mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-09-07 04:10:42 +00:00
Chinesezjc
dbff8ffba3
The host stray-capture cost function charged illegal UTF-8 bytes (0x80-0xC1,
0xF5-0xFF, and orphaned multibyte leads) the raw 1, but toString('utf8')
renders each as U+FFFD (3 serialized bytes). A b"\xff" flood was undercounted
threefold, so the residual grew to a full budget's worth of raw bytes before
flushing and, near a large maxLogBytes, expanded toward a ~1 GiB peak in the
flush's concat plus toString. Replace serializedBufferCost with accrueStrayCost,
a cross-chunk UTF-8 walker that charges each byte its decoded serialized width;
carry its sequence state on each StrayBuffer.
The child _LogStream had the same-family bug: its early-flush trigger compared
_pending_chars (character count) against remaining (a serialized-byte budget),
so a 30M-NUL newline-free flood stayed under a 50 MB char trigger yet encoded to
~180 MB at settlement, breaching RLIMIT_AS as worker-exit. Track _pending_cost
via the _JSON_BYTE_COST table and trigger on it; keep _pending_chars for the
char-based slice bounds.
Correct the note's surrogate claim (only the string-walking jsonStringCostUpTo
charges a lone surrogate six bytes; the byte walker never sees one). Shrink the
post-truncation fixture below PIPE_BUF for a deterministic single callback. List
the shared stdout/stderr budget as a third honest fail-before exception
(cross-pipe arrival timing is nondeterministic). Add illegal-UTF-8,
broken-multibyte, and child-log-flood regression tests; sync the zh pair.
3968 lines
189 KiB
TypeScript
3968 lines
189 KiB
TypeScript
import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs'
|
|
import { mkdtemp, writeFile } from 'node:fs/promises'
|
|
import { tmpdir } from 'node:os'
|
|
import { basename, dirname, join } from 'node:path'
|
|
import { describe, expect, it, vi } from 'vitest'
|
|
import { Context } from 'cordis'
|
|
import { PythonCodeRuntime } from '../src/index.ts'
|
|
import { logTruncationMarker } from '../src/protocol.ts'
|
|
import type { Config } from '../src/index.ts'
|
|
import type { CodeBindingFunction, CodeJsonValue, CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
|
|
|
|
/**
|
|
* Names one `py/` script whose `copyFileSync` must fail, for the partial-staging
|
|
* case. A real disk-full or missing-asset failure mid-copy cannot be produced
|
|
* from a test, and the leak only shows when `mkdtempSync` has already succeeded.
|
|
*/
|
|
const { failNextCopyOf } = vi.hoisted(() => ({ failNextCopyOf: { value: undefined as string | undefined } }))
|
|
vi.mock('node:fs', async (importOriginal) => {
|
|
const actual = await importOriginal<typeof import('node:fs')>()
|
|
return {
|
|
...actual,
|
|
copyFileSync(source: string, destination: string): void {
|
|
if (failNextCopyOf.value !== undefined && basename(source) === failNextCopyOf.value) {
|
|
failNextCopyOf.value = undefined
|
|
throw Object.assign(new Error('simulated ENOSPC on copy'), { code: 'ENOSPC' })
|
|
}
|
|
actual.copyFileSync(source, destination)
|
|
},
|
|
}
|
|
})
|
|
|
|
/**
|
|
* Integration suite over REAL python3 subprocesses (no subprocess mocks — it is
|
|
* cheap and local, per docs/testing.md's real-over-mock policy; the only mock is
|
|
* `node:fs.copyFileSync` for the staging-failure cases). Each test builds a fresh
|
|
* runtime so budgets can be tuned per case.
|
|
*/
|
|
async function setup(config: Config = {}) {
|
|
const ctx = new Context()
|
|
const fiber = await ctx.plugin(PythonCodeRuntime, config)
|
|
const runtime = ctx.codeRuntime as PythonCodeRuntime
|
|
return { ctx, fiber, runtime }
|
|
}
|
|
|
|
/** Convenience: one namespace `tools` with the given functions. */
|
|
function tools(functions: Record<string, CodeBindingFunction>) {
|
|
return [{ global: 'tools', functions }]
|
|
}
|
|
|
|
describe('PythonCodeRuntime — seam descriptors and misuse', () => {
|
|
it('registers the seam descriptors', async () => {
|
|
const { runtime } = await setup()
|
|
expect(runtime.language).toBe('python')
|
|
expect(runtime.isolation).toBe('process')
|
|
})
|
|
|
|
it('rejects non-positive config as seam misuse', async () => {
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 0 }))
|
|
.rejects.toThrow(/cpuSeconds must be a positive number/)
|
|
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: -1 }))
|
|
.rejects.toThrow(/maxWallMs must be a positive number/)
|
|
})
|
|
|
|
it('rejects a non-integer cpuSeconds at load (setrlimit needs an int)', async () => {
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 1.5 }))
|
|
.rejects.toThrow(/cpuSeconds must be a positive integer, got 1.5/)
|
|
})
|
|
|
|
it('rejects a non-integer byte budget at load (the child int()-truncates it)', async () => {
|
|
// maxLogBytes/maxValueBytes cross to the child, which reads them through
|
|
// int(...): a float would floor there while the host meters the fraction, so
|
|
// the two sides would enforce different public config. Reject at load.
|
|
const ctxLog = new Context()
|
|
await expect(ctxLog.plugin(PythonCodeRuntime, { maxLogBytes: 3.5 }))
|
|
.rejects.toThrow(/maxLogBytes must be a positive integer/)
|
|
const ctxValue = new Context()
|
|
await expect(ctxValue.plugin(PythonCodeRuntime, { maxValueBytes: 1024.5 }))
|
|
.rejects.toThrow(/maxValueBytes must be a positive integer/)
|
|
})
|
|
|
|
it('rejects finite numeric config that cannot cross as an exact rlimit integer', async () => {
|
|
// `Number.isFinite` and `Number.isInteger` both admit values that cannot
|
|
// round-trip. `addressSpaceMb: 1e308` overflows to `Infinity` once multiplied
|
|
// by 1 MiB, and `encodeJsonPlain` renders that as `null`, so the child gets no
|
|
// limit at all; `cpuSeconds: 1e100` clears `Number.isInteger` while sitting
|
|
// far past the safe range, so `setrlimit` receives a different number than was
|
|
// configured. Both used to end every run in a bootstrap exception instead of
|
|
// failing at load, where a self-contained configuration error belongs.
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, { addressSpaceMb: 1e308 }))
|
|
.rejects.toThrow(/addressSpaceMb must be at most \d+ .*exact integer/)
|
|
await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 1e100 }))
|
|
.rejects.toThrow(/cpuSeconds must be at most \d+ .*exact integers/)
|
|
// The boundary values still load: the bound rejects what cannot be encoded,
|
|
// not everything large.
|
|
const okMb = await ctx.plugin(PythonCodeRuntime, { addressSpaceMb: Math.floor(Number.MAX_SAFE_INTEGER / (1024 * 1024)) })
|
|
await okMb.dispose()
|
|
const okCpu = await ctx.plugin(PythonCodeRuntime, { cpuSeconds: Number.MAX_SAFE_INTEGER - 1 })
|
|
await okCpu.dispose()
|
|
})
|
|
|
|
it('rejects an output cap whose payload could not cross the frame ceiling', async () => {
|
|
// The caps budget a payload that must arrive inside ONE fd-3 frame, and the
|
|
// 256 MiB framing ceiling is fixed. A larger cap is unsatisfiable rather
|
|
// than generous: a completion the cap admits arrives as an over-ceiling
|
|
// frame and fails the run as `worker-exit`, inverting the `output-limit`
|
|
// the cap describes. Both budgets are metered in already-escaped serialized
|
|
// bytes, so a payload occupies at most `cap + envelope` on the wire; the
|
|
// bound is `ceiling - envelope`, not `(ceiling - envelope) / 6` (that
|
|
// divided in escape expansion the charge already counts).
|
|
const admissible = 256 * 1024 * 1024 - 64
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, { maxLogBytes: admissible + 1 }))
|
|
.rejects.toThrow(/maxLogBytes must not exceed 268435392 .*fd-3 frame ceiling/)
|
|
await expect(ctx.plugin(PythonCodeRuntime, { maxValueBytes: admissible + 1 }))
|
|
.rejects.toThrow(/maxValueBytes must not exceed 268435392 .*fd-3 frame ceiling/)
|
|
// The boundary value itself loads: the bound is the largest cap a frame can
|
|
// still carry, not one below it.
|
|
const boundary = await ctx.plugin(PythonCodeRuntime, { maxValueBytes: admissible })
|
|
await boundary.dispose()
|
|
})
|
|
|
|
it('rejects a pythonBin that spawn() would throw on, at load', async () => {
|
|
// Both values pass the string schema and both make `spawn` throw
|
|
// SYNCHRONOUSLY from inside run() — ERR_INVALID_ARG_VALUE for the empty
|
|
// path, ERR_INVALID_ARG_TYPE for the NUL — so run() would REJECT instead of
|
|
// resolving the worker-exit the seam promises for a child that cannot
|
|
// start. Both are self-contained configuration errors, so they fail here.
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, { pythonBin: '' }))
|
|
.rejects.toThrow(/pythonBin must be a non-empty path without NUL bytes/)
|
|
await expect(ctx.plugin(PythonCodeRuntime, { pythonBin: 'py\u0000thon3' }))
|
|
.rejects.toThrow(/pythonBin must be a non-empty path without NUL bytes/)
|
|
})
|
|
|
|
it('rejects a timer budget setTimeout would silently clamp to 1 ms', async () => {
|
|
// Node stores a setTimeout delay as a signed 32-bit value and substitutes
|
|
// 1 ms for anything larger, inverting the knob's meaning: a huge maxWallMs
|
|
// would time every run out at once, and a huge graceMs would SIGKILL one
|
|
// millisecond after SIGTERM. Both must fail at load instead.
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: 2_147_483_648 }))
|
|
.rejects.toThrow(/maxWallMs must not exceed 2147483647/)
|
|
// graceMs is bounded by the close deadline's added margin, not by the raw
|
|
// timer maximum, because that sum is what gets armed.
|
|
await expect(ctx.plugin(PythonCodeRuntime, { graceMs: 2_147_481_648 }))
|
|
.rejects.toThrow(/graceMs must not exceed 2147481647/)
|
|
// The exact maxima still load.
|
|
await expect(ctx.plugin(PythonCodeRuntime, { maxWallMs: 2_147_483_647, graceMs: 2_147_481_647 }))
|
|
.resolves.toBeDefined()
|
|
})
|
|
|
|
it('rejects loading this Unix-only backend on Windows', async () => {
|
|
// The bootstrap needs the POSIX `resource` module, a positional fd 3, and
|
|
// negative-PID process-group signals — none on Windows. The constructor
|
|
// must throw at load rather than register ctx.codeRuntime and defer the
|
|
// failure to the first run.
|
|
const original = process.platform
|
|
Object.defineProperty(process, 'platform', { value: 'win32', configurable: true })
|
|
try {
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(PythonCodeRuntime, {})).rejects.toThrow(/requires a Unix platform/)
|
|
} finally {
|
|
Object.defineProperty(process, 'platform', { value: original, configurable: true })
|
|
}
|
|
})
|
|
|
|
it('rejects a binding global that is not a Python identifier or is reserved', async () => {
|
|
const { runtime } = await setup()
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{ global: '1bad', functions: {} }],
|
|
})).rejects.toThrow(/is not a usable Python identifier/)
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{ global: 'class', functions: {} }],
|
|
})).rejects.toThrow(/is not a usable Python identifier/)
|
|
})
|
|
|
|
it('rejects duplicate binding namespaces', async () => {
|
|
const { runtime } = await setup()
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [
|
|
{ global: 'tools', functions: {} },
|
|
{ global: 'tools', functions: {} },
|
|
],
|
|
})).rejects.toThrow(/duplicate binding global/)
|
|
})
|
|
|
|
it('rejects run() after disposal, and unregisters ctx.codeRuntime', async () => {
|
|
const { ctx, fiber, runtime } = await setup()
|
|
await fiber.dispose()
|
|
await expect(runtime.run({ program: 'return 1', bindings: [] }))
|
|
.rejects.toThrow(/after disposal/)
|
|
expect(ctx.get('codeRuntime')).toBeUndefined()
|
|
})
|
|
|
|
it('short-circuits when the request signal is already aborted', async () => {
|
|
const { runtime } = await setup()
|
|
const signal = AbortSignal.abort('already-cancelled')
|
|
const result = await runtime.run({ program: 'return 1', bindings: [], signal })
|
|
expect(result.error?.kind).toBe('abort')
|
|
expect(result.error?.message).toContain('already-cancelled')
|
|
expect(result.logs).toEqual([])
|
|
})
|
|
|
|
it('short-circuits on an already-aborted signal whose reason cannot be converted', async () => {
|
|
// The pre-flight arm converted the reason with a bare `String()`, so a
|
|
// hostile reason threw out of `run()` — the seam promises to reject only for
|
|
// misuse, and a caller's cancellation token is not misuse.
|
|
const { runtime } = await setup()
|
|
const signal = AbortSignal.abort({
|
|
[Symbol.toPrimitive]() { throw new Error('reason blew up') },
|
|
})
|
|
const result = await runtime.run({ program: 'return 1', bindings: [], signal })
|
|
expect(result.error?.kind).toBe('abort')
|
|
expect(result.error?.message).toBe('<unrenderable rejection value>')
|
|
expect(result.logs).toEqual([])
|
|
})
|
|
|
|
it('runs the interpreter from materialized scripts outside the package, and removes them per run', async () => {
|
|
// The interpreter is an EXTERNAL process, so it can only open paths the OS
|
|
// resolves. Inside the single-file Python-SDK executable the packaged `py/`
|
|
// directory lives in pkg's virtual filesystem, which Node reads through its
|
|
// patched `fs` but `python3` cannot see, so spawning from that path fails
|
|
// with ENOENT. The scripts are therefore copied to a real directory first.
|
|
//
|
|
// The path is read from the child's own `__main__` module, so it proves
|
|
// where the interpreter actually loaded the entry script — asserting on a
|
|
// host-side constant would only restate the source. The program namespace
|
|
// seeds `__name__` but no `__file__`, hence the module lookup.
|
|
// `protocol.py` must land in the SAME directory, since `bootstrap.py` puts
|
|
// its own directory on `sys.path` to import it; the run completing at all
|
|
// already exercises that import.
|
|
const { runtime } = await setup()
|
|
const entryOf = async (): Promise<string> => {
|
|
const result = await runtime.run({ program: 'import sys\nreturn sys.modules["__main__"].__file__', bindings: [] })
|
|
expect(result.error).toBeUndefined()
|
|
return result.value as string
|
|
}
|
|
const entry = await entryOf()
|
|
expect(entry.endsWith('/bootstrap.py')).toBe(true)
|
|
const dir = dirname(entry)
|
|
expect(dir.startsWith(realpathSync(tmpdir()))).toBe(true)
|
|
expect(dir).not.toContain('/packages/')
|
|
// Staging is per RUN and removed at settlement, so by the time `run()`
|
|
// resolved the directory is already gone — nothing survives to be rewritten
|
|
// by a later run. `protocol.py` had to be beside the entry script for the run
|
|
// to complete at all, since `bootstrap.py` imports it off `sys.path`.
|
|
expect(existsSync(dir)).toBe(false)
|
|
// A second run stages its own copy rather than reusing the first.
|
|
expect(dirname(await entryOf())).not.toBe(dir)
|
|
})
|
|
|
|
it('contains a program that rewrites its own bootstrap to the run that did it', async () => {
|
|
// The child runs as the same UID as the host, so `0o700` does not stop model
|
|
// code from rewriting the scripts it was started from —
|
|
// `sys.modules['__main__'].__file__` names them. While all runs shared one
|
|
// staged copy, a program that overwrote `bootstrap.py` broke the NEXT run
|
|
// (measured: it settled as `worker-exit`), and substituted code would have
|
|
// run before the resource limits were applied.
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const sabotage = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'path = sys.modules["__main__"].__file__',
|
|
'open(path, "w").write("raise SystemExit(1)\\n")',
|
|
'return path',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(sabotage.error).toBeUndefined()
|
|
// The damage stayed inside the run that caused it.
|
|
const after = await runtime.run({ program: 'return 1 + 1', bindings: [] })
|
|
expect(after.error).toBeUndefined()
|
|
expect(after.value).toBe(2)
|
|
}, 20_000)
|
|
|
|
it('leaves no subprocess or scripts behind when disposal races the first run', async () => {
|
|
// Staging runs SYNCHRONOUSLY so no async boundary opens between `run()` and
|
|
// the point where `execute` registers the run in `live` and installs the
|
|
// abort listener. With an `await` there, a disposal landing in that window
|
|
// saw an empty `live`, returned, removed the script directory, and let the
|
|
// continuation spawn a subprocess after the fiber was gone.
|
|
//
|
|
// `dispose()` is called in the same synchronous turn as `run()`, with no
|
|
// `await` between them, so it lands exactly in that window.
|
|
//
|
|
// The leak assertion compares before and after rather than requiring an
|
|
// empty tmpdir: other tests in this file build runtimes they never dispose,
|
|
// so only the directories this test adds are its own evidence.
|
|
const staged = (): string[] =>
|
|
readdirSync(realpathSync(tmpdir())).filter(name => name.startsWith('dsh-code-runtime-python-'))
|
|
const before = new Set(staged())
|
|
const { fiber, runtime } = await setup({ maxWallMs: 8_000 })
|
|
const pending = runtime.run({ program: 'import time\nwhile True: time.sleep(0.1)', bindings: [] })
|
|
const disposed = fiber.dispose()
|
|
const result = await pending
|
|
await disposed
|
|
// Whatever the run reports, it must be terminal and must not be a success.
|
|
expect(result.value).toBeUndefined()
|
|
expect(['abort', 'worker-exit', 'timeout']).toContain(result.error?.kind)
|
|
// Disposal is to quiescence, so this run's directory is gone once it
|
|
// resolves, and nothing recreated it afterwards.
|
|
expect(staged().filter(name => !before.has(name))).toEqual([])
|
|
}, 15_000)
|
|
|
|
it('settles as abort when the signal fires in the same turn as the first run', async () => {
|
|
// Same window, the other listener. `addEventListener('abort')` does not
|
|
// replay an event that already fired, so an abort landing before the
|
|
// listener was installed used to be missed entirely and the program ran to
|
|
// success or the wall ceiling instead of resolving as `abort`. Synchronous
|
|
// staging keeps the pre-flight check and the listener in one turn, leaving
|
|
// no gap for the signal to slip through.
|
|
const { runtime } = await setup({ maxWallMs: 4_000, graceMs: 200 })
|
|
const controller = new AbortController()
|
|
const pending = runtime.run({
|
|
program: 'import time\nwhile True: time.sleep(0.1)',
|
|
bindings: [],
|
|
signal: controller.signal,
|
|
})
|
|
controller.abort('same-turn-abort')
|
|
const result = await pending
|
|
expect(result.error?.kind).toBe('abort')
|
|
expect(result.error?.message).toContain('same-turn-abort')
|
|
}, 15_000)
|
|
|
|
it('reports a staging failure as worker-exit instead of rejecting run()', async () => {
|
|
// Staging touches the filesystem, so it can fail for reasons that are not
|
|
// the caller's doing: a full or read-only temp filesystem, or a deployment
|
|
// that failed to ship the packaged scripts. Those are SUBSTRATE failures,
|
|
// the same class as a child that cannot start, and the seam reserves
|
|
// rejection for misuse — so `run()` must resolve, not throw.
|
|
//
|
|
// `TMPDIR` is the honest lever: `mkdtempSync` builds its path from
|
|
// `os.tmpdir()`, so pointing it at a path that is not a directory makes the
|
|
// real call fail without stubbing the module under test.
|
|
const previous = process.env.TMPDIR
|
|
const notADirectory = join(await mkdtemp(join(tmpdir(), 'dsh-staging-')), 'file')
|
|
await writeFile(notADirectory, '')
|
|
process.env.TMPDIR = notADirectory
|
|
try {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain('failed to stage the python bootstrap')
|
|
expect(result.logs).toEqual([])
|
|
} finally {
|
|
if (previous === undefined) delete process.env.TMPDIR
|
|
else process.env.TMPDIR = previous
|
|
}
|
|
})
|
|
|
|
it('leaves no staging directory behind when a script copy fails', async () => {
|
|
// `mkdtempSync` succeeding and a later `copyFileSync` failing is its own
|
|
// case: the directory exists but is only partially populated. Recording it
|
|
// before the copies would leak it, because `run` retries staging on the next
|
|
// call and overwrites the single recorded path — teardown could then remove
|
|
// only the newest attempt. Staging must clean up its own partial directory.
|
|
//
|
|
// Only `copyFileSync` is stubbed, and only for the second script, so
|
|
// `mkdtempSync` really runs and the directory under assertion is real.
|
|
const staged = (): string[] =>
|
|
readdirSync(realpathSync(tmpdir())).filter(name => name.startsWith('dsh-code-runtime-python-'))
|
|
const before = new Set(staged())
|
|
failNextCopyOf.value = 'protocol.py'
|
|
try {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain('failed to stage the python bootstrap')
|
|
// The partial directory is gone, so nothing accumulates across retries.
|
|
expect(staged().filter(name => !before.has(name))).toEqual([])
|
|
} finally {
|
|
failNextCopyOf.value = undefined
|
|
}
|
|
}, 15_000)
|
|
})
|
|
|
|
describe('PythonCodeRuntime — inherited resource limits', () => {
|
|
it('runs under an inherited hard limit tighter than addressSpaceMb', async () => {
|
|
// An unprivileged process may lower a hard rlimit but never raise it. Under
|
|
// a harness started with `ulimit -v` below `addressSpaceBytes`, requesting
|
|
// the configured cap made `setrlimit` raise `ValueError` and every run
|
|
// returned a bootstrap exception — even though the inherited limit is
|
|
// STRONGER than the one asked for. The bootstrap clamps to the inherited
|
|
// hard limit instead, so the run proceeds under the stricter bound.
|
|
//
|
|
// `pythonBin` is the honest lever: a wrapper that lowers RLIMIT_AS and then
|
|
// execs the real interpreter reproduces the inherited-limit condition
|
|
// without touching this test process's own limits.
|
|
const dir = await mkdtemp(join(tmpdir(), 'dsh-rlimit-'))
|
|
const wrapper = join(dir, 'python3-capped')
|
|
// 256 MiB, half the 512 MiB addressSpaceMb default, so the requested cap is
|
|
// unambiguously above the inherited ceiling.
|
|
await writeFile(wrapper, '#!/bin/sh\nulimit -v 262144\nexec python3 "$@"\n', { mode: 0o755 })
|
|
const { runtime } = await setup({ pythonBin: wrapper })
|
|
const result = await runtime.run({
|
|
program: 'import resource\nreturn resource.getrlimit(resource.RLIMIT_AS)[1]',
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// The applied hard limit is the inherited one, not the configured 512 MiB.
|
|
expect(result.value).toBe(256 * 1024 * 1024)
|
|
}, 15_000)
|
|
|
|
it('applies the configured limits when nothing tighter is inherited', async () => {
|
|
// The clamp must not weaken the normal path: with an infinite inherited hard
|
|
// limit there is nothing to clamp against, and RLIM_INFINITY compares as -1,
|
|
// so treating it as a numeric bound would collapse every limit to -1.
|
|
const { runtime } = await setup({ cpuSeconds: 42, addressSpaceMb: 400 })
|
|
const result = await runtime.run({
|
|
// `getrlimit` returns a tuple, which the lossless-JSON completion check
|
|
// rejects; the pair is listed explicitly rather than converted.
|
|
program: 'import resource\ncpu = resource.getrlimit(resource.RLIMIT_CPU)\nreturn [cpu[0], cpu[1], resource.getrlimit(resource.RLIMIT_AS)[1]]',
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// Soft at cpuSeconds, hard at +1 (the SIGKILL backstop), address space at
|
|
// the configured megabytes — exactly what the unclamped path applied.
|
|
expect(result.value).toEqual([42, 43, 400 * 1024 * 1024])
|
|
}, 15_000)
|
|
|
|
it('preserves an inherited soft limit stricter than the configured cap', async () => {
|
|
// Clamping reads BOTH inherited bounds, not just the hard one. A deployment
|
|
// that inherited a soft rlimit below the configured cap must keep that
|
|
// stricter soft: returning the configured value would RAISE the effective
|
|
// soft limit, loosening containment. The wrapper lowers only the SOFT CPU
|
|
// limit (`ulimit -S -t`) and leaves the hard limit unlimited, so the
|
|
// requested soft (`cpuSeconds`) sits above the inherited soft — the case that
|
|
// exposed the bug. RLIMIT_CPU is used because macOS ignores `ulimit -v`
|
|
// (RLIMIT_AS), which is exactly why the backend skips address space there.
|
|
const dir = await mkdtemp(join(tmpdir(), 'dsh-rlimit-soft-'))
|
|
const wrapper = join(dir, 'python3-soft-capped')
|
|
// Soft CPU 5 s, well below the configured 30 s, hard left unlimited.
|
|
await writeFile(wrapper, '#!/bin/sh\nulimit -S -t 5\nexec python3 "$@"\n', { mode: 0o755 })
|
|
const { runtime } = await setup({ pythonBin: wrapper, cpuSeconds: 30 })
|
|
const result = await runtime.run({
|
|
program: 'import resource\nreturn resource.getrlimit(resource.RLIMIT_CPU)[0]',
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// The applied SOFT limit is the inherited 5 s, not the configured 30 s.
|
|
expect(result.value).toBe(5)
|
|
}, 15_000)
|
|
|
|
it('rechecks CPU at settlement against the effective inherited soft limit', async () => {
|
|
// The settlement-time CPU recheck must compare against the EFFECTIVE soft
|
|
// limit (`_clamped` may have lowered it to a stricter inherited value), not
|
|
// the configured `cpuSeconds`. A program that traps SIGXCPU, burns past the
|
|
// inherited soft, and returns inside the soft-to-hard gap would otherwise be
|
|
// compared to the configured value and falsely reported successful, bypassing
|
|
// the inherited limit. The wrapper sets a 1 s soft CPU limit; the program
|
|
// traps SIGXCPU and busy-loops past it, then returns — the recheck must
|
|
// re-deliver SIGXCPU so the host classifies the run as a timeout.
|
|
const dir = await mkdtemp(join(tmpdir(), 'dsh-cpu-recheck-'))
|
|
const wrapper = join(dir, 'python3-cpu-capped')
|
|
await writeFile(wrapper, '#!/bin/sh\nulimit -S -t 1\nexec python3 "$@"\n', { mode: 0o755 })
|
|
const { runtime } = await setup({ pythonBin: wrapper, cpuSeconds: 30, maxWallMs: 12_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal, time',
|
|
// Trap SIGXCPU so the soft limit does not terminate the program; burn
|
|
// CPU well past the inherited 1 s soft, then return normally.
|
|
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
|
'end = time.process_time() + 2.5',
|
|
'while time.process_time() < end:',
|
|
' pass',
|
|
'return "returned"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
// The recheck compares spent CPU against the effective 1 s soft, not 30 s, so
|
|
// the run is a timeout rather than a false success.
|
|
expect(result.error?.kind).toBe('timeout')
|
|
}, 20_000)
|
|
})
|
|
|
|
describe('PythonCodeRuntime — programs and bindings', () => {
|
|
it('runs a top-level script, captures print output, and returns `result`', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'x = 40',
|
|
'y = 2',
|
|
'print("hello", x + y)',
|
|
'return {"answer": x + y}',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual({ answer: 42 })
|
|
// `print` in Python emits: text, ' ', text, '\n'. Concat the captured
|
|
// fragments and assert the model-visible message survives.
|
|
expect(result.logs.join('')).toContain('hello 42')
|
|
// 15s: this is usually the suite's first real subprocess — a cold python3
|
|
// start (interpreter + asyncio import) on a loaded CI runner can exceed
|
|
// the 5s default alone; later tests reuse the warm page cache.
|
|
}, 15_000)
|
|
|
|
it('bridges binding calls both ways and rejects the program-side call on a host rejection', async () => {
|
|
const { runtime } = await setup()
|
|
const calls: unknown[] = []
|
|
const result = await runtime.run({
|
|
program: [
|
|
'first = await tools.echo({"n": 1})',
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.fail({})',
|
|
'except RuntimeError as e:',
|
|
' caught = str(e)',
|
|
'return {"first": first, "caught": caught}',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
echo: async (args) => { calls.push(args); return { echoed: args as CodeJsonValue } },
|
|
fail: async () => { throw new Error('nope') },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual({ first: { echoed: { n: 1 } }, caught: 'nope' })
|
|
expect(calls).toEqual([{ n: 1 }])
|
|
})
|
|
|
|
it('still answers the call when the rejection value cannot be converted to a string', async () => {
|
|
// `messageOf` calls `String(error)`, which runs the value's own conversion,
|
|
// and this call site is a DETACHED async reply callback. A rejection whose
|
|
// `Symbol.toPrimitive` throws therefore escaped as an unhandled rejection:
|
|
// the reply frame was never written, the program stayed blocked on `await`,
|
|
// and the run degraded to a `maxWallMs` timeout (observed) — a host with no
|
|
// `unhandledRejection` listener would exit instead. The rejection must reach
|
|
// the program as an ordinary error carrying a fixed placeholder.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'try:',
|
|
' await tools.hostile({})',
|
|
'except RuntimeError as e:',
|
|
' return "rejected: " + str(e)',
|
|
'return "no rejection"',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
hostile: async () => {
|
|
throw { [Symbol.toPrimitive]() { throw new Error('toPrimitive blew up') } }
|
|
},
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('rejected: <unrenderable rejection value>')
|
|
}, 15_000)
|
|
|
|
it('still answers the call when an Error carries a cyclic value in place of its message', async () => {
|
|
// `Error.message` is typed `string` but is a plain writable property, so a
|
|
// rejection can carry any value there. Returning it verbatim handed a
|
|
// non-string to `sendReply`, breaching `encodeJsonPlain`'s JSON-plain
|
|
// precondition: a cyclic object grew the encoder stack until the host threw
|
|
// RangeError from the detached reply callback, so no reply frame was written
|
|
// and the run degraded to a `maxWallMs` timeout (observed). The conversion
|
|
// must contain it — `String()` on a cycle throws inside the guard and lands
|
|
// on the placeholder, so the program sees an ordinary error.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'try:',
|
|
' await tools.hostile({})',
|
|
'except RuntimeError as e:',
|
|
' return "rejected: " + str(e)',
|
|
'return "no rejection"',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
hostile: async () => {
|
|
const cyclic: { self?: unknown; [Symbol.toPrimitive]: () => string } = {
|
|
// A cycle alone is inert for `String()`; the throwing conversion is
|
|
// what proves the guard runs rather than the encoder.
|
|
[Symbol.toPrimitive]: () => { throw new Error('cyclic message') },
|
|
}
|
|
cyclic.self = cyclic
|
|
const error = new Error('placeholder')
|
|
// Writable per spec, so no cast is needed to install a non-string.
|
|
;(error as unknown as { message: unknown }).message = cyclic
|
|
throw error
|
|
},
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('rejected: <unrenderable rejection value>')
|
|
}, 15_000)
|
|
|
|
it('renders an Error whose message is a value with no JSON form', async () => {
|
|
// The non-cyclic arm. A number would not discriminate: `scalarJson` renders
|
|
// it as digits and the child `str()`s the field back, so it survives the
|
|
// wire either way. `undefined` is the value that separates the two orders —
|
|
// `scalarJson` emits a bare `undefined` token, so the reply line is not JSON
|
|
// at all, the child's parse drops the frame, and the program stays blocked
|
|
// on `await` until the wall ceiling (observed). Converting first sends the
|
|
// string "undefined", which the program receives as an ordinary rejection.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'try:',
|
|
' await tools.absent({})',
|
|
'except RuntimeError as e:',
|
|
' return "rejected: " + str(e)',
|
|
'return "no rejection"',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
absent: async () => {
|
|
const error = new Error('placeholder')
|
|
;(error as unknown as { message: unknown }).message = undefined
|
|
throw error
|
|
},
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('rejected: undefined')
|
|
}, 15_000)
|
|
|
|
it('runs a program with no await', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'return 2 + 2',
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe(4)
|
|
})
|
|
|
|
it('returns JSON null whether the program returns None or falls off the end', async () => {
|
|
// Python has no `undefined`: an async body that returns None and one that
|
|
// never returns both yield None, so both complete as an exact JSON null.
|
|
// (The worker/TS backend can tell `return undefined` from `return null`;
|
|
// Python cannot, and reporting null for both is the honest rendering.)
|
|
const { runtime } = await setup()
|
|
const explicit = await runtime.run({ program: 'return None', bindings: [] })
|
|
expect(explicit.error).toBeUndefined()
|
|
expect(explicit.value).toBeNull()
|
|
const noReturn = await runtime.run({ program: 'x = 1', bindings: [] })
|
|
expect(noReturn.error).toBeUndefined()
|
|
expect(noReturn.value).toBeNull()
|
|
})
|
|
|
|
it('settles with no value on a forged valueless done frame', async () => {
|
|
// The child always sends a value now (return None → JSON null), so a done
|
|
// frame with no value key can only be forged; the host settles it as a
|
|
// value-less completion rather than crashing on the absent field.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'os.write(3, b\'{"type":"done"}\\n\')',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBeUndefined()
|
|
})
|
|
|
|
it('coalesces print arguments into one log line, not per-write fragments', async () => {
|
|
// print("a","b") calls write() per arg/sep/newline; the stream must emit
|
|
// one logical line "a b" so Code Mode's join(newline) does not insert
|
|
// spurious blank lines. Two prints → exactly two entries, no empties.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: ['print("a", "b")', 'print("c")', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs).toEqual(['a b', 'c'])
|
|
})
|
|
|
|
it('flushes a print with no trailing newline', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: ['print("partial", end="")', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs).toEqual(['partial'])
|
|
})
|
|
|
|
it('aggregates a large newline-free native write into one log entry, not one per pipe chunk', async () => {
|
|
// A single `os.write` larger than one pipe read arrives as several Node
|
|
// `data` chunks. `logs` entries are joined with `\n` downstream, so pushing
|
|
// one entry per transport chunk would insert model-visible newlines at
|
|
// arbitrary pipe boundaries inside one native write. Stray capture holds a
|
|
// per-stream residual and admits only on a real `\n`, so a 200 KiB blast
|
|
// with no newline reads back as exactly one entry with no interior breaks.
|
|
const { runtime } = await setup({ maxLogBytes: 300_000 })
|
|
const size = 200_000
|
|
const result = await runtime.run({
|
|
program: ['import os', `os.write(1, b"A" * ${size})`, 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs).toEqual(['A'.repeat(size)])
|
|
})
|
|
|
|
it('splits native output on its own newlines, one entry per line', async () => {
|
|
// The complement of the aggregation case: real newlines in a native write
|
|
// still delimit entries, matching the child's line-granular `log` frames.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: ['import os', 'os.write(1, b"one\\ntwo\\nthree")', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs).toEqual(['one', 'two', 'three'])
|
|
})
|
|
|
|
it('bounds a newline-free native flood by the ledger instead of buffering it whole', async () => {
|
|
// A newline-free write far larger than maxLogBytes must not accumulate in
|
|
// the host-side residual: when the pending residual would cross the budget
|
|
// it is admitted (and truncated) immediately, and once the ledger has
|
|
// truncated, later chunks stop buffering entirely. The run still completes
|
|
// and the captured output ends at the truncation marker rather than
|
|
// retaining the whole flood.
|
|
const { runtime } = await setup({ maxLogBytes: 4096 })
|
|
const result = await runtime.run({
|
|
program: ['import os', 'os.write(1, b"A" * 2_000_000)', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
|
// The retained output is bounded by the budget, not the 2 MB flood.
|
|
expect(result.logs.join('').length).toBeLessThan(4096)
|
|
})
|
|
|
|
it('bounds a control-char-dense native residual by serialized cost, not raw length', async () => {
|
|
// A newline-free NUL flood passes the cheap `length + 3` lower bound at a
|
|
// raw length well under the budget, but each NUL serializes to ` ` (6
|
|
// bytes), so the true JSON cost is ~6x. The ledger must charge that
|
|
// serialized cost — and `jsonStringCostUpTo` must measure it WITHOUT
|
|
// allocating the escaped copy, so a near-budget line under a large
|
|
// maxLogBytes cannot momentarily allocate a multi-gigabyte `JSON.stringify`
|
|
// result. Under a small budget the residual is truncated once the serialized
|
|
// cost crosses it.
|
|
const { runtime } = await setup({ maxLogBytes: 4096 })
|
|
const result = await runtime.run({
|
|
program: ['import os', 'os.write(1, b"\\x00" * 4000)', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
|
})
|
|
|
|
it('bounds a newline-free NUL flood through sys.stdout by serialized cost, not char count', async () => {
|
|
// `_LogStream` (the child's sys.stdout wrapper) buffers newline-free writes
|
|
// and early-flushes once the pending tail can no longer fit the ledger.
|
|
// Charging that trigger by CHARACTER count undercharged a control-char flood
|
|
// by up to 6x: 30M NUL chars stay under a 50 MB char-count trigger yet
|
|
// serialize to ~180 MB, which the settlement flush then allocated at once —
|
|
// breaching a 64 MB RLIMIT_AS and surfacing as worker-exit instead of the
|
|
// truncation marker. Driving the flood through sys.stdout.write (not
|
|
// os.write, which bypasses the wrapper into host stray capture) exercises the
|
|
// in-child stream. On Linux CI the pre-fix trigger dies on RLIMIT_AS; the
|
|
// serialized-cost trigger flushes while running, so the run completes and
|
|
// ends at the marker. (RLIMIT_AS is skipped on Darwin — bootstrap.py — so the
|
|
// worker-exit repro is Linux-only; locally this asserts the happy path.)
|
|
const { runtime } = await setup({ maxLogBytes: 50_000_000, addressSpaceMb: 64, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: ['import sys', 'sys.stdout.write("\\x00" * 30_000_000)', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(50_000_000))
|
|
})
|
|
|
|
it('bounds an illegal-UTF-8 native residual by its U+FFFD-decoded cost', async () => {
|
|
// Every 0xFF byte is illegal in any UTF-8 sequence, so `toString('utf8')`
|
|
// renders each as U+FFFD (3 serialized bytes). `accrueStrayCost` must charge
|
|
// that 3, not the raw 1: otherwise the newline-free residual grows to a full
|
|
// budget's worth of RAW bytes before flushing — a ~3x undercount that near a
|
|
// large maxLogBytes retains hundreds of MiB then expands toward a ~1 GiB peak
|
|
// in flushStray's concat + toString. Paced single-byte writes (each its own
|
|
// `data` chunk, like the sealing case) expose the sub-chunk accrual: charged
|
|
// at 3 the residual crosses a 3072-byte budget after ~1024 bytes and flushes;
|
|
// charged at 1 it would need ~3072 bytes, so the peak residual triples. The
|
|
// largest merged buffer is the discriminator.
|
|
const realConcat = Buffer.concat.bind(Buffer)
|
|
let maxConcat = 0
|
|
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
|
const merged = realConcat(list, total)
|
|
if (merged.length > maxConcat) maxConcat = merged.length
|
|
return merged
|
|
}
|
|
let result: CodeRunResult
|
|
try {
|
|
const { runtime } = await setup({ maxLogBytes: 3072, maxWallMs: 30_000 })
|
|
result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'for _ in range(6000):',
|
|
' os.write(1, b"\\xff")',
|
|
' os.sched_yield()',
|
|
'return None',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
} finally {
|
|
Buffer.concat = realConcat
|
|
}
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(3072))
|
|
// Charged at 3, the residual flushes around 1024 raw bytes; the largest
|
|
// merged buffer stays well under 2048. A raw-byte undercount would let it
|
|
// reach ~3072 before flushing, so 2048 discriminates.
|
|
expect(maxConcat).toBeLessThan(2048)
|
|
})
|
|
|
|
it('charges a lone surrogate its full six escaped bytes, not three', async () => {
|
|
// A forged `log` frame carrying `\ud800` escapes materializes lone
|
|
// surrogates after JSON.parse. `Buffer.byteLength` of U+FFFD is 3, but
|
|
// ES2019 well-formed `JSON.stringify` emits `\ud800` at 6 bytes, so charging
|
|
// the raw width would admit ~2x the configured budget of serialized bytes
|
|
// (the same family as the NUL-flood undercount, at 2x rather than 6x). The
|
|
// cost walker charges surrogates the full 6, so a flood truncates at budget.
|
|
// Forged on fd 3 because Python stdout will not emit lone surrogates.
|
|
const { runtime } = await setup({ maxLogBytes: 4096 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
// 1000 \ud800 escapes: charged at the buggy raw width 1000 * 3 = 3000
|
|
// bytes fits under 4096 (wrongly admitted), but the correct serialized
|
|
// width 1000 * 6 = 6000 bytes is over budget — so the ledger must
|
|
// truncate. The count sits in the 683..1365 window where the two
|
|
// chargings disagree, making the test discriminate.
|
|
String.raw`frame = b'{"type":"log","text":"' + b'\\ud800' * 1000 + b'"}\n'`,
|
|
'os.write(3, frame)',
|
|
'return None',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
|
})
|
|
|
|
it('drops a second stray line in the same chunk once the first truncated the ledger', async () => {
|
|
// One `os.write` carrying two newline-terminated lines where the first
|
|
// exhausts maxLogBytes: the first line's admit truncates and marks the
|
|
// ledger, and the second line's admit — reached in the same `data` callback
|
|
// — must be the post-truncation no-op. Proves that branch is exercised, so
|
|
// it carries no v8-ignore. Kept to 109 bytes (< the smallest PIPE_BUF, 512 on
|
|
// macOS) so the whole payload lands in ONE atomic write and one `data`
|
|
// callback — the two newlines cannot split across callbacks and leave the
|
|
// branch un-exercised, which would be a hard-to-attribute per-file coverage
|
|
// flake. 103 payload bytes still exceed the 64-byte budget, so it truncates.
|
|
const { runtime } = await setup({ maxLogBytes: 64 })
|
|
const result = await runtime.run({
|
|
program: ['import os', 'os.write(1, b"A" * 100 + b"\\nSECOND\\n")', 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(64))
|
|
expect(result.logs.join('\n')).not.toContain('SECOND')
|
|
})
|
|
|
|
it('charges a broken multibyte sequence its U+FFFD bytes, split across pipe chunks', async () => {
|
|
// A 3-byte lead (0xE4) whose continuation never arrives — the next byte is a
|
|
// fresh ASCII 'A' — must be costed as U+FFFD (3) for the orphaned lead, not
|
|
// folded into a phantom character. Driven byte-by-byte so the lead and the
|
|
// breaking byte land in separate `data` chunks, exercising accrueStrayCost's
|
|
// cross-chunk broken-sequence branch. The run completes and the bytes are
|
|
// captured (rendered U+FFFD by toString), proving the walk resynchronizes.
|
|
const { runtime } = await setup({ maxLogBytes: 1024 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'os.write(1, b"\\xe4")',
|
|
'os.sched_yield()',
|
|
'os.write(1, b"A\\n")',
|
|
'return None',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.join('')).toContain('A')
|
|
expect(result.logs.join('')).toContain('�')
|
|
})
|
|
|
|
it('charges the exact serialized cost of short-escape and quote/backslash characters', async () => {
|
|
// Exercises every branch of jsonStringCostUpTo's per-character cost: a tab
|
|
// and other C0 controls with short JSON forms (\t etc., 2 bytes), a quote
|
|
// and backslash (2 bytes each), a `\uXXXX` control (6 bytes), a multibyte
|
|
// BMP character (raw UTF-8 width), and plain ASCII. Under a budget large
|
|
// enough to admit it, the line survives verbatim — proving the cost walker
|
|
// does not over- or under-charge and the string round-trips unescaped.
|
|
const { runtime } = await setup({ maxLogBytes: 4096 })
|
|
const result = await runtime.run({
|
|
program: ['import os', String.raw`os.write(1, "\ta\"b\\c\x01é\n".encode("utf-8"))`, 'return None'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs).toEqual(['\ta"b\\c\x01é'])
|
|
})
|
|
|
|
it('fails a completion dict with a non-string key as invalid-output (no key coercion)', async () => {
|
|
// json.dumps would coerce {1: "a", "1": "b"} to a single "1" key, silently
|
|
// dropping data. The shape validator rejects it before encoding.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'return {1: "first", "1": "second"}',
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('invalid-output')
|
|
expect(result.error?.message).toContain('non-string dict key')
|
|
})
|
|
|
|
it('rejects a binding argument with a non-string dict key before dispatch', async () => {
|
|
const { runtime } = await setup()
|
|
let called = false
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.sink({1: "x"})',
|
|
'except RuntimeError as e:',
|
|
' caught = str(e)',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: tools({ sink: async () => { called = true; return null } }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('lossless JSON')
|
|
expect(called).toBe(false)
|
|
})
|
|
|
|
it('fails a non-JSON completion value as invalid-output (no repr substitution)', async () => {
|
|
// A set is not lossless JSON. The old draft substituted repr(); the seam
|
|
// now requires refusing the run instead.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'return {1, 2, 3}',
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('invalid-output')
|
|
expect(result.error?.message).toContain('lossless JSON')
|
|
expect(result.error?.message).toContain('set')
|
|
})
|
|
|
|
it('fails a negative-zero completion value as invalid-output (sign bit is lossy over JSON)', async () => {
|
|
// JSON serialization turns -0.0 into 0 (or JS -0), silently changing the
|
|
// sign bit; the canonical lossless-JSON boundary rejects it, so the
|
|
// Python side must too — as a completion and as a binding argument.
|
|
const { runtime } = await setup()
|
|
const completion = await runtime.run({
|
|
program: 'return -0.0',
|
|
bindings: [],
|
|
})
|
|
expect(completion.error?.kind).toBe('invalid-output')
|
|
expect(completion.error?.message).toContain('negative zero')
|
|
const argument = await runtime.run({
|
|
program: [
|
|
'try:',
|
|
' await tools.echo(-0.0)',
|
|
' return "accepted"',
|
|
'except RuntimeError as e:',
|
|
' return str(e)',
|
|
].join('\n'),
|
|
bindings: tools({ echo: async args => args as never }),
|
|
})
|
|
expect(argument.error).toBeUndefined()
|
|
expect(argument.value).toContain('negative zero')
|
|
})
|
|
|
|
it('fails a NaN completion value as invalid-output (allow_nan=False)', async () => {
|
|
// json.dumps would happily emit NaN by default, but NaN is not JSON; the
|
|
// bootstrap passes allow_nan=False so it fails as invalid-output.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'return float("nan")',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('invalid-output')
|
|
})
|
|
|
|
it('fails an over-budget completion value as output-limit (child-side check)', async () => {
|
|
const { runtime } = await setup({ maxValueBytes: 64 })
|
|
const result = await runtime.run({
|
|
program: 'return "V" * 5000',
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
expect(result.error?.message).toContain('exceeded 64 bytes')
|
|
})
|
|
|
|
it('rejects a wide completion as output-limit before materializing its traversal state', async () => {
|
|
// `[0] * 2000000` sits far above maxValueBytes but well below the frame
|
|
// ceiling. The folded checker must reject it via the pre-enqueue bound —
|
|
// BEFORE pushing two million elements onto the walk — so a small
|
|
// addressSpaceMb does not turn the check itself into an RLIMIT_AS death.
|
|
const { runtime } = await setup({ maxValueBytes: 64, addressSpaceMb: 256, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: 'return [0] * 2000000',
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
expect(result.error?.message).toContain('exceeded 64 bytes')
|
|
}, 20_000)
|
|
|
|
it('rejects a wide dict as output-limit without materializing its items list', async () => {
|
|
// Same pre-enqueue bound on the dict branch: `len(current)` replaces
|
|
// `list(current.items())`, which allocated one tuple per member before the
|
|
// bound could reject the value. Two million entries under a 64-byte cap
|
|
// fits the 256 MiB address space as a dict but not as a dict PLUS a
|
|
// two-million-tuple list.
|
|
const { runtime } = await setup({ maxValueBytes: 64, addressSpaceMb: 256, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: 'return {str(i): 0 for i in range(2000000)}',
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
expect(result.error?.message).toContain('exceeded 64 bytes')
|
|
}, 20_000)
|
|
|
|
it('meters a float completion in the host\'s number spelling', async () => {
|
|
// CPython's repr disagrees with the host's String(number): `1.0` is three
|
|
// bytes here and one there, `1e-07` pads the exponent the host writes as
|
|
// `1e-7`. Both sides meter the SAME budget, so the child must count the
|
|
// bytes the host will receive — otherwise a boundary-sized value is
|
|
// falsely reported as output-limit.
|
|
const { runtime } = await setup({ maxValueBytes: 1 })
|
|
const integral = await runtime.run({ program: 'return 1.0', bindings: [] })
|
|
expect(integral.error).toBeUndefined()
|
|
expect(integral.value).toBe(1)
|
|
|
|
const exponent = await setup({ maxValueBytes: 4 })
|
|
const small = await exponent.runtime.run({ program: 'return 1e-7', bindings: [] })
|
|
expect(small.error).toBeUndefined()
|
|
expect(small.value).toBe(1e-7)
|
|
|
|
// The spelling is a meter input, not a licence to overshoot: `1.5` is three
|
|
// bytes on both sides and still fails a two-byte budget.
|
|
const tight = await setup({ maxValueBytes: 2 })
|
|
const over = await tight.runtime.run({ program: 'return 1.5', bindings: [] })
|
|
expect(over.error?.kind).toBe('output-limit')
|
|
})
|
|
|
|
it('carries floats across the wire in the host\'s number spelling', async () => {
|
|
// The child ENCODES with the same speller it meters with, so the frame the
|
|
// host parses must reproduce every double exactly — including the branches
|
|
// where CPython and ECMAScript disagree (integral floats, sub-1e-6
|
|
// exponents, >= 1e21, and beyond-safe-range integral doubles whose exact
|
|
// digits differ from the shortest round-trip form).
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'return [1.0, 100.0, 1.5, 0.1, 1e-7, 1e-6, 1e-5, 123.456, -2.5e-8, 1e21, float(2**60), 5e-324, 1.7976931348623157e308]',
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual([1, 100, 1.5, 0.1, 1e-7, 1e-6, 1e-5, 123.456, -2.5e-8, 1e21, 2 ** 60, 5e-324, 1.7976931348623157e308])
|
|
})
|
|
|
|
it('rejects a forged non-lossless done value host-side as invalid-output', async () => {
|
|
// A forged done frame bypasses the child's _check_done_value. JSON.parse
|
|
// turns 1e400 into Infinity; validateChildFrame no longer scans done.value,
|
|
// so the host's own checkDoneValue must catch the non-lossless number.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
String.raw`os.write(3, b'{"type":"done","value":1e400}' + b'\n')`,
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('invalid-output')
|
|
expect(result.error?.message).toContain('non-lossless number')
|
|
})
|
|
|
|
it('reports a syntax error as an exception without settling with a value', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: '$$invalid python$$',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('SyntaxError')
|
|
expect(result.value).toBeUndefined()
|
|
})
|
|
|
|
it('reports a runtime raise as an exception with the traceback', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'raise ValueError("intentional")',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('ValueError')
|
|
expect(result.error?.message).toContain('intentional')
|
|
})
|
|
|
|
it('bounds a deep exception cause chain instead of burning the wall budget formatting it', async () => {
|
|
// A chain thousands of links deep would make the rendering walk and
|
|
// format() linear in its length, consuming maxWallMs. Rendering is capped
|
|
// at 100 links with a marker; the run reports the exception well within
|
|
// budget rather than timing out.
|
|
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 20_000 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'err = None',
|
|
'for i in range(3000):',
|
|
' try:',
|
|
' raise ValueError(i) from err',
|
|
' except ValueError as e:',
|
|
' err = e',
|
|
'raise err',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('exception chain truncated at 100 links')
|
|
expect(Date.now() - start).toBeLessThan(15_000)
|
|
}, 25_000)
|
|
|
|
it('bounds an over-cap chain without assigning to the live exception', async () => {
|
|
// The cap used to be applied by severing the over-cap link ON the live
|
|
// exception. An exception class overriding __setattr__ to raise turned that
|
|
// assignment into model code running inside the bootstrap's failure
|
|
// handler; the throw skipped the `done` send that sits after the handler,
|
|
// so the host blocked on fd 3 and reported a maxWallMs timeout instead of
|
|
// the model's own exception. Cutting the chain on the TracebackException
|
|
// COPY touches no model hook, so the marker still appears and the run
|
|
// reports `exception`.
|
|
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 15_000 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'class Sealed(Exception):',
|
|
' def __setattr__(self, name, value):',
|
|
' raise RuntimeError("live mutation refused")',
|
|
'err = None',
|
|
'for i in range(150):',
|
|
' try:',
|
|
' raise Sealed(i) from err',
|
|
' except Sealed as e:',
|
|
' err = e',
|
|
'raise err',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('Sealed')
|
|
expect(result.error?.message).toContain('exception chain truncated at 100 links')
|
|
// The sever attempt is what used to leak: its message must not appear, and
|
|
// the run must settle well inside the wall budget rather than timing out.
|
|
expect(result.error?.message).not.toContain('live mutation refused')
|
|
expect(Date.now() - start).toBeLessThan(10_000)
|
|
}, 20_000)
|
|
|
|
it('still sends done when rendering the diagnostic itself raises', async () => {
|
|
// format() reaches the exception's own __str__, so a model class whose
|
|
// __str__ raises can throw from inside the failure handler. CPython's
|
|
// _safe_string absorbs a raising __str__ during formatting, but the
|
|
// fallback must hold for any throw on that path (a raising __repr__ of an
|
|
// argument, a MemoryError under RLIMIT_AS), so the assertion is the
|
|
// invariant that matters: a `done` frame carrying `exception`, never a
|
|
// timeout, and never the failing renderer's own message.
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'class Unprintable(Exception):',
|
|
' def __str__(self):',
|
|
' raise RuntimeError("str refused")',
|
|
' def __repr__(self):',
|
|
' raise RuntimeError("repr refused")',
|
|
'raise Unprintable()',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('Unprintable')
|
|
expect(result.error?.message).not.toContain('str refused')
|
|
expect(result.error?.message).not.toContain('repr refused')
|
|
}, 15_000)
|
|
|
|
it('sends done with an inert diagnostic when the whole rendering path raises', async () => {
|
|
// Drive the fallback itself. `TracebackException.format` reads the
|
|
// exception class's `__module__` to decide whether to qualify the name, and
|
|
// a metaclass property can raise there — a throw INSIDE the formatter,
|
|
// reached with no rebinding of anything the bootstrap owns. Without the
|
|
// wrapper it escapes the handler, the `done` send never runs, and the host
|
|
// times out at maxWallMs.
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'class Meta(type):',
|
|
' @property',
|
|
' def __module__(cls):',
|
|
' raise RuntimeError("renderer refused")',
|
|
'class Hostile(ValueError, metaclass=Meta):',
|
|
' pass',
|
|
'raise Hostile("original failure")',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
// The inert fallback names the class and a fixed literal; it must not carry
|
|
// the renderer's message, and must not have become a timeout. `__name__` is
|
|
// still a plain str here, so the class name survives.
|
|
expect(result.error?.message).toBe('Hostile: <diagnostic rendering failed>')
|
|
}, 15_000)
|
|
|
|
it('falls back to a placeholder class name when __name__ itself raises', async () => {
|
|
// The fallback reads type(exc).__name__, which a metaclass property can
|
|
// hijack. It must neither run that override's failure into the handler nor
|
|
// format a non-str __name__ into the message. The hostile `__module__` is
|
|
// what drives execution into the fallback in the first place.
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'class Meta(type):',
|
|
' @property',
|
|
' def __module__(cls):',
|
|
' raise RuntimeError("renderer refused")',
|
|
' @property',
|
|
' def __name__(cls):',
|
|
' raise RuntimeError("name refused")',
|
|
'class Nameless(Exception, metaclass=Meta):',
|
|
' pass',
|
|
'raise Nameless()',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toBe('<unknown>: <diagnostic rendering failed>')
|
|
}, 15_000)
|
|
|
|
it('reports the real exception when the program rebinds every name the failure path uses', async () => {
|
|
// The bootstrap IS __main__, so `import __main__; __main__._X = ...` reaches
|
|
// any module global a call-time lookup would read. The failure path is the
|
|
// worst place for that: the reporter, the byte cap, the traceback formatter,
|
|
// the settlement flush and the `done` send all run AFTER the `except` block,
|
|
// so a replacement that raises skips the send, leaves the host blocked on
|
|
// fd 3, and the run reports a maxWallMs timeout instead of the model's own
|
|
// exception. Rebind all of them at once; the run must still carry the real
|
|
// ValueError.
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import __main__',
|
|
'def boom(*a, **k):',
|
|
' raise RuntimeError("hijacked")',
|
|
'__main__._SAFE_MODEL_TRACEBACK = boom',
|
|
'__main__._cap_message = boom',
|
|
'__main__._model_traceback = boom',
|
|
'__main__._UNRENDERABLE_DIAGNOSTIC = boom',
|
|
'__main__._LogStream.flush_line = boom',
|
|
'__main__.ProtocolChannel.send_sync = boom',
|
|
'raise ValueError("real failure")',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('ValueError: real failure')
|
|
expect(result.error?.message).not.toContain('hijacked')
|
|
}, 15_000)
|
|
|
|
it('bounds an over-cap exception-group nesting on the copy', async () => {
|
|
// Exception groups link through `exceptions`, not the cause/context
|
|
// dunders, so the cap has to count that edge too — otherwise a deeply
|
|
// nested group walks past the bound the marker claims to enforce.
|
|
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'group = ValueError("leaf")',
|
|
'for i in range(150):',
|
|
' group = ExceptionGroup(f"g{i}", [group])',
|
|
'raise group',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('exception chain truncated at 100 links')
|
|
}, 20_000)
|
|
|
|
it('filters every bootstrap frame from the traceback of an uncaught binding rejection', async () => {
|
|
// A rejection re-raised by the bootstrap's dispatch adds bootstrap frames
|
|
// AFTER the model's own; only <model> frames may reach model-visible,
|
|
// durable output — a bootstrap.py path would leak host absolutes and make
|
|
// transcripts machine-dependent.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: 'await tools.boom({})',
|
|
bindings: tools({ boom: async () => { throw new Error('exploded') } }),
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('exploded')
|
|
expect(result.error?.message).toContain('<model>')
|
|
expect(result.error?.message).not.toContain('bootstrap.py')
|
|
})
|
|
|
|
it('renders a non-Error thrown value from a host binding as its String form', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.failRaw({})',
|
|
'except RuntimeError as e:',
|
|
' caught = str(e)',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
failRaw: async () => { throw 'raw-nope' },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('raw-nope')
|
|
})
|
|
|
|
it('reassembles a frame split across writes behind a completed one', async () => {
|
|
// One os.write carrying "<frame>\n<partial...>" leaves a non-empty
|
|
// residual after the newline loop; the tail must survive until its own
|
|
// newline arrives and then parse as a normal frame.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'head = json.dumps({"type":"log","text":"first"}).encode()',
|
|
'tail = json.dumps({"type":"log","text":"second"}).encode()',
|
|
'import time',
|
|
'os.write(3, head + b"\\n" + tail[:5])',
|
|
'time.sleep(0.2)',
|
|
'os.write(3, tail[5:] + b"\\n")',
|
|
'return "ok"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('ok')
|
|
expect(result.logs).toContain('first')
|
|
expect(result.logs).toContain('second')
|
|
})
|
|
|
|
it('raises the declared errorClass with the member name on rejection', async () => {
|
|
// Code Mode declares { name: ToolCallError, memberNameProperty: toolName };
|
|
// a host rejection must surface as that class, carrying the failed tool.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.fail({})',
|
|
'except ToolCallError as e:',
|
|
' caught = f"{type(e).__name__}:{e.toolName}:{e}"',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: [{
|
|
global: 'tools',
|
|
functions: { fail: async () => { throw new Error('typed-nope') } },
|
|
errorClass: { name: 'ToolCallError', memberNameProperty: 'toolName' },
|
|
}],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('ToolCallError:fail:typed-nope')
|
|
})
|
|
|
|
it('rejects an errorClass name colliding with its namespace global at the seam', async () => {
|
|
const { runtime } = await setup()
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'tools', memberNameProperty: 'toolName' } }],
|
|
})).rejects.toThrow(/collides with another injected global/)
|
|
})
|
|
|
|
it('rejects a namespace global colliding with a runtime-owned name at the seam', async () => {
|
|
// `__dsh_main__` passes the identifier check, but exec()ing the generated
|
|
// wrapper would silently overwrite the binding after injection. `console`
|
|
// is the WORKER backend's slot — refused here too so a namespace list
|
|
// valid on one backend is valid on all.
|
|
const { runtime } = await setup()
|
|
// `__debug__` is refused for a different reason than a collision: CPython
|
|
// compiles a bare `__debug__` reference to the constant True and refuses to
|
|
// assign the name at compile time, so an injected global under it is
|
|
// unreachable from the program — accepted by the seam, unusable here.
|
|
for (const global of ['__dsh_main__', 'console', '__debug__']) {
|
|
await expect(runtime.run({
|
|
program: 'x = 1',
|
|
bindings: [{ global, functions: {} }],
|
|
})).rejects.toThrow(/collides with a runtime-owned global/)
|
|
}
|
|
})
|
|
|
|
it('accepts a non-identifier memberNameProperty and rejects only an empty one', async () => {
|
|
// The seam permits any non-empty own property except the reserved
|
|
// members; Python setattr/getattr carry exotic names like `tool-name`,
|
|
// and the worker backend accepts them, so this backend must too.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'try:',
|
|
' await tools.boom({})',
|
|
'except ToolCallError as e:',
|
|
' return getattr(e, "tool-name")',
|
|
].join('\n'),
|
|
bindings: [{
|
|
global: 'tools',
|
|
functions: { boom: async () => { throw new Error('nope') } },
|
|
errorClass: { name: 'ToolCallError', memberNameProperty: 'tool-name' },
|
|
}],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('boom')
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'ToolCallError', memberNameProperty: '' } }],
|
|
})).rejects.toThrow(/memberNameProperty must be a non-empty attribute name/)
|
|
})
|
|
|
|
it('resolves a basename pythonBin to an absolute path (runs a real program)', async () => {
|
|
// A bare `python3` basename must resolve against PATH and actually launch
|
|
// under the empty-env spawn — exercises the accessSync success branch.
|
|
const { runtime } = await setup({ pythonBin: 'python3' })
|
|
const result = await runtime.run({ program: 'return 7', bindings: [] })
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe(7)
|
|
})
|
|
|
|
it('spawns via an absolute python path resolved from a basename against PATH', async () => {
|
|
// resolvePythonBin turns the default basename into an absolute path before
|
|
// the empty-env spawn; a basename with no PATH match falls through to the
|
|
// normal ENOENT worker-exit rather than throwing.
|
|
const { runtime } = await setup({ pythonBin: 'definitely-no-such-python-xyz' })
|
|
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
})
|
|
|
|
it('rejects a memberNameProperty naming a constrained BaseException attribute', async () => {
|
|
// `__dict__`/`__class__` are constrained descriptors alongside
|
|
// `__traceback__` — setattr of a string raises TypeError while
|
|
// constructing the rejection — so every dunder is refused at the seam.
|
|
const { runtime } = await setup()
|
|
// name/message/stack are the seam's own exclusions (CodeBindingErrorClass
|
|
// forbids replacing them; the worker backend rejects them identically).
|
|
for (const member of ['__traceback__', '__dict__', '__class__', 'args', 'name', 'message', 'stack']) {
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{ global: 'tools', functions: {}, errorClass: { name: 'ToolCallError', memberNameProperty: member } }],
|
|
})).rejects.toThrow(/reserved error member/)
|
|
}
|
|
})
|
|
|
|
it('rejects a lossy binding resolution (NaN) instead of coercing it to null', async () => {
|
|
// JSON.stringify would turn NaN into null and drop undefined fields; the
|
|
// seam requires a descriptive rejection so data cannot silently corrupt.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.bad({})',
|
|
'except RuntimeError as e:',
|
|
' caught = str(e)',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: tools({ bad: async () => Number.NaN }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('lossless JSON')
|
|
})
|
|
|
|
it('contains a forged pathological done value without crashing the host', async () => {
|
|
// A ~20k-deep nested array forged onto fd 3 would overflow a recursive
|
|
// JSON.stringify; the host's iterative encoder measures it stack-safely
|
|
// and fails it deterministically on the byte budget (40 kB > 32 KiB).
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'depth = 20000',
|
|
'payload = "[" * depth + "]" * depth',
|
|
'os.write(3, b\'{"type":"done","value":\' + payload.encode() + b\'}\\n\')',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
})
|
|
|
|
it('preserves a deeply nested completion value below the byte budget', async () => {
|
|
// CodeJsonValue has no depth limit: a 10000-deep nested list is only
|
|
// ~20 kB — under maxValueBytes — and must cross intact. That depth
|
|
// overflows BOTH recursive serializers the pipeline used to rely on
|
|
// (CPython's json.dumps recursion limit ~1000s, V8's JSON.stringify), so
|
|
// it proves the child-side _encode_json_plain and the host-side
|
|
// encodeJsonPlain together. The host JSON.parse of the frame is iterative
|
|
// in V8 for arrays, so only the two encoders were at risk.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'v = None',
|
|
'for _ in range(10000):',
|
|
' v = [v]',
|
|
'return v',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// Walk down iteratively (a recursive toEqual would itself overflow).
|
|
let depth = 0
|
|
let cursor: unknown = result.value
|
|
while (Array.isArray(cursor)) {
|
|
expect(cursor).toHaveLength(1)
|
|
cursor = cursor[0]
|
|
depth++
|
|
}
|
|
expect(depth).toBe(10000)
|
|
expect(cursor).toBeNull()
|
|
})
|
|
|
|
it('bridges a deeply nested binding resolution back into the program stack-safely', async () => {
|
|
// A binding resolution has no seam-level depth or byte cap; neither the
|
|
// host's reply serialization nor the CHILD's reply decode may die on
|
|
// recursion (json.loads raises RecursionError ~10k levels deep; the
|
|
// bootstrap decodes frames iteratively). 12000 levels sits past that
|
|
// limit while staying tiny in bytes.
|
|
const { runtime } = await setup()
|
|
const deep = ((): unknown => {
|
|
let v: unknown = null
|
|
for (let i = 0; i < 12000; i++) v = [v]
|
|
return v
|
|
})()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'v = await tools.deep({})',
|
|
'depth = 0',
|
|
'while isinstance(v, list):',
|
|
' v = v[0]',
|
|
' depth += 1',
|
|
'return depth',
|
|
].join('\n'),
|
|
bindings: tools({ deep: async () => deep as never }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe(12000)
|
|
})
|
|
|
|
it('rejects a reserved errorClass name at the seam', async () => {
|
|
const { runtime } = await setup()
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{
|
|
global: 'tools',
|
|
functions: {},
|
|
errorClass: { name: 'class', memberNameProperty: 'toolName' },
|
|
}],
|
|
})).rejects.toThrow(/errorClass.name "class" is not a usable Python identifier/)
|
|
})
|
|
|
|
it('routes a declared inherited-attribute name through the bridge via subscript', async () => {
|
|
// __class__ resolves on `object` before any fallback hook; the proxy's
|
|
// __getattribute__ intercepts declared names first, and subscript access
|
|
// is the SDK-advertised route for underscore names.
|
|
const { runtime } = await setup()
|
|
const seen: string[] = []
|
|
const result = await runtime.run({
|
|
program: [
|
|
'a = await tools["__class__"]({"via": "subscript"})',
|
|
'b = await tools.__class__({"via": "dot"})',
|
|
'return [a, b]',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
'__class__': async () => { seen.push('called'); return 'bridged' },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual(['bridged', 'bridged'])
|
|
expect(seen).toEqual(['called', 'called'])
|
|
})
|
|
|
|
it('rejects NaN binding arguments immediately instead of hanging', async () => {
|
|
// Default json.dumps would emit a non-standard NaN token that the host
|
|
// JSON.parse drops silently, hanging the call until the wall clock;
|
|
// allow_nan=False raises in-program right away.
|
|
const { runtime } = await setup({ maxWallMs: 8000 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.echo({"x": float("nan")})',
|
|
'except RuntimeError as e:',
|
|
' caught = str(e)',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: tools({ echo: async args => args as CodeJsonValue }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('lossless JSON')
|
|
expect(Date.now() - start).toBeLessThan(5000)
|
|
})
|
|
|
|
it('carries large binding arguments well past maxValueBytes', async () => {
|
|
// Binding traffic has no seam byte cap: a call frame far larger than the
|
|
// completion budget must reach the host intact (the fd-3 ceiling is a
|
|
// fixed memory-safety bound, not an output budget).
|
|
const maxValueBytes = 4096
|
|
const { runtime } = await setup({ maxValueBytes })
|
|
let receivedLength = 0
|
|
const result = await runtime.run({
|
|
program: [
|
|
`big = "B" * ${maxValueBytes * 50}`,
|
|
'r = await tools.measure({"payload": big})',
|
|
'return r',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
measure: async (args) => {
|
|
receivedLength = ((args as { payload: string }).payload).length
|
|
return receivedLength
|
|
},
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(receivedLength).toBe(maxValueBytes * 50)
|
|
expect(result.value).toBe(maxValueBytes * 50)
|
|
})
|
|
|
|
it('rejects an unknown binding name inside the program with a matching error', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.nope({})',
|
|
'except (AttributeError, RuntimeError) as e:',
|
|
' caught = str(e)',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: tools({ known: async () => 'ok' }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('nope')
|
|
})
|
|
|
|
it('bounds an unknown-binding diagnostic built from a forged call frame', async () => {
|
|
// `call.global` and `call.name` carry no byte cap of their own, only the
|
|
// 256 MiB fd-3 frame ceiling, and the reply interpolated them raw: one copy
|
|
// into the template result, one into the `JSON.stringify` escape, one into
|
|
// the `encodeJsonPlain` frame, one into the pipe write. Slicing each field
|
|
// to `maxValueBytes` code units first makes an 8 MiB forged name a
|
|
// 128-byte reply. The observable effect is the reply the child then has to
|
|
// READ: its fd-3 reader is unbuffered, so `readline` consumes an oversized
|
|
// reply one `read(2)` per byte and the run's own legitimate call never gets
|
|
// answered — measured under a 60 s ceiling, the 8 MiB case timed out and a
|
|
// 64 MiB case cost the host 509.9 MiB of heap against 120.3 MiB with the
|
|
// slices in place. The child's address space stays generous enough to BUILD
|
|
// the forgery, which is not what is under test.
|
|
const { runtime } = await setup({ maxValueBytes: 128, addressSpaceMb: 1024, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'frame = b\'{"type":"call","id":9001,"global":"tools","name":"\' + b"n" * (8 * 1024 * 1024) + b\'","args":{}}\\n\'',
|
|
// One os.write returns short past the pipe buffer, and a partial frame
|
|
// would glue itself to the next one and be dropped as malformed, so the
|
|
// forgery goes out through a drain loop.
|
|
'view = memoryview(frame)',
|
|
'while view:',
|
|
' view = view[os.write(3, view):]',
|
|
// A legitimate call after the forgery: its reply can only arrive once
|
|
// the child has read past whatever the forged frame was answered with.
|
|
'await tools.known({})',
|
|
'return "settled"',
|
|
].join('\n'),
|
|
bindings: tools({ known: async () => 'ok' }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('settled')
|
|
}, 40_000)
|
|
|
|
it('bridges a binding call reached via subscript access (tools["name"])', async () => {
|
|
// The SDK tells the model `await tools["my-tool"](args)` works for exotic
|
|
// names; the proxy's __getitem__ must route it through the bridge.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'r = await tools["my-tool"]({"n": 7})',
|
|
'return r',
|
|
].join('\n'),
|
|
bindings: tools({ 'my-tool': async args => ({ got: args as CodeJsonValue }) }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual({ got: { n: 7 } })
|
|
})
|
|
|
|
it('raises KeyError for an undeclared subscript name', async () => {
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools["absent"]({})',
|
|
'except KeyError as e:',
|
|
' caught = str(e)',
|
|
'return caught',
|
|
].join('\n'),
|
|
bindings: tools({ known: async () => 'ok' }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('absent')
|
|
})
|
|
})
|
|
|
|
describe('PythonCodeRuntime — budgets, termination, disposal', () => {
|
|
it('kills a wall-clock runaway program via SIGTERM/SIGKILL and reports timeout', async () => {
|
|
const { runtime } = await setup({ maxWallMs: 500, graceMs: 200 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: 'import time\nwhile True: time.sleep(1)',
|
|
bindings: [],
|
|
})
|
|
const elapsed = Date.now() - start
|
|
// The wall timer may fire first or the exit-after-signal may resolve; both are ok.
|
|
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
|
// We got somewhere in the neighborhood of maxWallMs, not the underlying `sleep(1)`.
|
|
expect(elapsed).toBeLessThan(2000)
|
|
}, 5000)
|
|
|
|
it('aborts a run when the outer signal fires mid-flight', async () => {
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const controller = new AbortController()
|
|
const settled: Promise<CodeRunResult> = runtime.run({
|
|
program: 'import time\nwhile True: time.sleep(0.1)',
|
|
bindings: [],
|
|
signal: controller.signal,
|
|
})
|
|
setTimeout(() => { controller.abort('outer-abort') }, 200)
|
|
const result = await settled
|
|
expect(['abort', 'worker-exit']).toContain(result.error?.kind)
|
|
}, 5000)
|
|
|
|
it('settles the run when a mid-flight abort reason cannot be converted', async () => {
|
|
// The listener converted the reason before calling `finish()`, so a hostile
|
|
// reason threw from inside an `AbortSignal` listener. Node reports that as an
|
|
// uncaught exception — it can terminate the host — and `finish()` never ran,
|
|
// so the run stayed live until the wall ceiling and misreported as `timeout`
|
|
// (observed) instead of the caller's cancellation. `maxWallMs` is short so
|
|
// that misreport is a fast assertion failure rather than a suite timeout.
|
|
const uncaught: unknown[] = []
|
|
const record = (error: unknown): void => { uncaught.push(error) }
|
|
process.on('uncaughtException', record)
|
|
try {
|
|
const { runtime } = await setup({ maxWallMs: 4_000, graceMs: 200 })
|
|
const controller = new AbortController()
|
|
const settled: Promise<CodeRunResult> = runtime.run({
|
|
program: 'import time\nwhile True: time.sleep(0.1)',
|
|
bindings: [],
|
|
signal: controller.signal,
|
|
})
|
|
setTimeout(() => {
|
|
controller.abort({ [Symbol.toPrimitive]() { throw new Error('reason blew up') } })
|
|
}, 200)
|
|
const result = await settled
|
|
expect(result.error?.kind).toBe('abort')
|
|
expect(result.error?.message).toBe('<unrenderable rejection value>')
|
|
expect(uncaught).toEqual([])
|
|
} finally {
|
|
process.off('uncaughtException', record)
|
|
}
|
|
}, 15_000)
|
|
|
|
it('disposes to quiescence: an in-flight run resolves as abort and the child exits', async () => {
|
|
const { fiber, runtime } = await setup({ maxWallMs: 10_000 })
|
|
const pending = runtime.run({
|
|
program: 'import time\nwhile True: time.sleep(0.1)',
|
|
bindings: [],
|
|
})
|
|
// Give the process time to spawn and start running.
|
|
await new Promise(resolve => setTimeout(resolve, 200))
|
|
await fiber.dispose()
|
|
const result = await pending
|
|
expect(['abort', 'worker-exit']).toContain(result.error?.kind)
|
|
}, 5000)
|
|
|
|
it('reports a spawn failure via a bogus python binary as worker-exit', async () => {
|
|
const { runtime } = await setup({ pythonBin: '/nonexistent/python-binary', maxWallMs: 3000 })
|
|
const result = await runtime.run({
|
|
program: 'return 1',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
}, 8000)
|
|
|
|
it('applies the strictest of the configured and inherited resource limits', async () => {
|
|
// This case used to drive the bootstrap's `applying resource limits failed`
|
|
// handler with `cpuSeconds: 2 ** 63`, asserting that a cap the child cannot
|
|
// apply fails the run rather than running it uncapped. That premise no longer
|
|
// holds, for two independent reasons, so the test now pins what is actually
|
|
// guaranteed instead of a path no admissible input reaches.
|
|
//
|
|
// First, `2 ** 63` is not a safe integer, so it is now rejected at LOAD as a
|
|
// configuration error — it can never reach the child at all. Second, even the
|
|
// largest admissible values are applied successfully, because `_clamped`
|
|
// bounds every requested pair by the inherited hard limit: an unprivileged
|
|
// process may lower a hard limit but never raise one, so the child keeps the
|
|
// stricter of the two rather than asking for something `setrlimit` refuses.
|
|
// The failure handler remains as a substrate guard (a platform whose kernel
|
|
// refuses the call for its own reasons), but it is no longer reachable from
|
|
// configuration, and a test that pretends otherwise documents a contract the
|
|
// code does not have.
|
|
//
|
|
// What is observable: a very large cap still yields a working run, and the
|
|
// containment it promises is met by the inherited ceiling.
|
|
const { runtime } = await setup({ cpuSeconds: Number.MAX_SAFE_INTEGER - 1, maxWallMs: 10_000 })
|
|
const result = await runtime.run({ program: 'return 1', bindings: [] })
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe(1)
|
|
}, 20_000)
|
|
|
|
it('settles as worker-exit when the child exits before sending done (no hang)', async () => {
|
|
// Regression: settlement must key off `close` (process reaped AND stdio
|
|
// drained), not `exit`. With `exit`, finish() re-armed a second exit
|
|
// listener that never fired — run() hung forever whenever the exit event
|
|
// beat the final fd-3 data (deterministic on macOS, a lost race elsewhere).
|
|
const { runtime } = await setup({ maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: 'import os\nos._exit(7)',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain('code=7')
|
|
}, 5000)
|
|
|
|
it('classifies RLIMIT_CPU soft-limit expiry (SIGXCPU) as a timeout', async () => {
|
|
// A CPU hot loop burns the soft limit; the kernel delivers SIGXCPU, whose
|
|
// close signal the host maps to `timeout`. macOS re-delivers SIGXCPU
|
|
// differently, so we assert only kind/message here — CI's darwin leg
|
|
// validates real delivery. cpuSeconds must be an integer for setrlimit.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: 'while True: pass',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('timeout')
|
|
expect(result.error?.message).toContain('CPU time exhausted')
|
|
}, 8000)
|
|
|
|
it('keeps an early self-inflicted SIGKILL a worker-exit, not a CPU timeout', async () => {
|
|
// The unsolicited-SIGKILL-as-timeout classification applies only when the
|
|
// CPU budget could have expired (wall time >= cpuSeconds). A SIGKILL
|
|
// seconds before that (cgroup OOM, an operator, os.kill) is substrate
|
|
// death and stays worker-exit per the orthogonal taxonomy.
|
|
const { runtime } = await setup({ cpuSeconds: 60, maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, signal',
|
|
'os.kill(os.getpid(), signal.SIGKILL)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain('SIGKILL')
|
|
})
|
|
|
|
it('charges a forked descendant against the run CPU budget', async () => {
|
|
// RLIMIT_CPU is per-process and every child inherits a FRESH budget, so a
|
|
// program that shells out multiplies `cpuSeconds` by the number of
|
|
// descendants it starts. Measured before the aggregate meter existed: with
|
|
// cpuSeconds 1, two sequential busy children burned 2.0 CPU-seconds
|
|
// (RUSAGE_CHILDREN) and the run still returned a SUCCESS completion. The
|
|
// settle-time check meters RUSAGE_SELF + RUSAGE_CHILDREN and converts the
|
|
// overrun into the same SIGXCPU the untrapped soft limit sends.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 30_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import subprocess, sys',
|
|
'for _ in range(2):',
|
|
' subprocess.run([sys.executable, "-c", "import time\\nt=time.time()\\nwhile time.time()-t<1.2: pass"])',
|
|
'return "escaped the cpu budget"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
// Darwin's SIGXCPU re-delivery differs, so accept either terminal
|
|
// classification; what must NOT happen is the completion crossing.
|
|
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
|
expect(result.value).toBeUndefined()
|
|
}, 40_000)
|
|
|
|
it('does not charge wall time or a cheap descendant against the CPU budget', async () => {
|
|
// The meter is CPU, not wall clock, and it must not fire on a child that
|
|
// burns almost nothing: a sleeping program and a trivial subprocess both
|
|
// have to complete normally, or the check would reject every program that
|
|
// shells out.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 30_000 })
|
|
const slept = await runtime.run({
|
|
program: 'import time\ntime.sleep(1.5)\nreturn "slept"',
|
|
bindings: [],
|
|
})
|
|
expect(slept.error).toBeUndefined()
|
|
expect(slept.value).toBe('slept')
|
|
const cheap = await runtime.run({
|
|
program: [
|
|
'import subprocess, sys',
|
|
'subprocess.run([sys.executable, "-c", "pass"])',
|
|
'return "cheap child"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(cheap.error).toBeUndefined()
|
|
expect(cheap.value).toBe('cheap child')
|
|
}, 40_000)
|
|
|
|
it('spends no part of addressSpaceMb on bootstrap machinery', async () => {
|
|
// RLIMIT_AS counts RESERVED address space, so anything the bootstrap maps
|
|
// for its own accounting is subtracted from the program's `addressSpaceMb`.
|
|
// A sampling thread for the descendant-CPU meter cost 72 MiB here (an 8 MiB
|
|
// stack plus a 64 MiB glibc per-thread malloc arena reservation) and turned
|
|
// the 2-million-entry dict rejection below into a MemoryError under a
|
|
// 256 MiB cap on a slower runner. Assert the child's own mappings directly
|
|
// rather than inferring the budget from a near-cap allocation, so the bound
|
|
// is read from /proc instead of from how much headroom one machine happens
|
|
// to have; 48 MiB is well above the ~30 MiB a bare interpreter maps and
|
|
// well below the 102 MiB the thread produced. `addressSpaceMb` itself is
|
|
// skipped on darwin (the dyld shared cache makes any practical cap
|
|
// unsettable) and /proc/self/maps does not exist there, so the mapping
|
|
// assertion is Linux-only; the completion path is checked everywhere.
|
|
const { runtime } = await setup({ maxValueBytes: 4096, addressSpaceMb: 256 })
|
|
const mapped = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'if sys.platform != "linux":',
|
|
' return 0',
|
|
'total = 0',
|
|
'with open("/proc/self/maps") as handle:',
|
|
' for line in handle:',
|
|
' low, high = (int(part, 16) for part in line.split(" ", 1)[0].split("-"))',
|
|
' total += high - low',
|
|
'return total // (1024 * 1024)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(mapped.error).toBeUndefined()
|
|
expect(mapped.value).toBeLessThan(48)
|
|
}, 20_000)
|
|
|
|
it('spends no part of addressSpaceMb on the reply pump, across a binding await', async () => {
|
|
// The test above measures BEFORE the program yields, so it could not see the
|
|
// reply pump's cost: `loop.run_in_executor(None, read_frame)` created the
|
|
// default executor's first thread on the first `await tools.*`, and that
|
|
// thread's 8 MiB stack plus a 64 MiB glibc per-thread malloc arena are
|
|
// charged to RLIMIT_AS while the limit is already in force — measured, the
|
|
// child went from 30.34 MiB to 102.39 MiB across one binding call. Under a
|
|
// small `addressSpaceMb` the thread cannot start and a legitimate call hangs
|
|
// to `maxWallMs`; under a larger one an allocation that should have fit dies
|
|
// as MemoryError. `loop.add_reader` watches the fd with no thread at all.
|
|
//
|
|
// Measuring both sides inside one run is what discriminates: a single
|
|
// after-the-fact number cannot separate the pump's cost from the
|
|
// interpreter's own footprint. Linux-only for the same reason as above.
|
|
const { runtime } = await setup({ addressSpaceMb: 256, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'def mapped():',
|
|
' if sys.platform != "linux":',
|
|
' return 0',
|
|
' total = 0',
|
|
' with open("/proc/self/maps") as handle:',
|
|
' for line in handle:',
|
|
' low, high = (int(part, 16) for part in line.split(" ", 1)[0].split("-"))',
|
|
' total += high - low',
|
|
' return total // (1024 * 1024)',
|
|
'before = mapped()',
|
|
'echoed = await tools.echo({"ping": True})',
|
|
'return {"before": before, "after": mapped(), "echoed": echoed}',
|
|
].join('\n'),
|
|
bindings: tools({ echo: async args => args as CodeJsonValue }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
const value = result.value as { before: number; after: number; echoed: unknown }
|
|
// The binding call really happened, so the pump really ran.
|
|
expect(value.echoed).toEqual({ ping: true })
|
|
// Awaiting a binding maps nothing extra. The 8 MiB allowance absorbs ordinary
|
|
// heap growth while staying far below the 72 MiB a pump thread cost.
|
|
expect(value.after - value.before).toBeLessThan(8)
|
|
}, 30_000)
|
|
|
|
it('still terminates a program that ignores SIGXCPU (hard-limit backstop)', async () => {
|
|
// A hot loop under SIG_IGN burns through the soft limit; the kernel's
|
|
// hard limit (cpuSeconds + 1) SIGKILLs it. Only a kernel-authoritative
|
|
// SIGXCPU close classifies as the CPU timeout — a bare SIGKILL is
|
|
// indistinguishable from a cgroup OOM kill, so it reports worker-exit
|
|
// (Darwin re-delivers SIGXCPU instead, where the wall clock settles it
|
|
// as timeout). Either way the run TERMINATES within the budget — the
|
|
// backstop holds even when the classification is the opaque one.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 6_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal',
|
|
'signal.signal(signal.SIGXCPU, signal.SIG_IGN)',
|
|
'while True: pass',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
|
}, 12_000)
|
|
|
|
it('enforces the CPU budget even when the program monkeypatches the enforcement primitives', async () => {
|
|
// The check uses import-time-captured references, so replacing
|
|
// resource.getrusage / signal.signal / os.kill on the modules cannot
|
|
// defang it: a trapping program that also swaps the callables and burns
|
|
// past the budget still dies by the authoritative SIGXCPU.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal, os, resource, time',
|
|
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
|
'resource.getrusage = lambda *a: (_ for _ in ()).throw(RuntimeError("nope"))',
|
|
'os.kill = lambda *a: None',
|
|
'signal.signal = lambda *a: None',
|
|
'deadline = time.process_time() + 1.05',
|
|
'while time.process_time() < deadline: pass',
|
|
'return "escaped"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('timeout')
|
|
expect(result.value).toBeUndefined()
|
|
}, 15_000)
|
|
|
|
it('re-delivers SIGXCPU when a trapping program returns inside the soft-to-hard gap', async () => {
|
|
// A program can trap SIGXCPU and settle during the one-second gap; the
|
|
// bootstrap re-checks the kernel CPU meter (getrusage) after settlement
|
|
// and dies by SIGXCPU with the default disposition restored, so the host
|
|
// still classifies the exhausted budget as a timeout instead of success.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal, time',
|
|
'fired = []',
|
|
'signal.signal(signal.SIGXCPU, lambda *a: fired.append(1))',
|
|
'deadline = time.process_time() + 1.05',
|
|
'while time.process_time() < deadline: pass',
|
|
'return "escaped"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('timeout')
|
|
expect(result.error?.message).toContain('CPU time exhausted')
|
|
expect(result.value).toBeUndefined()
|
|
}, 15_000)
|
|
|
|
it('enforces the CPU budget when the program rebinds the enforcer on __main__', async () => {
|
|
// The bootstrap IS `__main__`, so `import __main__` reaches its globals.
|
|
// The enforcement callable holds its primitives in closure cells (not
|
|
// module attributes) and `_run` reads the callable into a frame local
|
|
// before the program starts, so neither replacing the global nor swapping
|
|
// the module's captured names changes what runs after settlement.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal, time, __main__',
|
|
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
|
'__main__._DIE_IF_CPU_EXHAUSTED = lambda *_: None',
|
|
'deadline = time.process_time() + 1.05',
|
|
'while time.process_time() < deadline: pass',
|
|
'return "escaped"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('timeout')
|
|
expect(result.value).toBeUndefined()
|
|
}, 15_000)
|
|
|
|
it('bounds a program that defeats the post-check by writing its closure cell', async () => {
|
|
// The closure-cell capture raises the cost of defeating the post-check; it
|
|
// does NOT make it unreachable, and nothing in-process could: a cell is
|
|
// writable through `fn.__closure__[i].cell_contents`, and `sys._getframe`
|
|
// reads _run's frame locals. This program does exactly that — walks to
|
|
// _run's frame, takes the enforcement callable, and replaces its captured
|
|
// `getrusage` with one reporting zero CPU used — then burns past cpuSeconds
|
|
// with SIGXCPU trapped. The run must still fail, because the bound that
|
|
// model code cannot forge is outside the interpreter: the RLIMIT_CPU HARD
|
|
// limit at cpuSeconds + 1, whose SIGKILL admits no handler. No success is
|
|
// reportable either way.
|
|
const { runtime } = await setup({ cpuSeconds: 1, maxWallMs: 20_000 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal, sys, time',
|
|
'signal.signal(signal.SIGXCPU, lambda *a: None)',
|
|
// Walk out of __dsh_main__ to _run's frame and take its local.
|
|
'die = None',
|
|
'depth = 1',
|
|
'while depth < 12:',
|
|
' frame = sys._getframe(depth)',
|
|
' if "die_if_cpu_exhausted" in frame.f_locals:',
|
|
' die = frame.f_locals["die_if_cpu_exhausted"]',
|
|
' break',
|
|
' depth += 1',
|
|
'assert die is not None, "enforcer not reachable from the frame chain"',
|
|
'class Zero:',
|
|
' ru_utime = 0.0',
|
|
' ru_stime = 0.0',
|
|
'names = die.__code__.co_freevars',
|
|
'die.__closure__[names.index("getrusage")].cell_contents = lambda *a: Zero()',
|
|
// Burn well past the soft limit into the hard limit's SIGKILL.
|
|
'while True: pass',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
// What holds on EVERY platform: the tampering bought no success. The run
|
|
// failed, carried no value, and the reported kind is one of the two
|
|
// kernel-level outcomes — never a completion.
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind === 'worker-exit' || result.error?.kind === 'timeout').toBe(true)
|
|
if (process.platform === 'linux') {
|
|
// Linux enforces the RLIMIT_CPU HARD limit at cpuSeconds + 1 promptly, so
|
|
// the CPU bound — not the 20 s wall ceiling — is what stops the program.
|
|
// Its SIGKILL is not SIGXCPU, so the orthogonal-failure taxonomy reports
|
|
// `worker-exit`: a bare SIGKILL is not evidence of CPU burn.
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(Date.now() - start).toBeLessThan(15_000)
|
|
} else {
|
|
// Darwin does not deliver the hard limit's SIGKILL on the same schedule;
|
|
// observed on the macOS lane, a program that patches the post-check runs
|
|
// to the WALL ceiling instead. The CPU budget is therefore not the
|
|
// binding constraint against a tampering program there — the wall clock
|
|
// is. Asserted rather than skipped so the difference stays visible.
|
|
expect(result.error?.kind).toBe('timeout')
|
|
}
|
|
}, 30_000)
|
|
|
|
it('keeps a finished-but-not-closed run live so dispose awaits the child\'s death', async () => {
|
|
// finish() no longer drops the run from `live`; settle() (at close) does.
|
|
// A SIGTERM-trapping program with a small graceMs sits in the grace window
|
|
// after finish() fires — dispose() must not resolve until the SIGKILL
|
|
// backstop actually reaps the child. The program prints its pid (captured
|
|
// as a log even on abort); once dispose() resolves, that pid must be dead
|
|
// (process.kill(pid, 0) throws ESRCH).
|
|
const { fiber, runtime } = await setup({ maxWallMs: 10_000, graceMs: 400 })
|
|
// Deterministic readiness: the program reports its pid through a binding
|
|
// AFTER installing the trap, so dispose cannot race the spawn (a fixed
|
|
// sleep lost that race on slow CI runners — SIGTERM landed pre-trap).
|
|
let reportedPid!: (pid: number) => void
|
|
const trapReady = new Promise<number>((resolve) => { reportedPid = resolve })
|
|
const pending = runtime.run({
|
|
program: [
|
|
'import signal, time, os',
|
|
'signal.signal(signal.SIGTERM, lambda *a: None)',
|
|
'await tools.ready({"pid": os.getpid()})',
|
|
'while True: time.sleep(0.05)',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
ready: async (args) => {
|
|
reportedPid((args as { pid: number }).pid)
|
|
return 'ok'
|
|
},
|
|
}),
|
|
})
|
|
const pid = await trapReady
|
|
const start = Date.now()
|
|
await fiber.dispose()
|
|
const elapsed = Date.now() - start
|
|
const result = await pending
|
|
expect(['abort', 'worker-exit', 'timeout']).toContain(result.error?.kind)
|
|
// dispose() returned only after the grace window elapsed (the SIGTERM trap
|
|
// forces the SIGKILL backstop path), proving the run stayed live past finish().
|
|
expect(elapsed).toBeGreaterThanOrEqual(300)
|
|
expect(Number.isInteger(pid) && pid > 0).toBe(true)
|
|
// The child is fully reaped by the time dispose() resolved.
|
|
expect(() => process.kill(pid, 0)).toThrow(/ESRCH/)
|
|
}, 8000)
|
|
|
|
it('settles on the decided result even when a setsid-escaped orphan holds stdio open past close', async () => {
|
|
// `close` only fires once every inherited stdio stream drains. A descendant
|
|
// started with start_new_session=True escapes the child's process group, so
|
|
// the SIGTERM/SIGKILL aimed at that group never reaches it; if it inherited
|
|
// our stdout/stderr/fd 3 and outlives the run, `close` would never fire and
|
|
// run() would hang forever. The close-deadline backstop (graceMs + margin)
|
|
// must force settlement on the value the `done` frame already decided.
|
|
const { runtime } = await setup({ graceMs: 100 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import subprocess, sys',
|
|
// Orphan in a fresh session, inheriting our stdout/stderr/fd 3, alive
|
|
// past the close-deadline so `close` cannot fire on its own. Its own
|
|
// 5 s self-exit is the leak ceiling AND the discriminator: it must stay
|
|
// ABOVE the < 4000 ms upper-bound assertion below, so if the deadline
|
|
// backstop failed to settle, settlement could only come from this
|
|
// self-exit at ~5 s and blow the bound — a sharper signal than the wall
|
|
// ceiling would give.
|
|
'subprocess.Popen([sys.executable, "-c", "import time; time.sleep(5)"],',
|
|
' start_new_session=True)',
|
|
'return "escaped"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
const elapsed = Date.now() - start
|
|
// The done frame decided the value; the deadline settled it despite the
|
|
// orphan pinning the pipes open.
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('escaped')
|
|
// Settlement waited for the backstop (graceMs + CLOSE_REAP_MARGIN_MS ≈ 2.1s),
|
|
// not the orphan's 5 s self-exit — proving the deadline, not a fallback, fired.
|
|
expect(elapsed).toBeGreaterThanOrEqual(1_500)
|
|
expect(elapsed).toBeLessThan(4_000)
|
|
}, 8000)
|
|
|
|
it('flushes a newline-free diagnostic when the closeDeadline forces settlement', async () => {
|
|
// A leader that writes an unterminated diagnostic via `os.write(1, ...)` and
|
|
// then exits, leaving a setsid orphan holding the pipes open, settles through
|
|
// the closeDeadline destroy() path — which fires no `end`. The residual must
|
|
// be flushed before destroy() drops it, or the diagnostic is lost from
|
|
// `logs`. The value is decided by the done frame; the diagnostic must survive.
|
|
const { runtime } = await setup({ graceMs: 100 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, subprocess, sys',
|
|
'os.write(1, b"leader-diagnostic-no-newline")',
|
|
'subprocess.Popen([sys.executable, "-c", "import time; time.sleep(5)"],',
|
|
' start_new_session=True)',
|
|
'return "escaped"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('escaped')
|
|
expect(result.logs).toContain('leader-diagnostic-no-newline')
|
|
}, 8000)
|
|
|
|
it('reaps a same-group child that ignores SIGTERM and releases the pipes before close', async () => {
|
|
// The same-group counterpart to the setsid-orphan case above. A descendant
|
|
// left in the child's OWN process group (no setsid, so `kill(-pid)` reaches
|
|
// it) can ignore SIGTERM yet still release the inherited stdout/stderr/fd 3
|
|
// it does not hold — here by giving the Popen child DEVNULL streams and
|
|
// letting close_fds drop fd 3. The leader then writes `done` and exits, its
|
|
// `close` fires because the pipes drained, and settle() runs while that
|
|
// descendant is still alive. settle() then keeps a REF'd poll alive until the
|
|
// grace-window SIGKILL has emptied the whole process group, so the host cannot
|
|
// exit and reparent the survivor to init: no subprocess outlives the fiber.
|
|
//
|
|
// The descendant must have SIG_IGN installed BEFORE the host sends SIGTERM,
|
|
// or it dies from the default SIGTERM whether the fix is present or not — so
|
|
// it writes a readiness marker after trapping and the leader waits for that
|
|
// marker before returning. While alive it bumps a heartbeat file every 50 ms;
|
|
// the test asserts the heartbeat STOPS, which is what "no longer executing"
|
|
// means whether the killed descendant is reaped or lingers as a zombie (a
|
|
// SIGKILL'd process runs no more code either way). It sleeps 30 s as a safety
|
|
// net so a broken fix cannot leak it forever.
|
|
const handoff = await mkdtemp(join(tmpdir(), 'dsh-samegroup-'))
|
|
const readyMarker = join(handoff, 'ready')
|
|
const heartbeat = join(handoff, 'heartbeat')
|
|
const { runtime } = await setup({ maxWallMs: 10_000, graceMs: 300 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import subprocess, sys, os, time',
|
|
`marker = ${JSON.stringify(readyMarker)}`,
|
|
`heartbeat = ${JSON.stringify(heartbeat)}`,
|
|
// Same group (no start_new_session); ignores SIGTERM; holds none of the
|
|
// leader's pipes (DEVNULL std streams, close_fds drops fd 3). It writes
|
|
// the marker (argv[1]) only AFTER the trap is installed — so the leader
|
|
// cannot return, and the host cannot send SIGTERM, before it is ignored —
|
|
// then rewrites the heartbeat (argv[2]) every 50 ms for up to 30 s.
|
|
'code = ("import signal, sys, time\\n"',
|
|
' "signal.signal(signal.SIGTERM, signal.SIG_IGN)\\n"',
|
|
' "open(sys.argv[1], \'w\').close()\\n"',
|
|
' "end = time.time() + 30\\n"',
|
|
' "while time.time() < end:\\n"',
|
|
' " open(sys.argv[2], \'w\').close()\\n"',
|
|
' " time.sleep(0.05)\\n")',
|
|
'child = subprocess.Popen([sys.executable, "-c", code, marker, heartbeat],',
|
|
' stdin=subprocess.DEVNULL,',
|
|
' stdout=subprocess.DEVNULL,',
|
|
' stderr=subprocess.DEVNULL)',
|
|
'deadline = time.time() + 5',
|
|
'while not os.path.exists(marker) and time.time() < deadline:',
|
|
' time.sleep(0.02)',
|
|
'return "spawned"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('spawned')
|
|
// The trap really installed before the leader returned, so this is the
|
|
// SIGTERM-ignoring descendant, not one that would have died to the default.
|
|
expect(existsSync(readyMarker)).toBe(true)
|
|
// The grace-window SIGKILL (graceMs 300 + reap margin) empties the group. Once
|
|
// it has, the descendant stops bumping the heartbeat. Poll the heartbeat's
|
|
// mtime: two consecutive reads far enough apart with no change means it is no
|
|
// longer executing — true whether it was reaped or lingers as a zombie, so
|
|
// the assertion holds in a container whose init does not wait() orphans. The
|
|
// window (well under the 30 s self-timeout) proves the SIGKILL did the work.
|
|
const mtime = (): number => { try { return statSync(heartbeat).mtimeMs } catch { return 0 } }
|
|
const stopDeadline = Date.now() + 8_000
|
|
let last = mtime()
|
|
let still = false
|
|
while (Date.now() < stopDeadline) {
|
|
await new Promise(resolve => setTimeout(resolve, 400))
|
|
const now = mtime()
|
|
if (now === last && now !== 0) { still = true; break }
|
|
last = now
|
|
}
|
|
expect(still).toBe(true)
|
|
}, 20_000)
|
|
|
|
it('dispose awaits reaping of a same-group survivor from a completed run', async () => {
|
|
// The quiescence contract also holds for a run that ALREADY resolved: the run
|
|
// stays tracked in `live` until its process group is reaped, so a `dispose()`
|
|
// that races a just-returned run() still awaits the survivor rather than
|
|
// snapshotting an empty `live` and returning while it lives. Here the run
|
|
// completes (leaving a SIGTERM-ignoring same-group descendant), then dispose()
|
|
// is called; the heartbeat must be stale BY THE TIME dispose() resolves —
|
|
// proving teardown waited for the reap, not merely that the reap eventually
|
|
// happened.
|
|
const handoff = await mkdtemp(join(tmpdir(), 'dsh-dispose-quiesce-'))
|
|
const readyMarker = join(handoff, 'ready')
|
|
const heartbeat = join(handoff, 'heartbeat')
|
|
const { runtime, fiber } = await setup({ maxWallMs: 10_000, graceMs: 300 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import subprocess, sys, os, time',
|
|
`marker = ${JSON.stringify(readyMarker)}`,
|
|
`heartbeat = ${JSON.stringify(heartbeat)}`,
|
|
'code = ("import signal, sys, time\\n"',
|
|
' "signal.signal(signal.SIGTERM, signal.SIG_IGN)\\n"',
|
|
' "open(sys.argv[1], \'w\').close()\\n"',
|
|
' "end = time.time() + 30\\n"',
|
|
' "while time.time() < end:\\n"',
|
|
' " open(sys.argv[2], \'w\').close()\\n"',
|
|
' " time.sleep(0.05)\\n")',
|
|
'child = subprocess.Popen([sys.executable, "-c", code, marker, heartbeat],',
|
|
' stdin=subprocess.DEVNULL,',
|
|
' stdout=subprocess.DEVNULL,',
|
|
' stderr=subprocess.DEVNULL)',
|
|
'deadline = time.time() + 5',
|
|
'while not os.path.exists(marker) and time.time() < deadline:',
|
|
' time.sleep(0.02)',
|
|
'return "spawned"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(existsSync(readyMarker)).toBe(true)
|
|
// dispose() must not return until the group is reaped. After it resolves, the
|
|
// heartbeat must already be stale: read its mtime, wait past the heartbeat
|
|
// interval, and confirm it did not advance — the descendant is no longer
|
|
// executing (reaped or zombie), so teardown was genuinely quiescent.
|
|
await fiber.dispose()
|
|
const mtime = (): number => { try { return statSync(heartbeat).mtimeMs } catch { return 0 } }
|
|
const afterDispose = mtime()
|
|
// Pin the assertion to a heartbeat that actually ran: mtime() returns 0 when
|
|
// the file never existed, so without this the `toBe` below would pass
|
|
// vacuously (0 === 0) if the survivor never wrote a heartbeat at all.
|
|
expect(afterDispose).toBeGreaterThan(0)
|
|
await new Promise(resolve => setTimeout(resolve, 500))
|
|
expect(mtime()).toBe(afterDispose)
|
|
}, 20_000)
|
|
|
|
it('sends SIGKILL at the poll deadline when the event loop was blocked past both timers', async () => {
|
|
// If the host event loop is blocked (a big synchronous computation) from
|
|
// before the group-reap poll was scheduled until after the deadline, both the
|
|
// poll timer and the grace-window SIGKILL timer are overdue when the loop
|
|
// resumes. Node runs the earlier-scheduled poll first, so the SIGKILL timer
|
|
// may not have fired yet. The deadline arm must then send SIGKILL ITSELF
|
|
// rather than cancel the unfired escalation — otherwise a SIGTERM-ignoring
|
|
// same-group survivor is released for good. A synchronous busy-loop after
|
|
// run() resolves reproduces the block deterministically.
|
|
const handoff = await mkdtemp(join(tmpdir(), 'dsh-deadline-'))
|
|
const readyMarker = join(handoff, 'ready')
|
|
const heartbeat = join(handoff, 'heartbeat')
|
|
const graceMs = 300
|
|
const { runtime } = await setup({ maxWallMs: 10_000, graceMs })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import subprocess, sys, os, time',
|
|
`marker = ${JSON.stringify(readyMarker)}`,
|
|
`heartbeat = ${JSON.stringify(heartbeat)}`,
|
|
'code = ("import signal, sys, time\\n"',
|
|
' "signal.signal(signal.SIGTERM, signal.SIG_IGN)\\n"',
|
|
' "open(sys.argv[1], \'w\').close()\\n"',
|
|
' "end = time.time() + 30\\n"',
|
|
' "while time.time() < end:\\n"',
|
|
' " open(sys.argv[2], \'w\').close()\\n"',
|
|
' " time.sleep(0.05)\\n")',
|
|
'child = subprocess.Popen([sys.executable, "-c", code, marker, heartbeat],',
|
|
' stdin=subprocess.DEVNULL,',
|
|
' stdout=subprocess.DEVNULL,',
|
|
' stderr=subprocess.DEVNULL)',
|
|
'deadline = time.time() + 5',
|
|
'while not os.path.exists(marker) and time.time() < deadline:',
|
|
' time.sleep(0.02)',
|
|
'return "spawned"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(existsSync(readyMarker)).toBe(true)
|
|
// Block the event loop synchronously past graceMs + CLOSE_REAP_MARGIN_MS
|
|
// (2000) with margin, so both timers are overdue when the loop resumes.
|
|
const blockUntil = Date.now() + graceMs + 2_000 + 800
|
|
while (Date.now() < blockUntil) { /* busy-wait, no yield */ }
|
|
// Yield: the overdue poll runs (group still non-empty, deadline passed) and
|
|
// must send SIGKILL itself. The survivor then stops bumping the heartbeat.
|
|
const mtime = (): number => { try { return statSync(heartbeat).mtimeMs } catch { return 0 } }
|
|
const stopDeadline = Date.now() + 5_000
|
|
let last = mtime()
|
|
let stopped = false
|
|
while (Date.now() < stopDeadline) {
|
|
await new Promise(resolve => setTimeout(resolve, 400))
|
|
const now = mtime()
|
|
if (now === last && now !== 0) { stopped = true; break }
|
|
last = now
|
|
}
|
|
expect(stopped).toBe(true)
|
|
}, 20_000)
|
|
})
|
|
|
|
describe('PythonCodeRuntime — hostile peer', () => {
|
|
it('drops garbage bytes and unknown-shape frames posted directly to fd 3', async () => {
|
|
// The model program can reach fd 3 and write anything. We inject a
|
|
// non-JSON line, a valid JSON but unknown-shape frame, and a broken done
|
|
// frame; the host must not crash, and the real `done` still settles the run.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'os.write(3, b"not-json\\n")',
|
|
'os.write(3, b\'{"type":"unknown"}\\n\')',
|
|
'os.write(3, b\'{"type":"done","error":{"message":42}}\\n\')',
|
|
'return "survived"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('survived')
|
|
})
|
|
|
|
it('answers a forged call frame for an unknown binding and never crashes', async () => {
|
|
// The unknown-binding reply path, driven through the id the host expects:
|
|
// the program lets its own first call claim id 0 and forges id 1, which the
|
|
// host answers with the `unknown binding` rejection the honest call would
|
|
// have received. A forged id out of sequence is dropped instead — that is
|
|
// the id-bound test below, not this one.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
let seenLegitCall = false
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'x = await tools.echo({"ping": True})',
|
|
'os.write(3, json.dumps({"type":"call","id":1,"global":"tools","name":"forged","args":{}}).encode() + b"\\n")',
|
|
// The forged frame is answered, but nothing in the child awaits id 1, so
|
|
// the reply is ignored and the run completes on its own value.
|
|
'return x',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
echo: async (args) => { seenLegitCall = true; return args as CodeJsonValue },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual({ ping: true })
|
|
expect(seenLegitCall).toBe(true)
|
|
}, 15_000)
|
|
|
|
it('drops forged call frames whose ids are not the next in sequence, retaining no per-id state', async () => {
|
|
// The host used to remember every answered id in a Set, so a program could
|
|
// write an unbounded run of unique forged ids — each frame far below the
|
|
// 256 MiB ceiling, so nothing rejected them — and grow host memory for the
|
|
// whole run. Ids are consecutive from 0, so one counter replaces the set.
|
|
//
|
|
// The discriminator is that the forgeries must not be answered. Each names a
|
|
// binding that does exist, so a host answering them would run `echo` once
|
|
// per forgery; the count proves only the legitimate call was dispatched.
|
|
// Ids also run DESCENDING, so a high-water-mark test would drop the honest
|
|
// call that follows rather than the forgeries.
|
|
const { runtime } = await setup()
|
|
let echoCalls = 0
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'for i in range(2000, 0, -1):',
|
|
' os.write(3, json.dumps({"type":"call","id":i,"global":"tools","name":"echo","args":{"forged":i}}).encode() + b"\\n")',
|
|
'x = await tools.echo({"ping": True})',
|
|
'return x',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
echo: async (args) => { echoCalls += 1; return args as CodeJsonValue },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual({ ping: true })
|
|
expect(echoCalls).toBe(1)
|
|
}, 15_000)
|
|
|
|
it('keeps answering calls a program makes after one with unserializable arguments', async () => {
|
|
// The child claims an id only once its write succeeds, so a call rejected
|
|
// child-side for non-lossless arguments leaves no gap. Were a gap possible,
|
|
// the host's exact-successor test would drop every later call and the run
|
|
// would hang to the wall ceiling instead of completing.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
const seen: unknown[] = []
|
|
const result = await runtime.run({
|
|
program: [
|
|
'caught = ""',
|
|
'try:',
|
|
' await tools.echo({"bad": float("inf")})',
|
|
'except RuntimeError as e:',
|
|
' caught = str(e)',
|
|
'after = await tools.echo({"ok": True})',
|
|
'return {"caught": caught, "after": after}',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
echo: async (args) => { seen.push(args); return args as CodeJsonValue },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
const value = result.value as { caught: string; after: unknown }
|
|
expect(value.caught).toContain('lossless JSON')
|
|
expect(value.after).toEqual({ ok: true })
|
|
// The rejected call never reached the host; the one after it did.
|
|
expect(seen).toEqual([{ ok: true }])
|
|
}, 15_000)
|
|
|
|
it('drops a forged frame carrying an integer outside JavaScript safe range', async () => {
|
|
// JSON.parse would silently round 9007199254740993 to ...992 BEFORE any
|
|
// validation, corrupting a dispatched argument or completion. The host
|
|
// scans the raw line and drops such frames as hostile traffic; the honest
|
|
// child cannot produce one (its validator rejects unsafe ints).
|
|
const { runtime } = await setup()
|
|
let dispatched: unknown
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
// Forged call frame with an unsafe int argument, then a forged done
|
|
// frame with an unsafe int value — both must be dropped whole.
|
|
'os.write(3, b\'{"type":"call","id":7,"global":"tools","name":"echo","args":9007199254740993}\\n\')',
|
|
'os.write(3, b\'{"type":"done","value":9007199254740993}\\n\')',
|
|
'x = await tools.echo({"ok": True})',
|
|
'return x',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
echo: async (args) => { dispatched = args; return args as CodeJsonValue },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// The forged done did not settle the run; the legit call and completion did.
|
|
expect(result.value).toEqual({ ok: true })
|
|
expect(dispatched).toEqual({ ok: true })
|
|
})
|
|
|
|
it('truncates host-side logs once the budget is exhausted and emits the marker', async () => {
|
|
// Set a tiny host-side budget; the Python side has a much larger one, so
|
|
// its LogBuffer will not truncate — the host ledger fires first.
|
|
const { runtime } = await setup({ maxLogBytes: 32 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'for _ in range(50):',
|
|
' print("aaaaaaaaaa")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
const markers = result.logs.filter(line => line.includes('log capture truncated at 32 bytes'))
|
|
expect(markers.length).toBeGreaterThanOrEqual(1)
|
|
})
|
|
|
|
it('reports an exception whose message holds an unpaired surrogate instead of stranding to the wall clock', async () => {
|
|
// A strict UTF-8 encode of "\ud800" throws while BUILDING the failure
|
|
// frame; the run would then hang to maxWallMs and misreport as timeout.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
const result = await runtime.run({
|
|
program: String.raw`raise Exception("bad \ud800 surrogate")`,
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('bad')
|
|
expect(result.error?.message).toContain('surrogate')
|
|
})
|
|
|
|
it('carries a lone-surrogate completion string across the wire as its JSON escape', async () => {
|
|
// UTF-8 has no encoding for a lone surrogate, but JSON does: the ASCII
|
|
// `\ud800` escape, which JSON.parse reads back as the same UTF-16 code
|
|
// unit. `CodeJsonValue`, `snapshotJsonValue`, and the worker backend all
|
|
// accept such a string, so this backend must not narrow the shared seam.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: String.raw`return {"lone": "a\ud800b", "spelled": "😀"}`,
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// The lone half survives as the code unit itself; a spelled-out high-low
|
|
// PAIR folds into the astral character the host would hold for it.
|
|
expect(result.value).toEqual({ lone: 'a\ud800b', spelled: '\u{1f600}' })
|
|
})
|
|
|
|
it('meters a lone surrogate at its six escaped bytes, matching the host', async () => {
|
|
// The child and the host share maxValueBytes, so the child must charge the
|
|
// escape's six ASCII bytes (plus two quotes): eight fits, nine does not.
|
|
const { runtime } = await setup({ maxValueBytes: 8 })
|
|
const ok = await runtime.run({ program: String.raw`return "\ud800"`, bindings: [] })
|
|
expect(ok.error).toBeUndefined()
|
|
expect(ok.value).toBe('\ud800')
|
|
const over = await setup({ maxValueBytes: 7 })
|
|
const result = await over.runtime.run({ program: String.raw`return "\ud800"`, bindings: [] })
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
})
|
|
|
|
it('passes a lone-surrogate binding argument through instead of failing the call', async () => {
|
|
// The argument validator shared the same over-narrow rejection; a host
|
|
// binding must receive the code unit the program passed.
|
|
const seen: unknown[] = []
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: String.raw`return await tools.echo({"text": "x\udfff"})`,
|
|
bindings: tools({ echo: async (args: unknown) => { seen.push(args); return args as CodeJsonValue } }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(seen).toEqual([{ text: 'x\udfff' }])
|
|
expect(result.value).toEqual({ text: 'x\udfff' })
|
|
})
|
|
|
|
it('meters a non-ASCII completion in UTF-8 JSON bytes, matching the host', async () => {
|
|
// json.dumps' default \uXXXX escaping would count "é" as 8 bytes while
|
|
// the host meter counts its UTF-8 JSON form (4); the shared budget must
|
|
// agree, so a 4-byte-fitting value passes a maxValueBytes of 4.
|
|
const { runtime } = await setup({ maxValueBytes: 4 })
|
|
const ok = await runtime.run({ program: 'return "é"', bindings: [] })
|
|
expect(ok.error).toBeUndefined()
|
|
expect(ok.value).toBe('é')
|
|
const over = await runtime.run({ program: 'return "éx"', bindings: [] })
|
|
expect(over.error?.kind).toBe('output-limit')
|
|
})
|
|
|
|
it('filters bootstrap frames from exception-group members (TaskGroup)', async () => {
|
|
// Python 3.11+ stores member stacks under TracebackException.exceptions;
|
|
// the <model>-frame filter must recurse into them too.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import asyncio, sys',
|
|
'if sys.version_info < (3, 11):',
|
|
' raise ValueError("skip-old <model>")',
|
|
'async def boom():',
|
|
' raise ValueError("group-member")',
|
|
'async with asyncio.TaskGroup() as tg:',
|
|
' tg.create_task(boom())',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('<model>')
|
|
expect(result.error?.message).not.toContain('bootstrap.py')
|
|
})
|
|
|
|
it('keeps frames intact when a model thread floods logs while a large frame drains', async () => {
|
|
// os.write releases the GIL and a frame beyond PIPE_BUF is not atomic:
|
|
// without the writer lock + full-write loop, the printing thread could
|
|
// interleave bytes mid-frame and the host would drop the malformed JSON,
|
|
// hanging the run to the wall clock (or losing the completion).
|
|
const { runtime } = await setup({ maxValueBytes: 1024 * 1024, maxLogBytes: 4 * 1024 * 1024, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import threading',
|
|
'stop = False',
|
|
'def spam():',
|
|
' while not stop:',
|
|
' print("spam-line-" + "y" * 100)',
|
|
't = threading.Thread(target=spam)',
|
|
't.start()',
|
|
// A ~300 KiB completion — several PIPE_BUF units — while spam runs.
|
|
'big = "x" * (300 * 1024)',
|
|
'stop = True',
|
|
't.join()',
|
|
'return big',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('x'.repeat(300 * 1024))
|
|
}, 20_000)
|
|
|
|
it('settles cleanly while a daemon thread keeps writing unterminated log text', async () => {
|
|
// WARNING regression: the settlement `flush_out()/flush_err()` on the main
|
|
// coroutine read and clear `_LogStream._pending` and the shared LogBuffer
|
|
// ledger with NO lock, while a model daemon thread's `print`/`write` mutate
|
|
// the same state. Capturing the bound method (`out_stream.flush_line`) only
|
|
// fixes WHICH callable runs, not what it reads mid-flight: the flush could
|
|
// interleave with a concurrent write and join a `_pending` list being
|
|
// mutated under it, corrupting the ledger and costing the `done` frame — the
|
|
// run would then strand to the wall clock instead of completing. The shared
|
|
// re-entrant lock serializes them.
|
|
//
|
|
// A pure data race has no single bad input to reject deterministically, so
|
|
// this maximizes overlap: daemon threads emit UNTERMINATED writes (which
|
|
// pile into `_pending` rather than flushing per line) right up to the moment
|
|
// the body returns and settlement flushes. Repeated so the interleave lands.
|
|
for (let attempt = 0; attempt < 5; attempt++) {
|
|
const { runtime, fiber } = await setup({ maxLogBytes: 4 * 1024 * 1024, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys, threading',
|
|
'stop = False',
|
|
'def spam():',
|
|
' while not stop:',
|
|
// No newline: the text accumulates in the stream's `_pending`, which is
|
|
// exactly the state the settlement flush also touches.
|
|
' sys.stdout.write("tail-fragment-" + "z" * 64)',
|
|
'workers = [threading.Thread(target=spam, daemon=True) for _ in range(4)]',
|
|
'for t in workers: t.start()',
|
|
// Let the daemons build up pending writes, then return so settlement
|
|
// flushes while they are still mid-write.
|
|
'import time; time.sleep(0.05)',
|
|
'return "settled"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('settled')
|
|
await fiber.dispose()
|
|
}
|
|
}, 30_000)
|
|
|
|
it('completes a binding called from a worker thread on its own event loop', async () => {
|
|
// A binding reply Future is created on the loop that ran `dispatch`. When the
|
|
// model calls a binding from a worker THREAD via `asyncio.run(tools.x(...))`,
|
|
// that Future belongs to the thread's loop, not the main loop where
|
|
// `_pump_replies` reads the reply. `asyncio.Future` is not thread-safe:
|
|
// completing it from another thread does not wake its own loop, so a direct
|
|
// `set_result` would strand the awaiting thread and the run would degrade to a
|
|
// wall-clock timeout. The pump must schedule completion on the Future's own
|
|
// loop via `call_soon_threadsafe`. The tight maxWallMs makes the pre-fix
|
|
// failure a fast timeout rather than a hang.
|
|
//
|
|
// The main coroutine yields with `await asyncio.sleep` while the worker runs,
|
|
// rather than a synchronous `t.join()`: joining would block the main thread,
|
|
// so the main loop could not run `_pump_replies` and the call would deadlock
|
|
// regardless of the fix — that blocks the pump, not the cross-loop delivery
|
|
// this test pins.
|
|
const { runtime } = await setup({ maxWallMs: 8_000 })
|
|
const seen: unknown[] = []
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import asyncio, threading',
|
|
'result = {}',
|
|
'def worker():',
|
|
// A fresh loop in this thread; the binding Future is created here.
|
|
' result["value"] = asyncio.run(tools.echo({"from": "thread"}))',
|
|
't = threading.Thread(target=worker)',
|
|
't.start()',
|
|
'while t.is_alive():',
|
|
' await asyncio.sleep(0.02)',
|
|
'return result["value"]',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
echo: async (args) => { seen.push(args); return args as CodeJsonValue },
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toEqual({ from: 'thread' })
|
|
// The host binding actually ran (the reply round-tripped), not a timeout.
|
|
expect(seen).toEqual([{ from: 'thread' }])
|
|
}, 15_000)
|
|
|
|
it('keeps the reply pump alive when a late reply targets a closed thread loop', async () => {
|
|
// A binding called from a worker thread that ABANDONS the call (its
|
|
// `asyncio.run` is cancelled) leaves the pending entry holding that thread's
|
|
// loop, which `asyncio.run` closes on return. When the host later answers
|
|
// that call, `_pump_replies` schedules the completion onto the closed loop —
|
|
// `call_soon_threadsafe` raises `RuntimeError('Event loop is closed')`.
|
|
// Unguarded, that RuntimeError ends the pump task and strands every later
|
|
// reply; the guard drops the moot reply and keeps the pump serving.
|
|
//
|
|
// The ordering is a STRUCTURAL guarantee, not a timing window: the worker
|
|
// closes its loop before the main coroutine signals `closed`; the host
|
|
// answers the abandoned `slow` call (hitting the closed loop) before it
|
|
// answers `release`, because `release`'s handler only resolves `slow` first
|
|
// and then yields a microtask. So the pump provably meets the closed loop on
|
|
// `slow`'s reply before it must deliver `release`'s. Fail-before: the pump
|
|
// dies on `slow`, `release`'s reply is never read, and `await tools.release`
|
|
// hangs to the (small) maxWallMs as a timeout.
|
|
let releaseSlow!: () => void
|
|
const slowGate = new Promise<void>((resolve) => { releaseSlow = resolve })
|
|
const { runtime } = await setup({ maxWallMs: 6_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import asyncio, threading',
|
|
'closed = threading.Event()',
|
|
'def worker():',
|
|
' async def body():',
|
|
// Abandon the call: wait_for cancels it, but the pending host-side entry
|
|
// survives (dispatch does not pop on cancellation), holding this loop.
|
|
' try:',
|
|
' await asyncio.wait_for(tools.slow({}), timeout=0.1)',
|
|
' except asyncio.TimeoutError:',
|
|
' pass',
|
|
' asyncio.run(body())', // closes the thread's loop on return
|
|
' closed.set()',
|
|
't = threading.Thread(target=worker)',
|
|
't.start()',
|
|
'while not closed.is_set():',
|
|
' await asyncio.sleep(0.02)',
|
|
// The loop is closed. Now the host answers slow (dead-loop reply) then
|
|
// release; the pump must survive the first to deliver the second.
|
|
'after = await tools.release({})',
|
|
'return after',
|
|
].join('\n'),
|
|
bindings: tools({
|
|
slow: async () => {
|
|
// Answer only once the worker has closed its loop AND the main
|
|
// coroutine is awaiting release, so this reply reaches the pump against
|
|
// the closed loop.
|
|
await slowGate
|
|
return 'late'
|
|
},
|
|
release: async () => {
|
|
// Let slow's reply be written first, then yield a microtask so the
|
|
// pump processes the dead-loop reply before release's own reply lands.
|
|
releaseSlow()
|
|
await new Promise(resolve => setImmediate(resolve))
|
|
return 'released'
|
|
},
|
|
}),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
// The pump survived the closed-loop reply and delivered the later binding.
|
|
expect(result.value).toBe('released')
|
|
}, 15_000)
|
|
|
|
it('round-trips an exactly representable large integer through a binding echo', async () => {
|
|
// The reply serializer must print BigInt digits for a beyond-safe
|
|
// integral double: String(2**60) emits a rounded form, and the child
|
|
// would receive a DIFFERENT integer than the binding resolved.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'v = await tools.echo(2**60)',
|
|
'return v == 2**60',
|
|
].join('\n'),
|
|
bindings: tools({ echo: async args => args as never }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe(true)
|
|
})
|
|
|
|
it('preserves an exactly representable large integer and rejects a rounding one', async () => {
|
|
// The canonical boundary accepts every JS-double-exact value: 2**53 and
|
|
// 2**60 round-trip exactly and must cross (matching the worker backend);
|
|
// 2**53+1 rounds and must fail as invalid-output.
|
|
const { runtime } = await setup()
|
|
const exact = await runtime.run({ program: 'return [2**53, 2**60]', bindings: [] })
|
|
expect(exact.error).toBeUndefined()
|
|
expect(exact.value).toEqual([2 ** 53, 2 ** 60])
|
|
const lossy = await runtime.run({ program: 'return 2**53 + 1', bindings: [] })
|
|
expect(lossy.error?.kind).toBe('invalid-output')
|
|
expect(lossy.error?.message).toContain('not exactly representable')
|
|
})
|
|
|
|
it('rejects a container subclass whose overridden methods hide its contents', async () => {
|
|
// A dict subclass returning [] from items() passes an isinstance check but
|
|
// serializes as {}, so the host would receive a value the program did not
|
|
// compute. Exact-type matching fails it as invalid-output instead. The
|
|
// worker backend rejects the prototype-equivalent shapes the same way.
|
|
const { runtime } = await setup()
|
|
const hidden = await runtime.run({
|
|
program: [
|
|
'class Sneaky(dict):',
|
|
' def items(self): return []',
|
|
' def keys(self): return []',
|
|
' def __iter__(self): return iter([])',
|
|
' def __len__(self): return 0',
|
|
'return Sneaky(secret="kept")',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(hidden.error?.kind).toBe('invalid-output')
|
|
expect(hidden.error?.message).toContain('unsupported type (Sneaky)')
|
|
// A list subclass is refused on the same rule.
|
|
const listish = await runtime.run({
|
|
program: ['class L(list):', ' def __iter__(self): return iter([])', 'return L([1, 2, 3])'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(listish.error?.kind).toBe('invalid-output')
|
|
expect(listish.error?.message).toContain('unsupported type (L)')
|
|
// The exact built-in containers still cross unchanged.
|
|
const plain = await runtime.run({ program: 'return {"secret": [1, 2]}', bindings: [] })
|
|
expect(plain.error).toBeUndefined()
|
|
expect(plain.value).toEqual({ secret: [1, 2] })
|
|
})
|
|
|
|
it('rejects a scalar subclass whose overrides disagree with what gets serialized', async () => {
|
|
// The validators checked scalars with isinstance, so a subclass passed
|
|
// every check by its real value while the ENCODER read an override — the
|
|
// host then received a value the walk never approved. Each case below is a
|
|
// distinct override reaching a distinct reader.
|
|
const { runtime } = await setup()
|
|
// _dump_float spells a float from repr(value), so an overridden __repr__
|
|
// decides the digits: F(2.5) serialized as 1.
|
|
const floated = await runtime.run({
|
|
program: [
|
|
'class F(float):',
|
|
' def __repr__(self): return "1.0"',
|
|
'return F(2.5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(floated.error?.kind).toBe('invalid-output')
|
|
expect(floated.error?.message).toContain('unsupported type (F)')
|
|
// The JS-safe-range bound is two comparisons, so overriding them admits an
|
|
// int whose true digits (json.dumps reads the C-level value) the host's
|
|
// JSON.parse rounds: 9007199254740993 arrives as ...992.
|
|
const inted = await runtime.run({
|
|
program: [
|
|
'class I(int):',
|
|
' def __gt__(self, other): return False',
|
|
' def __lt__(self, other): return False',
|
|
'return I(2 ** 53 + 1)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(inted.error?.kind).toBe('invalid-output')
|
|
expect(inted.error?.message).toContain('unsupported type (I)')
|
|
// The pre-encode size bound reads len(), so overriding it to 0 admits a
|
|
// string of any length past maxValueBytes.
|
|
const stringed = await runtime.run({
|
|
program: [
|
|
'class S(str):',
|
|
' def __len__(self): return 0',
|
|
'return S("Q" * 100000)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(stringed.error?.kind).toBe('invalid-output')
|
|
expect(stringed.error?.message).toContain('unsupported type (S)')
|
|
// A str-subclass dict KEY reaches the same len() bound.
|
|
const keyed = await runtime.run({
|
|
program: [
|
|
'class S(str):',
|
|
' def __len__(self): return 0',
|
|
'return {S("Q" * 100000): 1}',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(keyed.error?.kind).toBe('invalid-output')
|
|
expect(keyed.error?.message).toContain('non-string dict key (S)')
|
|
// bool is an int subclass that IS lossless JSON, and the exact scalars all
|
|
// still cross unchanged.
|
|
const plain = await runtime.run({
|
|
program: 'return {"t": True, "f": False, "n": None, "i": 7, "d": 2.5, "s": "ok"}',
|
|
bindings: [],
|
|
})
|
|
expect(plain.error).toBeUndefined()
|
|
expect(plain.value).toEqual({ t: true, f: false, n: null, i: 7, d: 2.5, s: 'ok' })
|
|
})
|
|
|
|
it('rejects a scalar subclass passed as a binding argument', async () => {
|
|
// The uncapped binding-argument validator shares the exact-type rule, so
|
|
// the call fails through its rejection contract instead of dispatching a
|
|
// float whose digits come from an override.
|
|
const { runtime } = await setup()
|
|
const seen: CodeJsonValue[] = []
|
|
const result = await runtime.run({
|
|
program: [
|
|
'class F(float):',
|
|
' def __repr__(self): return "1.0"',
|
|
'try:',
|
|
' await tools.echo({"v": F(2.5)})',
|
|
'except Exception as exc:',
|
|
' return str(exc)',
|
|
].join('\n'),
|
|
bindings: tools({ echo: async (args) => {
|
|
seen.push(args as CodeJsonValue)
|
|
return null
|
|
} }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('unsupported type (F)')
|
|
expect(seen).toEqual([])
|
|
})
|
|
|
|
it('rejects a container subclass passed as a binding argument', async () => {
|
|
// Binding arguments run the uncapped validator, which must apply the same
|
|
// exact-type rule: the call fails descriptively instead of dispatching a
|
|
// value whose serialization disagrees with what was validated.
|
|
const { runtime } = await setup()
|
|
const seen: CodeJsonValue[] = []
|
|
const result = await runtime.run({
|
|
program: [
|
|
'class Sneaky(dict):',
|
|
' def items(self): return []',
|
|
'try:',
|
|
' await tools.echo(Sneaky(secret="kept"))',
|
|
'except Exception as exc:',
|
|
' return str(exc)',
|
|
].join('\n'),
|
|
bindings: tools({ echo: async (args) => {
|
|
seen.push(args as CodeJsonValue)
|
|
return null
|
|
} }),
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toContain('unsupported type (Sneaky)')
|
|
expect(seen).toEqual([])
|
|
})
|
|
|
|
it('fails an oversized completion as output-limit without materializing its encoding', async () => {
|
|
// A 100 MiB string under maxValueBytes: 1024 must fail as output-limit.
|
|
// The address-space cap leaves room for the program to BUILD the string
|
|
// (one copy + interpreter) but not for the old full pre-check encode,
|
|
// which materialized chunk fragments plus the joined copy (~2 more
|
|
// copies) and died on RLIMIT_AS as MemoryError/worker-exit.
|
|
const { runtime } = await setup({ maxValueBytes: 1024, addressSpaceMb: 384, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: 'return "x" * (100 * 1024 * 1024)',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
expect(result.error?.message).toContain('exceeded 1024 bytes')
|
|
}, 20_000)
|
|
|
|
it('rejects a control-heavy oversized completion on its length, not its escaped copy', async () => {
|
|
// Every "\x00" escapes to the six bytes " ", so the escaped form of a
|
|
// 40 MB string is ~240 MB. The walk must refuse on the cheap
|
|
// `len(current) + 2` lower bound; the 384 MiB address space holds the raw
|
|
// string but not its escaped expansion, so a pre-escape check dies on
|
|
// RLIMIT_AS instead of returning output-limit.
|
|
const { runtime } = await setup({ maxValueBytes: 1024, addressSpaceMb: 384, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: 'return "\\x00" * (40 * 1024 * 1024)',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
expect(result.error?.message).toContain('exceeded 1024 bytes')
|
|
}, 20_000)
|
|
|
|
it('truncates a single print far above maxLogBytes instead of dying on the encode', async () => {
|
|
// LogBuffer must reject via the cheap char-count lower bound BEFORE
|
|
// UTF-8-encoding the whole string: the full encode of a ~100 MB line
|
|
// would double the allocation and can breach RLIMIT_AS. 256 MiB
|
|
// address space comfortably holds one copy of the 100 MB string but
|
|
// not the pre-fix double allocation plus interpreter overhead spikes.
|
|
const { runtime } = await setup({ maxLogBytes: 1024, addressSpaceMb: 256, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'print("x" * (100 * 1024 * 1024))',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
|
}, 20_000)
|
|
|
|
it('stops host capture at the child ledger truncation, keeping exactly one marker', async () => {
|
|
// The two ledgers exhaust independently. One child entry larger than
|
|
// `maxLogBytes` sends ONLY the marker, so the host budget is still nearly
|
|
// untouched — and the marker used to arrive as an ordinary `log` frame the
|
|
// host could not tell from program output. Text written afterwards was
|
|
// therefore retained AFTER the marker, contradicting the stop-after-
|
|
// truncation contract, and a later host-side exhaustion could append a
|
|
// second marker. The frame now carries `truncated: true`.
|
|
//
|
|
// `os.write(1, ...)` bypasses the child's own stream, so those bytes reach
|
|
// the host as stray stdout and take the host ledger path rather than the
|
|
// child's — which is exactly the route that leaked past the marker.
|
|
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'print("y" * 70000)',
|
|
'os.write(1, b"AFTER")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
const markers = result.logs.filter(line => line.includes('log capture truncated'))
|
|
expect(markers).toHaveLength(1)
|
|
// The marker is the LAST entry: nothing was retained after truncation.
|
|
expect(result.logs.at(-1)).toBe(markers[0])
|
|
expect(result.logs.join('\n')).not.toContain('AFTER')
|
|
}, 20_000)
|
|
|
|
it('keeps one marker when a program forges repeated truncation frames', async () => {
|
|
// `truncated` is attacker-reachable: the program owns fd 3 and can write the
|
|
// flag itself, so the field is a hostile input rather than a trusted signal.
|
|
// Repeats must collapse to the single marker the contract promises, and only
|
|
// the literal `true` counts — a forged `"yes"` is rebuilt away by
|
|
// validateChildFrame, so that frame stays ordinary text.
|
|
const { runtime } = await setup({ maxLogBytes: 4096, maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'os.write(3, json.dumps({"type":"log","text":"first","truncated":"yes"}).encode() + b"\\n")',
|
|
'os.write(3, json.dumps({"type":"log","text":"MARK-A","truncated":True}).encode() + b"\\n")',
|
|
'os.write(3, json.dumps({"type":"log","text":"MARK-B","truncated":True}).encode() + b"\\n")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
// The non-boolean flag did not truncate, so its text was captured normally.
|
|
expect(result.logs).toContain('first')
|
|
// The first genuine flag stopped capture and emitted the HOST's own marker;
|
|
// the frame's own text is discarded, so neither payload appears.
|
|
expect(result.logs).not.toContain('MARK-A')
|
|
expect(result.logs).not.toContain('MARK-B')
|
|
expect(result.logs.at(-1)).toBe(logTruncationMarker(4096))
|
|
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
|
}, 20_000)
|
|
|
|
it('discards the text of a forged truncation frame instead of retaining it', async () => {
|
|
// The marker branch bypasses `admit`, so retaining the frame's own text put
|
|
// attacker-controlled bytes into `logs` with no cap at all: measured, a 1 MiB
|
|
// forged text was retained whole under `maxLogBytes: 64`, and the only bound
|
|
// left was the 256 MiB frame ceiling. The host emits its own marker instead,
|
|
// so the retained size is fixed regardless of what the program sent.
|
|
const forgedBytes = 1024 * 1024
|
|
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
`big = "A" * ${forgedBytes}`,
|
|
'os.write(3, json.dumps({"type":"log","truncated":True,"text":big}).encode() + b"\\n")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
// Only the host marker is kept, so the total stays orders of magnitude below
|
|
// what the forgery carried — and below the cap it was trying to escape.
|
|
expect(result.logs).toEqual([logTruncationMarker(64)])
|
|
expect(result.logs.join('').length).toBeLessThan(forgedBytes / 1000)
|
|
}, 30_000)
|
|
|
|
it('coalesces unframed fd-3 fragments without recopying the sealed prefix', async () => {
|
|
// The frame ceiling meters payload BYTES, but each retained chunk is its own
|
|
// Buffer with object and backing-store overhead the byte count cannot see:
|
|
// 5000 single-byte newline-free writes produced 5000 chunks holding 5031
|
|
// bytes, so a program pacing such writes could accumulate millions of objects
|
|
// inside the wall budget and exhaust the host heap far below 256 MiB.
|
|
//
|
|
// The observable behavior is that the run still completes normally: the
|
|
// fragments are coalesced rather than rejected, since a slow trickle of bytes
|
|
// is not itself a protocol violation.
|
|
//
|
|
// `Buffer.concat` is wrapped for the duration so the cumulative copy volume
|
|
// is measured rather than inferred: that total is what separates sealing into
|
|
// blocks from re-merging the whole buffer, and both shapes pass every
|
|
// behavioral assertion below.
|
|
//
|
|
// The trickle is terminated with its own newline before the real frame is
|
|
// written. Without that, those 5000 bytes prefix the frame on the SAME line,
|
|
// which then parses as junk and is dropped — correct framing behavior, but it
|
|
// would leave this test asserting the wrong thing.
|
|
// Bound at capture: `Buffer.concat` is a static method, and taking a bare
|
|
// reference to one trips no-unbound-method.
|
|
const realConcat = Buffer.concat.bind(Buffer)
|
|
let copied = 0
|
|
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
|
for (const part of list) copied += part.length
|
|
return realConcat(list, total)
|
|
}
|
|
const program = [
|
|
'import os',
|
|
// Newline-free single-byte writes, spaced so each lands as its own read.
|
|
// 60000 rather than 5000: the trickle has to cross the seal threshold
|
|
// enough times for the two shapes to separate. At 5000 writes there are
|
|
// only four seals, so even the quadratic form copies well under a
|
|
// megabyte and the budget below could not tell them apart.
|
|
'for _ in range(60000):',
|
|
' os.write(3, b"x")',
|
|
' os.sched_yield()',
|
|
'os.write(3, b"\\n")',
|
|
// A real frame after the trickle proves framing still works on the
|
|
// coalesced residual.
|
|
'print("after-trickle")',
|
|
'return "done"',
|
|
].join('\n')
|
|
let result: CodeRunResult
|
|
try {
|
|
const { runtime } = await setup({ maxWallMs: 30_000 })
|
|
result = await runtime.run({ program, bindings: [] })
|
|
} finally {
|
|
Buffer.concat = realConcat
|
|
}
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs).toContain('after-trickle')
|
|
// Sealing appends a finished block rather than re-merging everything held, so
|
|
// each byte is copied once. Re-concatenating the whole buffer at every
|
|
// threshold made the cumulative copy volume quadratic — 10 MiB trickled a
|
|
// byte at a time copies 53.7 GB that way. A per-byte-copied budget is the
|
|
// discriminator, and it is measured rather than reasoned about: this shape
|
|
// copies about 119 KB for 60000 trickled bytes, the re-merging shape about
|
|
// 540 KB. 256 KiB sits between them with margin on both sides — most writes
|
|
// are coalesced by the pipe before they reach us, so the observed ratio is
|
|
// smaller than the asymptotic one, and the threshold has to sit where a real
|
|
// measurement lands rather than where the asymptote suggests.
|
|
expect(copied).toBeLessThan(256 * 1024)
|
|
}, 40_000)
|
|
|
|
it('seals trickled stray fragments into blocks without recopying the sealed prefix', async () => {
|
|
// The stray-capture buffer has the same object-overhead exposure as the fd-3
|
|
// reader above: each newline-free `data` chunk is its own Buffer, so a
|
|
// program pacing single-byte `os.write(1, ...)` accumulates one object per
|
|
// write, which the serialized-cost counter cannot see. Past MAX_PENDING_CHUNKS
|
|
// the fragments seal into a finished block; re-merging the whole residual at
|
|
// each threshold instead would copy the sealed prefix again and again, making
|
|
// the cumulative copy volume quadratic. `Buffer.concat` is wrapped to measure
|
|
// that volume — both shapes admit the same final log entry, so the copy total
|
|
// is the discriminator. maxLogBytes is raised so the trickle is retained,
|
|
// not truncated, which is what forces the fragments to accumulate and seal.
|
|
const realConcat = Buffer.concat.bind(Buffer)
|
|
let copied = 0
|
|
Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer<ArrayBuffer> => {
|
|
for (const part of list) copied += part.length
|
|
return realConcat(list, total)
|
|
}
|
|
let result: CodeRunResult
|
|
try {
|
|
const { runtime } = await setup({ maxLogBytes: 200_000, maxWallMs: 30_000 })
|
|
result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'for _ in range(60000):',
|
|
' os.write(1, b"x")',
|
|
' os.sched_yield()',
|
|
'os.write(1, b"\\n")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
} finally {
|
|
Buffer.concat = realConcat
|
|
}
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
// The trickle coalesces into one log line (no interior newlines). Its exact
|
|
// length depends on pipe coalescing, but it is one entry and non-empty.
|
|
expect(result.logs.length).toBe(1)
|
|
expect((result.logs[0] as string).length).toBeGreaterThan(0)
|
|
// Sealing appends a finished block rather than re-merging everything held, so
|
|
// each byte is copied a bounded number of times. Re-merging the whole
|
|
// residual at every seal threshold instead makes the cumulative copy volume
|
|
// quadratic. Measured like the fd-3 sibling above rather than reasoned about:
|
|
// this sealed shape copies about 120 KB for 60000 trickled bytes, the
|
|
// re-merging shape about 538 KB (the stray path adds one whole-residual
|
|
// concat at the terminating newline over the fd-3 sibling's 119/540, landing
|
|
// at the same order). 256 KiB sits between them with margin on both sides, so
|
|
// reverting the seal to a re-merge turns this assertion red.
|
|
expect(copied).toBeLessThan(256 * 1024)
|
|
}, 40_000)
|
|
|
|
it('caps a huge exception diagnostic child-side before it crosses the wire', async () => {
|
|
// A program can raise with a multi-megabyte message; the child must cap
|
|
// it at maxValueBytes before formatting/sending, not ship the whole
|
|
// payload for the host to truncate after parsing.
|
|
const { runtime } = await setup({ maxValueBytes: 1024 })
|
|
const result = await runtime.run({
|
|
program: 'raise ValueError("boom-" + "x" * (8 * 1024 * 1024))',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toContain('boom-')
|
|
expect(result.error?.message.endsWith('… [truncated]')).toBe(true)
|
|
expect(Buffer.byteLength(result.error?.message ?? '', 'utf8')).toBeLessThan(2048)
|
|
})
|
|
|
|
it('caps a control-heavy exception diagnostic by its serialized cost, not raw bytes', async () => {
|
|
// The diagnostic crosses fd 3 inside a JSON frame where a control character
|
|
// escapes sixfold (a NUL is one raw byte, six as ` `). Capping by raw
|
|
// UTF-8 length would let a NUL-heavy message near maxValueBytes serialize to
|
|
// ~6x that and breach the frame ceiling — the silent worker-exit inversion
|
|
// the load-time cap check exists to prevent. The child meters the diagnostic
|
|
// by its serialized cost, so a NUL flood is truncated to fit the frame and
|
|
// the run still reports the exception rather than a worker-exit.
|
|
const { runtime } = await setup({ maxValueBytes: 4096 })
|
|
const result = await runtime.run({
|
|
// 512 KiB of NUL: ~3 MiB once escaped, far past the 4 KiB cap.
|
|
program: 'raise ValueError("\\x00" * (512 * 1024))',
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message.endsWith('… [truncated]')).toBe(true)
|
|
// The SERIALIZED form (what the frame carried) fits the budget, so its raw
|
|
// length is well under it too — a raw-byte cap would have admitted ~4 KiB of
|
|
// NULs that serialize to ~24 KiB.
|
|
const serialized = JSON.stringify(result.error?.message ?? '')
|
|
expect(Buffer.byteLength(serialized, 'utf8')).toBeLessThanOrEqual(4096 + 8)
|
|
})
|
|
|
|
it('bounds a newline-free partial-line flood while the program is still running', async () => {
|
|
// print("x", end="") never completes a line, so nothing reaches the
|
|
// Python LogBuffer until settlement — the buffered tail must still hit
|
|
// the budget mid-run instead of growing without bound to RLIMIT/timeout.
|
|
const { runtime } = await setup({ maxLogBytes: 1024, maxWallMs: 15_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'for _ in range(100000):',
|
|
' print("xxxxxxxxxx", end="")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
|
// The retained text is bounded by the budget, not the 1 MB the program wrote.
|
|
expect(result.logs.join('\n').length).toBeLessThan(4096)
|
|
}, 20_000)
|
|
|
|
it('discards empty writes instead of buffering one list slot each', async () => {
|
|
// An empty chunk adds no character, so the mid-run budget check (which
|
|
// compares buffered CHARS against the remaining ledger) can never fire on
|
|
// it. Buffering empty strings therefore grew `_pending` without bound —
|
|
// millions of slots per CPU second — until RLIMIT_AS turned an append into
|
|
// a MemoryError, long after the log ledger was exhausted. Two million
|
|
// empty writes must instead settle normally and contribute NO log entry,
|
|
// proving the chunk was dropped rather than joined at flush_line.
|
|
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 256, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'for _ in range(2000000):',
|
|
' sys.stdout.write("")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs).toEqual([])
|
|
}, 30_000)
|
|
|
|
it('stops scanning a single-write newline flood once the log ledger truncates', async () => {
|
|
// One write carrying half a million newlines: the offset scan must exit the
|
|
// instant LogBuffer truncates rather than re-slicing and pushing every
|
|
// remaining line. If it kept scanning it would exhaust the CPU/wall budget;
|
|
// the run instead settles quickly with exactly one truncation marker.
|
|
const { runtime } = await setup({ maxLogBytes: 256, maxWallMs: 10_000 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: ['print("x\\n" * 500000, end="")', 'return "done"'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
|
expect(Date.now() - start).toBeLessThan(8_000)
|
|
}, 15_000)
|
|
|
|
it('bounds an oversized newline-terminated write before joining and slicing it', async () => {
|
|
// The newline branch slices the first line out of the write before
|
|
// `LogBuffer.push` can apply its cheap budget rejection, so a single
|
|
// over-budget write cost a full extra copy of itself in peak address space —
|
|
// the amplification that bound exists to avoid, applied one layer too late.
|
|
// Measured under a 400 MiB addressSpaceMb with the slice unbounded: writes
|
|
// of 200 MiB and up died on MemoryError inside `sys.stdout.write`, reported
|
|
// as the PROGRAM's own exception rather than the promised truncation marker.
|
|
// `"\\n".rjust(n, "A")` is a single allocation ending in the newline, so the
|
|
// payload itself fits and the only remaining allocation is the stream's own
|
|
// slice; 340 MiB of a 400 MiB cap cannot survive one more copy of it.
|
|
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'payload = "\\n".rjust(340 * 1024 * 1024, "A")',
|
|
'sys.stdout.write(payload)',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs).toEqual([logTruncationMarker(256)])
|
|
}, 40_000)
|
|
|
|
it('bounds a newline-free write against the already-buffered chunks before joining them', async () => {
|
|
// The newline-free arm buffers the write and then compared the buffered
|
|
// CHARACTER COUNT against the ledger — correct — but paid for the comparison
|
|
// with `"".join(self._pending)`, a second full copy of everything held. One
|
|
// buffered character is enough to make that join a copy of the whole
|
|
// following write. Measured under a 400 MiB addressSpaceMb with a 340 MiB
|
|
// second write: the join raised MemoryError inside `sys.stdout.write`, and
|
|
// because the oversized chunks stayed in `_pending` the settlement
|
|
// `flush_line` raised it again — that throw sits after the `except
|
|
// BaseException` block, so it costs the `done` frame and the run came back
|
|
// `timeout: wall-clock ceiling reached (30000ms)` with no logs at all. The
|
|
// bound must be applied BEFORE the join and the chunks dropped on that path,
|
|
// so the run settles with the truncation marker it promises.
|
|
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
// One unterminated character first, so `_pending` is non-empty and the
|
|
// large write cannot take the "buffered text IS the write" shortcut.
|
|
'sys.stdout.write("x")',
|
|
'payload = "A" * (340 * 1024 * 1024)',
|
|
'sys.stdout.write(payload)',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs).toEqual([logTruncationMarker(256)])
|
|
}, 40_000)
|
|
|
|
it('bounds a newline-terminated write against the already-buffered chunks before joining them', async () => {
|
|
// Same allocation, reached through the newline arm: with chunks pending, the
|
|
// whole write used to be appended and joined so the offset scan could run
|
|
// over one string. Only the FIRST line needs those chunks, so a pending
|
|
// chunk plus a 340 MiB newline-terminated write under a 400 MiB
|
|
// addressSpaceMb died on MemoryError in the join before the per-line bound
|
|
// could reject anything, and the retained chunks made the settlement flush
|
|
// die the same way: measured, `timeout: wall-clock ceiling reached
|
|
// (30000ms)`. The reconstructed first line is now checked against the ledger
|
|
// and only a budget-sized prefix of it is copied; the rest of the write is
|
|
// scanned in place.
|
|
const { runtime } = await setup({ maxLogBytes: 256, addressSpaceMb: 400, maxWallMs: 30_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'sys.stdout.write("x")',
|
|
'payload = "\\n".rjust(340 * 1024 * 1024, "A")',
|
|
'sys.stdout.write(payload)',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs).toEqual([logTruncationMarker(256)])
|
|
}, 40_000)
|
|
|
|
it('emits pending text on an explicit flush, before the run can be killed', async () => {
|
|
// `_LogStream` inherits TextIOBase's no-op `flush()`, so an explicit
|
|
// `print(..., flush=True)` or `sys.stdout.flush()` left the text in
|
|
// `_pending` with nothing to drain it but `flush_line` after settlement — a
|
|
// call a hanging or killed run never reaches. Measured: printing
|
|
// "before hang" with flush=True ahead of an infinite loop returned
|
|
// `logs: []`, losing the one diagnostic the program deliberately committed.
|
|
const { runtime } = await setup({ maxWallMs: 4_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import sys',
|
|
'print("before hang", end="", flush=True)',
|
|
'while True: pass',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('timeout')
|
|
expect(result.logs).toContain('before hang')
|
|
}, 15_000)
|
|
|
|
it('marks a dropped tail when the ledger lands on exactly zero remaining', async () => {
|
|
// One 100-character line costs 103 serialized bytes (quotes + separator),
|
|
// consuming a 103-byte budget EXACTLY. Landing on zero never trips
|
|
// LogBuffer's "cost > remaining" branch, so `_truncated` stays unset and the
|
|
// stream's own `remaining > 0` guard silently discarded the unscanned tail —
|
|
// the run reported a complete log while dropping text. The tail must be
|
|
// pushed so the marker is emitted. (This surfaced only after empty writes
|
|
// stopped being buffered: `print` issues a trailing `write("")` whose
|
|
// buffered-empty path used to force the marker out incidentally.) A single
|
|
// wide line is used rather than many narrow ones so the CHILD ledger is the
|
|
// one that lands on zero: the host's identical ledger truncates first when
|
|
// many small entries precede the long marker text.
|
|
const { runtime } = await setup({ maxLogBytes: 103, maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: ['print("y" * 100 + "\\n" + "z" * 10, end="")', 'return "done"'].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs).toContain('y'.repeat(100))
|
|
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
|
// The dropped tail is not retained, but its loss is now reported.
|
|
expect(result.logs.some(line => line.includes('z'))).toBe(false)
|
|
}, 15_000)
|
|
|
|
it('charges the JSON-escaped cost of control characters against the log ledger', async () => {
|
|
// A NUL renders as \u0000 (6 bytes) in the serialized outer logs; the
|
|
// ledger must charge that expansion, or a control-character flood admits
|
|
// 6x the configured cap.
|
|
const { runtime } = await setup({ maxLogBytes: 256 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'for _ in range(500):',
|
|
' print("\\x00" * 10)',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
|
// Serialized (escaped) size of retained entries stays in the budget's
|
|
// neighborhood: well under the ~30 kB an uncharged flood would retain.
|
|
const serialized = Buffer.byteLength(JSON.stringify(result.logs), 'utf8')
|
|
expect(serialized).toBeLessThan(1024)
|
|
})
|
|
|
|
it('charges the serialized cost child-side, so a control-heavy line truncates instead of breaching the address space', async () => {
|
|
// The child's ledger must charge what the entry costs on the wire, not its
|
|
// raw UTF-8 length: a NUL is one raw byte but six as its escape. A 24 MiB NUL
|
|
// line clears the cheap char-count lower bound (24 MiB < 32 MiB budget), so
|
|
// charging raw bytes would ADMIT it and then encode a ~144 MiB escaped
|
|
// payload plus its UTF-8 copy — past the 384 MiB address space, killing the
|
|
// child (surfaced host-side as `worker-exit`) instead of truncating.
|
|
// Charging the serialized cost rejects it before any encode.
|
|
const { runtime } = await setup({ maxLogBytes: 32 * 1024 * 1024, addressSpaceMb: 384, maxWallMs: 20_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'print("\\x00" * (24 * 1024 * 1024))',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('done')
|
|
expect(result.logs.filter(line => line.includes('log capture truncated'))).toHaveLength(1)
|
|
// Nothing of the line itself was retained: the ledger refused the whole entry.
|
|
expect(result.logs.every(line => !line.includes(String.fromCharCode(0)))).toBe(true)
|
|
}, 30_000)
|
|
|
|
it('bounds a flood of zero-byte log lines through the per-entry separator charge', async () => {
|
|
// Blank print() lines carry zero content bytes; without the +1 separator
|
|
// charge they would bypass maxLogBytes entirely and grow the retained
|
|
// array without bound. Each empty entry costs one byte, so a 64-byte
|
|
// budget retains at most 64 entries before the marker.
|
|
const { runtime } = await setup({ maxLogBytes: 64, maxWallMs: 10_000 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'for _ in range(10000):',
|
|
' print()',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.length).toBeLessThanOrEqual(65)
|
|
expect(result.logs.some(line => line.includes('log capture truncated'))).toBe(true)
|
|
})
|
|
|
|
it('reassembles multibyte UTF-8 split across stray-output pipe chunks', async () => {
|
|
// A single os.write far past the 64 KiB pipe buffer forces multiple
|
|
// 'data' chunks; when the boundary lands inside the emoji's 4-byte
|
|
// sequence, per-chunk decoding would corrupt it into replacement
|
|
// characters. Raw bytes are buffered and only decoded once a complete line
|
|
// (or the whole tail at flush) is assembled, so the split sequence is whole
|
|
// by the time it is decoded.
|
|
const { runtime } = await setup({ maxLogBytes: 1024 * 1024 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
// os.write is one syscall and returns a partial count on a full
|
|
// pipe, so loop until the whole payload (odd prefix -> a chunk
|
|
// boundary lands inside the emoji's 4-byte sequence) is out.
|
|
String.raw`payload = b"a" * 65535 + "\u4f60\u597d\U0001f600".encode("utf-8")`,
|
|
'view = memoryview(payload)',
|
|
'while view:',
|
|
' view = view[os.write(1, view):]',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
const text = result.logs.join('')
|
|
expect(text).toContain('\u4f60\u597d\u{1f600}')
|
|
expect(text).not.toContain('\ufffd')
|
|
})
|
|
|
|
it('flushes a stray-output byte sequence left incomplete when the pipe ends', async () => {
|
|
// The child writes the first two bytes of a 3-byte UTF-8 character to fd 1
|
|
// and exits, so the pipe closes with the sequence unfinished in the raw
|
|
// residual. The 'end' flush decodes the residual with `toString('utf8')`,
|
|
// which renders the stranded bytes as U+FFFD instead of dropping them.
|
|
const { runtime } = await setup({ maxLogBytes: 1024 * 1024 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
// b"\xe4\xbd" is the leading two bytes of U+4F60; no continuation byte
|
|
// follows before exit.
|
|
String.raw`os.write(1, b"\xe4\xbd")`,
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.join('')).toContain('�')
|
|
})
|
|
|
|
it('rejects reserved words of EITHER backend language as binding globals', async () => {
|
|
// The seam's portable contract: `lambda` (Python keyword, legal JS name)
|
|
// and `typeof` (JS keyword, legal Python name) are both refused, so a
|
|
// namespace list valid on one backend is valid on every backend.
|
|
const { runtime } = await setup()
|
|
for (const global of ['lambda', 'typeof']) {
|
|
await expect(runtime.run({
|
|
program: 'return 1',
|
|
bindings: [{ global, functions: {} }],
|
|
})).rejects.toThrow(/is not a usable Python identifier/)
|
|
}
|
|
})
|
|
|
|
it('captures stray stdout bytes the child writes bypassing sys.stdout', async () => {
|
|
// Model code that writes to fd 1 via os.write() bypasses the Python-side
|
|
// LogBuffer, so the host's stray-byte capture on child.stdout is what
|
|
// records it.
|
|
const { runtime } = await setup()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'os.write(1, b"stray stdout\\n")',
|
|
'os.write(2, b"stray stderr\\n")',
|
|
'return "done"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.logs.join('')).toContain('stray stdout')
|
|
expect(result.logs.join('')).toContain('stray stderr')
|
|
})
|
|
|
|
it('escalates to SIGKILL when the program traps SIGTERM and ignores the grace period', async () => {
|
|
// A program that traps SIGTERM should still die: the kill() escalation
|
|
// fires SIGKILL after graceMs. The full run reports either timeout (wall)
|
|
// or worker-exit depending on which finish reason wins the race.
|
|
const { runtime } = await setup({ maxWallMs: 400, graceMs: 200 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import signal, time',
|
|
'signal.signal(signal.SIGTERM, lambda *a: None)',
|
|
'while True: time.sleep(1)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(['timeout', 'worker-exit']).toContain(result.error?.kind)
|
|
}, 6000)
|
|
|
|
it('bounds the fd-3 receive buffer against a newline-free flood', async () => {
|
|
// A program looping os.write(3, ...) with no newline would grow the host
|
|
// accumulator unbounded (the child's RLIMIT_AS does not cover the host
|
|
// string). The ceiling is a fixed 256 MiB memory-safety invariant —
|
|
// deliberately NOT derived from maxValueBytes, because legitimate binding
|
|
// call frames may be large. We flood slightly past it in 8 MiB writes so
|
|
// the test terminates promptly once the guard trips.
|
|
const ceiling = 256 * 1024 * 1024
|
|
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
|
|
const start = Date.now()
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
`for _ in range(${Math.ceil((ceiling * 1.1) / (8 * 1024 * 1024))}):`,
|
|
' os.write(3, b"A" * (8 * 1024 * 1024))',
|
|
'return "never"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
const elapsed = Date.now() - start
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
|
|
// The breach ends the run before the wall ceiling (the run did not idle
|
|
// out); absolute pipe throughput varies too much under parallel suites
|
|
// for a tight bound.
|
|
expect(elapsed).toBeLessThan(30_000)
|
|
}, 45_000)
|
|
|
|
it('fails a forged oversized done value host-side as output-limit', async () => {
|
|
// The Python-side _done_with_value check is bypassable by writing a done
|
|
// frame straight to fd 3. The host re-enforces maxValueBytes; the seam
|
|
// forbids substituting a truncated value, so the run FAILS as output-limit
|
|
// instead of returning a lie.
|
|
const maxValueBytes = 64
|
|
const { runtime } = await setup({ maxValueBytes })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'big = "B" * 5000',
|
|
'os.write(3, json.dumps({"type":"done","value":big}).encode() + b"\\n")',
|
|
// The real done never sends; the forged one settles the run.
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('output-limit')
|
|
expect(result.error?.message).toContain('exceeded 64 bytes')
|
|
}, 8000)
|
|
|
|
it('drops a forged oversized log frame on its code-unit lower bound, before escaping it', async () => {
|
|
// A forged `log` frame carrying a control-heavy string sits below the
|
|
// 256 MiB fd-3 frame ceiling but escapes several-fold: 24 MiB of NULs
|
|
// becomes ~144 MiB of ` `. Charging it required building that escaped
|
|
// copy first, so a 32-byte maxLogBytes could still force a
|
|
// hundreds-of-megabytes host allocation. The cheap `length + 3` lower bound
|
|
// truncates it instead. The host's own heap is what is under test, so keep
|
|
// the child's address space generous enough to BUILD the frame.
|
|
const { runtime } = await setup({ maxLogBytes: 32, addressSpaceMb: 1024, maxWallMs: 60_000 })
|
|
const before = process.memoryUsage().heapUsed
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
// Written as a raw frame so the child's own ledger never sees it.
|
|
'os.write(3, b\'{"type":"log","text":"\' + b"\\\\u0000" * (24 * 1024 * 1024) + b\'"}\\n\')',
|
|
'return "settled"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('settled')
|
|
// The frame was dropped as one truncation marker, not retained.
|
|
expect(result.logs).toEqual([logTruncationMarker(32)])
|
|
// The escaped copy (~144 MiB) was never materialized.
|
|
expect(process.memoryUsage().heapUsed - before).toBeLessThan(256 * 1024 * 1024)
|
|
}, 90_000)
|
|
|
|
it('charges a forged log frame its escaped cost once past the code-unit lower bound', async () => {
|
|
// The cheap lower bound only rejects what cannot possibly fit; a SHORT
|
|
// control-heavy frame clears it and must still be charged what it costs on
|
|
// the wire. Ten NULs are 13 against the 32-byte lower bound but 63 escaped
|
|
// (six bytes each, two quotes, one separator), so the full charge truncates.
|
|
const { runtime } = await setup({ maxLogBytes: 32 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'os.write(3, b\'{"type":"log","text":"\' + b"\\\\u0000" * 10 + b\'"}\\n\')',
|
|
'return "settled"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.value).toBe('settled')
|
|
expect(result.logs).toEqual([logTruncationMarker(32)])
|
|
}, 8000)
|
|
|
|
it('caps a forged done error.message from its code-unit prefix, never encoding the whole message', async () => {
|
|
// `Buffer.from(message)` on a message near the frame ceiling allocates a
|
|
// full UTF-8 copy before maxValueBytes applies. Only the first
|
|
// maxValueBytes code units can fit the cap, so only that prefix is encoded
|
|
// — at most 3x the cap in bytes. The message here is 48 MiB of ASCII: its
|
|
// full encode would be another 48 MiB in the host.
|
|
const maxValueBytes = 64
|
|
const { runtime } = await setup({ maxValueBytes, addressSpaceMb: 1024, maxWallMs: 60_000 })
|
|
const before = process.memoryUsage().heapUsed
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'os.write(3, b\'{"type":"done","error":{"kind":"exception","message":"\' + b"E" * (48 * 1024 * 1024) + b\'"}}\\n\')',
|
|
'import time',
|
|
'time.sleep(30)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
const message = result.error?.message ?? ''
|
|
// The marker's 15 bytes come OUT of the 64-byte cap, so 49 E's precede it
|
|
// and the whole string is exactly 64 bytes — not 64 plus the marker.
|
|
expect(message).toBe(`${'E'.repeat(maxValueBytes - 15)}… [truncated]`)
|
|
expect(Buffer.byteLength(message, 'utf8')).toBe(maxValueBytes)
|
|
// JSON.parse already holds the 48 MiB string; the cap must not add a
|
|
// second full-length copy on top of it.
|
|
expect(process.memoryUsage().heapUsed - before).toBeLessThan(256 * 1024 * 1024)
|
|
}, 90_000)
|
|
|
|
it('keeps a capped diagnostic within maxValueBytes, marker included', async () => {
|
|
// The marker is part of the emitted diagnostic, so its bytes are reserved
|
|
// from the cap rather than appended past it — the host meters this same
|
|
// field downstream. Checked on BOTH producers: the child's own _cap_message
|
|
// (a raised exception) and the host's capMessage (a forged done frame).
|
|
const maxValueBytes = 40
|
|
const { runtime } = await setup({ maxValueBytes })
|
|
const raised = await runtime.run({
|
|
program: 'raise ValueError("R" * 100000)',
|
|
bindings: [],
|
|
})
|
|
expect(raised.error?.kind).toBe('exception')
|
|
const raisedMessage = raised.error?.message ?? ''
|
|
expect(raisedMessage.endsWith('… [truncated]')).toBe(true)
|
|
expect(Buffer.byteLength(raisedMessage, 'utf8')).toBeLessThanOrEqual(maxValueBytes)
|
|
const forged = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'msg = "F" * 100000',
|
|
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(forged.error?.kind).toBe('exception')
|
|
const forgedMessage = forged.error?.message ?? ''
|
|
expect(forgedMessage.endsWith('… [truncated]')).toBe(true)
|
|
expect(Buffer.byteLength(forgedMessage, 'utf8')).toBe(maxValueBytes)
|
|
}, 15_000)
|
|
|
|
it('emits the marker alone when the cap is smaller than the marker itself', async () => {
|
|
// With maxValueBytes below the marker's own 15 bytes there is no room for
|
|
// message text; the marker still goes out, so the truncation stays reported
|
|
// instead of the diagnostic silently becoming empty. Both producers agree.
|
|
const { runtime } = await setup({ maxValueBytes: 4 })
|
|
const raised = await runtime.run({ program: 'raise ValueError("R" * 500)', bindings: [] })
|
|
expect(raised.error?.kind).toBe('exception')
|
|
expect(raised.error?.message).toBe('… [truncated]')
|
|
const forged = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":"F" * 500}}).encode() + b"\\n")',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(forged.error?.kind).toBe('exception')
|
|
expect(forged.error?.message).toBe('… [truncated]')
|
|
}, 15_000)
|
|
|
|
it('caps a forged done error.message without splitting a surrogate pair', async () => {
|
|
// At exactly maxValueBytes code units the prefix can end on a high
|
|
// surrogate whose low half sits just outside it. `Buffer.from` encodes that
|
|
// orphan as U+FFFD — the same corruption a mid-sequence byte cut causes —
|
|
// and those three replacement bytes sit past the marker-reserved budget, so
|
|
// the byte trim-back drops them.
|
|
const maxValueBytes = 32
|
|
const { runtime } = await setup({ maxValueBytes })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
// 32 ASCII chars then astral characters: code unit 32 is the first
|
|
// character's high surrogate (Python spells it as one code point, so
|
|
// json.dumps emits the raw 4 bytes the host reads back as a pair).
|
|
'msg = "A" * 32 + "\\U0001f600" * 4',
|
|
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
// 17 A's fill the marker-reserved budget; no orphaned half, no U+FFFD.
|
|
expect(result.error?.message).toBe(`${'A'.repeat(17)}… [truncated]`)
|
|
expect(Buffer.byteLength(result.error?.message ?? '', 'utf8')).toBe(maxValueBytes)
|
|
}, 8000)
|
|
|
|
it('returns a diagnostic under a third of the cap untouched, skipping the encode', async () => {
|
|
// Under maxValueBytes/3 code units a message cannot overflow the cap
|
|
// whatever it holds (3 bytes is the per-code-unit maximum), so the fast
|
|
// path returns it without encoding anything. Non-ASCII proves the bound is
|
|
// the code-unit count, not a byte assumption: 6 characters at 3 bytes each
|
|
// is 18 bytes, inside the 64-byte cap.
|
|
const { runtime } = await setup({ maxValueBytes: 64 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":"中文中文中文"}}).encode() + b"\\n")',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
expect(result.error?.message).toBe('中文中文中文')
|
|
}, 8000)
|
|
|
|
it('re-caps a forged done error.message host-side on a UTF-8 boundary', async () => {
|
|
// A forged done frame can carry an arbitrarily long error message; the
|
|
// host caps it to maxValueBytes and appends the shared marker. The
|
|
// message is emoji-dense and the cap is chosen so the marker-reserved
|
|
// 51-byte cut lands INSIDE a 4-byte sequence (one ASCII byte then 4-byte
|
|
// runs, so only a cut at 1 + 4k is aligned) — the cap must trim back to a
|
|
// code-point boundary rather than decode a replacement character, which
|
|
// would also exceed the cap.
|
|
const maxValueBytes = 66
|
|
const { runtime } = await setup({ maxValueBytes })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os, json',
|
|
'msg = "E" + "\\U0001f600" * 2000',
|
|
'os.write(3, json.dumps({"type":"done","error":{"kind":"exception","message":msg}}).encode() + b"\\n")',
|
|
'import time',
|
|
'time.sleep(5)',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('exception')
|
|
const message = result.error?.message ?? ''
|
|
expect(message.endsWith('… [truncated]')).toBe(true)
|
|
const marker = '… [truncated]'
|
|
const body = message.slice(0, message.length - marker.length)
|
|
// The WHOLE message, marker included, honors the cap.
|
|
expect(Buffer.byteLength(message, 'utf8')).toBeLessThanOrEqual(maxValueBytes)
|
|
// 'E' plus 12 emoji is 49 bytes: the trim-back walked the 51-byte budget
|
|
// down past two continuation bytes rather than splitting the 13th.
|
|
expect(body).toBe(`E${'\u{1f600}'.repeat(12)}`)
|
|
// The cut landed on a code-point boundary — no replacement character.
|
|
expect(body).not.toContain('\ufffd')
|
|
}, 8000)
|
|
|
|
it('bounds a single oversized newline-terminated line on fd 3', async () => {
|
|
// The same ceiling applies to one giant framed line. Write EXACTLY the
|
|
// ceiling with no newline — at the limit, not past it, so nothing trips —
|
|
// then a small newline tail, which is the chunk that crosses.
|
|
const ceiling = 256 * 1024 * 1024
|
|
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'chunk = b"A" * (8 * 1024 * 1024)',
|
|
`for _ in range(${ceiling / (8 * 1024 * 1024)}):`,
|
|
' os.write(3, chunk)',
|
|
'os.write(3, b"AAAA\\n")',
|
|
'return "never"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
|
|
}, 90_000)
|
|
|
|
it('rejects an over-ceiling fd-3 buffer without first joining it into one line', async () => {
|
|
// The ceiling has to be enforced on the byte COUNTER before Buffer.concat,
|
|
// not on the joined line afterwards: the join is a second copy of
|
|
// everything held, so a program could force roughly twice the advertised
|
|
// 256 MiB of host memory before anything rejected it.
|
|
//
|
|
// This program makes the two orders observably different rather than merely
|
|
// differently sized. It writes exactly the ceiling with no newline (at the
|
|
// limit, so nothing trips), then a newline followed by 8 MiB more. Checking
|
|
// the counter first sees more than the ceiling on the newline-bearing pipe
|
|
// chunk and rejects. Checking the joined line instead produced a FIRST LINE
|
|
// of exactly the ceiling — inside the per-line bound, so it passed as a junk
|
|
// frame — and left an 8 MiB residual well under the bound, so the breach was
|
|
// never reported: measured, the run settled as
|
|
// `python exited (code=0, signal=null) before completing` after the host had
|
|
// held the ceiling AND copied it, which is the doubling this check prevents.
|
|
const ceiling = 256 * 1024 * 1024
|
|
const { runtime } = await setup({ maxWallMs: 60_000, addressSpaceMb: 2048 })
|
|
const result = await runtime.run({
|
|
program: [
|
|
'import os',
|
|
'chunk = b"A" * (8 * 1024 * 1024)',
|
|
`for _ in range(${ceiling / (8 * 1024 * 1024)}):`,
|
|
' os.write(3, chunk)',
|
|
// One drain loop: a single os.write past the pipe buffer returns short,
|
|
// and a truncated tail would change which bytes cross the ceiling.
|
|
'view = memoryview(b"\\n" + b"B" * (8 * 1024 * 1024))',
|
|
'while view:',
|
|
' view = view[os.write(3, view):]',
|
|
'return "never"',
|
|
].join('\n'),
|
|
bindings: [],
|
|
})
|
|
expect(result.value).toBeUndefined()
|
|
expect(result.error?.kind).toBe('worker-exit')
|
|
expect(result.error?.message).toContain(`protocol frame exceeded ${ceiling} bytes`)
|
|
}, 120_000)
|
|
|
|
})
|