DongHyeonkaandClaude Opus 5
dfb7734674
The provider sandbox never ran. bubblewrap 0.9.0 stops parsing an `--args` file at the first non-option and never hands the remainder back, so the command written into that file was silently dropped: bwrap printed its usage text, exited 1, and the provider produced no evidence at all. The options still travel in the args file — that is what keeps host paths and credentials out of `/proc/<pid>/cmdline` — but the command now rides on real argv, and `encodeProviderBwrapInput` refuses a `--` so the drop cannot come back. The scope wrapper then could not exit. It read the supervisor's liveness pipe through `fs`, which runs a blocking `read(2)` on a threadpool thread; the supervisor holds that pipe open for the scope's whole life, so the read never returned and closing the descriptor did not interrupt it. Once bubblewrap finished the wrapper deadlocked in `process.exit`, the scope outlived the provider, and a completed run was reported as a timeout kill. The channel is now read through the event loop, so teardown is observable and terminal. Creation modes were left to the ambient umask. `mkdir(mode)` and `open(mode)` are requests the kernel subtracts the umask from, so a runner exporting a restrictive umask produced directories it could not enter and handed `tar` a file it could not re-open. Private modes are pinned instead of inherited. Promotion cleanup deleted before it checked. Removals run through a pinned descriptor, so a leaf substituted after validation had this promotion's exact five destroyed first and the substitution reported afterwards, leaving a half-emptied directory a retry could not tell from a completed one. The name is re-bound to the inode before anything is removed, so the failure is total. Separately, release coherence proved the artifacts agreed with each other but never that they belonged where they were going: a build whose runtime document said `APP_ENV: local`, `AUTH_MODE: demo` and a loopback API is coherent with itself and passed every gate. `public/` is copied verbatim into `dist/`, so that local document shipped with every build regardless of what the build was for. Runtime configuration now comes from a declared profile, and FE-GATE-027 refuses to admit an artifact to an environment it does not match — including refusing an undeclared destination, so nothing is admitted by omission. `REQUEST_TIMEOUT_MS` and `VITE_ROUTER_BASE_PATH` were validated and then dropped: the V3 executor ran every operation on its contract's own deadline, and Vite emitted root-absolute assets for a sub-path deployment. The timeout is now a ceiling that may tighten a contract but never loosen one, and one base path feeds the router, the Service Worker scope and the asset base together. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
94 lines
3.5 KiB
TypeScript
94 lines
3.5 KiB
TypeScript
import { readFile, writeFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import process from "node:process";
|
|
|
|
import {
|
|
DEPLOYMENT_TARGETS,
|
|
isDeploymentTarget,
|
|
type DeploymentTarget,
|
|
} from "../src/contracts/deployment-admission.ts";
|
|
import { runtimeConfigV2ArtifactSchema } from "../src/contracts/release-artifacts.ts";
|
|
|
|
/**
|
|
* §6.4. Materializes `dist/config.json` from the profile the build declares.
|
|
*
|
|
* `public/` is copied verbatim into `dist/`, so before this step the runtime
|
|
* document that shipped with every build was the local one — `APP_ENV: local`,
|
|
* `AUTH_MODE: demo`, a loopback API — regardless of what the build was for.
|
|
* The profile is the source of truth instead, and the only values a deployment
|
|
* may inject are the ones it actually owns: its endpoints and its identity.
|
|
*
|
|
* The result is validated against the same V2 schema the browser will apply, so
|
|
* an override cannot produce a document that only fails at boot.
|
|
*/
|
|
|
|
const PROFILE_DIRECTORY = "config/runtime";
|
|
const OUTPUT_PATH = "dist/config.json";
|
|
|
|
/**
|
|
* Deployment-supplied values. Everything else is fixed by the profile so a
|
|
* deployment cannot quietly widen what was reviewed.
|
|
*/
|
|
const OVERRIDES = Object.freeze({
|
|
API_BASE_URL: "RUNTIME_API_BASE_URL",
|
|
TELEMETRY_ENDPOINT: "RUNTIME_TELEMETRY_ENDPOINT",
|
|
} as const);
|
|
|
|
export async function generateRuntimeConfig(
|
|
target: DeploymentTarget,
|
|
environment: NodeJS.ProcessEnv = process.env,
|
|
): Promise<Record<string, unknown>> {
|
|
const profilePath = path.join(PROFILE_DIRECTORY, `${target}.json`);
|
|
const source: unknown = JSON.parse(await readFile(profilePath, "utf8"));
|
|
if (source === null || typeof source !== "object" || Array.isArray(source)) {
|
|
throw new TypeError(`${profilePath}: runtime profile must be an object`);
|
|
}
|
|
const draft: Record<string, unknown> = { ...(source as Record<string, unknown>) };
|
|
if (draft["APP_ENV"] !== target) {
|
|
throw new Error(
|
|
`${profilePath}: declares APP_ENV ${String(draft["APP_ENV"])}, expected ${target}`,
|
|
);
|
|
}
|
|
for (const [field, variable] of Object.entries(OVERRIDES)) {
|
|
const supplied = environment[variable];
|
|
if (supplied !== undefined && supplied !== "") draft[field] = supplied;
|
|
}
|
|
const buildId = environment["VITE_BUILD_ID"] ?? "local-build";
|
|
const releaseId = environment["RELEASE_ID"] ?? "local-release";
|
|
draft["BUILD_ID"] = buildId;
|
|
draft["RELEASE_ID"] = releaseId;
|
|
|
|
const parsed = runtimeConfigV2ArtifactSchema.safeParse(draft);
|
|
if (!parsed.success) {
|
|
const issues = parsed.error.issues
|
|
.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`)
|
|
.join("\n ");
|
|
throw new Error(`${profilePath}: runtime config is invalid\n ${issues}`);
|
|
}
|
|
return draft;
|
|
}
|
|
|
|
function resolveTarget(environment: NodeJS.ProcessEnv): DeploymentTarget {
|
|
const declared = environment["APP_PROFILE"] ?? "local";
|
|
if (!isDeploymentTarget(declared)) {
|
|
throw new Error(
|
|
`APP_PROFILE must be one of ${DEPLOYMENT_TARGETS.join(", ")}; received ${declared}`,
|
|
);
|
|
}
|
|
return declared;
|
|
}
|
|
|
|
async function main(): Promise<void> {
|
|
const target = resolveTarget(process.env);
|
|
const config = await generateRuntimeConfig(target);
|
|
await writeFile(OUTPUT_PATH, `${JSON.stringify(config, null, 2)}\n`, "utf8");
|
|
process.stdout.write(
|
|
`runtime config: ${target} profile written to ${OUTPUT_PATH} ` +
|
|
`(APP_ENV=${String(config["APP_ENV"])}, AUTH_MODE=${String(config["AUTH_MODE"])})\n`,
|
|
);
|
|
}
|
|
|
|
if (process.argv[1] && import.meta.url.endsWith(path.basename(process.argv[1]))) {
|
|
await main();
|
|
}
|