBe(true)
expect(Buffer.byteLength(forgedMessage, 'utf8')).toBe(maxValueBytes)
}, 15_000)
it('emits the marker alone when the cap is smaller than the marker itself', async () => {
// With maxValueBytes below the marker's own 15 bytes there is no room for
// message text; the marker still goes out, so the truncation stays reported
// instead of the diagnostic silently becoming empty. Both producers agree.
const { runtime } = await setup({ maxValueBytes: 4 })
const raised = await runtime.run({ program: 'raise ValueError("R" * 500)', bindings: [] })
expect(raised.error?.kind).toBe('exception')
expect(raised.error?.message).toBe('… [truncated]')
const forged = await runtime.run({
program: [
'import os, json',
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":"F" * 500}}).encode() + b"\\n")',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(forged.error?.kind).toBe('exception')
expect(forged.error?.message).toBe('… [truncated]')
}, 15_000)
it('caps a forged done error.message without splitting a surrogate pair', async () => {
// At exactly maxValueBytes code units the prefix can end on a high
// surrogate whose low half sits just outside it. `Buffer.from` encodes that
// orphan as U+FFFD — the same corruption a mid-sequence byte cut causes —
// and those three replacement bytes sit past the marker-reserved budget, so
// the byte trim-back drops them.
const maxValueBytes = 32
const { runtime } = await setup({ maxValueBytes })
const result = await runtime.run({
program: [
'import os, json',
// 32 ASCII chars then astral characters: code unit 32 is the first
// character's high surrogate (Python spells it as one code point, so
// json.dumps emits the raw 4 bytes the host reads back as a pair).
'msg = "A" * 32 + "\\U0001f600" * 4',
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
// 17 A's fill the marker-reserved budget; no orphaned half, no U+FFFD.
expect(result.error?.message).toBe(`${'A'.repeat(17)}… [truncated]`)
expect(Buffer.byteLength(result.error?.message ?? '', 'utf8')).toBe(maxValueBytes)
}, 8000)
it('returns a diagnostic under a third of the cap untouched, skipping the encode', async () => {
// Under maxValueBytes/3 code units a message cannot overflow the cap
// whatever it holds (3 bytes is the per-code-unit maximum), so the fast
// path returns it without encoding anything. Non-ASCII proves the bound is
// the code-unit count, not a byte assumption: 6 characters at 3 bytes each
// is 18 bytes, inside the 64-byte cap.
const { runtime } = await setup({ maxValueBytes: 64 })
const result = await runtime.run({
program: [
'import os, json',
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":"中文中文中文"}}).encode() + b"\\n")',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
expect(result.error?.message).toBe('中文中文中文')
}, 8000)
it('re-caps a forged done error.message host-side on a UTF-8 boundary', async () => {
// A forged done frame can carry an arbitrarily long error message; the
// host caps it to maxValueBytes and appends the shared marker. The
// message is emoji-dense and the cap is chosen so the marker-reserved
// 51-byte cut lands INSIDE a 4-byte sequence (one ASCII byte then 4-byte
// runs, so only a cut at 1 + 4k is aligned) — the cap must trim back to a
// code-point boundary rather than decode a replacement character, which
// would also exceed the cap.
const maxValueBytes = 66
const { runtime } = await setup({ maxValueBytes })
const result = await runtime.run({
program: [
'import os, json',
'msg = "E" + "\\U0001f600" * 2000',
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
'import time',
'time.sleep(5)',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('exception')
const message = result.error?.message ?? ''
expect(message.endsWith('… [truncated]')).toBe(true)
const marker = '… [truncated]'
const body = message.slice(0, message.length - marker.length)
// The WHOLE message, marker included, honors the cap.
expect(Buffer.byteLength(message, 'utf8')).toBeLessThanOrEqual(maxValueBytes)
// 'E' plus 12 emoji is 49 bytes: the trim-back walked the 51-byte budget
// down past two continuation bytes rather than splitting the 13th.
expect(body).toBe(`E${'\u{1f600}'.repeat(12)}`)
// The cut landed on a code-point boundary — no replacement character.
expect(body).not.toContain('\ufffd')
}, 8000)
it('bounds a single oversized newline-terminated line on fd 3', async () => {
// The same ceiling applies to one giant framed line. Write EXACTLY the
// ceiling with no newline — at the limit, not past it, so nothing trips —
// then a small newline tail, which is the chunk that crosses.
const ceiling = 256 * 1024 * 1024
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
const result = await runtime.run({
program: [
'import os',
'chunk = b"A" * (8 * 1024 * 1024)',
`for _ in range(${ceiling / (8 * 1024 * 1024)}):`,
' os.write(3, chunk)',
'os.write(3, b"AAAA\\n")',
'return "never"',
].join('\n'),
bindings: [],
})
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
}, 90_000)
it('rejects an over-ceiling fd-3 buffer without first joining it into one line', async () => {
// The ceiling has to be enforced on the byte COUNTER before Buffer.concat,
// not on the joined line afterwards: the join is a second copy of
// everything held, so a program could force roughly twice the advertised
// 256 MiB of host memory before anything rejected it.
//
// This program makes the two orders observably different rather than merely
// differently sized. It writes exactly the ceiling with no newline (at the
// limit, so nothing trips), then a newline followed by 8 MiB more. Checking
// the counter first sees more than the ceiling on the newline-bearing pipe
// chunk and rejects. Checking the joined line instead produced a FIRST LINE
// of exactly the ceiling — inside the per-line bound, so it passed as a junk
// frame — and left an 8 MiB residual well under the bound, so the breach was
// never reported: measured, the run settled as
// `python exited (code=0, signal=null) before completing` after the host had
// held the ceiling AND copied it, which is the doubling this check prevents.
const ceiling = 256 * 1024 * 1024
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
const result = await runtime.run({
program: [
'import os',
'chunk = b"A" * (8 * 1024 * 1024)',
`for _ in range(${ceiling / (8 * 1024 * 1024)}):`,
' os.write(3, chunk)',
// One drain loop: a single os.write past the pipe buffer returns short,
// and a truncated tail would change which bytes cross the ceiling.
'view = memoryview(b"\\n" + b"B" * (8 * 1024 * 1024))',
'while view:',
' view = view[os.write(3, view):]',
'return "never"',
].join('\n'),
bindings: [],
})
expect(result.value).toBeUndefined()
expect(result.error?.kind).toBe('worker-exit')
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
}, 120_000)
})
Reference in New Issue View Git Blame Copy Permalink