CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 18:05:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)

Browse Source 
* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>
This commit is contained in:
Garry Tan
2026-09-14 15:14:58 -07:00
committed by GitHub
co-authored by OpenAI Codex
parent 9f81911136
commit 4a3c6a8a3c
160 changed files with 24697 additions and 2288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/setup-needs-build.test.ts
+137 -7
View File
@@ -1,8 +1,9 @@
/**
* setup: the NEEDS_BUILD decision ("# 1. Build browse binary if needed").
*
* One `bun run build` produces every binary (browse, design, make-pdf), so a
* missing or stale one of ANY of them must trigger the whole build. Before,
* Direct `bun run build` produces every binary. Setup includes CSO when its
* host capability probe succeeds, and otherwise builds the general binaries
* while removing CSO artifacts so /cso fails closed. Before,
* only the browse binary's existence was checked and lib/ was not in the
* staleness set: a missing design/dist/design or make-pdf/dist/pdf, or an edit
* to lib/ (the canonical claude-bin / error-handling / aside-render sources the
@@ -22,12 +23,16 @@ import { runBashScript } from './helpers/bash-script';
const ROOT = path.resolve(import.meta.dir, '..');
const SETUP_SRC = fs.readFileSync(path.join(ROOT, 'setup'), 'utf-8');
const BUILD_SRC = fs.readFileSync(path.join(ROOT, 'scripts/build.sh'), 'utf-8');
const CSO_BUILD_SRC = fs.readFileSync(path.join(ROOT, 'scripts/build-cso.sh'), 'utf-8');
// From the $_EXE suffix derivation through the `fi` that closes the staleness
// chain. The statement that follows (the build itself) is the end anchor and is
// NOT included, so the harness never tries to run `bun run build`.
const BLOCK_START = '_EXE=""';
const BLOCK_END = '\nif [ "$NEEDS_BUILD" -eq 1 ]; then';
const CSO_SWITCH_START = 'if [ "${GSTACK_SETUP_RUNNING:-0}" = "1" ] && [ "${GSTACK_SETUP_SKIP_CSO_BUILD:-0}" = "1" ]; then';
const CSO_SWITCH_END = '\nbash browse/scripts/build-node-server.sh';
function needsBuildBlock(): string {
const start = SETUP_SRC.indexOf(BLOCK_START);
@@ -36,9 +41,17 @@ function needsBuildBlock(): string {
return SETUP_SRC.slice(start, end + 1);
}
function csoBuildSwitchBlock(): string {
const start = BUILD_SRC.indexOf(CSO_SWITCH_START);
const end = BUILD_SRC.indexOf(CSO_SWITCH_END, start);
if (start < 0 || end < 0) throw new Error('Could not locate the setup-private CSO build switch');
return BUILD_SRC.slice(start, end);
}
// Fixed instants, far apart, so coarse filesystem timestamps and clock skew
// can never blur "older than the binary" into "newer".
const BIN_T = new Date('2024-06-01T12:00:00Z');
const STAMP_T = new Date('2024-07-01T12:00:00Z');
const OLD_T = new Date('2024-01-01T12:00:00Z');
const NEW_T = new Date('2024-12-01T12:00:00Z');
@@ -50,6 +63,10 @@ const SOURCE_FILES = [
'lib/claude-bin.ts',
'package.json',
'bun.lock',
'scripts/build.sh',
'scripts/build-cso.sh',
'scripts/build-cso-windows.ps1',
'lib/cso/launcher.c',
];
const tmpDirs: string[] = [];
@@ -76,7 +93,19 @@ function makeTree(opts: { exe?: string } = {}): string {
writeAt(path.join(dir, 'browse/dist/browse'), BIN_T, 0o755);
writeAt(path.join(dir, `design/dist/design${exe}`), BIN_T, 0o755);
writeAt(path.join(dir, `make-pdf/dist/pdf${exe}`), BIN_T, 0o755);
writeAt(path.join(dir, `bin/gstack-cso-core${exe}`), BIN_T, 0o755);
writeAt(path.join(dir, `bin/gstack-cso-launcher${exe}`), BIN_T, 0o755);
const generation = path.join(dir, 'bin/.gstack-cso-generation');
fs.writeFileSync(generation, `${'a'.repeat(64)}\n`, { mode: 0o600 });
fs.utimesSync(generation, BIN_T, BIN_T);
if (exe) {
const generationLock = path.join(dir, 'bin/.gstack-cso-generation.lock');
fs.writeFileSync(generationLock, '', { mode: 0o600 });
fs.utimesSync(generationLock, BIN_T, BIN_T);
}
if (!exe) writeAt(path.join(dir, 'bin/gstack-cso-watchdog'), BIN_T, 0o755);
for (const f of SOURCE_FILES) writeAt(path.join(dir, f), OLD_T);
writeAt(path.join(dir, 'browse/dist/.build-complete'), STAMP_T);
return dir;
}
@@ -84,12 +113,13 @@ function touchNewer(dir: string, rel: string): void {
writeAt(path.join(dir, rel), NEW_T);
}
function decide(dir: string, opts: { isWindows?: '0' | '1' } = {}): number {
function decide(dir: string, opts: { isWindows?: '0' | '1'; csoAvailable?: '0' | '1' } = {}): number {
const script = [
'set -e',
`SOURCE_GSTACK_DIR="${dir}"`,
'BROWSE_BIN="$SOURCE_GSTACK_DIR/browse/dist/browse"',
`IS_WINDOWS=${opts.isWindows ?? '0'}`,
`CSO_BUILD_AVAILABLE=${opts.csoAvailable ?? '1'}`,
needsBuildBlock(),
'echo "NEEDS_BUILD=$NEEDS_BUILD"',
].join('\n');
@@ -113,12 +143,62 @@ describe('setup: NEEDS_BUILD static invariants', () => {
expect(block).not.toContain('bun_cmd run build');
});
test('all three binaries are existence-checked with -x and the $_EXE suffix', () => {
test('all required binaries are existence-checked with -x and the $_EXE suffix', () => {
const block = needsBuildBlock();
expect(block).toContain('[ ! -x "$BROWSE_BIN" ]');
expect(block).toContain('[ ! -x "$SOURCE_GSTACK_DIR/design/dist/design$_EXE" ]');
expect(block).toContain('[ ! -x "$SOURCE_GSTACK_DIR/make-pdf/dist/pdf$_EXE" ]');
expect(block).toContain('if [ "$IS_WINDOWS" -eq 1 ]; then _EXE=".exe"; fi');
expect(block).toContain('if [ "$CSO_BUILD_AVAILABLE" -eq 1 ]; then');
});
test('setup owns the only CSO build escape hatch and probes Bun hardening flags', () => {
for (const flag of ['dotenv', 'bunfig', 'tsconfig', 'package-json']) {
expect(SETUP_SRC).toContain(`--no-compile-autoload-${flag}`);
}
expect(SETUP_SRC).toContain('probe_cso_build_prerequisites');
expect(BUILD_SRC).toContain('[ "${GSTACK_SETUP_RUNNING:-0}" = "1" ]');
expect(BUILD_SRC).toContain('[ "${GSTACK_SETUP_SKIP_CSO_BUILD:-0}" = "1" ]');
expect(BUILD_SRC).toContain('BUN_CMD="$BUN_CMD" bash scripts/build-cso.sh');
});
test('the skip flag alone cannot weaken a direct build; setup can omit and purge CSO', () => {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-cso-build-switch-'));
tmpDirs.push(dir);
for (const sub of ['bin', 'scripts']) fs.mkdirSync(path.join(dir, sub), { recursive: true });
for (const name of ['gstack-cso-launcher', 'gstack-cso-launcher.exe', 'gstack-cso-core', 'gstack-cso-core.exe', 'gstack-cso-watchdog']) {
writeAt(path.join(dir, 'bin', name), BIN_T, 0o755);
}
const strict = path.join(dir, 'scripts/build-cso.sh');
fs.writeFileSync(strict, '#!/bin/sh\nprintf called > cso-called\n');
fs.chmodSync(strict, 0o755);
let result = runBashScript(`set -e\n${csoBuildSwitchBlock()}`, {
cwd: dir, env: { ...process.env, GSTACK_SETUP_SKIP_CSO_BUILD: '1' },
});
expect(result.status).toBe(0);
expect(fs.existsSync(path.join(dir, 'cso-called'))).toBe(true);
fs.unlinkSync(path.join(dir, 'cso-called'));
result = runBashScript(`set -e\n${csoBuildSwitchBlock()}`, {
cwd: dir, env: { ...process.env, GSTACK_SETUP_RUNNING: '1', GSTACK_SETUP_SKIP_CSO_BUILD: '1' },
});
expect(result.status).toBe(0);
expect(fs.existsSync(path.join(dir, 'cso-called'))).toBe(false);
expect(fs.readdirSync(path.join(dir, 'bin')).filter(name => name.startsWith('gstack-cso-'))).toEqual([]);
});
test('the whole-build stamp is invalidated before compilation and published only after every output succeeds', () => {
const invalidate = BUILD_SRC.indexOf('rm -f "$BUILD_STAMP" "$BUILD_STAMP_TMP"');
const firstBuild = BUILD_SRC.indexOf('"$BUN_CMD" run vendor:xterm');
const csoBuild = BUILD_SRC.indexOf('BUN_CMD="$BUN_CMD" bash scripts/build-cso.sh');
const publish = BUILD_SRC.indexOf('mv -f "$BUILD_STAMP_TMP" "$BUILD_STAMP"');
expect(invalidate).toBeGreaterThan(-1);
expect(firstBuild).toBeGreaterThan(invalidate);
expect(csoBuild).toBeGreaterThan(firstBuild);
expect(publish).toBeGreaterThan(csoBuild);
expect(BUILD_SRC.slice(publish + 1)).not.toContain('"$BUN_CMD" build');
expect(CSO_BUILD_SRC).toContain('rm -f "$CSO_BUILD_ROOT/browse/dist/.build-complete"');
});
test('the staleness find walks every embedded source root, lib/ included', () => {
@@ -126,9 +206,9 @@ describe('setup: NEEDS_BUILD static invariants', () => {
for (const root of ['browse/src', 'make-pdf/src', 'design/src', 'lib']) {
expect(block).toContain(`"$SOURCE_GSTACK_DIR/${root}"`);
}
expect(block).toContain('-type f -newer "$BROWSE_BIN"');
expect(block).toContain('"$SOURCE_GSTACK_DIR/package.json" -nt "$BROWSE_BIN"');
expect(block).toContain('[ -f "$SOURCE_GSTACK_DIR/bun.lock" ] && [ "$SOURCE_GSTACK_DIR/bun.lock" -nt "$BROWSE_BIN" ]');
expect(block).toContain('-type f -newer "$BUILD_STAMP"');
expect(block).toContain('"$SOURCE_GSTACK_DIR/package.json" -nt "$BUILD_STAMP"');
expect(block).toContain('[ -f "$SOURCE_GSTACK_DIR/bun.lock" ] && [ "$SOURCE_GSTACK_DIR/bun.lock" -nt "$BUILD_STAMP" ]');
});
});
@@ -137,6 +217,16 @@ describe('setup: NEEDS_BUILD decision executes', () => {
expect(decide(makeTree())).toBe(0);
});
test('an interrupted partial build cannot let a refreshed browse binary hide stale CSO outputs', () => {
const dir = makeTree();
fs.unlinkSync(path.join(dir, 'browse/dist/.build-complete'));
writeAt(path.join(dir, 'browse/dist/browse'), NEW_T, 0o755);
expect(fs.statSync(path.join(dir, 'bin/gstack-cso-core')).mtimeMs).toBeLessThan(
fs.statSync(path.join(dir, 'browse/dist/browse')).mtimeMs,
);
expect(decide(dir)).toBe(1);
});
test('make-pdf/dist/pdf missing → 1 (was: not checked at all)', () => {
const dir = makeTree();
fs.unlinkSync(path.join(dir, 'make-pdf/dist/pdf'));
@@ -155,6 +245,46 @@ describe('setup: NEEDS_BUILD decision executes', () => {
expect(decide(dir)).toBe(1);
});
test.each(['bin/gstack-cso-launcher','bin/gstack-cso-core', 'bin/gstack-cso-watchdog'])('%s missing → 1', binary => {
const dir = makeTree();
fs.unlinkSync(path.join(dir, binary));
expect(decide(dir)).toBe(1);
});
test('CSO generation manifest missing → 1', () => {
const dir = makeTree();
fs.unlinkSync(path.join(dir, 'bin/.gstack-cso-generation'));
expect(decide(dir)).toBe(1);
});
test('Windows CSO generation lock missing → 1', () => {
const dir = makeTree({ exe: '.exe' });
fs.unlinkSync(path.join(dir, 'bin/.gstack-cso-generation.lock'));
expect(decide(dir, { isWindows: '1' })).toBe(1);
});
test('unavailable CSO removes stale helpers and does not force a repeat build', () => {
const dir = makeTree();
expect(decide(dir, { csoAvailable: '0' })).toBe(0);
for (const binary of ['bin/gstack-cso-launcher', 'bin/gstack-cso-core', 'bin/gstack-cso-watchdog', 'bin/.gstack-cso-generation']) {
expect(fs.existsSync(path.join(dir, binary))).toBe(false);
}
});
test('unavailable CSO ignores its build-script freshness but still rebuilds missing general binaries', () => {
const dir = makeTree();
touchNewer(dir, 'scripts/build-cso.sh');
expect(decide(dir, { csoAvailable: '0' })).toBe(0);
fs.unlinkSync(path.join(dir, 'design/dist/design'));
expect(decide(dir, { csoAvailable: '0' })).toBe(1);
});
test.each(['scripts/build.sh', 'scripts/build-cso.sh', 'scripts/build-cso-windows.ps1', 'lib/cso/launcher.c'])('%s changed → 1', source => {
const dir = makeTree();
touchNewer(dir, source);
expect(decide(dir)).toBe(1);
});
// MSYS bash has no execute bit: `[ -x file ]` is true for any regular file, so
// this case is POSIX-only.
test.skipIf(process.platform === 'win32')('a binary that exists but is not executable counts as missing → 1', () => {