mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-11 13:46:32 +03:00
Paul BakausandGitHub
a8ce5962d3
* Fix silent launcher setup failures Report cache creation, cache write, and download failures with recovery guidance while preserving lazy engine downloads. AI-assisted by Codex. * Fix Windows staging-write failure handling Branch directly on redirection failure and reject staging directories before cleanup. Add coverage for an existing read-only staging file. AI-assisted by Codex.
199 lines
11 KiB
JavaScript
199 lines
11 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { spawn } from 'node:child_process';
|
|
import { createHash } from 'node:crypto';
|
|
import fs from 'node:fs';
|
|
import http from 'node:http';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { test } from 'node:test';
|
|
|
|
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
|
|
const WINDOWS = process.platform === 'win32';
|
|
const COMSPEC = process.env.ComSpec || process.env.COMSPEC || 'C:\\Windows\\System32\\cmd.exe';
|
|
// Use the host's command interpreter as a harmless Windows executable. No
|
|
// downloaded release binary is executed, and all network traffic is loopback.
|
|
const PAYLOAD = WINDOWS ? fs.readFileSync(COMSPEC) : Buffer.from('#!/bin/sh\necho verified-engine\n');
|
|
const HASH = createHash('sha256').update(PAYLOAD).digest('hex');
|
|
|
|
async function exercise(t, scenario) {
|
|
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'impeccable-launcher-'));
|
|
t.after(() => fs.rmSync(root, { recursive: true, force: true }));
|
|
const scripts = path.join(root, 'skill scripts');
|
|
const home = path.join(root, 'home');
|
|
const cache = path.join(root, 'cache');
|
|
fs.mkdirSync(scripts);
|
|
fs.mkdirSync(home);
|
|
fs.writeFileSync(path.join(scripts, 'VERSION'), '0.0.0-test\n');
|
|
const name = WINDOWS ? 'impeccable.cmd' : 'impeccable';
|
|
const launcher = path.join(scripts, name);
|
|
fs.copyFileSync(path.join(ROOT, 'skill/scripts', name), launcher);
|
|
const cacheDir = path.join(cache, 'bin', '0.0.0-test');
|
|
if (scenario === 'cache-directory-failure') {
|
|
// A file where the cache parent belongs makes mkdir fail on every OS,
|
|
// including privileged test runners where chmod cannot deny writes.
|
|
fs.mkdirSync(cache);
|
|
fs.writeFileSync(path.join(cache, 'bin'), 'blocked');
|
|
}
|
|
if (scenario === 'cache-write-failure') {
|
|
fs.mkdirSync(cacheDir, { recursive: true });
|
|
if (WINDOWS) fs.mkdirSync(path.join(cacheDir, 'impeccable.exe.part'));
|
|
}
|
|
if (scenario === 'cache-readonly-file') {
|
|
fs.mkdirSync(cacheDir, { recursive: true });
|
|
const staging = path.join(cacheDir, 'impeccable.exe.part');
|
|
fs.writeFileSync(staging, 'read-only');
|
|
fs.chmodSync(staging, 0o444);
|
|
}
|
|
const tools = path.join(root, 'tools');
|
|
fs.mkdirSync(tools);
|
|
if (!WINDOWS && scenario === 'cache-write-failure') {
|
|
// The POSIX staging name contains the launcher's PID, so intercept the
|
|
// preceding mkdir to place a directory at precisely that file path.
|
|
fs.writeFileSync(path.join(tools, 'mkdir'), '#!/bin/sh\n/bin/mkdir "$@" || exit $?\n/bin/mkdir "$IMPECCABLE_HOME/bin/0.0.0-test/.impeccable.part.$PPID"\n', { mode: 0o755 });
|
|
}
|
|
if (!WINDOWS && ['hash-failure', 'removed-during-hash'].includes(scenario)) {
|
|
fs.writeFileSync(path.join(tools, 'shasum'),
|
|
`#!/bin/sh\n${scenario === 'removed-during-hash' ? 'rm -f "$3"\n' : ''}printf '%s %s\\n' '${HASH}' "$3"\nexit ${scenario === 'hash-failure' ? 1 : 0}\n`,
|
|
{ mode: 0o755 });
|
|
}
|
|
const placementScenarios = ['removed-before-move', 'removed-after-move', 'emptied-after-move', 'move-failure'];
|
|
if (!WINDOWS && placementScenarios.includes(scenario)) {
|
|
const before = scenario === 'removed-before-move' ? 'rm -f "$2"\n' : '';
|
|
const after = scenario === 'removed-after-move' ? 'rm -f "$3"\n' : scenario === 'emptied-after-move' ? ': > "$3"\n' : '';
|
|
fs.writeFileSync(path.join(tools, 'mv'), scenario === 'move-failure' ? '#!/bin/sh\nexit 1\n' : `#!/bin/sh\n${before}/bin/mv "$@" || exit $?\n${after}`, { mode: 0o755 });
|
|
}
|
|
if (WINDOWS && (placementScenarios.includes(scenario) || ['hash-failure', 'removed-during-hash'].includes(scenario))) {
|
|
// move is a cmd builtin and certutil is an .exe: PATH shims cannot
|
|
// intercept them. Instrument ONLY the external-operation boundary in the
|
|
// staged test copy, preserving the launcher's real labels/checks/status
|
|
// handling. The separate valid case always runs the unmodified launcher.
|
|
const fault = path.join(tools, 'fault.cmd');
|
|
const hashFault = ['hash-failure', 'removed-during-hash'].includes(scenario);
|
|
const operation = hashFault
|
|
? 'certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul'
|
|
: 'move /y "%cached%.part" "%cached%" >nul 2>nul';
|
|
let script;
|
|
if (hashFault) {
|
|
script = `@echo off\n${scenario === 'removed-during-hash' ? 'del "%cached%.part" >nul 2>nul\n' : ''}echo hash header\necho ${HASH}\nexit /b 1\n`;
|
|
} else if (scenario === 'move-failure') {
|
|
script = '@echo off\nexit /b 1\n';
|
|
} else {
|
|
const before = scenario === 'removed-before-move' ? 'del "%cached%.part" >nul 2>nul\n' : '';
|
|
const after = scenario === 'removed-after-move' ? 'del "%cached%" >nul 2>nul\n' : scenario === 'emptied-after-move' ? 'type nul >"%cached%"\n' : '';
|
|
script = `@echo off\n${before}${operation}\nif errorlevel 1 exit /b 1\n${after}exit /b 0\n`;
|
|
}
|
|
fs.writeFileSync(fault, script.replaceAll('\n', '\r\n'));
|
|
const source = fs.readFileSync(launcher, 'utf8');
|
|
assert.equal(source.split(operation).length, 2, 'instrument exactly one operation');
|
|
const replacement = `call "${fault}"${hashFault ? ' >"%cached%.sha256" 2>nul' : ''}`;
|
|
fs.writeFileSync(launcher, source.replace(operation, replacement));
|
|
}
|
|
const requests = [];
|
|
const server = http.createServer((req, res) => {
|
|
requests.push(req.url);
|
|
if (scenario === 'transport-failure') {
|
|
req.socket.destroy();
|
|
return;
|
|
}
|
|
if (req.url.endsWith('.sha256')) {
|
|
const part = fs.readdirSync(cacheDir).find(file => file.includes('.part'));
|
|
if (scenario === 'removed') fs.unlinkSync(path.join(cacheDir, part));
|
|
if (scenario === 'emptied') fs.truncateSync(path.join(cacheDir, part));
|
|
res.writeHead(scenario === 'no-sidecar' ? 404 : 200);
|
|
res.end(scenario === 'empty-sidecar' ? '' : `${scenario === 'mismatch' ? '0'.repeat(64) : HASH} engine\n`);
|
|
} else {
|
|
if (scenario === 'download-failure') res.writeHead(404);
|
|
res.end(scenario === 'empty-download' ? '' : PAYLOAD);
|
|
}
|
|
});
|
|
await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
|
|
t.after(() => new Promise(resolve => server.close(resolve)));
|
|
// Keep system tools, but exclude user/npm PATH candidates and all launcher
|
|
// overrides so the test cannot accidentally execute an installed engine.
|
|
const env = {
|
|
PATH: WINDOWS ? `${process.env.SystemRoot}\\System32;${process.env.SystemRoot}` : `${tools}:/usr/bin:/bin`,
|
|
HOME: home, USERPROFILE: home, TEMP: root, TMP: root,
|
|
IMPECCABLE_HOME: cache,
|
|
IMPECCABLE_DOWNLOAD_BASE: `http://127.0.0.1:${server.address().port}`,
|
|
...(WINDOWS ? { SystemRoot: process.env.SystemRoot, ComSpec: COMSPEC, PROCESSOR_ARCHITECTURE: 'AMD64' } : {}),
|
|
};
|
|
const run = () => new Promise((resolve, reject) => {
|
|
const child = WINDOWS
|
|
? spawn(COMSPEC, ['/d', '/s', '/c', `""${launcher}" /d /c echo verified-engine"`], { env, cwd: root, windowsVerbatimArguments: true, timeout: 20000 })
|
|
: spawn('/bin/sh', [launcher], { env, cwd: root, timeout: 20000 });
|
|
let stdout = '';
|
|
let stderr = '';
|
|
child.stdout.on('data', data => { stdout += data; });
|
|
child.stderr.on('data', data => { stderr += data; });
|
|
child.on('error', reject);
|
|
child.on('close', (status, signal) => resolve({ status, signal, stdout, stderr }));
|
|
});
|
|
const result = await run();
|
|
if (scenario === 'valid') {
|
|
const requestCount = requests.length;
|
|
const cachedResult = await run();
|
|
assert.equal(cachedResult.status, 0, cachedResult.stderr);
|
|
assert.match(cachedResult.stdout, /verified-engine/);
|
|
assert.equal(cachedResult.stderr, '', 'cached execution stays quiet');
|
|
assert.equal(requests.length, requestCount, 'subsequent runs use the cached engine without network');
|
|
}
|
|
assert.equal(result.signal, null, JSON.stringify(result));
|
|
const cacheFailure = scenario.startsWith('cache-');
|
|
assert.equal(requests.filter(url => !url.endsWith('.sha256')).length, cacheFailure ? 0 : 1,
|
|
'cache failures do not attempt a download; other scenarios download once');
|
|
return { ...result, files: fs.existsSync(cacheDir) ? fs.readdirSync(cacheDir) : [], requests, cacheDir };
|
|
}
|
|
|
|
for (const scenario of ['cache-directory-failure', 'cache-write-failure', 'download-failure', 'transport-failure', ...(WINDOWS ? ['cache-readonly-file'] : [])]) {
|
|
test(`launcher explains ${scenario} and how to retry setup`, async t => {
|
|
const result = await exercise(t, scenario);
|
|
assert.equal(result.status, 127, JSON.stringify(result));
|
|
assert.doesNotMatch(result.stdout, /verified-engine/);
|
|
assert.match(result.stderr, /engine 0\.0\.0-test/);
|
|
assert.ok(result.stderr.includes(result.cacheDir), result.stderr);
|
|
assert.match(result.stderr, /engine-probe/);
|
|
assert.match(result.stderr, /IMPECCABLE_HOME/);
|
|
assert.match(result.stderr, /IMPECCABLE_BIN/);
|
|
if (['download-failure', 'transport-failure'].includes(scenario)) {
|
|
assert.match(result.stderr, /could not download/);
|
|
assert.match(result.stderr, /network/);
|
|
assert.deepEqual(result.files, [], 'failed downloads leave no staging files');
|
|
assert.equal(result.requests.length, 1, 'no verification without a download');
|
|
} else {
|
|
assert.match(result.stderr, scenario === 'cache-directory-failure' ? /cannot create/ : /cannot write/);
|
|
}
|
|
});
|
|
}
|
|
|
|
test('launcher downloads and runs a verified executable', async t => {
|
|
const result = await exercise(t, 'valid');
|
|
assert.equal(result.status, 0, result.stderr);
|
|
assert.match(result.stdout, /verified-engine/);
|
|
assert.deepEqual(result.files, [WINDOWS ? 'impeccable.exe' : 'impeccable']);
|
|
assert.equal(result.requests.length, 2);
|
|
});
|
|
|
|
for (const scenario of ['removed', 'emptied', 'empty-download', 'no-sidecar', 'empty-sidecar', 'mismatch', 'hash-failure', 'removed-during-hash', 'removed-before-move', 'removed-after-move', 'emptied-after-move', 'move-failure']) {
|
|
test(`launcher refuses ${scenario} with an accurate diagnostic`, async t => {
|
|
const result = await exercise(t, scenario);
|
|
assert.equal(result.status, 127, JSON.stringify(result));
|
|
assert.doesNotMatch(result.stdout, /verified-engine/);
|
|
assert.deepEqual(result.files, [], 'no unverified file or sidecar left behind');
|
|
if (scenario.startsWith('removed')) {
|
|
assert.match(result.stderr, /download completed but the file was removed before (verification|execution)/);
|
|
assert.match(result.stderr, /antivirus.*logs/i);
|
|
assert.doesNotMatch(result.stderr, /checksum mismatch/);
|
|
} else if (scenario.startsWith('emptied') || scenario === 'empty-download') {
|
|
assert.match(result.stderr, /downloaded file is empty/);
|
|
assert.doesNotMatch(result.stderr, /checksum mismatch/);
|
|
} else if (scenario === 'mismatch') {
|
|
assert.match(result.stderr, /checksum mismatch/);
|
|
} else if (scenario === 'move-failure') {
|
|
assert.match(result.stderr, /could not cache the verified download/);
|
|
} else {
|
|
assert.match(result.stderr, /refusing the unverified download/);
|
|
}
|
|
});
|
|
}
|